Modbus

The Modbus Protocol is a messaging structure. It is used to establish master-slave/client-server communication between intelligent devices. It is a de facto standard. The Modbus RTU specification defines the default communication protocol over serial lines. The Modbus TCP/IP specification takes the Modbus instruction set and wraps TCP/IP around it.

HSYCO supports both Modbus TCP and Modbus RTU, acting as a Modbus master in both cases.

This support is implemented as a set of Java APIs that allow read/write functions as described in the HSYCO Programming Handbook, and an I/O Server with a data point representation that you can use in the EVENTS language to poll Modbus data and generate events.

The MODBUSRTU I/O Server can also be configured to implement a Modbus TCP server / Modbus RTU master gateway.

General Configuration

Modbus TCP

If a Modbus TCP/IP device is used to interface HSYCO to a Modbus RTU or ASCII bus over RS485, the gateway should be configured as Modbus TCP/IP slave and Modbus RTU/ASCII master.

HSYCO can also directly access Modbus TCP slave devices.

Modbus RTU

HSYCO supports Modbus RTU over a local serial port, like the one in HSYCO Pi Strato. It doesn't support TCP to serial gateways.

You can also use the FTDI’s USB-RS485 cable, a USB to RS485 level serial UART converter cable incorporating FTDI’s FT232RQ USB to serial UART interface IC device which handles all the USB signaling and protocols. The cable provides a fast, simple way to connect devices with a RS485 interface to USB.

The USB-RS485 cable connects to any USB port of the HSYCO server, and doesn’t require external power supply. It offers an internal 120 Ohm resistor for line termination, and +5Vcc and ground level references that could become handy to connect pull-up and pull-down resistors for lines’ polarization (See the MODBUS over Serial Line Specification & Implementation guide for additional information about line polarization and termination).

The USB-RS485 cable doesn’t provide opto-isolated RS485 lines. Transient currents and voltage levels exceeding the cable’s specification could damage the USB-RS485 cable, HSYCO server and any Modbus device attached to the RS485 line.

HSYCO Configuration

Add a MODBUSTCP or MODBUSRTU I/O Server in the I/O Servers section of the Settings and set its parameters:

Communication

Modbus TCP

• IP Address: IP address of the gateway
• IP Port: TCP/IP port to use, leave blank to use default port 502.

Modbus RTU

• Comm ID: select the comm port the device is connected to.

When creating the used comm port, its id depends on your HSYCO server configuration, and should be "ttyUSB0" if there are no other devices connected to the USB ports. You could also use the "ftdi-n-n.n" alias, that is unique for each physical USB port on the server.

This I/O Server only supports local serial ports in Modbus RTU mode. If you need to implement a remote connection over TCP, use a Modbus TCP to Modbus RTU gateway and configure the I/O Server as a Modbus TCP client.

High Availability

• Shutdown when inactive: defaults to true.

Options

ID	Default	Values	Description
eventslog	false	true	if the general eventsLog option is also true in hsyco.ini, Modbus events for this gateway are written in the log files
		false	Modbus events for this gateway are not written in the log files, even if the eventsLog option is true in hsyco.ini
extendednames	false	true	when this option is set, data point names used to return values will have the postfix .FF, where FF is the 2-digit decimal function code
		false	data points’ default naming convention is used
frameinterval		> 0	when this option is set, a fixed silence interval (in milliseconds) is enforced before sending each message
tcpgatewayport		> 0	when this option is set, a Modbus TCP server / Modbus RTU master gateway is enabled, listening on this TCP port
tcpgatewayaddress		<ip_address>	when the Modbus TCP server / Modbus RTU master gateway is enabled, this options may be used to limit the server to listen on a specific IP address only. If not set, the server will listen on all available IP addresses / network ports
tcpgatewayblacklist		semicolon (;) separated list of ip addresses	when the Modbus TCP server / Modbus RTU master gateway is enabled, this options may be used to define the list of IP addresses that should be denyed access to the gateway
tcpgatewaywhitelist		semicolon (;) separated list of ip addresses	when the Modbus TCP server / Modbus RTU master gateway is enabled, this options may be used to define the list of IP addresses that should be allowed access to the gateway. If this option is set, only the connections originating from addresses listed here will be allowed
tcpgatewaypriority		semicolon (;) separated list of <ip_address>:<priority>	when the Modbus TCP server / Modbus RTU master gateway is enabled, this options may be used to define the RS485 access priority to specific IP addresses. Lower numbers represent higher priority. The default priority level is 10.
tcpgatewaytimeout	6000	>= 0	when the Modbus TCP server / Modbus RTU master gateway is enabled, this options may be used to set the maximum timeout to Modbus TCP requests. This is relevant when multiple parallel requests are queued for access to the RS485 bus. Defaults to 6000ms. When set to 0, requests will wait indefintely until the RS485 bus can be acquired to send a request

Modbus Utility

The Modbus Utility is an application that allows you to easily setup repetitive polling read requests and monitor the performance and status of each request.

