Integration & Gateways · Study deck

Modbus and the Register Contract

Picture a heat meter that returns the number 517.

Gateway Gus is your guide for this deck.

modbus

After studying this chapter

Learning objectives

You will be able to:

map coils, discrete inputs, input registers, and holding registers to what they can and cannot prove
build an integration record before polling a Modbus device
separate a protocol-level failure (no response, exception) from a data-meaning failure (wrong value, unexpected write)
review a Modbus register contract for release

Major section

Start With the Number Behind the Register

The screen should show 51.7 degrees, but only if the team chose the right location, scale, sign, and byte order.

A reply is not proof that the value is correct.
Modbus is a small set of request and response rules used by industrial devices.
The device manual gives those locations their engineering meaning.

A Modbus TCP application data unit combines a seven-byte MBAP header with the operation carried in its PDU.

Major section

Start With the Number Behind the Register (continued)

It lets one side read or write bits and groups of 16-bit numbers.

A gateway is a bridge that can carry those requests between unlike links.
No reply, an error reply, a wrong value, and an unsafe write need different action.
The useful question is not whether Modbus returned bytes.

The four object families tell the client how the value can be accessed; the device manual tells the team what the value means.

Major section

Overview: Modbus Exposes a Register Contract

Modbus is a compact industrial request/response protocol for reading and writing device state.

Its stable idea is not a rich device model; it is a client asking a server for coils, discrete inputs, input registers, or holding registers.
That separation is useful and dangerous.
The register map and integration record do.

Modbus separates the protocol operation from the engineering meaning that a register map supplies.

Major section

Overview: Modbus Exposes a Register Contract (continued)

A valid response frame can still be wrong engineering data if address, width, order, or scale is misread.

For example, a heat-meter manual might label a supply temperature as holding register 40017, scale it by 0.1 degrees, and store a 32-bit value across two adjacent 16-bit registers.
If you only remember one rule, remember this: Modbus does not explain what a value means.
The known physical value is the final check.

Gateway boundaries need explicit mapping records so Ethernet clients do not hide serial timing and addressing assumptions.

Major section

Overview: Modbus Exposes a Register Contract (continued)

CoilsSingle-bit read/write outputs such as run commands, relay outputs, resets, or binary actuator states.

One client library may expect the human reference number, another may expect zero-based protocol address 16, and a gateway may pass only the function code plus address onward to a serial device.
The protocol operation carries a function code and address over either a serial segment or a TCP connection; it does not carry the engineering definition of the value.
Discrete inputsSingle-bit read-only inputs such as contact states, alarm bits, limit switches, and status points.

Major section

Practitioner: Build the Integration Record Before Polling

The record also explains the transport path.

A useful Modbus integration record lets another engineer reproduce the connection without guessing.
Modbus RTU carries requests over a serial segment with device addresses, timing boundaries, and frame error checks.
Modbus TCP carries the same application operation through a TCP connection with an application header.

Modbus RTU framing becomes integration evidence only when captured bytes, address convention, device-map meaning, and observed response agree.

Major section

Practitioner: Build the Integration Record Before Polling (continued)

The transaction field pairs each request with its response.

It identifies the device, each value, the object family, the protocol address expected by the client or gateway, the engineering unit, the scaling rule, byte and word order, read/write permission, and the expected polling behavior.
In a small pump-skid integration, the record should make each assumption testable before the polling loop is left unattended.
The PDU then states the function and its data.

Major section

Practitioner: Build the Integration Record Before Polling (continued)

Device manuals and client libraries may describe the same register differently.

A valid frame proves that the addressed device answered without a detected frame error; it does not prove that the chosen register, word order, scale, or unit is correct.
The gateway may forward that named temperature, but the last panel still compares it with a trusted probe on the same pipe.
Multi-register values need scaling, signedness, byte order, and word order.

Major section

Practitioner: Build the Integration Record Before Polling (continued)

A small tested map that shows documented label, object type, client address, and observed value.

That physical check is what proves the decoded number means the intended process condition.
Blaming the network when the value is present but decoded incorrectly.
Known-good sample values, units, limits, and conversion notes from the device documentation.

