Modbus

[SAB1461]

I am trying to read a modbus response for a query send to an inverter over Modbus TCP/IP using the software Docklight.

Query Send in Hex: 15 01 00 00 00 06 01 03 00 BD 00 01 ( Trying to read Register 40188 with offset -1)

Response received: 15 01 00 00 00 05 01 03 02 FF FF

Every query send is responded with same response FF.

Please Help!!

[SAB1461]

I am trying to read a modbus response for a query send to an inverter over Modbus TCP/IP using the software Docklight.

Query Send in Hex: 15 01 00 00 00 06 01 03 00 BD 00 01 ( Trying to read Register 40188 with offset -1)

Response received: 15 01 00 00 00 05 01 03 02 FF FF

Every query send is responded with same response FF.

Please Help!!

[K C]

Hi,

The notation 40188 is a control system notation. This is translated to ModBus.

The 4 is either command 3 or 4. In your case command 3.

The 0188 is the ModBus address +1.

So at ModBus you should read a register at address 0187 that is 0xBB

You are reading address 0xBD which is address 0189 decimal

Kees

[SAB1461]

I dont thing I got you competely.

When checked on the Modscan software for 40189,190,191 shows the correct data.

In Docklight, I am reading xBC,xBD,xBE for same parameters with offset of -1.

If you say offset of +1 then,40189 should come for a query of xBD which is actually not the case.

I am attaching some more snapshots of my trial.

This is basically done because initially I was getting a jump in values read on a PLC.

Communication is betwn PLC & SMA Inverter with Sunspec Modbus used.

PLC displays correct value at one instance & then jumps to some garbage value & again correct value at other instance.

So, Now with Docklight I am trying to check the modbus respone of the Inverter doubting that due to Sunspec modbus of Inverter there is a jump in the Value.

[K C]

OK, just told you what I see every time when someone shows me an ModBus address like 40188.

Your device is responding, so the address exists and is valid but you don't get the expected data back. You get data back without an error from the slave.

Could it be that 40188 is the real ModBus address which is 0x9CFC ?

Kees