Enapter Handbook

# EL 4.1 FW 3.7.0 Modbus TCP Communication Interface

Note

For more information about examples of interaction with Enapter devices over Modbus communication protocol please visit our GitHub repository (opens new window).

Warning

Concurrent connections to Electrolyser EL 4.1 for Modbus TCP interface limited to two. In case if you are experiencing connection refuse issues with Modbus TCP, you need ensure that there are only two connections are used for communication.

# Introduction

Refer to the Reference section for details of the Modbus protocol.

This document describes public Modbus TCP implementation for Enapter Electrolyser EL 4.1 and assume understanding of TCP/IP and Modbus protocols.

# Physical Interface Connection

Connect Ethernet cable to the Ethernet Port of Enapter Electrolyser EL 4.1.

# TCP/IP Connection Settings

By default DHCP client is enabled therefore IP address will be assigned automatically by DHCP server available in the connected network.

It is recommended to set DHCP reservation based on MAC address of the electrolyser.

Configuration of the Static IP is possible using Enapter Cloud and Enapter Mobile Application for iOS and Android.

# Modbus Connection Settings

Option Value Comment
Modbus Port 502
Modbus Slave Address 1 Enapter Electrolyser always addressed as a slave

# References

http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf (opens new window)

# Data Formats Used

Primary tables Object Type Permission Comment
Input Registers 16 bit word Read Only
Holding Registers 16 bit word Read / Write

# Data Bits/Registers Dimension

Data Type Size in Bits Registers Used Comment
Boolean 16 bits 1 register 0 value means 'false', all other cases - 'true'
Uint16 16 bits 1 register
Uint32 32 bits 2 registers
Uint64 64 bits 4 registers
Uint128 128 bits 8 registers
Float32 32 bits 2 registers IEEE 754 Single-precision floating-point
Int32 32 bits 2 registers

# Data Encoding

Big-endian, high word first data encoding used.

This means that when more than single byte (8 bits) is transmitted, network byte order is used - the most significant byte placed at lower address (sent first).

# Implemented Modbus Functions

Function Code Comment
Read Holding Registers 03
Read Input Registers 04
Write Single Holding Register 06
Write Multiple Holding Registers 16

# Modbus Data Model

Input registers and Holding registers are referred to in the range 3XXXX and 4XXXX respectful (also known as PLC Address). For example, Holding register 0 in this document would be referred to as 40001 and would be addressed as register 0000 in the data address field of the Modbus message (also known as Protocol Address).

# Set/Read Modbus IP

To set Modbus IP:

  1. Open the Cloud and navigate to your site
  2. Select EL 4.1 you want to set Modbus IP
  3. Click the Configuration menu item
  4. Click Set Modbus IP
  5. Enter the IP address and then click Create Command
  6. Wait until command will be accepted

To read Modbus IP:

  1. Open the Cloud and navigate to your site
  2. Select EL 4.1 you want to read Modbus IP
  3. Click the Configuration menu item
  4. Click Read Modbus IP
  5. You can see Modbus IP in Execution Payload section

