Data Register Skew Modbus RTU via Modbus TCP bridge

Ignition
1

Data Register Skew Problem
Offset by one register per increasing modbus RS-485 address value

Eurotherm 2404 Modbus RTU via Modbus TCP bridge

|Eurotherm||Eurotherm|~ RS-485 ~~~ |Moxa |~|Modbus-TCP |
|2404_||__2404 __|~~~~~|Bridge |~|Ignition|

Overview -
I am having some difficulty communicating with a string of very old (read ancient) Eurotherm 2404 Modbus-RTU (aka Jbus) serial devices connected with a two wire RS-485 master slave network thru a Moxa MGate MB3480 using the Ignition Modbus-TCP Driver v2 2.6.1 (b386) with Ignition Version 7.6.1 (b2278)
(BTW - Thank You for the suggestion to use Moxa bridges on another forum topic, very fast and very easy to set up and use)

I have also tried this using either of the Ignition Modbus-RTU over TCP and Modbus-TCP drivers with a DigiOne IAP configured as a multiple master RS-232 to RS-485 serial/ethernet bridge and gotten the same result described further below.

I have read the Inductive Automation Ignition Forum “Topic: Help setting up Eurotherm 2404 to Integrate to Ignition” and the Eurotherm SERIES 2000 COMMUNICATION HANDBOOK I have attempted this using the example .csv parameters provided from the link in the previous forum post.

What Does Work -
I also have a legacy data connection working. A DigiOne IAP used as a Modbus-RTU serial master to Modbus-TCP bridge that is successfully converting the old RS-485 Modbus serial master connection collecting data on a PC running SpecView version 2+ and connecting it to the new Modbus-TCP ethernet slave data connection from the Moxa MB3480. To keep the old data collection system working, while I build the new remote store and forward historian with Ignition. All of the old SpecView data comes out correctly in the right places after having gone through the SpecView modbus serial master to ethernet DigiOne bridge conversion and ethernet slave to serial Moxa bridge conversion.

The Problem -
Whenever I create OPC tags and connect them to SQL tags there is a skewed modbus register offset that seems dependent upon the device modbus address. For instance when I talk to a device with modbus address 9, the data registers are all offset by one place compared to the data from the device with modbus address 8. The data registers in each of the next devices are skewed one more place further in each subsequent device. This makes it very difficult to see the process value in the first register (register 1 in modbus or register 0 in jbus terms.)

Example-
For instance (these are not the actual register data, just some example numbers from memory to help convey the concept)

[code]MBus-Addr 8 9 10

E8_4001 0 E9_4001 100 E10_4001 30
E8_4002 100 E9_4002 30 E10_4002 1400
E8_4003 30 E9_4003 1400 E10_4003 9999
E8_4004 1400 E9_4004 9999 E10_4004 1550
E8_4005 9999 E9_4005 1550 E10_4005 0
E8_4006 1550 E9_4006 0 E10_4006 32767[/code]

I have tried starting with E8_4000 or even E8_3990 or E8_0001 and still see skewed data from the wrong data registers.

???
Have I missed something here or is there an issue with the Ignition driver and ancient modbus/jbus devices? Do I need to write my own TCP driver or pay for a third party OPC translation device like Kepware or Matrikon? I haven’t even begun to try to talk to the bitwise devices that are defined as Kevotherm devices in SpecView. I hope to get most of my process status bits from the AllenBradley SLC 5/04 PLCs already connected though 1761-NET-ENIs, since I can not find any references to a Kevotherm device anywhere.

The only thing I can think is to try the Ignition Modbus RTU over TCP driver again, but that didn’t seem to work using the DigiOne IAP as a multiple serial/ethernet master bridge that way either.

Please help save me from having to break out the serial protocol analyzer and write my own driver. Like when I had to write serial communication scripts in ladder logic to talk to a Prosoft module. That was two weeks of fun there alright, but this has been a few weeks of fun too.

Thanks!

S

2

So just to be clear: you’re talking to 3 different physical devices, through 1 gateway, all of which you’re doing so through 1 device configured in Ignition? And when you say ‘modbus address’ you’re talking about unit id / slave id?

