Sign in to follow this  
Followers 0
TimJ11

slc 5/05 modbus

26 posts in this topic

Has anyone done any communication over Ethernet to modbus devices? I have an AB SLC 5/05 with enet communicating to an enet-modbus adapter. The modbus comms to 6 Telemecanique Altivar 31 Drives. So far I have figured out the message instruction addresses the ethernet IP address, and I know the data and structure the drives require. My question is: how do you format the message instructions destination device? Is it Peer-to-Peer, 485CIP, or what? If anyone has experience with this I would greatly appreciate help. Thanx, Tim

Share this post


Link to post
Share on other sites
Getting Modbus onto TCP is easy. You simply insert ANY available serial TCP server. There are at least a dozen on the market. If you paid more than about $100-$200 per port, you were ripped off. There is no magic to Modbus. On the other hand, Allen Bradley went out of their way to make sure that ALL of the protocols that they support over Ethernet are complicated and not easily translated like Modbus is. And none of them support Modbus directly. You HAVE to have a protocol translator. There are 3 possible options: 1. Install a Micrologix 1100. It has both an Ethernet port and a serial port. The serial port can communicate in Modbus/RTU DIRECTLY (supports RS-485 natively). You simply connect your Modbus network directly into the Micrologix 1100. Read the data into the Micrologix. Then simply use a peer-to-peer MSG block over Ethernet to communicate to the SLC 5/05. You can't do Modbus/TCP but you don't have to since you are already attempting to go from Modbus/RTU (or /ASCII) to Modbus/TCP. You can eliminate a component. Frankly, at about $500 US around here, a Micrologix 1100 is the least expensive "remote I/O" solution that Allen Bradley sells except for SOME Point I/O and SOME CompactBlock solutions for low density remote I/O. Usually the only puzzling part is what to do with the free serial port, display, and PLC that you get as a built-in option on these "smart" remote I/O blocks. 2. Install a Digi One IAP. This is a protocol translator. It has 2 serial ports and one Ethernet port. It can do Modbus/RTU, Modbus/ASCII, or Modbus/TCP translated to CSP. In effect it appears as if it is a SLC 5/05 on your network. Even though the packets are going in/out of the same Ethernet port, this doesn't matter. You can mix and match the 3 ports any way you want. The locations in memory that you specify get translated between Modbus and SLC 5/05. It is a little confusing to set it up but once you've done it, it works very well. I have one serving Modbus/TCP I/O to a PLC-5. 3. Buy a Prosoft Modbus/TCP or Modbus/RTU adapter. This plugs into the backplane. It is the most expensive option. It is not a translater, it's a mapper. You have to connect to a serial port on it with your PC and manually construct a map for it to use. It works but you can't make online changes. It only supports whatever your map specifies and nothing else. This is the most expensive and least flexible solution.

Share this post


Link to post
Share on other sites
Thanx, for the response Sparky, We do have a Lantronix ethernet to modbus adapter, but I am not sure it is a translator. It has two serial ports (RJ45) and two ethernet ports. It also has screw terminals for the serial port 2. This is the method I must use because the RJ45 serial ports only support RS232. The screw terminal port is the only one that supports RS485. I have to connect to the Lantronix via a serial port with my laptop to set up the modbus comms, and to set up the IP address of the Lantronix device. If this is a translator, that's great. Unfortunately, as you have stated, it is difficult to determine how to configure the msg in the 5/05 instruction itself, or even if it can be done. Currently I have the message instruction set up for CIP485. I have not been on line to the processor yet to see if that will work as I am doing the programming off line for now. I hope to download the new program early this week. I don't suppose anyone has had any luck trying AB or Rockwell support? The last time I tried them (years ago) they wanted to charge a fee. My customer may be willing to pay the fee, but the idea of paying them to use their products just doesn't sit well with me. If I have to, then I have to. Tim Edited by TimJ11

Share this post


Link to post
Share on other sites
Post the exact part number of the Lantronix device you have. It might or might not be a protocol translator. From your description it might be an XPress DR1+, which is almost what you need. The SLC-5/05 does not support Modbus/TCP on the Ethernet port nor does it support Modbus RTU on the serial port. The most successful device I have used to translate between SLC-5/05 controllers and Modbus RTU with an intervening Ethernet link is the Digi One IAP. That device is aware of both the A-B and Modbus protocols on Ethernet and can translate either one to Modbus RTU.

