Resolving GE 90-30 %M Bit Access over Ignition Modbus TCP

Where does a request for %M00001 stop?

Follow the packet. Ignition's Modbus TCP driver builds a request from the OPC item path prefix. That prefix selects a Modbus function code. The request travels over Ethernet to the Modbus TCP server in the IC693CPU374. The CPU then resolves the function code against a fixed set of PLC reference tables. The request for %M dies at that last hop. No Modbus function code points at %M, so no item path prefix in Ignition can reach it.

The 90-30 Modbus server exposes these tables and no others:

To get %M, %G, or %S data into Ignition, copy it into %R or %Q with ladder MOVE instructions. The CPU has no configuration setting that remaps these tables into Modbus space. It also has no alternate Modbus address for them. The existing Quick Panel reached %M because it talked to the CPU in GE's native Ethernet protocol, which addresses every reference table directly. Moving the HMI to Modbus TCP drops that access.

Check 1: Is the TCP path healthy?

Layer one first, even when the symptom looks like addressing. Take this reading: the quality of tags that already work on the same device connection.

In this installation, the %I, %Q, and %R tags all read correctly. That rules out the network and points the fault at the reference table.

Check 2: Does the prefix-to-reference offset line up?

Compare the item path number with the PLC reference number on a known-good tag.

Here the item path numbers equal the reference numbers directly, and the REAL at %R00082 decodes correctly. Offsets and word order are already correct. Any %M data you move into %R or %Q will land at the address you expect.

Check 3: Is the target in a Modbus-visible table?

Take this reading: the reference type of each tag that fails.

• %I, %Q, %R, %AQ, %AI: The address is reachable. Check the reference against the CPU's configured table size, because an address past the end returns an exception.
• %M, %G, %S: The address is not reachable over Modbus at any offset. The server answers with an exception (typically Illegal Data Address) or the tag goes Bad. Go to the mapping procedure.

Before mapping, decide which way each bit flows. Status bits flow from the PLC to the HMI and only need a PLC-side copy into the Modbus table. Command bits, such as HMI pushbuttons, flow from the HMI to the PLC. For those, Ignition writes to %R or %Q and ladder copies the value back into %M. Keep status and command bits in separate register blocks. If one register is both written by Ignition and overwritten every scan by a MOVE, the HMI write is lost on the next scan.

How do you map %M into %R or %Q?

Pick the destination first. %R is usually the safer target. %Q references in the configured I/O range drive physical outputs, so a %M copy into those references would energize real field devices. If you use %Q, restrict the copies to %Q references with no module assigned.

1. Inventory every %M, %G, and %S reference the Quick Panel application uses. Mark each as status (PLC to HMI) or command (HMI to PLC).
2. Check alignment. When the %M bits sit in contiguous, byte-aligned blocks, move them as words. A single MOVE INT/WORD then carries 16 bits into one %R register.
3. Reserve an unused %R block for status words and a separate unused %R block for command words. Cross-reference the program to confirm nothing else writes there.
4. For status, add MOVE WORD instructions from each aligned %M block into the status %R block, executed unconditionally every scan.
5. For scattered, non-aligned bits, use bit-level moves (MOVE BIT or a contact/coil pair) into individual %Q references or into bit positions of a %R word.
6. For commands, add MOVE WORD or bit moves from the command %R block back into the target %M references. Pulse-type commands need a reset strategy. Either Ignition writes 0 after the press, or the PLC clears the command word after it acts.
7. In Ignition, create one HR tag per packed %R word. Break out the individual bits with expression tags, or use bit-within-register addressing if your driver version supports it. Map each bit to the original Quick Panel tag name.
8. Download the logic and put the CPU in RUN.

In a packed word, the lowest-numbered %M reference lands in bit 0 of the %R register. For example, a word move starting at %M00001 places %M00001 in bit 0 and %M00016 in bit 15. Build the Ignition bit breakout on that order, and confirm it with the verification steps below before commissioning screens.

How do you verify the mapped bits end to end?

Verify against the source reference in the PLC, not against the HMI alone. Values reach Ignition one PLC scan plus one poll interval after they change.

1. Online with the PLC, force or toggle one known %M status bit, for example %M00001. Confirm the destination %R word changes by exactly the value of the expected bit (1 for bit 0).
2. In Ignition, watch the HR tag for that word. The raw integer must match the %R value shown in the PLC reference table view.
3. Toggle a high-order bit, such as the 16th bit of the block. Confirm the Ignition breakout tag for bit 15 follows it. This catches off-by-one and bit-order errors in the expression tags.
4. For each command bit, write 1 from an Ignition tag. Confirm the command %R word changes, then confirm the target %M reference changes on the next scan.
5. Watch the command bit for several seconds after the write. If it snaps back to 0 without a reset action, another MOVE or coil is writing the same register. Find it with a cross-reference and relocate the block.
6. Finally, compare every migrated screen object side by side with the running Quick Panel, and confirm matching states on at least one status bit and one command bit per screen.

FAQ