Modbus
The Modbus Protocol is a messaging structure. It is used to establish master-slave/client-server communication between intelligent devices. It is a de facto standard. The Modbus RTU specification defines the default communication protocol over serial lines. The Modbus TCP/IP specification takes the Modbus instruction set and wraps TCP/IP around it.
HSYCO supports both Modbus TCP and Modbus RTU, acting as a Modbus master in both cases.
This support is implemented as a set of Java APIs that allow read/write functions as described in the HSYCO Programming Handbook, and an I/O Server with a data point representation that you can use in the EVENTS language to poll Modbus data and generate events.
The MODBUSRTU I/O Server can also be configured to implement a Modbus TCP server / Modbus RTU master gateway.
General Configuration
Modbus TCP
If a Modbus TCP/IP device is used to interface HSYCO to a Modbus RTU or ASCII bus over RS485, the gateway should be configured as Modbus TCP/IP slave and Modbus RTU/ASCII master.
HSYCO can also directly access Modbus TCP slave devices.
Modbus RTU
HSYCO supports Modbus RTU over a local serial port, like the one in HSYCO Pi Strato. It doesn't support TCP to serial gateways.
You can also use the FTDI’s USB-RS485 cable, a USB to RS485 level serial UART converter cable incorporating FTDI’s FT232RQ USB to serial UART interface IC device which handles all the USB signaling and protocols. The cable provides a fast, simple way to connect devices with a RS485 interface to USB.
The USB-RS485 cable connects to any USB port of the HSYCO server, and doesn’t require external power supply. It offers an internal 120 Ohm resistor for line termination, and +5Vcc and ground level references that could become handy to connect pull-up and pull-down resistors for lines’ polarization (See the MODBUS over Serial Line Specification & Implementation guide for additional information about line polarization and termination).
The USB-RS485 cable doesn’t provide opto-isolated RS485 lines. Transient currents and voltage levels exceeding the cable’s specification could damage the USB-RS485 cable, HSYCO server and any Modbus device attached to the RS485 line.
HSYCO Configuration
Add a MODBUSTCP or MODBUSRTU I/O Server in the I/O Servers section of the Settings and set its parameters:
Communication
Modbus TCP
- IP Address: IP address of the gateway
- IP Port: TCP/IP port to use, leave blank to use default port 502.
Modbus RTU
- Comm ID: select the comm port the device is connected to.
When creating the used comm port, its id depends on your HSYCO server configuration, and should be "ttyUSB0" if there are no other devices connected to the USB ports. You could also use the "ftdi-n-n.n" alias, that is unique for each physical USB port on the server.
This I/O Server only supports local serial ports in Modbus RTU mode. If you need to implement a remote connection over TCP, use a Modbus TCP to Modbus RTU gateway and configure the I/O Server as a Modbus TCP client.
High Availability
- Shutdown when inactive: defaults to true. When true and the HSYCO Server is inactive, all Modbus calls are affectively blocked, and return null. The TCP gateway is also blocked.
