Fernando Castro

I did my own version of software to download files from n number of PLCS in the network over ethernet using the documentation @Saragani gave... there is a nice set of tools for developers but documentation is not as good and easy to understand as I would wanted. @lorenso unlucky for you I no longer have acces to that program... and I don't have hardware to even try to re do something.

Don't waste your time asking for a decent Modbus TCP implementation. Vision series are cheap PLCs with incredible versatility. I already tried every possible workaround regarding Modbus TCP communication. And you are right, other controllers do that kind of stuff better. Modbus TCP in the unitronics vision series is Intended to communicate 1 device to 1 PLC at a time per socket. There are workarounds but you need either use UDP. Or somehow manage some type of disconnect/reconnect sequence which at the very best will be finicky. It is what it is. On my previous job I inherited abig ammount of systems built on unitronics platform and Invested a lot of time figuring out how to upgrade the systems whitout replacing the PLCs.

🙄 On Industrial automation world, the first resource should be ask to the Original Equipment Manufacuter. 99% of the time you won't have access to the source code. Unless specified by the customer, no vendor provides a project file you can edit. And, assuming you have access to it, pretty much every single controls brand has proper documentation in the help file. I am truly surprised how often this happens.

Only possible if the original programmer enabled that option.

Aun que no estoy en Guadalajara ( Viví ahi un tiempo) podria asistir de manera remota si alguna vez tienes la necesidad. Tengo bastante experiencia con la serie vision, y se un par de cosas de desarollo web. Saludos!

I see that I am joining late. but I think you could bypass the name with the PCOM protocol. Since I no longer work with Unitronics I don't have access to the old software that I developed with PCOM dll but I am 99% sure it can be bypassed Edit: yes, you don't even need to know the name, and in fact you can retrieve the PLC name using this method. Once you get the PLC name then you can do a new blank download.

Using PCOM protocol you only need the IP, and it is easy to get once you are in the network

https://www.npr.org/2023/12/02/1216735250/iran-linked-cyberattacks-israeli-equipment-water-plants I just saw this post and it caught my attention... to be honest, targeting unitronics vision series It could be way too easy. If i recall correctly, once you are in the same network, unitronics communication drive dll doesn't even need the PLC name to connect to the PLC. And the default port 20256 and 20257 are very well known... assuming the dll allows retrive the PLC name, its easy to download a new blank program to the PLC. The IP is easier tho get if you are already in the network, Is as simple as using an ARP cmd command to scann all the devices and test for 20257, 20256 or 502 ports open... or I am sure that you can tell just just by the MAC addres. My suggestion is to add a firewall rule for external incoming connections through those ports if you network is exposed to the internet. Anyway stay safe.

Also always test your modbus communication with something like modbuss poll or modbus master simulator radzio it is free an you just install it on the computer, the modbus configuration is intuitive, and you will be able to test if the issue is on modbus py or on the PLC side.

First of all this rung is awful. No offense to you but visilogic is not a FBD programming, is ladder logic with some function blocks, Visilogic is kind of old and I wouldn't try to push everything on a single rung Which memory addres are you trying to read from the PLC? To make sure you are doing the correct math for the client modbus addresing.

I had one or two corrupted SD cards per month among my 180 PLCs. SanDisk 16 Gb from Amazon, and I don't even wrote to often, It was used more like a read only memory for managing recipes. Also the 64 file limit is kind of mysterious, you can store more than 64 but won't be written into the SD card, if you have 64, then record another 10 files, the most 10 recent files will appear on the SD card only if you delete other 10 or more files in the SD Card, where are those other files stores, who nows 🤷‍♂️, what is the actual limit in that phantom storage its also a mystery.

@Ivgeny is this possible with vision series or not?

Define how fast is fast. And I was actually looking for the exact same solution. Best option so far is to use UDP, if your sensors allows it.

