Template:Networking rutos manual modbus

The information in this page is updated in accordance with firmware version .

Summary

Modbus is a serial communications protocol. Simple and robust, it has become a de facto standard communication protocol and is now a commonly available means of connecting industrial electronic devices.

This manual page provides an overview of the Modbus functionality in {{{name}}} devices.

Note: Modbus TCP Server/Client and MQTT Gateway is additional software on some devices that can be installed from the System → [[{{{name}}} Package Manager|Package Manager]] page.

Modbus TCP Server

A Modbus TCP Server listens for connections from a TCP Client (client) and sends out a response or sets some system related parameter in accordance with the given query. This provides the user with the possibility to set or get system parameters.

The figure below is an example of the Modbus TCP Server window section and the table below provides information on the fields contained in that window:

General

Status section displays Modbus TCP Server status information:

Under the status section, you can configure the main server settings:

Field	Value	Description
Enable	off | on; default: off	Turns Modbus TCP on or off.
Port	integer [0..65535]; default: 502	TCP port used for Modbus communications.
Device ID	integer [0..255]; default: 1	The device's Modbus server ID. When set to 0, it will respond to requests addressed to any ID.
Mobile Data type	Bytes | Kilobytes | Megabytes; default: Bytes	Selects mobile data unit representation type.
Allow remote access	off | on; default: off	Allows remote Modbus connections by adding an exception to the device's firewall on the port specified in the field above.
Enable broadcasts	off | on; default: off	Process incoming Modbus broadcast messages.
Keep persistent connection	off | on; default: onn	Allows keep the connection open after responding a Modbus TCP client request.
Connection timeout	integer [0..60]; default: 0	Sets TCP timeout in seconds after which the connection is forcefully closed.
Enable custom register block	off | on; default: off	Allows the usage of custom register block.
Register file path	path; default: /mnt/regfile	Path to file in which the custom register block will be stored. Files inside /tmp or /var are stored in RAM. They vanish after reboot, but do not degrade flash memory. Files elsewhere are stored in flash memory. They remain after reboot, but degrade flash memory (severely, if operations are frequent).
First register number	integer [1025..65536]; default: 1025	First register in custom register block
Register count	integer [1..64512]; default: 128	Register count in custom register block

Data Sources

Data sources transmit data from one or more data sources (can be a Modbus client) and write it to Modbus registers.

To add new data source, press `Add` button:

Register configuration:

Field	Value	Description
Enable	off | on; default: off	Turns Register configuration on or off.
Register name	string; default: none	Name of the register.
Register source	list; default: none	Client service which will be sending requests.
Register value	list and permissions type; default: none	Request value and its permissions (Read-Only, Write-Only or Read-Write).
Register range	integer [1..65535]; default: none	Specify the start index and count for the range.
Register type	Binary | String | Bool | INT8 | UINT8 | INT16 | UINT16 | INT32 | UINT32 | INT64 | UINT64 | FLOAT32 | FLOAT64; default: Binary	Value data type.
Register size (with Binary and String data)	integer [1..8064]; default: none	Size of the value in bytes.
Modbus register range	integer; default: none	Start and calculated end of the register numbers.
Modbus data type	Coils (1) | Input coils (2) | Holding registers (3) | Input registers (4); default: Coils (1)	Modbus function code to be used for this request.

Modbus Registers

Get Parameters

---

Modbus parameters are held within registers. Each register contains 2 bytes of information. For simplification, the number of registers for storing numbers is 2 (4 bytes), while the number of registers for storing text information is 16 (32 bytes).

The register numbers and corresponding system values are described in the table below:

required value	register address	register number	number of registers	representation
System uptime	1	2	2	32 bit unsigned integer
System hostname	7	8	16	ASCII
Serial number	39	40	16	ASCII
LAN MAC address	55	56	16	ASCII
Device name	71	72	16	ASCII
WAN IP address	139	140	2	8 bit unsigned integer
Unix timestamp	364	365	2	32 bit unsigned integer
Local ISO time	366	367	12	ASCII
UTC time	378	379	12	ASCII
LAN IP	394	395	2	16 bit unsigned integer

Set Parameters

---

The Modbus daemon can also set some device parameters.

value to set	register address	register number	register value	description
Hostname	7	8	Hostname (in decimal form)	Changes hostname
Device name	71	72	Device name (in decimal form)	Changes device name
Reboot	206	207	1	Reboots the router
Change LAN IP	394	395	IPv4 (in decimal form)	Changes device LAN IP

Modbus TCP Client

A Modbus TCP Client can request data from Modbus servers. The Modbus TCP devices section is used to configure Modbus TCP servers and enable Client.

