ES V2 4G WiFi Modbus-RTU-TCP MQTT GW

424, Kalasagar Shopping Hub, Nr.
Satadhar Cross Road, Ghatlodia, Ahmedanad – 380061, (GUJ)

(P): +91 7600002163 (E): ankit@EmSysTechnologies.com(W): www.EmSysTechnologies.com
Modbus RTU/TCP to MQTT Over 4G/WiFi/Ethernet Gateway
Specification:
1. Gateway is based on WiFi module having below specifications

• High Performance Dual Core Low power Processor with WiFi and Bluetooth connectivity
• WiFi: 802.11 b/g/n/d/e/i/k/r (802.11n up to 150 Mbps)
• Bluetooth v4.2 BR/EDR and BLE specification
• Wi-Fi mode Station/softAP/SoftAP+station/P2P
• Security WPA/WPA2/WPA2-Enterprise/WPS
• Encryption AES/RSA/ECC/SHA
• Operating temperature -40 to +85C
2. Modem based SIMCOM 4G LTE Cat1 Module

• LTE-TDD Bands: B34/B38/B39/B40/B41
• LTE-FDD Bands: B1/B3/B5/B8
• GSM Bands: 900/1800 MHz
• Data Transfer Capabilities:
LTE Cat 1
Uplink up to 5Mbps
Downlink up to10Mbps
EDGE: Uplink/Downlink up to 236.8Kbps
GPRS: Uplink/Downlink up to 85.6Kbps
• Temperature Range
Operation temperature range: -40℃ ~ +85℃
KIRAN ELECTRONICS 1
424, Kalasagar Shopping Hub, Nr. Satadhar Cross Road, Ghatlodia, Ahmedanad – 380061, (GUJ)
3. Power Input: 230Vac or 9-24VDC/500mA

4. RS485 Half-duplex Modbus-RTU Master Interface
5. RJ45 Ethernet Port for Modbus-TCP Master Interface
Package Includes:
• 1 no. Modbus RTU/TCP MQTT Gateway
Features:
• Modbus RTU/TCP (RS485/Ethernet) to MQTT (4G/WiFi/Ethernet) Gateway is Reliable, Flexible and Plug-n-
play device to fetch data Over Modbus RTU/TCP and send them to cloud using MQTT protocol over
4G/WiFI/Ethernet Network.
• Ethernet & WIFI interface’s IP/subnet/gateway and DHCP settings is configurable.
• 4G, Ethernet and WIFI interface can be enable/disable independently.
• Internet can be possible through any 4G/ethernet/WIFI network interface.
• Gateway can be configured over SMS/MQTT connection.
• Multiple Modbus RTU/TCP transactions can be configured to fetch data from variety of Modbus Slave devices
like Energy meter, Temperature scanners etc.
• Field tested with Mosquitto MQTT Broker (Most widely used MQTT broker).
• Multiple Modbus RTU slaves can be connected to same RS485 network even with different baud rates.
• Multiple Modbus TCP slave/servers can be connected to RJ45 Ethernet port using Ethernet hub/switch.
• Modbus write operation is also allowed to configure Modbus devices remotely.
• Standard JSON data format for easy parsing at server side.
• Data transmission interval can be configured.
• Data can be buffered if server is disconnected.
• Gateway module will automatically connect with MQTT Broker and remains connected. It will automatically
reconnect if required.
• Module will automatically reboot itself if required (network or server connection fails repeatedly).
• All configuration like MQTT Broker URL/IP, Port no, User Name & Password, Modbus RTU Slave Baudrate
for serial port (2400, 4800, 9600, 19200, 38400, 57600, 115200), Modbus TCP Server IP/Port settings can be
done via SMS.
• Over-The-Air (OTA) Firmware Update supported for feature update and bug fixings.
• Made in India. Can be customized as per client requirement.
KIRAN ELECTRONICS 2
MQTT Details:
Note: Please note that we also provided customized firmware (MoQ. required or one-time customization
charges will be applied) if your requirements are differ from below specifications.
1) All the packets generated from Gateway will contain data in JSON format. Please refer examples given below
2) Data of all the active Modbus transactions are aggregated into single "STATUS" JSON packet. It will make easy to
process the data at server end as all the required data are available in single JSON packet.
3) Max. Number of RTU transactions:25
4) Max. Number of TCP transactions:25 (over Max 10 TCP connections to Modbus TCP Servers)
5) Max. Number of Modbus registers read / transaction: 64
6) Max. Number of Modbus registers write / transactions: 10
7) Max. Number of Modbus RTU registers read: 1200
8) Max. Number of Modbus TCP registers read: 1200
MQTT topics:
1. connection/<device-ID> ==> subscribe on this topic to get device connection status. This is retained topic
so your server will get Online/Offline status immediately after subscribing to this topic.Topic name is
configurable if needed.
2. data/<device-ID> ==> subscribe on this topic to receive Modbus transaction data. This is retained topic so
your server will get last published data immediately after subscribing to this topic.Topic name is
configurable if needed.
3. config-cmd/<device-ID> ==>publish configuration commands to this topic. Topic name is not