Share this post


Link to post
Share on other sites
Thanx for your response Eddie, The XPress DR1+ is exactly the module that was purchased. There is a mention in the manual about an XPress AI1, but I don't know if that is the same thing you are referring to. Looks like I'll tell my customer he got the wrong device, although I'm sure a salesman told him that the XPress DR1+ is what he needed. (Makes me glad I didn't spec it!)

Share this post


Link to post
Share on other sites
I talked my customer into buying the Digi One IAP. We are getting it next day air. I took a look at some manuals, and confusing is an understatement. I am not an expert network guy, only experience is with of course the rockwell networks, devicenet, controlnet, df1. a little profibus years ago and just a little bit of IP stuff. I hope I can make this work as I was just informed that my customers' customer will be here Thursday to see the lines run. I still have to develop the algorithm for formatting strings via modbus to/from the drives and the PLC. (it looks like some of the data words from the drives don't line up with the 16 bit words in the plc. Some of the bytes are split, and the lower byte is shifted and becomes the hight byte of the next word). Any help in setting the Digi One would be a greatly appreciated as it would be a time saver. Thanx to anyone that might be able to help

Share this post


Link to post
Share on other sites
Go through the wizard. It will help you get everything set up. Don't even try to figure out the Modbus/SLC 5/05 "location" stuff on your own. It never seemed to quite work correctly for me. Use the Excel spreadsheets to do that. I had the best luck also with the 0x4 and 0x5 Modbus addresses. If you get stuck, there's also a "forum" on the Digi web site. At least at one time, Lynn Linse (seems to be the programmer for the Digi One IAP) cruised the forums and routinely gave helpful information. I strongly recommend that while you are debugging, first attempt a simple RS-232/Ethernet conversion across a laptop to verify that you can make everything work correctly. Then download one of the free or demo "PC modbus troubleshooting" type programs that let you simply poll an address. Use this again the the "serial/Ethernet" or "serial/serial" conversion to verify that everything works as expected. Finally, attempt to do the same things via the SLC 5/05 once you can consistently get Modbus communication to work through the Digi One IAP with a PC.

Share this post


Link to post
Share on other sites
Go through the wizard. It will help you get everything set up. Don't even try to figure out the Modbus/SLC 5/05 "location" stuff on your own. It never seemed to quite work correctly for me. Use the Excel spreadsheets to do that. I had the best luck also with the 0x4 and 0x5 Modbus addresses. If you get stuck, there's also a "forum" on the Digi web site. At least at one time, Lynn Linse (seems to be the programmer for the Digi One IAP) cruised the forums and routinely gave helpful information. I strongly recommend that while you are debugging, first attempt a simple RS-232/Ethernet conversion across a laptop to verify that you can make everything work correctly. Then download one of the free or demo "PC modbus troubleshooting" type programs that let you simply poll an address. Use this again the the "serial/Ethernet" or "serial/serial" conversion to verify that everything works as expected. Finally, attempt to do the same things via the SLC 5/05 once you can consistently get Modbus communication to work through the Digi One IAP with a PC.

Share this post


Link to post
Share on other sites
Do you have power on the Modbus network? Check with a volt meter. If there's no generator, it probably won't work. Download the protocol specification from www.modbus.org. One of the major problems with Modbus is that there is no less than 4 different implementations of the hardware connections. It sounds like you need to start with the Modbus side of things. Start out by getting rid of the extra stuff. Get both ports of the Digi One working in "passthru" mode unless you have an RS-232/RS-485 converter box. Work on getting Modbus working first with ONE node. The exact resistance necessary to terminate things with just resistors can be somewhat trial-and-error. Again, modbus.org gives you about the best information.

Share this post


Link to post
Share on other sites
Thanx a bunch, I will look at these things today. I wondered about power for the Modbus, I didn't know where it came from, the rep I talked to this morning says it is just a 5 volt, low current signal that can only be verified with a scope. He also suggested using a gateway before the Lantronix devices. He suggests an HMI or another small processor, as was mentioned above on this web site. I would rather get the DigiOne working simply because of the 8 node limit on the Lantronix.