Notice the Global section config. It is used to outright turn the service off or on if any active configurations are present.

Clicking the Cog icon opens a modal window. The global configuration slider can be set and it's state saved.

Field	Value	Description
Enabled	off | on; default: off	Turn on/off Modbus client service.
Database location	RAM ; default: RAM	Select Modbus database location.
Database size	size in KiB	Current database size.

By default, the client list is empty and client is disabled. To add a new client, click the 'Add' button

After clicking 'Add' you will be redirected to the newly added modbus device configuration page.

Field	Value	Description
Enabled	off | on; default: off	Turns communication with the server device on or off.
Name	string; default: none	Server device's name, used for easier management purposes.
Server ID	integer [0..255]; default: 1	Modbus server ID number (1-255). Note: ID 0 is a broadcast address that will target a specific server. If a true broadcast is desired request(s) must have Broadcast enabled.
IP address	ip4; default: none	Server device's IP address.
Port	integer [0..65535]; default: none	Server device's Modbus TCP port.
Timeout	integer [1..30]; default: 5	Maximum response wait time.
Always reconnect	off | on; default: off	Create new connection after every Modbus request.
Number of timeouts	integer [0..10]; default: 1	Skip pending request and reset connection after number of request failures.
Frequency	Period | Schedule; default: Period
Delay	integer [0..999]; default: 0	Wait in milliseconds after connection initialization.
Period	integer [1..99999]; default: 60	Interval in seconds for sending requests to this device
Schedule request	time format string 'hh:mm:ss'; default: none	Schedule request time (format: Hours:Minutes:Seconds).

Requests Configuration

---

A Modbus request is a way of obtaining data from Modbus servers. The client sends a request to a server specifying the function code to be performed. The server then sends the requested data back to the Modbus client.

Note: Modbus TCP Client uses Register Number instead of Register Address for pointing to a register. For example, to request the Uptime of a device, you must use 2 in the First Register field.

The Request Configuration list is empty by default. To add a new Request Configuration loon to the Add New Instance section. Enter a custom name into the 'Name' field and click the 'Add' button:

The new Request Configuration should become visible in the list:

Field	Value	Description
Name	string; default: Unnamed	Name of this Request Configuration. Used for easier management purposes.
Data type	8bit INT | 8bit UINT | 16bit INT, high byte first | 16bit INT, low byte first | 16bit UINT, high byte first | 16bit UINT, low byte first | 32bit float (various Byte order) | 32bit INT (various Byte order) | 32bit UINT (various Byte order) | 64bit INT (various Byte order) | 64bit UINT (various Byte order) | 64bit float (various Byte order) | ASCII | Hex | Bool | PDU; default: 16bit INT, high byte first	Defines how read data will be stored.
Function	Read coils (1) | Read input coils (2) | Read holding registers (3) | Read input registers (4) | Set single coil (5) | Set single coil register (6) | Set multiple coils (15) | Set multiple holding registers (16); default: Read holding registers (3)	Specifies the type of register being addressed by a Modbus request.
First Register	integer [0..65535]; default: 1	First Modbus register from which data will be read.
Register Count / Values	integer [1..2000]; default: 1	Number of Registers/Coils/Inputs or actual values to be written (Multiple values must be separated by space character).
No brackets	off | on; default: off	Removes the starting and ending brackets from the request (only for read requests).
Store on change only	off | on; default: off	Store the response only if the value has changed.
Broadcast	off | on; default: off	Enable to broadcast the request to all devices (only for write requests).
Enabled	off | on; default: off	Turns the request on or off.
Actions	- (interactive button)	Deletes the request.

Additional note: by default the newly added Request Configurations are turned off. You can use the on/off slider to the right of the Request Configuration to turn it on:

---

After having configured a request, you should see a new 'Request Configuration Testing' section appear. It is used to check whether the configuration works correctly. Simply click the 'Test' button and a response should appear in the box below. Note: to use test buttons, you need to enable Client section. A successful response to a test may look something like this:

Alarms Configuration

---

Alarms are a way of setting up automated actions when some Modbus values meet user-defined conditions. When the Modbus TCP Client (this {{{name}}} device) requests some information from a server device it compares that data to with the parameters set in an Alarm Configuration. If the comparison meets the specified condition (more than, less than, equal to, not equal to), the Client performs a user-specified action, for example, a Modbus write request or switching the state of an output.

The figure below is an example of the Alarms Configuration list. To create a new Alarm, click the 'Add' button.