# Modbus Table

# Holding Registers (Read / Write)

Register Data Type Name Comment
0 Uint64 Unix Time Seconds from 1 January 1970 UTC.
e.g. 02/29/2020 @ 3:15 PM (UTC) represented as 1582989315.
4 Boolean Reboot 1 = Reboot.
5 Boolean Locate Electrolyser 1 = Start Blinking All LED; 0 = Stop Blinking All LED.
1000 Boolean Start / Stop Electrolyser 1 = Start; 0 = Stop.
1002 Float32 Production Rate [%] Current production rate in percent (system reset set this value to 'Default Production Rate'), can be changed 'on-fly' even when electrolyser produce H2
1011 Boolean Force Water Refilling 1 = Start Force Water Refilling
1013 Boolean Maintenance Mode 1 = Enable Maintenance Mode; 0 = Disable Maintenance Mode.
1014 Boolean Preheat 1 = Start Preheat; 0 = Stop Preheat
1015 Boolean Flushing 1 = Skip Flushing; 0 = Flushing
1016 Uint16 Start SIF Proof-Tests 0 = No test; 1 = Start SIF1; 3 = Start SIF3; 4 = Start SIF4; 5 = Start SIF5; 6 = Start SIF6
4000 Boolean Configuration Begin 1 = Start configuration
4001 Boolean Configuration Commit 1 = Commit current changes; 0 = Rollback changes
4020 Uint32 Set Ethernet IP Address e.g. 0xC0A80201 (192.168.2.1); 0 = DHCP enabled
4022 Uint32 Set Ethernet IP Netmask Ex: 255.255.255.0
4024 Uint32 Set Ethernet Gateway IP Address Ex: 192.168.2.1
4038 Int32 Cloud logs 0 = disable logging (default); 1 = only fatal errors; 2 = fatal errors and errors; 3 = warnings and more important; 4 = everything before and important messages; 5 = all messages, except internal debug ones
4042 Int32 System logs 0 = disable logging (default); 1 = only fatal errors; 2 = fatal errors and errors; 3 = warnings and more important; 4 = everything before and important messages; 5 = all messages, except internal debug ones
4044 Uint32 Syslog IP Address Default IP address 255.255.255.255 (Broadcast)
4046 Uint16 Syslog Port Default port 514
4142 Float32 Chassis Altitude [m]
4308 Float32 Set Max Tank Pressure (Outlet) [bar]
4310 Float32 Set Restart Pressure (Outlet) [bar]
4396 Float32 Set Default Production Rate [%] This register can be modified only when stack is inactive (Idle or Maintenance mode)
4600 Uint32 Heartbeat ModBus Timeout [Seconds]; 0 = disable
4602 Uint32 Heartbeat Gateway Timeout [Seconds]; 0 = disable
4604 Uint32 Heartbeat UCM Timeout [Seconds]; 0 = disable
5602 Boolean Modbus Swap Bytes 0 = false (default); 1 = true
Check Modbus Swap Table for more information.
Reset is required to accept changes.
5603 Boolean Modbus Swap Words 0 = false (default); 1 = true
Check Modbus Swap Table for more information.
Reset is required to accept changes.
6014 Float32 PT01 minimal threshold Dryer output pressure at which it leaves Stand-by. Updated value is saved only after writing 1 to register #6022.
6016 Float32 PT01 maximal threshold Dryer output pressure at which it moves to Stand-by. Updated value is saved only after writing 1 to register #6022.
6018 Boolean Start/Stop Dryer Write: 1 = Start; 0 = Stop. Read register #6021 to check Dryer Logic States. Avoid frequent write operations, since it can damage Dryer's Flash.
6019 Uint16 Stop Dryer DEPRECATED
6020 Uint16 Reboot Dryer Write: 1 = Reboot Dryer; Read = number of times Dryer was rebooted. Avoid frequent write operations, since it can damage Dryer's Flash.
6022 Uint16 Save updated Dryer configuration Write: 1 = Save updated Dryer configuration on flash. Avoid frequent write operations, since it can damage Dryer's Flash.
6023 Uint16 Locate Dryer in DCN/IDCN 0 = Disable; 1 = Enable
6024 Uint16 Reboot UCM 1 = Reboot UCM
6025 Uint16 Plugin ID Plugin ID which is used to save the data written to register #6026.
1 = Auto Control Plugin.
6026 Uint16 Plugin Argument 0 = Disable plugin; 1 = Enable plugin
6200 Uint32 Water Tank status Read Water Tank States (bitmask)
6202 Float32 Water Tank water level [Liters]
6204 Float32 Water Tank inlet temperature [°C]
6206 Float32 Water Tank tank temperature [°C]
6208 Float32 Water Tank conductivity [μS/cm]
6210 Float32 Water Tank pump current [Amperes]
6212 Uint32 Reserved Reserved for WT21
6214 Uint32 Reserved Reserved for WT21
6216 Uint32 Reserved Reserved for WT21
6218 Uint32 Reserved Reserved for WT21
6220 Uint32 Water Tank UCM uptime [Seconds]
6222 Uint16 Command to Water Tank Write: 1 = Start; 2 = Stop; 3 = Reboot WT control board; 4 = Reboot WT UCM board; 5 = Locate OFF; 6 = Locate ON; 7 = Maintenance OFF; 8 = Maintenance ON
6223 Uint16 Reserved Reserved for WT21
7000 Boolean Electrolyte Tank Heater (H102_out_power) Read: 0 = Disabled; 1 = Enabled
7001 Boolean Pump (P107_out_power) Read: 0 = Disabled; 1 = Enabled
7002 Boolean PSU (PSU_out_power) Read: 0 = Disabled; 1 = Enabled
7003 Boolean H2 Vent Line Solenoid Valve (V101_out_open) Read: 0 = Disabled; 1 = Enabled
7004 Boolean Water Refilling Solenoid Valve (V105_out_open) Read: 0 = Disabled; 1 = Enabled
7005 Boolean Cooling valve V106 For Liquid Cooled electrolyser.
Read: 0 = Closed; 1 = Open
Write (Maintenance Mode only): 0 = Close; 1 = Open
7006 Boolean Electrolyte Cooler Fan (F103A_out_power) Read: 0 = Disabled; 1 = Enabled
7500 Float32 Electrolyte Cooler Fan (F103A_out_pwm) Read: [PWM]
7502 Float32 Electronic Compartment Cooling Fan (F108C_out_pwm) Read: [PWM]
7504 Float32 Pump Voltage (P107_out_v) Read: [Volt]
7506 Float32 PSU Voltage (PSU_out_v) Read: [Volt]

