NX_ModbusRtuRead how to avoid error 16#0406

[urvhalt 0]

PLC NX1P29B24DT1 v1.47

Sysmac studio 1.53

Instruction NX_ModbusRtuRead

Used port for Modbus RTU is:  option board NX1W-CIF11, put straigt into the PLC.

 

Is there any way to avoid the error that gaives error id  16#0406?

 

I do use NX_ModbusRtuWrite for writing 16-bit registers, without any issues, works like a charm :)

 

However, NX_ModbusRTURead always give me error id 16#0406. 

 

On the bus, using oscilloscope - I can see and decode the data transaction, for example for reading holding or input registers from some node. . It does successfully complete with correct request sent out 

and response coming back. Figured NX_ModbusRTURead has some trouble delivering the results to me, 

 

I have tried allocating read result registers to:

no area, just symbol  ( like how NX_ModbusRTUWrite can be used )

D area,  or W area.

I simply use an array of words. I have tried 1 word ( single or in array ), i have tried array of 63 words,

 

i have tried to attach the array  to the function block instance  in different ways -   with and without index, and also as single word.   

 

( I did try variants regarding data areas,  because some japaneese or chineese exampe that did use NX_ModbusRTURead using D-area for read registers, and I guessed maybe there is some legacy stuff involved, Finally tried that example as a whole  -  got the same error, 16#0406   The example is   "iO-GRID_M_Modbus_RTU_Connection_Operating_Manual(OMRON_NX1P2)_TC.pdf"  from Daudin coorporation. That example is somewhat ugly amd rough ( for exaple the use of 0.25ms timer )   ....  but i guess someone got it working and thereof did produce the document.   ).

 

Tried  instances of NX_ModbusRTURead     the instance are accompanied with a sequece for handling communications, and errors, properly.     For some strange reason, usage examples never do that..  )

Most parameters and data-types used are probably good, because it do actually send and recieve data.

fbi_rtu_read(    Execute:=rtu_read_exec
                            , DevicePort:=port      
                            , SlaveAdr:=rtu_read_adr
                            , ReadCmd:=rtu_read_cmd
                            , ReadDat:=read_regs           // array 1..63   of word     also tried smaller array:  reading 8 words to an 8 word array.  Tried using no area,   tried using D-area:  D0..D62
                            , Option:=rtu_options
                            , Abort:=rtu_read_abort
                            , Done=>rtu_read_done
                            , Busy=>rtu_read_busy
                            , CommandAborted=>rtu_read_aborted
                            , Error=>rtu_read_error           always true when amswewr from node has arrived
                            , ErrorID=>rtu_read_errid        always gives 16#0406        ( if node is available and responds correctly )
                            , ErrorIDEx=>rtu_read_erridx    no nothing here ( 0 )
                            , ReadSize=>rtu_read_rsz );

 

And this:

 

fbi_rtu_read(    Execute:=rtu_read_exec
                            , DevicePort:=port      
                            , SlaveAdr:=rtu_read_adr
                            , ReadCmd:=rtu_read_cmd
                            , ReadDat:=read_regs[0]      //   <-  compiler does accept with and without index...    so i have tried both.  This is probably for a single word.  (
                            , Option:=rtu_options         
                            , Abort:=rtu_read_abort
                            , Done=>rtu_read_done
                            , Busy=>rtu_read_busy
                            , CommandAborted=>rtu_read_aborted
                            , Error=>rtu_read_error 
                            , ErrorID=>rtu_read_errid      
                            , ErrorIDEx=>rtu_read_erridx
                            , ReadSize=>rtu_read_rsz );

 

and this

 

fbi_rtu_read(    Execute:=rtu_read_exec
                            , DevicePort:=port      
                            , SlaveAdr:=rtu_read_adr
                            , ReadCmd:=rtu_read_cmd
                            , ReadDat:=read_reg                reading single holding register, one word,  without allocation  or in D-area      the communication do occur, get a proper ansver on the bus
                            , Option:=rtu_options
                            , Abort:=rtu_read_abort
                            , Done=>rtu_read_done
                            , Busy=>rtu_read_busy
                            , CommandAborted=>rtu_read_aborted
                            , Error=>rtu_read_error         .. true
                            , ErrorID=>rtu_read_errid          16#0406
                            , ErrorIDEx=>rtu_read_erridx
                            , ReadSize=>rtu_read_rsz );

 

 

Maybe the NX1W-CIF11, has some legacy properties that  locks down read registers to be at an  very specific address? 

 

Thankful for any ideas / Patrik

[photovoltaic 122]

16#0406 means you are receiving more data than you can accommodate. Give yourself a large buffer or ask for less data

[urvhalt 0]

18 hours ago, photovoltaic said:

16#0406 means you are receiving more data than you can accommodate. Give yourself a large buffer or ask for less data.   Attached oscilloscope image:  PLC is reading one reg with fn3 from node 4,  Response has  two bytes ( the 02 )     = 1 word, back, and the checksum.    I request 1 word,  i get 1 word.. ..             thankful for any input / Patrik

Interesting, Do you know for sure that, that is the only way to get 16#0406?        if I ask for one register to be read, and do supply     ARRAY[1..63] OF WORD   .. i dont really see how it cannot fit..   kind regards / Patrik

[urvhalt 0]

Tried supplying "read_regs"   array 0..4096 of word     somewhat overkill...    still get error 16#0406.   Attached screen dump is taken after the error was detected, so execute is low and error is low, but error id lingers. Watch tab shows read parameters.  (  Also,  the fb emits  the result   ReadSize  = 1   -  so the function block did manage to recieve what i asked for   ) .

