Modbus driver fail to read HRUS register followed by HRF register (32bit float)

Ignition 8.1.28

There is perhaps a bug in modbus TCP driver or a strange behavior.
We have a device with the following table (see below)

Read HRUS Register from 1 to 11 are OK
Read HRF Register from 12 to 20 are Bad, but they can be read by another modbus master.

If we disable the first tag (HRF12), the next HRF are read with success.
It seems that Ignition driver group consecutive HRUS and HRF to make only one frame and this is not allowed by the device.

We have tried to add Address Mapping to try to force to split request, but it seems that the driver group consecutive frames too ?

The only horrible solution found is to make 2 ignition devices, one with tags for HRUS and another for tags for HRF




But if we try to read the whole holding register table, it fail:

Devices don't know anything about how we're combining registers to derive values. The request is just for a certain range of registers, that's it.

Get a Wireshark capture and see what's going on.

If you can request 1 through 11 successfully, but a request for 1 through 20 fails, then either one of those registers has no data at it, or your device's Modbus implementation is broken.

edit: I see your last screenshot where the device returns Illegal data address when reading the full range. I'm not sure there's much you can do here.

My driver would be no help, either, fwiw. Thinking how to solve this....

Yes it's very stange, if we read 1-11 and 12-22 separately it's ok, but if we read 1-22 it fail..

2 Ignition devices like he's already stumbled on, I think.

Otherwise a driver would need some kind of setting where you defined arbitrary memory/register boundaries that the request optimization logic wouldn't combine across.

My driver has close to that logic, where you define the available registers, and it automatically excludes gaps from spanning. But there's no actual gap here. Hmm, some more.

Perhaps a max size to 10 will help. It will be better than 2 devices
I will test tomorrow.

Doable, but ugly. Won't be quick. What brand of device is this? Or brands?

The device is a Schneider ASP, a building automation small PLC.

It's f*cking incredible to me that Schneider/Modicon devices are somehow among the worst Modbus implementations out there.



Can you fire them? (Not even half-kidding.)

That is the customer stuff...:sob: This was not our choice.

Why, it's not like Modicon invented the protocol or anything. :rofl: