Hello. I have a Siemens S7-1510SP PLC that I am trying to communicate with via Modbus RTU, through a Moxa MB3180 RTU to TCP gateway. The PLC currently communicates successfully with a Kepware server in this configuration.
The registers that I need to read are 401025, 401027, 401029 and 401031. The Modbus device ID is 22. I have Ignition Modbus TCP configured with the IP address of the Moxa.
In the tag config I have: [modbusDevice]22.HRXXXXXX, but I cannot figure out how to address the appropriate registers. All the examples I can find use the 5-digit registers, not the 6-digit extended range.
This is the only info I can find on in the Siemens literature. I do not have access to the PLC program.
How should I configure the OPC tags in Ignition to read the registers 401025, 401027, 401029 and 401031?
Thanks
These are probably [Device]22.HR1025, [Device]22.HR1027, etc...
(maybe plus or minus one, depending on zero-based addressing on either side)
FWIW, the protocol on the wire is always extended, and supports XXXXX covering 2^16 addresses. The early Modicon PLCs that first implemented the protocol could only handle/use addresses 1 ≤ x ≤ 9999, and displayed five digits including the prefix. Those old PLCs also established the one-based convention: register/coil/input/discrete X=1 is actually address zero on the wire.
Everybody and their brother has broken Modbus conventions since, including the successors of Gould Modicon (Schneider, now).
Thanks. I have got the communication working. However, I have some discrepancies between the values in Kepware vs Ignition.
For example, here is the Setpoint value (changes very infrequently) from register 401029:
Any idea what could be the cause of this?
Could be off by one address and/or need to use reverse word order option. Could be something else.
Get a Wireshark capture if you can, easy to see there.
Yep, combination of zero-based addressing and reversing word order fixed it. Thank you.
