Protocol_Modbus-Master
Product Information
Full information about other Elecsys products is available on our website at www.elecsyscorp.com and the RediGate Product Support page.
Product Support
Tel: +1-913-890-8905
Fax: +1-913-982-5766
Email: idc-support@elecsyscorp.com
Headquarters, Sales, Support & Manufacturing
Elecsys Corporation
846 N Mart-Way Court
Olathe, KS 66061
Tel: +1-913-647-0158
Fax: +1-913-982-5766
Email: info@elecsyscorp.com
While Elecsys may assist customers with their choice of products, the final choice of product for a specific application is entirely the responsibility of the buyer. Elecsys' entire liability with respect to its products or systems is defined in the Elecsys standard terms and conditions of sale.
Any example code is provided only to illustrate the use of Elecsys products. No warranty, either expressed or implied, is made regarding any example code provided by Elecsys and Elecsys shall incur no liability whatsoever arising from any use made of this code.
Disclaimers
The information in this manual is believed to be accurate at the time of publication. Elecsys Corporation assumes no responsibility for inaccuracies that may be contained in this document and makes no commitment to update or keep current the information contained in this manual. Elecsys Corporation assumes no responsibility for any infringements of patents or other rights of third parties that may result from its use. Elecsys Corporation reserves the right to make changes or improvements to this document and/or product at any time and without notice. While Elecsys may assist customers with their choice of products, the final choice of product for a specific application is entirely the responsibility of the buyer. Elecsys' entire liability with respect to its products or systems is defined in the Elecsys standard terms and conditions of sale.
Any example code is provided only to illustrate the use of Elecsys products. No warranty, either expressed or implied, is made regarding any example code provided by Elecsys and Elecsys shall incur no liability whatsoever arising from any use made of this code.
Electrostatic Discharge (ESD) Protection
These units contain devices that could be damaged by the discharge of static electricity. At all times, please observe industry standard ESD precautions when handling the unit.
WARNING: DO NOT CONNECT OR DISCONNECT CABLES WHEN ENERGIZED, UNLESS POWER HAS BEEN REMOVED FROM THE EQUIPMENT OR THE AREA IS KNOWN TO BE FREE OF IGNITABLE CONCENTRATIONS OF FLAMMABLE SUBSTANCES.
© 2024 Elecsys Corporation
Introduction
The RediGate Configuration Manual describes the configuration of many of the RediGate's standard features using the ACE program. This document gives additional instructions for configuring the RediGate to use the following protocols:
Modbus RTU (serial) Master
Modbus ASCII (serial) Master
Modbus RTU (TCP) Master
Modbus ASCII (TCP) Master
Open Modbus/TCP Master
See the following Quick Start example configurations:
The RediGate is a multi-application remote data communications computer/data integration device. It provides a wide array of SCADA and other communication and logic processing functionality. In order to configure the operational characteristics of the RediGate, Elecsys provides the ACE Configuration Editor. This manual assumes that the user is already familiar with the use of ACE and that the RediGate being configured includes software support for the above protocols.
Within the ACE Editor, each configuration object is represented by an icon and contains general properties and specific fields that provide operational settings for the RediGate. This manual provides reference information on the configuration objects within the ACE Editor, specific to the FieldUnit protocol(s) listed above.
To configure as a UDP/IP Master, see RediGate UDP Protocol Master.
Modbus Protocol Description
This document is not intended to provide a detailed description of the protocol(s) involved, nor to disclose proprietary information that may belong to other parties. Depending on the protocol, it may be necessary to refer to other vendor protocol documentation or device configuration details to understand how the RediGate should be configured to interface with it. This section provides a brief discussion of the protocol for the purpose of understanding the RediGate's configuration objects.
Modbus is a poll-response (or master-slave) protocol. Modbus protocol devices are addressed with a number from 1 to 255. A host system requests data from a Modbus device using a Function Code, a zero-based Offset, and a Count of registers. The Function Code determines the type of data, and the Offset specifies which starting register to request within that data type, starting from 0. The device will respond to a request by returning the specified Count of registers. Traditionally, Modbus device vendors use a 5-digit Address notation to refer to these registers (for example, 40,001); however, some manufacturers use the Function/Offset method or a different non-standard Address notation to identify registers (such as 400,001).
Typical Modbus address registers and function codes are listed below, along with the traditional Starting Address notation.
