/
MODBUS Client

MODBUS Client

MODBUS Client communication protocol

Supported device types and versions

The protocol implements client (master) communication with arbitrary devices that support MODBUS RTU or MODBUS ASCII standards (serial communication) as well as MODBUS over TCP/IP. Moreover, it supports two extensions:

  • Byte mode - allows working with devices that implement the registers as 1-byte variables (in contrast with Modbus standard in which the register value is 2 bytes).

  • Variable mode - allows working with devices that implement the registers with different sizes than standard 2 bytes. It was implemented because of support of the flowmeter FloBoss 103 made by Fisher Controls International (at this time a part of Emerson Process Management): 1-byte variables, 4-byte unsigned/signed integers, text strings of length 10,12,20,40 characters, a 6-byte time stamp, and other.
    Note: this mode enables work with devices implementing the so-called Enron Modbus or Daniel Modbus.

  • Passive (scanning) mode allows to work in eavesdropping mode. This applies especially to serial communication when the communication port of the device is already used to communicate with another Master device. Due to the nature of the Modbus protocol, it is necessary to receive both requests and responses in this mode.

 Communication line configuration

  • Line category Serial (serial communication)

  • Line category SerialOverUDP Device Redundant (serial communication).

  • Line category RFC2217 Client (serial communication).

  • Line category TCP/IP-TCP and TCP/IP-TCP Redundant (MODBUS over TCP/IP). Reserved TCP port 502 is commonly used, but it is possible to use any other one according to the setting of the device. The line number is not used; set the value, e.g. to 1.
    Note: For redundant systems, it is possible to enter multiple names/addresses separated by commas.
    Note: In the case of WAGO 750-8100 type PLC and communication via MODBUS TCP, it was necessary to set a small polling period (e.g. 1 second) in the time parameters of the station. In the case of a longer period (5 seconds), the connection was closed quite often by the PLC.

Forced disconnection: If all stations on the TCP/IP-TCP or TCP/IP-TCP Redundant line are in the simulation mode or the communication is stopped for them, the line will be disconnected (the communication socket will be closed). If the simulation is disabled for at least one station and the communication is not stopped for it (the Parameters tab of the Station type object), the line will be connected again.

Line protocol parameters

A dialogue window of communication line configuration - Protocol parameters tab.
They influence some optional protocol parameters.

The line protocol contains the following parameters:

Parameter

Meaning

Unit

Default value

Parameter

Meaning

Unit

Default value

Immediate Disconnect

The parameter is implemented only for TCP/IP-TCP and TCP/IP-TCP Redundant line categories. The parameter activates the disconnection of the TCP connection after the execution of each read cycle, or after the value is written. The parameter was implemented due to problems with connection stability on mobile GPRS networks.

YES/NO

NO

Passive Mode

This parameter activates the passive (scanning) mode. In this mode, requests are not sent and writing does not work. Only received packets are parsed. The nature of the Modbus protocol implies that it is necessary to receive both the requests and responses of existing communication.

YES/NO

NO

TCP No Delay

Setting the TCP No Delay parameter to YES causes the low-level socket option TCP_NODELAY to be set, thus turning off the default packet coalesce feature.
The parameter is implemented only for TCP/IP-TCP and TCP/IP-TCP Redundant line categories.

YES/NO

NO

Station configuration

  • Communication protocol "Modbus Client".

  • The station address is a decimal number mostly in the range of 1 to 247. Address 0 is reserved as broadcast.

Note: If no I/O tag with a valid address is configured on the station, no communication will take place, and the station will be in an invalid state (Invalid). If the KOM process patch older than 27.8.2026 is used, it will be in an error state (StHARDERR).

Station protocol parameters

Configuration dialogue box - tab Parameter.
They influence some optional parameters of the protocol. The following station protocol parameters can be set:

Table 1

Parameter

Meaning

Unit

Default value

Parameter

Meaning

Unit

Default value

Retry Count

Maximum count of request retries. If no response is returned after a request has been sent, the station's status will change to a communication error.

