Modbus RTU communication with Gantner modules

Compatible Gantner Instruments measurement modules support Modbus RTU requests to read measurement values, write supported variables and retrieve diagnostic information. Use the register layout and communication settings specified for the module and firmware. Read both registers of a real value together, and enable write access before sending supported write commands.

Communication sequence

The Modbus master initiates communication by sending a request to a module. The addressed module processes the request and returns a response.

Each message contains:

Field	Description
Module address	Identifies the module receiving the request or sending the response.
Function code	Defines the requested operation, such as reading or writing registers.
Parameters or data	Contains register addresses, register quantities or values.
Cyclic redundancy check	A 16-bit checksum used to detect transmission errors.

Modules respond to requests from the master. The achievable polling rate depends on the communication settings, message length, number of modules and performance of the master.

Communication timing

The following timing parameters describe the communication sequence:

Parameter	Description
T1	Time between consecutive characters within a message.
T2	Time between a request and the corresponding response.
T3	Time between a response and the next request.

A character time is calculated as:

Character time = number of bits per character ÷ baud rate

The number of bits includes the start bit, data bits, parity bit where used, and stop bits.

Modbus RTU uses a silent interval to separate messages. Follow the Modbus serial line timing requirements for the selected baud rate.

Where supported, the module configuration software allows adjustment of the minimum response delay and communication timeout. The implementation described in the source documentation provides:

Setting	Documented value
Minimum response delay	Default: one character time
Communication timeout	Adjustable from 0.1 to 600 seconds
Communication timeout default	60 seconds

The module response to a communication timeout is configurable where supported. Check the documentation for the connected module before applying these values.

Message format and byte order

A Modbus RTU message has the following structure:

Module address → Function code → Parameters or data → Checksum

There are no explicit start or end delimiter characters. Messages are separated by a silent interval.

The checksum uses a different byte order: the low byte is transmitted first, followed by the high byte. It is calculated over the complete message, excluding the checksum field itself, with an initial value of 0xFFFF.

All register addresses and function codes in this article are hexadecimal unless stated otherwise.

Supported function codes

The source documentation describes the following functions:

Function code	Function	Purpose
`0x03`	Read holding registers	Reads registers assigned to the holding register area.
`0x04`	Read input registers	Reads registers assigned to the input register area.
`0x06`	Write single register	Writes one 16-bit register.
`0x08`	Diagnostics	Performs the supported diagnostic subfunction.
`0x10`	Write multiple registers	Writes consecutive 16-bit registers.

A register being readable does not automatically mean that it is writable. Write access depends on the variable type and module configuration.

Read holding registers: `0x03`

Use this function to read consecutive holding registers.

Request fields: Module address, function code, starting register address, number of registers and checksum.

Response fields: Module address, function code, data byte count, register data and checksum.

Each register contains two data bytes.

Read input registers: `0x04`

Use this function to read consecutive input registers. The request and response structures are the same as for function 0x03.

Write single register: `0x06`

Use this function to write one 16-bit register.

Request fields: Module address, function code, register address, register value and checksum.

A successful response repeats the register address and value from the request.

Diagnostics: `0x08`

The documented diagnostic function uses subfunction 0x0000, Return Query Data.

The module returns the diagnostic data unchanged when it receives a valid request. For example, the request can contain the data word 0xA537.

This provides a basic check that the module can receive and respond to a valid message.

Write multiple registers: `0x10`

Use this function to write a consecutive block of registers.

Request fields: Module address, function code, starting register address, register quantity, data byte count, register data and checksum.

Response fields: Module address, function code, starting register address, number of registers written and checksum.

The documented implementation specifies a maximum data payload of 64 bytes, equivalent to 32 registers. Confirm the supported limit for the connected module.

Measurement value registers

Measurement values are available as signed integers or real values, depending on the module and configuration.

The source documentation describes two register layouts. Select the layout specified for the connected module.

Signed integer values

Each integer value occupies one 16-bit register and has a range of −32,768 to 32,767.