Function Code | Register Group | Starting Address | Read/Write | Description |
|---|---|---|---|---|
1 | Coil Registers | 00,001 | Read | Coils are used for digital outputs or other general purpose Boolean values. |
2 | Status Registers | 10,001 | Read-only | Status Registers are Boolean values, typically used for digital status inputs. |
3 | Holding Registers | 40,001 | Read | Holding Registers are the most commonly used register, used for analog outputs, and general purpose integer or floating point data, strings, etc. |
4 | Input Registers | 30,001 | Read-only | Input Registers are typically used for analog inputs. |
5 | Write Coil | 00,001 | Write | Write a single Coil. |
6 | Write Holdreg | 40,001 | Write | Write a single Holding Register. |
15 | Write Multiple Coils | 00,001 | Write | Write multiple Coil Registers. |
16 | Write Multiple Holdregs | 40,001 | Write | Write multiple Holding Registers. |
For example, using a Function Code=3, Offset=0, and Count=6 would request the registers commonly notated as 40,001-40,006. The following message shows this poll and response for a device number 21 (0x15). The values returned from the registers in this example are 0001 through 0006 (underlined below).
Poll: 15 03 00 00 00 06 C6 DCResponse: 15 03 0C 00 01 00 02 00 03 00 04 00 05 00 06 C8 20
Holding Registers and Input Registers commonly hold 16-bit data. Often, pairs of 16-bit registers are also used to represent 32-bit integers or floating point data.
For instance, in a device that uses register pairing, the host might request 41,001 and 41,002 (two 16-bit values), and the host is responsible for assembling them into a single 32-bit value. The first register might contain the most-significant 16-bit word (big-endian), or it might contain the least-significant 16-bit word (little-endian), depending on the design of the device.
In other devices, a single register (e.g., 41,001) might return a 32-bit value per address location. Or it might use analog registers to contain packed Booleans, one or two ASCII character strings per register, etc. The system designer must become acquainted with the data and address format used by a Modbus device in order to correctly configure the RediGate to request and interpret the device data.
The Modbus master/host must be configured according to the requirements defined by the device. The RediGate has a very flexible and full-featured configuration that allows it to communicate successfully with nearly all Modbus devices.
Modbus ASCII is an older ASCII-based protocol that uses a less robust LRC error checking algorithm. It is not used much anymore.
Modbus RTU (or Modbus Binary) is the most common protocol for Modbus over serial communications and uses a more robust CRC error checking. The RediGate can do Modbus ASCII or RTU over a serial (RS-232 or RS-485) circuit.
Modbus TCP-Encapsulated – The RediGate can encapsulate either RTU or ASCII Modbus protocol into TCP/IP packets (this would be suitable for communication to a Modbus device through a Terminal Server). This includes the Modbus CRC at the end of the message. The TCP port number is user-definable.
Open Modbus/TCP is a variation of Modbus RTU that is only used for TCP/IP networks. It uses the same basic message structure, but it adds 6 bytes to the beginning and removes the CRC from the end of each message. Open Modbus/TCP uses TCP port 502 as standard.
Note that both Modbus TCP-Encapsulated and Open Modbus/TCP use TCP/IP protocol to transport Modbus protocol messages, but the contents of data packets are slightly different. Be aware that some devices use one or the other protocol type, and they may use somewhat different terminology to refer to these options. If the device uses port 502, it is almost certain that the protocol is Open Modbus/TCP. If the device vendor provides documentation on the binary protocol structure, the presence or absence of the Modbus CRC is another way to distinguish the two protocols.
The following sections describe the ACE objects used for Modbus Master, object properties (including constraints on the Instance number), and object fields and their possible values required to configure for the given protocol(s). The object structure in ACE is hierarchical, with each object existing under a certain parent object. For instance, the FieldUnit is the child of one of several types of Circuit objects, either serial or network type (" System>Clients>Master Channels>Master Channel>Circuit").
The Description and Enabled properties are included in ACE as part of each object but are not mentioned here. The "UFF External" property is only mentioned for the objects where it is typically used, but should normally be left unchecked.
