Custom Modbus Device & Modicon PLCs

memphiskt007

Member
Join Date
Dec 2017
Location
Tennessee
Posts
5
Hello all,

Been in the industry for about 20 years and have finally found a problem I cannot solve. Looking for some modbus help.

I have a Momentum PLC with an M1 adapter, part number 171CCC96030, programmed with Concept 2.6. This setup communicates via Modbus TCP/IP to a custom 3rd party device specific to this customer. It has communicated for years, no issues.

Its time to replace this device with a Modicon M340, also communicating via MB TCP/IP, programmed in Unity. Upon replacing the old PLC with the M340. I can no longer communicate with the 3rd party device via read/write vars or IO scanner. Performing a Wireshark from the 3rd party device I can see the Modbus traffic getting to the machine. I removed all devices from the customer's network so there are no managed switches between, just to make sure.

I have exchanged the 3rd party device with other identical devices on site, just to verify it still works. It works flawlessly with other momentum PlCs. I have taken my M340 to other modbus tcp/ip devices and it works fine. So the code is good. Using other M340s with the 3rd party device yields the same results.

My suspicion is something within the 3rd party device does not like the M340. The company supporting this 3rd party device has long since been out of business, so no help there. Is there anything within unity, or native to the hardware that I am missing? Any thoughts?

If there is something I have missed or not stated, feel free to ask.
 
When analyze networks for 900 years look so good you will not.

Wireshark, you have.

Mmm. Compare between controllers, you will.

Verify Device ID number in packet, you must.
 
Wireshark, you have.

Mmm. Compare between controllers, you will.

Verify Device ID number in packet, you must.

Agree. It would appear that the 3rd party device is the master/client and the m340 is the server/slave?

You can capture the packet in wireshark, then use you laptop and your favorite modbus master software to send the exact same command to the m340 and see if it responds correctly. Is there a chance the m340 response is too faster/slower than the quantum?
 
Have you tried just a single request (using Read_var), some older devices cant handle too many requests too quickly
 
Agree. It would appear that the 3rd party device is the master/client and the m340 is the server/slave?

You can capture the packet in wireshark, then use you laptop and your favorite modbus master software to send the exact same command to the m340 and see if it responds correctly. Is there a chance the m340 response is too faster/slower than the quantum?

The identifier is correct in the request. I played around with the timing, speeding up slowing down, nothing. You are correct the 3rd party device is the server.

I have tried limiting the IO scans and the read/write commands to 1 register each, and only had 1 function at a time. So either read, write, or IO scan, never together.

I also forgot to mention originally, when I send my first request with the M340, the 3rd party device tries to respond. The OS (DOS) implies that the MB server is trying to use a socket already utilized by another connection, and halts comms. When observing the wireshark captures, it shows the M340 trying to use ports other than 502 and resets the connection.
 
Welcome to the PLCTalk Forum community, by the way. I'll knock off the Yoda jokes.

Is the M340 getting a Modbus-level error in which the device provides and error code instead of a data response, or is it getting a TCP-level connection failure ?

If you can grab both the Quantum and the M340 transactions in Wireshark, zip them up, and post here that might help. There are a bunch of Modbus enthusiasts over at Control.com as well.

Any chance the M340 is somehow also trying to establish an EtherNet/IP connection on Port 44818 ?

This might be an issue with the old TCP stack on your DOS device. Dissecting it is the only troubleshooting method I can think of.
 
Welcome to the PLCTalk Forum community, by the way. I'll knock off the Yoda jokes.

Is the M340 getting a Modbus-level error in which the device provides and error code instead of a data response, or is it getting a TCP-level connection failure ?

If you can grab both the Quantum and the M340 transactions in Wireshark, zip them up, and post here that might help. There are a bunch of Modbus enthusiasts over at Control.com as well.

Any chance the M340 is somehow also trying to establish an EtherNet/IP connection on Port 44818 ?