# Input Registers (Read Only)

Register Data Type Name
0 Uint32 Device Model 0x45533431 ("EL41")
2 Uint16 Firmware MAJOR and MINOR Version Ex: 769 => 769 // 256 = 3, 769 % 256 => 1 (3.1)
3 Uint16 Firmware PATCH Version Ex: 3 => 3 (3)
4 Uint32 Firmware Build Number Ex: 0x4E343471
6 Uint128 Device Control Board Serial Number Ex: 9E25E695-A66A-61DD-6570-50DB4E73652D
14 Uint64 Chassis Serial Number 1 bits - reserved, must be 0
10 bits - Product Unicode
11 bits - Year + Month
5 bits - Day
24 bits - Chassis Number
5 bits - Order
8 bits - Site
Example
18 Uint16 System State 0 = Internal Error, System not Initialized yet; 1 = System in Operation; 2 = Error; 3 = Fatal Error; 4 = System in Expert Mode.
20 Uint32 Live time [seconds] Total time during which a system is power up (not only time when stack is working).
22 Uint32 Uptime [seconds] How long the system has been running
768 Array of Uint16 Warning Codes Warning Events Array The sequence of registers with warning codes. The first register contains the total number of warnings, while the subsequent registers include the Uint16 warning codes (refer to the table).
832 Array of Uint16 Error Codes Error Events Array The sequence of registers with error codes. The first register contains the total number of errors, while the subsequent registers include the Uint16 error codes (refer to the table).
1000 Uint32 Product Code 0x44 = ELE410535A2ASV01
0x45 = ELE410508A2ASV01
0x46 = ELE410535A2LSV01
0x47 = ELE410508A2LSV01
0x48 = ELE410535D4ASV01
0x49 = ELE410535A2AEV01
0x4A = ELE410535A2LEV01
0x4B = ELE410535A2ASV02
0x4C = ELE410535A2LSV02
0x4D = ELE410508A2ASV02
0x4E = ELE410508A2LSV02
0x4F = ELE410535A2ASV03
0x50 = ELE410508A2ASV03
0x51 = ELE410535A2LSV03
0x52 = ELE410508A2LSV03
0x53 = ELE410535A2AEV02
0x54 = ELE410535A2LEV02
1002 Uint32 Stack Start/Stop Cycles Quantity How many Stack Start/Stop cycles
1004 Uint32 Stack Total Runtime seconds
1006 Float32 Stack Total H2 Production NL
1008 Float32 H2 Flow Rate NL/hour, NAN when not producing H2
1010 Uint64 Stack Serial Number 1 bits - reserved, must be 0
15 bits - Stack Type
11 bits - Year + Month
5 bits - Day
24 bits - Stack Number
8 bits - Site
1014 Uint16 Cooling Type 1 = Air cooling; 2 = Liquid cooling
1200 Uint16 Electrolyser State 0 = Halted; 1 = Maintenance mode; 2 = Idle; 3 = Steady; 4 = Stand-By (Max Pressure); 5 = Curve.
4000 Boolean Configuration Progress 1 = Configuration is in progress.
4001 Boolean Configuration Source 1 = Configuration over Modbus.
4002 Int32 Last Configuration Result 0 = OK, Configuration was completed successfully; 1 = Permanent, The operation has failed (internal or general error); 2 = No Entry, Configuration was not started or interrupted; 5 = I/O, Data save error; 11 - Try again, Configuration needs to be tried again; 13 = Access Denied, Some changed registers are read-only; 16 = Busy, Another configuration was in progress; 22 = Invalid, The data has invalid or wrong type.
4004 Uint16 Last Configuration Wrong Holding Keeps first invalid Holding register number which doesn't allow successful configuration commit.
4600 Uint16 Heartbeat Timeout for Modbus Heartbeat in seconds. 0 = disabled (default)
6000 Uint16 Dryer Error Dryer error code (bitmask).
