Nano-10 PLC as Modbus Server?

[peterjung]

Hi there – I am looking for some pointers in figuring out MODBUS TCP/IP with the Nano-10.  I am new to the Nano-10 and TRI products in general however I am fairly familiar with PLC’s in general.  However I have never used any kind of MODBUS so I am a little bit confused how to implement this with the Nano-10.

I have been able to set up a test rig with a couple of Nano-10’s and I have downloaded a programme and I can monitor online and can see the programme operating nicely.  Now I want to get the Nano-10 to talk to a simple HMI interface over Modbus TCP/IP.

Where I am struggling is how to get the information from the ladder over the MODBUS TCP/IP link to the HMI.

Here is an example of what I mean:

I have a bit programmed as “FAULT” and uses a RLY output of “r9” in my ladder.

I intend the Nano-10 to be the server and the HMI to be the client.  What do I need to do at the PLC end to make “r9” so that this can be read by the HMI?

What would the MODBUS address of “r9” be?  Do I need to copy “r9” to a specific memory address than can then be accessed by the HMI?

I have read up on the READMODBUS and WRITEMODBUS but as far as I can understand these functions are for when the Nano-10 is used as the client and not the server?

I get the feeling I am just not getting something conceptually here?  I would be very grateful if someone can give me a few pointers in this?

[support]

All the PLC's I/Os, internal relays, timers, counters and data memory have specific addresses mapped to the Modbus holding register or input register space. The memory map can be found on Table 14.1 (page 14-8) on the Nano-10 User's Manual. http://www.triplc.com/documentations.htm

E.g. input #1 to #16 are mapped to a single 16-bit Modbus holding register 40001. So you HMI can simply read from holding register 40001 to get all 16 inputs in a single register.

Inputs 1-16 are also mapped as bit number 1 to 16 of the Modbus input register space accessible as individual bit using Modbus function 02.

Likewise DM[] data are mapped to holding register space 41001 to 45000 and these are both readable and writeable.

So you don't have to do anything inside the PLC's ladder or TBASIC program to make this happens. It is already there, just have to map it correctly.

And you are right that READMODBUS, WRITEMODBUS, READMB2 and WRITEMB2 are only used when the PLC is the master (or client) and not required when it is a slave (or server).

Note that Modbus have two addressing conventions - Modicon convention has a prefix such as 4xxxxx for holding register, 3-xxxx for input register etc. Another is a binary addressing convention where everything starts from 0. So you need to find out which convention your HMI is using.




 

[peterjung]

Support...Many thanks!

I have just had a look at page 14.8 in the manual as you suggest and I get it now!

Thanks again for the prompt response!

[peterjung]

Hi Again!

I have been able to read bits over the MODBUS TCP/IP but I am having trouble writing from the HMI to the PLC.

For example I have r6 which I can read from using the address and function code as:

11030.

i.e. Function Code 1 followed by the Bit Address.

I tried to write to r1 using the same format i.e. 51025 but this give me an error.

I suspect that the following section from page 19-9 in the manual may be the reason:

“All the Nano-10 I/O bits are mapped identically to both the MODBUS “0x” and 1x space.  Although MODBUS names the 0x address space as “Coil (which means output bits) and the “1x” address space as “Input Status” (which means input bits only), the Nano-10 PLCs treat both spaces the same.  Some MODBUS drivers only allow you to “read” from the 0x space and “write” to 1x space but you still use the same offset shown on Table 14.1”

I am somewhat confused about the above statement.  I am trying to use Advanced HMI as the HMI programme and the MODBUS TCP driver will not accept addresses of the format 0-1025 or 1-1025.  So what would be the correct address to map to r1 on 1025 but in the “1x” space?

Confused…..

[peterjung]

OK... I worked it out.  I just figured out that I do not need to send the MODBUS function code with the address from the HMI - I guess the function is implicit in the type of control......doh!

So If I want to read from Bit 1025 I need to address it as 11025
If I want to write to Bit 1025 then I need to address it as 01025

Simple when you know how I guess.....!!

[support]

Thanks for letting us know. I am glad it works out for you now.

Note that we have just released a new i-TRiLOGI version that will correctly set the duplexity of the Ethernet interface and our tests show great improvement over LAN connection with nearly zero Modbus TCP error (vs about 0.1% error rate using previous settings). It is worthwhile upgrading your i-TRiLOGI software to the latest version, then simply retrieve your Ethernet settings and overwrite them with the new software. This fix work for all firmware versions.

For more info please see the News section in this forum