Are These Valid Modbus Addresses?

G

Thread Starter

geoffrybrown

I have been trying to poll a ModbusTCP Temperature probe from my SCADA system. The mfg uses addresses 49 and 50 for Temp and RH, but they don't seem to be valid Modbus read registers in my mind.

Through some back and forth with the vendor, they assert that addresses 49 and 50 are valid for reading ModbusTCP data.

I thought that valid Modbus read registers must start with a 4XXX so I added the prefix to get the address 40049. Note that when I use address 49 and 50, the data is not valid when I read it, but when I use 40049 I do get the same value as their web page reports. My Modbus interpretation that all addresses that start with 00XXX to actually be coil write commands, not a read.

Can someone explain this address problem?

My actual problem with this device is that my first poll will read the correct value and the second read will always come back as 0, then the 3rd read will be correct and the 4th 0, etc.

What would cause this?

GBrown
 
L

Lynn August Linse

You'll perhaps get a lot of answers, but true Modbus numbers registers from 0 to 65535, and coils also are 0 to 65535.

The 4x/0X stuff is a notation used by early Modicon programming tool, where 0 was reserved for none/nop and the address was strictly 0001 to 9999. So 4x0001 was register offset 0, and 0x00001 would be coil offset 0. Eventually, when 64K memory became cheaper than 4x, they bumped this up to 5 digits, but it is still a Modicon notation. You'll find, as example, that SE now use the %MW0 for memory-word instead.

My suggestion to vendors is always just include two columns in the document, so your two registers would be 49 or 4x00050, plus 50 or 4x00051. This makes everyone happy.
 
G

geoffrybrown

Below is the follow-up from the vendor. Did I miss the memo? Did Modbus change the protocol so that 4XXX register reads are not the standard?

I am totally surprised by this.

ad 1) This is a problem with your SCADA. Your SCADA software use addressing according obsolete Modbus specification from 1996. We have some devices which supports of both address models (standard and obsolete 40xxx).

Because T3610 is one of newer devices we did not implemented this obsolete address model. You are first with this problem. Maybe if we will talk about bigger quantity of devices we will be able add obsolete addressing model.
 
> but when I use 40049 I do get the same value as their web page reports.

1) The leading numeral 4 in a register number, like 40050, is for people only. It tells the reader that the value is in a holding register because holding registers have historically been designated 4xxxx and lately 4xxxxx.

The leading 4 is never used in the Modbus message itself. The function code 03 reads the holding registers and the function code 03 is part of the Modbus message. Only the indexed value of the register (0050) is used in the Modbus message.

Some masters want you to include the leading 4 when defining which register(s) to poll, probably because so many slave maps use 4xxxx or 4xxxxx . Others don't, they want the indexed value for the register only. Your SCADA modbus master clearly likes it when you use the leading 4.

> Did Modbus change the protocol so that 4XXX register reads are not the standard?

No. Regardless of whether your SCADA uses 4xxxx (1996) or 4xxxxx (later) you will be able to read registers 49 and 50 because the Modbus message format has not changed.

The Modbus message format accommodates all registers up to 65535.
 
F

Fred Loveless

Boy that is news to me. Modbus is a huge standard amongst device manufacturers. I am pretty sure that is you use Unity in a modbus device that it is a different protocol more like TSX and it also supports symbolic addressing. I would be interested in knowing the manufacturer as I am sure one of my customers will run into one of these at some point. I would like to be able to hit the issue head on when they try to read data from the device with our server.

Fred Loveless
Senior Application Engineer
Kepware Technologies
 
F

Fred Loveless

My colleagues and I did some research based on the model and found the manufacturers documentation. The support person obviously does not read said documentation because it clearly indicates that a holding register read is used and that then simply lists the register offsets.

http://www.cometsystem.com/userfiles/file/manuals-english/transmitters/ie-snc-tx6xx.pdf#page=26

The only thing that could be an issue is if the are doing 0 or 1 based addressing for the registers. Most devices use 1 base which means that if the master server or scada asks for '40001' then the request sent to the device is for register 0. For 0 base addressing '40001' would be register 1. Sometimes devices will only allow you to read one register at a time as well. If you try to read multiple registers at one time you will get errors.
 
G

geoffrybrown

Ok, I did figure out what my problem was in terms of why the read would alternate between correct values and 0 values.

I had a non-tagged register location writing over my new tag. Mostly an after effect of a very old system with documentation that is incomplete.

Lynn, Thank you for the Modbus perspective.

GBrown
 
Top