# EL 4.1 FW 3.5.0 Modbus TCP Communication Interface
Note
For more information about examples of interaction with Enapter devices over Modbus communication protocol please visit our GitHub repository (opens new window).
Warning
Concurrent connections to Electrolyser EL 4.1 for Modbus TCP interface limited to two. In case if you are experiencing connection refuse issues with Modbus TCP, you need ensure that there are only two connections are used for communication.
# Introduction
Refer to the Reference section for details of the Modbus protocol.
This document describes public Modbus TCP implementation for Enapter Electrolyser EL 4.1 and assume understanding of TCP/IP and Modbus protocols.
# Physical Interface Connection
Connect Ethernet cable to the Ethernet Port of Enapter Electrolyser EL 4.1.
# TCP/IP Connection Settings
By default DHCP client is enabled therefore IP address will be assigned automatically by DHCP server available in the connected network.
It is recommended to set DHCP reservation based on MAC address of the electrolyser.
Configuration of the Static IP is possible using Enapter Cloud and Enapter Mobile Application for iOS and Android.
# Modbus Connection Settings
Option | Value | Comment |
---|---|---|
Modbus Port | 502 | |
Modbus Slave Address | 1 | Enapter Electrolyser always addressed as a slave |
# References
http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf (opens new window)
# Data Formats Used
Primary tables | Object Type | Permission | Comment |
---|---|---|---|
Input Registers | 16 bit word | Read Only | |
Holding Registers | 16 bit word | Read / Write |
# Data Bits/Registers Dimension
Data Type | Size in Bits | Registers Used | Comment |
---|---|---|---|
Boolean | 16 bits | 1 register | 0 value means 'false', all other cases - 'true' |
Uint16 | 16 bits | 1 register | |
Uint32 | 32 bits | 2 registers | |
Uint64 | 64 bits | 4 registers | |
Float32 | 32 bits: * bit 31: Sign (1 bit) * bit 30-23: Exponent (8 bits) * bit 22-0: Fraction (23 bits) | 2 registers | IEEE 754 Single-precision floating-point |
# Data Encoding
Big-endian, high word first data encoding used.
This means that when more than single byte (8 bits) is transmitted, network byte order is used - the most significant byte placed at lower address (sent first).
# Implemented Modbus Functions
Function | Code | Comment |
---|---|---|
Read Holding Registers | 03 | |
Read Input Registers | 04 | |
Write Single Holding Register | 06 | |
Write Multiple Holding Registers | 16 |
# Modbus Data Model
Input registers and Holding registers are referred to in the range 3XXXX and 4XXXX respectful (also known as PLC Address). For example, Holding register 0 in this document would be referred to as 40001 and would be addressed as register 0000 in the data address field of the Modbus message (also known as Protocol Address).
# Set/Read Modbus IP
To set Modbus IP:
- Open the
Cloud
and navigate to your site - Select EL 4.1 you want to set Modbus IP
- Click the
Configuration
menu item - Click
Set Modbus IP
- Enter the IP address and then click
Create Command
- Wait until command will be accepted
To read Modbus IP:
- Open the
Cloud
and navigate to your site - Select EL 4.1 you want to read Modbus IP
- Click the
Configuration
menu item - Click
Read Modbus IP
- You can see Modbus IP in
Execution Payload
section
# Modbus Table
# Holding Registers (Read / Write)
Register | Data Type | Name | Comment |
---|---|---|---|
0 | Uint64 | Unix Time | Seconds from 1 January 1970 UTC. e.g. 02/29/2020 @ 3:15 PM (UTC) represented as 1582989315. |
4 | Boolean | Reboot | 1 = Reboot. |