Modbus Integration

Because the Modbus protocol is not asynchronous, but is based on polling, you always have to request a read to tell the driver to actually read the data and eventually generate an event on the associated data point if the data has changed.

Modbus TCP server / Modbus RTU master gateway

The MODBUSRTU I/O Server can be configured to implement a Modbus TCP server / Modbus RTU master gateway.

When this feature is enabled, the MODBUSRTU I/O Server can be used to directly process Modbus requests from HSYCO applications, while at the same time allowing external access to Modbus TCP clients.

Access to the RS485 bus is synchronised, so that only one request/response can be performed on the bus at any given time. Requests pipelining is not supported.

Multiple clients can be connected the the gateway’s port (default 502) at the same time. If different clients issue multiple overlapping requests, they will be queued for access to the RS485 bus.

In this case, two optional parameters can affect the behaviour of the gateway.

The “tcpgatewaytimeout” option is used to set the maximum timeout to Modbus TCP requests. When a request is recevied from a TCP client and has to be queued because the RS485 is busy, it will wait up to tcpgatewaytimeout milliseconds. Defaults to 6000ms. When set to 0, requests will wait indefinitely until the RS485 bus can be acquired to send a request. A timed-our request will be returned a “0A” error code (Gateway Path Unavailable).

The “tcpgatewaypriority” option is used to assign a priority to distinct Modbus TCP client addresses. Lower numbers represent higher priority. The default priority level is 10.

When more than one request is queued, the gateway will process the requests based on the assigned priority, so that a request arriving when another request is already in the queue (i.e. already waiting the completion of the currently active request) could be processed first if it has a higher (lower number) priority, overriding the standard FIFO (first come, first served) logic. Note that, if there are only two clients overlapping their respective requests, these requests would simply be granted alternate access to the RS485, and the priority settings would have no effect.

Datapoints

The naming convention HSYCO uses for the events is closely related to the Modbus addressing standards and data types.

The data point names always begin with the same format: ID.unitid.address, where ID is the I/O server id, unitid is the Modbus slave device address, from 1 to 247, and address is the initial register address you are reading.

The supported public function codes are:

• 01: Read Coils
• 02: Read Discrete Inputs
• 03: Read Holding Registers
• 04: Read Input Registers
• 05: Write Single Coil
• 06: Write Single Register
• 15: Write Multiple Coils
• 16: Write Multiple Registers
• 22: Mask Write Register (only available using the modbusWriteMaskRegister() JavaScript and Java function)
• 23: Read/Write Multiple Registers (only available using the modbusReadWriteMultipleRegisters() JavaScript and Java function).

Operations on Input Registers and Holding Registers tables support the following data types:

Type code	Description	Return range	Number of registers	Data format
ushort	unsigned short integer	0 ... 65535	1	big-endian[Note 1]
uint	unsigned integer	0 ... (232 - 1)	2	big-endian[Note 1]
uintx	unsigned integer	0 ... (232 - 1)	2	big-endian, low word first[Note 2]
ulong	unsigned long integer	0 ... (264 - 1)	4	big-endian[Note 1]
ulongx	unsigned long integer	0 ... (264 - 1)	4	big-endian, low word first[Note 2]
short signed	short integer	-32768 ... +32767	1	big-endian[Note 1]
int	signed integer	-231 ... (231 - 1)	2	big-endian[Note 1]
intx	signed integer	-231 ... (231 - 1)	2	big-endian, low word first[Note 2]
long	signed long integer	-263 ... (263 - 1)	4	big-endian[Note 1]
long x	signed long integer	-263 ... (263 - 1)	4	big-endian, low word first[Note 2]
float	signed IEEE 754 floating point	+/- 2-149 ... (2-2-23)x2127	2	IEEE 754 floating-point "single format" bit layout
floatx	signed IEEE 754 floating point	+/- 2-149 ... (2-2-23)x2127	2	IEEE 754 floating-point "single format" bit layout, low word first[Note 2]

Note 1 

The big-endian representation means that when a numerical quantity larger than a single byte is transmitted, the most significant byte is sent first.

