Gas skid, flow computer with a Modbus TCP port, S7-1200 CPU 1214C with MB_CLIENT, TIA V16. Reading the twelve analog inputs at 30001 to 30012 works, all twelve values arrive and match the transmitters, I proved the loops first.
The totals and the corrected flow the manual lists at 7001 to 7016 won't come. MB_CLIENT with MB_DATA_ADDR 47001 gives STATUS 16#8383 and the flow computer's own comm log says exception 02 illegal data address.
I tried 47000 and 47002 in case it's an off by one, and read lengths of 2, 4 and 16, same thing every time. Is the register area above 7000 locked on the device somehow? The vendor's slow to answer and I'm stuck on it. Should I maybe be reading those register tables in the manual differently, given the 30001 block comes in fine and the 7000 one won't?
Off by one is my first guess always, 47001 in the block being register 7000 on the wire. You've tried both sides, fine. Post the manual page for those totals, the table heading matters more than the numbers.
The page heading says "Input Registers (3xxxx) read only" and then 7001, 7003, 7005 as float pairs. Photo of the page attached. The setpoints are in a separate table headed "Holding Registers (4xxxx)".
> "Input Registers (3xxxx) read only"
That heading is your answer. The totals are input registers, function code 4. You're asking with 47001, which MB_CLIENT turns into function code 3, holding registers, and the flow computer has no holding register 7001, so you get exception 02 and the 16#8383 with it. The 30001 block works for the same reason, right table.
Put MB_DATA_ADDR at 37001 and the block sends FC4. Same trap on the Logix side with the Modbus AOI, except there you pick the function code and the offset separately, which makes it more obvious. Word order for the floats is the next thing, the manual should say word swap or not. There's a writeup on the four tables here: https://plctr.com/understanding-the-communication-protocols-for-plc-and-scada-systems/
Changed it to 37001 and the 16#8383 went away, STATUS 0 and data came in on V16 first try. Floats are garbage though, numbers like 1.2e-40, and the totalizer reads nonsense.
Word swap. Swap the two words before the DWORD to REAL move. Every flow computer I've met does it the other way round to the PLC.
Rotated each DWORD by 16 bits before the REAL conversion and the totals match the flow computer's own display to the third decimal.
So the totals are input registers, function code 4, and I was asking with holding register addresses, function code 3, which is what the 16#8383 was telling me. 37001 in MB_DATA_ADDR fixed it, plus the word swap. The device was never locked, that was me.
Still not sure why the vendor puts setpoints and totals in two tables at overlapping numbers. Thanks jcasey, marcob.
Two tables at the same numbers, every flow computer does it, never heard why.