Skip to Content

Register Login

Industry Online Support

Technical Forum

Navigation

S7-1200 ModBus RTU input register reading beyond address 9998

Created by: nikoska at: 3/2/2012 8:18 PM (15 Replies)

Rating (1)

Thanks 1

Result pages:: |; 1 | 2; |

16 Entries

Entries per page: 10 | all

3/2/2012 8:18 PM	Rate (0)
nikoska Posts: 4 Rating: (1)	Hello everyone, In working with an S7-1200 as ModBus RTU master communicating with a ModBus RTU slave device, we have encountered a problem. The problem is that the input register range of the ModBus slave starts at address D000 (53248). The S7-1200 supports only reading input register addresses 0000-9998 (Mode 0 Function 04, Modbus addresses 30001-39999). With holding registers there is no issue, the S7-1200 supports addresses 00000-65534 (Mode 0 Function 03, Modbus addresses 400001-465535). So at present, while we are reading from and writing values to the ModBus slave via the holding registers, we cannot read the input register data from this ModBus slave. Is there any way in the S7-1200 to enable reading input register adresses beyond 9998 in ModBus RTU? Thanks Nikos
nikoska Posts: 4 Rating: (1)
Suggestion To thank Quote Answer

3/2/2012 10:15 PM	Rate (0)
0_Einstein Diamond Member Joined: 7/7/2010 Last visit: 11/5/2024 Posts: 15385 Rating: (2443)	Can you simply copy the subject registers to holding registers (4x's) that are within the range of the Modbus RTU protocol on the remote system? Yes, it wastes register storage space on the remote system, but, it might get around the problem until it is built into the S7-1200 library.
	science guy
Suggestion To thank Quote Answer

3/3/2012 1:45 PM	Rate (0)
nikoska Posts: 4 Rating: (1)	I'm afraid not - the ModBus RTU slave device is a standard commercial product, within which I have no programming control. It is a black box - I simply access what is made available by the manufacturer. Any other thoughts?
nikoska Posts: 4 Rating: (1)
Suggestion To thank Quote Answer

4/28/2012 3:07 PM	Rate (0)
TIBI68 Gold Member Joined: 12/1/2009 Last visit: 10/27/2024 Posts: 672 Rating: (147)	Hi nikoska, I think you need tocontact with the manufacturer of thatblack box in order to solve your problem. I might could help you in case you usea CP34x, there I wrote the modbus master RTUdriver myself and can do whatever is the requirement. Regards.
	Give us your feedback and show us your respect! We take our free time to support you with our knowledge and experience. If this post is helpfull to you kindly click on "Rate" or "Thank".
Suggestion To thank Quote Answer

5/1/2012 3:57 PM	Rate (0)
smiffy Platinum Expert Joined: 1/17/2007 Last visit: 10/21/2024 Posts: 1547 Rating: (537)	The black box is using what are known as extended holding registers. These were a later addition to the modbus protocol, and not all modbus devices support them. It seems that the S7-1200 device falls into the category. I suggest that you could use a modbus protocol convertor. This is a hardware device that sits between the 2 devices. As its name suggests, its purpose is usually to convert one protocol to another (e.g. modbus RTU to modbus ASCII say). However, it can be used to remap the registers from one modbus RTU device to another. I have used one such device to do this in the past. The one I used is made by a company called anybus. Click here for details. The Anybus device has a built-in modbus RTU slave for one side, and a loadable protocol for the other side (one of which is a modbus master RTU protocol). The configuration of the device is through wizards, so no programming knowledge is required. So you would load in the modbus master RTU protocol to the convertor. The convertor master side would connect to your black box and poll the extended holding registers. These can then be remapped internally in the convertor to 40001 addresses. These can now be read by the S7-1200 master from the convertors modbus slave RTU interface. So the S7-1200 would think it was reading the 40001 adresses, but it would actually be reading the extended holding register addresses.
	Programming today is the race between software engineers building bigger and better idiot proof programs, and the universe producing bigger and better idiots. So far, the universe is winning...
Suggestion To thank Quote Answer