Note 2 

This format transmits the least significant word first. The most significant byte of each word is sent first.

Read Coils

Reads from 1 to 2000 contiguous coils, using function code 01. Each coil returns a binary value, 0 or 1, in distinct data points, one for each coil.

ID	Value	R/W	Description
unitid.address	readcoils:<n>	W	executes the Read Coils function, reading <n> coils
unitid.address.1 ... unitid.address.<n> or unitid.address.01.<n> if extendednames is set	0	R	the status of the <n>-th coil starting at address is off
	1	R	the status of the <n>-th coil starting at address is on
unitid.address.error or unitid.address.01.error if extendednames is set	0, null, >0	R	the error status. 0: no error; null: unknown error; >0: modbus exception code

The <n> value after readcoils: can also be a variable, that will be replaced with its numeric content, for example:

IO modbus.27.400 = readcoils:$number

Read Discrete Inputs

Reads from 1 to 2000 contiguous discrete inputs, using function code 02. Each input returns a binary value, 0 or 1, in distinct data points, one for each coil.

ID	Value	R/W	Description
unitid.address	readdiscreteinputs:<n>	W	executes the Read Discrete Inputs function, reading <n> inputs
unitid.address.1 ... unitid.address.<n> or unitid.address.02.<n> if extendednames is set	0	R	the status of the <n>-th input starting at address is off
	1	R	the status of the <n>-th input starting at address is on
unitid.address.error or unitid.address.02.error if extendednames is set	0, null, >0	R	the error status. 0: no error; null: unknown error; >0: modbus exception code

The <n> value after readdiscreteinputs: can also be a variable, that will be replaced with its numeric content, for example:

IO modbus.27.400 = readdiscreteinputs:$number

Read Holding Registers

Reads one data point, using function code 03 to read the appropriate number of registers, based on the data type.

Each reading returns a single value, but you can also use an extended read function to read multiple consecutive values with one single Modbus read function, by adding :<n> at the end of “readholdingregisters:<format>”, where <n> is the number of values.

ID	Value	R/W	Description
unitid.address	readholdingregisters:ushort	W	executes the Read Holding registers function, reading 1 register and interpreting the data as an unsigned short integer
unitid.address	readholdingregisters:uint	W	executes the Read Holding registers function, reading 2 consecutive registers and interpreting the data as an unsigned integer
unitid.address	readholdingregisters:ulong	W	executes the Read Holding registers function, reading 4 consecutive registers and interpreting the data as an unsigned long integer
unitid.address	readholdingregisters:short	W	executes the Read Holding registers function, reading 1 register and interpreting the data as a signed short integer
unitid.address	readholdingregisters:int	W	executes the Read Holding registers function, reading 2 consecutive registers and interpreting the data as a signed integer
unitid.address	readholdingregisters:long	W	executes the Read Holding registers function, reading 4 consecutive registers and interpreting the data as a signed long integer
unitid.address	readholdingregisters:bitshort	W	executes the Read Holding registers function, reading 1 register and interpreting the data as 16 individual bits
unitid.address	readholdingregisters:bitint	W	executes the Read Holding registers function, reading 2 consecutive registers and interpreting the data as 32 individual bits
unitid.address	readholdingregisters:bitlong	W	executes the Read Holding registers function, reading 4 consecutive registers and interpreting the data as 64 individual bits
unitid.address	readholdingregisters:float	W	executes the Read Holding registers function, reading 2 consecutive registers and interpreting the data as a floating-point number using the IEEE Standard 754 representation
unitid.address or unitid.address.03 if extendednames is set	the returned value, according to the requested data type	R	this is the value read using the Read Holding Registers function
unitid.address.<n> or unitid.address.03.<n> if extendednames is set	the returned bit value, with <n> from 1 to 16, 32 or 64	R	this is the value read using the Read Holding Registers function with bitshort, bitint or bitlong format options
unitid.address.error or unitid.address.03.error if extendednames is set	0, null, >0	R	the error status. 0: no error; null: unknown error; >0: modbus exception code

Read Input Registers

Reads one data point, using function code 04 to read the appropriate number of registers, based on the data type.

Each reading returns a single value, but you can also use an extended read function to read multiple consecutive values with one single Modbus read function, by adding :N at the end of “readinputregisters:<format>”, where <n> is the number of values.