configurable.
4. config-res/<device-ID>/0 ==> subscribe on this topic to receive response of configuration RPC commands.
Topic name, except ‘+’ part, is configurable if needed.
MQTT packet examples:
1) From Device to Server

Topic:
connection/861693039912345
Data:
{
"connection" : "ONLINE",
"ts" : 1539031250,
"datetime" : "08/10/2018 20:40:50",
"product" : "ES-4G-WiFi-LAN-MB-TCP-MQTT”,
"hardware_ver" : "1.0",
"firmware_ver" : "1.0",
"user_id_1" : "",
"user_id_2" : "",
"user_id_3" : ""
}
KIRAN ELECTRONICS 3

Topic:
connection/861693039912345
Data:
{
"connection" : "OFFLINE"
"product" : "ES-GPRS-MODBUS-RTU-MQTT",
"hardware_ver" : "1.0",
"firmware_ver" : "1.0",
"user_id_1" : "",
"user_id_2" : "",
"user_id_3" : ""
}
Topic:
data/861693039912345
Data:
- Modbus Data Payload:
{
"ts" : 1654717900,
"datetime" : "08/06/2022 19:51:40",
"signal" : 27,
"DIN" : [ 0, 0 ],
"DOUT" : [ 0 ],
"location" : {
"3d_fix" : 1,
"timestamp-UTC" : 2121967689,
"satellites" : 22,
"latitude" : 23.06637,
"longitude" : 72.532074,
"speed-kmph" : 2.900232,
"altitude-mtr" : -10.3,
"course-degree" : 0.0
},
"modbusRTU" : {
"1" : {
"ts" : 1654717900,
"device_type" : 0,
"txn" : "1,3,101,60",
"res" : "0,OK",
"data" : [ 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 238.717789, 238.727936, 238.737839,
238.687576, 0.0, 0.0, 0.0, 0.0, 50.034767, 47268.632812 ],
"datalen" : 30
},
"2" : {
"ts" : 1654717900,
"device_type" : 0,
"txn" : "1,3,217,2",
"res" : "0,OK",
"data" : [ 17, 37878 ],
"datalen" : 2
}
}
}
KIRAN ELECTRONICS 4
- Digital Input Alert Data Payload:

{
"ts" : 1654014383,
"datetime" : "31/05/2022 16:26:23",
"alert-DIN" : {
"Ch" : 1,
"Alert" : true,
"State" : "INPUT-1 IS FAILED"
}
}
- Analog Input Alert Data Payload:
4) From Server to Device (Configuration commands are described later in this manual)
Topic:
config-cmd/861693039912345
Data:
SET MB SCAN INTERVAL#60
5) From Device to Server (Configuration Command response)

Topic:
config-res/861693039912345/0
Date:
- Successful response:
{
"ts" : 1654007725,
"cmd" : "GET MB SCAN INTERVAL",
"resp" : {
"scan-interval-sec" : 60,
"cmd-res" : "success"
}
}
- Invalid command response:

{
"ts" : 1654007743,
"cmd" : "GET MB SCAN",
"resp" : {
"cmd-res" : "invalid command"
}
}
- Command Error Response:

{
"ts" : 1654008268,
"cmd" : "GET ID",
"resp" : {
"cmd-res" : "error-1"
}
}
KIRAN ELECTRONICS 5
Configuration Commands (SMS/MQTT):