5 | Boolean | Locate Electrolyser | 1 = Start Blinking All LED; 0 = Stop Blinking All LED. |
6 | Boolean | System Maintenance Mode | Legacy support. For new integrations #1013 must be used. 1 = Enable Maintenance Mode; 0 = Disable Maintenance Mode. |
1000 | Boolean | Start / Stop Electrolyser | 1 = Start; 0 = Stop. |
1002 | Float32 | Production Rate [%] | Current production rate in percent (system reset set this value to 'Default Production Rate'), can be changed 'on-fly' even when electrolyser produce H2 |
1010 | Boolean | Request Blowdown routine | 1 = Request blowdown or read 'is blowdown requested' |
1011 | Boolean | Force Water Refilling | 1 = Start Force Water Refilling |
1013 | Boolean | Maintenance Mode | 1 = Enable Maintenance Mode; 0 = Disable Maintenance Mode. |
1014 | Boolean | Preheat | 1 = Start Preheat; 0 = Stop Preheat |
1015 | Boolean | Flushing | 1 = Skip Flushing; 0 = Flushing |
1016 | Uint16 | Start SIF Proof-Tests | 0 = No test; 1 - 6 = Number of test to run |
4000 | Boolean | Configuration Begin | 1 = Start configuration |
4001 | Boolean | Configuration Commit | 1 = Commit current changes; 0 = Rollback changes |
4020 | Uint32 | Set Ethernet IP Address | e.g. 0xC0A80201 (192.168.2.1); 0 = DHCP enabled |
4022 | Uint32 | Set Ethernet IP Netmask | Ex: 255.255.255.0 |
4024 | Uint32 | Set Ethernet Gateway IP Address | Ex: 192.168.2.1 |
4038 | Int32 | Cloud logs | 0 = disable logging (default); 1 = only fatal errors; 2 = fatal errors and errors; 3 = warnings and more important; 4 = everything before and important messages; 5 = all messages, except internal debug ones; 6 = all messages |
4042 | Int32 | System logs | 0 = disable logging (default); 1 = only fatal errors; 2 = fatal errors and errors; 3 = warnings and more important; 4 = everything before and important messages; 5 = all messages, except internal debug ones; 6 = all messages |
4044 | Uint32 | Syslog IP Address | Default IP address 255.255.255.255 (Broadcast) |
4046 | Uint16 | Syslog Port | Default port 514 |
4142 | Float32 | Chassis Altitude | [m] |
4308 | Float32 | Set Max Tank Pressure (Outlet) | [bar] |
4310 | Float32 | Set Restart Pressure (Outlet) | [bar] |
4396 | Float32 | Set Default Production Rate [%] | This register can be modified only when stack is inactive (Idle or Maintenance mode) |
4600 | Uint32 | Heartbeat ModBus Timeout | [Seconds]; 0 = disable |
4602 | Uint32 | Heartbeat Gateway Timeout | [Seconds]; 0 = disable |
4604 | Uint32 | Heartbeat UCM Timeout | [Seconds]; 0 = disable |
6014 | Float32 | PT01 minimal threshold | Dryer output pressure at which it leaves Stand-by. Updated value is saved only after writing 1 to register #6022. |
6016 | Float32 | PT01 maximal threshold | Dryer output pressure at which it moves to Stand-by. Updated value is saved only after writing 1 to register #6022. |
6018 | Boolean | Start/Stop Dryer | Write: 1 = Start; 0 = Stop. Read register #6021 to check Dryer Logic States. Avoid frequent write operations, since it can damage Dryer's Flash. |
6019 | Uint16 | Stop Dryer | DEPRECATED |
6020 | Uint16 | Reboot Dryer | Write: 1 = Reboot Dryer; Read = number of times Dryer was rebooted. Avoid frequent write operations, since it can damage Dryer's Flash. |
6022 | Uint16 | Save updated Dryer configuration | Write: 1 = Save updated Dryer configuration on flash. Avoid frequent write operations, since it can damage Dryer's Flash. |
6023 | Uint16 | Locate Dryer in DCN/IDCN | 0 = Disable; 1 = Enable |
6024 | Uint16 | Reboot UCM | 1 = Reboot UCM |
6025 | Uint16 | Plugin ID | Plugin ID which is used to save the data written to register #6026. 1 = Auto Control Plugin. |
