Issues connecting with an Energy meter through MODBUS

keristos · Jan 21, 2016

Hi guys, here's a little description of the issues I'm having.

This is not the first time I am using MODBUS to connect with devices, I do it very often. Any help would be appreciated!

I am trying to connect to a BTcino F41TMA energy meter through MODBUS. After various failed attempts to connect using a PLC I tried to connect the energy meter to a USB to RS485 converter directly with my Laptop. This allows me to manually send messages to any MODBUS device.

I input the parameters in the software to match those set on the device and started transmitting;
Address: 7
Baud Rate: 9600
Parity: None
Register Address: 4097
Function: 3

The result I got was [00], an ‘illegal response’.

I changed the Register address multiple times using: 96, 4096, 97, 4097, 100, 4100.
I also changed the Baud Rate on both the device and my laptop from 9600 to 19200.
The Function was also changed between 3 and 4.
Switching the Modbus wires or disconnecting the Modbus cable completely results in a ‘time-out’ and hence this led me to believe that the connection is in fact correct but the device seems to be returning an illegal response.

This link leads to screenshots of the software.

This link is for the MODBUS Table of the device.

Thank you,
Patrick

tragically1969 · Jan 21, 2016

keristos said:
Hi guys, here's a little description of the issues I'm having.

This is not the first time I am using MODBUS to connect with devices, I do it very often. Any help would be appreciated!

I am trying to connect to a BTcino F41TMA energy meter through MODBUS. After various failed attempts to connect using a PLC I tried to connect the energy meter to a USB to RS485 converter directly with my Laptop. This allows me to manually send messages to any MODBUS device.

I input the parameters in the software to match those set on the device and started transmitting;
Address: 7
Baud Rate: 9600
Parity: None
Register Address: 4097
Function: 3

The result I got was [00], an ‘illegal response’.

I changed the Register address multiple times using: 96, 4096, 97, 4097, 100, 4100.
I also changed the Baud Rate on both the device and my laptop from 9600 to 19200.
The Function was also changed between 3 and 4.
Switching the Modbus wires or disconnecting the Modbus cable completely results in a ‘time-out’ and hence this led me to believe that the connection is in fact correct but the device seems to be returning an illegal response.

This link leads to screenshots of the software.

This link is for the MODBUS Table of the device.

Thank you,
Patrick

Don't know the slave but is it defined that the registers are input registers ?

Try the data type as holding registers.......

Actually, ignore that, just re-read your post.

Steve Bailey · Jan 21, 2016

The Modbus map for the addresses 4096 through 4180 shows a length of 2, while the power factor at address 4182 shows a length of 1 even though both are listed as unsigned integers. When you were trying to read address 4096, did you use the correct length? It should have been 2 words.

keristos · Jan 21, 2016

Steve Bailey said:
The Modbus map for the addresses 4096 through 4180 shows a length of 2, while the power factor at address 4182 shows a length of 1 even though both are listed as unsigned integers. When you were trying to read address 4096, did you use the correct length? It should have been 2 words.

Yes I tried changing the length, it should work nonetheless, it just wouldn't make sense as a value. I believe reading 1 or 2 or 5 registers doesn't make a difference as long as the registers exist. Correct me if I'm wrong.

Thank you

Steve Bailey · Jan 21, 2016

I agree, the length should not matter as long as the registers exist. However, the slave may have rejected the request if you asked for one word of data when the variable you're trying to read is two words. Because Modbus is non-proprietary, there is wide variation in how different users implement it.

I also wonder if that one-character ([00] hex) response shown in your Modbus tester screenshot actually came from the slave. If the slave did not accept the command from the master, the normal exception code would be to echo the command code with the MSB set. In your case the exception response to the [03] hex command would be [83] hex.

keristos · Jan 21, 2016

Steve Bailey said:
I agree, the length should not matter as long as the registers exist. However, the slave may have rejected the request if you asked for one word of data when the variable you're trying to read is two words. Because Modbus is non-proprietary, there is wide variation in how different users implement it.

I also wonder if that one-character ([00] hex) response shown in your Modbus tester screenshot actually came from the slave. If the slave did not accept the command from the master, the normal exception code would be to echo the command code with the MSB set. In your case the exception response to the [03] hex command would be [83] hex.

I did try with different lengths and I kept getting the same response.

Do you think the modbus could be blocked on the devices? And maybe the [00] response is some kind of a 'bad password' or 'no access'?