Options
| ID | Default | Values | Description |
|---|---|---|---|
| eventslog | false | true | if the general eventsLog option is also true in hsyco.ini, Modbus events for this gateway are written in the log files |
| false | Modbus events for this gateway are not written in the log files, even if the eventsLog option is true in hsyco.ini | ||
| extendednames | false | true | when this option is set, data point names used to return values will have the postfix .FF, where FF is the 2-digit decimal function code |
| false | data points’ default naming convention is used | ||
| frameinterval | >= 0 | when this option is set, a fixed silence interval (in milliseconds) is enforced before sending each message | |
| tcpgatewayport | > 0 | when this option is set, a Modbus TCP server / Modbus RTU master gateway is enabled, listening on this TCP port | |
| tcpgatewayaddress | <ip_address> | when the Modbus TCP server / Modbus RTU master gateway is enabled, this options may be used to limit the server to listen on a specific IP address only. If not set, the server will listen on all available IP addresses / network ports | |
| tcpgatewayblacklist | semicolon (;) separated list of ip addresses | when the Modbus TCP server / Modbus RTU master gateway is enabled, this options may be used to define the list of IP addresses that should be denyed access to the gateway | |
| tcpgatewaywhitelist | semicolon (;) separated list of ip addresses | when the Modbus TCP server / Modbus RTU master gateway is enabled, this options may be used to define the list of IP addresses that should be allowed access to the gateway. If this option is set, only the connections originating from addresses listed here will be allowed | |
| tcpgatewaypriority | semicolon (;) separated list of ip <addresses:priority> | when the Modbus TCP server / Modbus RTU master gateway is enabled, this options may be used to define the RS485 access priority to specific IP addresses. Lower numbers represent higher priority. The default priority level is 10. | |
| tcpgatewaytimeout | 6000 | >= 0 | when the Modbus TCP server / Modbus RTU master gateway is enabled, this options may be used to set the maximum timeout to Modbus TCP requests. This is relevant when multiple parallel requests are queued for access to the RS485 bus. Defaults to 6000ms. When set to 0, requests will wait indefintely until the RS485 bus can be acquired to send a request |
| tcpmodbuseventunitid | 0...255 | When the Modbus TCP gateway option is enabled, setting tcpmodbuseventunitid to a Unit Id value (0 to 255) will redirect all TCP requests to that Unit Id to the ModbusEvent() callback instead of the Modbus RTU serial bus |
Modbus Utility
The Modbus Utility is an application that allows you to easily setup repetitive polling read requests and monitor the performance and status of each request.
Modbus Integration
Because the Modbus protocol is not asynchronous, but is based on polling, you always have to request a read to tell the driver to actually read the data and eventually generate an event on the associated data point if the data has changed.
Modbus TCP server / Modbus RTU master gateway
The MODBUSRTU I/O Server can be configured to implement a Modbus TCP server / Modbus RTU master gateway.
When this feature is enabled, the MODBUSRTU I/O Server can be used to directly process Modbus requests from HSYCO applications, while at the same time allowing external access to Modbus TCP clients.
Access to the RS485 bus is synchronised, so that only one request/response can be performed on the bus at any given time. Requests pipelining is not supported.
Multiple clients can be connected the the gateway’s port (default 502) at the same time. If different clients issue multiple overlapping requests, they will be queued for access to the RS485 bus.
In this case, two optional parameters can affect the behaviour of the gateway.
The tcpgatewaytimeout option is used to set the maximum timeout to Modbus TCP requests. When a request is recevied from a TCP client and has to be queued because the RS485 is busy, it will wait up to tcpgatewaytimeout milliseconds. Defaults to 6000ms. When set to 0, requests will wait indefinitely until the RS485 bus can be acquired to send a request. A timed-our request will be returned a 0A error code (Gateway Path Unavailable).
The tcpgatewaypriority option is used to assign a priority to distinct Modbus TCP client addresses. Lower numbers represent higher priority. The default priority level is 10.
When more than one request is queued, the gateway will process the requests based on the assigned priority, so that a request arriving when another request is already in the queue (i.e. already waiting the completion of the currently active request) could be processed first if it has a higher (lower number) priority, overriding the standard FIFO (first come, first served) logic. Note that, if there are only two clients overlapping their respective requests, these requests would simply be granted alternate access to the RS485, and the priority settings would have no effect.
When the Modbus TCP gateway option is enabled, setting the tcpmodbuseventunitid option to a Unit Id value (0 to 255) will redirect all TCP requests to that Unit Id to the ModbusEvent() callback instead of the Modbus RTU serial bus.
Modbus Datapoints
| ID | Value | R/W | Description |
|---|---|---|---|
| frameinterval | >= 0 | W | a fixed silence interval (in milliseconds) is enforced before sending each message. This overrides the frameinterval configuration option |
| default | W | clears the frameinterval setting, reverting to the standard frame interval, that is based on port's speed. This overrides the frameinterval configuration option |
Datapoints
The naming convention HSYCO uses for the events is closely related to the Modbus addressing standards and data types.
The data point names always begin with the same format: ID.unitid.address, where ID is the I/O server id, unitid is the Modbus slave device address, from 1 to 247, and address is the initial register address you are reading.
The supported public function codes are:
- 01: Read Coils
- 02: Read Discrete Inputs
- 03: Read Holding Registers
- 04: Read Input Registers
- 05: Write Single Coil
- 06: Write Single Register
- 15: Write Multiple Coils
- 16: Write Multiple Registers
- 22: Mask Write Register (only available using the modbusWriteMaskRegister() JavaScript and Java function)
- 23: Read/Write Multiple Registers (only available using the modbusReadWriteMultipleRegisters() JavaScript and Java function).