6026 | Uint16 | Plugin Argument | 0 = Disable plugin; 1 = Enable plugin |
6200 | Uint32 | Water Tank status | Read Water Tank States (bitmask) |
6202 | Float32 | Water Tank water level | [Liters] |
6204 | Float32 | Water Tank inlet temperature | [°C] |
6206 | Float32 | Water Tank tank temperature | [°C] |
6208 | Float32 | Water Tank conductivity | [μS/cm] |
6210 | Float32 | Water Tank pump current | [Amperes] |
6212 | Uint32 | Reserved | Reserved for WT21 |
6214 | Uint32 | Reserved | Reserved for WT21 |
6216 | Uint32 | Reserved | Reserved for WT21 |
6218 | Uint32 | Reserved | Reserved for WT21 |
6220 | Uint32 | Water Tank UCM uptime | [Seconds] |
6222 | Uint16 | Command to Water Tank | Write: 1 = Start; 2 = Stop; 3 = Reboot WT control board; 4 = Reboot WT UCM board; 5 = Locate OFF; 6 = Locate ON; 7 = Maintenance OFF; 8 = Maintenance ON |
6223 | Uint16 | Reserved | Reserved for WT21 |
7005 | Boolean | Cooling valve V106 | 0 = Close; 1 = Open |
# Input Registers (Read Only)
Register | Data Type | Name | Comment |
---|---|---|---|
0 | Uint32 | Device Model | 0x45533431 for EL4.1 |
2 | Uint16 | Firmware MAJOR and MINOR Version | Ex: 769 => 769 // 256 = 3, 769 % 256 => 1 (3.1) |
3 | Uint16 | Firmware PATCH Version | Ex: 3 => 3 (3) |
4 | Uint32 | Firmware Build Number | Ex: 0x4E343471 |
6 | Uint128 | Device Control Board Serial Number | Ex: 9E25E695-A66A-61DD-6570-50DB4E73652D |
14 | Uint64 | Chassis Serial Number | 1 bits - reserved, must be 0 10 bits - Product Unicode 11 bits - Year + Month 5 bits - Day 24 bits - Chassis Number 5 bits - Order 8 bits - Site Example |
18 | Uint16 | System State | 0 = Internal Error, System not Initialized yet; 1 = System in Operation; 2 = Error; 3 = Fatal Error; 4 = System in Expert Mode. |
20 | Uint32 | Live time [seconds] | Total time during which a system is power up (not only time when stack is working). |
22 | Uint32 | Uptime [seconds] | How long the system has been running |
768 | Array of Uint16 Warning Codes | Warning Events Array | The sequence of registers with warning codes. The first register contains the total number of warnings, while the subsequent registers include the Uint16 warning codes (refer to the table). |
832 | Array of Uint16 Error Codes | Error Events Array | The sequence of registers with error codes. The first register contains the total number of errors, while the subsequent registers include the Uint16 error codes (refer to the table). |
1000 | Uint32 | Product Code | 0x44 = ELE410535A2ASV01 0x45 = ELE410508A2ASV01 0x46 = ELE410535A2LSV01 0x47 = ELE410508A2LSV01 0x48 = ELE410535D4ASV01 0x49 = ELE410535A2AEV01 0x4A = ELE410535A2LEV01 0x4B = ELE410535A2ASV02 0x4C = ELE410535A2LSV02 0x4D = ELE410508A2ASV02 0x4E = ELE410508A2LSV02 |
1002 | Uint32 | Stack Start/Stop Cycles Quantity | How many Stack Start/Stop cycles |
1004 | Uint32 | Stack Total Runtime | seconds |
1006 | Float32 | Stack Total H2 Production | NL |
1008 | Float32 | H2 Flow Rate | NL/hour, NAN when not producing H2; |
1010 | Uint64 | Stack Serial Number | 1 bits - reserved, must be 0 15 bits - Stack Type 11 bits - Year + Month 5 bits - Day 24 bits - Stack Number 8 bits - Site |
1014 | Uint16 | Cooling Type | 1 = Air cooling; 2 = Liquid cooling |
1200 | Uint16 | Electrolyser State | 0 = Halted; 1 = Maintenance mode; 2 = Idle; 3 = Steady; 4 = Stand-By (Max Pressure); 5 = Curve. |
4000 | Boolean | Configuration Progress | 1 = Configuration is in progress. |
4001 | Boolean | Configuration Source | 1 = Configuration over Modbus. |
