Issues with ModbusRTU on CP1H with MODTCP61 module

[totes 0]

Hi folks,

 

I'm having quite the "fun" time getting ModbusTCP comms going with the CP1H PLC & MODTCP61 module.  

I've set up the serial port for 115200, 8,N,1 - Serial Gateway as instructed in the manual.

I've set the MODTCP61 to "Master" and It's IP to 192.168.233.11

On my PC, I'm running a Modbus Server Simulator at 192.168.233.1

 

I've tried using the code provided here:  https://forums.mrplc.com/index.php?/files/file/867-easy-to-use-modbus-rtu-master-for-cp1l-cp1h-cj1-cj2-cs1/

I've also tried with very basic code I wrote using simple writes to the EasyModbus control registers D32200 and/or D32300 and enabling EasyModbus at A461.00 and/or A460.00

I've tried with both serial ports on the PLC.

It seems like the PLC/code side of things is correct and the MODTCP61 is not sending out correctly formatted ModbusTCP requests over the network as it sends out requests over the network when configurations are correct (and doesn't if I intentionally set something wrong).

 

 

I've run Wireshark to sniff the network traffic and here's what I'm seeing:

The MODTCP61 module sends a packet to 192.168.233.1 (server/slave) as expected, but the slave/server never responds to it.

I've tried with a software client/master on both my PC and another PC on the network and both receive a response from the slave/server.

 

I've attached some packet capture images to show what's going on.  I'm not a TCP traffic expert, so I'm having a difficult time figuring out the "why" to it not working.

 

Any clues?

Thanks!

 

 

[chelton 72]

I think you maybe confusing 2 different modus setups. The modtcp61 module does not require code from memory it maps directly to the plc memory. The easy to use modus code is for modus rtu/ascii using serial port. Have you followed the modtcp61 manual?

[totes 0]

I understand that the MODTCP61 module is a serial to ethernet gateway and uses the built-in PLC EasyModbus function to control it.   The PLC code is just loading the memory locations required for the EasyModbus function of the Omron PLC.   The one provided in the MrPLC forum link does some error handling and facilitates multiple reads/writes, but is doing the same basic thing...   loading the PLC memory locations for the control word, activating the command bit and storing the response.

I've written some very pared down logic which just loads the memory locations and activates the EasyModbus command to simplify troubleshooting and I get the same result.  Messages go out on the Ethernet side (indicating a valid ModbusRTU command was received over the internal serial interface), but the ethernet side server doesn't respond to the message (presumably due to an incorrectly formatted ModbusTCP command from the ModTCP61 module).   I'm stuck here.   

Only alternative I have right now is to use an external serial/ethernet Modbus gateway (Lantronix, Moxa, etc) and use a serial port module CIF11 or similar if I can't get the native Omron TCP module to work.

 

 

[totes 0]

Here's the little bit of info available from the manual when using it as a master (required for my use case):

The CP1W-MODTCP61 allows Omron CP1L and CP1H PLCs to function as control devices for remote I/O slaves that use the Modbus TCP protocol. The adapter is a Modbus TCP master device, meaning the adapter will not respond to Modbus TCP commands issued from another Modbus TCP master device. The Easy Modbus function of the PLC is used to send Modbus RTU commands to the adapter, which are converted to Modbus TCP commands and delivered to the remote device. The Modbus RTU Node Number is automatically used as the last octet of the IP address of the destination device, with the first 3 octets of IP address of the adapter used as the first 3 octets of the destination device.  Example The CP1W-MODTCP61 Adapter IP address is set as 192.168.1.25. A Modbus RTU command sent to node ‘2C’ in the PLC using Easy Modbus. The Modbus TCP command will be delivered to 192.168.1.44 (44 Decimal = 2C Hex).

[totes 0]

From what I gather in the TCP messages, the Omron module is sending out a message to establish a TCP connection/link [SYN] but does not receive a response from the server.   The software client request for connection [SYN] received a response from the server [SYN, ACK].   For some reason the Omron message is 60bytes long and is formatted differently than the software client message 56bytes long.   I have a support request ticket in with Omron.  I'll post if they provide a response.  Thanks.

[totes 0]

I figured out my issue.   It turned out to be a group policy domain issue on my work computer.  Communications over a local network via my 1st ethernet port would not properly pass Modbus traffic which comms over my 2nd adapter which was on the corporate network would allow it.   Thus, I could reach the server on my computer from other computers on my network but not from the PLC that was linked through the local network to my PC.