It's a straightforward application: Use a Unitronics Vision PLC as Modbus TCP/IP Master, communicating with many slave devices at the same time (let's say minimum 2 maximum 4) with low latency, using only one single socket (All other sockets are being used for different applications). One of the Modbus slaves was supposed to control a process variable linked to the output of a PID loop in the PLC. BTW, at this point for me, it's only out of my curiosity, the company I worked for has filed for bankruptcy and I was laid off, so I cannot test anything, well... I guess I could (assuming I have some remote connection to the facility still enabled and all my test equipment is still on 😏) but of course that will be illegal. 😅

I believe that that is to add the slaves to the protocol, and it means that you can't select a device which IP has not been added to the configuration FB first? I can communicate without problems, but using the same socket for many devices requires closing the connection and connecting to the other IP before sending/receiving.

I also read that, and I also got confused about it.... however, I just tried and couldn't make it work. It's even more confusing because it seems that for Modbus TCP/IP a socket connection must be stablished first ..maybe the broadcasting function works on UDP only? but again... maybe I am doing something wrong, It is a shame that there is no example using Unitronics as a master to multiple slaves.

Seems that It Isn't. changing SB147 to 0 stops the communication but I need to re initialize the socket then to connect to Modbus TCP slaves again.

I did some tests, and yeah, It's the same on V570 as V700. The Issue is not the Socket being Open, is that you need to connect the socket to a specific IP first to use Modbus OverTCP/IP. If you connect to a Device 1, then use Modbus IP function for Device 1, then you try to use another Modbus Function to Device 2 (Using the stored IP for Device 2 on the MI and selecting the correct device) then the PLC still sends the Modbus requests to Device 1. I know that because I get a response status of 7. * Messages 6, 7, and 11mean that the master has found incompatible elements in the data sent between master and slave. which makes sense because those requests don't make sense for Device 1. And based on my tests, to use connect function you should be disconnected first. already tried using connect without disconnecting first.

That is how I tried the very first time on the V700, and never made it work maybe I was missing something. ... I ended ussing another socket and later one I came out with the Connection/Disconnection method but the connection part is not as fast as one could Imagine, some times it gets out of sync (I have a sequence to detect enabled devices and poll one by one and if one fails to respond on a given time it restarts the entire connection), sure I can reconnect again but 2 to 3 secconds whitout a new value Is not going to make it for a PID Loop.

In this case No. All the PLCs as slaves to a Modbus Master works great (also V700 doesnt has CAN card ) and Ethernet Is easier because the physically network already exists. And for the PLC as Modbus Master the Modbus slaves are third party devices that only support ModbusTCP (Also I am already using serial port for other device)

following up on this... unfortunately for me, it seems that the 2 devices that I use as slaves doesn't support UDP. So, I am stuck with my "Connection/Disconnection" routine.... I have a new challenge that I don't know how to solve. I need to implement a PID Loop which its Output will be linked to one of those MODBUS Slaves. the reconnection time of course will be a problem. I have 570 and V700 and I am trying so hard to maintain the same software for both so Stuck with 4 sockets (1 for data collection as Modbus Slave, 1 for remote operator, 1 software Download/Online view/SD file transfers and 1 for Modbus Master) I can't believe that the way Modbus master was implemented only allows you to talk to 1 slave in my opinion that defeats the purpose of an Industrial Network. Any other tricks under the Sleeve?

whatever SCADA software you want.... the more appropriated question is what SCADA software your client can afford? If your client only needs visualization, it may not need to be necessarily a SCADA software. I implemented a visualization system using this stack: Grafana, Influx DB, Telegraf to monitor an entire facility. Everything open sourced.

I just started playing around PID with Unitronics and also, I cannot test the program on the actual process yet. Having said that to test the logic what I did was a custom sub routine that will simulate an input based on the output, of course this will never maintain a setpoint but at least I can see the PID in action trying to maintain the given set point and test the logic for enabling/disabling the PID and starting the autotune. The program is as follows. I linearized a the PID output to a series of increments from -50 to 200 then each second, I add the increment value to the input and just with that you can see some oscillations.

It wasn't me but yeah ID matters for some vendors, although over TCP/IP slave addressing is based on IP and it should be irrelevant.

I think you are correct. Also i found another manual online that says ML statrs on 5100, you could try 5112 and see if that works