4002 | Int32 | Last Configuration Result | 0 = OK, Configuration was completed successfully; 1 = Permanent, The operation has failed (internal or general error); 2 = No Entry, Configuration was not started or interrupted; 5 = I/O, Data save error; 11 - Try again, Configuration needs to be tried again; 13 = Access Denied, Some changed registers are read-only; 16 = Busy, Another configuration was in progress; 22 = Invalid, The data has invalid or wrong type. |
4004 | Uint16 | Last Configuration Wrong Holding | Keeps first invalid Holding register number which doesn't allow successful configuration commit. |
4600 | Uint16 | Heartbeat | Timeout for Modbus Heartbeat in seconds. 0 = disabled (default) |
6000 | Uint16 | Dryer Error | Dryer error code (bitmask). |
6001 | Uint16 | Dryer Warning | Dryer warning code (bitmask). |
6002 | Float32 | Dryer TT00 | Temperature of heater element for cartridge 0 (first line). |
6004 | Float32 | Dryer TT01 | Temperature of heater element for cartridge 1 (second line). |
6006 | Float32 | Dryer TT02 | Temperature of heater element for cartridge 2 (first line). |
6008 | Float32 | Dryer TT03 | Temperature of heater element for cartridge 3 (second line). |
6010 | Float32 | Dryer PT00 | Input pressure of the dryer. |
6012 | Float32 | Dryer PT01 | Output pressure of the dryer. |
6021 | Uint16 | Dryer state | Read Dryer Logic States |
7000 | Boolean | High Electrolyte Level Switch (LSH102B_in) | 1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor. |
7001 | Boolean | Very High Electrolyte Level Switch (LSHH102A_in) | 1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor. |
7002 | Boolean | Low Electrolyte Level Switch (LSL102D_in) | 1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor. |
7003 | Boolean | Medium Electrolyte Level Switch (LSM102C_in) | 1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor. |
7004 | Boolean | Electrolyte Tank High Pressure Switch (PSH102_in) | 1 = Pressure is too high; 0 = Pressure is normal. |
7007 | Boolean | Electronic Compartment High Temperature Switch (TSH108_in) | 1 = Temperature is too high. 0 = Temperature is normal. |
7009 | Boolean | Chassis Water Presence Switch (WPS104_in) | 1 = Water is present on input; 0 = No water input. |
7010 | Boolean | Dry Contact | 1 = OK (Closed); 0 = NOT OK (Opened) |
7500 | Float32 | Electrolyte Cooler Fan Speed (F103A_in_rpm) | [rpm] |
7502 | Float32 | Air Circulation Fan Speed (F104B_in_rpm) | [rpm] |
7504 | Float32 | Electronic Compartment Cooling Fan Speed (F108C_in_rpm) | [rpm] |
7506 | Float32 | Electrolyte Flow Meter (FM106_in_lmin) | [Liters per minute] |
7508 | Float32 | Stack Current (HASS_in_a) | [Ampere] |
7510 | Float32 | PSU Voltage (Stack Voltage) (PSU_in_v) | [Volt] |
7512 | Float32 | Inner Hydrogen Pressure (PT101A_in_bar) | [bar] |
7514 | Float32 | Outer Hydrogen Pressure (PT101C_in_bar) | [bar] |
7516 | Float32 | Water Inlet Pressure (PT105_in_bar) | [bar] |
7518 | Float32 | Electrolyte Temperature (TT102A_in_c) | [°C] |
7520 | Float32 | Downstream Temperature (TT106_in_c) | [°C] |
7526 | Float32 | Board Power 24V (V24_in_v) | [V] |
7532 | Float32 | Board Temperature (BOARD_in_c) | [°C] |
7538 | Float32 | Gas Presence (HT104_in_ppm) | [parts/million] |
7540 | Float32 | Safety Board Temperature (TE108_in_c) | [°C] |
8002 | Float32 | Outer Hydrogen Pressure Raw Sensor Value (PT101C_in_v) | Raw value, [Volt] |
8004 | Float32 | Stack Current Raw Sensor Value (HASS_in_v) | Raw value, [Volt] |
# Dryer error/warning code bitmask
Dryer error/warning code bitmask (opens new window) is 16-bit value where each bit representing one type of error. The following table provides the detailed description of each error.
Bit number | Description |
---|---|
0 | TT00 has invalid value (sensor provides unexpected values) |
1 | TT01 has invalid value (sensor provides unexpected values) |
2 | TT02 has invalid value (sensor provides unexpected values) |
3 | TT03 has invalid value (sensor provides unexpected values) |
4 | TT00 value growth is not enough (heating mechanism does not work properly) |
5 | TT01 value growth is not enough (heating mechanism does not work properly) |
6 | TT02 value growth is not enough (heating mechanism does not work properly) |
7 | TT03 value growth is not enough (heating mechanism does not work properly) |
8 | PS00 (pressure switch on line 0) is triggered |
9 | PS01 (pressure switch on line 1) is triggered |
10 | F100 has invalid RPM speed (fan between line 0 and line 1) |
11 | F101 has invalid RPM speed (fan on line 0) |
12 | F102 has invalid RPM speed (fan on line 1) |
13 | PT00 (Input pressure) has invalid value (sensor provides unexpected values) |
14 | PT01 (Output pressure) has invalid value (sensor provides unexpected values) |
# Water Tank States (bitmask)
Water Tank status bitmask (opens new window) is 32-bit value where bit representing one type of status. The following table provides the detailed description of each state.
Bit number | State Name |
---|---|
0 | N/A |
1 | Stop |
2 | Maintenance |
4 | Manual mode |
5 | Bad quality water input |
6 | Waiting for water |
7 | High water inlet temperature |
8 | Low water inlet temperature |
9 | Very low water level |
10 | Low water level |
11 | Very high water level (warning) |
13 | Low water tank temperature |
15 | Very high water level (fatal error) |
16 | Tank refilling issue |
17 | Tank temperature sensor broken |
18 | Inlet temperature sensor broken |
19 | Water level sensor broken |
20 | Water level sensor miscalibrated |
21 | Current sensor broken |
22 | Water leak |
23 | Valve leak |
24 | Pump broken |
26 | Factory settings reset failed |
27 | Internal error |
# Diagrams
# System State Diagram
This diagram describes possible transition between different electrolyser states. The state can be read in the Input Register #18.
# Examples
# Example: Reading Chassis Serial Number
Read from Modbus 586601960808264448
.
Decode into binary format 0001000001 00100000001 11011 000000001101010000110001 10011 00000000
and parse every part.
Product Unicode = 0b0001000001
= 65 => 'AB'
65 % 32 = 1 => A
(A=1, B=2,..., Z=26 => 'A')
65 // 32 = 2 => B
(A=1, B=2,..., Z=26 => 'B')
Year + Month = 0b00100000001
= 257 => 21 05
257 // 12 = 21 => 21 (Year)
257 % 12 = 5 => 05 (May)
Day = 0b11011
= 27
Chassis Number = 0b000000001101010000110001
= 54321
Order = 0b10011
= 19: (=>S)
Site = 0b000000
= 0 => PI (0 - PIsa, 1 - SAerbeck)
Result Chassis Serial Number - AB 21 05 27 54321 S PI
# Example: Change Electrolyser Restart Pressure over Modbus TCP
Here is an example to change Electrolyser Restart Pressure to 25 bar over Modbus TCP. This will enable Electrolyser to restart when pressure drop to 25 bar on outlet.
