Modbus TCP Question

[einnh]

I have used a half dozen fieldbus protocols over the years but never Modbus TCP. I guess the time has come.

I am trying to read sensor data from a Bender iso685 Ground Fault/Insulation Monitor device for technician use in a remote location (without much luck).

- I tried reading the data using the Modbus TCP code supplied by Rockwell for CompactLogix controllers with out any success.
- Then I tried using Red Lion's Modbus TCP to read the data, without any success.
- Now I am trying to just scan the device for data to ensure I am poling correctly, without much success.

The Bender unit is at 10.10.10.24, Modbus TCP is enabled. My workstation is at 10.10.10.1, windows firewall is disabled, and I can ping the device.

From the Bender documentation located here: (google search link sorry): http://www.benderbenelux.nl/sites/default/files/downloads/iso685-D_D00022_A_XXEN_0.pdf


- 4-digit addressing
- Holding register for reading values, read holding register, function code 0x03.
- Registers for device programming, preset multiple registers, function code 0x10.

I am now trying to just read data using QModMaster (Modbus Master app) on my workstation. I have the following settings:

- Modbus TCP Slave IP : 010.010.010.024
- TCP Port: 502
- Modbus Mode: TCP
- Unit ID: 1
- Scan Rate: 3000 ms
- Function Code: 0x03 Read Holding Register
- Start Address: 4113 (DEC) (just for this test).
- Number of Registrars: 1,
- Data Format: DEC

It is spitting out:

Read data failed. Error: Illegal Data Address

I belieive this corresponds to exception-code 0x02.

What am I doing wrong? Why can't I even read data using this simple scanner? I called Bender support and the technician stated 'It's something on your end, I can't help you."

Thanks,

Eric

 

[einnh]

and here is the reference from the Bender documentation.

 

[einnh]

Running some tools supplied with QModMaster it looks like I can ping, and the port is open, but I can't run any diagnostics on the device?

------- Modbus Diagnotics : Report Slave ID 1 -------
Read diagnostics data failed.
Error : Timeout
------- Modbus TCP : Ping IP 010.010.010.024 -------

Pinging 10.10.10.24 with 32 bytes of data:
Reply from 10.10.10.24: bytes=32 time=1ms TTL=128
Reply from 10.10.10.24: bytes=32 time=1ms TTL=128
Reply from 10.10.10.24: bytes=32 time=1ms TTL=128
Reply from 10.10.10.24: bytes=32 time=1ms TTL=128

Ping statistics for 10.10.10.24:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms

------- Modbus TCP : Check Port 010.010.010.024:502 Status -------
Connected.Port is opened

 

[Archie]

Try 2 registers. A float is 4 bytes. Each register is 2

 

[tragically1969]

I have used a half dozen fieldbus protocols over the years but never Modbus TCP. I guess the time has come.

I am trying to read sensor data from a Bender iso685 Ground Fault/Insulation Monitor device for technician use in a remote location (without much luck).

- I tried reading the data using the Modbus TCP code supplied by Rockwell for CompactLogix controllers with out any success.
- Then I tried using Red Lion's Modbus TCP to read the data, without any success.
- Now I am trying to just scan the device for data to ensure I am poling correctly, without much success.

The Bender unit is at 10.10.10.24, Modbus TCP is enabled. My workstation is at 10.10.10.1, windows firewall is disabled, and I can ping the device.

From the Bender documentation located here: (google search link sorry): http://www.benderbenelux.nl/sites/default/files/downloads/iso685-D_D00022_A_XXEN_0.pdf


- 4-digit addressing
- Holding register for reading values, read holding register, function code 0x03.
- Registers for device programming, preset multiple registers, function code 0x10.

I am now trying to just read data using QModMaster (Modbus Master app) on my workstation. I have the following settings:

- Modbus TCP Slave IP : 010.010.010.024
- TCP Port: 502
- Modbus Mode: TCP
- Unit ID: 1
- Scan Rate: 3000 ms
- Function Code: 0x03 Read Holding Register
- Start Address: 4113 (DEC) (just for this test).
- Number of Registrars: 1,
- Data Format: DEC

It is spitting out:

Read data failed. Error: Illegal Data Address

I belieive this corresponds to exception-code 0x02.