-

2

Retry Timeout

Timeout before resending a request if no response has been received.

s

0.1

Wait First Timeout

The delay after sending the request and before reading the response.

s

0.1

Wait Timeout

The delay between the response readings.

s

0.1

Max. Wait Retry

The maximum number of retries for the response reading.

-

20

Start Silent Interval

"Start silent interval" before the beginning of the transmission in RTU mode.

ms

50

Stop Silent Interval

"Stop silent interval" after the end of the transmission in RTU mode.

ms

50

Read After Write

After writing to the I/O tag, the reading immediately follows. By setting the parameter to the NO value, it is possible to reduce the load on communications (especially serial ones) with a large number of writes.

YES/NO

YES

Little Endian Mode

Byte order in Little-endian mode for 4-byte variables. The individual options indicate in which bytes (1-lowest, 4-highest) the individual bytes from the communication will go:

  • 2143 - first the lower word is received, then the higher word (higher byte within the word is always first)

  • 3412 - first the higher word is received, then the lower word (lower byte within the word is always first)

  • 1234 - bytes are received from lowest to highest (direct opposite of big-endian)

-

2143

Byte mode

Special byte mode of transmission in which the values of registers have a length of 1 byte and not 2 bytes, as it is defined in the Modbus protocol specification.

YES/NO

NO

Variable mode

Special variable mode of transmission in which the values of registers have variable lengths.

The setting of Variable mode:
Little endian = the lowest bytes are sent first
Big endian = the highest bytes are sent first
OFF = variable mode is switched off

Note 1: Variable and byte modes are incompatible, and only one of them can be enabled.
Note 2: Emerson FloBoss 103 device: text strings and 6-byte time stamps are always sent from the lowest byte.
Note 3: Variable mode is implemented only for Protocol Mode=RTU.
Note 4: A data encoding big-endian is used automatically, according to the default parameter values Byte mod=NO and Variable mode=OFF (i.e. according to the MODBUS protocol specification).

OFF
Little endian
Big endian

OFF

Full debug

Logging of detailed debug information about communication in the line log.

YES/NO

NO

Protocol mode

Protocol mode: RTU or ASCII.

Note: In the case of "MODBUS over TCP/IP", the parameter value is ignored, and Protocol Mode=RTU is used.

RTU
ASCII

RTU

Addressing model

Sets an address model of the MODBUS protocol:
MODBUS PDU data are addressed from 0 up to 65535.
MODBUS data Model data are addressed from 1 up to 65536.

Note: MODBUS PDU is a default value. If the MODBUS data Model is set, the object with the address X is addressed as X-1 in the MODBUS PDU.
After you change this parameter, a restart of the respective communication process was required in the past (KOM binaries older than May 27, 2021).

MODBUS PDU
MODBUS data Model

MODBUS PDU

TCP/IP protocol variant

Select a variant of the protocol in case of TCP/IP communication:
"MODBUS TCP" is a variant of communication without a control checksum. Safeguarding is done by the underlying TCP protocol.
"MODBUS over TCP" is a variant where a payload is MODBUS RTU data containing a checksum.

"MODBUS TCP"
"MODBUS over TCP"

"MODBUS TCP"

Max. Registers

The maximum count of registers that are read by one request.

-

100

Max. Bytes

The maximum count of bytes that are required by one request (only in "Byte mode").

-

100

Bool Mask

If a value of the integer type (Holding Registers, Input Registers) is assigned to an I/O tag of the Di or Dout type, this is done by comparing the read value with zero. If the value is zero, the value of the I/O tag is False, otherwise True. The Bool Mask parameter allows specific bits to be filtered out before the comparison is made, based on a bitmask specified as a hexadecimal number (the leftmost byte is the highest). The bitmask FF FF FF FF means that all bits are considered (for 1- and 2-register integer addresses).
Bitmask 01 means that only the lowest bit is considered. If the address of the I/O tag specifies the use of only the lower/upper byte of the register, the lowest/second lowest byte of the mask is applied.

-

FF FF FF FF

Skip Unconfigured

This parameter is used to avoid reading the values from addresses that are not configured.