Modbus Master Channel
The structure of ACE objects for a Master Channel used for Modbus protocol is shown below:
Modbus Serial | Modbus TCP-Encapsulated | Open Modbus/TCP |
 | | |
The RediGate uses the Master Channel and its child objects to define the RediGate's ability to act as a master for reading or writing other devices using one or more device protocols. All master protocols use the same basic structural definition, requiring at least four ACE objects to be configured:
- The Master Channel defines the sequence and timing of periodic scans of the device, independent of protocol.
- The Circuit (network or serial) defines the physical connection to the device.
- The FieldUnit object defines the protocol-specific characteristics and poll definitions for the device.
- The Real-time Database (RTDB) defines a data structure for storing information obtained from each physical field device.
- Other optional child objects under the RTDB or FieldUnit provide other features for acting on the device's data.
In the Master Channel configuration, make sure that the Response Timeout is set long enough to receive replies for the given network and field devices. Add rows in the Scan Table for each poll in each FieldUnit that is required to be scanned in real-time.
For general information on configuring Master Channels, see the RediGate Configuration Manual.
AsyncCircuit, NetCircuit
As with most FieldUnit types, Modbus Master requires either an AsyncCircuit for serial (RS-232 or RS-485) devices or a NetCircuit for TCP/IP devices (TCP-Encapsulated Modbus or Open Modbus/TCP).
For the AsyncCircuit, choose the serial port to use for the communication (COM2 on RediGate 100 series, or one of several COM ports on the RediGate 400 series).
For the NetCircuit, use a Circuit Type of “Network Circuit" and set the Master Network Port to be the TCP/IP port number used by the device for Modbus communication (if using Open Modbus/TCP, this should typically be port 502). Enter the Destination Address (device IP address) in the Connect Table.
For general information on configuring circuits or AsyncPorts, see the RediGate Configuration Manual.
AsyncPort
If using an AsyncCircuit for serial devices, make sure to include an COM port (System → Networks → AsyncPort) object in the configuration with the instance number matching the physical COM port, and the baud rate corresponding to the field device’s setting.
See the RediGate Configuration Manual for information on configuring the AsyncPort.
Modbus FieldUnit
A Modbus FieldUnit object contains unique information for each physical field device that uses the Modbus communication protocol, defining parameters for how data is read and written for the device.
Attributes | Function |
|---|---|
Object Type | FieldUnitModbus32 (any Modbus type: RTU or ASCII, Serial or TCP-Encapsulated, and Open Modbus/TCP) FieldUnitModbusTCP32 (Open Modbus/TCP only) |
Parent(s) | System → Clients → Master Channels → Master Channel → AsyncCircuit (serial) System → Clients → Master Channels → Master Channel → NetCircuit (TCP) |
Instance | Must be unique under a Circuit. |
The FieldUnit must have an RTDB child object defined under it. | |
Properties | Values |
|---|---|
Unit Name | Enter the field unit name. Unit name is displayed in diagnostic menus, in HCP diagnostic screens, and may be used as part of an MQTT topic name. |
Unit Address | Enter the actual field unit address which is configured in the device being polled. |
Protocol | Binary Modbus 32 Unit – Modbus RTU (Binary), serial or TCP-encapsulated ASCII Modbus 32 Unit – Modbus ASCII, serial or TCP-encapsulated Open Modbus TCP or Modbus-TCP 32 Unit – Open Modbus/TCP |
Com Retries | Enter the number of communication retries after a failed poll attempt. If a poll attempt fails, the RediGate will issue the poll again up to the configured number of "Com Retries" before the field unit is declared failed. For devices on a Network Circuit, you should probably keep the number of protocol retries low (0 or 1), because TCP/IP has its own network retries. |
Comm Status | Enter the starting holding register to contain the communication status for this FieldUnit. Each Comm Status takes 5 registers, beginning at the register configured in this parameter. The Comm Status Holdreg for each field unit in a configuration must be defined such that the five registers do not overlap other registers being used. If the register is defined in the 30,xxx address range, the status values will be stored in the local device's RTDB (i.e., the RTDB defined as a child to this FieldUnit). If the register is in the 40,xxx range, the values will be stored in the Status/Control Field Unit RTDB. The Comm Status Holdreg is optional, and can be set to 0 to disable the storage of status registers. See the section Communication Status Registers in the RediGate Configuration Manual for a description of the five Comm Status Register contents. |