6001 Uint16 Dryer Warning Dryer warning code (bitmask).
6002 Float32 Dryer TT00 Temperature of heater element for cartridge 0 (first line).
6004 Float32 Dryer TT01 Temperature of heater element for cartridge 1 (second line).
6006 Float32 Dryer TT02 Temperature of heater element for cartridge 2 (first line).
6008 Float32 Dryer TT03 Temperature of heater element for cartridge 3 (second line).
6010 Float32 Dryer PT00 Input pressure of the dryer.
6012 Float32 Dryer PT01 Output pressure of the dryer.
6021 Uint16 Dryer state Read Dryer Logic States
7000 Boolean High Electrolyte Level Switch (LSH102B_in) 1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7001 Boolean Very High Electrolyte Level Switch (LSHH102A_in) 1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7002 Boolean Low Electrolyte Level Switch (LSL102D_in) 1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7003 Boolean Medium Electrolyte Level Switch (LSM102C_in) 1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7004 Boolean Electrolyte Tank High Pressure Switch (PSH102_in) 1 = Pressure is too high; 0 = Pressure is normal.
7007 Boolean Electronic Compartment High Temperature Switch (TSH108_in) 1 = Temperature is too high. 0 = Temperature is normal.
7009 Boolean Chassis Water Presence Switch (WPS104_in) 1 = Water is present on input; 0 = No water input.
7010 Boolean Dry Contact 1 = OK (Closed); 0 = NOT OK (Opened)
7012 Boolean Safety Board Relay Status (SB_RELAY_STATUS_in_open) 1 = Open; 0 = Closed
7013 Boolean Safety Board Dry Contact (SB_DRYCONTACT_in_open) 1 = Open; 0 = Closed
7014 Boolean Safety Board WriteEN (SB_WRITE_EN_in_enabled) 1 = Enabled; 0 = Disabled
7015 Boolean Safety Board FANDIAG (SB_FANDIAG_out_activated) 1 = Activated; 0 = Diactivated
7016 Boolean Safety Board WPSDIAG (SB_WPSDIAG_out_activated) 1 = Activated; 0 = Diactivated
7017 Boolean Safety Board Relay0 (SB_RELAY0_out_open) 1 = Open; 0 = Closed
7018 Boolean Safety Board PSU_EN (SB_PSU_EN_out_power) 1 = Enabled; 0 = Disabled
7500 Float32 Electrolyte Cooler Fan Speed (F103A_in_rpm) [rpm]
7502 Float32 Air Circulation Fan Speed (F104B_in_rpm) [rpm]
7504 Float32 Electronic Compartment Cooling Fan Speed (F108C_in_rpm) [rpm]
7506 Float32 Electrolyte Flow Meter (FM106_in_lmin) [Liters per minute]
7508 Float32 Stack Current (HASS_in_a) [Ampere]
7510 Float32 PSU Voltage (Stack Voltage) (PSU_in_v) [Volt]
7512 Float32 Inner Hydrogen Pressure (PT101A_in_bar) [bar]
7514 Float32 Outer Hydrogen Pressure (PT101C_in_bar) [bar]
7516 Float32 Water Inlet Pressure (PT105_in_bar) [bar]
7518 Float32 Electrolyte Temperature (TT102A_in_c) [°C]
7520 Float32 Downstream Temperature (TT106_in_c) [°C]
7522 Float32 Board Power 5V (V5_in_v) [Volt]
7524 Float32 Board Power 12V (V12_in_v) [Volt]
7526 Float32 Board Power 24V (V24_in_v) [Volt]
7528 Float32 MCU Backup Battery (BAT_in_v) [Volt]
7530 Float32 MCU Temperature (MCU_in_c) [°C]
7532 Float32 Board Temperature (BOARD_in_c) [°C]
7538 Float32 Gas Presence (HT104_in_ppm) [parts/million]
7540 Float32 Safety Board Temperature (TE108_in_c) [°C]
8002 Float32 Outer Hydrogen Pressure Raw Sensor Value (PT101C_in_v) Raw value, [Volt]
8004 Float32 Stack Current Raw Sensor Value (HASS_in_v) Raw value, [Volt]
8006 Float32 Gas Sensor Voltage (HT104_in_v) Raw value, [Volt]