Major section

Practitioner: Build the Integration Record Before Polling (continued)

The sequence separates communication success from engineering correctness and shows why a capture, map version, conversion rule, gateway route, and field observation belong in one integration record.

Its two parts are the MBAP header and the PDU.
It also has a one-byte Unit Identifier, so 2 + 2 + 2 + 1 = 7 bytes.
At a gateway, the unit field selects the serial target.

Major section

Under the Hood: Separate Protocol Failure from Data Meaning Failure

Good Modbus troubleshooting separates symptoms before changing configuration.

Treating every symptom as a generic network failure usually adds retries while leaving the real defect in the register map, gateway boundary, or security envelope.
A useful triage pattern is to preserve the first failing request and classify it before tuning.
Keeping those buckets separate prevents a security or data-quality issue from being hidden behind more retries.

Troubleshooting is faster when the evidence ladder separates link, address, function, encoding, gateway, and security questions.

Major section

Under the Hood: Separate Protocol Failure from Data Meaning Failure (continued)

A Modbus exception response means the server answered but rejected the operation, so function code, address range, permission, or device mode is the next evidence.

A plausible response with an impossible value means decoding work: offset convention, scaling, signed interpretation, endian order, stale point mapping, or a wrong adjacent register.
Unexpected writeReview allowed clients, firewall rules, write-code blocking, change logs, remote-access path, and device mode.
The boundary admits allowed clients and can block write functions that a read-only integration does not need.

Major section

Summary

Modbus is useful because it is small and predictable, but that simplicity shifts responsibility into engineering records.

The protocol defines object families, function operations, and transport mappings.
The device register map defines meaning, scaling, write safety, and decoding.
RTU, TCP, and gateway paths all need different evidence, and classic Modbus deployments need an explicit security envelope before values are exposed upstream.

Deck summary

Key takeaways

The screen should show 51.7 degrees, but only if the team chose the right location, scale, sign, and byte order.

It lets one side read or write bits and groups of 16-bit numbers.
Modbus is a compact industrial request/response protocol for reading and writing device state.
A valid response frame can still be wrong engineering data if address, width, order, or scale is misread.
CoilsSingle-bit read/write outputs such as run commands, relay outputs, resets, or binary actuator states.

Retrieval practice

Recall check 1 of 3

Gateway Gus says: answer from memory, then check your reasoning.

Q1A drive exposes a speed setpoint that a controller must read and write. Which Modbus object type is the best fit?

ADiscrete input (read-only bit)

BHolding register (read/write)

CInput register (read-only data)

DGateway Unit Identifier (route ID)

Show answer

Answer: B Writable numeric setpoints normally belong in holding registers.

Retrieval practice

Recall check 2 of 3

Gateway Gus says: answer from memory, then check your reasoning.

Q2A Modbus TCP client reaches a gateway, but reads from the wrong downstream RTU device. Which review artifact should you check first?

AGateway Unit Identifier and downstream serial-address map

BRegister scaling table for the selected measurement value

CEthernet switch port label and dashboard color setting

DCloud retention rule for stored polling history

Show answer

Answer: A Gateway problems should be reviewed at the boundary: client address, gateway endpoint, Unit Identifier or routing field, downstream serial address, timeout, retry, and error translation behavior.

Retrieval practice

Recall check 3 of 3

Gateway Gus says: answer from memory, then check your reasoning.

Q3A Modbus poll succeeds, but a temperature value is clearly wrong while neighboring values look reasonable. What should you inspect before blaming network loss?

ATCP retry count and socket keepalive timer for every poll

BChart refresh interval and dashboard color mapping

CRack location and cable label for the nearby device

DScaling, signedness, byte order, word order, and address offset

Show answer

Answer: D Modbus troubleshooting should first classify the evidence.

Print reference

Answers

Answer key.

B · Writable numeric setpoints normally belong in holding registers.
A · Gateway problems should be reviewed at the boundary: client address, gateway endpoint, Unit Identifier or routing field, downstream serial address, timeout, retry, and error translation behavior.
D · Modbus troubleshooting should first classify the evidence.