Produce RBEs | Select this option to determine whether to produce a Report by Exception (RBE) flag when data in this unit's RTDB changes. In the RTDB, for every data point, there are potentially 4 RBE flags associated with every data point. When the data point changes, the RBE flags are set. The RediGate's HCP and MQTT publishing processes use these flags to determine when new data needs to be reported. |
Poll Table | Click the Edit Table button to define the polls to be sent to this FieldUnit. Note that the Poll Table only defines how the protocol is defined to operate for each set of data defined in the polls. The Poll Table doesn’t actually do any of the polling itself. If you want any of these polls to be sent to the FieldUnit on a regular basis, it should be referenced in one or more Scan Table entries in the Master Channel. Poll Table entries may be defined which are only used for pass-through writing to the device, not scanned regularly by the Master Channel. Protocol-specific properties for the Poll Table are described in the following table. |
Poll Table Properties | |
|---|---|
Properties | Values |
Source Register | Enter the starting source register in the device to begin polling data. This will be found in the documentation for the device, based on the information that you want to obtain. The format of the Source Register depends on the configuration of the Source Format, described below. For OFFSET source formats, the Source Register should be entered as a zero-based Offset (Coils or Holding registers only). For other Source Formats, the Source Register must be entered as a 5-digit absolute address. |
Source Format | Select the data type of the data being read in this row of the Poll Table. See below for under Configuring Source Format for more details on this option. |
Count | Enter the count of points to read from the device. For everything other than Strings, the Count includes the number of entities (Boolean, 16-bit, 32-bit, etc.) being requested, based on the Source Format setting listed above. This will typically also be the number of Destination Registers used by the poll. For String data types, the Count must be configured to match whatever convention is used in the Modbus device, and it must be defined such that the Modbus response contains the correct number of response registers (multiples of 8 bytes for String-8, multiples of 16 bytes for String-16, etc.). See below under “Configuring String Data Formats” for more details on the String data types. |
Destination Register | Enter the starting destination register within the field unit's RTDB into which the Write Count of data points will be stored. These registers must be configured in the RTDB object. The Destination Register type should be chosen based on the Source Format of the data points defined on this row of the Poll Table:
|
Comment | The Comment column is an optional field, allowing a description to be entered for each row in the table. This is only for the user and has no effect on the operation of the RediGate. |
Different manufacturers use a variety of non-standard formats to represent data using the Modbus protocol. The RediGate provides many options to read and interpret data from a device in any byte order. Sometimes trial and error is necessary to get the configuration correct so that data is represented in the RTDB correctly.
Modbus protocol typically transmits each 16-bit value in “big endian” format (most significant byte, MSB, is transmitted first, followed by the least significant byte, LSB). When requesting 32-bit values, there is no universal standard for how 32-bit Modbus is to be transmitted on the wire. Either the most-significant word (MSW) or least-significant word (LSW) may be stored in the device first, and thus transmitted first in the Modbus protocol messages.
The Poll Table list includes a mnemonic device ("HLhl") and a verbal description of each source format, to help the user identify the different Source Formats.
The “H” and “L” indicate the relative positions of the high and low bytes within each word.
“HL” and “hl” indicate the relative positions of the high and low order 16-bit words.
Thus, the Source Format labeled “Little-Big Endian (hl HL)” indicates the data is interpreted as LSW first followed by MSW; whereas “Big-Big Endian (HL hl)” indicates the data is interpreted as MSW first followed by LSW. These are the two most common methods of polling 32-bit data from Modbus devices.
The following tables give a list of the Modbus Source Format options with an explanation of each. The formats listed in Bold Italic are the more commonly used selections. For each non-OFFSET format, the Source Format column should contain an absolute address (10,001, 40,001, etc.).
