Possible Bug in Modus TCP Driver when reading 32bit registers?

I though I would raise what appears to be an issue/bug with the modbus TCP driver when reading 32bit registers using manual addressing in Ignition tag e.g. using HRD# notation that has caused me some issues.
Ignition Version 8.1.20. Modbus version 7.1.20 (b2022082313)

When using manual addressing the Ignition driver appears to request an additional 2 holding registers more than required. This creates problems when reading a 32bit value that sits on the last 2x modbus addresses within an available address range in a device. The driver attempts to read past the end of the available modbus addresses and the modbus read fails - sending other tags bad that are serviced by the same request.

From my testing with (zero based addressing set to false) and looking at the logs:

  • Reading 1x tag HRD9 produces the following modbus request:
    Sending message: [ 01 F3 00 00 00 06 00 03 00 08 00 04 ]
    Ignition requests 4 words starting at Address 40008.

  • Reading 2x tags, HRD9, and HRD11 produces:
    Sending message: [ 03 ED 00 00 00 06 00 03 00 08 00 06 ]
    Ignition requests 6 words starting at address 40008 :

  • Reading 3x tags, HRD9, 11, 13 produces:
    Sending message: [ 04 3F 00 00 00 06 00 03 00 08 00 08 ]
    Ignition requests 8 words starting at address 40008

I have found when using Modbus address mapping instead of manual addressing the Ignition driver does not appear to exhibit this behaviour.

Testing by creating an address group with the following parameters:
Prefix = DINT, Start = 9, End=9, Step=True, Modbus Type=Holding Register 32, Modbus address=9

  • Reading 1x tags: DINT9 produces the following modbus request:
    Sending message: [ 04 5B 00 00 00 06 00 03 00 08 00 02 ]
    Ignition requests 2 words starting at address 40008 - which appears to be correct.

As a work around this behaviour use Modbus address mapping
OR
if you have control of the modbus addressing in the end modbus device you are trying to communicate with, ensure there are 2 additional spare modbus registers defined beyond the last 32bit address you try to read using manual addressing.

The D modifier in HRD means "double", as in 64-bit double precision floating point, which takes four consecutive 16-bit holding registers. Take a closer look at the manual addressing section of the manual:

https://docs.inductiveautomation.com/display/DOC81/Modbus+Addressing#ModbusAddressing-ManuallySpecifyEachAddress

I suspect you need HRI, not HRD.

1 Like

Ahh, - thanks @pturmel !

My bad.