ID	Value	R/W	Description
unitid.address	readinputregisters:ushort	W	executes the Read Input registers function, reading 1 register and interpreting the data as an unsigned short integer
unitid.address	readinputregisters:uint	W	executes the Read Input registers function, reading 2 consecutive registers and interpreting the data as an unsigned integer
unitid.address	readinputregisters:ulong	W	executes the Read Input registers function, reading 4 consecutive registers and interpreting the data as an unsigned long integer
unitid.address	readinputregisters:short	W	executes the Read Input registers function, reading 1 register and interpreting the data as a signed short integer
unitid.address	readinputregisters:int	W	executes the Read Input registers function, reading 2 consecutive registers and interpreting the data as a signed integer
unitid.address	readinputregisters:long	W	executes the Read Input registers function, reading 4 consecutive registers and interpreting the data as a signed long integer
unitid.address	readinputregisters:bitshort	W	executes the Read Input registers function, reading 1 register and interpreting the data as 16 individual bits
unitid.address	readinputregisters:bitint	W	executes the Read Input registers function, reading 2 consecutive registers and interpreting the data as 32 individual bits
unitid.address	readinputregisters:bitlong	W	executes the Read Input registers function, reading 4 consecutive registers and interpreting the data as 64 individual bits
unitid.address	readinputregisters:float	W	executes the Read Input registers function, reading 2 consecutive registers and interpreting the data as a floating-point number using the IEEE Standard 754 representation
unitid.address or unitid.address.04 if extendednames is set	the returned value, according to the requested data type	R	this is the value read using the Read Input Registers function
unitid.address.<n> or unitid.address.04.<n> if extendednames is set	the returned bit value, with <n> from 1 to 16, 32 or 64	R	this is the value read using the Read Input Registers function with bitshort, bitint or bitlong format options
unitid.address.error or unitid.address.04.error if extendednames is set	0, null, >0	R	the error status. 0: no error; null: unknown error; >0: modbus exception code

Write Coils

Writes a single coil, using function code 05, or multiple coils, using function 15.

ID	Value	R/W	Description
unitid.address	bit:0 bit:false bit:off	W	executes the Write Single Coil function, setting the coil to off
	bit:1 bit:true bit:on	W	executes the Write Single Coil function, setting the coil to on
	bits:<0|1|-...	W	executes the Write Multiple Coils function, setting consecutive coils based on the binary sequence. The left-most bit in the sequence is the first coil
unitid.address.<n> or unitid.address.05.<n> if extendednames is set	0	R	the write function returned a correct response, and the new status of the coil is off
	1	R	the write function returned a correct response, and the new status of the coil is on
unitid.address.error or unitid.address.05.error if extendednames is set	0, null, >0	R	the error status. 0: no error; null: unknown error; >0: modbus exception code

The value after bit: and bits: can also be a variable, that will be replaced with its numeric content, for example:

IO modbus.27.1220 = bit:$value

Write Registers

Writes registers, using function code 06 or 16, based on the data type.

ID	Value	R/W	Description
unitid.address	ushort:<value>	W	executes the Write Single Register function, writing an unsigned short number
unitid.address	uint:<value>	W	executes the Write Multiple Registers function, writing an unsigned integer number to two adjacent registers
unitid.address	ulong:<value>	W	executes the Write Multiple Registers function, writing an unsigned long number to four adjacent registers
unitid.address	short:<value>	W	executes the Write Single Register function, writing a signed short number
unitid.address	int:<value>	W	executes the Write Multiple Registers function, writing a signed integer number to two adjacent registers
unitid.address	long:<value>	W	executes the Write Multiple Registers function, writing a signed long number to four adjacent registers
unitid.address	float:<value>	W	executes the Write Multiple Registers function, writing a floating-point number using the IEEE Standard 754 representation to two adjacent registers
unitid.address	hex:<value>	W	executes the Write Multiple Registers function, writing an array of bytes passed in <value> as an hexadecimal string. The <value> string length should be multiple of 4, as four bytes represent the two bytes in each register
unitid.address or unitid.address.06 unitid.address.16 if extendednames is set	the written value, according to the requested data type	R	the write function returned a correct response
unitid.address.error or unitid.address.06.error unitid.address.16.error if extendednames is set	0, null, >0	R	the error status. 0: no error; null: unknown error; >0: modbus exception code

The value after short:, int: etc. can also be a variable, that will be replaced with its numeric content, for example:

IO modbus.27.1220 = int:$value

Examples

Reading an integer value from two registers

TIME: IO modbus.27.400 = readholdingregisters:uint
IO modbus.27.400 : UISET mydata.text = IO modbus.27.400

The first line executes the read holding registers function on a Modbus device with address 27, reading two contiguous registers starting at address 400.

