Beckhoff PLC MODBUS RTU

E

Thread Starter

Erol2309

Hello,

I am having/expect to have a problem reading historical data from a flow computer. The vendor of the flow computer specifies that historical records can be read using Modbus FC20 but the PLC i am currently working with does not support FC20. As a work-around the vendor says that historical data can be read also using FC3, although only by reading one individual entry at a time. So far so good, the catch is that when doing it using FC3 the two bytes in the modbus message that specify the number of registers requested must have a preset value (index of the historical entry). This will probably cause a problem seeing as my readings will only be 20 words of length for each query but the index will vary. I am expecting the modbus function to return an error code.

I am using a Beckhoff CX2020 PLC (actually not a PLC as it runs Windows CE).

This being said, does anyone know a work around for this issue? Is it a safe bet to assume that the solution will be to resort to low level programming of the serial interface?

Any help or advice is greatly appreciated!
 
The imposed limitation of 'reading one individual entry at a time' of 'historical data' with 'FC3' doesn't make sense to me.

The standard Modbus Function Code (FC) 03 has a 2 byte field for a starting address and a 2 byte field for quantity of registers. FC 03 addresses data in the 4xxxxx memory area. That means that the standard FC03 can read multiple values from contiguous 4xxxxx register addresses.

If the historical data is really resident in some area of accessible 4xxxxx memory (which accessed by FC 03) then those data values should be readable with any master/client's standard Function Code 03h by specifying the number of registers that are to be read in one transaction (up to the maximum) from a starting address (an index value, as it were). Depending on how many are data values available and needed , it might take multiple 'transactions' to fetch what's needed.

Did the vendor tell you specifically the starting address and the range of historical data that is available in 4xxxxx or was it just hinted at?

If there is some vendor imposed restraint on the number of historical values returned from some area of 4xxxxx memory (it's Modbus, anything goes . . .) and that restraint is one value, then a script using the standard FC03 which increments the starting address each time for the number of available historical values could fetch one data value per transaction over multiple transactions.

But I'm wondering if there's a misinterpretation of the vendor's statement. Could the vendor have meant to say that the data can be read real-time using FC 03, one value at a time; with the implication that the task of building a database of historical data is then done at the receiver end, meaning in your HMI?
 
Ok so i finally got hold of the PLC and the flowcomputer, here's their variation on Modbus RTU:

1 byte: slave address

2 byte: function code

3-4 byte: data address of the first holding register

5-6 byte: here it gets tricky as usually here you would have the quantity specifier, but in this case their device expects the index of the historical recording you are requesting

7-8 byte: CRC

Each historical recording is returning 20 words, and as i've tested only historical data with the index 20 is working...obviously.

The historical data could be read using Modbus FC20, but that is not available on this PLC.
 
Thank you for your observations. Very interesting Modbus derivative.

Would you mind sharing some information for those who might run into the same situation?

What brand and model Flow computer is this?

Which Function Code is accomplishing this 20 word read of historical values? FC 03?

Does the value of 20 words seem to be a fixed value (always 20 words regardless of indexed address?)

Is a word = a Modbus register (16 bits)? Are 32bit floating point values two words/registers?

Are the words data values only, or is there time/date stamp data?

What indexed range is used for historical data?

Any idea who much historical data is available? 100 words? 1,000 words?

> The historical data could be read using Modbus FC20, but that is not available on this PLC.

That's not unusual. It's hard to find a master that does support FC20.
 
Ok so here are my answers to your questions: the flow computer is FEPA model CDM-GN.

Currently no function code can read the data. I see only two possibilities to solve this issue. Either low level programming of the serial interface. Or kindly asking the vendor to modify its firmware to store the last recordings of the historical data in simple holding registers that can be read via FC03.

Regardless of the index each historical entry has a length of 20 words.

By word i mean 16 bit value. The floating point values are stored in 2 consecutive registers.

The timestamp is being stored in float values also...a bit weird to interpret but not impossible.

The historical data is grouped in two categories, hourly and daily data, each having a fixed number of recordings (up to ~800 as i remember).
 
Have you tried using Simply Modbus ? Great test software I use all the time, they have RTU and TCP versions. Really good just verify if a neutral Modbus master can query and read a Modbus device.

Best
 
Top