modbus | Modbus TCP Server and Client in Python3 | TCP library

The device manual isn't clear about the register start address, but the first register it mentions has the address of 1.

Similarly, the mbpoll command-line utility (not the one with GUI) isn't very clear about the start address. But its documentation mentions that the default value for -r parameter is 1.

I think it's safe to assume that both use the same addressing which starts from 1, as the command-line tool has no problems accessing the value.

But MinimalModbus API clearly mentions that its register start address is 0. So when using this library, you need to use registeraddress = 45 for accessing the temperature, not 46 or 40046.

But why won't 46 work? Normally, one would expect it to grab data starting from the next register and print some garbage, but not timeout. But we can't know how the device works internally. Maybe a request to access the temperature register actually triggers some measurement function and then returns a value. A request to access an unaligned data (with a wrong register value) can be simply rejected by the firmware.

If you still get timeouts with registeraddress = 45, your Python runtime may have some problems accessing the serial port. As I stated in my comment, I recommend using a logic analyzer to see what's going on on the wire. Without such a tool, you're doing blind-debugging.

Expanding on the answer in the comments in case someone finds this in the future:

When using modpoll with floating point numbers (e.g. -t 4:FLOAT) two 16 bit registers will be combined to output each 32 bit floating point value. This may mean that modpoll is requesting more registers (32) than expected. The result may be an error if non-existent registers, at the end of the range, are being requested (I'd expect exception 2 - ILLEGAL DATA ADDRESS). This can be resolved by reducing the number of values requested.

I believe you will also need -B (Big Endian) but that would not cause an error (just an unexpected result).

In your client, strlen(message) will count chars until the first '0'encoutered. So your sent bool array never will be of length 8.

Your client must then take the buffer length too in parameter to fix this.

If your buffer is a true C array (not an allocated pointer) then sizeof statement can give the length. But if you use a malloc'd pointer for buf, sizeof statement will always return 8, never less, never more (in 64 bit systems), that is the size of a pointer only.

In short, always keep a length integer alongside with a buffer.

As @Marcos G. pointed out in the question's comments, it turns out that the only way to succesfully ask the Sensor R444A01 about the values of multiple registers is to read these registers on a single query, instead of 1 query per 1 register.

Therefore, I needed to make use of the following keys: "read_count" and "read_offset".

Here is the correct code in order to read both Temperature and Humidity values on a single query:

Thanks to @Brits i got it running. I had to use read_float(0, functioncode=4, number_of_registers=2) where 0 is decimal. If i want to read 001A i had to convert from hex to dec = 26. Works very good

Writing is successful.

write_register from minimalmodbus has "None" return value.

So checking the return_flag results in failure.

I would recommend get it working between your code and a Modbus emulator, not the PLC. Once you get YOUR code working, then you can work on the PLC.

What's cool about using an emulator initially, you could also use IT to be the Master to talk to the PLC (similar to how you got your code working as the Master to the emulator as the Slave). The emulator can provide good understanding of both sides before getting the 2 ends to talk to themselves (i.e. the actual Master and the actual Slave(s)). Emulators can also provide good diagnostic details. That's one issue when diagnosing comm - which side is causing the problem (or is it a physical layer issue, e.g. wired wrong). A good emulator can help diagnose issues before doing "real" comm.

Modbus does not define how the data types are sent, it only defines the sending of one or more 16-bit words and also bits.

As these registers are interpreted as signed or unsigned integers, or as two consecutive registers are interpreted as a float and even less as 3 registers are interpreted as time, then each implementation of the protocol does as it thinks best.

For this reason, when a float is sent, sometimes the most significant word is sent first and sometimes it is the opposite.The Modbus client should be prepared to invert the words in this case.

And in the case of transmitting a time, it can be even more complicated.

The C standard does not specify padding in structures; a compiler is permitted to insert padding between members for any reason. There is generally no reason for a compiler to insert padding before members whose size is one byte or arrays of such, and GCC and Clang do not. (Conceivably, there could be a slight benefit to aligning an array in some architectures, to make the base address simpler. This is not of practical concern here.)

Even if the earlier members were not one-byte types, you could get the layout you request by removing the #pragma directives that surround the structure and marking each earlier element with __attribute__((__packed__)). For example, this code: