Wrong return in fc4 #96

@AlanCluet I think you are sending different start address value 00 06 vs 00 08. This library uses 0 based or data address based addressing. Try adjusting start address.

8f 04 00 00 00 06 01 04 00 06 00 01 <--- OK Request
55 25 00 00 00 06 01 04 00 08 00 01 <--- Bad Request

Example request packet structure

 * Example packet: \x00\x01\x00\x00\x00\x06\x01\x04\x00\x6B\x00\x01
 * \x00\x01 - transaction id
 * \x00\x00 - protocol id
 * \x00\x06 - number of bytes in the message (PDU = ProtocolDataUnit) to follow
 * \x01 - unit id
 * \x04 - function code
 * \x00\x6B - start address
 * \x00\x01 - input registers quantity to return

aldas Jul 22, 2021
Maintainer

This is one older answer related to addressing #91 (comment)

AlanCluet Jul 26, 2021
Author

I just edit the ip / id / address and quantity of the query.
how can be some answers good and some bad with same script?

aldas Jul 26, 2021
Maintainer

Assuming that "OK Request" is done with some other modbus client/library then it is the addressing scheme that is different. This library uses data address for addessing - so first address is 0 and second is 1. Some clients use (as default) 1 as first address.

You could paste your code for that example request. I can comment on that if there is something fishy there.

AlanCluet Jul 26, 2021
Author

its just ur fc4 example with custom ip, id and address.

But same script in some address returns the same value and in other address from same device dont.

With other clients all address returns the expected values.

aldas · 2021-07-26T17:22:20Z

aldas
Jul 26, 2021
Maintainer

So with this library fc4 example when you set start address X you get different response compared to other tools. This is as I sayd - this library uses data address. This means that if start address is X then X is sent to the server. Other tools often used -1 addressing ala when you set start address x=5 then actually 4 is sent.

For example Modpoll https://www.modbusdriver.com/modpoll.html has option -0

-0            First reference is 0 (PDU addressing) instead 1

note: reference is start address

6 replies

aldas Jul 27, 2021
Maintainer

well, for me to debug it I would need to see request dump from other library with exact same data address in packet as this library sends and info that number that other library/tool decodes into and that number this library says that register contains.

for example previously

8f 04 00 00 00 06 01 04 00 06 00 01 <--- OK Request
55 25 00 00 00 06 01 04 00 08 00 01 <--- Bad Request

I assume in that case this library had $startAddress = 8; as I see 00 08 in packet. I do not know about other tool addres - was it also 8 (I assume it could not have been 6)? then try to set it to 10 (seems to be somekind of +2 thing going on. probably related to fact that 1 register = 2 bytes)

and then when the requests from both tries have same data address in packet report that value/number is that input register is reported to have.

The thing is that FC4 and FC3 implementations are pretty much the same. FC4 extends FC3 to swap out function code.

aldas Jul 27, 2021
Maintainer

also do you have same problem then you use modbus "server" emulator as your requests target? https://www.modbusdriver.com/diagslave.html allows you to tests agains.

AlanCluet Aug 2, 2021
Author

is not an address variation issue, if i ask on all clients on address 3, all returns the same, if i ask on address 4 all other clients returns the same but fc4 scripts returns other value.

aldas Aug 2, 2021
Maintainer

still. for me to help I need to see both requests (other tool/client and this lib) network packets and what is the shown value (other tool and this client) in applications. It would be good if you could provide screenshot of that other tool for me to see what are the exact request params. and copy paste of this library code you use for requesting and printing the response

As said: previous sniffed dump had different data addresses in packets. There is nothing I can do if different addresses are requested. But if packets have same address and still value shown in application is different then the problem is somewher response bytes are converted to values.

aldas Aug 3, 2021
Maintainer

Example of FC4 request with https://www.modbusdriver.com/modpoll.html

Server:

x@x:~/code$ ./diagslave -m tcp -p 5020
diagslave 3.4 - FieldTalk(tm) Modbus(R) Diagnostic Slave Simulator
Copyright (c) 2002-2021 proconX Pty Ltd
Visit https://www.modbusdriver.com for Modbus libraries and tools.