Boolean Source Formats | Description | Meaning |
|---|---|---|
Boolean | Binary (single bit) register | Single on/off bit occupies a register |
UnPack16-Boolean | Integer to bit conversion | Integer source register is stored as individual bits in Boolean destination registers, parsed in order of LSB to MSB bits from each 16-bit integer word in the Modbus message. |
Reverse8-Boolean | Integer to bit conversion | UnPack type with reversed bit order. Integer values are converted to Boolean destination registers, parsed in order of MSB to LSB from each 8-bit byte in the Modbus message. |
Integer/Float Source Formats | Description | Meaning |
|---|---|---|
16 bit register (HL) | Big Endian 16-bit register | Typical 16-bit register type. |
32 bit register (hlHL) | Little-Big Endian 32-bit register | One numbered register in the device includes 4 bytes of data, transmitted in Little-Big Endian byte order. |
16 Bit Pair L/B Endian (hl_HL) | Little-Big Endian 16-bit pair of registers | Field unit includes pairs of registers, where each register includes 2 bytes of data. Bytes transmitted in Little-Big Endian byte order (LSW first). |
32 Bit B/B Endian (HLhl) | Big-Big Endian 32-bit register | One numbered register in the device includes 4 bytes of data, transmitted in Big-Big Endian byte order. |
16 Bit Pair B/B Endian (HL_hl) | Big-Big Endian 16-bit pair of registers. | Field unit includes pairs of registers, where each register includes 2 bytes of data. Bytes transmitted in Big-Big Endian byte order (MSW first). |
16 Bit L Endian (LH) | Little Endian 16-bit register | Like 16-bit register, byte order reversed. |
32 Bit L/L Endian (lhLH) | Little-Little Endian 32-bit register | Like 32-bit register, but with byte order reversed (in pairs) from standard Modbus. |
16 Bit Pair L/L Endian (lh_LH) | Little-Little Endian 16-bit pair of registers. | Like 16-bit pair L/B register type, byte order reversed. |
32 Bit B/L Endian (LHlh) | Big-Little Endian 32-bit register | Like 32-bit B/B register type, but with byte order reversed from standard Modbus. |
16 Bit Pair B/L Endian (LH_lh) | Big-Little Endian 16-bit pair of registers. | Like 16-bit pair B/B register type, byte order reversed. |
CMD-LOG-TO-STRING32 | Log output commands to String register |
The following “OFFSET” formats are equivalent to the Source Format types above in byte and word order, but they allow the configuration to identify the source register using the "Function Code / Offset" convention. The OFFSET type of Source Format is sometimes necessary for Modbus devices that have coil registers greater than 9999 or holding registers numbered higher than an offset of 25,534 (i.e., higher than an absolute address of 65535).
For each OFFSET type, the Source Format column should be configured as a number from 0 to 65535, which is an offset from the first coil register (function code 1) or the first holding register (function code 3). Only Modbus commands 1 and 3 are currently supported for reading OFFSET types (with corresponding Modbus write function codes 5, 6, 15, and 16).
OFFSET Source Formats | Description | Meaning |
|---|---|---|
OFFSET Coils 0 to 65535 | Binary (single bit) registerBinary (single bit) register | Use Modbus command 1 with offset (starting from 0) as the Source Register to request Boolean coils. |
OFFSET 16 bit Hreg (HL) 0 to 65535 | Big Endian 16-bit register | Use Modbus command 3 for all following command formats. Typical 16-bit holding register, but requested with Source Register as an offset (starting from 0). |
OFFSET 32 bit Hreg (hlHL) 0 to 65535 | Little-Big Endian 32-bit register | 32-bit holding register, with Source Register as an offset |
OFFSET 16 BitPair L/B Endian (hl HL) 0 to 65535 | Little-Big Endian 16-bit pair of registers | 32-bit value stored as pairs of registers, requested with Source Register as an offset. Bytes transmitted in Little-Big Endian byte order (LSW first). |
OFFSET 32 Bit B/B Endian (HLhl) 0 to 65535 | Big-Big Endian 32-bit register | Each of the OFFSET Source Format types use the same Endian notation as in the previous table of Source Formats. |
OFFSET 16 Bit Pair B/B Endian (HL hl) 0 to 65535 | Big-Big Endian 16-bit pair of registers. |
|
OFFSET 16 Bit L Endian (LH) 0 to 65535 | Little Endian 16-bit register |
|
OFFSET 32 Bit L/L Endian (lhLH) 0 to 65335 | Little-Little Endian 32-bit register |
|
OFFSET 16 Bit Pair L/L Endian (lh LH) 0 to 65535 | Little-Little Endian 16-bit pair of registers. |
|
OFFSET 32 Bit B/L Endian (LHlh) 0 to 65535 | Big-Little Endian 32-bit register |
|
OFFSET 16 Bit Pair B/L Endian (LH lh) 0 to 65535 | Big-Little Endian 16-bit pair of registers. |
|
Examples of Source Format
The Endian source formats above define the byte order in which to interpret the data received from the Field Unit in response to the poll. A few illustrations are given below:
Example #1:
Field device includes ten 16-bit integers, transmitted in normal Modbus format, starting at the address 40,001. Poll Table should be configured for:
Source Register = 40,001
Source Format = 16 bit register (HL)
Count = 10
Destination Register should be a 16-bit RTDB location.
