S7-300 ADFweb HD67602 Profinet to Modbus Zero Data

Problem Statement

A SIMATIC S7-300 PLC is connected through an ADFweb HD67602 Profinet-to-Modbus RTU gateway to an OMRON E5GC-RX1A6M digital temperature controller. The GSD file is installed, the device name is assigned, the gateway appears in TIA Portal online diagnostics with no Profinet error, the Compositor configuration downloads without warnings, and the gateway LEDs report link-active on both sides — yet the S7-300 watch table shows a constant zero for the temperature input words.

No diagnostic interruption is raised. The Profinet IO device (HD67602) shows green module status, the maintenance LED is off, and the Modbus side reports no framing or timeout errors. This is the classic signature of a silent mapping failure on a protocol gateway: the IO is exchanging cyclic frames, but the data being polled does not correspond to registers that exist (or are readable) on the Modbus slave.

The guide below walks through the full field-proven diagnostic procedure for this exact scenario. It is based on a recurring fault class reported across Profinet/Modbus gateway installations and is valid for the entire HD67602 family of ADFweb Profinet-Slave / Modbus-Master converters.

System Architecture

The physical topology is intentionally simple, but the protocol conversion introduces three independent configuration domains — each of which must be correct simultaneously for the watch table to reflect real data.

Three independent configuration planes must align:

1. Profinet plane — device name, IP, slot mapping in TIA Portal.
2. Gateway plane — Modbus master settings, RS-485 parameters, polling table in ADFweb Compositor.
3. Modbus plane — slave address, baud rate, parity, register map on the OMRON E5GC.

If any of the three is wrong, the gateway continues to run but the data returned to the PLC is meaningless (most commonly zero).

Root Cause Analysis

From field experience, a "no-error, all-zeros" symptom on a Profinet/Modbus gateway falls into one of the following root causes, ranked by frequency:

Prerequisites

Before starting diagnostics, gather the following:

• ADFweb HD67602 user manual — MN67602_ENG.pdf
• ADFweb Compositor HD67602 configuration software (download from the ADFweb product page for the HD67602)
• GSDML file for the HD67602, installed in TIA Portal
• OMRON E5GC Communications Manual — E5GC Datasheet and E5GC Modbus Communication Manual (H180 in OMRON literature)
• A laptop with TIA Portal (V15.1 or later recommended) and a free USB / Ethernet port
• A Modbus RTU master tester (e.g., QModMaster, Modbus Poll) with an RS-485 USB adapter for slave-side verification
• Multimeter and ideally a two-channel oscilloscope or RS-485 line analyzer

Step-by-Step Diagnostic Procedure

Step 1 — Verify Physical Layer and LEDs

Inspect every active LED on all three devices. Some LEDs are designed to be lit during normal operation, some only on fault. Never answer "all LEDs are off" without checking the datasheet.

If the HD67602 RX/TX Modbus LED never blinks, the gateway is not issuing any Modbus request. The fault is inside the gateway configuration (or the Profinet AR has not been established). If the LED blinks but the E5GC COMM LED never reacts, the physical Modbus wiring is the prime suspect.

Step 2 — Inspect RS-485 Wiring

The HD67602 exposes RS-485 on a 3-pin connector (or detachable terminal) labeled A, B, and SGND. The OMRON E5GC with the Modbus option exposes the same three signals on its communications terminals (typically A+, B−, and SG / FG).

Mandatory wiring rules:

• Connect A (gateway) to A+ (E5GC) and B to B−. Swapping A/B silently breaks every frame.
• Use a twisted pair, shield grounded at one end only (typically the gateway SGND).
• Install a 120 Ω termination resistor at each physical end of the bus — including the E5GC if it is the last device. The HD67602 has an internal, software-selectable termination (usually enabled via a jumper or in Compositor).
• Total bus length: < 1200 m at ≤ 19200 bps. For 115200 bps, restrict to < 100 m to avoid rise-time issues.
• Do not tie SGND to chassis ground at both ends — this creates a ground loop and bias drift.

Step 3 — Verify Modbus Slave Configuration on the E5GC

The E5GC is configured from its front keypad. Navigate the parameter levels and confirm:

Step 4 — Validate the Modbus Link with an External Master

Disconnect the HD67602 from the RS-485 bus, connect a USB-RS485 adapter to a laptop running QModMaster or Modbus Poll, and attempt a read of the E5GC process value:

// QModMaster example — read E5GC process value
Slave ID:           1
Function:           03 (Read Holding Registers)
Start Address:      0x0000  (decimal 0)
Quantity:           1
Response expected:  0x0064 = 100 °C   (or current PV * 10 in 0.1 °C units)

If this read returns valid data, the Modbus slave is healthy. If it returns Illegal Function (0x01) or Illegal Data Address (0x02), the register map in the E5GC manual for your firmware revision differs from the gateway's poll table. The fix is to update either the E5GC's bank assignment or the gateway's Modbus Mapping in Compositor.