After adding the Alarm you should be redirected to its configuration page which should look similar to this:

Field	Value	Description
Enabled	off | on; default: off	Turns the alarm on or off.
Function code	Read Coil Status (1) | Read Input Status (2) | Read Holding Registers (3) | Read Input Registers (4); default: Read Coil Status (1)	Modbus function used for this alarm's Modbus request. The Modbus TCP Client (this {{{name}}} device) perform this request as often as specified in the 'Period' field in Server Device Configuration.
Compared condition data type	8bit INT | 8bit UINT | 16bit INT, high byte first | 16bit INT, low byte first | 16bit UINT, high byte first | 16bit UINT, low byte first | 32bit float (various Byte order) | 32bit INT (various Byte order) | 32bit UINT (various Byte order) | 64bit INT (various Byte order) | 64bit UINT (various Byte order) | 64bit float (various Byte order) | ASCII | Hex | Bool; default: 16bit INT, high byte first	Select data type that will be used for checking conditions.
First register number	integer [1..65536]; default: none	Number of the Modbus coil/input/holding-register/input-register to read from.
Values	various; default: none	The value against which the read data will be compared.
Condition	More than | Less than | Equal to | Not Equal to | Less or equal | More or equal; default: More than	When a value is obtained it will be compared against the value specified in the following field. The comparison will be made in accordance with the condition specified in this field.
Action frequency	Every trigger | First trigger; default: Every trigger	Describes how frequently the specified action will be taken.
Redundancy protection	off | on; default: off	Protection against executing a configured action too often.
Redundancy protection period	integer [1..86400]; default: none	Duration to activate redundancy protection for, measured in seconds. This field becomes visible only when 'Redundancy protection' is turned on.
Action	Ubus event | Email | MODBUS Write Request | Trigger output | MQTT message; default: MODBUS Write Request	Action that will be taken if the condition is met. Possible actions: Email - sends Email to a specified recipient(s). Ubus event - sends Email to a specified recipient(s). MQTT message - sends MQTT message to a specified broker. Ubus event - sends ubus event. Modbus Request - sends a Modbus Write request to a specified server. Trigger output - changes state of selected I/O output pin.
Email: Subject	string; default: none	Subject of an email. Allowed characters (a-zA-Z0-9!@#$%&*+-/=?^_`{|}~. ).
Email: Message text	string; default: none	Message that will be sent if condition passes.
Email: Sender's email account	string; default: none	Sender's email configuration (configure it [[{{{name}}}_Administration#Recipients | here]]).
Email: Recipient's email address	email address; default: none	For whom you want to send an email to. Allowed characters (a-zA-Z0-9._%+@-).
MODBUS Write Request: IP address	ip | host; default: none	Modbus server's IP address.
MODBUS Write Request: Port	integer [0..65535]; default: none	Modbus server's port.
MODBUS Write Request: Timeout	integer [1..30]; default: 5	Maximum time to wait for a response.
MODBUS Write Request: ID	integer [1..255]; default: none	Modbus server ID.
MODBUS Write Request: Modbus function	Set Single Coil (5) | Set Single Register (6) | Set Multiple Coils (15) | Set Multiple Registers (16); default: Set Single Coil (5)	A function code specifies the type of register being addressed by a Modbus request.
MODBUS Write Request: Executed action data type	8bit INT | 8bit UINT | 16bit INT, high byte first | 16bit INT, low byte first | 16bit UINT, high byte first | 16bit UINT, low byte first | 32bit float (various Byte order) | 32bit INT (various Byte order) | 32bit UNIT (various Byte order) 64bit INT (various Byte order) | 64bit UINT (various Byte order) | 64bit float (various Byte order) | ASCII | Hex | Bool; default: Bool	Select data type that will be used for executing action.
MODBUS Write Request: First register number	integer [0..65535]; default: none	Begins reading from the register specified in this field.
MODBUS Write Request: Values	integer [0..65535]; default: none	Register/Coil values to be written (multiple values must be separated by space character).
Trigger output: Output	Selects which output will be triggered.
Trigger output: I/O Action	Turn On | Turn Off | Invert; default: Turn On	Selects the action performed on the output.
MQTT message: JSON format	string; default: none	Below this field you can find special codes that begin with the '%' sign. Each code represents a piece information related to the status of the device. Include these codes in the field for dynamic information reports. Possible values: Local time, Unix time, Router name, Device name, Serial number, Current FW version, LAN IP address, Monitoring status, UTC time in ISO, WAN IP address, New line, Modbus server ID, Modbus server IP, First register number, Register value, Mobile IP addresses, Signal strength, Operator name, Network type, Data connection state, Network state, IMSI, IMEI, Modem model, Modem serial number, SIM pin state, SIM state, RSCP, ECIO, RSRP, SINR, RSRQ, ICCID, CELLID, Neighbour cells, Network info, Network serving, WAN MAC address, Analog Current Loop (6,9), Analog Input (6,9), Input (3), Digital Input (1), Output (4), Isolated Output (3,4,8), Isolated Input (2,7), Relay (5,10)
MQTT message: Hostname	host | ip; default: none	Broker’s IP address or hostname.
MQTT message: Port	integer [0..65535]; default: 1883	Broker's port number.
MQTT message: Keepalive	positive integer; default: none	The number of seconds after which the broker should send a PING message to the client if no other messages have been exchanged in that time
MQTT message: Topic	string; default: none	The name of the topic that the broker will subscribe to.
MQTT message: Client ID	positive integer; default: none	Client ID to send with the data. If empty, a random client ID will be generated
MQTT message: QoS	At most once (0) | At least once (1) | Exactly once (2); default: At most once (0)	A period of time (in seconds) which has to pass after a trigger event before this Action is executed.
MQTT message: Use root CA	off | on; default: off	Use root CA for verifying the servers certificates
MQTT message: Use TLS	off | on; default: off	Turns the use of TLS/SSL for this MQTT connection on or off.
MQTT message: Use credentials	off | on; default: off	Turns the use of username and password for this MQTT connection on or off.

