ModbusTCP Protocol Driver Version 1.1 Application Guide
ModbusTCP Protocol Driver Version 1.1 Application Guide
In addition to the driver-specific application guides, a user guide is available. The enteliBRIDGE
Gateway User Guide focuses on general information about the web interface that is not specific
to a particular driver. When you click the Help Question mark button in the upper right area of
the web interface, the User Guide PDF file opens in a separate window.
This section describes the specifications and basic data structure and communication models
for the Modbus protocol driver. It is assumed that you have the enteliBRIDGE Gateway User
Guide available and are familiar with its content. The user guide provides general information
that is not specific to a protocol driver and focuses on doing tasks using the web interface.
Assumptions
You have:
Component Description
Capacity Up to 30,000 Modbus points total mapped to BACnet virtual devices
*Capacities listed have with: 250 virtual devices max
been tested but actual 1300 points max per virtual device
limits may vary depending Trend up to 5000 mapped points
on site configurations.
Modbus Data Types Coils (0xxxx references),
Read (01), Write Single (05)
Discrete Inputs (1xxxx references),
Read (02)
Input Registers (3xxxx references),
Read (04)
Holding Registers (4xxxx references)
Read (03), Write Single (06), Write Multiple (16)
If the Modbus device doesn’t support the Read/Write Multiple
service then the Read/Write Single service will automatically be
used.
There is no 2xxxx address prefix.
Data Types / Data Model Bit, UINT16, UINT32, UINT64, INT16, INT32, INT64, Float, Chars,
Lenchars, MASK16, MASK32, MASK64
Settable byte orders
Supports scaling, offsetting and bit masking
BACnet Objects Analog Input, Binary Input, Multi-State Input,
Analog Output, Binary Output, Multi-State Output,
Analog Value, Binary Value, Multi-State Value,
Large Analog Value, Integer Value, Positive Integer Value,
Bit String Value, Character Value, Octet String Value
Date Value, Time Value, Date Time Value.
Supported Devices
You can save time in setting up a device by using an existing GWF object that was created for
that device. Sometimes an existing GWF provides a reasonable start and you can then modify it
to suit your application if required. The Delta Exchange (http://deltaexchange.deltacontrols.com/)
has a repository of freely available GWF templates that can be searched and downloaded to the
gateway.
ModbusTCP products come in two main types: gateways to Modbus controllers, and native
ModbusTCP controllers. The Delta ModbusTCP gateway connects to both types of controllers.
This version of the ModbusTCP protocol driver does not accept serial Modbus RTU or ASCII
communications directly so it would rely on a Modbus gateway to translate between RTU or
ASCII and TCP.
When using the enteliBRIDGE gateway to connect through a ModbusTCP gateway to serial
Modbus controllers, a virtual device is created for each Modbus controller. For native
ModbusTCP controllers, a single virtual device is created for each controller. The enteliBRIDGE
gateway can connect to a mixture of both types.
Modbus is a simple protocol that allows access to collections of binary data (coils or discrete
inputs) and other data (holding registers and input registers). Registers are 2 byte values that
can be combined to provide support for larger values. Common larger values include 4 byte or 8
byte signed and unsigned integer values, 4 byte floating point values, and character strings. All
of these types are supported by the gateway. The gateway also allows for bit fields from within
registers to be accessed.
While the current Modbus specification does provide direction on byte ordering, historically it
did not and many products exist that do not use the standard byte ordering on the wire. The
Delta gateway allows for byte ordering to be specified for each data value.
The enteliBRIDGE system can organize the data into logical devices for effective interactions
between the BACnet and Modbus networks. Modbus device formats provide a simple mapping
template for each device type and you can bring similar devices online by just defining the IP
address and format selection.
The driver has a heartbeat configuration function which provides a way to handle slave devices
that do not support a COIL at address 0. By default, the driver pings the first coil to verify
communications with a slave device if this heartbeat configuration feature is inactive. The
heartbeat provides a way to ping a specific register or coil as defined in the Heartbeat Read
Mapping entry on the Configuration tab of each GWD. See the GWD Heartbeat Configuration
Function topic.
The Modbus protocol driver provides the ability to interact with Modbus devices as virtual
BACnet® devices in your building automation system. As the system allows for up to 250
Modbus devices and a total of 30,000 mappings, the ability to organize the data into logical
devices is crucial for effective interactions between the BACnet and Modbus networks. Modbus
device formats (GWF object) provide a simple mapping template for each device type and you
can bring similar devices online by just defining the IP address and format selection. Each
defined Modbus device can only reference a single Modbus Device Format (GWF).
Modbus devices regularly use scaling to return integer-based values for non-integer based
data. The ModbusTCP protocol driver allows for scaling to be defined in the mapping of the
register to a BACnet point so that the appropriately scaled data is presented to the user. It also
allows for bits to be extracted to Binary Variables or enumerated lists to Multi-state variables,
thereby providing a much more intuitive environment for the end user to consume the data
being presented.
Licensing
The protocol drivers use a licensing model based on the number of points used. After an initial
trial period, the number of points needed for the working application can be determined and the
license finalized. The Modbus Protocol Driver Catalog Sheet describes licensing and the point
count calculation.
See the enteliBRIDGE User Guide for explanation of the Licensing tab
located on the web interface Landing page.
Useful Tools
Several useful free tools:
Each byte has 8 bits and a single register consists of 2 bytes or 16 bits.
