Sign in to follow this  
Followers 0
Hartman

5/03 comms problem

19 posts in this topic

Hi all..I'm new to the world of plc's but recently i've taken on a fault at work that has'nt been resolved for a couple of years Anyway the problem is communications between our dcs and an AB 5/03. Apparantly we did have comms for a short while coming from the processor (rs232 from modbus slave) going into a westermo ma-42 which presumably is a convertor to RS422 because the distance is about 100m from plc to dcs. On the rack there is also a 1747 ke module which was connected to pc using the df1 port-this also does not communicate (even with the link cable from dh485 from processor to 1747ke module). When a laptop is connected to the dh485 on the processor it connects fine. Anyway i know i probably havent given enough information here but if someone can help.. The cable connections themselves are ok and the westermo unit does actually flash rd and sd and i'm told that the dcs side is fine too.

Share this post


Link to post
Share on other sites
Just an update for anyone.. Ive checked what signals we are getting at our dcs and its coming up as illegal data value! but at least its getting something.Our dcs is the master and the 5/03 is the slave.I checked the dcs settings which were modbus protocol,8 data bits,1 stop bit,parity none and 9600 baud rate. I tried configuring channel 0 to match but i'm not sure of the protocol for modbus? should it be full duplex? also will the plc know its the slave? where can i check that setting? i'm close to getting it working...any advice?

Share this post


Link to post
Share on other sites
Your SLC5/03 does not support Modbus protocol ( DF1 or DH485 only). Nor does the KE module. You will need some kind of thrid party protocol converter to communicate using Modbus.(see links below). Or change your DCS to use DF1 or DH485 if it supports it. http://www.mrplc.com/sites/follow.cgi?262 http://www.mrplc.com/sites/follow.cgi?541 Edited by Mickey

Share this post


Link to post
Share on other sites
Examine that SLC-5/03 very carefully. Does the front label read "RTU 5/03" ? These were a special edition of the SLC-5/03 controller that had firmware installed to make the Channel 0 RS232 serial port behave as a Modbus RTU protocol slave. The controllers were built by Allen-Bradley but sold by Prosoft Technology. If that's not the case, then you definitely have a apples/oranges connection. The Channel 0 port on a normal SLC-5/03 supports ASCII, and DH485, and DF1 Full and Half dupex protocols, as does the Comm port on a 1747-KE module. Figure out how this was ever supposed to work (does the DCS support DF1 protocol ?) and learn the configuration of the 1747-KE module. Generally with KE's, you shut down and pull out the module, switch the JW4 jumper to Configure mode, then reinsert, power back up, and connect via Hyperterminal at 1200 baud/ Xon/Xoff handshaking. Get the 1747-KE module from literature.rockwellautomation.com for more instructions.

Share this post


Link to post
Share on other sites
Thanks for the replies guys.. I do have the prosoft RTU 5/03 card which as you say does support modbus protocol, The comms did work for a week but after a power cut it never worked again..that was a long time ago and a few people have tried to repair it! The 1747 KE was there to connect to a local pc next to the plc which now also doesnt work.but i'm not worried about the pc.The comms to our control room are all i'm concentrating on at the minute. I have ordered another 232 to 422 convertor to see if its the westermo unit causing the upset.I also have a prosoft mcm-3150 module which i'm tempted to try and install but i dont think its going to solve the language barrier problem.. Thanks again..i'll keep you posted..

Share this post


Link to post
Share on other sites
I tried the new 232 to 422 convertor and alas the signal to the dcs stayed the same..which i suppose proves that the westermo was working ok. I have no idea what to do next! ... is there any literature that can help me with communications problems? i need something to talk me through a complete set up of the comms.. thanks

Share this post


Link to post
Share on other sites
Hartman, from your posts, I suppose the communication route is DF1(RS232) from SLC processor => RS232/RS422 converter => RS422 cable => RS232/RS422 converter => Modbus port of your DCS. Did you do something as Mickey suggested? You need a third party module to make DF1 and Modbus talk to each other.

Share this post


Link to post
Share on other sites
Taotaoba, See his post #7 he has one of these ( see link below) http://www.prosoft-technology.com/content/...765/145974/file

Share this post


Link to post
Share on other sites
I have been in the middle of DCS to PLC communication problems before. It has been my experience that the DCS end is more the touble than the PLC. Have you looked at the hardware/software combination that is the interface on the DCS? Is it a separate interface card that can be reseated or even reboot the firmware?

Share this post


Link to post
Share on other sites
The saga continues...I didnt realise this before but having checked the N100 tables i'm getting the fault 104 at N100/21 which is bad length (exceeds data table length) and at N100/24 fault 3 which is illegal data value?? what does this mean exactly and what should it be??? The modbus driver is active and everything else looks ok..

Share this post


Link to post
Share on other sites
What values are your DCS writing down to the PLC? You maybe writing values outside the range of the integer data table causing the error.