Protocol configuration: MODBUS/TCP
Slave configuration: address = -1, master activity t/o = 3.00s
IP configuration: port = 5020, connection t/o = 60.00s

Server started up successfully.
Listening to network (Ctrl-C to stop)
...............
validateMasterIpAddr: accepting connection from 127.0.0.1
Slave   1: readInputRegisters from 6, 1 references
........................^C

Request using following settings:

-a 1          Slave address (1-255 for serial, 0-255 for TCP, 1 is default) <--- (unit id)
-r 6          Start reference (1-65536, 1 is default) <--- (start address)
-c 1          Number of values to read (1-125, 1 is default) <--- (quantity)
-t 3          16-bit input register data type <--- (modbus function type)
-1            Poll only once only, otherwise every poll rate interval
-p 5020          IP protocol port number (502 is default)

Actual request:

x@x:~/code$ ./modpoll -a 1 -r 6 -c 1 -t 3 -1 -p 5020 127.0.0.1
modpoll 3.10 - FieldTalk(tm) Modbus(R) Master Simulator
Copyright (c) 2002-2021 proconX Pty Ltd
Visit https://www.modbusdriver.com for Modbus libraries and tools.

Protocol configuration: MODBUS/TCP, FC4
Slave configuration...: address = 1, start reference = 6, count = 1
Communication.........: 127.0.0.1, port 5020, t/o 1.00 s, poll rate 1000 ms
Data type.............: 16-bit register, input register table

-- Polling slave...
[6]: 0

TCPDUMP:

x@x:~/code/$ sudo tcpdump -i lo -X port 5020
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), captu
...
...
...
// request packet bytes "0001 0000 0006 0104 0005 0001"
07:35:37.375639 IP localhost.51600 > localhost.5020: Flags [P.], seq 1:13, ack 1, win 128, options [nop,nop,TS val 4165712428 ecr 4165712428], length 12
        0x0000:  4500 0040 78a4 4000 4006 c411 7f00 0001  E..@x.@.@.......
        0x0010:  7f00 0001 c990 139c bb98 b82d d825 b100  ...........-.%..
        0x0020:  8018 0080 fe34 0000 0101 080a f84b ba2c  .....4.......K.,
        0x0030:  f84b ba2c 0001 0000 0006 0104 0005 0001  .K.,............
...
// response packet bytes "0001 0000 0005 0104 0200 00"
07:35:37.375834 IP localhost.5020 > localhost.51600: Flags [P.], seq 1:12, ack 13, win 128, options [nop,nop,TS val 4165712428 ecr 4165712428], length 11
        0x0000:  4500 003f 0f7a 4000 4006 2d3d 7f00 0001  E..?.z@.@.-=....
        0x0010:  7f00 0001 139c c990 d825 b100 bb98 b839  .........%.....9
        0x0020:  8018 0080 fe33 0000 0101 080a f84b ba2c  .....3.......K.,
        0x0030:  f84b ba2c 0001 0000 0005 0104 0200 00    .K.,...........
...
...

Example FC4 request with this library

Code I am using:

<?php

use ModbusTcpClient\Network\BinaryStreamConnection;
use ModbusTcpClient\Packet\ModbusFunction\ReadInputRegistersRequest;
use ModbusTcpClient\Packet\ModbusFunction\ReadInputRegistersResponse;
use ModbusTcpClient\Packet\ResponseFactory;

require __DIR__ . '/../vendor/autoload.php';
require __DIR__ . '/logger.php';

$connection = BinaryStreamConnection::getBuilder()
    ->setPort(5020)
    ->setHost('127.0.0.1')
    ->setLogger(new EchoLogger())
    ->build();

$startAddress = 6;
$quantity = 1;
$unitID = 1;
$packet = new ReadInputRegistersRequest($startAddress, $quantity, $unitID);
echo 'Packet to be sent (in hex): ' . $packet->toHex() . PHP_EOL;

try {
    $binaryData = $connection->connect()
        ->sendAndReceive($packet);
    echo 'Binary received (in hex):   ' . unpack('H*', $binaryData)[1] . PHP_EOL;

