Hi guys!

I have a problem with the communication of a water meter through modbus, I am using a master simulator (ModScan) and a usb to rs485 converter to read the values of the 0x address but I get the error (modbus exception response from slave device), the simulator and the meter were programmed according to the manufacturer's requirements.


These are the connections







I would appreciate any help you can give me


.

 

The good news is that an exception response means you are communicating with the device from ModScan (wiring, baud rate, parity, and device address are correct).

The next step is to find out what exception code the Modbus module is returning. The only way I know how to do this in ModScan is to view the traffic and look at the raw response (the exception code is the 3rd byte of the response). You can view the traffic in ModScan by clicking on the Setup menu and selecting Display Options->Show Traffic.

What is the vendor and model of the Modbus module? Do you have a register list?

You said you're trying to read 0X address, so have you selected 01: COIL STATUS for the MODBUS Point Type in ModScan? What Address and Length are you using?

If you haven't done so already, try setting the Length to 1. ModScan uses 1-based addressing, so you may need to add 1 to the address when entering it into ModScan's Address field, if the Modbus module's documentation uses 0-based addressing.

 

Hello, your explanation was very helpful, thank you.

As for the module I have no reference as it is also supplied by the same manufacturer of the meter, then I share format of the records.

 

I using lenght 1 and adress 0036 and this is the exception code

 

OK, I think I see the problem and source of the confusion.

In Modbus "0X addresses" means Coils (for completeness, Input Statuses are 1X, Holding Registers are 4X and Input Registers are 3X). I have a complete write up on this here:
https://control.com/forums/threads/modbus-register-numbering.49844/

The above is a completely different thing than hexadecimal numbers, which uses the "0x" prefix. When registers are documented using hexadecimal, they are almost always 0-based.

Here's what you need to do:

1. Select 03: HOLDING REGISTERS in ModScan for the MODBUS Point Type (if this doesn't work, you may need to use 04: INPUT REGISTERS for the MODBUS Point Type).
2. Using the "Dec." column from your Modbus register list, add 1 to the number before entering it into ModScan's Address field. For example, if you want to read Temperature Value at address 52 (0x0034 hexadecimal), you would enter 53 in ModScan.
3. For the Length field in ModScan, any parameter that uses the "Int16" or "Uint16" type, you would use a Length of 1 per parameter. For "Int32" or "Uint32" types, you would need to use a Length of 2 per parameter (and to view values select Setup->Display Options->Long Integer->Most Significant Register First). For parameters that use the "double" type, you would use a Length of 4 per parameter (But if the documentation is accurate, you would not be able to view values since the documented byte ordering actually violates Modbus 16-bit register ordering. However, you can try selecting Setup->Display Options->Double Float->Most Significant Register First or Least Significant Register First in case the documentation is wrong).

And as a side note, the packet you show is actually the request from ModScan, not a response. Are you sure ModScan is saying "Modbus Exception Response from Slave Device" and not "MODBUS Message TIME-OUT"?

 

Hello, all the doubts were solved, the truth is that I had some confusion about the concepts of registers and coils.

In the end thanks to your explanation I could read them without problem, it is the first time I work with modbus and was doing some tests to better understand the concepts, thank you in advance for your help.

Regarding the note I had changed the parity value and when I made the capture the error was the one you mention "MODBUS Message TIME-OUT".

Thanks for everything.