Variable	Layout A	Layout B
Variable 1	`0x0000`	`0x0000`
Variable 2	`0x0001`	`0x0001`
Variable 8	`0x0007`	`0x0007`
Variable 16, where available	`0x000F`	`0x000F`
Variable 17, where available	—	`0x0010`
Variable 32, where available	—	`0x001F`

For variable number n, the integer register address is:

Register address = n − 1

The number of available variables depends on the module. Apply the configured scaling and decimal information when interpreting integer values.

Real values

Each real value occupies two consecutive 16-bit registers:

First register: high word.
Second register: low word.

Variable	Layout A: high / low word	Layout B: high / low word
Variable 1	`0x0010` / `0x0011`	`0x0020` / `0x0021`
Variable 2	`0x0012` / `0x0013`	`0x0022` / `0x0023`
Variable 8	`0x001E` / `0x001F`	`0x002E` / `0x002F`
Variable 9, where available	`0x0020` / `0x0021`	`0x0030` / `0x0031`
Variable 16, where available	`0x002E` / `0x002F`	`0x003E` / `0x003F`
Variable 17, where available	—	`0x0040` / `0x0041`
Variable 32, where available	—	`0x005E` / `0x005F`

Always read or write both words of a real value in the same request. Use function 0x10 when writing a value spanning two registers.

For variable number n:

Layout	High-word address	Low-word address
A	`0x0010 + 2 × (n − 1)`	High-word address + 1
B	`0x0020 + 2 × (n − 1)`	High-word address + 1

Example: reading a real value

To read variable 1 from a module using Layout B:

Select the module address.
Use the read function specified for the register area.
Set the starting register address to 0x0020.
Request two registers.
Interpret the returned high and low words using the module’s real-value format.

Check how the master software represents register addresses. Some applications use register reference numbers or an offset instead of the hexadecimal protocol addresses shown here.

Writing variables

The effect of a write operation depends on the variable type and configuration.

Variable type or function	Effect of an authorised write
Analogue input with tare enabled	Triggers the tare function.
Digital counter with reset enabled	Resets the counter to zero.
Arithmetic variable with minimum or maximum tracking and reset enabled	Resets the stored minimum or maximum value.
Setpoint variable	Applies the new setpoint.
Digital output controlled by the host	Sets the output to the corresponding state.

Enable write access in the applicable module configuration software before sending write commands.

Writing an input-related register may trigger a tare or reset operation rather than change the measured value.

Variable information registers

Where supported, each variable has an information block containing its type, measurement principle, display information and name.

The information block for variable 1 starts at 0x1000.

Register address	Content	Documented length
`0x1000`	Variable type	2 bytes
`0x1001`	Measurement principle	2 bytes
`0x1002`	Field length	2 bytes
`0x1003`	Decimal places	2 bytes
`0x1004`	Tare or reset availability	2 bytes
`0x1005–0x1007`	Engineering unit	4 characters
`0x1008–0x1011`	Variable name	20 characters
`0x1012–0x101F`	Reserved	—

Information blocks are spaced by 0x0020 registers.

Block start for variable n = 0x1000 + 0x0020 × (n − 1)

Examples:

Variable	Information block
1	`0x1000–0x101F`
2	`0x1020–0x103F`
3	`0x1040–0x105F`
8	`0x10E0–0x10FF`
16	`0x11E0–0x11FF`

Variable type codes

Code	Variable type
`0x00`	Empty variable
`0x01`	Analogue input
`0x02`	Arithmetic variable
`0x03`	Digital output
`0x04`	Digital input
`0x05`	Setpoint
`0x06`	Alarm
`0x09`	Controller variable

Analogue input measurement principle codes

Code	Measurement principle
`0x00`	Single-ended voltage
`0x01`	Differential voltage
`0x02`	Current
`0x03`	Two-wire resistance
`0x04`	Three-wire resistance
`0x05`	Four-wire resistance
`0x06`	Four-wire bridge
`0x07`	Six-wire bridge
`0x08`	Thermocouple with internal reference junction compensation
`0x09`	Thermocouple with external reference junction compensation
`0x0A`	Cold junction terminal 1
`0x0B`	Potentiometric measurement
`0x0C`	Cold junction terminal 2
`0x0D`	Cold junction terminal 3
`0x0E`	Cold junction terminal 4

Digital input measurement principle codes

Code	Measurement principle
`0x00`	None
`0x01`	Host input
`0x02`	Frequency
`0x03`	Progressive counter
`0x04`	Quadrature counter
`0x05`	Up/down counter

Digital output measurement principle codes

Code	Measurement principle
`0x00`	None
`0x02`	Pulse-width modulation output
`0x03`	Process output

The source also lists code 0x01 as “post output”. Its meaning should be checked against the module documentation before use.

