I have what I think can be an addressing issue when using the supplied Modbus RTU function blocks for S7 1200 CPU.

I'm using the latest supplied library blocks (TIA V13 SP 1 Upd. 9) for Modbus RTU in a 1251 CPU with a CB1241 card installed.

There is four slaves I want to exchange data with, two ABB ACS880 VFD's and two Bitzer compressor supervision/control units (Black boxes).

The VFD's answers to everything that I send to them without a problem, but the Bitzer boxes don't.

I have done a lot of RTU communication with other PLC brands earlier, and the difference is that now when using the 1200 CPU, I must add 40001 or 30001 to the register addresses I want to access in the VFD's.

Else nothing is sent out from the blocks.

The Bitzer units are using absolute addressing with input registers starting at 11201.

If I try to convert the address of an input register to an "old" standard Modbus address by adding 30001 to it, it ends up in the holding register area, and of course will the function code then be incorrect.

And yes, the units are using 16-bit addressing.

The Modbus.org site mentions this old addressing method in the obsolete protocol spec.

Is there any other version of the library blocks that allows absolute addressing, or do I have to create it myself ?

Hello,

did you check TIA help about MB_MASTER instruction? Look to DATA_ADDR input parametet description, there you can see how you need define MODE due general MB function and MB address. Hope you'll find solution in that table.

Hi Duris_I

Thanks for your reply.

I have read the help files over and over again a lot of times now.

Talked to the support as well, but the local guys can't help me so much in this matter.

I have discovered that these blocks follow the old (now obsolete) Modbus standard.

They compare function code and register address, so if the address doesn't meet the function code, nothing is sent.

Let's hope for improvement in TIA V14 that will arrive any time now

Else I have to develop a library that works according to the latest revision of the standard.

Hello,

no problem to prepare your own little request and answer implementation if you know exact frame consistency. I see little doubt about update of system in TIA v14, but it can be confirmed by others, I still don't have installed. Good luck.

It's now working when running a slave simulator software in the PC.

I can now ask for holding or input register addresses from 1 to 99999.

It's no longer limited from (1 to 9999) as it was in the ready to use fnc blocks.

The only remaining thing is to test it against the external equipment.

I am not a Siemens guy, so I can't help you with Siemens specifics, but your problem seems to be the re-emergence of the legacy 5 digit vs 6 digit addresssing issue.

I assume 11201 is decimal, correct?

Is the blitzer 11201 register (4)11201 in a holding register or a (3)11201 in an input register?  Or (4)11202 or (3)11202 with a one offset?

Which means that 11201 is not (1)1201, a discrete input or an input coil, read by Function Code 2?

What you describe sounds like what has been commonly called '5 digit vs 6 digit' addressing issue.

Very early Modbus (back when memory was in units of Kb not Gb) could be memory limited and many devices used only 9999 decimal addresses within any memory area.  The four memory areas of 1 for output coils, 2 for input coils, 3 for input registers, and 4 for holding registers.  So (4)0000 to (4)9999 decimal covered everything, even though the Modbus two byte addressing scheme ranges up to (4)00000 (4)65535 decimal or 0000h to FFFFh.

4xxxx up to 49999 was '5 digit', 4xxxxx up to 465353 is known as '6 digit' (even though the leading numeral four is convention only, it is not part of the Modbus message).  I tend to put the leading numeral in parentheses to separate it from the indexd register value.

Your issue seems to be that the master compares, for example, the Function code 03 with the target register 11201 and misidentifies 11201 as (1)1201 which it thinks should be use Function Code 02, and throws an error.

The master does not recognize 11201 as (4)11201 for use with Function 03?

Although Siemens suffers from NIH (not invented here) syndrome with regards to Modbus, I'd be surprised if a 2nd decade/21st century Modbus implementation did not cover 6 digit addressing. 

5/6 digit addressing was a common issue in the 1990's but has diminished as a topic on Control.com (which hosts Modbus.org) with the evolution of electronics, specifically the low cost of memory and the disappearance of 8 bit embedded micros handling the data.




 

The problem I had with the Siemens "ready to use" blocks was that:

1. For Fnc Code 03, I needed to specify addresses from 40001 to 49999.

2. For Fnc Code 04, I needed to specify addresses from 30001 to 39999.

All other systems I worked with gives me the possibility to set a register address from 1 and upwards. They assumed that you knew what you asked for by the function code.

The Siemens blocks has a built in filter that don't allow you to do this.

If you look at the Modbus telegram to verify function code and register address:

Fnc Code might be 03 or 04, and the register address from 1 regardless if you write 30001 or 40001.

It's not possible to use the extended addressing mode, since some of  the slaves can't handle that.

So, I wrote my own Modbus function blocks that work according the latest Modbus specification.

Haven't really finished testing them to 100% against the HW, only used PC based slave emulators.

Edit:

Siemens really suffers from NIH sometimes, very good expression I normally use expressions with one more letter.