3G Modbus RTU/TCP Gateway
USER MANUAL
Rev: 2.01
March 27, 2014
Revision history
Rev.
Date
Details
0.1
28 April 2012
First Release
1.1
25 June 2012
Second Release
2.0
26 Feb 2014
M2M firmware Draft
2.01
27 March 2014
3rd Release
2
Safety precautions
General precautions
- The machine contains kernel board and 3G Modbus Gateway module which generates radio
frequency (RF) power. When using the machine care must be taken on safety issues related to RF
interference as well as regulations of RF equipment.
- Be sure that the machine will not be interfering with nearby equipment. For example: pacemakers
or medical equipment. The antenna of the Modbus Gateway should be away from computers, office
equipment, home appliance, etc.
- An external antenna must be connected to the Modbus Gateway for proper operation. Only used
approved antennas with the Modbus Gateway. Please contact authorized dealer on finding an approved
antenna.
- Always keep the antenna with minimum safety distance of 26.6 cm or more from human body. Do
not put the antenna inside metallic box, containers, etc.
Protecting your machine
To ensure error-free usage, please install and operate your Modbus Gateway with care. Do remember the
following:
- Do not expose the Modbus Gateway to extreme conditions such as high humidity/rain, high
temperatures, direct sunlight, caustic/harsh chemicals, dust, or water.
- Do not try to disassemble or modify the machine. There is no user serviceable part inside and the
warranty would be void.
- Do not drop, hit or shake the Modbus Gateway. Do not use the Modbus Gateway under extreme
vibrating condition.
- Do not pull the antenna or power supply cable. Please attach or detach by holding the connector.
- Connect the Modbus Gateway only according to the instruction manual. Failure to do it will void
the warranty.
3
Chapter 1
Introduction
3G Modbus Gateway is integrated with embedded kernel module and ready-to-use 3G/GPRS Modbus
Gateway module for retrieving remote data from mobile internet base on Modbus RTU and TCP
protocol. It also supports 3G HSPA (Down link: Cat 8, 7.2Mbps; Up link: Cat 5, 2Mbps) GPRS (Class
12) and EDGE (Class 12) for high speed data transfer. 3G Modbus Gateway can be easily controlled by
using web configure or standard Modbus command for data acquisition.
With setting 3G Modbus Gateway to play as TCP Server (Listener) or TCP Client (Caller) and some
other proper options, 3G Modbus Gateway will be able to get Modbus command from Modbus Master
through 3G mobile network, then transfer to Modbus Slave in local network (Ethernet LAN or RS485)
to finish the polling procedure.
1.1 Package
The 3G Modbus Gateway package should include the following:
- 3G Modbus Gateway x 1
- Power cable x 1
- Antenna x 1
4
1.2 Interfaces
- UP Face
- Back Face
SMA Type Antenna
Power(9-24V)
SIM Card Holder
- Front Face
Dip Switch
RS485/422 Port
5
LAN
Reset
1.3 Status indicator
The LED will indicate different status of the Modbus Gateway:
Status
IP
Receive
Send
- Status: 3G Modbus Gateway’s system status
 off: Modbus Gateway is switched off
 on: Modbus Gateway is connecting to the network
 flashing slowly: Modbus Gateway is in idle mode
 flashing rapidly: Modbus Gateway is in transmission/communication (GSM only)
- IP: availability of 3G/GPRS network
- Receiving: data received over TCP/UDP
- Sending: data transmitted over TCP/UDP
- Signal strength:
 strong: CSQ 27 or higher
 medium: CSQ 23 – 26
 low: CSQ 14 – 22
 weak: CSQ 1 – 13
- Ethernet:
LED will blink when data traffic on Ethernet.
- Remote:
LED will be on when SCADA Modbus Master from 3G mobile connect to 3G Modbus Gateway
successfully.
6
- Local:
LED will be on when connect to more than one Modbus Slave devices through Modbus TCP
protocol successfully.
