Reading modbus/TCP from IAQ RW-THC not working?

  • Hi,

    may be am am a little bit stupid. But I do not get any modbus information back from my new device.

    These are the settings of the device:

    I verified the port is open:

    root@zentrale:~# nmap -p 502
    Starting Nmap 7.70 ( ) at 2021-09-26 14:55 CEST
    Nmap scan report for
    Host is up (0.18s latency).
    502/tcp open  mbap
    Nmap done: 1 IP address (1 host up) scanned in 6.88 seconds

    First I tried to use mbpoll to get information but mbpoll's syntax is somehow cryptic so I either got no results, an error or misleading results....
    I tried then to do it with my own C code but failed as well.

    #include "header.h"
    #include "vars.h"
    void main(int argc, char* argv[])
    modbus_t *modbusglob;
    union {
           uint16_t word[2];
           uint32_t dword;
           float fl;
    } wert;
    int errlvl;
    /********************************* Function **********************************/
    void fieldbus_free(modbus_t *modbus)
            if (modbus != NULL) {
    /********************************* Function **********************************/
    modbus_t * fieldbus_new(void)
    int err;
    modbus_t *modbus;
    char host[15];
    int port;
    //    strcpy(host,"");
        port   = 502;
        modbus = modbus_new_tcp(host, port);
        if (modbus == NULL )
           exit (55);
        err = modbus_connect(modbus);
        if (err  == -1)
            modbus = NULL;
            exit (55);
        err=modbus_set_slave(modbus, 0);
        if(  err == -1)
            modbus = NULL;
            exit (60);
        } else {
            return modbus;
    /********************************* Main **********************************/
    errlvl=modbus_read_registers(modbusglob, 26, 2, (&wert.word[0]));
    if (errlvl == -1) {printf("ERR1 modbus_read_register, %s\n",modbus_strerror(errno));}
    else { printf("Register is set to %f\n",wert.fl);}
    errlvl=modbus_read_registers(modbusglob, 18, 2, (&wert.word[0]));
    if (errlvl == -1) {printf("ERR2 modbus_read_register, %s\n",modbus_strerror(errno));}
    else { printf("Register is set to %f\n",wert.fl);}
    exit (0);

    What I get after compile and start is a timeout:

    root@zentrale:/heizung/src# ./neuron
    ERR1 modbus_read_register, Connection timed out
    ERR2 modbus_read_register, Connection timed out

    I used register 26 and 18 for VOC-Index (foat32) and CO2 (float32).
    Remark: As soon as I switch to "localhost" (and matching registers) instead of the device I am getting results...

    What is wrong here?

    And regarding mbpoll: someone having a working example for mbpoll/tcp?

    THANKS a lot!


  • administrators

    Hi @knebb,
    here's a working mbpoll example reading a temperature:

    root@mkudlacek:~# mbpoll -a 1 -0 -1 -r 0 -c 2 -t 3:hex
    mbpoll 1.4-25 - FieldTalk(tm) Modbus(R) Master Simulator
    Copyright © 2015-2019 Pascal JEAN,
    This program comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it
    under certain conditions; type 'mbpoll -w' for details.
    Protocol configuration: Modbus TCP
    Slave configuration...: address = [1]
                            start reference = 0, count = 2
    Communication.........:, port 502, t/o 1.00 s, poll rate 1000 ms
    Data type.............: 16-bit register, input register table
    -- Polling slave 1...
    [0]:    0x41AD
    [1]:    0x05FD


    The problem is probably in the slave address. You probably use "0" (modbus_set_slave(modbus, 0)), but it is "1".

    Best regards,

  • @Martin-Kudláček

    Tahnks a lot!

    Ok, mbpollnow delivers useful output which I do have to convert manually.

    And yes, changing from 0to 1 for setting slave does not produce any timeout errors or similar.

    Just, it still does not show the current values. I am always getting "0.000000" back (while mbpoll and the webpage show different values). No matter what address I use in the read call:

    errlvl=modbus_read_registers(modbusglob, 6, 2, (&wert.word[0]));

    Any further idea?


  • administrators

    Hi @knebb,
    you have verified, that the HW is working and returns correct value via standard tool. Checking and fixing your code is unfortunately beyond the scope of the free support.

    Thank you for understanding and have a nice day,

Log in to reply