Step 5 — Inspect the ADFweb Compositor Configuration

Open the project file downloaded to the HD67602 and review the following sections in order:

5.1 Profinet Settings

• Device Name: must match the Profinet name assigned in TIA Portal exactly (case-sensitive).
• IP Address: must be in the same subnet as the S7-300 PN interface; not in use by any other device.
• Slot / Subslot layout: the input slot count and output slot count defined in Compositor must match the I/O configuration in TIA Portal — otherwise the watch table reads the wrong module offset and shows zero or stale data.

5.2 Modbus Master Settings

• Baud rate: identical to E5GC (9600 default).
• Parity: Even (OMRON default).
• Data bits / Stop bits: 7E1 or 7E2 — exactly matching the E5GC.
• Inter-frame delay: 50–100 ms minimum for OMRON slaves; otherwise the first few polls can be dropped.
• Response timeout: ≥ 500 ms when communicating with E5GC over a noisy line.

5.3 Modbus Mapping (Poll Table)

This is the section that is most often mis-configured. Each row in the Compositor poll table defines a Modbus read that the gateway executes cyclically. The key fields are:

Save the project, send it to the HD67602 via the USB / Ethernet configuration port, and power-cycle the gateway. The configuration is non-volatile but is only applied after a clean reboot.

Step 6 — Validate the Profinet Side in TIA Portal

1. Open the project, go to Devices & Networks, locate the HD67602 in the device view.
2. Confirm the device name assigned via Online → Accessible Devices → Assign Profinet Name matches the name in Compositor exactly.
3. Inspect the slot table: the input slot count defined in TIA must equal the input area defined in Compositor. A mismatch silently shifts the offsets.
4. Right-click the device and select Online & Diagnostics. The Module Status field must read OK, Maintenance = none.
5. Open the Watch Table and force a refresh. Toggle Monitor All.

OMRON E5GC Modbus Register Map (Reference)

For reference, the E5GC's holding-register map (subject to your specific firmware revision) typically includes:

Verification Procedure

After completing the configuration corrections, perform the following end-to-end check before declaring the fault closed:

1. Power-cycle the HD67602. Confirm the PWR and LINK LEDs are solid green and the ERR LED is off.
2. In TIA Portal, open Online → Accessible Devices. The HD67602 must appear with the configured device name and IP.
3. Open the watch table. Monitor the input word mapped to the E5GC PV register. The value must change in real time when the process temperature changes — apply a known heat source or change the set point to force movement.
4. Cross-validate the value with the E5GC front display (the upper row shows PV). They must agree within the E5GC's display resolution (typically 0.1 °C).
5. Toggle the value type in the watch table: if you read IW 0 as INT, it should match IW 0 interpreted as WORD. If they differ, there is a byte-swap issue in the Compositor mapping.
6. Force a write to a writable register (e.g., set point at 0x0101) from the watch table and confirm the E5GC accepts the new value.
7. Watch the gateway's RX/TX Modbus LED for 60 s. The blink rate must match the configured poll cycle (default typically 100–500 ms).

Troubleshooting Matrix — Quick Field Reference

Workaround if the Gateway Cannot Be Re-Configured Quickly

If the HD67602 must stay in service while a permanent fix is being prepared, two interim measures are common:

1. Insert a serial tap: deploy a PC-based Modbus master on the same RS-485 segment (listen-only, or as a temporary master) to validate that the E5GC is reachable. This proves the slave is healthy and isolates the fault to the gateway configuration.
2. Side-channel polling from the S7-300: in some scenarios, a second Modbus master (an S7-300 with a CM PtP or CP341 module) can poll the E5GC directly over RS-485, bypassing the gateway. This is a debugging arrangement, not a permanent architecture, but it keeps the production process running while the Profinet/Modbus issue is resolved.

Safety and Operational Notes

• Power-cycle the gateway only after each configuration download — the HD67602 applies Compositor projects on a cold boot, not on a hot reload.
• Do not mix termination strategies. The HD67602 internal termination is enabled/disabled by a physical jumper or by a checkbox in Compositor; if you enable it on the gateway, the E5GC must be the only other termination point.
• When upgrading ADFweb firmware or Compositor, always re-export the project; the software is often newer than the bundled manual, and parameter defaults can change between revisions.
• Keep the gateway's RS-485 bus electrically isolated from the Profinet switch. The HD67602 provides 1.5 kV galvanic isolation on the serial side, but a shared ground path elsewhere in the panel can defeat it.
• Document the final configuration (slave address, baud, parity, register map, PN slot layout) inside the TIA Portal project comments. This eliminates the most common "it worked yesterday" problem when a maintenance engineer later replaces the E5GC.

FAQ