Modbus mapping in e!COCKPIT and "Illegal Data Value" problem

[Spectre]

Hi. I'm using a Wago PFC100 PLC for a project I'm doing and I want to communicate with AdvancedHMI through Modbus TCP.

I'm not an expert when it comes to Modbus, but I know a little. My main problem is understanding how the mapping of Modbus variables work in e!COCKPIT and how it correlates to the way AdvancedHMI maps function codes. I have managed to get Modbus communication working by following a step by step guide (https://www.youtube.com/watch?v=XZiqyO1s6YM) using some function blocks, but I'm fairly certain it should be possible to do it simpler than that.

I haven't done any configuration of the PLC in regards to port access. I'm using a static IP I've assigned to it. But I assume the default Modbus port is 502 which I've configured in the ModbusTCP driver.

Attached are some images with information I thought could be relevant. I have for instance mapped a WORD which is assigned Register 0: Bit 0 in e!COCKPIT, but I'm not sure how that correlates to Modicon addressing. I've also set up a DigitalPanelMeter to try and read this variable.

Any suggestions or help is appreciated. Thank you in advance.

[Archie]

I have for instance mapped a WORD which is assigned Register 0: Bit 0 in e!COCKPIT, but I'm not sure how that correlates to Modicon addressing. I've also set up a DigitalPanelMeter to try and read this variable.

Based on you mentioning the bit number, I an going to guess that it is in the bit address space.

Use a BasicLabel for testing because it can expand to give more detailed messages. Start by trying address 00001 and then 10001

[Godra]

The page 224 of the 1st manual shows Modbus addressing, supported function codes and type of access (read-only, read-write) as well as bit access:

https://www.wago.com/global/search?f=%3AresultType%3Adownload%3AdocCategory1%3ADL_13%3AdocCategory2%3ADL_16%3AdownloadLanguages%3Aen&ststate=eyJmIjp7ImRvd25sb2FkIjoiL3NlYXJjaD9mPSUzQXJlc3VsdFR5cGUlM0Fkb3dubG9hZCUzQWRvY0NhdGVnb3J5MSUzQURMXzEzJTNBZG9jQ2F0ZWdvcnkyJTNBRExfMTYlM0Fkb3dubG9hZExhbmd1YWdlcyUzQWVuIn0sImMiOnsiYWxsIjoxMDk0MzksImRvd25sb2FkIjo2NTQsInByb2R1Y3QiOjI2NzQ4LCJzZXJ2aWNlIjo0MCwic29sdXRpb25zIjoxOTEsImNvbXBhbnkiOjIzfX0%3D&with=PFC100

It looks a bit odd and Archie might be a better person to interpret it.

[Spectre]

Thanks for replies guys. I will try with a basic label and try different adresses. And yes, I also found the addressing to be very strange indeed. Will be trying some things in the meantime and update if I figure anything out.

Edit: I tried with a basic label and different addresses.

00001 gives "Illega function"
10001 gives "Illegal data address"
20001 gives "Invalid Address 20001 - Invalid first digit in address" obviously
30001 gives "Slave device failure"
40001 gives "Illegal data value" as usual

According to tech support the way the PLC does addressing is:

PFC-OUT 0-31999: FC3, FC4, FC23, FC66
PFC-IN 32000-63999: FC3, FC4, FC6, FC16, FC23, FC66

Not really sure how this correlates to the way AdvancedHMI does its addressing, but I came across this thread.

http://www.plctalk.net/qanda/showthread.php?t=114288

[Godra]

Try higher addresses to see what responses you will get (addresses like 400010, 463000).

You should look up Modbus function codes so you know exactly what they mean, like FC3 is to read holding registers which in AHMI translates into addresses starting with 4, which is also applicable for FC16 - Write Multiple Registers.

[Archie]

9.2.1.3 Register 0xFA02 – Watchdog Status

This is an integer value, so FC3 (4xxxx address) should read it.

0xFA02 = 64002

64002 + 1 = 64003

Modicon Address -> 464003

Try that address to see if it reads anything

[Spectre]

Hello Archie, I tried reading watchdog status with a DigitalPanelMeter and a Basic Label, and it returned the value -1 (see image).

I'm not really sure what to make of it, as it's not listed as a possible return value in the datasheet. I also am able to read for instance "Hardware Version" in section 9.2.3.3 with address 64021 in AHMI as 464022 and return the value "4". Same with Firmware version, it returns an "8". So I'm clearly able to read something.

Godra, higher addresses yield same result, "Illegal data value". I am somewhat aware how the function codes correlates. I'm just unaware how the addressing does. So when my Modbus address is "Register: 0 Bit: 0" I'm not sure what that means. But I understand that if I want to read it, I would have to preceed it by a 4, just don't know the rest.

[Archie]

-1 would be 0xFFFF

[Godra]

You have made a progress and managed to read some values.

From the mentioned Wago manual, special registers start at 64000 (0xFA00) with Watchdog and that's probably why Archie asked you to try reading from there.
Your Modbus address "Register: 0 Bit: 0" shows as a special register as from the picture you posted.
That picture also shows on the left side "_16_DI_Generic" and others like "_8_DO_Generic", so try to get Wago support to explain to you what those mean.

DI should be Digital Input, DO should be Digital Output, AI should be Analog Input, AO should be Analog Output and so on...

I can only suggest to keep reading the manual and trying different addresses.

It almost looks as if you need to setup in the controller all the addresses that you want to use before you can poll them with AHMI for values.

[Spectre]

Seems like I found a solution. So the way my PLC does adressing (and probably any Codesys based PLC) 0 - 31999 is the OUTPUT Register and 32000-63999 is the INPUT Register from the PLCs perspective. While Coils can have address 0 - 32767 for OUTPUT and 32768 - 65353 as INPUT. So lets say I have a Coil on address 18 as OUTPUT. Then I would have to input Modbus function code 00019 (function code followed by address +1) to R/W.

Here is where I got confused. So lets say an INPUT Coil, it would get assigned a really high address like 33000, it would simply add another digit to the Modbus addressing. So to access this Coil I would have to use Modbus function code 133001 (function code 1 followed by address +1). I'm pretty sure I tried this before, but it seem to be working now. So I consider at least this part of the project solved. Thanks a lot Archie and Godra for help.

Edit: Forgot to add one thing. You also have to create a "Generic Modbus Master" and connect it to the PLC through Modbus TCP. No idea why, maybe to tell the PLC to act as slave? It wasn't necessary when I did it with the library function block however.

[larryhts]

Spectre  Thanks for the great explanation it will help some of us if we run into that PLC.

[Godra]

Edit: Forgot to add one thing. You also have to create a "Generic Modbus Master" and connect it to the PLC through Modbus TCP. No idea why, maybe to tell the PLC to act as slave? It wasn't necessary when I did it with the library function block however.

For future reference, this seems to coincide with my suggestion:

It almost looks as if you need to setup in the controller all the addresses that you want to use before you can poll them with AHMI for values.

This since the controller just wasn't responding with values to requests from AHMI and I thought it required some special setup.

So, the step mentioned by Spectre might actually be very important.