Share this post


Link to post
Share on other sites
Im not sure how i find this out i've been reading up on integers and words and i cant get my head round it..is there a way of seeing the values when i'm connected with RSlogix?

Share this post


Link to post
Share on other sites
The way I'd go about it is to connect your PC in place of the RTU-5/03 and run a serial analyzer to see what Modbus commands the DCS is sending. I use a lot of commercial and shareware serial analyzers like the ones from Docklight and HHD Software, but for your purposes I'd recommend Tal Technologies Breakout program. It's a really simple way to show serial data coming into a serial port on your PC. http://www.taltech.com/freesoftware/fs_sw.htm Then you can decode the Modbus commands manually, or using a nifty program that parses Modbus for you: http://www.chipkin.com/a/resources/modbus/parser/ Once you know what registers and lengths the DCS is polling, you can check the configuration of your RTU-5/03 to see if it can handle those requests.

Share this post


Link to post
Share on other sites
hi..happy new year folks , i have managed to use the programs suggested above to check the dcs messages,and this is what i've got.... Frame Analysis (<SOH><EOT><NUL><NUL><NUL><LF>p<CR>) -------------- Error #0007 The checksum is invalid. Actual=0x2ee70c Required=0x7ebf The frame has errors but there may be sufficient information to analyse the message. . We do not support analysis of of some functions in this version of the application. Function code=14(dec)=0xe No further analysis is possible. If someone can make sense of this i'd be very greatful.

Share this post


Link to post
Share on other sites
Excellent information ! Let's first change the ASCII codes for hexadecimal values: <SOH><EOT><NUL><NUL><NUL><LF>p<CR>) 01 04 00 00 00 0A 70 0d Modbus format is as follows: [Address] [Function] [Data] [Checksum] When we run the above format through the parser, we get: ------------------------------------------------------------- The frame has no errors. Poll Analysis Device Address =1 =0x01 Function =4 =0x04 =Read Input Registers Point Address =30001 Point Count =10 ------------------------------------------------------------- The slave address as Node 01 makes sense. Modbus Function 4 has two arguments: Starting Address (0x0000) and Number of Registers (0x000A) The RTU-5/03 controller supports Modbus Function 4 as part of the standard Modbus function set, but I'd have to see your actual configuration (the RSLogix 500 *.RSS file) to make sure that you've configured the Input Register (Modbus function 4, Modbus addresses 3xxxxx) correctly. Edited by Ken Roach

Share this post


Link to post
Share on other sites
I downloaded the Prosoft RTU-5/03 user manual and did some reading. Based on the error codes you described: N100:21 = 104, Bad Length / Exceeds Data Table End N100:24 = 3, Illegal Data Value / Count Field exceeds Data Table size I think that the configuration for the SLC data file that represents Modbus Input Registers (Modbus address 3xxxxx) may not be configured correctly. Check the value of N100:4 in your RSLogix 500 program. N100:4 Modbus Input Register Data Table. This should be the SLC data table number that will represent Modbus Input Registers. Be sure this data table number exists and is 10 or more elements in size.

Share this post


Link to post
Share on other sites
Good news people...I have got comms now!! Although..I'm not sure how...As you mentioned above ken, i checked the value in n100:4 and it was 14,and the others were as follows n100:2=10 n100:3=12 n100:5=16 and n100:6=18 The only way i could get the comms to work was by setting all the above values to 0 ? This is obviously not working correctly as the control room screen is only 75% correct, info such as pump on or off,motor on or off etc.. The integer values n7:0 to n7:7 are way off the mark(on the control screen) of what they should be even though the output values in the ladder are correct. I think its to do with the values in n100:2 to n100:6 but how do you know what these should be? needless to say i'm over the moon with the progress..Thanks to all who replied..

Share this post


Link to post
Share on other sites
I suspect that what happened is that now the DCS is reading the data in Data File 0 (the Output data image of the SLC) instead of in Data File N14. Can you post the *.RSS file for your RTU-5/03 controller ? That way Forum members can check the configuration themselves. Usually I just create a ZIP file from the .RSS and post that.

Share this post


Link to post
Share on other sites
According to the User Manual, N100:2 = 10 Modbus Coil registers 0xxxxx are in SLC data file N10 N100:3 = 12 Modbus Contact registers 1xxxxx are in SLC data file N12 N100:4 = 14 Modbus Input Registers 3xxxxx are in SLC data file N14 N100:5 = 16 Modbus Holding Registers 4xxxxx are in SLC data file N16 N100:6 = 18 Modbus Floating Point Holding Registers 47xxxx are in SLC data file F18 Check the size of the N14 integer data file to be sure that it's more than 10 registers in length. I think that the "set all pointers to 0" just made all Modbus data read from SLC data file 0, which isn't what you want. It just happens to work because data file 0 is large enough to allow the requests.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0