See Appendix A: Modbus Basics Tutorial for more info.
Scaling
Many Modbus devices represent data as a scaled value in order to constrain the data to a single
register. For example, a temperature of 72.5 would be represented as 725. You need to know
how the device treats data. Most manufacturers provide a register table in their documentation.
The ModbusTCP driver can handle the scaling of registers, reading or writing, so that the value
presented to the user in BACnet matches reality.
Modbus Registers
Register Read/ Write Function
Coils (0xxxx references) Read (01), Write Single (05)
Discrete Inputs (1xxxx references) Read (02)
Input Registers (3xxxx references) Read (04)
Holding Registers (4xxxx references) Read (03), Write Single (06), Write
Multiple (16)
If the Modbus device doesn’t support the Read/Write Multiple service then the Read/Write
Single service will automatically be used.
Modbus Functions
The ModbusTCP driver supports:
Name Modbus
Function
Read Coils 01
Read Discrete Inputs 02
Read Holding Register 03
Read Input Register 04
Write Single Coil 05
Write Single Register 06
Write Multiple Registers 16
The Steps I-V sections include basic information and more complex topics are covered in the
following sections. For Modbus terms, see Appendix D: Glossary of Modbus Terms.
The ModbusTCP driver automatically reconnects to devices when the network connection is
re-established after the connection is dropped.
The LAN ports on the enteliBRIDGE are rated at 1 gigabit speed; however its actual throughput
is determined by the slowest device connection in the network.
Some older Modbus devices have a communication limitation of reading a single data point at a
time (1 data point per message) and also requiring delays between messages.
ModbusTCP port
The network port allocated to Modbus is 502. This is the port which will typically be set by
default in all devices and is likely being used unless the site has set aside a different port for
this traffic. The designated port must be open on the network for all ModbusTCP devices to be
able to communicate.
Wiring Considerations
Often, the Modbus devices reside on an existing network. You need to understand network
wiring, arrangement, and communication. In some cases, changes to the network may be
needed to allow proper communications with the gateway.
Element Description
Max Specifies the size of the socket pool used by the GWS to
Sockets communicate with other devices. This value must be greater than
or equal to the number of different devices/ ports that the GWS
will connect to.
For example, if you have 90 GWDs in the GWS and they connect to
10 different ports on a single IP address, then Max Sockets should
be set to 10 or higher.
Do not set this value too high as the enteliBRIDGE does not
support more than 1024 sockets and files to be open at once. You
must restart the enteliBRIDGE for this value to take effect.
In the GWD, the ModbusTCP Address property value has the form:
The Port and Unit parameters are optional. The Port parameter indicates the port in the
ModbusTCP device that the gateway should connect to. Port 502 is the default and is used unless
otherwise specified when setting the Modbus device's address in the GWD. If left unspecified, the
default ModbusTCP port of 502 is used. This would not normally need to be modified unless
changed at the Modbus device for network reasons.
The Unit parameter is used to select the Modbus RTU device behind the ModbusTCP device that
this GWD represents. The value represents the Modbus address and if left unspecified defaults
to an address of 1.
For subnet addressing, see the GWD Object Subnet topic in the Advanced
Features section of this document.
The ModbusTCP driver Heartbeat function sends a Read request for an item to the device. If no
response is received or specific Modbus error codes (4, 6, 10, 11) are received, the device is
marked as offline. Error codes 1, 2, 3, 5, and 8 do not affect the status the device.
http://www.simplymodbus.ca/exceptions.htm
https://en.wikipedia.org/wiki/Modbus#Exception_responses
The type of request is configured in the Device configuration page. The request target can be:
Case 1: Modbus device is a gateway (or Modbus Master) to Modbus slave RTU devices:
Case 2: Modbus device is directly controlling points (i.e. not a master to RTU slaves):
the device supports the service. If the value for either parameter is set to 0, then the driver does
not attempt to use the service with the device.
The Support Write Multiple Coils parameter is not supported at this time.
It is set to zero by default and is not changeable.
The Heartbeat Read Mapping entry is configured by the user. The entry accepts a reference to a
single REGISTER or COIL. The syntax only allows reads for a single register. The syntax is the
similar to that for the RemoteRef field in a GWF mapping entry with the notable difference that
only a single register or coil can be read.
Mappings
You create the required GWD and GWF objects manually as the ModbusTCP protocol does not
allow auto-mapping of the network. The gateway can also upload an xml configuration file.
Add a Mapping
When you add a mapping, follow the ModbusTCP Protocol Driver syntax for the Remote
Reference and Data Types fields. The syntax demands precision but does provide great
flexibility for data manipulation. Refer to the ModbusTCP specific help included after the
standard help content for a field.
separate window.
Parameter values:
<type> = COIL // binary 1 bit data type
= INPUT // read only binary 1 bit data type
= HREG // 2 byte register
= IREG // read only 2 byte register
<addr> = 1 to 65536
<count> = 1 to 255
<offset> = 1 to 255
Parameter Description
addr The number of the data item in the Modbus device. This is the 1-based address
of the data item which is the standard way of documenting Modbus coils, inputs
and registers. In contrast, the address on the wire is 0-based.
For example:
Register 40001 is the first Holding Register (but may also be referred to as
Holding Register 0 or 0000H) and is entered as HREG[1:1]
COIL[60]
The following polling with offset approach is preferred when requesting contiguous data as it is
more efficient. Less network bandwidth is required and the data collection is more rapid.