Operations on Input Registers and Holding Registers tables support the following data types:
| Type code | Description | Return range | Number of registers | Data format |
|---|---|---|---|---|
| ushort | unsigned short integer | 0 ... 65535 | 1 | big-endian(1) |
| uint | unsigned integer | 0 ... (232 - 1) | 2 | big-endian(1) |
| uintx | unsigned integer | 0 ... (232 - 1) | 2 | big-endian, low word first(2) |
| ulong | unsigned long integer | 0 ... (264 - 1) | 4 | big-endian(1) |
| ulongx | unsigned long integer | 0 ... (264 - 1) | 4 | big-endian, low word first(2) |
| short | signed short integer | -32768 ... +32767 | 1 | big-endian(1) |
| int | signed integer | -231 ... (231 - 1) | 2 | big-endian(1) |
| intx | signed integer | -231 ... (231 - 1) | 2 | big-endian, low word first(2) |
| long | signed long integer | -263 ... (263 - 1) | 4 | big-endian(1) |
| longx | signed long integer | -263 ... (263 - 1) | 4 | big-endian, low word first(2) |
| float | signed IEEE 754 floating point | +/- 2-149 ... (2-2-23)x2127 | 2 | IEEE 754 floating-point "single format" bit layout |
| floatx | signed IEEE 754 floating point | +/- 2-149 ... (2-2-23)x2127 | 2 | IEEE 754 floating-point "single format" bit layout, low word first(2) |
Note 1
The big-endian representation means that when a numerical quantity larger than a single byte is transmitted, the most significant byte is sent first.
Note 2
This format transmits the least significant word first. The most significant byte of each word is sent first.
Read Coils
Reads from 1 to 2000 contiguous coils, using function code 01. Each coil returns a binary value, 0 or 1, in distinct data points, one for each coil.
| ID | Value | R/W | Description |
|---|---|---|---|
| unitid.address | readcoils:<n> | W | executes the Read Coils function, reading <n> coils |
| unitid.address.1 ... unitid.address.<n> or unitid.address.01.<n> if extendednames is set | 0 | R | the status of the <n>-th coil starting at address is off |
| 1 | R | the status of the <n>-th coil starting at address is on | |
| unitid.address.error or unitid.address.01.error if extendednames is set | 0, null, >0 | R | the error status. 0: no error,null unknown error; >0: modbus exception code |
The <n> value after readcoils: can also be a variable, that will be replaced with its numeric content, for example:
IO modbus.27.400 = readcoils:$number
Read Discrete Inputs
Reads from 1 to 2000 contiguous discrete inputs, using function code 02. Each input returns a binary value, 0 or 1, in distinct data points, one for each coil.
| ID | Value | R/W | Description |
|---|---|---|---|
| unitid.address | readdiscreteinputs:<n> | W | executes the Read Discrete Inputs function, reading <n> inputs |
| unitid.address.1 ... unitid.address.<n> or unitid.address.02.<n> if extendednames is set | 0 | R | the status of the <n>-th input starting at address is off |
| 1 | R | the status of the <n>-th input starting at address is on | |
| unitid.address.error or unitid.address.02.error if extendednames is set | 0, null, >0 | R | the error status. 0: no error,null unknown error; >0: modbus exception code |
The <n> value after readdiscreteinputs: can also be a variable, that will be replaced with its numeric content, for example:
IO modbus.27.400 = readdiscreteinputs:$number
Read Holding Registers
Reads one data point, using function code 03 to read the appropriate number of registers, based on the data type.