What am I doing wrong? Why can't I even read data using this simple scanner? I called Bender support and the technician stated 'It's something on your end, I can't help you."

Thanks,

Eric

View attachment 52285

Hmmm, looking at that manual it also states registers should be read using FC4 (input registers) have you tried that ?

Also try reading the amount of registers it defines on that address, looks like 4 but have no idea why 4 registers would be required for a Float unless it was 64 bit which would be unlikely for a resistance measurement ?

Edit: just realised the 4 is bytes so 2 registers

 

[einnh]

I tried Using 2 and 4 registers.

See the following:

 

[einnh]

 

[Archie]

The start index in Modbus is sometimes 0 and sometimes 1, so I would try to add 1 to the address and then try to subtract 1

From what I am seeing, it looks like it should work the way you have it.

Is the device by any chance using Enron Modbus?

 

[lfe]

The correct Modbus address of the first holding register is 40001 or 400001 depending on whether 5 or 6 digit addressing is used.

Some device manuals indicate an offset instead of the address then an offset = 0 corresponds to 40001 or 400001.

You could try using 44114 or 404114 as the start address

It is also strange to ask for a unit ID when Modbus/TCP does not use that since what distinguishes a slave from others is the IP

 

[Firejo]

The correct Modbus address of the first holding register is 40001 or 400001 depending on whether 5 or 6 digit addressing is used.

Some device manuals indicate an offset instead of the address then an offset = 0 corresponds to 40001 or 400001.

You could try using 44114 or 404114 as the start address

It is also strange to ask for a unit ID when Modbus/TCP does not use that since what distinguishes a slave from others is the IP

You went where I was going to go until I found some documentation on QModMaster which shows a screenshot of the main window. It shows the function code "Read Input Registers" with a starting address of "0" which indicates that the software is adding "3000x". Having said that it's worth a try (it can only fail if it's wrong). I'm wondering if this is nothing more than a "base 0" vs "base 1" address issue.
As to the "Unit ID", I've come across one or two Modbus TCP server devices that need a Unit ID which doesn't make sense but once it was supplied it went from very unhappy to happy.

 

[Firejo]

Once you get past the "why won't it answer" issue, I'd avoid trying to use the Rockwell "sudo" Modbus code. It's difficult to use at best (I've never been able to get it to work but then again, I'm not an advanced programmer). This device should do the trick although the RedLion should as well.
https://www.spectrumcontrols.com/products/universal-gateway/

 

[einnh]

Got it working!

Had to change the following

Unit ID: 0 (was 1)
Start Address: (-1 from entry I wanted to read).

Now that I know it is working I have to figure out the rest of my headaches:
- Reading this through either my Red Lion HMI or through the CompactLogix.
- HEX to Floating Point conversions in the CompactLogix.

 

[einnh]

Once you get past the "why won't it answer" issue, I'd avoid trying to use the Rockwell "sudo" Modbus code. It's difficult to use at best (I've never been able to get it to work but then again, I'm not an advanced programmer). This device should do the trick although the RedLion should as well.
https://www.spectrumcontrols.com/products/universal-gateway/

The panel is already built and UL stamped, trying to avoid adding any more hardware to it. The Graphite unit I'm using should be able to read it. It is once again, massaging the queries I guess.

 

[bernie_carlton]

Glad you have it working. I was concerned with your leading zero addresses. Sometimes the leading zero forces the interpretation to octal instead of decimal. Thus 010oct = 8dec and 024oct = 20dec. But if you got it then ok.

 

[ganutenator]

Glad to hear that you got it working.
I think a modbus address of 0 is a brodacast message. So unless it is strictly modbus tcp and no modbus/tcp to serial converter you shouldn't have a problem. But if it is modbus serial, you could cause problems down the line if you ever wanted to add another modbus device on the modbus network. I'm sure someone on here will correct me if I am wrong.