The previous HREG example does the following: (Assuming UINT16 data type)
Element Description
BIT Used with COIL and INPUT types
UINT16, UINT32, Signed and unsigned integral values. 16 bit values take a single register
UINT64, INT16, or 16 coils; 32 bit values take 2 registers or 32 coils. The 64-bit values
INT32, INT64 take 4 registers.
FLOAT 4 byte floating point value. Takes up 2 registers or 32 coils.
MASK16, MASK32, Used to retrieve bit fields from within 1 or 2 registers or 4 registers.
MASK64 Non-masked bits are written to 0, so all bits in the registers should be
masked using offset mappings ''[+0]''.
CHARS Character string value with 2 characters per register. The length
indicates the number of characters.
LENCHARS Character string value with first register being a count (number of
characters) and 2 characters per register.
Parameter Description
byte-order Indicates the order in which the bytes are on the wire where 1 = least
significant byte and 4 = most significant byte. Defaults to 4321.
length 1..32 the number of characters in a CHARS data item.
first-bit The first bit of the bit field. 0 is the least significant bit. For MASK16, the
valid bit range is 0-15. For MASK32, the valid bit range is 0-31. For
MASK64, the valid bit range is 0-63..
See the enteliBRIDGE Gateway User Guide which opens when you click
on the ? Help icon in the upper right area of the enteliBRIDGE web
interface. The PDF file opens in a separate window.
Step V: Troubleshooting
1. Confirm that the values read and decoded are correct. One approach is to pick a single
point with a known value and confirm that it reads in properly. Known values can be the
60 HZ, 120 or 240 VAC etc. Follow this approach for a single point for each of the
different data types needed for the application.
2. Recognize common problems which may involve:
• Reading the incorrect register or trying to read a register that does not exist.
• A Modbus device setup has an issue that is preventing the Gateway from seeing it.
• Older Modbus devices can communicate rather slowly and be lax in their
conformance to the Modbus standard.
Data Representation
This topic provides a visual explanation of data encoding. The Modbus standard uses a ‘big-
Endian’ representation for addresses and data items. This means that when a numerical
quantity larger than a single byte is transmitted, the most significant byte is sent first.
The following graphic shows the default 4321 byte order.
Offsets
The following are some offset examples:
HREG[4]
COIL[22:3]
[+1]
[+2]
Be careful when writing to mask data types because zeros are written to
the mapped registers to fill up the size of the mask. It is recommended
that masked data types are only used for reading and not writing.
Data Types
This section explains some additional data type operations.
The following examples show how to use the INT16*0.1 and INT32*0.1 datatypes:
Scaling Example
Consider a register that holds 9876 (decimal) with a mapping of UINT32*0.1. The value in an AV
is 987.6
Scaling applies to the numeric types only.
The following shows the syntax used for scaling of a Data Type:
*<multiplier value>
Multiplies the result read from the Modbus register before storing in the BACnet property; or
divides the BACnet value by this amount (constant numeric value only) when writing to the
Modbus register.
The <Conversion> parameter also supports addition or subtraction of a factor or a float value
from the result before it is saved as a BACnet value.
<<bits to shift
Takes the results of the read and shifts the resultant bits to the left before storing in the
BACnet property. (Integers only)
Takes the results of the read and shifts the resultant bits to the right before storing in the
BACnet property. (Integers only)
The following figure contains some sample mappings showing scaling operations for INT64
values mapped to a LAV. Mappings for a UINT64 are similar.
If a register value is shifted three bits to the right (>>3), then the result is equivalent to dividing
by 8 (2^3).
Be careful when writing to mask data types because zeros are written to
the mapped registers to fill up the size of the mask. It is recommended
that masked data types are only used for reading and not writing.
The following diagram shows the bits received, masked, and the result:
The data is: (20125 decimal) 0100 1110 1001 1101 binary
A Boolean AND function is done on the data and the mask and the result is: (157 decimal) 0000
0000 1001 1101 binary
• RemoteRef: HREG[1:4]
• DataType: CHARS(6)
The length in a CHARS is a number of characters and there are 2 characters per HREG so
HREG[1:4] allows strings up to 8 chars in length. The data is translated as UTF-8.
HREG[1:32]
[+2]
[+4]
The driver polls the register set ([1:32]) once with a single ReadMultipleRegister request and it
then uses that data to fill the variables. The example will request 32 registers starting at
register address 1. Each HREG has 2 bytes.
The gateway polls the ModbusTCP registers at appropriate time when using offsets. Consider:
The previous HREG example does the following: (Assuming UINT16 data type)
For numerical data types (i.e. UINTxx, INTxx, FLOAT), we can specify the byte order as for
example UNIT32(4321) or UNIT32(1234) or UINT32 (2143) or UINT32 (3412) indicating which way
the bytes are to be read.
For example, the ordering (4321) is used with 1, 2 and 4 register values. For instance: INT16
(4321) or INT32 (4321) or INT64 (4321). The INT64 (4321) notation actually indicates a byte order
of 87654321 and INT16 (4321) indicates a byte order of 21.
The driver supports 64-bit LAV types and this provides a good way to handle 64-bit integer
values from energy meters and other devices.
LAV.PresentValue can convert to Modbus FLOAT, LENSCHARS, CHARS and BIT fields. The
present value can display up to 15 significant digits plus the exponent.
