Weintek cMT2078x Modbus Addressing Help

I've got a new machine in the plant that I'm trying to get Modbus TCP setup on. The OEM sent me some information on the setup, for example

ReadValues = modbusClient.ReadInputRegisters(400, 100)


Based on a Weintek PDF I found online input registers are 3x, so my Ignition OPC tag path is ns=1;s=[Silo A]3x400 which gives me a bad quality. What am I missing?

If that's the literal address you're using you missed the part where you read the Ignition user manual to understand the Modbus address syntax. 3x400 is not a valid address.

It would maybe be something like [Silo A]IR400.


Weintek has gone out on a limb defining non-existent address types. There's no such thing as a 5x address, though the functionality described can be configured on an Ignition driver. The protocol spec has a totally different definition for 6x addresses, with dedicated function codes.

I read the manual first. I took it that 3x was the prefix, and using the device address mapping tool generated the ns=1;s=[Silo A]3x400, which I see is wrong now. 3x just means the 30000 range.

I tried the manual address of [Silo A]IR400 but it didn't work.

I figured it out :slight_smile: I was able to hack the admin password into the Weintek HMI. With easybuilder pro, I downloaded the project from the HMI, and decompiled it. They had the Modbus unit id set to 1 where I was trying to use unit id 0.


@Kevin.Herron Seems I need a little help on string conversion.

IR480-499 are being read as 16int. I set up a tag with path [Silo A]1.HRS480:20

  • Without any string handling options I get an empty string.
  • With reverse byte order, I get Z
  • With read raw string checked, I get Z Pillow 4
  • Change path to [Silo A]1.HRS480:40, I get Z Pillow 43OZCAC`

The manual says that each word is 2 characters, but best I can tell I only have one char per word.


What string are you expecting? You may have some trouble here, the Modbus driver doesn't so Strings in any kind of sane manner.

Sorry, I meant to include that in the last post
Z Pillow 43 OZ is the correct value

[Silo A]1.HRS480:40 is probably closest to what you want.

This means read 40 bytes, aka 20 registers. The string either has to be fixed width or null terminated.

edit: if you're expecting null-terminated, make sure the raw strings option is false.

1 Like

I think it is null terminated, 0 in ascii should be null; therefore the null would be RecipeName15

hmm, I reloaded the recipe name on the HMI, and it started acting completely different. I had to reverse the byte order and then uncheck the raw string option and it worked as expected :man_shrugging:

Eww. That suggests that different parts of its code do strings differently.

Weird, with HRS480:40 the string must be over 20 chars long for it to read correctly. If I do 20 chars or less, it only shows the very first character in the string. So weird.