    /**
     * @var $response ReadInputRegistersResponse
     */
    $response = ResponseFactory::parseResponseOrThrow($binaryData);
    echo 'Parsed packet (in hex):     ' . $response->toHex() . PHP_EOL;
    echo 'Data parsed from packet (bytes):' . PHP_EOL;
    print_r($response->getData());
    
} catch (Exception $exception) {
    echo 'An exception occurred' . PHP_EOL;
    echo $exception->getMessage() . PHP_EOL;
    echo $exception->getTraceAsString() . PHP_EOL;
} finally {
    $connection->close();
}

Starting server:

x@x:~/code$ ./diagslave -m tcp -p 5020
diagslave 3.4 - FieldTalk(tm) Modbus(R) Diagnostic Slave Simulator
Copyright (c) 2002-2021 proconX Pty Ltd
Visit https://www.modbusdriver.com for Modbus libraries and tools.

Protocol configuration: MODBUS/TCP
Slave configuration: address = -1, master activity t/o = 3.00s
IP configuration: port = 5020, connection t/o = 60.00s

Server started up successfully.
Listening to network (Ctrl-C to stop)
...
validateMasterIpAddr: accepting connection from 127.0.0.1
Slave   1: readInputRegisters from 7, 1 references
...^C

Executing php script

x@x:~/code/modbus-tcp-client/examples$ php fc4.php 
Packet to be sent (in hex): 721700000006010400060001
2021-08-03 04:49:20.012481: [debug] msg: "Connected"
2021-08-03 04:49:20.021272: [debug] msg: "Data sent", data: array (
  1 => '721700000006010400060001',
)
2021-08-03 04:49:20.021319: [debug] msg: "Polling data"
2021-08-03 04:49:20.021348: [debug] msg: "Stream 34 @ index: 0 received data: ", data: array (
  1 => '7217000000050104020000',
)
Binary received (in hex):   7217000000050104020000
Parsed packet (in hex):     7217000000050104020000
Data parsed from packet (bytes):
Array
(
    [0] => 0
    [1] => 0
)

TCPDUMP:

x@x:~/code/$ sudo tcpdump -i lo -X port 5020
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
...
...
...
// request packet bytes "7217 0000 0006 0104 0006 0001"
07:49:20.021238 IP localhost.51748 > localhost.5020: Flags [P.], seq 1:13, ack 1, win 128, options [nop,nop,TS val 4166535074 ecr 4166535065], length 12
        0x0000:  4500 0040 261e 4000 4006 1698 7f00 0001  E..@&.@.@.......
        0x0010:  7f00 0001 ca24 139c acc0 d870 e55e 93ea  .....$.....p.^..
        0x0020:  8018 0080 fe34 0000 0101 080a f858 47a2  .....4.......XG.
        0x0030:  f858 4799 7217 0000 0006 0104 0006 0001  .XG.r...........
...
// response packet bytes "7217 0000 0005 0104 0200 00"
07:49:20.021279 IP localhost.5020 > localhost.51748: Flags [P.], seq 1:12, ack 13, win 128, options [nop,nop,TS val 4166535074 ecr 4166535074], length 11
        0x0000:  4500 003f fa93 4000 4006 4223 7f00 0001  E..?..@.@.B#....
        0x0010:  7f00 0001 139c ca24 e55e 93ea acc0 d87c  .......$.^.....|
        0x0020:  8018 0080 fe33 0000 0101 080a f858 47a2  .....3.......XG.
        0x0030:  f858 47a2 7217 0000 0005 0104 0200 00    .XG.r..........

Resulting packets from both tests are:

tool	request	response
library	`7217 0000 0006 0104 0006 0001`	`7217 0000 0005 0104 0200 00`
modpoll	`0001 0000 0006 0104 0005 0001`	`0001 0000 0005 0104 0200 00`

as you see start address bytes are different 06 vs 05. This is because in modpoll we used default addressing that assumes that addresses start from To switch todata/PDU addressing` you would use

-0            First reference is 0 (PDU addressing) instead 1

About addressing PDU vs model address

Starting address and offset is device/manufactures specific - how they choose to address data. In Modbus packet addresses are 0-based - so first address is 0 (term data address). In documentation they are sometimes/often referred as 1-based. Often in form of 40001 where first number represents function type because some modbus devices can have different memory for different functions - so FC3 can not read FC1 data.