• Bit Values
• Integers
• Floating Point Numbers
This document will explain the common ways integers and floats are encoded in a Modbus
device.
Modbus devices contain ranges of memory which can be read from and written to and are called
Registers. Registers can be thought of as being equivalent to BACnet objects like analog
variables and binary variables.
When looking at information directly inside Modbus device memory, or when looking at
information being transmitted over the RS-485 network, the values are displayed in
hexadecimal format.
Integers
If you have ever addressed a Delta controller through DNA, using the on board DIP switches,
you have already decoded an integer value. Each bit in an integer has a different value. When
converting from binary to decimal you add up the value of all bits set to 1 (same as when you
need to determine what the address of a controller is based on its DNA DIP switch). The value of
the bits is as follows:
Each bit is numbered from right to left, starting at 0. The value of each bit is equal to 2n where n
is the bit position. For the furthest right bit, which is commonly referred to as the Least
Significant Bit (or LSB), the value is 20 which equals 1. For the next bit over, the value is 21
Unsigned Integers
Integers come in 2 different types - the simpler of the 2 is unsigned. Unsigned integers have a
range of 0 to (2n - 1), where n is the number of bits:
• For an 8 bit (1 byte) unsigned integer the range is from 0 to (28 - 1) which is 0 to 255
• For a 16 bit (2 byte) unsigned integer (1 Modbus register) the range is from 0 to (216 - 1)
which is 0 to 65,535
• For a 32 bit (4 byte) unsigned integer (2 Modbus registers) the range is from 0 to
4,294,967,295
• For a 64 bit (8 byte) unsigned integer ( the range is from 0 to 18446744073709551615
As you can see, unsigned integers are whole numbers (no decimal place) and only positive.
Signed Integers
Signed integers can be positive or negative. Like unsigned integers they do not have a decimal
place. They split their range - half is positive and half is negative:
Encoding of Integers
The decimal value of an unsigned integer is determined by adding up the value of all bits set
to 1. Signed integers require 1 additional step:
• If the leading bit is set to 0: the value of all bits set to 1 are added (the same as an
unsigned integer).
• If the leading bit is set to 1: the value of all bits set to 1 are added (including the
leading bit) and 2n is subtracted from the number.
• For an 8 bit integer (1 byte) you subtract 28 which is 256
♦
• For a 16 bit integer (2 bytes - 1 Modbus register) you subtract 216 which is 65536
♦
Example 1: What is the decimal value of an 8-bit integer stored as 0x97? Solve as both unsigned
and signed integers.
1. Start by breaking this number into its binary format: 0x97 = 1001 0111
2. Add up the value of all bit set to 1 to determine the value as an unsigned integer:
Unsigned Value = 128 + 16 + 4 + 2 + 1 = 151
3. The first bit is set to 1, so we must subtract 2n from this value to determine the signed
integer value:
Example 2: What is the decimal value of a 16-bit integer stored as 0x4F68? Solve as both
unsigned and signed integers.
While a 32 bit signed integer has a range from -2,147,483,648 to 2,147,483,647 a 32 bit floating
point number has a range of +/- 10E-38 to +/- 10E38.
While there are 64 and 128 bit floats, Modbus will only ever deal with the 32 bit versions - the
increased precision and range is not necessary for Modbus applications.
The 32 bits inside a floating point number are broken into 3 parts:
• Sign: when the sign bit is set to 0, the value is positive. When set to 1, the value is
negative. This follows the convention of signed integers.
• Exponent: these 8 bits are decoded as an unsigned integer. A bias of 127 is subtracted
(see equation below), allowing the exponent to be positive or negative. As a result the
exponent has a range of possible values from -127 to 128.
• Mantissa: the rest of the bits are the 'left overs'. The value of the mantissa is also
decoded as an unsigned integer.
These 3 parameters are fed into the following equation to determine the decimal value of the
float:
When you have an understanding of the different types of values used in Modbus, you can use a
free programming calculator application to convert values.
The target audience is partner personnel and system engineers who design and implement
systems for ModbusTCP sites.
The purpose is to create a longer example for specific meters and map selected points based on
the register table provided in the documentation for each meter.
This section shows how to configure the driver to communicate with Modbus meters. The
documentation and register table is consulted for three meters. This content is in addition to the
Workflow section. Screens and text show how to configure and map points for selected Modbus
data types for each meter.
Overview
This section presents a longer start-to-finish example for a specific basic application with
detailed explanation and many screens. The content includes many screen captures that show
steps in a visual manner in addition to text explanations. The intention is to provide an extended
example with GWF mappings of selected values for actual Modbus meters. The ModbusTCP
driver with enteliBRIDGE 1.0.14 is used.
Selected values are mapped based on information found in the register map table for each
meter. A sample of values is shown that illustrates how to handle different Modbus data types,
how to combine multiple register entries into a single value, and also how to handle scaling
operations. The section contains only a number of representative mapping entries for three
different meters. A typical project would contain many similar mapping entries. Mapping
examples also show the use of BDC and MIC for BI and MV objects.
It is assumed that you are aware of the contents of the enteliBRIDGE Gateway User Guide PDF
file. The User Guide contains general information about using the web interface to configure
and create mappings of ModbusTCP values to BACnet variables. ModbusTCP driver-specific
information is contained within this ModbusTCP Protocol Driver Version Application Guide. The
web interface also provides online help.