Note:
• Arguments of configuration commands are passed as comma separated list. Command and arguments are
separated with character ‘#’. SMS and MQTT commands are exactly the same. Please use command and
argument format strictly. Do not add additional white spaces inside the command string.
• All configuration commands are allowed from SMS. But not all commands are allowed from MQTT.
Modbus read/write transaction configuration commands are allowed from MQTT.
1) SET ADMIN
// need be make one mobile number as “Admin” number before sending other configuration commands.
// configuration commands will only be accepted from Admin mobile number.
// you need not set Admin mobile again, if you change SIM card of Modbus Gateway device.
2) UNSET ADMIN
// if you need to change Admin mobile number, first send this command from current Admin mobile no.
// then send “Set Admin” command from new Admin Mobile no.
3) SET DATA SERVER#<server domain/IP>,<server port>,<user>,<password>

// allowed from MQTT
// MQTT broker configuration.
i.e. SET DATA SERVER#www.xyz.com,12345,user1,pwd1
SET DATA SERVER#192.168.1.10,12345 // no user & password
4) GET DATA SERVER

// to check currently configured MQTT broker details
5) SET DEVICE ID#1,<device-ID>

// by default device ID will be Gateway’s IMEI no. So do not changed it.
// same device ID will be reported as client-ID in MQTT connection request.
i.e. SET DEVICE ID#1,device-1
6) GET DEVICE ID#1

7) SET DATA BUFFER#<enDis>,<buffer-mode>,<buffer-size-KB>,<BUFFER-TX-INTERVAL-Sec>

// enDis: 1 to enable data buffering, 0 to disable data buffering
// buffer-mode: “LOCAL” or “SD”
// buffer-size-KB: maximum file size in KB. Range: 100 KB to 3072 KB
// BUFFER-TX-INTERVAL-Sec: range: 0 to 60 second, default: 2 sec
6) GET DATA BUFFER

KIRAN ELECTRONICS 6
7) DELETE BUFFERED DATA#1

// send this command to cleanup all buffered data.
8) SET ID#<1-3>,<max. 15 char ID>

// you can set up to 3 user defined character strings
// this IDs will be reported back to server in MQTT connection data
i.e. SET ID#1,EnergyMeter1
9) GET ID#<1-3>
// to check currently configured user ID for specific ID no.
i.e. GET ID#1
10) REBOOT
11) SET NETIF CONFIG#<netif>,<enabled>,<DHCP enabled>[,<ip>[,<gw>[,<mask>]]]

// NOTE: Module will be rebooted after this command
// netif: Network Interface: WIFI or ETH
// enabled: 1: enable / 0: disable
// DHCP enabled: 1: dhcp enabled (module will get IP from router), 0: static IP
// In case of static IP, configure remaining <ip>, <gateway> and <netmask>
// disable wifi interface

set netif config#wifi,0
// enable wifi interface with DHCP enabled
set netif config#wifi,1,1
// enable wifi interface with static IP
set netif config#wifi,1,0,192.168.1.201,192.168.1.5,255.255.255.0
// disable ethernet interface

set netif config#eth,0
// enable ethernet interface with DHCP enabled
set netif config#eth,1,1
// enable ethernet interface with static IP
set netif config#eth,1,0,192.168.1.201,192.168.1.5,255.255.255.0
12) GET NETIF CONFIG#<netif>

// module will be reboot automatically
// get Ethernet interface configuration

get netif config#eth
// get WiFi interface configuration

get netif config#wifi
KIRAN ELECTRONICS 7
13) ENABLE INTERNET#<netif>

14) DISABLE INTERNET#<netif>

15) Enable GSM

// to enable GSM/4G module
16) Disable GSM

// to disable GSM/4G module, Module will be powered-off
KIRAN ELECTRONICS 8
Modbus RTU Configuration Commands:
1) SET MB CONFIG#<transaction ID>,<is-enabled>,<baudrate>,<no. of databits>,<no. of