- System:
The system status, it will blink when system is good and running.
7
1.4
SMA female antenna connector (Main)
Connect it to an external antenna with SMA male connector. Make sure the antenna is tuned for the
frequency band(s) used (one or more of 850/900/1800/1900/2100MHz) with impedance of 50Ohm, and
also connector is secured tightly.
1.5
SMA female antenna connector (Aux)
The purpose of the second connector is reserved for other feature and not used in this type of machine.
8
Chapter 2
Installation
2.1 Install the SIM card
Use a ball pen or paper clip to press the SIM card holder eject button. The SIM card holder will
come out a little, take it out and put the SIM card in the tray. Make sure the SIM card is fully
inserted inside the tray, and put it back into the slot.
Note: DO NOT pull out the SIM holder without pushing the ejector.
Please disable the PIN code function of SIM card by celluar phone before use.
2.2 Connect the external antenna (SMA type)
Connect this to an external antenna with SMA male connector and secure it tightly. Make sure the
antenna is tuned for the frequency band(s) used (one or more of 850/900/1800/1900/2100Mhz) and
with impedance of 50Ohm.
Note: Incorrect antenna will affect communication and even damage the Modbus
Gateway.
9
2.3 Function Features
2.3.1 Modbus Protocol Description
Modbus protocol was developed for a long time and widely used on lots of devices, meters,
especially in industrial field.
Figure 1: Example of MODBUS Network Architecture
The MODBUS protocol defines a simple protocol data unit (PDU) independent of the underlying
communication layers. The mapping of MODBUS protocol on specific buses or network can
introduce some additional fields on the application data unit (ADU).
The MODBUS application data unit is built by the client that initiates a MODBUS transaction. The
function indicates to the server what kind of action to perform. The MODBUS application protocol
establishes the format of a request initiated by a client. The function code field of a MODBUS data
unit is coded in one byte. Valid codes are in the range of 1 ... 255 decimal (the range 128 – 255 is
reserved and used for exception responses). When a message is sent from a Client to a Server
device the function code field tells the server what kind of action to perform. Function code "0" is
not valid. Sub-function codes are added to some function codes to define multiple actions. The data
field of messages sent from a client to server devices contains additional information that the server
uses to take the action defined by the function code. This can include items like discrete and register
addresses, the quantity of items to be handled, and the count of actual data bytes in the field. The
data field may be nonexistent (of zero length) in certain kinds of requests, in this case the server
does not require any additional information. The function code alone specifies the action.
If no error occurs related to the MODBUS function requested in a properly received MODBUS
10
ADU the data field of a response from a server to a client contains the data requested. If an error
related to the MODBUS function requested occurs, the field contains an exception code that the
server application can use to determine the next action to be taken. For example a client can read
the ON / OFF states of a group of discrete outputs or inputs or it can read/write the data contents of
a group of registers. When the server responds to the client, it uses the function code field to
indicate either a normal (error-free) response or that some kind of error occurred (called an
exception response). For a normal response, the server simply echoes to the request the original
function code.
Figure 2: General MODBUS frame
At the message level, the Modbus protocol still applies the master–slave principle even though the
network communication method is peer–to–peer. If a controller originates a message, it does so as a
master device, and expects a response from a slave device. Similarly, when a controller receives a
message it constructs a slave response and returns it to the originating controller.
Figure 3 :Master–Slave Query–Response Cycle
The Query: The function code in the query tells the addressed slave device what kind of action to
perform. The data bytes contain any additional information that the slave will need to perform the
function. For example, function code 03 wil query the slave to read holding registers and respond
with their contents. The data field must contain the information telling the slave which register to
start at and how many registers to read. The error check field provides a method for the
11
slave to validate the integrity of the message contents.
The Response: If the slave makes a normal response, the function code in the response is an echo
of the function code in the query. The data bytes contain the data collected by the slave, such as
register values or status. If an error occurs, the function code is modified to indicate that the
response is an error response, and the data bytes contain a code that describes the error. The error
check field allows the master to confirm that the message contents are valid.
