Description
The EPXMBE001 returns Illegal Data Address (Modbus Error Code 02), even when the modbus addresses seem to be properly configured at the ModbusTCP Client.
This is due to auto ranging(optimization) of the client driver, crossing a gap in defined memory for special parameters, thus requesting non-existent memory locations. This does not affect access to Process Image I/O Data as there are no gaps here. This only affects access to special data.
Resolution
This is the Modbus Memory Map of EPXMBE001 (extracted from GFK-2958)
Checking the address map, some gaps are observed in the memory map (ie. there are not addresses defined between 0x1006 and 0x100C or between 0x101F and 0x1028)
Many ModbusTCP Client (ie View OPC driver) groups nearby addresses in the same communication frame in order to reduce the number of frames. So, if the built frame includes a gap (a memory space with non defined addresses), the EPXMBE001 will return the "Illegal Data Address"
The only way this issue can be avoid is forcing the ModbusTCP Client to poll only ONE address. As negative side, this means there will be more communication frames in the network.
In case of using View OPC driver, this can be configured in the Device properties, in Blocks tab: