Modbus
Modbus is simple, ubiquitous and completely untyped: the device gives you 16-bit registers and it is your job to know what they mean. QUBIQ's Modbus support is about making that mapping explicit and repeatable.
Configuration
| Field | Description |
|---|---|
| Name | Connection identifier. |
| Host | Device IP or hostname. |
| Port | 502 for Modbus TCP; the gateway's port for RTU-over-TCP. |
| Framing mode | tcp (Modbus TCP), rtu (RTU framing over a serial gateway), ascii. |
| Unit ID | The slave/unit address. 1 unless the device or gateway says otherwise. |
| Byte order | How multi-register values are assembled — see below. |
| Connect timeout (ms) | How long to wait for the socket. |
| Request timeout (ms) | How long to wait for a response before failing the read. |
| Probe address / quantity | The register the connection test reads to prove the link. |
Byte and word order
The single most common source of wrong Modbus values. A 32-bit float spans two registers, and vendors disagree on the order of both the words and the bytes within them.
| Order | Also called | Registers for 1.0f (0x3F800000) |
|---|---|---|
| Big-endian | ABCD | 0x3F80, 0x0000 |
| Little-endian | DCBA | 0x0000, 0x803F |
| Big-endian byte swap | BADC | 0x803F, 0x0000 |
| Little-endian byte swap | CDAB | 0x0000, 0x3F80 |
If a value reads as an absurd number (4.6e-41, 1.7e38), the order is wrong — not the address.
Read a register whose value you know, and try orders until it matches.
Register addressing
Modbus has four address spaces. Which one you are reading is part of the address.
| Space | Function code | Access | Typical notation |
|---|---|---|---|
| Coils | 1 / 5 / 15 | read/write bit | 0xxxx |
| Discrete inputs | 2 | read bit | 1xxxx |
| Input registers | 4 | read 16-bit | 3xxxx |
| Holding registers | 3 / 6 / 16 | read/write 16-bit | 4xxxx |
Vendor documentation is inconsistent about whether addresses are 0-based (protocol) or 1-based
(documentation). Holding register "40001" in a manual is protocol address 0. If everything is
shifted by exactly one, this is why.
Binding tags
| Field | Notes |
|---|---|
| Address | Register address, with the space and any width/type qualifier the form provides. |
| Polling mode | poll (normal — Modbus has no subscription mechanism) or write. |
| Sampling rate | Poll period in milliseconds. |
| Deadband | Change threshold before an update is propagated. |
Modbus is strictly request/response. There is no subscribe; a "subscribe" binding is a poll.
Poll rate and register grouping
QUBIQ groups contiguous registers into single requests. Two consequences:
- Contiguous addresses are much cheaper than scattered ones. If you can influence the device's register map, block related values together.
- Do not poll faster than the device can answer. A small PLC serving a serial gateway may manage a few requests per second. Polling every 100 ms produces timeouts, not fresher data.
Start at 1000 ms and reduce only where a faster value demonstrably matters.
Verifying a register
Use Read registers in the connection's editor (needs View connections). It performs a one-shot read of a register range, so you can confirm an address and byte order before building tags on it.
Scaling
Devices frequently transmit scaled integers: temperature as tenths of a degree, pressure as hundredths of a bar. Do not scale in every widget — configure it once on the tag:
Raw low 0 Eng low 0.0
Raw high 10000 Eng high 100.0
Scaling is applied after the read and before history and alarms, so everything downstream sees engineering units. → Tag properties
Writing
Writable tags issue function code 5/6/15/16 depending on the target space and width. A write is acknowledged by the device; a failure surfaces as a rejected write, not a silent no-op.
Gate device writes with a write-security level on the tag so only sufficiently privileged runtime operators can drive equipment. → LiveView authentication
Troubleshooting
| Symptom | Check |
|---|---|
| Connection test times out | Wrong port; some devices use RTU-over-TCP on a non-502 port. Check the unit ID too. |
| Illegal data address | The register does not exist, or the off-by-one above, or the wrong address space. |
| Illegal function | The device does not support that function code — often read-only registers being written. |
| Values are nonsense floats | Byte/word order. |
| Values are exactly 10× or 100× off | Missing scaling. |
| Intermittent timeouts | Polling faster than the device or serial gateway can serve. Slow down. |
One tag Bad, the rest fine | That register is outside a valid block; the grouped read fails for it only. |
Next
→ SNMP · Binding tags