5/2/2012 1:23 PM	Rate (0)
TIBI68 Gold Member Joined: 12/1/2009 Last visit: 10/27/2024 Posts: 672 Rating: (147)	Thanks smiffy, good to know about that device, for the case I need one in future. Do you have information about the frame structure of accessing these extendend addresses. I just have the standard serial & TCP modbus protocol descriptions. Best Regards.
	Give us your feedback and show us your respect! We take our free time to support you with our knowledge and experience. If this post is helpfull to you kindly click on "Rate" or "Thank".
Suggestion To thank Quote Answer

5/2/2012 3:47 PM	Rate (0)
smiffy Platinum Expert Joined: 1/17/2007 Last visit: 10/21/2024 Posts: 1547 Rating: (537)	They are handled identical to the normal holding register transactions (e.g. function code 03, 06, 16). The only difference is that you can have the start address range of 40001 to 105536 (offset 0 to 65535).
	Programming today is the race between software engineers building bigger and better idiot proof programs, and the universe producing bigger and better idiots. So far, the universe is winning...
Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users TIBI68

6/20/2012 12:30 PM	Rate (0)
nikoska Posts: 4 Rating: (1)	Hello everyone, Thanks for the updates. Smiffy, I appreciate your solution, and indeed it seems it would solve the problem. However, it seems to me we are going the long way around. I can understand a legacy PLC 20 years old not supporting extended input registers, but not a newer and still updated device such as the S7-1200. Not to mention that the Modbus specification: http://www.modbus-ida.org/docs/Modbus_Application_Protocol_V1_1b.pdf dated 28 December 2006, very clearly states (page 7) that "In a MODBUS PDU each data is addressed from 0 to 65535". On page 16 it is even more exact, specifically for function 0x04 (read input registers) that the address is specified as 0x0000 to 0xFFFF, i.e. 16 bits. So it appears that the S7-1200 firmware is not compliant with the ModBus specification in this respect. So, I would put the matter to the S7-1200 firmware developers, they already implemented extended addressing for the holding registers, they must do the same for input registers.
nikoska Posts: 4 Rating: (1)
Suggestion To thank Quote Answer

6/20/2012 1:19 PM	Rate (0)
smiffy Platinum Expert Joined: 1/17/2007 Last visit: 10/21/2024 Posts: 1547 Rating: (537)	The way I have always understood it is that you cannot have extended addressing for input registers. You can only have extended addressing for holding registers. The reason being that Input registers start at address 30001 and Holding registers start at address 40001. So the maximum number of input registers you can address is 40000 - 30001 = 9999. The fact that the specification shows the register count field as having a range of 0 to FFFFH is just identifying that it is a 2-byte field. It does not imply that the whole range can be used. Either that or it is a mistake in the specification. There are no addresses used above where the holding registers are mapped, so they can use the full 65535 register count supported by the the 2-byte register count field.
	Programming today is the race between software engineers building bigger and better idiot proof programs, and the universe producing bigger and better idiots. So far, the universe is winning...
Suggestion To thank Quote Answer

6/20/2012 2:11 PM	Rate (1)
nikoska Posts: 4 Rating: (1)	Hello smiffy, I understand what you are saying. But it's not that I need to access 65535 input register values simultaneously. Imagine that I need to access only 1 value, but which is not at input register address 1, but at address 53249. There is no way to do it with the S7-1200. The fact is that a large manufacturer puts on the market ModBus Slave devices with this addressing scheme. Speaking to the equipment manufacturer (very large scale - thousands of these ModBus devices are in operation), they mentioned that several PLCs have this addressing limitation, but all of the ones they have encountered offer the capability to "offset" the input register address range by a user-specified value, so that you ask for address "1" and offset e.g. "0xD000", this is added internally to produce the final address of "0xD001" put on the bus. So, while you cannot access ALL 16-bit values simultaneously, you can access ANY of these values. Of course, I could ask the manufacturer to reprogram their equipment to the 0-9998 input register address range, but even if they agree, this would only solve a single problem once. I would expect the most flexibility to exist in the controller and not in the controlled device. Thus my request for the addition of such an address "offset" feature in the S7-1200 firmware. Thanks Nikos
nikoska Posts: 4 Rating: (1)
Suggestion To thank Quote Answer

|

Share this page:

Share this page on...

Follow us on