MODBUS RTU on Danfoss FC202 1

[Marke]

Hi

I have a project requiring serial coms control and monitoring of a Danfoss FC202 using MODBUS RTU.

I have the PLC talking, but can not work out how to access the current readings etc as these are on parameters that can not be mapped into the MODBUS register set.
The parameters below 9.99 map into 40000 - 49999, but how do you access parameters 10.00 and above??
I must be missing something.

Best regards,

Mark Empson
L M Photonics Ltd

 

[niallnz]

According to the Danfoss manual MG20N222, parameter numbers are mapped as 10 times the parameter number. So I guess that parameters 10 and above are 4x0100.

Good luck

 

[Marke]

Hello niallnz

Parameter 10.00 is treated as 1000, multiply that by 10 and add 40000 and you get 50000 which is outside the range handled by modbus.

The values that we want to get at are things like current which is at 16.14 (1614) That would map to 56140 which is greater than 49999.
There must be a way of mapping these parameters back into the modbus address range.

Best regards,

Mark Empson
L M Photonics Ltd

 

[danw2]

Have you tried the querying the holding register corresponding to parameter 16.14, according to the method stated?

The modbus message Start Address HI and Start Address LO bytes don't get 4xxxx numbers, they each get one byte, that we typically read as hex numbers.

So, the register address for holding register 108 in a modbus message, as described below from the Danfoss manual, is not 40108 but 107(dec) or 6B (hex), resulting in a value of 00 (hex)in the Start Address HI byte and 6B (hex)in the Start Address LO byte.

The corresponding hex value for 16140 (dec) will 'fit' into the Start Addr HI and Start Addr LO bytes of a Modbus message.

I couldn't find the FC202 Modbus manual, only a 2800/6000/8000 VLT Modbus manual. But on the chance that Danfoss is unlikely to radically change Modbus comm from series to series, here's my interpretation.

(pq 15, MG.10.S2.02):
Holding register 40001 is addressed as register
0000 in the data address field of the message.
The function code field already specifies a ‘holding
register’ operation. Therefore, the ‘4XXXX’ reference
is implicit. Holding register 40108 is addressed
as register 006BHEX (107 decimal).

So they're doing this:
108 (dec) = 6C (hex) - 1 = 6B = 107 (dec)
So, the start Addr Hi byte is 00, Start Addr LO byte is 6B in the example.

For your motor current parameter 16.14
1614 * 10 = 16140 (decimal) = 3F0C (hex) - 1 = 3F0B
Start Addr Hi byte is 3F, Start Addr LO byte is 0B

Why not try read function 03 (hex) holding register 3F0B (hex) and read 2 registers?
I suspect that the response will come back as a 32 bit integer.

Dan

 

[Marke]

Hi Dan

Yes, I suspect that if i structured the data packets manually, it would work, but with the PLC, I have to specify the full modbus address and it must fall in the range of 40000 to 49999 and I can not override this. I don't really want to get into byte stuffing on the PLC if I can avoid it.

Thank you and best regards,


Mark Empson
L M Photonics Ltd

 

[ozmosis]

Mark
Have you resolved this issue yet? if not, I can get someone to find an answer for you in the company.
Patrick

 

[Marke]

Hi Patrick

No answer at this stage which is unfortunate as I will miss the deadline.

Have a good day,


Mark Empson
L M Photonics Ltd

 

[danw2]

Marke,

There's a thread on 5 or 6 digit holding register addressing at the Modbus site:

http://modbus.control.com/dev/1026155725/index_html

Mr. Goodman's comment, "the 5-digit representation was a convenient shorthand for expressing the entire range of addresses supported by the largest Modicon device (40001-49999) available once upon a time" leads me to believe that your modbus master was written for an older era of Modbus.

My reading of the Modbus spec is that Danfoss is well within the spec's interpretation. A holding register located at either 16140 (16.14*100*10) or even 56140 (16140 + 40000) would be within the memory address range of the Modbus spec.

Both recent Modbus Application Protocols, V1.1a (June 4, 2004) and (V1.1b December 28, 2006) state in para 4.4 MODBUS Addressing model, "The MODBUS application protocol defines precisely PDU addressing rules. In a MODBUS PDU each data is addressed from 0 to 65535."

Each protocol further states (para 6.3) that the addressing range for the 03 read/write holding registers
is 0x0000 to 0xFFFF, [which is understood to be at the 40000 to 4FFFF (hex) or 40000 (decimal) to 465535 (decimal)]

If your current master only addresses a range of 40000 to 49999 (assumed decimal) then the master can only handle 15% of the total range of Modbus addresses and master takes the blame for not handling addressing within the range of the Modbus spec and Danfoss is off the hook.

I suspect that you'll have to use another Modbus master or something like RedLion's Data Station Plus module that can fetch data as a modbus master on one port, remap the data internally and on another port act as a modbus slave and allow your current master to fetch the data from the re-mapped register location below 49999.

Dan

 

[Marke]

Hello Dan

Thank you for your insight.
Yes, when I look at the current specification, you can use function 3 and an address of 0 - 0xFFFF which allows for a an address up to 65535, but the Danfoss documentation describes holding registers in the range of 40000 - 49999.
Unfortunately, there are two ways that MODBUS RTU drivers seem to be written, either defining the MODBUS logical address, or the function number and MODBUS Number.
Where the MODBUS logical address is used, the function number is typically determined from the MODBUS logical address, i.e. 0 - 9999 Coil Status, 10000 - 19999 input status, 30000 - 39999 input register and 40000 - 49999 holding register.
This is the older specification as described in the Danfoss documentation.
Unfortunately, the PLC that I am using operates on the MODBUS logical address and will not allow greater than 49999.