Share this post


Link to post
Share on other sites
I set up the DigiOne for pass-thru and used a program I got from the Internet and I could read data from the dirves. I then set the DigiOne Enet port for Modbus IP, and that worked with my program also. I polled several drives so ModBus is working. If I set up the DigiOne Enet port to Ethernet IP, RSLinx finds it on the network and shows connections to it. If I set the DigiOne Enet port to AB Ethernet, Linx does not find it. It looks like it is some kind of Enet settings. I set all the IP addresses (170.230.138.xxx) and made sure the submasks were the same 255.255.255.0 It could also be the msg instruction also. I tried writing data words to the control word, like node and function and beginning word number, then I realized most of that data is already in the msg instruction. I can see all of it (using the XLS calculator) except the node number. I tried adding the node number at the beginning of the IP address in the instruction, followed by a comma and I still don't get good data. I tried adding the node number at the end of the IP address in the instruction, preceded by a comma, and I still don't get good data. I tried writing the node number to the first byte in the control word, and that didn't work either. I don't understand how the message gets routed to the correct drive. I have made all of these attempts with only one drive on the network. I tried all the combinations of msg instruction and DigiOne Enet settings, and I cannot see any valid data. I simply get garbage with the error bit set in the msg instruction. I don't even know for sure if the error code is dependable.

Share this post


Link to post
Share on other sites
This is consistent with the way RSLinx works. The "EtherNet/IP" driver performs a broadcast of the "List Identity" function of the CIP protocol, and everything on the subnet answers with its identity object information. The "Ethernet Devices" driver requires a table of IP addresses to which it attempts to connect using the older TCP Port 2222 based A-B Ethernet protocol. A general description of how to do the the function you need is here: http://iatips.wikispaces.com/Rockwell-PLC-...g-Modbus-slaves

Share this post


Link to post
Share on other sites
I have seen this document before, but like all the examples I have seen to date, mention the capacity to communicate with an SLC 5/05, then proceed to show as RS 5000 platform example. I don't know of a way to make sure the SLC is sending information to the DOIAP, but an example of how to program the msg function would be helpful in that I can eliminate bad programming as the cause of the problem.

Share this post


Link to post
Share on other sites
http://iatips.wikispaces.com/Rockwell-PLC-...g-Modbus-slaves

Share this post


Link to post
Share on other sites
Take a deep breath, Tim, and please accept this in a constructive light. It would be more informative if you would post the configuration of the MSG block in tabular format or a cropped screenshot of the MSG instruction configuration window in RSLogix 500. It would also be informative for you to post the DOIAP configuration or at least describe it in detail, rather than just designating that it's set up for one protocol or another. "I set it up for all three protocols" is an act of panic, not of analysis. Post the Modbus node numbers of your Modbus RTU slave drives, and post the Modbus addresses you are trying to read and write from them. The SLC-style addressing to Modbus addressing translation is pretty straightforward, especially with the Excel calculator. What you're having trouble with is you confidence in the basic Ethernet setup, and in the mechanism that the Digi One IAP uses to designate the remote Modbus slave address. In a ControlLogix message block, the "CIP With Source ID" addressing option is used. This is the sneaky part of the implementation. If you read the RSLogix 5000 Help file, or the RA Knowledgebase, you'll find that this mechanism is used to send a CIP message to RSLinx Unsolicited Topics, which use the Source ID to identify the data that's coming to it. in RSLogix 5000: Source Link: 0 Source ID: Modbus destination node number Destination Link: 0 The Digi One IAP uses the Source ID not to identify the source of the data, but rather as the Remote Modbus Slave address when it generates a Modbus Read or Modbus Write. So how do we get the same configuration in RSLogix 500 with the MSG instruction, which has a different configuration window ? When you configure the MSG instruction block (in the ladder editor) there are options for Read/Write and Target Device (500CPU/485CIF/PLC5), as well as for Local/Remote. Select Read, and 500CPU (this makes it an SLC Typed Read, which the Digi One IAP supports). Select Remote, and then look at the Setup Screen. The target configuration has three extra fields: Remote Bridge Addr (decimal): 0 Remote Station Address (decimal): Modbus Slave node number Remote Bridge Link ID (decimal): 0 That's my understanding of the Remote Addressing mechanism. I haven't specifically done this with SLC-5/05 and Digi One IAP, so I'm not actually giving you instructions by heart. Because you have set "Multi-Hop" to "No" in the RSLogix 500 MSG instruction configuration, the SLC will use the older A-B Ethernet (CSPv4) protocol, not EtherNet/IP. Configure the Digi One IAP accordingly for only that older protocol.

