Announcement

Collapse
No announcement yet.

ECOM 100 with Modbus ECWX write to short

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts


  • ECOM 100 with Modbus ECWX write to short

    So..I read chapter 5 of the H0-ECOM100 manual and I got the Peer-to-peer through netedit3 working and I'am reading off of a honeywell temperature controller. I followed the example and I have a few questions about writing if anyone has more experience with the DL stuff. I have gotten read and writes to work with other hardware but this is not working the same. I do see that on V memory locations 7766-67 My clock is incrementing. With the default -follow the book exactly- this changes nothing on the controller. Register 40003 is a valid R/W address so that isn't the problem. I am targeting the address with TA2 and K2 for byte count. I'am thinking there is a data typing problem. Since the data type the controller wants is a short, and V memory is 8bits, I need 2 adjacent addresses both converted? The book says "Note the data will be in BCD/Hex format". I tried the
    LD > Vmem 7766
    BCD
    OUT > Vmem 7770
    and various combinations of those instructions but still havnt gotten any values to budge. What am I missing to send a short to the controller through this Ibox properly? Do I need to use LDD after I convert the values and send that? There must be a simpler way to do this.
    Thanks


  • #2
    You may be running into a word or byte swapping issue. SWAPB can be your friend.
    If you have an urgent issue, please contact AutomationDirect's Technical Support team.

    AutomationDirect.com Technical Support: 1(800) 633-0405 or (770) 844-4200 Email Tech Support

    Comment



    • #3
      I'am not sure I'am implementing the comm's correctly and am asking for a reference in addition to the documentation. So, from what I gather V0 and TA0 both are equivalent and target modbus address 40001. The example in the book uses TA2 which should target modbus address 40003. I can confirm that when I read from this address that it is the value I expect. When I try to use the ECRW box to write to this address (exactly as in the example) the value does not change. I see my V memory locations incrementing at 7766/67. I have a modbus map for the device I'am working with that says address 40003 is a R/W register, it also defines the data type as a short, so I would need 2 adjacent V-memory locations in order to create a 16 bit int? right? . I tried a word swap between 7766/67. I tried some random bit swapping but I'am directionless. I tried loading values into the accumulator with LD and outputing them to another address (like 3000) after converting them with conversion boxes. I tried changing V-memory data type. I know you can write to this device on this address and I must be doing something wrong or silly, or not understanding this correctly.

      Given that the device is expecting a short, what would the proper method be for sending this data in the correct format? I'am assuming I need to target TA2 still, using 2 bytes, starting from a memory location that has the data in the proper format. If I load lets say ZEROs into 3000/01 should I not be able to set the value to zero? A generic reference would be appreciated so I can at least know that I'am doing one part of it correctly. I'am new to DL PLC's and I'am finding them to be bit little quirky, and modbus addressing is always annoying.

      Thanks

      Comment



      • #4
        I think that using some different Vmem locations (V3000 - V3001) that are not in use in the plc to troubleshoot is the way to go.
        Maybe the timer TA0 value is changing somehow.

        Load both with zeros and write to the modbus location.
        Read back the modbus location to say V3010-V3011.
        If this works, try a loading a different number to (V3000 - V3001).

        Does the target device have a range of numbers that are allowed to be entered?

        Comment



        • #5
          The plot thickens. Yes, the target device does have a range, however I'm in range. I'am trying to write to the setpoint which currently has a max value of 1500. I tried sending K0, K1, K100, K1000. Nothing. I called tech support and now they are confused as well..here is what they told me to try.

          Ok, so I did start using 3000 range V-memory and ditched the incrementer. I setup a modbus slave on my pc and swapped IP's with the device: it writes to my pc fine. So the plc is sending a write.

          I then used modscan to write to 40003, this also worked fine. The device is reading the values and changing from modscan. So the device can write to that register.

          I double checked my ECWX ibox and confirmed with tech support that TA2 is targeting 40003 (the same register I just proved is working both directions with the modbus tools).

          I was finally advised to clear the plc memory completely and reload the program, I tried this and still no change. This is just bizarre at this point. I have everything going through a brainbox SW-504 unmanaged switch. I used the switch in both tests (writing to device from modscan, and getting written to from the PLC (with modbus slave). Dipswitch 7 is on, on the HO-ECOM100.

          I additionally set an ibox to target specifically just register 40003 and I'm writing it to V10000...that is working.

          I then have a LD K100 > BIN > OUT V3000 to make sure the value is binary (i tried this w/o bin as well). I'am seriously running out of ideas. I just rechecked the PLC to PC write and I'm noticing that it is only changing the Values of the holding register (FC3). The device map says that FC4 Integer registers are R/W but is also says "Integer Writes require function code 6", am I just targeting the incorrect address because of function codes? It is able to write to my PC slaves holding register FC3, but the device does not use FC3 as far as I can tell. I also thought I was using FC4 using the TA0 address targeting. Which address range is FC6? FC4? The manual does not make this clear, I thought I was on 40001 addressing, so why is TA2 writing to a holding register?

          Comment



          • #6
            For holding registers (4xxxx) - read using function call 3, write using function call 6 (single register) or function call 16 (multiple registers)
            thePLCguy

            Bernie

            Comment



            • #7
              Hey Bernie,
              I'am aware of that, however targeting a specific register with a diff function call was unclear in the modbus tcp documentation. On page 5-5 of the H0-ECOM manual, it shows that function code 6 and 16 are V-memory locations. Ok. Which ones? I see on page 5-7 that it shows the DL06 and 'modbus data type' however I do not understand how this corresponds to function codes. I do not see "write single register" nor "write multiple registers". When I have interacted with modbus in the past I was able to specify the function code and register separately and this was no problem. I started trying random groups of V-memory locations from the chart but this is simply unclear to me which group is which. There is no field to enter it separately. Looking for clarification on how to specify function codes in the ECWX ibox. Thanks

              Comment



              • #8
                The numbers in the function calls do not correspond to the number at the beginning of the memory area. Don't let that confuse you. If you use Wireshark you may be able to see which function call (fc6 or fc16) the command is using. I'm guessing that it is using fc16 with a register count of 1 and the device is rejecting it because it isn't function call 6. Check if the command receives an modbus error response.
                thePLCguy

                Bernie

                Comment



                • #9
                  Oh man did you nail it. I did a wireshark capture yesterday when I was testing the writes to my PC on the modbus slave simulator. I just re-looked at the capture file and sure enough it is FC16. This is just all very confusing though using the ECWX ibox. The AD tech only added to the confusion at this point. I understand that I need to use FC6, I just don't understand which variable to change in the ibox to accomplish that. Should I do more wireshark and just do it by trial and error? What DOES correspond to the function code? The manual was just bad at explaining this. I understand the octal conversion but the FC part I do not.

                  Comment



                  • #10
                    Unless the experts at AD have a trick I think you are out of luck. I don't think you can control the fc6 vs fc16 choice.
                    thePLCguy

                    Bernie

                    Comment



                    • #11
                      Hmm, that seems silly. Thank you for the info, I think I'll give them a call again and report back. I suppose I could do multiple registers if I had to, that just seems silly I can't control that variable from this ibox/hardware.

                      Comment



                      • #12
                        Ok, entirely my fault as usual . The HO-ECOM card does not support FC6 as stated on pg. 5-16. I had seen further up the manual that the DL06 does support FC6 but only as a SERVER. The codes it supports as a Client are only 1-4 and 15-16. I think I just hit the wall and will ask the controller vendor if I can fudge this on 16 even though it does not say it supports 16 on their map. A bit disappointed for lack of FC support, live and learn.

                        Comment

                        Working...
                        X