Modbus TCP with OMRON E5EC


I need modbus expert to guide me on this as I am still new to modbus.

I've referred to the OMRON E5EC "Digital Temperature Controllers Communications Manual" but I've yet to discover the holding register to write to Auto/Manual mode. I can read the status but not able to write to change the mode from Auto to Manual vice versa.

FYI, I try to communicate with the E5EC controller using modbus tcp protocol and tests out the register using MODSCAN software. I converted the two-byte mode address to decimal and able to find and write to these addresses successfully for SV, MV manual, P, I, D.

I used modscan to find the auto/man address (referring to the communications manual), I converted the 101E/300F to decimal and I found out there is a value of 1.

However, I could not write to that address to change it to 0. Also, when I switch between Auto/Manual mode at the controller, the register does not change and always stays at 1. If I understand correctly, from the manual (0) is OFF and (1) is ON, so I think that the address only imply that the Auto/Man selection was turned ON instead of (0) for manual and (1) for auto mode.

I go thru the manual again and found out at page 86, there is a command code (09) for Auto/Manual Switch where 00: Automatic Mode and 01: Manual Mode

I do not understand how this command code works?
What makes it different from the holding register address I use for other parameters?
You've done a nice job explaining what you've tried and what's worked and what hasn't.

Don't feel bad about being new to Modbus. I'm old to Modbus and found the Omron a real challenge, things like:

- Omron's "Variable area" is not a rotameter, it's a Modbus register.

- Omron's "Element" is a 16 bit Modbus register

- serial comm defaults to 7 bit word/2 stop bits, an ASCII standard, so you did really well to get Modbus RTU running with 8 bit word/1 stop bit.

- register addresses are zero based hex addresses, and you managed to figure out that Modscan uses decimal values for register addressing, not hex. Bravo for someone new to Modbus.

I'm going by what's in the manual; I don't have an Omron loop controller, nor any direct experience with one.

<b>1. Getting the controller into manual mode:</b>

Whew. Lots of references to Auto/Manual in various registers and the descriptions are not good. I'm as confused as you are:

Register 2E0A Event Input Assignment: value 2 = Auto/manual Switch (presumably reports the status of Event 1 when it is configured to switch between auto/manual on a contact closure?)

Register 300F Auto/Manual Select Addition: addition? what is added to what? It isn't clear to me, either, what the data value in 300F really means.

Register 3200 PF setting 7 = Auto/Manual switch. I have no idea what PF means.

Command Code 09: This uses Modbus Function Code (FC) 06, which writes a 16 bit word to a single register. Manual page 4-10 (78 pdf) section 4-4-2 says that Omron supports Function Code 10H (16 decimal), which writes multiple registers, and usually FC 10H (16 decimal) will execute a single register write when told to write a single word to single register.

I think you're on the right track about using Command mode 09 to force auto/manual.

There's a statement in the manual on page 4-12 is, "For an operation command, specify 0000 or FFFF."
Their example, later on, shows the data value as 0101, so I'd ignore the 0000/FFFF bit of nonsense, whatever it is, but I suspect the data value format is critical.

Note that the example for Command and Response (page 4-14) for the Run/Stop command (where 00 is RUN, 01 is Stop), that the command to Stop is formatted as shown in the link:

Decoded, the message is:
01 Slave 1
06 Function Code 06 (write single to single register)
0000 Register 0000
0101 Data value 0101
499A CRC

Note that the data value is not either 0000 or FFFF, which eliminates their previous suggestion to use either.

The data value in the example is 0101, or a sequentially duplicated 01 Stop value.

I suspect that for Auto/Manual mode (00 = Auto; 01 = Manual) that your data value probably has to duplicate the 01 Manual value, in other words the data value should be 0101 for manual mode. The duplicated value probably has something to do with Omron's 2 byte/4 byte proprietary protocol CompoWay/F weirdness.

Modscan uses Function Code 16 to write a value. The Omron manual says it supports both FC 06 and FC 16 (10 hex). You can write a value from Modscan using Setup > Extended > Preset Regs (enter the data value). Try it and see what happens when you write value 0101 to register 0009 (hex), or 0010 decimal.