stopbits>,<parity>,<device type>,<slave ID>,<MB func code>,<MB func address>,<MB func
len>,<data type>?<data bitmap in HEX>
// MODBUS READ TRANSACTION CONFIGURATION:
//
// transaction ID: Modbus transaction ID.
// is-enabled: 1 => transaction is enabled; 0 => transaction is disabled
// bardrates: 1200, 2400, 4800, 9600, 19200, 38400, 57600,115200
// no. of databits: 8
// no. of stopbits: 1, 2
// parity: N,O,E
// Device type: unique Modbus slave device identifier(1: EnergyMeter, 2: TempScanner etc)
// MB function code:
// 1: read coil
// 2: read discrete inputs
// 3: read holding registers
// 4: read input registers
// Data-Type: (optional)
// 0: None
// 1: unsigned int16
// 2: int32
// 3: int32 swapped
// 5: unsigned int32 swapped
// 6: float (32bit)
// 7: float (32bit) swapped
// data bitmap in HEX (optional) : 64 bit hex value bitmap
// - modbus register value indexed by bit value of bitmap will be dropped while sending data to server
// - so data array received on server will only have required modbus register value.
// - it is optional, so if not specified, all modbus register values will be sent to server
Example Modbus Read Transaction Configuration:
// configure Modbus transaction to read holding register

SET MB CONFIG#1,1,9600,8,1,N,0,1,3,1,10,0?0x3F
SET MB CONFIG#1,1,9600,8,1,N,0,1,3,1,10,6?0x3FF
// configure Modbus transaction to read input register

SET MB CONFIG#2,1,115200,8,1,N,0,1,4,1,8,0?0xFF
2) GET MB CONFIG#<transaction ID>

// to read currently configured transaction details for a given transaction ID.
KIRAN ELECTRONICS 9
3) MODBUS WRITE#<transaction ID>,<is-enabled>,<baud rate>,<no. of databits>,<no. of

stopbits>,<parity>,<device type>,<slave ID>,<MB func code>,<MB func address>,<MB func
len>?<data-1>,<data-2>,...
// MODBUS WRITE TRANSACTION CONFIGURATION:
//
// transaction ID: 1 (always 1)
// is-enabled: 1 (always 1)
// baud rates: 1200, 2400, 4800, 9600, 19200, 38400, 57600,115200
// no. of data bits: 8
// no. of stop bits: 1, 2
// parity: N,O,E
// Device type: 0 (doesn't matter. keep it 0)
// 5: write single coil
// 6: write single holding register
// 15: write multiple coils
// 16: write multiple holding registers
Example Modbus Write Transaction Configuration:

// write single coil
MODBUS WRITE#1,1,115200,8,1,N,0,1,5,1,1?1
// write single holding register

MODBUS WRITE#1,1,115200,8,1,N,0,1,6,1,1?4000
// write multiple coils

MODBUS WRITE#1,1,9600,8,1,N,0,1,15,0,7?1,0,1,1,1,0,1
MODBUS WRITE#1,1,115200,8,1,N,0,1,15,0,15?1,1,0,1,1,1,1,1,1,1,1,1,1,0,1
// write multiple holding registers

MODBUSWRITE#1,1,115200,8,1,N,0,1,16,0,5?101,102,103,104,105
4) SET MB SCAN INTERVAL#<time in seconds>

// time interval for data reporting
// range: [10 sec - 3600 sec.] default: 60 sec
i.e. SET MB SCAN INTERVAL#30
5) GET MB SCAN INTERVAL

6) SET MB RESP TIMEOUT#<time in milliseconds>

// Modbus transaction timeout. This timeout will be applied to all Modbus transactions.
// 200 ms default timeout is sufficient in most cases. Change this if you have slower device on RS485 net.
// range: [50 ms - 2000 ms] default: 200 ms
i.e. SET MB RESP TIMEOUT#250
KIRAN ELECTRONICS 10
7) GET MB RESP TIMEOUT

8) SET MB TRANS DELAY#<time in milliseconds>

// Delay between consecutive Modbus transactions. This timeout will be applied to all Modbus transactions.
// 10 ms default timeout is sufficient in most cases.
i.e. SET MB TRANS DELAY#100
9) GET MB TRANS DELAY

10) SET MB TX DELAY#<modbus transaction ID>,<pre-TX Delay microsecond>,<post-TX Delay microsecond >
// Tune pre and post delay in RS485 half-duplex communication, if modbus communication is not reliable
// delay in microsecond. Range [0-50000] microsecond
// default: pre-TX: 100 us, post-TX: 100 us
SET MB TX DELAY#1,10,100
11) GET MB TX DELAY#<modbus transaction ID>