Share this post


Link to post
Share on other sites
A confirmation of what I was thinking about using the Remote Destination Address to designate the Modbus Slave Node number: http://iatips.wikispaces.com/Edit-RSLogix-500-MSG-SLC505

Share this post


Link to post
Share on other sites
I tried to add the screen shot, but I don't know if it shows. I attached some doc files of the screen shots. (screen_shots.doc and screen_shots1.doc) Suffice it to say the rung with the message and the config pop-up window are nearly identical to the ones shown on Lyn's site. The differences are the IP address and the address of the target word. In case the docs cannot be read this is what I have: A conditioned rung with the message instruction. I fire a one shot, seal the msg with the EN bit, and de-energize it with the DN and ER bits. The box looks like this: Read/Write Message Type Peer-to-Peer Read/Write Read Target Device 500CPU Local/Remote Remote Control Block N16:0 Ctr Blck Lngth 51 The Pop-Up looks like this (without the status bits): This Controller Communication Command 500CPU Read Data Table Address N17:0 Size in Elements 1 Channel 1 Target Device Message Timeout 23 Data Table Address N42:6 (From the spreadsheet, Drive Current Voltage ) Ethernet IP Address 170.230.138.231 Local/Remote Remote MultiHop No Remote Bridge Addr (dec) 0 Remote Sta Addr (dec) 1 Remote Bridge Link ID 0 It would also be informative for you to post the DOIAP configuration or at least describe it in detail, rather than just designating that it's set up for one protocol or another. "I set it up for all three protocols" is an act of panic, not of analysis. (again I tried to post screen shot screen_shots2.doc) this is a copy of the ia config summary table=1 name=Drives table=1 route=1 protocol=modbusrtu protaddr=0-32 type=serial port=1 table=1 route=1 active=on Network Sources (Masters): master=1 protocol=abethernet table=1 transport=tcp ipport=2222 master=1 chartimeout=50ms messagetimeout=2500ms idletimeout=5min permit=all master=1 priority=medium master=1 active=on Serial Sources/Destinations (Masters/Slaves): serial=1 protocol=modbusrtu type=slave table=1 messagetimeout=2500ms serial=1 slavetimeout=1sec chartimeout=20ms serial=1 broadcast=off This from the Network Configuration window Obtain an IP address automatically using DHCP * Use the following IP address: (this is the option chosen) * IP Address: 170.230.138.231 * Subnet Mask: 255.255.255.0 Default Gateway: 170.230.138.0 (the software prevents me from entering 0.0.0.0) This from the Serial Port Configuration Window Port Description Profile Serial Configuration Action Port 1 None Industrial Automation 19200 8E1 Copy... Port 2 None <Unassigned> 9600 8N1 Copy... This from the Device Information window Device Information System Model: Digi One IAP Firmware Version: Version 82000770_G 04/04/2007 MAC Address: 00:40:9D:33:49:25 CPU Utilization: 0% Up Time: 4 hours 14 minutes 11 seconds Power Sources: External power supply Powered 802.3af powered Ethernet Not Powered Network DHCP: Off IP Address: 170.230.138.231 Host Name: Network Diagnostics Network Protocols Route Table This from the Route Table Diagnostics Route Table Diagnostics Index Network Subnet Mask Gateway Metric Interface 1 0.0.0.0 0.0.0.0 170.230.138.0 1 ether 2 170.230.138.0 255.255.255.0 170.230.138.231 0 ether I am only trying to poll one drive at this time, node 1. I am attempting to poll a function 4, address 3207, which should be the current voltage of the drive. This is the same address I used for the pass-thru serial port test and the Modbus IP test, both of which I could display the drive voltage in real time. I have the rest of the drives powered down so as not to add confusion. I hope this sheds some light, I can provide more information if you tell me where to find it. I have look at everything I could find on the DOIAP. Thank you again for the help and support. screen_shots.doc screen_shots1.doc screen_shots2.doc

Share this post


Link to post
Share on other sites
Now that's more like it ! While I digest that information, I have two questions for clarification: 1. When you trigger the MSG instruction in the SLC and allow it to complete just once, is there an error code, or does it complete successfully ? 2. You mentioned "I am attempting to poll a function 4, address 3207, which should be the current voltage of the drive." Modbus can get confusing because the Functions are different from the prefix numbers used in Modicon controllers. Function Code 0x03 reads Holding Registers, which are addressed as "4xxxxx" Function Code 0x04 reads Analog Input Registers, which are addressed as "3xxxx" Can you post a link or details about the Modbus implementation in the Altivar 31's ? [Edit: I read a document that says the Altivar 31 supports Modbus Functions 03, 06, and 16, all of which address Holding Registers, "4xxxxxx"] Edited by Eddie Willers

Share this post


Link to post
Share on other sites
I was in a mild panic as this line was supposed to run last Thursday. I ordered I/O, relays, and cable to hard wire the drives to the PLC (this is how the existing line is), but my customer wants to use networking instead. I have until Monday eve to get the networks to run, else the new components will be picked up and installed so the I can get the programming done by next Thursday. I would rather get the network to function and do the programming required for that. Thanx again (I can't thank you enough) Modbus_ATV31.pdf Tele_Drive_Modbus_Addresses.pdf

Share this post


Link to post
Share on other sites
"Error code 30, The remote host is not there, disconnected, or shut down." This means that the message is getting through to the Digi One IAP, which is responding with an error code instead of with a success code and the data you requested. This is the same kind of error code you'd get if you were sending a message through any Rockwell protocol bridge and the device on the far network (the remote host) did not respond. If the message were not getting through to the Digi One IAP, you would get a different error code, usually 0x37 Message Timed out in Local Processor.