Description and example:
The requests for data, which are limited by protocol parameter "Max. Registers" or "Max. Bytes", are sent as standard. If I/O tags with addresses "Holding Registers" 1, 2, and 5 have been configured, one request reading 5 registers starting with address 1 is sent, although the I/O tags with addresses 3 and 4 are not configured. It is more efficient to obtain the required data by one request than by two ones even if the unnecessary data are also read.
If the parameter "Skip Unconfigured" is set to YES, two requests are sent, the first one reads two registers starting from address 1, and the second one reads one register from address 5.
Some Modbus servers respond by exception to the reading of a range of registers that contains "unknown" registers (which, e.g. they don't have mapped to internal memory).
Specifically, this is the error "ExceptionCode 02 (Starting Address not OK or Starting Address + Quantity of Registers not OK)".

YES/NO

NO

Check Receive Length

If this parameter is set to YES, then an extra check is performed when receiving a response to a read request: the length of received data is checked to see whether it matches the number of registers in a read request.

  • if Byte mode is on (Byte mode=YES), the length of received data must be equal to the number of registers

  • if both Byte mode and variable mode are off, the length of received data must be equal to double the number of registers

  • if the variable mode is on (Variable mode=little-endian or big-endian), the check has not been implemented yet

This extra check is reasonable on high-latency and variable-latency lines - e.g. GPRS networks - to detect and avoid the situation when read request (#1) is repeated due to timeouts and then two responses are received, the second of which could be considered to be an answer to another read request (#2), thus causing wrong values being assigned to I/O tags addressed by this read request #2.

YES/NO

NO

Dummy Request Mode

If the parameter is set to YES, then a single request (which contains the total number of registers) is used. It is necessary that the I/O tags are defined for all addresses 0..N.
This mode can be used for special devices that send all data (with variable size registers - 2, 4, 8 bytes - in a single response).

YES/NO

NO

TCP Write Password

On the TCP/IP-TCP line, immediately after the connection is established, it is possible to write a specific value to the selected address (TCP Password Address) using the selected function (TCP Password Function). In this way, the ComAp control unit enables the authorised Modbus client to be authenticated. The value is entered in hexadecimal in the order of the bytes as they will be transmitted (e.g. "01 0A BC D0". If an odd number of bytes is entered, a byte with the value 0 will be added at the end.

Setting the parameter to an empty value causes the write to not be performed after the connection is established.

-

 

TCP Password Address

Address for writing the password (TCP Write Password) on the TCP/IP-TCP line. If the password is longer than 2 bytes, it is the address of the first register. If the password has e.g. 6 bytes, written as 3 registers from the specified address.

-

0

TCP Password Function

The write function for writing the password (TCP Write Password) on the TCP/IP-TCP line.
If the number of bytes of the password is greater than 2, function 16 (Write Multiple Registers) is used even if function 6 (Write Single Register) is specified.

6
16

6

I/O tag configuration

Possible types of I/O tag values for invariable mode: Ai, Ao, Di, Do, Ci, Co, TxtI.

Possible types of I/O tag values for variable mode: Ai, Ao, Di, Do, Ci, Cout, TxtI, TxtO, TiA.

I/O tag address:

The main address space in the protocol MODBUS is divided into the following registers:

  • Coil type (reading/writing)

  • Discrete Inputs (reading)

  • Holding Registers (reading/writing)

  • Input Registers (reading)

Independent addressing with the address size of 2 bytes, i.e. addresses from 0 up to 65535 (so-called MODBUS PDU addressing model), is in an address space of each type of register. Some devices work with an address space starting with 1 (so-called MODBUS Data Model). In this case, it is necessary to deduct 1 in the address at configuration I/O tags in the D2000 system or change the setting of the parameter Addressing model to the MODBUS data Model.

The I/O tag with an address starting with %IGNORE will be ignored.

I/O tag address can be in a basic or extended format (for a variable mode).