While this example strives to be realistic, it has some limitations as it was created using a
simulator rather than real devices. The limitations of the simulator affect the device addressing
on the GWD screens.
The site consists of three buildings and has a central boiler for heating. A typical energy
management application might:
• Monitor
• Display dynamic energy graphics for usage awareness
• Trend and archive data. Do energy calculations for the whole building complex.
For this tutorial, the site contains the following Modbus energy devices:
The focus is on these three meter types. We want to show the considerations involved in
mapping some typical Modbus data types for each meter. Of course, we would expect the
system to use water, steam and natural gas flow meters but we do not focus on these
components here.
Meters can provide values in real time and some values are also available as average,
maximum and minimum. The maximum and minimum values may also have associated
timestamps.
A site typically has multiple instances of a particular meter and in some cases the calculation
factors used in internal calculations may differ for one or more meters.
Documents
The documentation for each meter may use different conventions. For example, each of these
manuals uses a different notation for hexadecimal Modbus addresses.
Name Links
Acuvim II Series Power Meter User's Acuvim II Series Power Meter User's Manual
Manual Document #1040E2203 Revision Date: June 2015
https://www.accuenergy.com/files/acuvim-ii/Acuvim-II-Power-
Meter-User-Manual-1040E1303.pdf
Shark 200 & 200T Installation and Shark 200 & 200T Installation & Operation Manual V1.17 October
Operation Manual V.1.17 June 18, 9, 2012
2014 Document E149701
http://www.electroind.com/products/Shark200/pdf/manuals/Shar
k%20200%20Data-
Logging%20Power%20and%20Energy%20Meter%20with%20Expa
ndable%20IO%20User%20Manual%20V.1.17_E149701.pdf
BTU Heat Meter ONICON System- System-10-MOD Network Interface Installation Guide 05/14
10-MOD BTU Meter Installation http://www.onicon.com/pdfs/0653-10-System-10-MOD-Network-
Guide Interface-Installation-Guide-05-14.pdf
Terms
This topic explains some common terms.
Energy meters typically include both primary mode and secondary mode values:
• Primary mode: The numeric value in the register of the meter and equals the real
physical value.
• Secondary mode: A defined relationship exists between the register numerical value and
the real physical value. The calculation may rely on a number of parameters for
calculation and scaling of the result. You need to understand the calculations used on
each device.
Three Meters
The following table lists the meters for each building.
The driver now supports the 64-bit BACnet LAV type and this provides
a good way to handle 64-bit integer values from energy meters and
other devices.
For the secondary values, we need to be aware of the factors used to make calculations.
A site typically has multiple instances of a particular meter and in some cases the factors may
differ for one or more meters. In a mapping, a Data Type entry of FLOAT(4321)*120 means that
the value is multiplied by a scaling factor of 120.
The following graphic shows a segment from the register table in the documentation for the
Acuvim II meter. Note the use of the H notation to indicate a hex address.
The following table contains a number of values selected from the register tables in the
documentation for the device. We would use this table to add mapping to a GWF.
The offset notation, [+1] or [+8] etc., allows for bulk retrieval of multiple values.
Name
Address HEX
Modbus
Ref Decimal
Remote
Ref
Local
Type
Data
Device Type
Units/
Read
Write
Modifiers
Write
Read/
(secs)
Stale Time
Acuvim II Power Meter
1 PT1 (High 1005 HREG[4101] AV1.PresentValue UINT16 retrieve-
16 bit) periodically
2 PT1 (Low 1006 [+1] AV2.PresentValue UINT16 retrieve- do-not-
16 bit) periodically poll
3 PT2 1007 HREG[4103] AV3.PresentValue UINT16 retrieve-
periodically
4 CT1 1008 [+1] AV4.PresentValue UINT16 retrieve- do-not-
periodically poll
5 CT2 1009 HREG[4105] AV5.PresentValue UINT16 retrieve-
periodically
Address HEX
Modbus
Ref Decimal
Remote
Ref
Local
Type
Data
Device Type
Units/
Read
Write
Modifiers
Write
Read/
(secs)
Stale Time
13 Reactive [+4] AV19.PresentValue INT32(4321)*.1 kWh retrieve-on- write- do-not- 5000
energy read through poll
14 Energy [+8] AV21.PresentValue INT32(4321)*.1 kWh retrieve-on- write- do-not- 5000
TOTAL read through poll
15 Energy [+10] AV22.PresentValue INT32(4321)*.1 kWh retrieve-on- write- do-not- 5000
NET read through poll
16 Reactive [+12] AV23.PresentValue INT32(4321)*.1 kWh retrieve-on- write- do-not- 5000
Energy read through poll
TOTAL
17 Reactive [+14] AV24.PresentValue INT32(4321)*.1 kWh retrieve-on- write- do-not- 5000
Energy read through poll
NET
18 Apparent [+16] AV25.PresentValue INT32(4321)*.1 kVA retrieve-on- write- do-not- 5000
Energy read through poll
TOTAL
P=Rx×(PT1/PT2)×(CT1/CT2)
The Acuvim II registers (1005H to 1009H) are 16bit unsigned integer (UINT16) data types that
contain data for the 4 factors.
The following graphic shows a segment from the register table in the documentation for the
Shark 200 power meter. Note the use of the 0x notation for a hex address.