If you want to read more see modbus spec page 7 - "4.4 MODBUS Addressing model"
https://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf

AlanCluet · 2021-08-10T09:10:17Z

AlanCluet
Aug 10, 2021
Author

Im starting over, with the example fc4 script, only edited the ip address i get this error:

Packet to be sent (in hex): 8a5d00000006000400090001
An exception occurred Unable to create client socket to tcp://IP:5020: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond #0

F:\www\modbus\vendor\aldas\modbus-tcp-client\src\Network\BinaryStreamConnectionBuilder.php(31): ModbusTcpClient\Network\InternetDomainStreamCreator->createStream() #1
F:\www\modbus\vendor\aldas\modbus-tcp-client\src\Network\BinaryStreamConnection.php(38): ModbusTcpClient\Network\BinaryStreamConnectionBuilder->ModbusTcpClient\Network{closure}() #2 F:\www\modbus\vendor\aldas\modbus-tcp-client\examples\fc4_ori.php(21): ModbusTcpClient\Network\BinaryStreamConnection->connect() #3 {main}

5 replies

aldas Aug 10, 2021
Maintainer

are you sure that port 5020 is correct for your env? This error means that php could not create connection to ip+port and ip and/or port is wrong or there is something that is blocking the connection ala firewall on that host (IP)

AlanCluet Aug 10, 2021
Author

my bad, the port is wrong, ill check again.

AlanCluet Aug 10, 2021
Author

Packet to be sent (in hex): 1eaf00000006000400090001 Binary received (in hex): 1eaf0000000300840b

An exception occurred Gateway targeted device failed to respond #0 F:\www\modbus\vendor\aldas\modbus-tcp-client\examples\fc4_ori.php(28): ModbusTcpClient\Packet\ResponseFactory::parseResponseOrThrow() #1 {main}

aldas Aug 10, 2021
Maintainer

in your problematic packets you have 1 as device id but this last request seems to have 0. Did you change it to $unitID = 0;?

                  $unitID = 0;
                  v
1e af 00 00 00 06 00 04 00 09 00 01
                           ^
                           $startAddress = 9;

AlanCluet Aug 19, 2021
Author

Hi again, been busy this days.

On the version i use i have this:

$connection = BinaryStreamConnection::getBuilder()
->setPort(502)
->setHost($ip)
->setConnectTimeoutSec(2) // timeout when establishing connection to the server
->setWriteTimeoutSec(1) // timeout when writing/sending packet to the server
->setReadTimeoutSec(2) // timeout when waiting response from server
->build();

$endianess = Endian::BIG_ENDIAN;
Endian::$defaultEndian = $endianess;

$startAddress = 0;
$quantity = 10;
$unitID = 1;
$packet = new ReadInputRegistersRequest($startAddress, $quantity, $unitID);

and i print this as result:

Packet to be sent (in hex): f7150000000601040000000a
Array ( [0] => 0 [1] => 35 )
Array ( [0] => 4 [1] => 176 )
Array ( [0] => 0 [1] => 80 )
Array ( [0] => 0 [1] => 0 )
Array ( [0] => 0 [1] => 0 )
Array ( [0] => 0 [1] => 0 )
Array ( [0] => 0 [1] => 242 )
Array ( [0] => 0 [1] => 0 )
Array ( [0] => 1 [1] => 194 )

And i try with other windows clients like EasyModbus or Modscan64, and i get this:

Some values match some dont.

aldas · 2021-08-19T18:39:04Z

aldas
Aug 19, 2021
Maintainer

Your response is printed as byte pairs (not register values)

Array ( [0] => 0 [1] => 35 )
Array ( [0] => 4 [1] => 176 )
Array ( [0] => 0 [1] => 80 )
Array ( [0] => 0 [1] => 0 )
Array ( [0] => 0 [1] => 0 )
Array ( [0] => 0 [1] => 0 )
Array ( [0] => 0 [1] => 242 )
Array ( [0] => 0 [1] => 0 )
Array ( [0] => 1 [1] => 194 )