Modbus TCP/IP Configuration Commands:
1) SET MB TCP CLIENT#<Client ID>,<is-enable>,<Slave-IP-address>,<Slave-Port>,<Slave ID>

// Configure TCP/IP connection to Modbus TCP Server
// Client-ID: Client/Connection ID Range: 1 to 10
// is-enable: 1: Client enabled, 0: Client disabled
// Slave-IP-address: IPv4 Address of Modbus TCP Server. TCP Server should be in Local LAN.
// Slave-Port: Modbus TCP Server Port
// Slave ID: Slave-ID of TCP Server Port. It will be used to bind modbus transaction to TCP connection
SET MB TCP CLIENT#1,1,192.168.1.10,502,1
2) GET MB TCP CLIENT#<Client ID>

// To read TCP/IP connection configuration
// Client-ID: Client/Connection ID Range: 1 to 10
GET MB TCP CLIENT#1
3) SET MB TCP CONFIG#<transaction ID>,<is-enabled>,<device type>,<slave ID>,<MB func code>,<MB

func address>,<MB func len>,<data type>?<data bitmap in HEX>
// MODBUS READ TRANSACTION CONFIGURATION:
//
// transaction ID: Modbus transaction ID.
// is-enabled: 1 => transaction is enabled; 0 => transaction is disabled
// Device type: unique Modbus slave device identifier(1: EnergyMeter, 2: TempScanner etc)
// Slave-ID: Slave Id or Connection ID to map modbus transaction to TCP Connection
// 1: read coil
// 2: read discrete inputs
// 3: read holding registers
// 4: read input registers
// Data-Type: (optional)
// 0: None
// 2: int32
// 3: int32 swapped
// 5: unsigned int32 swapped
// 6: float (32bit)
// 7: float (32bit) swapped
// data bitmap in HEX (optional) : 64 bit hex value bitmap
// - modbus register value indexed by bit value of bitmap will be dropped while sending data to server
// - so data array received on server will only have required modbus register value.
// - it is optional, so if not specified, all modbus register values will be sent to server
Example Modbus Read Transaction Configuration:
SET MB TCP CONFIG#1,1,0,1,3,1,10,0

SET MB TCP CONFIG#1,1,0,1,4,1,10,6?0x3FF
4) GET MB TCP CONFIG#<transaction ID>

// to read currently configured transaction details for a given transaction ID.
5) MODBUS TCP WRITE#<transaction ID>,<is-enabled,<device type>,<slave ID>,<MB func code>,<MB

func address>,<MB func len>?<data-1>,<data-2>,...
// MODBUS TCP WRITE TRANSACTION CONFIGURATION:
//
// transaction ID: 1 (always 1)
// is-enabled: 1 (always 1)
// Device type: 0 (doesn't matter. keep it 0)
// Slave-ID: Slave Id or Connection ID to map modbus transaction to TCP Connection
// 5: write single coil
// 6: write single holding register
// 15: write multiple coils
// 16: write multiple holding registers
Example Modbus Write Transaction Configuration:

// write single coil
MODBUS TCP WRITE#1,1,0,1,5,1,1?1
// write single holding register

MODBUS TCP WRITE#1,1, 0,1,6,1,1?4000
// write multiple coils

MODBUS TCP WRITE#1,1, 0,1,15,0,7?1,0,1,1,1,0,1
MODBUS TCP WRITE#1,1, 0,1,15,0,15?1,1,0,1,1,1,1,1,1,1,1,1,1,0,1
// write multiple holding registers

MODBUS TCP WRITE#1,1,0,1,16,0,5?101,102,103,104,105
6) SET MB TCP SCAN INTERVAL#<time in seconds>

// time interval for data reporting
// range: [10 sec - 3600 sec.] default: 60 sec
i.e. SET MB TCP SCAN INTERVAL#30
7) GET MB TCP SCAN INTERVAL

