# Link tags from Schneider plc to ignition via modbus tcp connection **URL:** \ **Category:** Ignition\ **Created:** [February 4, 2020, 8:43pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924 "2020-02-04T20:43:36Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![mbai1](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@mbai1](https://forum.inductiveautomation.com/u/mbai1)\ **Post date:** [February 4, 2020, 8:43pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/1 "2020-02-04T20:43:36Z")
Hi, We are trying to link a Schneider TM251MESE plc to ignition with modbus tcp communication. We are able to create a connection between the plc and ignition, but we are unable to link the ignition tags to plc, since we cannot seem to replicate the PLC mapping with modbus addresses. We are reading zeroes for everything but the first few coils (around MODBUS address 000001). Is there anything in the Ignition gateway settings or in Ignition designer that can help us read integer values that are not zero? (i.e. from %QW03 or %IW08). ---
**Author:** ![AFULLER](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/afuller/32/7931_2.png) [@AFULLER](https://forum.inductiveautomation.com/u/AFULLER)\ **Post date:** [February 4, 2020, 8:59pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/2 "2020-02-04T20:59:42Z")
I have been able to read registers by adding the “HR” prefix to my tags. For example float 8265 is now [DEVICE\_NAME]HR8265 . I had zero luck with the mapping aspect, typed in the tag manually.Also the device needs to be setup and in advance. The free Modbus tester from SE will help you track your tags. [Schneider Modbus Tester](https://www.se.com/us/en/faqs/FA180037/) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [February 4, 2020, 9:09pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/3 "2020-02-04T21:09:19Z")
Bit memory can only be accessed as bits in Modbus, per its spec. Modbus devices that support read-modify-write can treat bits of holding registers as booleans. Your PLC would have to expose your %QW as an HR, and the %IW as an IR. %Q is accessible as C, and %I is accessible as DI. [https://docs.inductiveautomation.com/display/DOC79/Modbus+Addressing](https://docs.inductiveautomation.com/display/DOC79/Modbus+Addressing) ---
**Author:** ![mbai1](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@mbai1](https://forum.inductiveautomation.com/u/mbai1)\ **Post date:** [February 4, 2020, 9:26pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/4 "2020-02-04T21:26:27Z")
I forgot to mention in the initial post that we've tried HR and IR to read %QW and %IW respectively, but the resulting tag values are 0 unfortunately. %Q as C does seem to work, though. > [@AFULLER](#): > > Also the device needs to be setup and in advance. For a Schneider PLC, we are not entirely sure where this is done. At the moment we are trying the add the device's MODBUS TCP slave configuration in SoMachine. Is that what you are talking about? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [February 4, 2020, 9:52pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/5 "2020-02-04T21:52:10Z")
> [@mbai1](#): > > we’ve tried HR and IR to read %QW and %IW respectively You missed my point. You _ **cannot** _ do this with Modbus. You will need code in the PLC to copy bit memory to word memory. Modbus word accesses cannot read bit memory. _ **At all.** _ Unless that Schneider CPU model has some feature that can alias the two together (not that I've heard of such a feature). ---
**Author:** ![AFULLER](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/afuller/32/7931_2.png) [@AFULLER](https://forum.inductiveautomation.com/u/AFULLER)\ **Post date:** [February 5, 2020, 12:26pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/6 "2020-02-05T12:26:58Z")
You can try a third party software like the Kepware-EX, this might get the job done, they have a 2-hour demo package. You could also try read the tags via Python. Were you able to read the tags with Modbus reader? ---
**Author:** ![mbai1](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@mbai1](https://forum.inductiveautomation.com/u/mbai1)\ **Post date:** [February 5, 2020, 6:38pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/7 "2020-02-05T18:38:20Z")
We've tried using KEPServerEX as our 3rd party OPC server, but we're running into the exact same problem, where we can read %QXx.x things but not holding registers or input registers. We're not sure if we are addressing them correctly (is it 040001 or 400001 for %QW1, is it 400006 or 400011 for %QW11, etc.), since we only read zeroes, but this is a minor issue. > [@pturmel](#): > > You missed my point. You _ **cannot** _ do this with Modbus. You will need code in the PLC to copy bit memory to word memory. Modbus word accesses cannot read bit memory. _ **At all.** _ If this is true, then it's the real problem we are facing - we want to read 'bit memory' as 'word memory', but the PLC doesn't do this automatically. It's misleading since the documentation seems to imply we can just read bit memory as words... Here are some screenshots: Do we need to configure a Modbus TCP slave device shown here in SoMachine (we are not sure how to configure this)? ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/4/4959c6f20675d4270141a03736e6070964e92f3d.png) These are some values we are trying to read through MODBUS/OPC UA, viewed from SoMachine: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/e/e041c6a3ebad1a05285c53595e10858ffe491871.png) And here is the value we are reading from Ignition Designer: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/8/8ae2947f3f99c9442f2214df1f5cf94f4900ffb2.png) Some properties in Ignition Designer: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/2/213e9bfa02cb9672c637f24e1c4d3dc63444e67e.png) And the properties in KEPServerEX: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/d/d778f4da422bc35fdffe4edea03035446e7d0ea6.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [February 5, 2020, 7:11pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/8 "2020-02-05T19:11:01Z")
If the PLC is exposing %QW1 as Modbus 400001, then it really is word memory (the ‘4’ prefix) and Ignition address HR1 should work just fine. I don’t know enough about the Schneider to advise further. ---
**Author:** ![ena\_bj](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ena_bj/32/13318_2.png) [@ena\_bj](https://forum.inductiveautomation.com/u/ena_bj)\ **Post date:** [February 17, 2020, 1:27pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/9 "2020-02-17T13:27:38Z")
I’m connecting M241 to Edge through Modbus TCP IP. In PLC, I’ve copied everything I need to access into word memory, so I’m dealing with MX (byte), MW (word), and MD (double word). It’s important to note how Schneider does the addressing: MX100, MW100 and MD100 are completey different locations (on the other hand, in Siemens I believe they’d be the same). However, these addresses overlap, e.g. MW1 is made of MX2 and MX3. The same relation is between MW and MD (factor of 2), and between MX and MD is a factor of 4. For Modbus driver, you can look at MW at basis, since it is basically what you get from the PLC if you put in HR. In my case, the MW201 corresponds to the data of HR202, there is an offset of 1 for word values. This also means that MD205 is HRF412 [(205+1offset)\*2]. MX200.0 is HR101.0, MX200.7 is HR101.7 and MX201.0 is HR101.8, the last one being the second byte in the word. As you can see, you always have to take into account the offset and how the bytes and word are written in memory. This offset problem might have been avoided with different driver configuration, but I didn’t have the time to test this, so at this point I’m not making claims either way. Now I’m going to introduce my problem. 🙂 I’m using control elements like numeric text box with bidirectional binding to the tags with addresses as described above. I can read all the tags, however I can only write HRF and HR (floats and integers) back into the PLC. If I try to write a tag with e.g. momentary or one shot button with HR102.0 (MX202.0) address, I get a ‘Error writing “0” to tag [edge]{the rest of the tag path} Bad’. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [February 17, 2020, 1:36pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/10 "2020-02-17T13:36:43Z")
> [@ena\_bj](#): > > If I try to write a tag with e.g. momentary or one shot button with HR102.0 (MX202.0) address, I get a ‘Error writing “0” to tag [edge]{the rest of the tag path} Bad’. Does this also happen if you create a boolean tag with that address? Is there an error in the gateway logs at the same time? ---
**Author:** ![ena\_bj](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ena_bj/32/13318_2.png) [@ena\_bj](https://forum.inductiveautomation.com/u/ena_bj)\ **Post date:** [February 17, 2020, 1:41pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/11 "2020-02-17T13:41:08Z")
Yes, the tag is boolean type with item path [ROB5]HR102.0. The is an error in the logs for every write attempt: MaskWriteRegisterRequest - Received response with ExceptionCode: 0x01 (IllegalFunction). ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [February 17, 2020, 1:47pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/12 "2020-02-17T13:47:13Z")
Okay this means that the device you’re connected to doesn’t support bit-level writes on registers via the MaskWriteRegister function. You’re going to have to use a derived tag or scripting function that reads, masks, and writes a new word back down instead. There’s an old post discussing the derived tag setup here: [Troubles making a Derived Boolean Tag work as a mask for a Short Tag](http://forum.inductiveautomation.com/t/troubles-making-a-derived-boolean-tag-work-as-a-mask-for-a-short-tag/15203/2?u=kevin.herron) and there’s probably multiple posts discussing the scripting approach floating around. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [February 17, 2020, 2:14pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/13 "2020-02-17T14:14:27Z")
> [@Kevin.Herron](#): > > You’re going to have to use a derived tag Or consider using bit memory (%Q) for bits and word memory (%M) for words, as Modbus' original architecture is designed to do. That will avoid the race conditions that manual implementation of Read-Modify-Write cycles suffer. ---