3

Yes. Multiple different physical Eurotherm 2404 devices (Modbus RTU over RS-485 serial slaves,) through 1 Moxa gateway (presently configured for Modbus RTU slave to Modbus TCP master bridging,) all of which I’m doing so through 1 device configured in Ignition. The data register location in the first Eurotherm device read, even if I only connect to one of them at a time, is still already skewed by it’s modbus serial address value, where I can not see the first register value. Which is the very most important Process Value that I need to be able to see and log.

Yes. When I say ‘modbus address’ I am talking about unit id / slave id, using the same ‘unit id’ number for each ‘slave id’ number. Moxa Bridge has one IP Address - Each Eurotherm 2404 has an individual RS-485 slave id, each accessed by the TCP unit id through the bridge.

Actually it is about 15 each modbus eurotherm 2404 devices in total. That I will eventually be parsing out over the one Moxa bridge, over it’s four serial ports mapped by slave id range for improved bandwidth, but I am testing with just the three eurotherm 2404 devices at slave id 8,9, and 10 on the one port to start with for this example.

4

Can you set things up exactly like in your example, 3 devices, only a handful of tags, and then turn ReadHoldingRegistersRequest (or ReadInputRegistersRequest) loggers to TRACE level. After a few minutes, export the logs and upload them here or email them to support. Alternatively, if you’re handy with wireshark, you can just capture the comms between Ignition and the gateway device and then upload the pcap file.

5

Hi Kevin, Thanks for your help so far.

OK, I am looking at the Diagnostics Window found in the Ignition Designer Help menu. I see no Logger entry for ReadHoldingRegistersRequest in the selectable Logging Levels. Am I supposed to create a Logger from the Diagnostics Console or something?

I am very glad that I haven’t had to use the diagnostics until now, where might I find the man page for that? Also, where might I find the log export function? Do you mean the copy button in the log viewer? I only see loggers for the
…client.gateway_interface.GatewayConnectionManager and
…TagManager.Gateway
there and in the Logging Levels selector that might perhaps be appropriate, I’m not quite sure what you are talking about. Ticking the TRACE option for either of these shows no discernible output anywhere I can see like in the LogViewer.

Am I missing a developer toolkit of some kind? :scratch:

Thanks!

6

Sorry, this is all on the Ignition gateway that you’ll be doing this. Configure > System > Console. You’ll find Levels and Logs tabs there.

[attachment=0]Screen Shot 2014-01-16 at 3.34.29 PM.png[/attachment]

7

OK, I captured a minute or so of packets from the Virtual Machine running the Ignition gateway with Wireshark and will email them to support ASAP. Thanks!

8

OK, Here is the ReadHoldingRegistersRequest Trace Log attached

Thanks!

9

Did you configure these as SQLTags or via the address map page?

If SQLTags, can you export SQLTags csv/xml from the designer, for the folder(s) with these tags, and attach?

If the address map, can you export the mappings from the page in the gateway, and attach?

10

via the address map page

Export attached and looks like

10 E,4000,4005,false,8,HoldingRegister,8 E,4000,4005,false,9,HoldingRegister,9 E,4000,4005,false,10,HoldingRegister,10

Hmm, what does the 10 on the first line mean?

11

The 10 on the first line is the radix.

The problem is the next three lines: it appears you’ve set your start address to 8, 9, then 10, which would explain why you see an offset by one for each address…

You probably mean to have a starting address of 8 across the board… not 8, for unit 8, 9 for unit 9, 10 for unit 10.

12

Start Address? How does “Modbus address” mean start address?
Start address as in after holding register 4000 where do I start reading registers?
Ahhhhhh
That explains it.
Now I see the numbers That I am looking for.
Thank You!

13

When using the address map page, the ‘start’ and ‘end’ are just combined with prefix to create names for your tags, they have no bearing on what actual register address the tags begin at. That’s up to the ‘modbus address’ field.

So if you really want to be reading HR1 through HR6, you should maybe put in 40001 start, 40006 end, and 1 as the modbus address.

14

OK. It all makes sense now and is working perfectly. Thank You. I would say Modbus register instead of Modbus “address.” My being so literal I painted myself into a corner. Thanks!