Modbus/TCP to Rockwell mapping with multiple slaves

Digi One IA/IAP
1

Ok, I got the “DH+ to Ethernet via KF2” bridge working very well. I mentioned it to Lynn but I solved the “multiple devices with same IP address and different station numbers” issue in RS-Linx. Simply create multiple Ethernet drivers and set up your different station addresses on each one. It is a kludge but it works (almost) perfectly. The only problem I’ve had so far (no explanation) is that over this interface, my Panelviews show up and appear to be working but when the Panelview software attempts to reprogram the Panelview, it complains that it can’t recognize the device. Programming the PLC’s works flawlessly.

Now I’m onto the next bridging project: bridging from PLC 5’s, Micrologix, and SLC’s over to Modbus protocol since the types, amounts, and pricing of the available hardware is far better than on the AB side of the world.

I read through the manuals and started with an Acromag card which talks Modbus/TCP. Everything works great. The IAP looks “like a SLC” and talks MSG blocks via PCCC.

Now on to the next big issue. I understand very well now how the protocol mapping works with ONE device.

How does the protocol mapping work with multiple devices? IE, it’s obvious how to set the UID numbers and/or map them but how do you figure out the “file” address to use in the MSG block?

2

I’m not sure the question? Are you trying to poll say 6 Modbus/RTU slaves on an RS-485 multi-drop?

I’ve never seen how RSLogix5 presents a MSG block, but on a SLC5/05 you have 2 options:

  1. If you’re using CSPv4 (ie: NOT multi-hop), then you need to use the new rev “F” firmware and select REMOTE addressing. When set to LOCAL, the SLC5/05 forces the CSPv4 header’s DST/SRC values to both be 0 - not useful in addressing Modbus/RTU slaves. When set to REMOTE, you well see more fields up. Enter a value in the “Remote Station Address” and the DOIAP will use this as the slave address. Firmware E/E1 doesn’t understand the REMOTE header in CSPv4, so this is not an option for older DOIAP.

  2. If you are using Ethernet/IP (ie: YES to multi-hop), you should add a ControlLogix backplane entry. The 1756 Slot number will be used as the slave address. In other words, the SLC5/05 will open a CIP connected message channel to the DOIAP and ask it to connect to say slot 7. Since the DOIAP has no backplane, it just says “fine” but records the slot # as the a constant to use as the destination or slave address in all DF1 or Modbus messages created by this channel.

I just got my first MicroLogix 1100 a few days ago - it seems to ONLY support Ethernet/IP, so option #2 with the multi-hop slot trick is required.

Does this answer your questions?

  • Lynn
3

Yes, that almost answers my question. I’m actually interested in polling say 6 Modbus/TCP slaves because my issue is getting the PLC-5’s to talk anything but AB Remote I/O (truly using the IAP as a protocol bridge). When I put in multiple Modbus/TCP slaves, they show up on the list just like multiple Modbus/RTU slaves so it at least appears that the DOIAP is handling it correctly.

“Multi-hop” is a CSPv4 feature that was originally used because under DH+ and other AB proprietary networks, you could have “bridges” in the network but you explicitly gave the path through the network. So the RS-Logix 5 screens look slightly different from a SLC 5/05 but under the hood, it’s using the same old “remote” headers from the DH/DH+ days.

This is what I do know about PLC 5 communication (Ethernet-specific):

Very recently (within the last 12 months), AB started selling PLC-5 processors with Ethernet/IP capability. I don’t have any information since all of mine are significantly older than that. So I can’t comment as to how this actually works (test it).

If you specify Ethernet even on a CSP-only processor (all I have at the moment), the message type just turns into the usual DF-1 specification whether it is a “SLC Typed Logical Read/Write”, or something for a PLC-5 or PLC-2.

You get a box for “Multihop” (Yes or No). If you set it to no, then it asks for an IP address and as usual, DST and RST are set to zero just like with the SLC 5/05 using CSPv4 routing.

If you set Multi-hop to yes, then you get a “MultiHop” tab with more settings. It used to look different as I recall but on a current copy of RS-Logix 5, it asks for the To Address (“1756-ENet I.P. (str):” and a “Backplane Slot(dec):”. If you press the “Insert” key, then you can continue to add more addresses (specify a route). If you do that, then you put in a Device (choices are 1756-CNB, 1756-DHRIO, 1756-DH485, ControlLogix backplane, or Remote DH/DH+), and then another address which is based on the device such as ControlNet node for a 1756-CNB, or a DH/DH+ Station ID for DH/DH+.

