EIM Modbus RTU


This document describes an overview of Modbus and how it is used in the ETS system. Modbus (RTU) can be used to read a variety of data from the ETS system to some sort of Modbus master device, to be used remotely or on-site. A proper understanding of how the items are addressed and scaled in ETS will help ensure your system setup works correctly.

Brief Modbus overview

Modbus is a serial communication protocol that is designed for reading and writing individual data items from a set of devices on the serial network. The device sending the commands is called the Modbus Master, and each other device on the network is called a Modbus Slave. Each slave will have a unique address, called the “Slave Address”, “Station Address”, or “Slave ID”. This address can run from 1 – 247.

Each slave ID will have a set of “Modbus Registers” that link to certain data items. The registers are broken into four sets, each numbered in a different range:

  • (1-9999) Discrete Output Coils
  • (10001-19999) Discrete Input Contacts
  • (30001-39999) Analog Input Registers
  • (40001-49999) Analog Output Holding Registers

While the register numbers, as referenced in documentation, will be numbered as they are above, it is important to note that in an actual Modbus command the data address (not to be confused with station address above) is always numbered 0-9999, and the register set that is actually read is based on the function code.

A command will contain a specific “Function code”, which indicates whether it is a read or write, whether it covers one or multiple registers, and which of the four register sets is used. There are 8 function codes in standard Modbus.

A Modbus Master command will contain:

  1. The slave ID for which the command is intended
  2. The function code
  3. The data address of the register
  4. The number of registers requested (for some function codes)
  5. The “CRC”, which is an error-checking number

As an example, we might want to read register 40002. The Modbus will send a command to the slave ID in question with function 4 (read input registers) from data address 1. Since the function code links to analog input registers, then the slave will know that the data address “1” is referring to register 40002, because analog input registers are register set 40001-49999, and address 1 is the second register (the first being address 0).


Slave IDs

In ETS, each module in the system will have its own slave ID. However, all Modbus responses will come from the EIM only, which has the Modbus connection. The slave ID can be changed on the EIM on the Modbus screen.

For example, the EIM might have an ID of 10 and the AFRC Lite might be connected and have an ID of 11. If a Modbus master command arrives addressed to either ID 10 or 11, the EIM will respond. For any other address, the EIM will not respond.

Modbus Screen showing slave ID setups

If a Modbus request arrives matching a module ID, but that module is not actually attached currently, the EIM will not respond.

Register Scaling

Each module in ETS has its own Modbus table showing the data at different registers. An example section of the AFRC Lite Modbus table is shown below.

For many registers, the value is scaled to go from a decimal number to an integer. To decode from a Modbus register value to the real value, use the equation below

[real value] = [register value]*[Resolution/Bit] + [Offset]

The last two items in the above equation are in the Modbus tables. As an example, perhaps the register 30001 (Pre-Cat Exhaust Temp) was read and the value was 37,077. Using the values from the above table:

[real value] = 37077*0.03125 + (-273) = 885.6 degrees

Register Addressing

Note also in the table above that there is a separate column for “Register” and “Address”. The difference between the two has been previously discussed, and both are listed for convenience. Different Modbus and SCADA systems use various methods for specifying the register that is read. The register itself might be entered in a high-level program, and it will determine the data address on its own by using the last 4 digits. Alternately, a program might need the data address specified directly. The ETS uses “PLC Addressing” which is base 0 addressing. If this is not an option in a Modbus Master program, the address that is requested might have to be decremented by 1.


In the program “Modbus Poll”, the following setup was used for Read/Write definition:

  • Slave ID: 20 (which was the AFRC Lite configured slave ID)
  • Function 04 Read Input registers (This uses the table above, registers 30001-39999)
  • Address: 1
  • Quantity: 3 (Address 1 and quantity 3 should read registers 30001-30003)
  • PLC Addresses (Base 1) checked

The response was the three temperatures (Precat, Postcat, and Diff temp) as desired. Modbus Poll sent a “0” as the data address since the PLC Addresses was checked. If the program did not have this option, the same result could be obtained by using the address “0” to refer to address 1.

Table types

The convention for table types generally used in ETS is the following:

(1-9999) Discrete Output Coils

Discrete output coils are for settings that can be represented as binary (0/1 or off/on). For example, valve auto or manual mode.

(10001-19999) Discrete Input Contacts

Discrete input contacts are for board inputs that can be represented as binary (0/1 or off/on). For example, the state of the oil pressure switch.

(30001-39999) Analog Input Registers

Analog input registers are for almost all other values that are not binary. E.g. temperatures, pressures, etc.

(40001-49999) Analog Output Holding Registers

Analog output holding registers are for settings that can be read and written over Modbus. For example, annunciator alarm limits fall into this category.

Custom Modbus Map

The EIM has the capability to re-map the register numbers to a custom map. This custom map is stored in a csv file, and can be used to create a block of registers with data from various modules. This allows a single read to the EIM Slave ID to pick up all the desired data across multiple modules. This file can be downloaded / uploaded by going to the EIM Modbus screen and choosing “Custom Map…”. More detail can be found on this article: http://forum.emittechnologies.com/knowledgebase/articles/1156870-eim-custom-modbus-map

Modbus Table

The modbus table(s) can be downloaded here: https://drive.google.com/open?id=0BzOiNHLPWdg1UGQzLUktcTZfTVU

Feedback and Knowledge Base