The basic format of I/O tag address:
Address format is [I|U|Uu|Ul|f|F|L|Ll|S|Sl|B|X|sn.|an.|An.][d|D][b][s]RdFn[-WrFn[d|r]].Address[.BitNr]  [,Items]  in which:

  • The first character defines a type of I/O tag:

    • I - Integer16 (default) - one register is read, signed

    • U - Unsigned16 - one register is read, unsigned

    • Uu - Unsigned16 - one register is read, unsigned, and only the upper byte is processed (1st in sequence)

    • Ul - Unsigned16 - one register is read, unsigned, and only the lower byte is processed (2nd in sequence)

    • f - Float (4 bytes = 2 registers) - two registers with Address and Address+1 are read and transmitted as big-endian (see Note).

    • F - Float (4 bytes = 2 registers) - two registers with Address and Address+1 are read and transmitted as little-endian (so-called Modicon format), (see Note)

    • L - Unsigned long (4 bytes = 2 registers) - two registers with Address and Address+1 are read, unsigned, and transmitted as big-endian (see Note)

    • Ll - Unsigned long (4 bytes = 2 registers) - two registers with Address and Address+1 are read and transmitted as little-endian, unsigned (see Note)

    • S - Signed long (4 bytes = 2 registers) - two registers with Address and Address+1 are read, signed, and transmitted as big-endian (see Note)

    • Sl - Signed long (4 bytes = 2 registers) - two registers with Address and Address+1 are read and transmitted as little-endian, signed (see Note)

    • B - Byte unsigned, only the upper 8 bits of the register value

    • X - Byte unsigned, only the lower 8 bits of the register value

    • sn. - Text string with the length of n characters, one register is one character, n registers with Address up to Address+n-1 are read

    • an. - Text string with the length of 2*n characters, one register is two ASCII characters, characters are transmitted in the same order as they appear in the string,  n registers with Address up to Address+n-1 are read

    • An. - Text string with the length of 2*n characters, one register is two ASCII characters, characters are transmitted in big-endian order (i.e. "1234" is transmitted as "2143"),  n registers with Address up to Address+n-1 are read

  • Modifier d indicates that a number is an 8-byte number (4 consecutive registers). It can be used for types L, Ll, S, Sl, F,f, and it is used for configuration of signed/unsigned 8-byte integer as well as an 8-byte float (big-endian <B8>..<B1> and little-endian <B1>..<B8> formats).
    Modifier D indicates that a number is an 8-byte number (4 consecutive registers). It can be used for types Ll, Sl, F, and it is used for the configuration of signed/unsigned 8-byte integer as well as an 8-byte float (little-endian format <B2><B1><B4><B3><B6><B5><B8><B7>).

  • Modifier b indicates that the number is BCD-coded. It can be used for I/O tags of I, U, B, L, Ll types.

  • Modifier s indicates that a status register (Unsigned16) located on address Address is followed by a big-endian Float value located on address Address+1 .. Address+2. This indicator is used for type f and it is implemented for calorimeter Endress+Hauser RMS621. The following table shows the values of the status register and their mapping to D2000 attributes.

    Status register

    D2000 attributes

    Status register

    D2000 attributes

    0: Invalid value

    Weak

    1: Measured value valid

    Valid

    2: Overflow warning
    3: Overflow error
    4: Underflow warning
    5: Underflow error
    6: Saturated steam alarm
    7: Error in differential pressure calculation
    8: Wrong medium for DP calculation
    9: Wrong value range - DP calculation inaccurate
    10: Differential pressure - general error
    11: Range overshoot (Tsat > 350 etc.) on
    12: Change in state of aggregation
    26: Differential pressure --> general error
    99: No measured value is assigned to the register in the setup of the ModBus

    Weak

  • Parameter RdFn is a function of the Modbus protocol for data reading. The following functions are implemented:

    • 1 - Read Coils: binary status reading

    • 2 - Read Discrete Inputs: binary input reading

    • 3 - Read Holding Registers: status register reading (Integer16/Unsigned16 and Float32 - reads two successive registers)

    • 4 - Read Input Registers: input register reading (Integer16/Unsigned16 and Float32 - reads two successive registers)