Modbus 32 bit ints are not correct

[rob987]

Hi,
I have a problem reading 32 bit unsigned ints from a PLC. The smaller values are correct, but larger values are not.
I have done the point locater read using all the available 4 byte int types, with no luck. The data is good when read with modpoll, and agrees with the PLC data.

The larger values are Watt hour values from power meters, and the PLC stores the midnight values, to show the current days usage.

$ modpoll -m tcp -a 1 -r 16401 -c 18 -t 4:int -1 192.168.220.75
modpoll 3.4 - FieldTalk(tm) Modbus(R) Master Simulator
Copyright (c) 2002-2013 proconX Pty Ltd
Visit http://www.modbusdriver.com for Modbus libraries and tools.

Protocol configuration: MODBUS/TCP
Slave configuration...: address = 1, start reference = 16401, count = 18
Communication.........: 192.168.220.75, port 502, t/o 1.00 s, poll rate 1000 ms
Data type.............: 32-bit integer, output (holding) register table

-- Polling slave...
[16401]: 712312
[16403]: 0
[16405]: 7787370
[16407]: 4738731
[16409]: 7431320
[16411]: 1011237
[16413]: 710242
[16415]: 4390912
[16417]: 4552479
[16419]: 7269753
[16421]: 11488
[16423]: 6472
[16425]: 12772
[16427]: 6717
[16429]: 2070
[16431]: 0
[16433]: 8466
[16435]: 4306

The above modpoll values are correct.
The point locator test returns the following values -

Note, one of the zero values is correct, and the other is 655360

In space separated text,

Click PLC Modpoll Read Point Locator
Register Type MB Address Name Value Value Address Value Address
DD9 INT2 416401 Pool_Energy 712314 712314 [16401] 1029992 16399
DD10 INT2 416403 Spare 0 0 [16403] 655360 16401
DD11 INT2 416405 CP3_Import_Energy_MidN 7787370 7787370 [16405] 54122 16403
DD12 INT2 416407 CP3_Export_Energy_MidN 4738731 4738731 [16407] 7753387 16405
DD13 INT2 416409 H1_Energy_MidN 7431320 7431320 [16409] 4744344 16407
DD14 INT2 416411 H2_Energy_MidN 1011237 1011237 [16411] 7433765 16409
DD15 INT2 416413 Pool_Energy_MidN 710242 710242 [16413] 1037922 16411
DD16 INT2 416415 SE5K_M_Export_Energy_Mid 4390912 4390912 [16415] 655360 16413
DD17 INT2 416417 SE5K_M_Import_Energy_Mid 4552479 4552479 [16417] 4421407 16415
DD18 INT2 416419 SE5K_I_Energy_MidN 7269753 7269753 [16419] 4582777 16417
DD19 INT2 416421 CP3_Import_Today 11487 11487 [16421] 7220448 16419
DD20 INT2 416423 CP3_Export_Today 5942 5942 [16423] 5942 16421
DD21 INT2 416425 H1_Energy_Today 11989 11989 [16425] 11989 16423
DD22 INT2 416427 H2_Energy_Today 6650 6650 [16427] 6650 16425
DD23 INT2 416429 Pool_Energy_Today 2070 2070 [16429] 2070 16427
DD24 INT2 416431 SE5K_M_Exp_Energy_Today 0 0 [16431] 0 16429
DD25 INT2 416433 SE5K_M_Imp_Energy_Today 7242 7242 [16433] 7242 16431
DD26 INT2 416435 SE5K_I_Energy_Today 4306 4306 [16435] 4306 16433

Any suggestions on how to resolve ?

Thanks

[rob987]

Another problem discovered. I am reading 3 x 32 bit values from an inverter via modbus, and publish them for the PLC to read. The values in mango seems correct, but are not being updated to the publisher. The PLC read is showing success, and the value in the register is being overwritten, but is is not the same as the value in Mango.

M_Exported_Energy has a value of 444315 in Mango, but the PLC shows 4390912. This value has not changed all day, so "Export Today" shows as zero.

I checked logIO in the publisher, files are created, but no data is logged

-rw-r--r-- 1 root root 0 Apr 7 17:09 processLog.ModbusIpPublisherRT-1.log
-rw-r--r-- 1 root root 0 Apr 7 17:09 processLog.ModbusProcessImageSendThread-1.log
@mango:/opt/mango/logs$

How do I debug the publisher?

[CraigWeb]

Hi @rob987

the first thing that comes to my mind is why are you polling 16399 with the point locator for pool energy?
Modbus4J is zero-based so you will only -1 for the Modbus address.

I believe you should be polling 16400 and then alternating between unsigned integer, unsigned integer swapped and unsigned integer swapped bytes and words to find out how the click PLC puts its registers.

[rob987]

Hi all,
Well, at least I have won the dummy of the week award this week :-)
The DINTs have swapped words, so when you read from the correct address and swap the words, all is good.
I "fixed" the publisher by creating a second publisher on same port number, and modbus address 2.
I did have SINT and DINT data combined in the one publisher, and the PLC was making 2 read requests.
The DINT values are now increasing as expected.

Thanks all

[jvaughters]

Rob987,

You have run into a common problem that I see all the time. The swapped word issue is defaulted differently by different Modbus master clients. So modpoll can look correct because it assumed (defaulted) the order correctly. As a general rule, if the numbers are not coming out correct swap the words to see if that helps. Other troubleshooting techniques would be to retrieve each individual word and assemble them manually and see if that helps resolve the issue. Furthering the issue, I have found that device documentation can greatly lack in describing the order of their numbers. Of course all of this depends on getting the correct register number resolved first.

I'm glad you got it resolved.

[CraigWeb]

When smaller numbers are correct and larger numbers are incorrect. It is usually due to swapped registers or not zero-basing your address. The good news is that Modbus devices will apply the same rule across all the 32 and 64-bit data so once you have figured out on one data point you can apply it to the rest.