See Appendix B: Modbus Map and Retrieving Logs section of the Shark 200/200T Meter
Installation and Operation Manual Version 1.13.
HEX
Modbus Address
Decimal
Remote Ref
Ref
Local
Type
Data
Device Type
Units/
Read
Write
Write Modifiers
Read/
Name
HEX
Modbus Address
Decimal
Remote Ref
Ref
Local
Type
Data
Device Type
Units/
Read
Write
Write Modifiers
Read/
CT PT numerator, denominator, multiplier are found at 752F to 7533 (30000-30004). Refer to the
Programmable Settings Section of the mapping table in the documentation.
The BTU meter accepts inputs from multiple sensors and calculates the quantity of heat being
transferred. The meter provides heat flow per unit time outputs and also totalized values.
http://www.onicon.com/pdfs/0653-10-System-10-MOD-Network-Interface-Installation-Guide-
05-14.pdf
41001 (A029H) defines the Meter Operating Mode as an Integer: 1 = single mode; 2 = dual mode;
3 = bi-directional mode. (Create a 3 state MIC for Mode: Single, Dual, and Bi-Directional)
41002 (A02AH) defines the Mode Status Indicator as an Integer: 1= heating mode or forward
direction; 2= cooling mode or reverse direction. (Create a 2 state BDC for Status: Heating,
Cooling)
The following table contains a number of values selected from the register tables in the
documentation for the device. We would use this table to list values that we want to map in a
GWF.
Registers 41003 through 41064 provide totalization of energy, volume and mass flow data in 32
bit single precision floating point format. The registers are organized mainly into pairs that
must be concatenated. Some totalizers such as 400026 (Low Order), 40027(Middle Order), 40028
(High Order), use three registers to accumulate a large energy total. The registers can be joined
using Modbus offsets as shown in the following table.
Name
HEX
Address
Modbus
Ref Decimal
Remote
Ref
Local
Type
Data
Device Type
Units/
Read
Write3333
Modifiers
Read/ Write
(secs)
Stale Time
BTU Heat Meter ONICON System-10-MOD BTU Meter
1 Meter Operating Mode A020 1001 MV1. Present_Value UINT16 retrieve- not- 5000
(Create MIC with periodically writable
1=Single, 2=Dual,
3=Bi-Directional)
2 Meter Status (create A02A 1002 BV1. Present_Value BIT retrieve- not- 5000
BDC with 1=Heating, periodically writable
2=Cooling)
10 Supply Temperature- A043 HREG[1027:12] AV10.Present_Valu FLOAT degF retrieve- not- 5000
degF e periodically writable
11 Return Temperature- [+2] AV11.Present_Valu FLOAT degF retrieve- do- 5000
degF e on-read not-
poll
12 Supply Temperature- [+4] AV12.Present_Valu FLOAT degC retrieve- do- 5000
degC e on-read not-
poll
13 Return Temperature- [+6] AV13.Present_Valu FLOAT degC retrieve- do- 5000
HEX
Address
Modbus
Ref Decimal
Remote
Ref
Local
Type
Data
Device Type
Units/
Read
Write3333
Modifiers
Read/ Write
(secs)
Stale Time
degC e on-read not-
poll
14 Energy Total Mode2- [+8] AV14.Present_Valu FLOAT BTU retrieve- do- 5000
BTU e on-read not-
poll
15 Energy Total Mode1- [+10] AV15.Present_Valu FLOAT BTU retrieve- do- 5000
BTU e on-read not-
poll
16 Energy Total Mode1- A053 HREG[1043:4] AV16.Present_Valu FLOAT kWHr retrieve- not-
kWHr e periodically writable
17 Energy Total Mode2- [+2] AV17.Present_Valu FLOAT kWHr retrieve- do- 5000
kWHr e on-read not-
poll
Pulse Totalization
The register pair 41063 and 41064 can provide pulse totalization using the optional auxiliary
pulse input board for the System-10 BTU Meter. This option can totalize pulse outputs from
water or gas meters. The maximum count is 9,999,999.
A remote reference entry with an offset would join the pulse registers:
HREG[1063:4]
[+2]
A newer frontend such as enteliWEB 4+ provides the means to create, view and edit BACnet
objects including newer ones such as LAV which are often useful when mapping points.
5. Click OK. A GWS instance for the ModbusTCP protocol driver appears. Generally, you
would accept the defaults.
The following shows the ModbusTCP GWS1 for Seaside Energy:
The Enable checkbox is found at the top of the page for each object. When you enable or disable
a GWD or GWS, click the save button in the lower right area.
You can create a GWF for each meter and reference it in the Device Template field of the GWD.
Name the GWF objects as follows: Acuvim II Power, Shark 200 Power, and ONICON Sys10 BTU
Meter. The approach is to first establish basic communications with the GWS and GWD objects
and then later in the process to add mapping entries to each GWF.
In Step IV: Configure the GWF Point Mappings of the workflow, mappings are added for the
required data points.
For this example, we might create one GWD object for each of the following meters:
The following three GWD objects were created for the meters:
The following graphic shows the Configuration tab for GWD1 which handles the Power Meter for
Building 1 Main.
The following shows the Setup tab of the GWD2 which handles the Shark 200 Power Meter for
Building 2 production.
The general process is to add a row entry into the mapping grid, save it, and then use the
system feedback and error messages to fix all error in an entry. Sometimes, it helps to refresh
the window (F5) during the error fixing process. If you created GWF objects prior to creating the
GWD objects, then add mappings to the existing GWF that is referenced in each GWD object.