Based on your description of RS-Logix 500, the displays are all a little different but they function identically so I see no technical reason it is not going to work. When I get a second Ethernet card in here and have it all working, I can send some screen shots of setting it up on both a SLC 5/05 and a PLC 5/40E.

4

Okay, I tried it. No go with the PLC5. So just in case, I switched over to a SLC5/05 and switched to trying to communicate with just a single device. This is my configuration summary:

IA Configuration Summary Back to Industrial Automation

Table modbustable
table=1 name=modbustable
Network Sources:
master=1 active=on protocol=abethernet transport=tcp ipport=2222 table=1 chartimeout=50ms messagetimeout=2500ms idletimeout=5min errorresponse=off fixedaddress=auto fixedsource=auto target=slc5 mapping=“”
Serial Sources/Destinations:
None
Route Destinations:
route=1 active=on protocol=modbustcp protaddr=0 type=ip ipaddress=10.3.3.12 ipport=502 transport=tcp connect=passive idletimeout=5min reconnecttimeout=5sec chartimeout=50ms slavetimeout=1sec errorresponse=on fixedaddress=auto
route=2 active=on protocol=modbustcp protaddr=1-255 type=ip ipaddress=10.3.3.12 ipport=502 transport=tcp connect=passive idletimeout=0ms reconnecttimeout=5sec chartimeout=50ms slavetimeout=2500ms errorresponse=on fixedaddress=auto

Although I can poll the device directly, I can’t seem to poll the Digi One. Is there something wrong with the Digi configuration?

5

Keep in mind for the “RA to MB/TCP” bridge you can reuse an existing DOIAP - even the one servicing your KF gateway. If you set the destination IP to 0.0.0.0 and enable “replace=on”, then the DOIAP uses the slave address as the last octet. In your case, if your 6 MB/TCP slaves have IP like 192.168.3.70 to 76 (and DOIAP is on 192.168.3.x subnet), then calling them slaves 70-76 allows you to have a single “destination route” catching slaves 70-76.

The DOIAP has not yet been optimized for rapid net-2-net function. My last tests showed CSP-to-MB/TCP bogged down at about 55 polls per second and EIP-to-MB/TCP at about 30. This is NOT related to the DOIAP horse-power (It has a 32-bit, 66MHz processor). It is more related to the UNIX-style signaling & task scheduling used. The “Master” & “Slave” halfs of the process run seperately & the PCCC to Modbus works in a few steps which can almost be thought of as repeats of failed attempts. So these limits are caused by task switches.

Since 55 polls per second is “fast enough” (or “too fast”) for normal serial links, so this issue of net-2-net speed up is on my to-do list, but down a few notches from the top since any fixes could break lots of other things.

  • Lynn
6

I’d try a route like this:

set ia table=1 route=1 active=on protaddr=0-254 type=ip
set ia table=1 route=1 protocol=modbustcp transport=tcp
set ia table=1 route=1 connect=passive ipaddress=0.0.0.0
set ia table=1 route=1 ipport=502 replaceip=on
set ia table=1 route=1 slavetimeout=1000 chartimeout=250
set ia table=1 route=1 idletimeout=120 errorresponse=on
set ia table=1 route=1 broadcast=replace fixedaddress=1

The differences are:

  1. DOIAP uses its own IP for the first 3 octets of the MB/TCP slave address (ie: 10.3.3.x in your case)
  2. DOIAP uses your supplied “slave address” as the final octet - so you’d access slave at IP 10.3.3.45 as slave address #45
  3. the “fixedaddress=1” forces the Modbus/TCP “unit id” to be 1. With it auto, it matches the slave address (ie: like 45) and some Modbus/TCP slaves incorrectly demand the Unit Id be zero or 1.
  4. the “idletimeout” means we close connections to your Modbus/TCP slave if no new request shows up in 2 minutes. This isn’t critical, but when doing a route like this that permits up to 254 sockets, we don’t want to maintain sockets we never expect to use again.