**Author:** ![ena\_bj](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ena_bj/32/13318_2.png) [@ena\_bj](https://forum.inductiveautomation.com/u/ena_bj)\ **Post date:** [February 18, 2020, 1:44pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/14 "2020-02-18T13:44:56Z")
I’m just going to post a quick followup. I took a step back and went to driver configuration. I checked “Zero-based addressing” and “Reverse word order” and all addresses fell into place. Now MW200 is HR200 and MD200 is HRI400. In PLC I copied DI into MW100 and I put other statuses into MW101 and commands into MW102. These words were brought into Edge as OPC tag integers HR100, HR 101 and HR102. Then following Kevin’s advice I used derived tags to read and write bits from my status and command words (OPC tags). For derived tags I just C/P read and write expressions from Kevin and adjusted bit offset. Now everything works ok. ---
**Author:** ![mbai1](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@mbai1](https://forum.inductiveautomation.com/u/mbai1)\ **Post date:** [February 18, 2020, 11:17pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/15 "2020-02-18T23:17:29Z")
Okay, we’re a bit farther on the issue. We are able to read and write integer values from Ignition so long as we specify the PLC memory address in SoMachine (i.e. adding ‘AT %MW201’ to an integer definition), and we are using KEPServerEX as the OPC server. Our new problem is that we cannot write boolean values (i.e. %MX401.1) the same way. On Ignition Designer, whenever we try and toggle any boolean variable, we get “Error writing to TagName.value:Bad”. The same sort of issue happens in KEPServerEX and from Ignition Gateway where we cannot write booleans. Would anyone happen to know why? We are certain the address is correct (we can set booleans by just defining them as words and then writing the appropriate decimal number corresponding to the bit). ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [February 18, 2020, 11:50pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/16 "2020-02-18T23:50:14Z")
> [@mbai1](#): > > The same sort of issue happens in KEPServerEX and from Ignition Gateway where we cannot write booleans. Would anyone happen to know why? We are certain the address is correct (we can set booleans by just defining them as words and then writing the appropriate decimal number corresponding to the bit). Same reason I told @ena_bj maybe? ---
**Author:** ![ena\_bj](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ena_bj/32/13318_2.png) [@ena\_bj](https://forum.inductiveautomation.com/u/ena_bj)\ **Post date:** [February 19, 2020, 5:20am UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/17 "2020-02-19T05:20:56Z")
To my knowledge, you must specify the address in variable tables in PLC, if you want that variable to be visible on Modbus, since that address in variable table is also a Modbus address. I used word memory, which corresponds to holding registers. The problem you have now is the same as mine, the fix is a few posts above. ---
**Author:** ![mbai1](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@mbai1](https://forum.inductiveautomation.com/u/mbai1)\ **Post date:** [February 19, 2020, 11:21pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/18 "2020-02-19T23:21:55Z")
Yep, our fix was the exact same using derived tags (should’ve read those posts carefully). Sucks that we can’t do bit-level writes by default. Thanks to everyone for all the help! ---
**Author:** ![tarcio.sales](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tarcio.sales/32/4999_2.png) [@tarcio.sales](https://forum.inductiveautomation.com/u/tarcio.sales)\ **Post date:** [December 7, 2020, 2:30pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/19 "2020-12-07T14:30:39Z")
Hi Mr Pturmel Recently I’m trying to establish connection between my M340 Schneider and Ignition through Modbus, I am using the EGX150 Schneider through RS485. For some %MW tags I was able to retrieve the readings correctly, but for others same tags I can’t. The reading is totally different from PLC. Based on your post I set like 1.HR221 and 1.HR241 for respectively tags %MW220 and %MW240, but the readings seem to be not correct (adding 1 in the address number). See below the picture: Ignition screen - bad reading ![teste](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/e/8e5eb8d4166babc011f19c098790d8bf81c9948d.gif) Schneider M340 PLC - correct reading highlighted ![teste1234](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/9/1984fbd26671691f9bc95eb44104cbbd914b88c9.png) Any idea why the readings seems inconsistent ? Thanks a lot. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 7, 2020, 2:33pm UTC](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924/20 "2020-12-07T14:33:13Z")
Try the “Reverse Word Order” setting on the driver? [Next page](https://forum.inductiveautomation.com/t/link-tags-from-schneider-plc-to-ignition-via-modbus-tcp-connection/31924.md?page=2)