Register is 16 bit of memory. 16bit is 2 bytes. So if we would combine bytes from that output we would get this

#	high byte	low byte	register (16bit)
1	0 / 0x0	35 / 0x23	35 (0x0023)
2	4 / 0x4	176 / B0	1200 (0x04B0)
3	0 / 0x0	80 / 0x50	80 (0x0050)
4	0 / 0x0	0 / 0x0	0 (0x0000)
5	0 / 0x0	0 / 0x0	0 (0x0000)
6	0 / 0x0	0 / 0x0	0 (0x0000)
7	0 / 0x0	242 / 0xF2	242 (0x00F2)
8	0 / 0x0	0 / 0x0	0 (0x0000)
9	1 / 0x1	194 / 0xC2	450 (0x01C2)

This line prints raw bytes.

print_r($response->getData());

To print register values as (int16?) you would need to use:

    foreach ($response->asWords() as $word) {
        print_r($word->getInt16());
    }
   // or
    foreach ($response as $word) {
        print_r($word->getInt16());
    }

I strongly recommend checking and trying this example https://github.com/aldas/modbus-tcp-client/blob/master/examples/index.php this showcases how raw bytes from response can be used/converted to almost any type

1 reply

aldas Aug 19, 2021
Maintainer

@AlanCluet I think you have missed one crucial thing - modbus deals with raw byte pairs (register) how you interpret those bytes. Which order (endian) or which type (signed or unsigned integer, or float/real etc) is not part of modbus and is up to you.

AlanCluet · 2021-08-20T07:15:37Z

AlanCluet
Aug 20, 2021
Author

Well, that fixed it, so many thanks. now i get almost everithing, just left one probe that give me this error:

An exception occurred Illegal data address #0 F:\www\modbus\vendor\aldas\modbus-tcp-client\examples\fc4.php(39): ModbusTcpClient\Packet\ResponseFactory::parseResponseOrThrow() #1 {main}

3 replies

AlanCluet Aug 20, 2021
Author

On the probe i dont get a result i get this

An exception occurred
Illegal data address
#0 F:\www\modbus\check_test.php(129): ModbusTcpClient\Packet\ResponseFactory::parseResponseOrThrow() #1 F:\www\modbus\check_test.php(200): get_modbus_fc4() #2 {main}

And in the others that now i get the result i also get this:

An exception occurred
offset out of bounds
#0 F:\www\modbus\check_test.php(156): ModbusTcpClient\Packet\ModbusFunction\ReadHoldingRegistersResponse->offsetGet() #1 F:\www\modbus\check_test.php(203): get_modbus_fc4() #2 {main}

aldas Aug 20, 2021
Maintainer

Illegal data address

This is error returned from modbus server. Modbus specification defines it on page 48 (https://modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf) as

code	name	meaning
02	ILLEGAL DATA ADDRESS	The data address received in the query is not an allowable address for the server. More specifically, the combination of reference number and transfer length is invalid. For a controller with 100 registers, the PDU addresses the first register as 0, and the last one as 99. If a request is submitted with a starting register address of 96 and a quantity of registers of 4, then this request will successfully operate (address-wise at least) on registers 96, 97, 98, 99. If a request is submitted with a starting register address of 96 and a quantity of registers of 5, then this request will fail with Exception Code 0x02 “Illegal Data Address” since it attempts to operate on registers 96, 97, 98, 99 and 100, and there is no register with address 100.

offset out of bounds

Means that you are trying to access data out of bounds your response has. For example if you request for 1 register and try to interpret it as int32 value getInt32() you would get error as 1 register has 2 bytes but 32bit integer is 4 bytes. Also same exception can occur if you get data out of range ala with $response->getWordAt($address) but have not used ->withStartAddress($startAddress) or $address is way off accessible range.

basically it depends and I can not tell without seeing the code.