Figure 3 :Master–Slave Query–Response Cycle
12
2.3.2 Modbus Query/Response Example
Master Query with ASCII/RTU Framing:
Slave Response with ASCII/RTU Framing
2.3.3 3G Modbus Gateway apply in 3G Mobile Network
3G Modbus Gateway is designed to be able to accept traditional Modbus command through 3G
Mobile network. With proper setting, 3G Modbus Gateway accepts traditional Modbus command
from remote SCADA through mobile 3G network (mobile WAN). Although 3G mobile operators
provide only single floating IP to the carry device, yet the 3G Modbus Gateway analysis and
process every Modbus command packets coming from SCADA side, then transfer the original
Modbus command to local Modbus device. It also sends back the command results to remote
SCADA.
3G Modbus Gateway intelligently choose Modbus protocol to follow according to the packet
content, types of protocol are for RS485/422 and TCP/IP base. The data process engine is max to 4
Modbus TCP protocol devices and 31 RTU protocol devices.
13
－ ＋
DC9~12V
Reset
LAN
10/100M
ModBus TCP
Remote Connection
Local Connection
Main System
AUX
SIM
§Data Acquisition System
§SCADA
§Real Time Viewer
MAIN
......
GSM Status
3G
RX
TX
RS485/422
Signal
Strength
WAN
RS-485
ON OFF
T/R X
X
T+
X
TD+ R+
DR-
3G ModBus
DATA Gateway
RS-422
Ethernet
......
Support：
§Modbus TCP §Transparent to LAN
§Modbus RTU §Transparent to RS485/422
§Static Buffering
§Real Time Acquisition
2.3.4 Data Acquisition under Modbus Protocol through 3G Mobile
It plays as so called one to many Modbus Gateway device, when SCADA sends a data acquisition
command to the Modbus device from cloud side, 3G Modbus Gateway helps to analysis the pockets
to the correct local machine, then sends back the result.
2.3.5 DDNS Supported
Normally, the carries (mobile operators) provide floating IP to the 3G Modbus Gateway, may
change after a period of time, 3G Modbus Gateway support DDNS client, the remote site of
SCADA may find 3G Modbus Gateway via DDNS. If not, please contact your 3G mobile carrier for
this issue.
14
Chapter 3
Configuration
3.1 Use of the SofTool – ETM.exe
3G Modbus Gateway’s factory default IP is 192.168.0.100. However it can be searched by the
Softoll –ETM.exe to find all the devices at same IP section.
15
3.2 3G Modbus Gateway Web Configuration
Users can use browser (IE/ Chrome) to do web configuration. Default factory IP is
http://192.168.0.100
3.2.1 Login Security: the defalt ID is admin, Passsword is blank.
3.2.2 Status Page:
This page shows the current status of 3G Modbus Gateway.
3.2.3Networking Page:
This page shows and set up the network related information. Including LAN, PPPoE and 3G
16
Modbus Gateway important parameters. Connection Mode option allows users to choose how is 3G
Modbus Gateway to connect to 3G mobile network.
Manual: 3G Modbus Gateway connect to 3G network manually, is also factory setting. Whenever
users need to change any settings about 3G network related parameters of the Gateway, should set
to this mode first. 3G Modbus Gateway related setting includes:
a.
APN
b. Password
c.
TCP Socket Mode
d. Destination Port
e.
Destination Host IP
f.
DDNS (in System page)
Auto Connect: Let the Gateway connect to 3G network automatically. When TCP Socket Mode,
Destination Port, Destination host IP and DDNS (in System page) settings are done, users should
change to Auto Connect Mode.
APN and Password: Depends on 3G operator provide to this setting. now in Taiwan, for example,
normal Chunghwa Telecom’s 3G Mobile service APN is “internet”, password: (blank). It depends
on the service provider from 3G operators.