The second line sets a text object of the Web interface with the value read from the Modbus device.

Reading several values at once

TIME: IO modbus.27.220 Modbus.27.222 Modbus.27.224 = readinputregisters:float
IO modbus.27.220 : UISET mydata1.text = IO modbus.27.220
IO modbus.27.224 : UISET mydata1.text = IO modbus.27.224

The first line is a compact form for reading multiple data points.

Reading binary data

TIME: IO modbus.27.1000 = readdiscreteinputs:24
IO modbus.27.1000.1 = 0 : UISET mylabel1.color = g
IO modbus.27.1000.1 = 1 : UISET mylabel1.color = r
...
IO modbus.27.220.24 = 0 : UISET mylabel24.color = g
IO modbus.27.220.24 = 1 : UISET mylabel24.color = r

The first line executes the read discrete inputs function on a Modbus device with address 27, reading two contiguous registers starting at address 1000 and interpreting the first 24 bits as binary values.

The following lines change the color of some objects of the Web interface to green if the bit status is 0 or red if the status is 1.

Reading in extended mode

If the option extendednames was specified in System Settings:

TIME: IO modbus.27.1000 = readholdingregisters:ushort
IO modbus.27.1000.03 : UISET mydata.text = IO modbus.27.1000.03

The first line executes the read holding register function for an ushort value on a Modbus device with address 27, reading the registers 1000.

The following line changes the attribute text of a text object setting it to the value just read.

Writing a single coil

TIME : IO modbus.27.1220 = bit:1

Set coil 1220 to on.

Writing multiple coils

TIME : IO modbus.27.1220 = bits:100

Set three coils starting from 1220 to 1, 0, 0.

Writing registers

TIME : IO modbus.27.210 = ushort:2048 
TIME : IO modbus.27.220 = float:-123.22
TIME : IO modbus.27.230 modbus.27.240 = long:200000000

The first line executes the write single register on a Modbus device with address 27, writing the register at address 210 with an unsigned short number.

The second line executes the write multiple registers on a Modbus device with address 27, writing two consecutive registers starting at address 220 with an IEEE-754 floating-point number.

The third line executes the write multiple registers on a Modbus device with address 27, writing four consecutive registers starting at address 230 and four at 240 with a signed long number.

Release Notes

3.6.0

• new Modbus Utility scheduler engine, for automatic scheduling and sequencing of Modbus requests
• new Modbus Utility configuration interface
• the Write Registers data point format now accepts values passed as hexadecimal strings
• performance and stability improvements of the Modbus TCP client communication
• Modbus TCP server / Modbus RTU master gateway:
  • new "tcpgatewayblacklist" option for IP address based black lists
  • new "tcpgatewaywhitelist" option for IP address based white lists
  • new "tcpgatewaypriority" option for IP address based priority support
  • new "tcpgatewaytimeout" option to set the maximum response timeout

3.5.1

• new "frameinterval" option to set fixed silence interval before each message
• new "tcpgatewayaddress" and "tcpgatewayport" options to enable the Modbus TCP server / Modbus RTU master gateway

3.5.0

• new data types "intx", "longx", "uintx", "ulongx", "floatx" to implement low word first data encoding

3.4.0

• added support for function 23, Read/Write Multiple Registers:
  • modbusReadWriteMultipleRegisters() Java method and JavaScript function

3.3.0

• added support for Write Multiple Coils function:
  • writeMultipleCoils() Java method and JavaScript function
  • ID.unitid.address = bits:<0|1>... in EVENTS

3.2.1

• EVENTS: minor fixes to the readcoils and readdiscreteinputs actions

3.2.0

• reading multiple consecutive values with a single Modbus read is now supported for readholdingregisters and readinputregisters

3.1.1

• using format options bitshort, bitint and bitlong for readholdingregisters and readinputregisters, it is now possible to read 1, 2 or 4 registers and return the individual bit values

3.1.0

• new error events on Modbus read or write errors
• new option extendedNames. When this option is set, data point names used to return values will have the postfix .FF, where FF is the 2-digit decimal function code

3.0.3

• fixes to the Modbus write functions
• variables can now be used in value strings

3.0.0

• initial release

---

Modbus is a registered trademark of Modbus Organization, Inc.