# Dryer error/warning code bitmask

Dryer error/warning code bitmask (opens new window) is 16-bit value where each bit representing one type of error. The following table provides the detailed description of each error.

Bit number Description
0 TT00 has invalid value (sensor provides unexpected values)
1 TT01 has invalid value (sensor provides unexpected values)
2 TT02 has invalid value (sensor provides unexpected values)
3 TT03 has invalid value (sensor provides unexpected values)
4 TT00 value growth is not enough (heating mechanism does not work properly)
5 TT01 value growth is not enough (heating mechanism does not work properly)
6 TT02 value growth is not enough (heating mechanism does not work properly)
7 TT03 value growth is not enough (heating mechanism does not work properly)
8 PS00 (pressure switch on line 0) is triggered
9 PS01 (pressure switch on line 1) is triggered
10 F100 has invalid RPM speed (fan between line 0 and line 1)
11 F101 has invalid RPM speed (fan on line 0)
12 F102 has invalid RPM speed (fan on line 1)
13 PT00 (Input pressure) has invalid value (sensor provides unexpected values)
14 PT01 (Output pressure) has invalid value (sensor provides unexpected values)

# Water Tank States (bitmask)

Water Tank status bitmask (opens new window) is 32-bit value where bit representing one type of status. The following table provides the detailed description of each state.

