Issues connecting with an Energy meter through MODBUS

No, the anwsers really don't make any sense..
Like they said, it shold at least start with the address and function code that you send..

DLMUK rushed i think, 4096 is not 3 with 97 - 3 with 4096 is 44097 or sometimes like you said 404097... That is for holding registers.. input - 34097..


It might have some weird version of modbus, like extended addresing or 2 byte device addresing..
 
Last edited:
No, the anwsers really don't make any sense..
Like they said, it shold at least start with the address and function code that you send..

DLMUK rushed i think, 4096 is not 3 with 97 - 3 with 4096 is 44097 or sometimes like you said 404097... That is for holding registers.. input - 34097..


It might have some weird version of modbus, like extended addresing or 2 byte device addresing..

Could you give me some more information about the 'weird' version of modbus you mentioned? In an earlier post I provided a link in a response to the full modbus table (instead of just a screenshot), and it says 'Modbus RTU' on it...

How can this be so complicated :(

Edit: just found this in the modbus table I just referred to...makes any sense?

Data bits
trasmission
sequence

Least significant
bit first
 
Last edited:
Sorry, when it is a weird version I have trouble like you.. Bu I know there is a version that asks for two byte address of device.

And don't forget, maybe it is just broken..

I am not sure about the order of bits..
 
Nah I don't think it's broken, I tried directly connecting to 2 on a switchboard that contains 8. Before that I connected to a common modbus of all 8 energy Meter.

I am lost. Tomorrow I'm going back on site...I'll try again =\
 
No... absolutely no sense at all
I concur

[08][03][10][00][00][02][C0][52]

Response should start [08][03] regardless of successful communication or not.

Yes.

You should then get an exception code between 01 and 11, and then a crc. So an illegal response should look something similar to...

[08][03][02][****]

Almost. The Fault Flag is 128 decimal added to the function code, so FC 03 becomes Fault Flag 13, followed by the fault code:

[08][13][02][****]
 
Your first message reply not only makes no sense for address or function code , but its CRC ( 95 00) is not a correct CRC value for the rest of the message, as calculated by Lammertbies CRC calculator
http://www.lammertbies.nl/comm/info/crc-calculation.html

Sending: (Function 3, Addr 4097, length 1)
[08][04][10][00][00][01][35][93]

Receiving:
[EF][DF][FF][FF][FD][95][00]
CRC_is_not_a_CRC.jpg
 
Your very first post addressed slave 7:
I input the parameters in the software to match those set on the device and started transmitting;
Address: 7
Baud Rate: 9600
Parity: None
Register Address: 4097
Function: 3


Today's messages address slave 8. Is there a slave 8 on your network?

Slave 7 will not reply to a misaddressed message. A Modbus slave is silent and does not reply to a message not addressed to itself.
 
Am I mistaken in thinking that modbus is in the range of 400000?
Well, sort of, maybe.

The leading numeral 4 is only for humans, it is not part of the Modbus message. The leading numeral denotes the 'memory area' where the data resides.

I've started putting the leading numeral in parentheses to separate it from the actual register address.

(4)xxxxx memory is for Holding Registers. Holding Registers are addressed with Function Code 03.

(3)xxxxx memory is for Input Registers. Input Registers are addressed with Function Code 04.

I don't have a clue why FC 03 addresses (4)xxxxx, while FC 04 addresses (3)xxxxx, but some guy at Modicon made that silly decision 30+ years ago and we still live with it.

So if your data is in 4xxxx or 4xxxxx, then you need to use Function Code 03 to get to it.

That would mean that in this case, with address 4097, with the function code added it would actually come to 404097.
The leading numeral is not part of the Modbus message. Some masters use the 4xxxxx format, others do not, using only the 'indexed' value, the xxxxx part of the register address.

One doesn't 'add' anything to a Modbus register (unless it's the dreaded one-offset problem, which we'll get to once you get a valid message transaction running.

On the modbus table I linked to earlier, the address is listed in both decimal (4096) and hex (1000)... So I'm not sure what you said is the case.

You correctly used the 10 00 (hex) value as the register address in the message, but probably with the wrong function code.
 
Last edited:
Your replacement USB/232 converter is now getting data, but it's nonsense data.

Nonsense data is indicative of something wrong/not matching in the serial comm setup, which must be identical for both devices.
- the baud rate
- the number of bits in the word (8 for RTU)
- parity
- the number of stop bits
 
As a side note, I did test the new RS485 converter on a different Modbus device, a Carlo Gavazzi EM24 DIN that I've connected to countless times to make sure it is working correctly.

Your very first post addressed slave 7:
I input the parameters in the software to match those set on the device and started transmitting;
Address: 7
Baud Rate: 9600
Parity: None
Register Address: 4097
Function: 3


Today's messages address slave 8. Is there a slave 8 on your network?

Slave 7 will not reply to a misaddressed message. A Modbus slave is silent and does not reply to a message not addressed to itself.

Yes on the switchboard I'm trying to connect to there is a network of 8 energy meters. When I'm testing I am disconnecting one EM from the rest and connecting my cables directly.

Well, sort of, maybe.

One doesn't 'add' anything to a Modbus register (unless it's the dreaded one-offset problem, which we'll get to once you get a valid message transaction running.

I understand that one doesn't add anything to a Modbus register, Its just that the software, after choosing the FC and inputting the address, combines them together when displaying the returned data.