Thank you and best regards,

Mark Empson
L M Photonics Ltd

 

[Marke]

Hi Dan

Following on from your suggestions, I have managed to locate a new MODBUS driver that allows for both modbus formats and I am now able to access the upper registers. The information in the manual is incorrect as it shows addressing in the old format only.
I am still having problems with the control word, it does not accept commands as it should, and this seems to depend on other settings. If I set the minimum speed above zero, the command word will not accept a stop bit. This looks like either a firmware issue, or a change in the way it is done.

Thanks again, you set me on the right track.

Best regards,

Mark Empson
L M Photonics Ltd

 

[ozmosis]

Mark
I'll take it up with the support folk tomorrow(mon) and try and get an answer.
Patrick

 

[Marke]

Hi Patrick

Found a work around, set the start bit to zero, then strobe the reset bit and it stops, so am making progress.
I'll have to send you a copy of some revised instructions.
Best regards,
Mark.

Mark Empson
L M Photonics Ltd

 

[danw2]

Mark, I never asked which Modbus master you were using. Is it Citect? Anyhow, the 1999 tech note from Citect (belwo) has an explanation about 6 digit addressing (in 1999 it might not have been part of the Modbus spec, but a 65535 range has been since 2004):

---------------- note Q2800.pdf ---------------
Modbus 6-digit addressing
Article number: Q2800
Created on: 24/06/99
Product: Citect for Windows Versions 5.xx

Summary
I have reviewed the published Modbus spec (Ref: PI-MBUS-300 Rev J) several times and found no direct reference to 6-digit addressing. What is 6-digit addressing?

Solution
As this is not part of the Modbus specification per se, few people will be able to provide you a solid definition.
I have heard two meanings when people refer to six digit addressing in Modbus:

a) The function codes that Modbus defines to read the 4xxxx registers (FC3 for read and FC6 for write) theorectically have a 9999 register range (ie 40001 - 49999). However, the
actual coding in the protocol allows for 2 bytes (ie 0 - 65535). Some people refer to this as 6-digit addressing.

Citect's format is designed to be as close to what a Modicon user would see in his PLC program and thus the range is defined as 40001-49999. Users wanting to
access registers past the 49999 barrier have done so by using the register range of 400001 to 465535 instead of 40001 to 49999 (please note that for Citect's Modbus driver addresses 40001 to 49999 are equivalent to addresses 400001 to 409999).

b) The Modbus function codes FC20 & FC21 (Read Write General reference) are for accessing the 6xxxxx registers. I believe that this is more commonly the 6-digit addressing
that people refer to. Using FC20 & FC21, some 16Meg of address range is available. Keep in mind that transmitting 16Mb of data over a 19.2Kbaud link will take a while. The
Modbus/TCPIP specification may be more suited to this case when your primary concern is tranmitting large volumes of data (this is documented on Modicon's web site:

http://www.modicon.com).

The Quantum PLC makes more use of this register area than
other models. The Citect Modbus driver is being modified to support the 6xxxxx registers.

Note: Whilst this KB article refers to the MODBUS driver, the comments can generally also be applied to the rest of the Modbus family of drivers (MBPLUS, MODBUSA, MBSLAVE,
MODNET, etc.).

Author: Bruce Kinchin
----------------- end --------------

 

[Marke]

Hi danw2

The PLC that I am using is a Horner HE-XLE.
The new driver allows for 5 digit addressing and 6 digit addressing with 5 digit addressing in the range of 40000 - 49999 and 6 digit addressing in the range of 400000 - 465535 so there is no problem with that.

Having had a good look around, there seems to be an element of confusion over the modbus addressing for 6 digit addressing. The five digit addressing is very clearly 40000 - 49999. Some software allows for access beyond 49999 and other software/drivers do not. The function | modbus number addressing is not a problem and that covers both 5 and 6 digit addressing, unfortunately this address format was not an option with the 5 digit driver.

To me, the description in the manual of 40000-49999 as the address range implies five digit addressing and also suggests that anything outside that range is not covered. That was certainly my experience when I used the 5 digit addressing driver. I was looking for some form of wrap around that kept the additional registers in that range.
Following on from your previous comments, I went in hunt of a 6 digit addressing driver and all works OK.
It would be clearer if the examples were based on 6 digit addressing rather than 5 digit addressing.

Thank you for your help.
Best regards,
Mark.

Mark Empson
L M Photonics Ltd

 

[danw2]

>It would be clearer if the examples were based on 6 digit addressing rather than 5 digit addressing.

Mark, do I feel your pain on that. The absence of simple examples sure makes our jobs harder. I'm convicned that those who write the manuals are 4-5 layers from any one who knows what these functions are or do, hence the silence and absence of working examples. How are we supposed to figure out syntax? That's supposed to be defined.

Rant on:
Right now I'm looking at box that has a timer function and the description of the timer function is absolutely useless. I'll have to make up some tests, just to figure out whether it's on-delay or off-delay, interval or whatever.

It kills me that publishing a screen shot of a Windows configuration screen is supposed to fulfil the requirement for 'documentation'. I can see the screen, it's how some cube-nerd defines the settings and their limits that need toi be documented.
Rant off.

I hope your get your motor curren read and a means to STOP.

Dan