Modbus natively speaks Modicon addressing, meaning all requests on it refer to four original address spaces:
Descrete Inputs - 1,2,3... 65536
Output Coils - 1,2,3... 65536
Input Registers - 1,2,3... 65536
Holding Registers - 1,2,3... 65536
Sometimes documentation of a device refers to addresses of registers in these address spaces. Note, they all start from 1, not from 0.
IEC 61131 refers to variables based on %I, %Q %IW, %QW, %MW, %M address spaces. They all usually start from 0, not from 1.
As you open documentation of specific device and see register address 2700, and try to read %MW2700. PLC logic adjusts the request and asks the device at Holding registry address 2699.
Thus you get shifted address data.
In your case there is something more - address of register 2700 refers to the first word of two-word variable. If you read only half of this variable, the specific device warns you with error code 16#03
From Modbus documentation:
"
16#03 - ILLEGAL DATA VALUE - A value contained in the query data field is not an allowable value for server (or slave). This indicates a fault in the structure of the remainder of a complex request, such as that the implied length is incorrect. It specifically does NOT mean that a data item submitted for storage in a register has a value outside the expectation of the application program, since the MODBUS protocol is unaware of the significance of any particular value of any particular register.
"
In short, in your case : the request surprises the slave - it expected to respond with complete variable (of two words) but you ask only for one.
So, for the application to work - instead of 2700 refer to 2701 and request at least for 2 words (request even amount of words for all two-word variables).
Modbus Slave Device in this example can be Power Meter 8000, 5000 and many other devices.
Descrete Inputs - 1,2,3... 65536
Output Coils - 1,2,3... 65536
Input Registers - 1,2,3... 65536
Holding Registers - 1,2,3... 65536
Sometimes documentation of a device refers to addresses of registers in these address spaces. Note, they all start from 1, not from 0.
IEC 61131 refers to variables based on %I, %Q %IW, %QW, %MW, %M address spaces. They all usually start from 0, not from 1.
As you open documentation of specific device and see register address 2700, and try to read %MW2700. PLC logic adjusts the request and asks the device at Holding registry address 2699.
Thus you get shifted address data.
In your case there is something more - address of register 2700 refers to the first word of two-word variable. If you read only half of this variable, the specific device warns you with error code 16#03
From Modbus documentation:
"
16#03 - ILLEGAL DATA VALUE - A value contained in the query data field is not an allowable value for server (or slave). This indicates a fault in the structure of the remainder of a complex request, such as that the implied length is incorrect. It specifically does NOT mean that a data item submitted for storage in a register has a value outside the expectation of the application program, since the MODBUS protocol is unaware of the significance of any particular value of any particular register.
"
In short, in your case : the request surprises the slave - it expected to respond with complete variable (of two words) but you ask only for one.
So, for the application to work - instead of 2700 refer to 2701 and request at least for 2 words (request even amount of words for all two-word variables).
Modbus Slave Device in this example can be Power Meter 8000, 5000 and many other devices.
Publicerad för:Schneider Electric Sverige