Tare and reset codes

Code	Meaning
`0x00`	Tare or reset unavailable
`0x01`	Tare or reset available

Device information

The following read-only registers provide general module information:

Register address	Content	Length
`0x0300`	Number of variables	2 bytes
`0x0301–0x0303`	Serial number	6 characters
`0x0304–0x030D`	Location	20 characters

A device identification area starts at 0x0400. The source describes the following fields:

Field	Documented length
Vendor name	1–32 characters
Module model	1–32 characters
Hardware version	1–8 characters
Software version	1–8 characters

The source does not provide fixed start addresses for all identification fields. Use the applicable module register map to locate them.

Status information

Register address	Content
`0x0500`	Module status
`0x0501`	Variable status

Module status

The module status register contains error and configuration indicators. A set bit does not always indicate a fault.

The table retains the source document’s indicator numbering. Confirm the corresponding bit masks for the connected module.

Indicator	Meaning
M1	Electrically erasable memory error; documented as not implemented
M2	Flash memory error
M3	Analogue-to-digital converter interrupt timeout
M4	Configuration checksum error or configuration access failure
M5	Programmable logic loading error
M6	Real-time clock error; documented as not implemented
M7	Internal communication bus timeout
M8	Overload indication; documented as unused
M9	Socket memory checksum error or access failure
M10	Valid module address selected using the address switches
M11	Configuration source indication associated with switch 8
M12	Incorrect extension board indication; documented as unused
M13	Calibration file obtained from the extension board
M14	Calculation time overrun
M15	Communication controller access failure
M16	Working memory readiness or write failure

Available indicators and their interpretation depend on the module hardware and firmware.

Variable status

The documented variable status register provides one range-error indicator for each of variables 1–16.

A set indicator means that the corresponding measurement value is outside its valid linearisation range. Possible causes include a sensor failure or short circuit.

For example:

Indicator	Meaning
K1	Variable 1 range error
K2	Variable 2 range error
…	…
K16	Variable 16 range error

Troubleshooting

The module does not respond

Check that:

The master and module use matching serial communication settings.
The request uses the correct module address.
The module supports the requested function and register range.
The master allows sufficient response time.
Message timing and checksum generation are correct.
The physical communication connection is correct.

Values are incorrect

Check that:

The correct register layout is selected.
The master uses the intended register address convention.
Integer values are interpreted as signed 16-bit values.
Scaling and decimal places are applied correctly.
Real values are read as two registers in one request.
Register byte order and real-value word order are configured correctly.

Write commands have no effect

Check whether the variable supports writing and whether write access is enabled. Also confirm whether the command is intended to update a value or trigger a tare or reset operation.

Frequently asked questions

Which Modbus register layout should I use?

Use the layout specified for your module and firmware. The article describes Layout A and Layout B, which have different starting addresses for real values. Confirm the applicable layout before configuring the master.

How do I read a real measurement value?

Read its two consecutive registers in the same request. The documented order is high word first, then low word. Interpret the result using the real-value format specified for the module.

Why does writing an input-related register trigger a reset?

Depending on the variable configuration, a write can trigger tare, reset a counter or clear a tracked minimum or maximum. It does not necessarily replace the measured value.

What determines the achievable polling rate?

The polling rate depends on the serial communication settings, message length, number of modules and master performance. Allow for message separation and module response time.

How can I check whether the module responds correctly?

Where supported, use function 0x08 with subfunction 0x0000, Return Query Data. The module returns the supplied diagnostic data unchanged. This checks request and response communication; it does not validate measurement accuracy.