Modbus TCP illegal packet (CRC) time-out problem in gateway

Question

I am connecting a Modbus gateway to an RTU acquisition system. I am using a MOXA Gateway MB3480 with a RS485 (2 wires) connector. The thing is that I can't read the data all the time; I receive a time-out error.

My settings:

• Port in RTU slave mode, baudrate 9600, parity none. I have tried it with and without a resistor in the bus.

What I have tried:

• Request data with QModMaster, most of the times the result is: time-out error.
• Request data with Python. Same result. Code:

from pymodbus.pdu import ModbusRequest
from pyModbusTCP.client import ModbusClient
import time

c = ModbusClient(host="192.168.88.4", port=502, unit_id=2, auto_open=True, auto_close=True)

while True:
    try: 
        regs = c.read_holding_registers(6, 1)
        b = regs[0]/1000.0
        a = round((b-4)/0.16,2)
        print(a)
    except:
        print("Read error")
    time.sleep(3)

• I have tried an USB adapter and with a Raspberry Pi running Modbus RTU, it works; I can read the data. After changing the wires to the Moxa's gate, it only works sometimes. I have got the GND signal connected too.

• I have tried sniffing the traffic with Traffic Monitor from Mgate Manager. I can see illegal packet (CRC) in the comments.

• I have tried updating the firmware.

Where can the problem come from?

Answer 1

From your table:

It looks as we'd expect for a gateway: it receives a modbus request on its MB/TCP side, and relays it out on its MB/RTU side.

The message 02 03 00 06 00 01 is slave=2, func=read_holding_registers, start=6, quantity=1. 64 38 is the correct CRC.

However the reply has the problem. The message 02 03 02 10 1c itself looks sensible: client=2 (as expected), func=read-holding-registers-without-error (as expected), bytecount=2 (as expected), bytes=10 1c (are these good?). The CRC is received as 64 7c but it should be f0 4d according to calculation (see later for detail).

As the CRC is incorrect, the receiver (the gateway) discards it. The transmitter considers this transaction complete, and doesn't resend. In due course the receiver (gateway) or client PC times out and generates the error.

Questions

1. Do you have any RTU messages at all which the gateway accepted without bad CRC? (You say it works "sometimes": can we see the monitor table of a message which had no CRC error?)
2. Is 0x10, 0x1c a reasonable response from the far unit for holding reg 6?
3. I am suspecting the serial line. Do you have any way to look at the signal on the serial line with either an oscilloscope or another serial receiver?
4. Is it possible you have multiple devices with address 2? They'll reply at the same time, correctly triggering a CRC error in the receiving device (gateway). (EDIT: From comments, this proved to be the source of the problem: a second device on the bus.)
5. You say "USB adapter/Raspberry Pi/Modbus RTU: works": can you get the raw bytes and add them to the question? Ideally the same read-holding-registers(6, 1); ideally with the same reply(0x10, 0x1c).

---

CRC checking on the serial messages:

02 03 00 06 00 01   calc 64 38
02 03 02 10 1c   calc f0 4d

# python3 from modbus algorithm flow chart p40
# https://www.modbus.org/docs/Modbus_over_serial_line_V1_02.pdf

def modbuscrc(msg):
    crc = 0xffff
    for b in msg:
        print("%02x " % b, end="")
        crc ^= b
        for i in range(0, 8):
            carry = crc & 0x01
            crc = (crc >> 1) & 0x7fff
            if carry:
                crc ^= 0xa001
    print("  calc %02x %02x" % (crc & 0xff, crc >> 8))
    return crc

modbuscrc([0x02, 0x03, 0x00, 0x06, 0x00, 0x01])
modbuscrc([0x02, 0x03, 0x02, 0x10, 0x1c])