# Example: Reading Modbus Input Registers
Request Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Word Count 00 01 00 00 00 06 01 04 03 EE 00 02 Request Packet Description
Modbus/TCP
- Transaction ID – default: 00 01
- Protocol ID – default: 00 00
- Query Length – default: 00 06
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Read Input Registers – default: 04
- Reference Number: Starting register – decimal: 1006
- Word Count: Number of registers to read – decimal: 2
Wireshark Example
Response Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Byte Count Register[0] Register[1] 00 01 00 00 00 07 01 04 04 48 00 10 7A Response Packet Description
Modbus/TCP
- Transaction ID – default: 00 01
- Protocol ID – default: 00 00
- Query Length – decimal: 7
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Read Input Registers – default: 04
- Byte Count: Registers values size – decimal: 4
- Register[0] value – decimal: 18432
- Register[1] value – decimal: 4218
- Register[…] value – 2 bytes
Wireshark Example
# Example: Writing to Modbus Holding Registers
Request Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data 00 01 00 00 00 06 01 06 00 04 00 01 Request Packet Description
Modbus/TCP
- Transaction ID – default: 00 01
- Protocol ID – default: 00 00
- Query Length – default: 00 06
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Write Single Register – default: 06
- Reference Number: Starting register – decimal: 4
- Data: Value to write – decimal: 1
Wireshark Example
Response Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data 00 01 00 00 00 06 01 06 00 04 01 Response Packet Description
Modbus/TCP
- Transaction ID – default: 00 01
- Protocol ID – default: 00 00
- Query Length – default: 00 06
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Write Single Register – default: 06
- Reference Number: Register to write – decimal: 4
- Data: Value to write – decimal: 1
Wireshark Example
# Example: Reading Errors Sequence
Request Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Word Count 00 01 00 00 00 06 01 04 03 40 00 20 Request packet description
Modbus/TCP
- Transaction ID – default: 00 01
- Protocol Identifier – default: 00 00
- Query Length – default: 00 06
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Read Input Registers – default: 04
- Reference Number: Starting register – default: 03 40
- Word Count: Number of registers to read – default: 00 20
Wireshark Example
Response Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Byte Count Register[0] Register[1] 00 01 00 00 00 43 01 04 40 00 01 11 B3 Response packet description
Modbus/TCP
- Transaction ID – default: 00 01
- Protocol ID – default: 00 00
- Query Length – default: 00 43
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Read Input Registers – default: 04
- Byte count: Registers values size – default: 40
- Register[0] value – total number of errors, decimal: 1
- Register[1] value – error code 1: 11 B3
- Register[…] value – error code N
Wireshark Example
# Example: Writing Heartbeat Modbus Timeout
Request Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data 00 02 00 00 00 06 01 06 0F A0 00 01 Request Packet Description
Modbus/TCP
- Transaction ID – decimal: 2
- Protocol ID – default: 00 00
- Query Length – default: 00 06
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Write Single Register – default: 06
- Reference Number: Starting register – decimal: 4000
- Data: Value to write – decimal: 1
Wireshark Example
Response Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data 00 02 00 00 00 06 01 06 0F A0 00 01 Response Packet Description
Modbus/TCP
- Transaction ID – decimal: 2
- Protocol ID – default: 00 00
- Query Length – default: 00 06
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Write Single Register – default: 06
- Reference Number: Register to write – decimal: 4000
- Data: Value to write – decimal: 1
Wireshark Example
Request Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data 00 03 00 00 00 06 01 06 11 F8 00 00 Request Packet Description
Modbus/TCP
- Transaction ID – decimal: 3
- Protocol ID – default: 00 00
- Query Length – default: 00 06
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Write Single Register – default: 06
- Reference Number: Starting register – decimal: 4600
- Data: Value to write – decimal: 0
Wireshark Example
Response Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data 00 03 00 00 00 06 01 06 11 F8 00 00 Response Packet Description
Modbus/TCP
- Transaction ID – decimal: 3
- Protocol ID – default: 00 00
- Query Length – default: 00 06
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Write Single Register – default: 06
- Reference Number: Register to write – decimal: 4600
- Data: Value to write – decimal: 0
Wireshark Example
Request Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data 00 04 00 00 00 06 01 06 0F A1 00 01 Request Packet Description
Modbus/TCP
- Transaction ID – decimal: 4
- Protocol ID – default: 00 00
- Query Length – default: 00 06
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Write Single Register – default: 06
- Reference Number: Starting register – decimal: 4001
- Data: Value to write – decimal: 1
Wireshark Example
Response Packet
Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data 00 04 00 00 00 06 01 06 0F A1 00 01 Response Packet Description
Modbus/TCP
- Transaction ID – decimal: 4
- Protocol ID – default: 00 00
- Query Length – default: 00 06
- Unit ID: Slave Address – default: 01
Modbus
- Function Code: Write Single Register – default: 06
- Reference Number: Register to write – decimal: 4001
- Data: Value to write – decimal: 1