Steve Bailey · Jan 21, 2016

I googled that model number and the only datasheet I found indicated that it uses RS485 for serial communications. Did you terminate the RS485 cable at both ends? What are you using for a converter between your computer and the RS485 cable? Could that device be responsible for the [00] response?

keristos · Jan 21, 2016

Steve Bailey said:
I googled that model number and the only datasheet I found indicated that it uses RS485 for serial communications. Did you terminate the RS485 cable at both ends? What are you using for a converter between your computer and the RS485 cable? Could that device be responsible for the [00] response?

To be honest, no, I didn't terminate one either end. It's not something I usually do and I never had issues even with long runs of cable.

I can't tell you the device I used at the moment since I'm not at the office, but it was a prolific USB to RS485 converter.

With regards to the response being from the converter, I don't believe it is. I say this because upon disconnection of the cable from the energy meter's end I get a 'timeout' error.

Thank you for your help so far

bernie_carlton · Jan 21, 2016

Is there further documentation in English? You might experiment with the 'data bits' setting (though with No Parity 8 data bits is almost mandatory). Maybe the number of stop bits?

keristos · Jan 22, 2016

bernie_carlton said:
Is there further documentation in English? You might experiment with the 'data bits' setting (though with No Parity 8 data bits is almost mandatory). Maybe the number of stop bits?

Sorry for the late reply, had to get to the office to send the document.

Anyway, here it is.

Thanks

DLMUK · Jan 22, 2016

Hi,

looking at your data screenshot, none of those commands are addressing what you require.

I suspect the red 00s are a nul at the end of the message so these can be ignored. There is no response from the slave at all in that data you have sent.

I could be wrong, but I don't think there is a such a thing as an exception response of 00?!

So what you have is:

07 04 1000 0001 356C

The 07 is your node address = correct
the 04 is your modbus code. 04 is for input registers. The modbus table you have posted shows that they are HOLDING registers so need the modbus read code 03. See the column on the far right.
the 1000 is your 4096 address
the 0001 is the length = seeing as register 4096 is a length of 2, I would change this for 2. If you are trying to troubleshoot something which isn't working there is no point inducing problems!
356C is the checksum.

So the message you need to see from your modbus simulator is...

07 03 1000 0002 356C

Try changing from reading input registers to holding registers.

keristos · Jan 22, 2016

DLMUK said:
Hi,

looking at your data screenshot, none of those commands are addressing what you require.

I suspect the red 00s are a nul at the end of the message so these can be ignored. There is no response from the slave at all in that data you have sent.

I could be wrong, but I don't think there is a such a thing as an exception response of 00?!

So what you have is:

07 04 1000 0001 356C

The 07 is your node address = correct
the 04 is your modbus code. 04 is for input registers. The modbus table you have posted shows that they are HOLDING registers so need the modbus read code 03. See the column on the far right.
the 1000 is your 4096 address
the 0001 is the length = seeing as register 4096 is a length of 2, I would change this for 2. If you are trying to troubleshoot something which isn't working there is no point inducing problems!
356C is the checksum.

So the message you need to see from your modbus simulator is...

07 03 1000 0002 356C

Try changing from reading input registers to holding registers.

Thank you for your reply. In my OP I mentioned that I tried every combination possible, including using function 03 instead of 04, different register lengths, different baud rates and even different register addresses.

Unfortunately I don't believe this is the problem

I will try nonetheless, the next time I have an on site visit, the exact settings you suggested.

I'm worried that Modbus might be disabled and I require some special password to access it / enable it.

Thank you

tragically1969 · Jan 22, 2016

I think you need to look at cabling and comms setup in the slave and double check, I don't think you are connected to the slave at all, one your screenshots of Modbus Poll states that ?

Is it a 2 wire or 4 wire device, which USB > RS485 converter are you using, has it got Rx and Tx lights, when you send a request you should get an Rx at the laptop end even ifs its an illegal response as the slave will be Tx'ing that back to the master

Ozzie01 · Jan 22, 2016

Also just one quick one to check is the base of the addressing very often this can make your addressing offset by 1 resulting in Illegal Data Read

keristos · Jan 22, 2016

Ozzie01 said:
Also just one quick one to check is the base of the addressing very often this can make your addressing offset by 1 resulting in Illegal Data Read

Yes I tried both addresses 4096,4097 (due to that offset by on that some devices seem to have)

Issues connecting with an Energy meter through MODBUS

keristos

Member

tragically1969

Member

Steve Bailey

Lifetime Supporting Member + Moderator

keristos

Member

Steve Bailey

Lifetime Supporting Member + Moderator

keristos

Member

Steve Bailey

Lifetime Supporting Member + Moderator

keristos

Member

bernie_carlton

Lifetime Supporting Member + Moderator

keristos

Member

DLMUK

Member

keristos

Member

tragically1969

Member

Ozzie01

Member

keristos

Member

Similar Topics