The ONICON System-10-MOD BTU Heat Meter has Meter Operating Mode Indicator and Mode
Status Indicator entries in its register table.
Name
Ref HEX
Remote
Decimal
Ref
Remote
Ref
Local
Type
Data
Type
Device
Units/
Read
Write
Modifiers
Write
Read/
(secs)
Stale Time
BTU Heat Meter ONICON System-10-MOD BTU Meter
Meter Operating A020 1001 MV1. UINT16. retrieve- not-
Mode Present_Value periodically writable
41001
(Create MIC with
1=Single, 2=Dual,
3=Bi-Directional)
Meter Status A02A 1002 BV1. Present_Value BIT retrieve- not-
41002 periodically writable
(create BDC with
1=Heating,
2=Cooling)
The following graphic shows a segment from the register table in the documentation for the
ONICON System-10 BTU meter.
An MIC associates text with the states of a multistate value. The StateText entries are: Single,
Dual, and Bi-Directional.
1. In the left navigation pane, if necessary click on a specific protocol to expand the folder.
2. Double click on the Templates folder for the ModbusTCP protocol. The right pane
provides information about the three types of template objects. Clicking on one of the
three tabs shows a list of existing objects.
3. Click on the Device Templates tab. A list of GWF objects appears. You can edit a GWF by
adding a Mapping that uses a BDC/MIC object to an existing GWF.
4. Specify a BDC/MIC object by entering the instance number in the Units/ Device Type
field. Based on the Local Reference, the application selects either the BDC or MIC
instance.
The following graphic shows that for the first mapping row, the Units/ Device Type field
contains 1 which references MIC1. In the second mapping row, the Units/ Device Type
field contains 3 which references BDC3.
Click Save.
For more information, see the procedures in the GWF: Binary Templates (BDC) and Multistate
Templates (MIC) section of the enteliBRIDGE User Guide for 1.0.14.
The system provides feedback that helps a user to configure a gateway using the ModbusTCP
protocol driver with the GWD and GWF objects. The web interface and object dialogs provide
feedback for field entries and a temporary message displays at the top after most actions.
The Setup tab of the GWD object page includes these fields that provide feedback: Status,
Reliability, Description of Halt, GWS Description of Halt and Last Error.
Additionally, the message system provides feedback for the row entries of the GWF mapping
table grid.
The Description of Halt Not a) Fix the ModbusTCP Address. The GWS Status field now
Loaded yet message indicates b) Enable the GWD if necessary. indicates Running instead
a missing or invalid c) Enable the GWS object if of stopped.
ModbusTCP Address on the necessary.
GWD. Click Save and refresh the
web interface.
The GWD indicates a GWF Check the mappings on the GWF The GWD reads in data.
error. associated with the GWD. Fix any
Click Save and refresh the
issues.
web interface.
The GWD indicates a Check that the physical Modbus The GWD reads in data.
communication failure. device is online and
Click Save and refresh the
communicating.
web interface.
Polling issues a) Check that the physical The GWD reads in data.
Modbus device is online and
Click Save and refresh the
communicating.
web interface.
b) Check the Modbus Address on
the GWD.
c) Check the mappings on the
GWF associated with the GWD.
Fix any issues.
Missing ModbusTCP Address Enter a valid ModbusTCP Click Save and refresh the
Address on the GWD. web interface.
Device Query issue. a) Check that the physical Click Save and refresh the
Modbus device is online and web interface.
communicating.
b) Check the mappings on the The GWD reads in data.
GWF associated with the GWD. The Description of Halt
Fix any issues.
message does not display
anymore.
Missing ModbusTCP address. Enter a valid ModbusTCP Click Save and refresh the
Address on the GWD. web interface.
The GWD reads in data.
For example, if the Data Type property for the first row is invalid, the Error Description reads:
You might have entered INTEGER32 by mistake when BIT is the correct choice. You would
change the Data Type to BIT and click Save. You may also need to do a refresh of the window.
The temporary message at the top would display Mapping OK and the Reliability field would
display no-fault-detected. In 1.1, the Reliability field does not change.
The following graphic shows the GWF Mapping tab from the gateway 1.1 web interface. In 1.0.14,
there was only one tab.
The following graphic shows the GWF Configuration tab from the enteliBRIDGE Gateway 1.1 web
interface.
The following demonstration sequence shows what happens when you start with two correct
entries and then deliberately make a typical error in a column starting with Name and
continuing with RemoteRef etc. The intention is show the system response to a single deliberate
error and then fix this error. If needed, refer to the help available at the bottom of the web
interface.
Typically, after you fix one error, the system provides feedback on the following error. This
process continues until each error is fixed up to the last mapping.
Remote Reference Fix the syntax of the remote Click Save and refresh the
reference. For example, add the web interface.
missing ending bracket and put:
HREG[1001] The Error Description field is
blank and the Reliability
indicates ‘no-fault-detected.
Data Type Fix the data type so that it Click Save and refresh of the
Read/Write Modifier Change the Read/Write Modifier Click Save and refresh of the
for the mapping entry to ‘do- web interface.
not-poll’.
The Error Description field is
For example, the Offset entry in blank and the Reliability
the second row could contain an indicates ‘no-fault-detected.
offset [+1] in the RemoteRef
column but with the incorrect
retrieve-periodically.
