I want to develop a software to read and write data to Schneider PLC, which is the format of %I and %Q using modbus TCP protocol (E.g. %I0.4.0 and %Q0.5.1).

Now, I just can read/write the %MW type address using function codes of 3 or 16.

So, how can I read or write that format data to PLC program?
Is that I can distinguish the format address using the function codes?

 

As far as I know it is not possible. Copy the IO as a block into %MW and read it from there

 

> As far as I know it is not possible. Copy the IO as a block into %MW and read it from there

Thanks.
And,can you tell me is the ModbusTCP protocol itself decided the failure of the %I format data exchange or the PLC software that decided the failure of the exchanging?

 

Using the "standard" Modbus function codes to a Modicon IEC controller such as the M340 it is not possible to read either the %I or %IW references. The Modbus function codes 01 and 02 both return %M references (similar to old Modicon 0xxxx coils) and fucntion codes 03 and 04 both return %MW references (similar to old Modicon 4xxxx holding registers).

In simple terms, if you were to use function code 02 to read input 127 you would receive the state of output 127 (or internal ref 127).

Since there never were references such as 0x, 1x, 3x, 4x in the M340 (topological addressing only), I/O references must be moved to located %M and %MW references for Modbus access.

Examples:
Move %Ixx (DIN) to %Mxx for reading via Modbus protocol.
Write via Modbus protocol to %Mxx and then move to %Qxx (DOUT)
Move %IWxx (AIN) to %MWxz for reading via Modbus protocol

Unlocated variables and system bits/words must be moved to located references (%M or %MW) in the controller for remote access. Use the MOVE function.

NOTE 1.. you would have thought that this would have caused issues with HOST DEVICES when Schneider users moved from non IEC controllers to IEC controllers, but in truth it seems that all communication tables were configured to read/write coils and holding registers. Reading of raw inputs was not done.

NOTE 2.. Schneider devices with Modicon UMAS protocol (e.g. Magelis HMI devices) can read all memory type references directly, including system bits and words.

 

1.
> Using the "standard" Modbus function codes to a Modicon IEC controller such
> as the M340 it is not possible to read either the %I or %IW references.

Can I think like this:"Because Modicon IEC controller does not support the read or write %I or %IW references"?

2.
> Since there never were references such as 0x, 1x, 3x, 4x in the M340
> (topological addressing only), I/O references must be moved to located %M
> and %MW references for Modbus access.

Can I think like this:"If the PLC have the 0x, 1x, 3x, 4x references, it can be read or written using %I and %IW"

3.
> NOTE 2.. Schneider devices with Modicon UMAS protocol (e.g. Magelis HMI devices)
> can read all memory type references directly, including system bits and words.

What is the UMAS protocol?
As far as I know, Vijeo Citect can read and write all memory type references directly, Is that because the protocol of Citect is UMAS as well?

 

>> 1.
>> Using the "standard" Modbus function codes to a Modicon IEC controller such
>> as the M340 it is not possible to read either the %I or %IW references.

> Can I think like this:"Because Modicon IEC controller does not support the read
> or write %I or %IW references"?

You can if you want to. It is not the controller but the protocol. All references are accessible with the correct protocol.

>> 2.
>> Since there never were references such as 0x, 1x, 3x, 4x in the M340
>> (topological addressing only), I/O references must be moved to located
>> %M and %MW references for Modbus access.

> Can I think like this:"If the PLC have the 0x, 1x, 3x, 4x references, it can be
> read or written using %I and %IW"

Stay with read / write of %M and %MW

>> 3.
>> NOTE 2.. Schneider devices with Modicon UMAS protocol (e.g. Magelis HMI devices)
>> can read all memory type references directly, including system bits and words.

> What is the UMAS protocol?

UMAS protocol is an "expanded" Modbus Protocol used by Schneider for Unity software and the Magelis software (and probably more). It permits read and writes of mixed data types in the same message frame.

> As far as I know, Vijeo Citect can read and write all memory type references
> directly, Is that because the protocol of Citect is UMAS as well?

Yes

 

Schneider PLCs such as the M340 when acting as a Modbus SLAVE will automatically respond to all the standard Modbus commands to read and write %MW, %IW, %QW. Magelis HMIs can, for example, read all these data types via Modbus TCP/IP or serial modbus.

If the PLC is to act as Modbus MASTER, use the READ_VAR or WRITE_VAR function to read or write %MW. If you want to read %IW or %QW you must use the DATA_EXCH function. With the DATA_EXCH function, you can create a Modbus request with any Modbus code you wish.

 

my dear

the problem can be solved by either using an OPC server such as KEPWARE and select the driver modbustcp driver. otherwise check for blocks (program Schneider plc using functional block diagrams) which can be used to read (provided the function code is 4 for reading data) from the input registers with addresses starting with 3xxxxh. provided your plc is 5 digit address device or it will be 3xxxh for 4 digits. fc is 3 for reading data from holding registers. for writing data use functional block with function code 6 for writing in a single holding register.