Example #2:
Field device includes four IEEE floating point values, stored in registers 40,001-2, 40,003-4, 40,005-6, and 40,007-8. Because the registers are listed as odd-numbered registers, the device is using pairs of 16-bit registers to represent the 32-bit IEEE values. Thus, the Poll Table should be configured for:
Starting Address = 40,001
Source Format might be "16 Bit Pair L/B Endian (hl HL)” or “16 Bit Pair B/B Endian (HL hl)”, depending on the word order of the registers. (If the odd numbered registers contain the most-significant word, then use the B/B Endian format.)
Count = 4 (this is the count of four 32-bit entities, not eight 16-bit registers)
Destination Register should be a 32-bit RTDB location.
The Modbus Poll Table includes several different types for String (ASCII) data. There is no common standard among Modbus devices as to how String data should be stored. The RediGate is only able to read String data in certain increments of ASCII characters (8, 16, or 32 bytes per destination RTDB register). The “Count” column indicates the count of registers that will be included in the Modbus message. As with all Modbus messages, a maximum of 255 total bytes per message are allowed.
For example, if the Modbus device stores ASCII characters in 16-bit registers (two characters per register), then for the String-8 data type you must poll for multiples of 4 source registers (“Count” in the Poll Table should be 4, 8, 12, etc.). For the String-16 data type, the “Count” should be 8, 16, 24, etc.
However, if the Modbus device stores ASCII characters in 32-bit registers (four characters per register), you still need to set the “Count” to poll for multiples of 32-bit registers, so that the response comes back in groups of 8, 16, or 32 ASCII characters, depending on the Source Format chosen (for instance, for String-8 data use a count of 2, 4, 6, etc.). Or, if a single Modbus register contains the entire string, the count should be 1 per string register.
String Source Formats | Description | Meaning |
|---|---|---|
String-8 (abcdefgh)String-8 (abcdefgh) | 8-character String request8-character String request | Request sets of four 16-bit registers, returning 8 ASCII characters, which should be stored into STRING32 or STRING256 RTDB registers. Only 8 characters are stored into each RTDB register (multiple register reads are stored into sequential RTDB string registers). Example: Omni flow computer in Omni mode returns 8 characters in response to a read request with Count=1. But in Modicon mode, you have to request a Count=4 registers in order to receive 8 characters. The RediGate Modbus driver will accept the bytes that are returned in whatever quantity, regardless of the mode, and store them into the RTDB in groups of 8 until the whole response message is processed. |
String-8 Swapped (badcfehg) | 8-character String request, byte-swapped | Like the String-8, only each pair of bytes (MSB/LSB in each register) is reversed. Only 8 characters are stored into each RTDB register (multiple register reads are stored into sequential RTDB string registers). |
String-16 (abcdefghijklmnop) | 16-character String request | Request sets of eight 16-bit registers, returning 16 ASCII characters, which should be stored into STRING32 or STRING256 RTDB registers. Only 16 characters are stored into each RTDB register (multiple register reads are stored into sequential RTDB string registers). |
String-16 Swapped (badcfehgjilknmpo) | 16-character String request, byte-swapped | Like the String-16, only each pair of bytes (MSB/LSB in each register) is reversed. Only 16 characters are stored into each RTDB register (multiple register reads are stored into sequential RTDB string registers). |
String-32 (abcdefghijklmnop) | 32-character String request | Request sets of sixteen 16-bit registers, returning 32 ASCII characters, which should be stored into STRING32 or STRING256 RTDB registers. Only 32 characters are stored into each RTDB register (multiple register reads are stored into sequential RTDB string registers). |
String-32 Swapped (badcfehgjilknmpo) | 32-character String request, byte-swapped | Like the String-32, only each pair of bytes (MSB/LSB in each register) is reversed. Only 32 characters are stored into each RTDB register (multiple register reads are stored into sequential RTDB string registers). |
OFFSET String-8 (abcdefgh) 0 to 65535 | 8-character String request, using Offset instead of register address | Like String-8, but the Source Register is an offset from register 40001, not an absolute address (using Modbus command 3). |