Each reading returns a single value, but you can also use an extended read function to read multiple consecutive values with one single Modbus read function, by adding :<n> at the end of readholdingregisters:<format>, where <n> is the number of values.
| ID | Value | R/W | Description |
|---|---|---|---|
| unitid.address | readholdingregisters:ushort | W | executes the Read Holding registers function, reading 1 register and interpreting the data as an unsigned short integer |
| unitid.address | readholdingregisters:uint | W | executes the Read Holding registers function, reading 2 consecutive registers and interpreting the data as an unsigned integer |
| unitid.address | readholdingregisters:ulong | W | executes the Read Holding registers function, reading 4 consecutive registers and interpreting the data as an unsigned long integer |
| unitid.address | readholdingregisters:short | W | executes the Read Holding registers function, reading 1 register and interpreting the data as a signed short integer |
| unitid.address | readholdingregisters:int | W | executes the Read Holding registers function, reading 2 consecutive registers and interpreting the data as a signed integer |
| unitid.address | readholdingregisters:long | W | executes the Read Holding registers function, reading 4 consecutive registers and interpreting the data as a signed long integer |
| unitid.address | readholdingregisters:bitshort | W | executes the Read Holding registers function, reading 1 register and interpreting the data as 16 individual bits |
| unitid.address | readholdingregisters:bitint | W | executes the Read Holding registers function, reading 2 consecutive registers and interpreting the data as 32 individual bits |
| unitid.address | readholdingregisters:bitlong | W | executes the Read Holding registers function, reading 4 consecutive registers and interpreting the data as 64 individual bits |
| unitid.address | readholdingregisters:float | W | executes the Read Holding registers function, reading 2 consecutive registers and interpreting the data as a floating-point number using the IEEE Standard 754 representation |
| unitid.address or unitid.address.03 if extendednames is set | the returned value, according to the requested data type | R | this is the value read using the Read Holding Registers function |
| unitid.address.<n> or unitid.address.03.<n> if extendednames is set | the returned bit value, with <n> from 1 to 16, 32 or 64 | R | this is the value read using the Read Holding Registers function with bitshort, bitint or bitlong format options |
| unitid.address.error or unitid.address.03.error if extendednames is set | 0, null, >0 | R | the error status. 0: no error,null unknown error; >0: modbus exception code |
Read Input Registers
Reads one data point, using function code 04 to read the appropriate number of registers, based on the data type.
Each reading returns a single value, but you can also use an extended read function to read multiple consecutive values with one single Modbus read function, by adding :<n> at the end of readinputregisters:<format>, where <n> is the number of values.
| ID | Value | R/W | Description |
|---|---|---|---|
| unitid.address | readinputregisters:ushort | W | executes the Read Input registers function, reading 1 register and interpreting the data as an unsigned short integer |
| unitid.address | readinputregisters:uint | W | executes the Read Input registers function, reading 2 consecutive registers and interpreting the data as an unsigned integer |
| unitid.address | readinputregisters:ulong | W | executes the Read Input registers function, reading 4 consecutive registers and interpreting the data as an unsigned long integer |
| unitid.address | readinputregisters:short | W | executes the Read Input registers function, reading 1 register and interpreting the data as a signed short integer |
| unitid.address | readinputregisters:int | W | executes the Read Input registers function, reading 2 consecutive registers and interpreting the data as a signed integer |
| unitid.address | readinputregisters:long | W | executes the Read Input registers function, reading 4 consecutive registers and interpreting the data as a signed long integer |
| unitid.address | readinputregisters:bitshort | W | executes the Read Input registers function, reading 1 register and interpreting the data as 16 individual bits |
| unitid.address | readinputregisters:bitint | W | executes the Read Input registers function, reading 2 consecutive registers and interpreting the data as 32 individual bits |
| unitid.address | readinputregisters:bitlong | W | executes the Read Input registers function, reading 4 consecutive registers and interpreting the data as 64 individual bits |
| unitid.address | readinputregisters:float | W | executes the Read Input registers function, reading 2 consecutive registers and interpreting the data as a floating-point number using the IEEE Standard 754 representation |
| unitid.address or unitid.address.04 if extendednames is set | the returned value, according to the requested data type | R | this is the value read using the Read Input Registers function |
| unitid.address.<n> or unitid.address.04.<n> if extendednames is set | the returned bit value, with <n> from 1 to 16, 32 or 64 | R | this is the value read using the Read Input Registers function with bitshort, bitint or bitlong format options |
| unitid.address.error or unitid.address.04.error if extendednames is set | 0, null, >0 | R | the error status. 0: no error,null unknown error; >0: modbus exception code |
Write Coils
Writes a single coil, using function code 05, or multiple coils, using function 15.
