Titan – Modbus TCP Slave

The Titan routers can be configured to behave as a Modbus TCP/RTU slave device. For example, using Modbus TCP protocol, it is possible to change the internal relays remotely (via 3G, Ethernet or WiFi) as well as consulting their statuses, the status of the digital input and sending/receiving SMS messages or sending emails via Modbus TCP.

Remember that relays can also be controlled remotely via AT commands, be these sent by SMS, 3G, Ethernet or WiFi. This can be configured using the menu “Other > Remote Console”.

Below we can find a table with the Modbus address for the Titan registers. The Modbus commands that are permitted are 0x03 to read and 0x10 to write.

REGISTER ID	R/W	POSSIBLE VALUES	DESCRIPTION
1	R	0 … 32635	Firmware version
2	R	0 … 32635	Firmware subversion
3	R/W	0, 1	Relay 1 (0 = relay open/1 = relay activated)
4	R/W	0, 1	Relay 2 (0 = relay open/1 = relay activated)
5	R	0, 1	Digital input status. 0 = input to GND, 1 = input not connected
98	W	0 … 32635	Length of AT command to be executed
99	R	0 … 32635	Length of AT command response
100…354	W	ASCII	AT command text (in ASCII)
500…754	R	ASCII	AT command response text (in ASCII)
1000	R/W	0, 1	1 indicates a new SMS received. A PLC should write ‘1’ after reading the SMS
1001	R	0 … 18	Length of cell number that sent the SMS
1002…1019	R	ASCII	Cell number that sent the SMS
1020	R	0 … 18	Length of SMS
1021…1180	R	ASCII	Text of SMS

AT Commands via Modbus TCP Protocol

Another interesting characteristic of the Titan routes is the option to execute AT commands via Modbus protocol. For example, if we have a PLC acting as a Master Modbus TCP, we can send an AT command via Modbus TCP protocol to the router in order to obtain information such as network coverage, or send an SMS, read a radio sensor (temperature, pulse counter, digital input or a 4/20mA input, etc.), read the time or reset the router.

The following pages will explain the process of sending AT commands via Modbus TCP.

Procedure for Sending AT Commands via Modbus TCP

The process is simple and the best way to understand it is using a practical example. For example, imagine we want to execute the command AT+CSQ to obtain the network coverage.

• First we must write the AT command in ASCII code, using the registers 100 and onwards

REGISTER ID	VALUE	DESCRIPTION
100	65	ASCII for letter: A
101	84	ASCII for letter: T
102	43	ASCII for character: +
103	67	ASCII for letter: C
104	83	ASCII for letter: S
105	81	ASCII for letter: Q

• The command AT+CSQ has six characters, therefore we must input in register 98 the value “6” for the command to be executed

REGISTER ID	VALUE	DESCRIPTION
98	6	Size of command to be executed

• Then we must check the command’s execution, which we can see in register 99. The value we are reading represents the length of the response. A value of 0 indicates there is no response (the execution is incomplete)

REGISTER ID	VALUE	DESCRIPTION
99	28	Size of response to command

• Finally, we must read the 28 registers where the response is contained (register 500 onwards)

REGISTER ID	VALUE	DESCRIPTION
5000	65	A
501	84	T
502	43	+
503	67	C
504	83	S
505	81	Q
506	13	\r
507	13	\r
508	10	\n
509	43	+
510	67	C
511	83	S
512	81	Q
513	58	:
514	32	[space]
515	49	1
516	54	6
517	44	‚
518	57	9
519	13	9
520	13	\r
521	10	\n
522	13	\r
523	10	\n
524	79	O
525	75	K
526	13	\r
527	10	\n

For this AT command the relevant registers are 515 and 516, which indicate a network coverage of 16.

Remember that in order to use this characteristic to send SMS messages, the AT command is AT^MTXTUNNEL=SMS,phone,message, as previously outlined in this guide.

Procedure for Receiving SMS Messages

The process for receiving SMS messages via Modbus TCP is very simple. The PLC should periodically check register 1000. If the value read is “1”, this indicates that there is a new SMS message, which can be read from regsiters 1001 to 1180. After reading the message, the value of register 1000 should be changed back to “0”.

ADDITIONAL NOTES

• Once configured click on the “SAVE CONFIG” button to save changes. Restart the router so changes apply
• Check the modbus registry table inside the Titan router configuration menus, in the section Other > Modbus Slave