TCP Socket Mode gives 2 options, it means users can set up 3G Modbus Gateway to play as TCP
TCP Server(Listener) or Client(Caller) according to the Destination Port and Destination Host IP
parameters after connect to 3G mobile network.
The caller mode of the gateway is used for M2M Modbus solution, please contact us for more
information.
17
3.2.4 IO Page:
This page provides users to show and set up 3G Modbus Gateway port and RS485/422 port.
3G Modbus Gateway Port: This port is reserved to communicate to 3G Modbus Gateway through
RS232 for engineer debugging. Please don’t change any factory setting about this section unless
users are familiar with 3G/GPRS standard AT command.
RS485/422 Port: Users can set up this section’s parameters according to users environment. The
packet to RS485/422 will use Modbus RTU protocol automatically without user define.
3.2.5 Slave Mapping page:
This page provide users to set up the relation between Modbus TCP Slave’s device ID, IP and Port.
This mapping is important for 3G Modbus Gateway’s data process engine. Modbus command
18
packet from Modbus Master (WAN) will be analyzed instantly by data process engine then transfer
forward correctly to goal Slave (Local), otherwise will transfer forward to RS485/422 port with
Modbus RTU protocol.
3.2.6 System Page:
This page provides to show and set up system related information.
3G Modbus Gateway’s DDNS set up function is provided here. NOIP and Dyndns are available.
19
Chapter 4
Specifications
Hardware
 Real Time Clock*1
 Protection : Built-in 1.5KV Magnetic Isolation
 RTC : Real Time Clock
 CPU：Sierra Wireless CPU & ARM 32-bit CPU
 RAM：8M bytes SDRAM
 ROM：4M bytes Flash ROM
Ethernet
 Port Type : RJ-45 Connector
 Speed : 10 /100 M bps (Auto Detecting)
 Protocol :
ARP ,IP ,ICMP ,UDP ,TCP ,HTTP ,DHCP
PPPoE , DDNS , NTP , FTP , Telnet
 Mode : TCP Server / TCP Client / UDP
 Setup : HTTP Browser Setup (IE &
Chrome) ,Console
 Security : Setup Password
Serial Port
 Port： RS-422 / RS-485
 RS-422：Rx+, Rx-, Tx+, Tx- (Surge Protection )
 Speed：300 bps ~ 230.4K bps
 RS-485：Data+, Data- (Surge Protection )
 Parity：None, Odd, Even, Mark, Space
 Built-In RS-422 / RS-485 Terminal Resistor
 Data Bits：5, 6, 7, 8 / Stop Bits：1, 2
 15KV ESD for all signals
Mobile 3G / GPRS / EDGE
 LED for Modbus Device Connection
 Quad-band GSM 850/900/1800/1900 MHz
 LED for Remote Connection
 Tri-band UMTS/HxDPA (WCDMA/FDD)
 LED for EDGE/GPRS/3G availability
2100/1900/850 MHz
 External SMA Type Antenna
 LED Bar RSSI
 Mobile 3G availability( Down7.2M / UP 2M
 LED indication of Network Registration
bps )
 LED indication of TX / RX Data Traffic
 GPRS Multislot class 12 / EGPRS Multislot
 LED for SYS ( PWR )
class 12
Environment
Power / Warranty
 DC 9 ~12V , 1000 mA / 1 year
 Operating Temperature：0 ~ +70℃
 Storage Temperature：-10 ~ +75℃
20
Chapter 5
Troubleshooting
5.1 The LED does not light
– Check if the machine has been properly connected to a 9-24V power supply
– Check if the power connector is properly inserted
– Check the fuse on the power cord
5.2 The LED lights but does not blink long time after power up
– Check if a valid SIM card has been properly inserted
– Check if the SIM card has been locked
– Check if the network coverage is available
5.3 The machine does not respond to the SCADA program
– Check if the Remote LED is on.
– Check if the Local LED is on.(For Modbus TCP protocol)
– Check if the data process engine selection is correct co response to SCADA.
21