Bit number State Name
0 N/A
1 Stop
2 Maintenance
4 Manual mode
5 Bad quality water input
6 Waiting for water
7 High water inlet temperature
8 Low water inlet temperature
9 Very low water level
10 Low water level
11 Very high water level (warning)
13 Low water tank temperature
15 Very high water level (fatal error)
16 Tank refilling issue
17 Tank temperature sensor broken
18 Inlet temperature sensor broken
19 Water level sensor broken
20 Water level sensor miscalibrated
21 Current sensor broken
22 Water leak
23 Valve leak
24 Pump broken
26 Factory settings reset failed
27 Internal error

# Modbus Swap Table

Swap Words (Holding/5603) Swap Bytes (Holding/5602)
Big Endian (default) False False
Little Endian True True
Big Endian (Byte Swap) False True
Little Endian (Byte Swap) True False

# Diagrams

# System State Diagram

This diagram describes possible transition between different electrolyser states. The state can be read in the Input Register #18.

# Examples

# Example: Reading Chassis Serial Number

Read from Modbus 586601960808264448.

Decode into binary format 0001000001 00100000001 11011 000000001101010000110001 10011 00000000 and parse every part.

Product Unicode = 0b0001000001 = 65 => 'AB'

65 % 32 = 1 => A (A=1, B=2,..., Z=26 => 'A')

65 // 32 = 2 => B (A=1, B=2,..., Z=26 => 'B')

Year + Month = 0b00100000001 = 257 => 21 05

257 // 12 = 21 => 21 (Year)

257 % 12 = 5 => 05 (May)

Day = 0b11011 = 27

Chassis Number = 0b000000001101010000110001 = 54321

Order = 0b10011 = 19: (=>S)

Site = 0b000000 = 0 => PI (0 - PIsa, 1 - SAerbeck)

Result Chassis Serial Number - AB 21 05 27 54321 S PI

# Example: Change Electrolyser Restart Pressure over Modbus TCP

Here is an example to change Electrolyser Restart Pressure to 25 bar over Modbus TCP. This will enable Electrolyser to restart when pressure drop to 25 bar on outlet.

# Example: Reading Modbus Input Registers

  • Request Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Word Count
    00 01 00 00 00 06 01 04 03 EE 00 02

  • Request Packet Description

    Modbus/TCP

    • Transaction ID – default: 00 01
    • Protocol ID – default: 00 00
    • Query Length – default: 00 06
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Read Input Registers – default: 04
    • Reference Number: Starting register – decimal: 1006
    • Word Count: Number of registers to read – decimal: 2

  • Wireshark Example

    Reading Modbus Request

  • Response Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Byte Count Register[0] Register[1]
    00 01 00 00 00 07 01 04 04 48 00 10 7A

  • Response Packet Description

    Modbus/TCP

    • Transaction ID – default: 00 01
    • Protocol ID – default: 00 00
    • Query Length – decimal: 7
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Read Input Registers – default: 04
    • Byte Count: Registers values size – decimal: 4
    • Register[0] value – decimal: 18432
    • Register[1] value – decimal: 4218
    • Register[…] value – 2 bytes

  • Wireshark Example

    Reading Modbus Response

# Example: Writing to Modbus Holding Registers

  • Request Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data
    00 01 00 00 00 06 01 06 00 04 00 01

  • Request Packet Description

    Modbus/TCP

    • Transaction ID – default: 00 01
    • Protocol ID – default: 00 00
    • Query Length – default: 00 06
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Write Single Register – default: 06
    • Reference Number: Starting register – decimal: 4
    • Data: Value to write – decimal: 1

  • Wireshark Example

    Writing Modbus Request

  • Response Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data
    00 01 00 00 00 06 01 06 00 04 01

  • Response Packet Description

    Modbus/TCP

    • Transaction ID – default: 00 01
    • Protocol ID – default: 00 00
    • Query Length – default: 00 06
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Write Single Register – default: 06
    • Reference Number: Register to write – decimal: 4
    • Data: Value to write – decimal: 1

  • Wireshark Example

    Writing Modbus Response

# Example: Reading Errors Sequence

  • Request Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Word Count
    00 01 00 00 00 06 01 04 03 40 00 20