8) SET MB TCP RESP TIMEOUT#<time in milliseconds>

// Modbus transaction timeout. This timeout will be applied to all Modbus transactions.
// 200 ms default timeout is sufficient in most cases. Change this if you have slower device on RS485 net.
i.e. SET MB TCP RESP TIMEOUT#250
9) GET MB TCP RESP TIMEOUT

10) SET MB TCP TRANS DELAY#<time in milliseconds>

// Delay between consecutive Modbus transactions. This timeout will be applied to all Modbus transactions.
// 10 ms default timeout is sufficient in most cases.
i.e. SET MB TRANS DELAY#100
11) GET MB TCP TRANS DELAY


ES V2 4G WiFi Modbus-RTU-TCP MQTT GW

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ES V2 4G WiFi Modbus-RTU-TCP MQTT GW

Uploaded by

Copyright:

Available Formats

424, Kalasagar Shopping Hub, Nr.

Satadhar Cross Road, Ghatlodia, Ahmedanad – 380061, (GUJ)

Modbus RTU/TCP to MQTT Over 4G/WiFi/Ethernet Gateway

1. Gateway is based on WiFi module having below specifications

2. Modem based SIMCOM 4G LTE Cat1 Module

3. Power Input: 230Vac or 9-24VDC/500mA

• 1 no. Modbus RTU/TCP MQTT Gateway

3. config-cmd/<device-ID> ==>publish configuration commands to this topic. Topic name is not

MQTT packet examples:

1) From Device to Server

2) From Device to Server

- Digital Input Alert Data Payload:

- Analog Input Alert Data Payload:

5) From Device to Server (Configuration Command response)

- Invalid command response:

- Command Error Response:

Configuration Commands (SMS/MQTT):

3) SET DATA SERVER#<server domain/IP>,<server port>,<user>,<password>

4) GET DATA SERVER

5) SET DEVICE ID#1,<device-ID>

6) GET DEVICE ID#1

7) SET DATA BUFFER#<enDis>,<buffer-mode>,<buffer-size-KB>,<BUFFER-TX-INTERVAL-Sec>

6) GET DATA BUFFER

7) DELETE BUFFERED DATA#1

8) SET ID#<1-3>,<max. 15 char ID>

11) SET NETIF CONFIG#<netif>,<enabled>,<DHCP enabled>[,<ip>[,<gw>[,<mask>]]]

// disable wifi interface

// disable ethernet interface

12) GET NETIF CONFIG#<netif>

// get Ethernet interface configuration

// get WiFi interface configuration

13) ENABLE INTERNET#<netif>

14) DISABLE INTERNET#<netif>

15) Enable GSM

16) Disable GSM

Modbus RTU Configuration Commands:

1) SET MB CONFIG#<transaction ID>,<is-enabled>,<baudrate>,<no. of databits>,<no. of

Example Modbus Read Transaction Configuration:

// configure Modbus transaction to read holding register

// configure Modbus transaction to read input register

2) GET MB CONFIG#<transaction ID>

3) MODBUS WRITE#<transaction ID>,<is-enabled>,<baud rate>,<no. of databits>,<no. of

Example Modbus Write Transaction Configuration:

// write single holding register

// write multiple coils

// write multiple holding registers

4) SET MB SCAN INTERVAL#<time in seconds>

5) GET MB SCAN INTERVAL

6) SET MB RESP TIMEOUT#<time in milliseconds>

7) GET MB RESP TIMEOUT

8) SET MB TRANS DELAY#<time in milliseconds>

9) GET MB TRANS DELAY

11) GET MB TX DELAY#<modbus transaction ID>

Modbus TCP/IP Configuration Commands:

1) SET MB TCP CLIENT#<Client ID>,<is-enable>,<Slave-IP-address>,<Slave-Port>,<Slave ID>

2) GET MB TCP CLIENT#<Client ID>

3) SET MB TCP CONFIG#<transaction ID>,<is-enabled>,<device type>,<slave ID>,<MB func code>,<MB

Example Modbus Read Transaction Configuration:

SET MB TCP CONFIG#1,1,0,1,3,1,10,0

4) GET MB TCP CONFIG#<transaction ID>

5) MODBUS TCP WRITE#<transaction ID>,<is-enabled,<device type>,<slave ID>,<MB func code>,<MB

Example Modbus Write Transaction Configuration:

// write single holding register