This might be an issue with the old TCP stack on your DOS device. Dissecting it is the only troubleshooting method I can think of.

Will try to get the captures to you guys ASAP. This system is in an environment that is difficult to get in, and its manufacturing to boot (meaning of course, I can't do proper testing)

Could you elaborate on your last points? If I recall, there was something trying to use port 44818. How would this disrupt my MB traffic? Since this DOS machine is no longer supported, I am really hoping for a solution on the PLC side.
 
...

If I recall, there was something trying to use port 44818. How would this disrupt my MB traffic? Since this DOS machine is no longer supported, I am really hoping for a solution on the PLC side.

I believe that is a port used by RSLinx autobrowse. If you have RSLinx installed on this machine, make sure RSLinx is not running.
 
Modicon has added limited support for the Rockwell "EtherNet/IP" protocol to some of their devices, and that protocol uses TCP Port 44818.

If your embedded system can only accept one TCP connection from a given host, then maybe if the M340 is setting up an EtherNet/IP protocol connection and that's interfering with the Modbus/TCP connection on Port 502.

That's just a guess, of course.

EDIT: or, of course, if the embedded device can only support one TCP connection total, and gets hosed up if something tries to access it while it's trying to be a Modbus/TCP server.

In general, RSLinx Classic browses with a broadcast packet rather than a TCP connection on Port 44818, but who knows what's going on here. Maybe Modicon tools browse differently for EtherNet/IP capable devices, in some kind of "auto discover" feature for their local LAN segment.
 
Last edited:
Modicon has added limited support for the Rockwell "EtherNet/IP" protocol to some of their devices, and that protocol uses TCP Port 44818.

If your embedded system can only accept one TCP connection from a given host, then maybe if the M340 is setting up an EtherNet/IP protocol connection and that's interfering with the Modbus/TCP connection on Port 502.

That's just a guess, of course.

EDIT: or, of course, if the embedded device can only support one TCP connection total, and gets hosed up if something tries to access it while it's trying to be a Modbus/TCP server.

In general, RSLinx Classic browses with a broadcast packet rather than a TCP connection on Port 44818, but who knows what's going on here. Maybe Modicon tools browse differently for EtherNet/IP capable devices, in some kind of "auto discover" feature for their local LAN segment.

This is what I have suspected all along, that the device can only handle one connection. I had my laptop try and retrieve data while the momentum was, and the server halted. However, what I don;t understand is why the device is fine with a single momentum but not a single m340. When trying to hit the device with my laptop only, the server halts. So this machine seems to love momentum's and hate everything else. I suspect its a "feature" hard-coded into the DOS system, but no one is familiar with it and I have yet to get my hands on it where I can play around with it. I think my only option is to take some captures, and see what I can change on the DOS machine.
 
When trying to hit the device with my laptop only, the server halts

Interesting. I wonder if that's a coincidence, like maybe your computer starts trying some kind of uPnP or other traffic that trips up that computer.

Any chance you can get a tap or mirror port on a switch to give you better visibility into the system ?

Or can you reconfigure the Quantum and then the M340, to point to another address which is occupied by a test computer running just ModSim32 and Wireshark ?
 

Similar Topics

Hi, I am constantly using S7 CB 1241 (RS485) Modbus comms to field devices, but these one was designed as a custom device. However I can see it...
Replies
0
Views
3,004
Good day! I am working on a project at our campus to integrate fleet vehicle chargers with load management so we don't overwhelm our service. The...
Replies
37
Views
3,694
I imported a customised shape into the project, but I don't know how to actually add into on to a specific HMI screen. Do I use the Graphics menu...
Replies
2
Views
630
I'm testing the ability to make a custom ActiveX control for PVP7 applications to be able to write data out in an XML format. With my simple...
Replies
0
Views
623
I am having difficulty finding documentation or examples on integrating Visual Studio with iX Developer in order to develop custom objects...
Replies
0
Views
523
Back
Top Bottom