| ID | Value | R/W | Description |
|---|---|---|---|
| unitid.address | bit:0 bit:false bit:off | W | executes the Write Single Coil function, setting the coil to off |
| bit:1 bit:true bit:on | W | executes the Write Single Coil function, setting the coil to on | |
| bits:<0|1|-... | W | executes the Write Multiple Coils function, setting consecutive coils based on the binary sequence. The left-most bit in the sequence is the first coil | |
unitid.address.<n> or unitid.address.05. <n> if extendednames is set | 0 | R | the write function returned a correct response, and the new status of the coil is off |
| 1 | R | the write function returned a correct response, and the new status of the coil is on | |
unitid.address.<n> or unitid.address.05. <n> if extendednames is set | 0,null,>0 | R | the error status. 0: no error; null: unknown error; >0: modbus exception code |
The value after bit: and bits: can also be a variable, that will be replaced with its numeric content, for example:
IO modbus.27.1220 = bit:$value
Write Registers
Writes registers, using function code 06 or 16, based on the data type.
| ID | Value | R/W | Description |
|---|---|---|---|
| unitid.address | ushort:<value> | W | executes the Write Single Register function, writing an unsigned short number |
| unitid.address | uint:<value> | W | executes the Write Multiple Registers function, writing an unsigned integer number to two adjacent registers |
| unitid.address | ulong:<value> | W | executes the Write Multiple Registers function, writing an unsigned long number to four adjacent registers |
| unitid.address | short:<value> | W | executes the Write Single Register function, writing a signed short number |
| unitid.address | int:<value> | W | executes the Write Multiple Registers function, writing a signed integer number to two adjacent registers |
| unitid.address | long:<value> | W | executes the Write Multiple Registers function, writing a signed long number to four adjacent registers |
| unitid.address | float:<value> | W | executes the Write Multiple Registers function, writing a floating-point number using the IEEE Standard 754 representation to two adjacent registers |
| unitid.address | hex:<value> | W | executes the Write Multiple Registers function, writing an array of bytes passed in <value> as a hexadecimal string. The <value> string length should be a multiple of 4, as four bytes represent the two bytes in each register |
| unitid.address or unitid.address.06 unitid.address.16 if extendednames is set | the written value, according to the requested data type | R | the write function returned a correct response |
| unitid.address.error or unitid.address.06.error unitid.address.16.error if extendednames is set | 0, null, >0 | R | the error status. 0: no error; null: unknown error; >0: modbus exception code |
The value after short:, int: etc. can also be a variable, that will be replaced with its numeric content, for example:
IO modbus.27.1220 = int:$value
About bitshort naming convention
This table shows the correspondence between the bits of the Modbus PDU and the bits in the HSYCO datapoint table when HSYCO executes the Read Holding or Input Registers function, reading one register and interpreting the data as 16 individual bits.
| bit15 | bit14 | bit13 | bit12 | bit11 | bit10 | bit9 | bit8 | bit7 | bit6 | bit5 | bit4 | bit3 | bit2 | bit1 | bit0 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| .8 | .7 | .6 | .5 | .4 | .3 | .2 | .1 | .16 | .15 | .14 | .13 | .12 | .11 | .10 | .9 |
Examples
Reading an integer value from two registers
TIME: IO modbus.27.400 = readholdingregisters:uint
IO modbus.27.400 : UISET mydata.text = IO modbus.27.400
The first line executes the read holding registers function on a Modbus device with address 27, reading two contiguous registers starting at address 400.
The second line sets a text object of the Web interface with the value read from the Modbus device.
Reading several values at once
TIME: IO modbus.27.220 Modbus.27.222 Modbus.27.224 = readinputregisters:float
IO modbus.27.220 : UISET mydata1.text = IO modbus.27.220
IO modbus.27.224 : UISET mydata1.text = IO modbus.27.224
The first line is a compact form for reading multiple data points.
Reading binary data
TIME: IO modbus.27.1000 = readdiscreteinputs:24
IO modbus.27.1000.1 = 0 : UISET mylabel1.color = g
IO modbus.27.1000.1 = 1 : UISET mylabel1.color = r
...