You correctly used the 10 00 (hex) value as the register address in the message, but probably with the wrong function code.

I did try with different function codes and different addresses (due to the +1 issue you also mentioned) and had luck. This is ridiculous...I'm sure I must be doing something wrong.

Your replacement USB/232 converter is now getting data, but it's nonsense data.

Nonsense data is indicative of something wrong/not matching in the serial comm setup, which must be identical for both devices.
- the baud rate
- the number of bits in the word (8 for RTU)
- parity
- the number of stop bits

I double and triple checked to make sure everything matches withing the:
a) Software (Modbus Tester)
b) The Device
c) The Virtual COM port settings in Device Manager (even though I'm quite sure the software overrides these)
 
Do you have a copy of the manual in English? I can only find an Italiano version, and other than spageeettttthhhhi my italian isn't up to much.
 
Do you have a copy of the manual in English? I can only find an Italiano version, and other than spageeettttthhhhi my italian isn't up to much.

Haha, the Manual I am using has 4 languages, so if you can speak spagettthhii, Tea and scones, croissant or Siesta, you should manage :)

Edit: Though as far as I know the Croissant was initially invented in Turkey, so lets change that to Escargot or Baguettes :)
 
Edit: just found this in the modbus table I just referred to...makes any sense?

Data bits
trasmission sequence

Least significant bit first
Here is a screen shot from the Modbus Over Serial Line V1.02 Specification;

serial_transmission_sequence_from_Modbus_Serial.jpg


If it isn't least significant bit first, it isn't Modbus.
 
The manufacturer is confused and has poor documentation.

The correct Function Code

The term Input Registers has a very specific meaning in Modbus.

In Modbus terminology Input Registers means the area of memory which is addressed by Function Code 04 and is read-only. It is represented by memory (3)xxxx, or (3)xxxxx.

The Read Function Code 03 (dec) (circled in green, below) on the manufacturer's register table is also very specific Modbus terminology: Function Code 03 addresses Holding Register(s). Holding Register memory is represented by (4)xxxx or (4)xxxxx

I assert that their term "Input Registers- Words" (circled in red) is incorrect and should be Holding Registers - Words, because they designate Function Code 03 to be used to read the data from registers. The Function Code overrides the misnamed terminology.

Modbus_slave_table_long_integers_hi.jpg


The correct number of registers per value
The sequence of registers from 4096 to 4098 indicates that each data value is 32 bit long integer, consisting of two sequential/contiguous 16 bit Modbus registers, as does the column Dimension [word] (circled in blue), which states, 2 words (registers) for 4096 (1000h).

As Steve mentioned in post #5, some slaves reject a request for 'partial data'. It is therefore important to request 2 registers for the Phase voltages (and most of the other values).

The Correct Master message
The master's request message should be
slave 8: 08h
Function code 03: 03h
start register: 1000h
length of data: two words/registers: 00 02
CRC: CRC CRC

08 03 10 00 00 02 CRC CRC

This is not what is in the data stream:

master_tool_hex_code_send_msg_hi.jpg


The Function code, circled in green has to be 03.
The requested register count, circled in red, must be 02

Master software tool
master_tool_data_type_is_NOT_FC_it_is_leading_n.jpg


What is called Data Type (circled in red) is NOT the function code, it is the leading numeral used by humans to identify the data type or memory area.The leading numeral for input registers is (3)xxxx

This is confirmed by the Address (circled in blue): 34097, [which I would write (3)4097 because (3)is not part of the modbus message.]

Since Function Code 03 is the correct Function Code, and FC 03 addresses the Holding Registers in the (4)xxxx memory, the Data Type needs to be switched to whatever comes up on the list for 4: (probably 4: Holding Reg)

Then Address will appear as: 44096

I suspect that you've done this at one point or another in the combinations of trials, but stay away from single (one) register reads (device might well generate exception code) and stick with Function Code 03, in spite of the misnamed Input Registers on the mfg's document.

Serial Comm
But none of this will produce a valid read transaction until the serial data makes sense.

The USB/485 converter must be on the right COM port or you'd get nothing.

A and B must be OK or you'd get nothing (time out).

Terminating resistors aren't critical at 4800/9600/19.2K with short table top distances (cable lengths).

Have you run a 3rd wire for signal ground-to-signal ground?
 
Some devices do not recognize COM setting changes until power is cycled.

Try cycling power after confirming your comm settings.
 

Similar Topics

Hello all, hope your week is going well. I am currently working on debugging a Micro850 with Category number 2080-LC50-24QWB. When I connect...
Replies
8
Views
2,365
I'm trying to resurrect an older machine from around 2005 that uses a 140CPU43412A. The goal is to retrieve the existing program so that it can be...
Replies
4
Views
3,450
I am having some issue connecting to the Factory Talk Server. We Have been running an application on FactroyTalk View Studio for about 6 months...
Replies
5
Views
7,754
I am trying to connect my 7" Omron NB7W-TW00B HMI to my AB CompactLogix L-31 PLC. Right now I am just trying to pass a single value from my PLC...
Replies
1
Views
3,930
Hi, I am having trouble connecting to a Siemens S7-200 PLC in Citect. - Citect Version: 6.1 SPB, - Driver: SIMPPI 1.00.03.001 - Siemens...
Replies
0
Views
2,690
Back
Top Bottom