  • Request packet description

    Modbus/TCP

    • Transaction ID – default: 00 01
    • Protocol Identifier – default: 00 00
    • Query Length – default: 00 06
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Read Input Registers – default: 04
    • Reference Number: Starting register – default: 03 40
    • Word Count: Number of registers to read – default: 00 20

  • Wireshark Example

    Reading Errors Request

  • Response Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Byte Count Register[0] Register[1]
    00 01 00 00 00 43 01 04 40 00 01 11 B3

  • Response packet description

    Modbus/TCP

    • Transaction ID – default: 00 01
    • Protocol ID – default: 00 00
    • Query Length – default: 00 43
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Read Input Registers – default: 04
    • Byte count: Registers values size – default: 40
    • Register[0] value – total number of errors, decimal: 1
    • Register[1] value – error code 1: 11 B3
    • Register[…] value – error code N

  • Wireshark Example

    Reading Errors Response

# Example: Writing Heartbeat Modbus Timeout

  • Request Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data
    00 02 00 00 00 06 01 06 0F A0 00 01

  • Request Packet Description

    Modbus/TCP

    • Transaction ID – decimal: 2
    • Protocol ID – default: 00 00
    • Query Length – default: 00 06
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Write Single Register – default: 06
    • Reference Number: Starting register – decimal: 4000
    • Data: Value to write – decimal: 1

  • Wireshark Example

    Writing Heartbeat Modbus Timeout Request 1

  • Response Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data
    00 02 00 00 00 06 01 06 0F A0 00 01

  • Response Packet Description

    Modbus/TCP

    • Transaction ID – decimal: 2
    • Protocol ID – default: 00 00
    • Query Length – default: 00 06
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Write Single Register – default: 06
    • Reference Number: Register to write – decimal: 4000
    • Data: Value to write – decimal: 1

  • Wireshark Example

    Writing Heartbeat Modbus Timeout Response 1

  • Request Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data
    00 03 00 00 00 06 01 06 11 F8 00 00

  • Request Packet Description

    Modbus/TCP

    • Transaction ID – decimal: 3
    • Protocol ID – default: 00 00
    • Query Length – default: 00 06
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Write Single Register – default: 06
    • Reference Number: Starting register – decimal: 4600
    • Data: Value to write – decimal: 0

  • Wireshark Example

    Writing Heartbeat Modbus Timeout Request 2

  • Response Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data
    00 03 00 00 00 06 01 06 11 F8 00 00

  • Response Packet Description

    Modbus/TCP

    • Transaction ID – decimal: 3
    • Protocol ID – default: 00 00
    • Query Length – default: 00 06
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Write Single Register – default: 06
    • Reference Number: Register to write – decimal: 4600
    • Data: Value to write – decimal: 0

  • Wireshark Example

    Writing Heartbeat Modbus Timeout Response 2

  • Request Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data
    00 04 00 00 00 06 01 06 0F A1 00 01

  • Request Packet Description

    Modbus/TCP

    • Transaction ID – decimal: 4
    • Protocol ID – default: 00 00
    • Query Length – default: 00 06
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Write Single Register – default: 06
    • Reference Number: Starting register – decimal: 4001
    • Data: Value to write – decimal: 1

  • Wireshark Example

    Writing Heartbeat Modbus Timeout Request 3

  • Response Packet

    Transaction ID Protocol ID Query Length Unit ID Function Code Reference Number Data
    00 04 00 00 00 06 01 06 0F A1 00 01

  • Response Packet Description

    Modbus/TCP

    • Transaction ID – decimal: 4
    • Protocol ID – default: 00 00
    • Query Length – default: 00 06
    • Unit ID: Slave Address – default: 01

    Modbus

    • Function Code: Write Single Register – default: 06
    • Reference Number: Register to write – decimal: 4001
    • Data: Value to write – decimal: 1