AlanCluet Aug 23, 2021
Author

Thanks for your help

AlanCluet · 2021-08-23T11:43:48Z

AlanCluet
Aug 23, 2021
Author

last detail:

Packet to be sent (in hex): 565200000006090400000008
Parsed packet (in hex): 5652000000130904100000b5940000000000002afb00000000
Data parsed from packet (bytes):
DataArray ( [0] => 0 [1] => 0 [2] => 181 [3] => 148 [4] => 0 [5] => 0 [6] => 0 [7] => 0 [8] => 0 [9] => 0 [10] => 42 [11] => 251 [12] => 0 [13] => 0 [14] => 0 [15] => 0 )

0
-19052
0
0
0
11003
0
0

In the hex chain, i get b594 that is 46484 why in getInt16() translate it to -19052?

2 replies

aldas Aug 23, 2021
Maintainer

0xb594 is 46484 when you convert it to unsigned int16 with method: getUInt16().
0xb594 is -19052 when you convert it to signed int16 with method: getInt16().

Maybe this helps https://study.com/academy/lesson/unsigned-data-types.html
For example here https://en.wikipedia.org/wiki/C_data_types is table with value ranges for different data types with their signed/unsigned variants.

I recommend you to try to request that same data using this example https://github.com/aldas/modbus-tcp-client/blob/master/examples/index.php

it will show you how bytes can be interpreted as different values when using different data types.

AlanCluet Aug 25, 2021
Author

Many thanks for all !

Wrong return in fc4 #96

AlanCluet Jul 15, 2021

Replies: 7 comments · 25 replies

aldas Jul 15, 2021 Maintainer

AlanCluet Jul 16, 2021 Author

aldas Jul 16, 2021 Maintainer

aldas Jul 22, 2021 Maintainer

aldas Jul 22, 2021 Maintainer

AlanCluet Jul 26, 2021 Author

aldas Jul 26, 2021 Maintainer

AlanCluet Jul 26, 2021 Author

aldas Jul 26, 2021 Maintainer

aldas Jul 27, 2021 Maintainer

aldas Jul 27, 2021 Maintainer

AlanCluet Aug 2, 2021 Author

aldas Aug 2, 2021 Maintainer

aldas Aug 3, 2021 Maintainer

AlanCluet Aug 10, 2021 Author

aldas Aug 10, 2021 Maintainer

AlanCluet Aug 10, 2021 Author

AlanCluet Aug 10, 2021 Author

aldas Aug 10, 2021 Maintainer

AlanCluet Aug 19, 2021 Author

aldas Aug 19, 2021 Maintainer

aldas Aug 19, 2021 Maintainer

AlanCluet Aug 20, 2021 Author

AlanCluet Aug 20, 2021 Author

aldas Aug 20, 2021 Maintainer

AlanCluet Aug 23, 2021 Author

AlanCluet Aug 23, 2021 Author

aldas Aug 23, 2021 Maintainer

AlanCluet Aug 25, 2021 Author

AlanCluet
Jul 15, 2021

Replies: 7 comments 25 replies

aldas
Jul 15, 2021
Maintainer

AlanCluet Jul 16, 2021
Author

aldas
Jul 16, 2021
Maintainer

aldas Jul 22, 2021
Maintainer

aldas Jul 22, 2021
Maintainer

AlanCluet Jul 26, 2021
Author

aldas Jul 26, 2021
Maintainer

AlanCluet Jul 26, 2021
Author

aldas
Jul 26, 2021
Maintainer

aldas Jul 27, 2021
Maintainer

aldas Jul 27, 2021
Maintainer

AlanCluet Aug 2, 2021
Author

aldas Aug 2, 2021
Maintainer

aldas Aug 3, 2021
Maintainer

AlanCluet
Aug 10, 2021
Author

aldas Aug 10, 2021
Maintainer

AlanCluet Aug 10, 2021
Author

AlanCluet Aug 10, 2021
Author

aldas Aug 10, 2021
Maintainer

AlanCluet Aug 19, 2021
Author

aldas
Aug 19, 2021
Maintainer

aldas Aug 19, 2021
Maintainer

AlanCluet
Aug 20, 2021
Author

AlanCluet Aug 20, 2021
Author

aldas Aug 20, 2021
Maintainer

AlanCluet Aug 23, 2021
Author

AlanCluet
Aug 23, 2021
Author

aldas Aug 23, 2021
Maintainer

AlanCluet Aug 25, 2021
Author