<b>2. Controller's Output value</b>
Once you get the controller into manual mode, it looks like register 2600 (hex) is where you write a Manual (mode) MV value.

<b>3. Interpreting the data values:</b>
It's signed integer data, with a "divide by 10" factor to get a single digit to the right of the decimal point.

Comm manual page 5-3: Two-Byte mode: register 2600: Manual MV:
Standard control: H'FFFFFFCE to H'0000041A (H' is Omron's hexadecimal notation)
The values equate to -5.0 to 105.0

For low range value, -5.0, the right-most (low order) 16 bits are FFCE (hex), a 16 bit integer which converts to decimal = -50
Apply a "divide by 10 factor" and you get -50 / 10 = -5.0

For the upper range value, 105.0, the right-most low order 16 bits are 041A (hex), a 16 bit integer which converts to decimal = 1050
Apply a "divide by 10 factor" and you get 1050 / 10 = 105.0

So read the low order 16 bits and divide by 10 to get the value.
Hello David.

Thank you very much for your time going thru the manual and the explanation on the function code.

I tried to write in Modscan as you suggested, 0101 to both registers (0009 and 0010) but I got this:

**Modbus Exception Response from Slave Device**
The example Operation Command in the link:

uses the Function Code 06, with a register address of 0000, but register address 0000 is (4)0001 and according to the register table/map is (4)0001, 0000 hex, is used for the 32 bit (4 byte) process variable.

Is register 0000h or (4)0001 the controller's Process Variable (PV) or a COMMAND register? A process variable in a temperature controller is usually a write-only value, generated within the controller. So a write command to 0000h probably tells the controller that it's a command, which is the basis for the yellow highlighted statement, under "Write Variable Address": For an operation command, specify 0000 or FFFF.

So 0000 or FFFF is the device's register address for a COMMAND.

Now to tackle the data format for the command query, which is shown as being 0101 in the Example Command and Response. I do not think that it is a duplicated value, as I initially thought, I think that the high order byte is the COMMAND value, and the low order byte is the COMMAND's value.

Unfortunately the example uses the STOP command, 01, so we have to guess which of the two 01's (0101) is the command code 01 and which 01 is the code meaning STOP. I'm guessing the high order 01 is the command and the low order 01 is the STOP.

If that's true, then a COMMAND to enable communications writes would be Command 00, Enable 01.
The command to put the auto/manual switch into manual would be: Command 09, manual mode 01

So I'm guessing the Modbus PDU message to enable command writes would be <pre>
xxh slave node ID
06h Function code to Write a single variable
0000h the write variable address for an operation command (or maybe FFFF)
0001h Command 00 to enable communication writes (enable = 01)
xxh slave node ID
16h Function code to Write multiple variables
0000h the write variable address for an operation command (or maybe FFFF)
0001h quantity of registers to write to
0002h data byte count
00h Data Hi Command 00 to enable comm writes
01h Data Lo Enable = 01
Followed by a writing a COMMAND to switch to auto/manual<pre>
xxh Slave node ID
06h Function code to Write a single variable
0000h the write variable address for an operation command
0901 Command 09 for auto/manual switch, manual mode 01
xxh slave node ID
16h Function code to Write multiple variables
0000h the write variable address for an operation command (or maybe FFFF)
0001h quantity of registers to write to, one register
0002h data byte count
09h Data Hi Command 09 for the auto/manual switch
01h Data Lo Auto/Manual = Manual = 01
In Modscan, register 0000h is (4)0001. I think Modscan only uses FC 16, but it should format the message

I also noticed that the auto/manual switch command has a much more extensive explanation in the CompoWayF (Omron's proprietary protocol) section of the comm manual (pg 43 in my copy), which is not repeated in the Modbus section of the Comm manual.
Oops, 2nd post, data format explanation should read:

. . . the high order byte is the COMMAND "Code" (not value), and the low order byte is the COMMAND's value.