Thankful for any input/help.  / Patrik

 

[photovoltaic 122]

I am going off the error code definition in manual W502 page 2-1131.

https://assets.omron.com/m/4af2f29325f303b2/original/NJNX-series_Instructions_Reference_Manual.pdf

16#0406: CmdSize exceeded the area of CmdDat[].

Have you tried running a Modbus slave simulator on your PC and seeing the results? Share your program and I can test it for you.

[urvhalt 0]

4 hours ago, photovoltaic said:

I am going off the error code definition in manual W502 page 2-1131.

https://assets.omron.com/m/4af2f29325f303b2/original/NJNX-series_Instructions_Reference_Manual.pdf

16#0406: CmdSize exceeded the area of CmdDat[].

Have you tried running a Modbus slave simulator on your PC and seeing the results? Share your program and I can test it for you.

2-1131: yes, however that is for Modbus TCP.

This issue is regarding RS-485,  NX_ModbusRTURead  ( W502:  2-1310 ).  Of course error 0406 Might be something very similar for Modbus RTU, but there might also be slight differences depending on implementation choices, hardware limits, protcol specification and so on..   Error id 0406 is not documented for NX_ModbusRTURead or other RTU related functions. 

Yes I will put some source-code archive here, maybe tomorrow.   

 (  Other ideas:  i do use clearbuf before writes and before reads, removing any junk.  I do check busy between any calls. I have not tried using NX_ModbusRTUCmd  - one option would be to use that thing instead of thoose separate read and write fbs.      I do have tried function codes, reads and writes against my slaves using a few software-tool and an RS-485 adapter,  they behaved well.   Also  I do successfully run the nodes ( inverters ) , using NX_ModbusRTUWrite.   ..writing do give responses from the slaves,  so, responses sent from dem slaves, is properly recieved / detected. NX_ModbusRTUWrite does not ignore dem responses, if a node is down, I get an error code, perfect.    )  

 

Thankful for any help,   kind regards / Patrik

[photovoltaic 122]

My mistake - for RTU 0406 means: Illegal Data Position Specified.  This is likely an error response from the slave. 

Are you sure the device you are requesting data from has that register and you have access to it? Are you entering the address correctly in regards to HEX or DEC format?  I have seen these errors thrown when a certain node # was expected along with the address. Truthfully I have seen a lot of oddities in Modbus from specific devices, that's why it's always good to poll a PC-based Modbus server.

[urvhalt 0]

Please find attached project archive.   Instances are att bottom of section .master..   above it is a virtual program ( a list.)  and its interpreter, handling four inverters.  

pc is program counter fo the interpreter that makes the master happen.    IP is program counter for interpreted sequence, the list of actions for the master to perform.

(Protocol is Modbus RTU  ( RS485 using CJ1W-CIF11 in modbus mode   ,  problem is: NX_ModbusRTURead always gives error code 16#0406.   NX_ModbusRTUWrite works fine. )

Kind regards / Patrik

support NX_ModbusRTURead.smc2

Edited 13 Apr 2023 by urvhalt

[urvhalt 0]

Feeling sceptic - my slaves always give responses for succesful reads as dispayed and decoded on oscilloscope captures. ( Real oscilloscope,   not tracing ).

Also, ErrorIDEx is 0  (  modbus errors )

 

Other thoughts - if I had some slight  mismatch regarding comms parameters, i would get checksum errors. And, NX_ModbusRTUWrite works for me ;    write   performs two way communication, so communication is ok both ways.  Adresses i can write, are documented as "READ-WRITE". Even when reading thoose, I get the error.

 

Changeing the requested number of words,   in the read request,  changes  the ouput parameter ReadSize  accordingly.     Canging to something uber-ridiculous like requesting 7000 regs,  gives response via ErrorID ( 0x0400 ). 

 

I think I already also  have tried running theese slaves against my pc,  but  maybe i mix this up with another Modbus RTU I comossion simultanously with this one...  maybe do it again.... 

   

Kind regards / Patrik

 

[urvhalt 0]

My RS-485 serial adapter didnt want to participate, i got some RC-filter effect -  to slow edges when using it, even when going slow, 9600 baud.

 

Did some oscilloscope recording and found that NX_ModbusRTURead  do put  the number of the register adress I want to read,    into word  read_regs[0] ,  in conjuction with error id 0x0406

 

image A     read node 1  holding reg 5,  1 reg        slave delivers answer with payload bytes  00 C8

image B   monitoring in sysmac studio,    error 0406  and the digit 5  appears  in read_regs

image C   I did change the register adress to 7. triggered the read  again,   Now 7 appears  in read_regs

 

somewhat strange.    kind regards / Patrik

[urvhalt 0]

Did try reading holding registers using NX_ModbusRTUCmd  instead of  NX_ModbusRTURead,  ( also replaced dem writes for consistency  )  

Seems to work fine.     Cumbersome, but works.

 

Kind regards / Patrik

 

[urvhalt 0]

Actually, using NX_ModbusRTUCmd with fn3 or fn4, i only got the command data copied to the results data when reading some register, and no error code,  and no result data, strange - my slaves do send result data.    Next step might be using no-protocol mode to get full control,  but I probably do not have time for that.  

 

Kind regards  / Patrik