Sign in to follow this  
Followers 0
Chris Elston

Cognex Modbus TCP/IP to GE PLC CMM321 Module

4 posts in this topic

I've got some questions about Cognex Modbus. one question is Cognex the other a GE PLC.... I've posted before about my Cognex and GE PLC Modbus journey, I've got this working with the Cognex modbus sample I downloaded from Cognex support. It was pleasantly easy to do this. No ladder logic required if you want to write register values from the Cognex camera to the PLC. In my application, I want the camera to write X,Y,theta information into some registers within the GE PLC at the end of the inspection, this works good for me. The Cognex sample does this just great. I have one question and one problem, or maybe I need an explanation of what I am doing wrong. question #1: I don't understand the 2-byte thing that Cognex is formatting for the Modbus protocol. The whitepaper published by Cognex, InSightModbus.doc states QUOTE: We will need to send the register address over as two bytes. So if the register you want to write to/read from is register 100 then this would be written as: The upper byte of the reference address: 100/256 The lower byte of the reference address: Mod(100,256) So if we were reading from a reference address 100 using FC16, the byte8 would be: 100/256 = 0.391 And byte 9 would be: Mod(100,256) = 100 For hex this value would be 0x64 for byte 8. Byte 9 would contain 0. END QUOTE: The actual command in question is: QueryDevice(I30,$A$18,0,0,0,0,0,17,0,0x10,E30/256,Mod(E30,256),0,5,10,J32,K32,L32,M32,N32,O32,P32,Q32,R32,S32) E30 cell contains 100 assume in the above example. 0x10 defines Function Code 16 per the modbus protocol: Modbus_Application_Protocol_V1_1a.pdf My thinking is if I was going to write 100 over two bytes, the lower byte would be 4 and the upper would be 96. 0110 0100 I don't understand this spreadsheet math of taking the register number and dividing it by 256 to get 0.391 for the lower byte. Exactly what does that mean or do in the Cognex? Then using the register number with a Mod(100,256) function, using that for the upper byte. Can someone explain this theory? problem #1: While getting this Cognex to work, I was able to write to registers in my GE PLC using a CMM321 ethernet interface which supports Modbus. According to the GE manual gfk1541b.pdf in Appendix E defines the modbus mapping registers to registers in my GE PLC. If I write to modbus address 29185 from the Cognex camera, Appendix E in the GE manual indicates, the value should end up in register %R1. (which is like an integer location) This is NOT the case, the value is written to %R2. It's offset by one. It's not really a big deal now that I know that. That's why I am trying to understand the packet being sent from the Cognex to the GE PLC trying to troubleshoot this on my own. I figured if I could grasp the packet information, I could find out if there is an error in the Cognex sample or maybe the Appendix E from GE is a mis-print. Thanks for any information on these two issues. InSightModbus.doc gfk1541b.pdf modbus_sample.zip Modbus_Application_Protocol_V1_1a.pdf

Share this post


Link to post
Share on other sites
Question 1: The address can be a 16-bit word, so it needs to be split into two bytes. Dividing by 256 is the same as shifting the bits in the 16-bit word right by 8 places. This action moves the upper byte to the lower byte. The modulo operation returns the remainder of the division by 256, which is the lower byte. Question 2: Addresses in Modicon start at zero. Addresses in GE Fanuc start at 1. Thus, the first register in Modbus is 40000 while the first register in GE is %R00001. I would say that the table in the GE Fanuc manual should read Modbus register table 0 -255 for the %I addresses, 256 - 16639 for the %M addresses, etc. The Modbus protocol only defines four memeory types, outputs (0), inputs (1), analog inputs (3), and registers (4). Of these, types 1 and 3 are read-only. In order to allow access to GE Fanuc internals (%M) and analog outputs (%AQ), and to allow writing to %I and %AI memory, the CMM321 maps those memory types to %R addresses.

Share this post


Link to post
Share on other sites
How can I trigger the camera from the PLC? I see that I can use coils but I do not see anything that explains where they are in the IO map. Any help will be greatly appreciated.

Share this post


Link to post
Share on other sites
The coils are bits in the command register. If my memory is correct, for the DM300 bit zero is "Trigger Enable" which must be set and bit 02 is "Trigger".

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0