Term Explanation
Bit 2 state (binary) data.
The Data Type of the value referred to by the Remote Reference of a
COIL or INPUT register. e.g. COIL[60]
Byte order The order in which each byte of data (8 bits) is received or sent to a
Modbus register that assembles it to correctly represent the data.
Client/server The requesting device is called the client (Modbus Master) and the
devices that supply the information are called servers (Modbus
Slaves). Using computer terminology, a master is a client and a slave
is a server.
COIL In Modbus, a coil provides a way to read and write Boolean values.
Coils often represent binary outputs or internal bits which allow both
read and operations.
Data type A data type is a classification identifying one of various types of data,
which determines the possible values for that type. The type
determines the operations that can be done on values of that type; the
meaning of the data; and the way values of that type can be stored. For
this driver, types include: unsigned integer, signed integer or Boolean.
Data Type Specifies the Data Type of the value referred to by the Remote
field Reference. The options available depend on the protocol driver.
Debug Specifies the datatypes of configuration parameters. The specific
Comms protocol driver defines the names, types and semantics of each
(GWS) configuration item.
Values are limited to 255 characters. Binary values are formatted as
HEX strings and must have an even number of ASCII chars (e.g.
002f30). Case is ignored.
When set to 1, the ModbusTCP driver will generate extra debug for
certain communication events to the GWS log.
Debug Specifies the datatypes of configuration parameters. The specific
Errors (GWS) protocol driver defines the names, types and semantics of each
configuration item.
Values are limited to 255 characters. Binary values are formatted as
HEX strings and must have an even number of ASCII chars (e.g.
Term Explanation
002f30). Case is ignored.
When set to 1, the ModbusTCP driver will generate extra debug for
certain internal errors to the GWS log.
Debug Specifies the datatypes of configuration parameters. The specific
Requests protocol driver defines the names, types and semantics of each
(GWS) configuration item.
Values are limited to 255 characters. Binary values are formatted as
HEX strings and must have an even number of ASCII chars (e.g.
002f30). Case is ignored.
When set to 1, the ModbusTCP driver will generate debug output for all
requests to the GWS log.
Device Specifies the protocol specific address of this device. The address
address must be unique for this GWS (no other GWD associated with this GWS
(GWD) can have the same address value.)
The Address format is:
ipaddr[:port][:unit#]
The Port field indicates the port in the ModbusTCP device that the
gateway should connect to. It defaults to 502 which is the default
ModbusTCP port. The Unit field is used to select the Modbus RTU
device behind the ModbusTCP device that this GWD represents. This
field defaults to 1.
The GWD.Address differs from the BACnet device address.
Discrete A Modbus discrete input (a read-only bit).
Input
Float 4 Byte (dual register) positive or negative decimal values
(+/- 10E-38 to +/- 10E38)
Functions Modbus commands are called functions. A function is a command to
read or write a data table address. Each available function has a
number. Read Single is a function 01 type.
Gateway This object contains settings that apply to a specific protocol.
Settings
object (GWS)
Gateway This object contains settings that apply to a real or virtual device that
Device object communicates the protocol. There can be many devices per GWS (per
(GWD) protocol).
Gateway This object provides a template mapping for protocol devices. The
format protocol driver using mappings in this object to translate from
Term Explanation
ModbusTCP Internet access to MODBUS is available at the reserved system port
502 on the TCP/IP stack. TCP is Transmission Control Protocol.
Modbus Modbus ASCII is similar to Modbus RTU but encodes the data as ASCII
ASCII instead of binary.
Modbus The requesting device is called the Modbus Master and the devices
Master/Slave that supply the information are called Modbus Slaves. Using computer
terminology, a master is a client and a slave is a server.
The master can initiate transactions (queries) but the slaves can only
supply the requested data, or perform the action requested in a query.
Modbus The message sent on the network by the Client to initiate a
Request transaction.
Modbus The Request message received on the Server side.
Indication
Modbus The Response message sent by the Server.
Response
Modbus The Response Message received on the Client side.
Confirmation
Modbus RTU Controllers communicate on a Modbus network using RTU (Remote
Terminal Unit) mode. Within a message each eight-bit byte contains
two four-bit hexadecimal characters. This mode provides greater
character density than ASCII for the same baud rate. It is used with
RS-232 and RS-485 connections.
Offset Used to specify a relative register or coil number to read. The offset is
relative to the register or coil specified by the previous mapping.
Poll interval Defines the length of one poll interval in milliseconds. The Poll Type
determines how many items are polled in one poll interval.
When using 1-per-Interval polling, set the interval to slightly longer
than the expected time it would take to poll one item from a Modbus
device. This time is dependent on the response time of devices being
used.
When using All-per-Interval, select a time which longer than (#
mappings) * (expected time per mapping).
Poll Type Specifies the polling behavior of the device.
The options are: constant, 1-per-interval, all-per-interval, and custom.
Constant: Poll through the request list at the Poll Interval (e.g. every
1000 msec) and then restarts at the beginning when complete.
http://www.modbus.org/docs/Modbus_Messaging_Implementation_Guide_V1_0b.pdf
http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf
http://mblogic.sourceforge.net/mbapps/ModbusBasics-en.html
http://www.lammertbies.nl/comm/info/modbus.html
http://en.wikipedia.org/wiki/Modbus
http://www.scorpioncontrols.com/info/modbustcp.htm