Share this post


Link to post
Share on other sites
You described the Digi One IAP as working correctly when you set it up for use with a Modbus/TCP master and as a passthrough device, which makes me assume that you have the serial port on it configured correctly, but I don't trust my assumption. The above configuration for the serial port on the DOIAP with type=slave concerns me. We want the serial port on the DOIAP to be a Modbus RTU Master, as the Altivar 31 drives are Modbus RTU Slaves. The Digi website has a lot of good stuff (not to mention Lynn Linse's multiple personal sites) but I have not found a really substantial User Manual for the Digi One IAP. There are a lot of step-by-step guides for specific features but nothing that I'd call a reference manual. Edited by Eddie Willers

Share this post


Link to post
Share on other sites
The Digi One terminology is confusing me a little bit. Within the realm of the Digi One IAP itself, the message sources are called "masters" and the message destinations are called "slaves". But I remain very skeptical of the configuration of the Serial port on the Digi One IAP. The telnet host described in the User Manual I finally found (publication 90000263_b.pdf) does show the serial port configured as a "Modbus Slave" even when I think it should say Master. This document also includes proofreading notes to from the editor to the author, which makes me not totally trust its contents. Make sure you cycle power to the DOIAP whenever you change its configuration ! A slightly-related note on your MSG instructions: You don't need to "seal in" a MSG instruction with the /EN bit. Once the preconditions on the rung go from false to true, the MSG is enabled until it is through executing. This can happen because it's Done (/DN=1), because it has Errored (/ER = 1), or because you have manually timed it out (you set /TO =1, it sets /ER =1). When I write message instructions that run on a periodic basis, I condition my MSG block with the /DN bit of my periodic timer in series with an XIO instruction addressed to the /EN bit of the MSG command word. That way the MSG doesn't get re-enabled (and thus stuck into the queue) before it's completed the previous execution. Edited by Eddie Willers

Share this post


Link to post
Share on other sites
I have been rebooting the DOIAP, but not cycling power. I will do this from now on. I can certainly try configuring the serial port to be a master, at this point, it wouldn't hurt. I normally use the wizard which simply states, configure the master (the port that recieves messages from the device), then set up the slave (the port that sends messages to devices). This is getting confusing. I see your point, carrying the logic the next step (if I follow it correctly) the Ethernet port could be the slave port because it receives messages from the 'master' (plc). I had intended staying home Sunday and working on the plc program for hardwired I/O, but maybe I'll go into the plant and try some more configurations, and this time, cycle power on the DOIAP. I will attempt to set up the serial and Ethernet ports as masters, and work out from there. I'll check some of Lyns other sites as well since I have only looked at one. I will also investigate the pdf you mention. Once again, thanx

Share this post


Link to post
Share on other sites
Another attempt you could make is to designate the RS232 port on the Digi One IAP as the Modbus RTU serial port, and attach a serial sniffer to that port. Even Hyperterminal will tell you if the Digi One IAP is even attempting to send a Modbus command when you hit it with the SLC Typed Read request from the SLC-5/05. If you have a managed Ethernet switch that supports Port Mirroring, you could try to intercept the data going from the SLC to the DOIAP with a utility like Wireshark. With all the data you've provided, those are the only two steps I can really think of short of walking through the Digi One IAP setup myself.

Share this post


Link to post
Share on other sites
I will try this today. I assumed the DOIAP was working as far as Modbus goes because of the two tests I have already performed. That is, configuring the DOAIP serial port 1 as slave and serial port 2 as pass-thru master. Using MB Poll, a program I downloaded, I could read address 3207 from node 1 in real time. Next I disconnected my laptop from port 2 of the DOIAP, and configured the Ethernet port as Modbus master. Using the same MB Poll program, I again was able to read the same address. I believed then that the DOIAP was working and the ports had to be configured as serial port 1: slave; Ethernet port: master. As for the tests you mention, I will definitely try these because I was wondering if there were ways to find out if the PLC commands were being received by the DOIAP and also being passed thru it. Thanx for this additional information

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0