MODBUS Messages

A CTM-15X Modem can be used in MODBUS mode for SCADA applications. This allows the modem to operate as a simple SCADA device that can understand and format MODBUS messages based on various modem parameters, such as inputs and outputs, device information and GPS position. The modem can simultaneously support a MODBUS slave gateway connection.

The modem can be configured to "read" and "write" MODBUS messages using the mode command and modbusadd commands.
The MODBUS message format is defined by the MODBUS organization.

MODBUS Message Format
MODBUS uses a binary format expressed in HEX. It is a Request/Response protocol with allowance for Report by Exception Responses from the slave device.

Parameter	Format
MODBUS ID 0xII	1 byte, range 1 to 247
Function code 0xFF	1 byte defined by MODBUS protocol
Data 0xNN……0xNN	Variable size dependant on function code
Error check 0xZZZZ	2 bytes CRC (not used in MODBUS TCP messages)

The following MODBUS messages are supported by the CTM-15X for reading and setting of its Input/Output.

Read Digital Outputs

In MODBUS term this is called read coils and has function code 0x01.
Request message: 0xII 0x01 0x00 0x00 0x00 0x04 0xZZ 0xZZ

Where:
0xII is the modem’s assigned MODBUS ID
0xZZ 0xZZ is the CRC checksum for this message

Response message: 0xII 0x01 0x01 0xSS 0xZZ 0xZZ

Where:
0xSS is the current state of the 4 digital outputs
Bit 0 represents output #1
Bit 1 represents output #2
Bit 2 represents output #3
Bit 3 represents output #4

Set Digital Output

In MODBUS term this is called write coil and has function code 0x05.
Request message: 0xII 0x05 0x00 0xWW 0xSS 0x00 0xZZ 0xZZ

Where:
0xII is the modem’s assigned MODBUS ID
0xWW is the output to be set: range 0x00 to 0x03 corresponding with outputs 1 through 4
0xSS is the output set state: 0x00 = off, 0xFF = on
0xZZ 0xZZ is the CRC checksum for this message

Response: 0xII 0x05 0x00 0xWW 0xSS 0x00 0xZZ 0xZZ

Where:
0xWW is the output set: range 0x00 to 0x03 corresponding with outputs 1 through 4
0xSS is the set state of the output: 0x00 = off, 0xFF = on

Read Digital Inputs

In MODBUS term this is called read discrete inputs and has function code 0x02.
Request message: 0xII 0x02 0x00 0x00 0x00 0x06 0xZZ 0xZZ

Where:
0xII is the modem’s assigned MODBUS ID
0xZZ 0xZZ is the CRC checksum for this message

Response message: 0xII 0x02 0x01 0xSS 0xZZ 0xZZ

Where:
0xSS is the current state of the 6 digital inputs
Bit 0 represents inputs #1
Bit 1 represents inputs #2
Bit 2 represents inputs #3
Bit 3 represents inputs #4
Bit 4 represents inputs #5
Bit 5 represents inputs #6

Read Analog Inputs

In MODBUS term this is called read input registers and has function code 0x04.
Request message: 0xII 0x04 0xSS 0xSS 0xNN 0xNN 0xZZ 0xZZ

Where:
0xII is the modem’s assigned MODBUS ID
0xSS 0xSS is the start address for reading registers
0xNN 0xNN is the number of registers to read
0xZZ 0xZZ is the CRC checksum for this message

Example:
to read all the modem’s six analog input values:

0xII 0x04 0x00 0x00 0x00 0x06 0xZZ 0xZZ

Response message:

0xII 0x04 0x0C 0xH1 0xL1 0xH2 0xL2 0xH3 0xL3 0xH4 0xL4 0xH5 0xL5 0xH6 0xL6 0xZZ 0xZZ

Where:
0xHn is the high byte for analog input n
0xLn is the low byte for analog input n<

Reg. #	Register content	Notes
0 – 5	Analog input 1 to 6 values	Value in volts x 100, big endian byte order
6	Modem supply VCC	volts x 100, big endian byte order
7	Modem 1xRTT RSSI value	HEX, big endian byte order – units dBm (without the negative sign)
8	Modem internal temperature	HEX, big endian byte order – units degrees Celsius
9	GPS day & month	HEX
10	GPS year	HEX, big endian byte order
11	GPS hours & minutes	HEX
12	GPS seconds & GPS validity flag	Seconds in HEX, Validity flag in ASCII: A = valid; V = invalid
13 – 14	GPS Latitude	Floating point radian format, little endian byte order. To convert to degrees multiply by 180/pi (negative numbers are South, positive are North)
15 – 16	GPS Longitude	Floating point radian format, little endian byte order. To convert to degrees multiply by 180/pi (negative numbers are West, positive are East)
17	GPS speed	Value in m/sec x 10
18	GPS heading	Value 0 to 359 degrees (integer)

Error Response

If the modem is not able to correctly respond to a request then it will send an error response.
Error response format: 0xII 0x8N 0xXX 0xZZ 0xZZ

Where:
0xII is the modem’s assigned MODBUS ID
0x8N is the error code corresponding with the request:
0x81 is for read coils
0x82 is for read discrete inputs
0x84 is for read input registers
0x85 is for write coil
0xXX is the exception code: 0x01, 0x02, 0x03, or 0x04
0xZZ 0xZZ is the CRC checksum for this message

MODBUS TCP Messages

MODBUS TCP messages are identical to those used with standard MODBUS except that they drop the two byte CRC checksum at the end of every message.

Parameter	Format
MODBUS ID	0xNN 1 byte, range 1 to 247
Function code	0xNN 1 byte defined by MODBUS protocol
Data	0xNN……0xNN Variable size dependant on function code