IO modbus.27.220.24 = 0 : UISET mylabel24.color = g
IO modbus.27.220.24 = 1 : UISET mylabel24.color = r
The first line executes the read discrete inputs function on a Modbus device with address 27, reading two contiguous registers starting at address 1000 and interpreting the first 24 bits as binary values.
The following lines change the color of some objects of the Web interface to green if the bit status is 0 or red if the status is 1.
Reading in extended mode
If the option extendednames was specified in System Settings:
TIME: IO modbus.27.1000 = readholdingregisters:ushort
IO modbus.27.1000.03 : UISET mydata.text = IO modbus.27.1000.03
The first line executes the read holding register function for an ushort value on a Modbus device with address 27, reading the registers 1000.
The following line changes the attribute text of a text object setting it to the value just read.
Writing a single coil
TIME : IO modbus.27.1220 = bit:1
Set coil 1220 to on.
Writing multiple coils
TIME : IO modbus.27.1220 = bits:100
Set three coils starting from 1220 to 1, 0, 0.
Writing registers
TIME : IO modbus.27.210 = ushort:2048
TIME : IO modbus.27.220 = float:-123.22
TIME : IO modbus.27.230 modbus.27.240 = long:200000000
The first line executes the write single register on a Modbus device with address 27, writing the register at address 210 with an unsigned short number.
The second line executes the write multiple registers on a Modbus device with address 27, writing two consecutive registers starting at address 220 with an IEEE-754 floating-point number.
The third line executes the write multiple registers on a Modbus device with address 27, writing four consecutive registers starting at address 230 and four at 240 with a signed long number.
Release Notes
3.8.0
- improved accuracy of frame spacing
- the Modbus TCP server / Modbus RTU master gateway now handles custom functions using the serial port timeout, instead of the fixed 100ms timeout used in previous versions
3.7.0
- new "tcpmodbuseventunitid" option. When the Modbus TCP gateway option is enabled, setting tcpmodbuseventunitid to a Unit Id value (0 to 255) will redirect all TCP requests to that Unit Id to the ModbusEvent() callback instead of the Modbus RTU serial bus
- high-availability: when "shutdown when inactive" is true and the HSYCO Server is inactive, all Modbus calls are affectively blocked, and return null. The TCP gateway is also blocked
- fixed a bug causing conversion errors when reading 4 consecutive registers with "longx" or "ulongx" data types
3.6.0
- new Modbus Utility scheduler engine, for automatic scheduling and sequencing of Modbus requests
- new Modbus Utility configuration interface
- the Write Registers data point format now accepts values passed as hexadecimal strings
- performance and stability improvements of the Modbus TCP client communication
- Modbus TCP server / Modbus RTU master gateway:
- *new "tcpgatewayblacklist" option for IP address based black lists
- *new "tcpgatewaywhitelist" option for IP address based white lists
- *new "tcpgatewaypriority" option for IP address based priority support
- *new "tcpgatewaytimeout" option to set the maximum response timeout
3.5.1
- new "frameinterval" option to set fixed silence interval before each message
- new "tcpgatewayaddress" and "tcpgatewayport" options to enable the Modbus TCP server / Modbus RTU master gateway
3.5.0
- new data types "intx", "longx", "uintx", "ulongx", "floatx" to implement low word first data encoding
3.4.0
- added support for function 23, Read/Write Multiple Registers:
- *modbusReadWriteMultipleRegisters() Java method and JavaScript function
3.3.0
- added support for Write Multiple Coils function:
- *writeMultipleCoils() Java method and JavaScript function
- *ID.unitid.address = bits:<0|1>... in EVENTS
3.2.1
- EVENTS: minor fixes to the readcoils and readdiscreteinputs actions
3.2.0
- reading multiple consecutive values with a single Modbus read is now supported for readholdingregisters and readinputregisters
3.1.1
- using format options bitshort, bitint and bitlong for readholdingregisters and readinputregisters, it is now possible to read 1, 2 or 4 registers and return the individual bit values
3.1.0
- new error events on Modbus read or write errors
- new option extendedNames. When this option is set, data point names used to return values will have the postfix .FF, where FF is the 2-digit decimal function code
3.0.3
- fixes to the Modbus write functions
- variables can now be used in value strings
3.0.0
- initial release
Modbus is a registered trademark of Modbus Organization, Inc.