I was recently hired to reprogram an ABB AC250 PLC that was to use Modbus RTU to connect to a new external PID regulator from Fuji Electric (PXG-5). I managed to get a working connection with the regulator by using the MBConnect-block but that's where all fortune ends.

According to the specifications, the regulator requires the following data to perform a read or write operation:
Station number, 1 byte
Function code, 1 byte
Starting address, 2 bytes
No. of bits to read/write, 1 byte
CRC checksum, 2 bytes

but the ABB MBRead-block can only supply the station number and starting address, not the function code (same goes for MBWrite). According to the ABB support personnel that I spoke to, the only way out would be to write my own Modbus code, something I doubt there's time or money to do. Unfortunately, Fuji Electric does not have a representative in my country (Sweden) and the salesman/support person hardly knew what Modbus was and could definitely not answer my questions about function codes.

Has anybody got experience from using Modbus function codes in AC250?

The controller was installed in 1993 +- 1 year and we're using Control Builder 3.2-11 or 3.2-16.

 

While there are variations I have never seen something as you describe. Here are two write examples.

1. Function Code 6, Preset Single Register:
03 06 00 09 30 39 8C 38
Slave address 0x03, function code 0x06, register 0x0009 the value Decimal 12345 = 0x3039 CRC 0x8c38.

2. Function code 16 write multiple registers:
03 10 00 09 00 02 04 04 D2 16 2E 17 08
Slave address 0x03, function code 0x10, registers 0x0009 for 0x0002 registers, 0x04 data bytes. Data is 1234=0x04d2 and 5678=0x162e. CRC 0x1708

 

I have used MBRead/MBConnect with a variety of different modbus devices without any problem (SEPAM, Diris and Sixnet devices). All using AC250 and ControlBuilder 3.2. The MBRead block seems to work as a standard modbus master, and every modbus message includes FC info. Are you sure you don't have any other problem? like wiring? what is the status of the MBConnect block? what is the status/error of the MBRead?

 

No, there are no "different versions" of the Modbus standard. However, not every PLC vendor implements every Modbus command.

The AC250 (Sattline series and also AC800 series) uses 5 main function blocks to run a Modbus link.

MBConnect creates the connection to the remote RTU.

MBRead or MBReadCyclic create a Modbus read message, sends it to the RTU and waits for a reply.

MBWrite or MBWriteCyclic creates a modbus write message, sends it to the RTU and waits for a confirmation.

As a programmer, you do not choose which Modbus function code to use. This is done by selecting a MBRead or MBWrite function.

You can check in the AC250 manual to see which modbus function codes the MBRead and MBWrite blocks actually use. The manuals are available on the ABB solutionsbank website. Sorry, I dont have one with me just now.

If the AC250 and the remote RTU do not use the same modbus commands, then your other choice is to write a custom serial protocol in the AC250. This is not as easy as a Modbus link and requires some extra commissioning etc, but is not too hard as it also uses standard function blocks.

Rob
www[.]lymac.co.nz

 

I tried to find Modbus info for ABB - I gave up after 10 minutes. ABB's site is 'dense'.

In the absence of documentation, let me speculate:

The controller (regulator?) has separate MB blocks for write or read. So controller knows whether you need a read or write operation.

I suspect that there is no function code designation within the controller's MB block because the controller is inferring which function block is used from the destination address and the MB block used.

For instance, if you use MBread block with address 40015, it is assumed that you are reading from 40015 using function code 03 (4xxxx is in the holding register memory block).

Or if you use the MBwrite block with register address 40015 the controller knows that it uses function code 06 to write data to 40015.

If use MBread with register address 30039, it is assumed that the function code 04 reads input register 30039.

I suspect that your "no. of bits to read/write, is NOT bits, but either bytes or register data words (2 bytes). Look carefully into which it is.

Carl Ellis

 

Thanks everybody, your input is appreciated.

I came back to the site last Friday and was about to try exactly what Carl Ellis suggests, that I should use the address only and that the controller will choose the appropriate FC for that address and function block. Unfortunately something in the controller broke down and prevented me from downloading so I never got to see the result. I just talked to a guy at ABB about this and he agreed that this might be the solution so I'm giving it a try as soon as I can. He also recommended that I use the address format '%QW16#0001' rather than '%MW16#0001' that I originally used but I didn't get an explanation to why.

As for Romulo's questions, I get a "1" on MBConnect which is supposed to indicate a working communications link. On the MBRead block, I only get a flag for "no new data available", I have forgotten its number.

We're replacing the CPU this week and I'll give Carl's suggestion a new try right after that.

 

Well, no luck so far. A colleague tried changing the address to '%QX16#0001' earlier today but with no luck. The MBRead.Status-flag indicates a time-out (-4929). From what I understood, the MBRead accepts this address and gives a different error code than before so thats at least something positive.

As we were unsure whether the Modbus link was really working or not, he pulled out the cable between PLC and regulator. The result? The MBConnect.Valid is still 1 (indicating a working connection). Apparently the "Polltime" was set to 0 to avoid sending "FC-8 telegrams" (whatever that means) that caused the connection to time-out earlier so now the controller doesn't perform any checks at all.

So I guess I'm back to square one again. Any clues?

 

Can you provide a web link to whatever Modbus documentation is available for this ABB device?

 

http://solutionsbank.abb.com

 

Nope, I haven't been able to find any. As opposed to Profibus, Sattbus and COMLI, Modbus isn't mentioned in the controller data sheet.

We have started a support case with ABB and hope to get some help from them next week. I'll try to find a software client for my PC to test both the PLC and the regulator, to see that they are both working.

 

Where is this syntax coming from?

address format '%QW16#0001' rather than '%MW16#0001'

Can you decrypt it for the rest of us?

Carl

 

Sorry, that's the ABB format for memory addressing. % tells the controller it's a memory adress, Q for reading (M for read-only, I for writing), W for word (X for bits). 16 is for hexadecimal address format and #0001 is the coil/register number.

This is what I was recommended by the ABB Support desk but no success so far.