MQTT Modbus Gateway

The MQTT Modbus Gateway function is used to transfer Modbus data (send requests, receive responses) over MQTT. When it is enabled, the device (this {{{name}}}) subscribes to a REQUEST topic and publishes on a RESPONSE topic on a specified MQTT broker. It translates received MQTT message payload to a Modbus request and relays it to the specified Modbus TCP server.

When the MQTT Gateway receives a response from the server, it translates it to an MQTT message and publishes it on the RESPONSE topic.

Below is an example of the MQTT Gateway page. Refer to the table for information on MQTT Gateway configuration fields and status.

Field	Value	Description
Enable	off | on; default: off	Turns MQTT gateway on or off.
Host	ip | host; default: 127.0.0.1	IP address or hostname of an MQTT broker.
Port	integer [0..65535]; default: 1883	Port number of the MQTT broker.
Message type	ASCII | JSON; default: ASCII	Format in which requests and responses will be sent to MQTT broker.
Request topic	alphanumeric string; default: request/$$SERIAL	Topic name. Constants: Serial number: $$SERIAL Mac address: $$MAC Device name: $$NAME
Response topic	alphanumeric string; default: response/$$SERIAL	Topic name. Constants: Serial number: $$SERIAL Mac address: $$MAC Device name: $$NAME
QoS	At most once (0) | At least once (1) | Exactly once (2); default: Exactly once (2)	Specifies quality of service.
Username	string; default: none	Username for authentication to the MQTT broker.
Password	string; default: none	Password for authentication to the MQTT broker.
Client ID	integer; default: none	Specifies client ID for MQTT broker.
Keepalive	integer; default: 5	Keepalive message to MQTT broker (seconds)
Use TLS/SSL	off | on; default: off	Turns TLS support on or off
TLS type	Certificate based | Pre-Shared-Key based; default: Certificate based	Selects the type of TLS encryption
TLS insecure	off | on; default: off	Disables TLS security
Certificate files from device	off | on; default: off	Choose this option if you want to use certificate files generated on device.
CA file	string; default: none	Upload/select certificate authority file.
Certificates file	string; default: none	Upload/select certificate file.
Key file	string; default: none	Upload/select key file.
PSK	string; default: none	Specifies the pre-shared key.
Identity	string; default: none	Specifies identity.

Request messages

---

Note: MQTT Gateway uses Register Number instead of Register Address for pointing to a register. For example, to request the Uptime of a device, you must use 2 in the Register Number field.

Modbus request data sent in the MQTT payload should be generated in accordance with the one of the following formats:

• TCP:

 0 <COOKIE> <IP_TYPE> <IP> <PORT> <TIMEOUT> <SERVER_ID> <MODBUS_FUNCTION> <FIRST_REGISTER> <REGISTER_COUNT/VALUES> <BROADCAST>

• Serial:

 1 <COOKIE> <SERIAL_DEVICE_ID> <TIMEOUT> <SERVER_ID> <MODBUS_FUNCTION> <FIRST_REGISTER> <REGISTER_COUNT/VALUES> <BROADCAST>

• MODBUS TCP connection management messages:

 2 <COOKIE> <CONNECTION_INDEX> <ACTION>

 2 <COOKIE> <CONNECTION_INDEX> 0 <IP_TYPE> <IP> <PORT> <TIMEOUT>

Explanation:

• Cookie - a 64-bit unsigned integer in range [0..2⁶⁴-1]). A cookie is used in order to distinguish which response belongs to which request, each request and the corresponding response contain a matching cookie: a 64-bit unsigned integer.
• IP type - host IP address type. Possible values:
  • 0 - IPv4 address;
  • 1 - IPv6 address;
  • 2 - hostname that will be resolved to an IP address.
• IP - IP address of a Modbus TCP server. IPv6 must be presented in full form (e.g., 2001:0db8:0000:0000:0000:8a2e:0370:7334).
• Port - port number of the Modbus TCP server.
• Timeout - timeout for Modbus connection, in seconds. Range [1..999].
• Server ID - Modbus TCP server ID. Range [1..255].
• Modbus function - Modbus task type that will be executed. Possible values are:
  • 1 - read coils;
  • 2 - read input coils;
  • 3 - read holding registers;
  • 4 - read input registers;
  • 5 - set single coil;
  • 6 - write to a single holding register;
  • 15 - set multiple coils;
  • 16 - write to multiple holding registers.
• First register - number (not address) of the first register/coil/input (in range [1..65536]) from which the registers/coils/inputs will be read/written to.
• Register count/value - this value depends on the Modbus function:
  • 1 - coil count (in range [1..2000]); must not exceed the boundary (first coil number + coil count <= 65537);
  • 2 - input count (in range [1..2000]); must not exceed the boundary (first input number + input count <= 65537);
  • 3 - holding register count (in range [0..125]); must not exceed the boundary (first register number + holding register count <= 65537);
  • 4 - input register count (in range [0..125]); must not exceed the boundary (first register number + input register count <= 65537);
  • 5 - coil value (in range [0..1]);
  • 6 - holding register value (in range [0..65535]);
  • 15 - coil count (in range [1..1968]); must not exceed the boundary (first coil number + coil count <= 65537); and coil values separated with commas, without spaces (e.g., 1,2,3,654,21,789); there must be exactly as many values as specified (with coil count); each value must be in the range of [0..1].
  • 16 - register count (in range [1..123]); must not exceed the boundary (first register number + register count <= 65537); and register values separated with commas, without spaces (e.g., 1,2,3,654,21,789); there must be exactly as many values as specified (with register count); each value must be in the range of [0..65535].
• Broadcast - number used to identify that the broadcast is ON (in range [0..1]). Note: that broadcast flag is not ignored only when 5,15,6,16 Modbus functions are used.
  • 0 - if 0 or not specified - message will be sent only to a Modbus server, that matches the provided <SERVER_ID> in the message.
  • 1 - message will be sent to all available Modbus servers on the network.
• Serial device ID - a string used to identify a serial device. Must match with Device ID field in MQTT Gateway page Serial gateway configuration section.
• Connection index - a number used to identify a connection on which an action will be preformed (in range [0..7]).
• Action - a connection action. Possible values are:
  • 0 - OPEN. This will open a closed connection, reopen an already open connection with the same parameters or close an already open connection and open a new one with new parameters.
  • 1 - CLOSE. This will close an open connection and do nothing to the closed one.
  • 2 - STATUS. This will respond with either OK 1 for an open connection or OK 0 for a closed connection.

Response messages

---

A special response message can take one of the following forms:

<COOKIE> OK                              - for functions 6 and 16
<COOKIE> OK <VALUE> <VALUE> <VALUE>...   - for function 3, where <VALUE> <VALUE> <VALUE>... are read register values
<COOKIE> ERROR: ...                      - for failures, where ... is the error description

Examples

---

Below are a few examples of controlling/monitoring the internal Modbus TCP Server on {{{name}}}.

---

Reboot the device

• Request:
  

  0 65432 0 192.168.1.1 502 5 1 6 206 1

• Response:
  

  65432 OK

---

Retrieve uptime

• Request:
  

  0 65432 0 192.168.1.1 502 5 1 3 2 2

• Response:
  

  65432 OK 0 5590

---

If you're using Eclipse Mosquitto (MQTT implementation used on {{{name}}}), Publish/Subscribe commands may look something like this:

Retrieve uptime

• Request:
  

  mosquitto_pub -h 192.168.1.1 -p 1883 -t request -m "0 65432 0 192.168.1.1 502 5 1 3 2 2"

• Response:
  

  mosquitto_sub -h 192.168.1.1 -p 1883 -t response
  65432 OK 0 5590

See also

• Monitoring via Modbus - detailed examples on how to use Modbus TCP

[[Category:{{{name}}} Services section]]