Titan – AN8: Implementing a Modbus RTU/TCP – SNMP Gateway

Scenario Details

The Titan routers include all the typical features of a 2G/3G/4G router. However, they also include a series of additional features that help make it one of the leading market routers based on the number of features it includes.

One of these additional features is the ability to create SNMP (v2) connectivity for any Modbus RTU or Modbus TCP device, through which carrying out SET/GET operations, as well as sending traps upon changes in register values or status, is available.

In this Application Note an example will be used to show how to configure the Titan router in order to create this capability for a Modbus RTU device.

Description of the Example

In this example we will use a device with Modbus RTU communication protocol via its RS232 port (configuration: 9600,8,N,1). The Modbus device has as its Modbus address the value @1 and contains 33 Modbus registers for both reading and writing (numbered from 0 to 32).

We will also have an SNMP v2 server, from which we must be able to send GET SNMP commands at any time in order to any of the device’s Modbus RTU registers. We must also be able to use SET SNMP commands to change a Modbus register in the device. Finally, we also require that a TRAP is sent to the SNMP server to inform of any change in status for the Modbus registers 2 and 10 since these represent alarms.

For this, we will use the MTX-Router-Titan-3G-mini router which is habilitated to carry out SNMP-Modbus protocol conversions.

SNMP Configuration

The first thing we must do is configure the SNMP section of the Titan router. For this, we must access the menu “Other > SNMP”, where we can activate the SNMP service and specify the UDP port and community for the SET and GET SNMP commands. The same is necessary for the sending of TRAPS, with the additional requirement of specifying the IP address used to send them.

In the screen above, we can see a link marked “Click here for download MIB”. By clicking this link, the MIB database will be downloaded which includes information about the OIDs, TRAPS, etc.

Configuring the Titan Router’s COM1 Serial Port

We will use the Titan’s COM1 port to access the Modbus device containing the RS232 port. The necessary configuration, to be inserted in the menu “Serial Settings > Serial Port1-232/485”, is shown in the screen below.

In summary, we must configure the Titan’s COM1 port to RS232 mode, using the same configuration as the port contained in the Modbus device (9600,8,N,1). The mode to be selected is “Function: nothing or Used by External Device” since the port will be used by the external Modbus device.

Configuring the Titan Router’s Modbus

This configuration is done from the menu “External Devices > Modbus Devices”. In the main part of the screen, we must select “Enabled” as well as indicate the COM1 serial port to read the Modbus, as we configured in the previous section.

The Modbus-SNMP gateway is configured in the lower part of this screen. We must select “Enabled” and indicate the Modbus device’s address to be used (in this example, @1). We must also specify the first register (in this example, @0) and the number of registers to be read (in this example, 33), as well as those registers for which the Titan router will not send a notification TRAP in the event of changes in status (in this example, 2 and 10). Note that this must be specified using commas to separate each number, without spaces. The configured registers will be read by the Titan router every 5 seconds, using the Modbus command 0x03. Only registers of the type “word” will be read.

Note that the maximum number of registers to be mapped between the Modbus RTU and SNMP is 500. A list of the existing relations between the 500 Modbus registers and the OIDs and TRAPS is included in the MIB database. It is not necessary for the 500 registers to be read consecutively. For example, if you only wish to read registers 1 to 5 and 100 to 200, this can be specified in the “Number Words” field as follows: “1-5;100-200”.

Once configured, the device must be reset for this configuration to be effective.

Checking the Configuration

There are several ways in which the configuration can be checked. The most obvious is to use real devices. However, an alternative method is to use emulators, given that this provides the possibility to detect and resolve problems that could occur. We will use the latter in this section.

Firstly, we must connect the Titan router’s serial port to the RS232 port in our PC. Then, we will use a piece of PC software called “Modbus Slave” to act as our Modbus device to be read. A slave device will be created with address @1, 03 reading function, first register as 0 and the number of registers to be 33.

The PC’s serial port will be configured using the same speed as the real device (9600,8,N,1).

Upon pressing OK and establishing a connection, we will go to the menu “Display > Communication” where we must activate the visor for the communication traffic between the Titan router and the emulator.

Providing everything is correct, we should see RX strings which are the ‘questions’ sent to the emulator by the Titan router. The TX strings are the responses received by the Titan router.

If everything is correct (i.e. communications between the Modbus registers and the emulator are working correctly), we can continue to the SNMP section. For this we will use MIB Browser software. In this example, we have used “ManageEngine MibBrowser5”, which is free. Here we must configure the local Internet IP address (the default value is 192.168.1.2), as well as specifying the UDP port as 161, and inserting “public” into the community fields.

After completing this, the MIB file from the Titan device must be copied to the “mibs” folder, which should be located where the “ManageEngina MibBrowser” was installed (usually this would be “C:\ Program Files (x86)\Manage Engine\MibBrowser Free Tool\mibs”. The MIB file can be downloaded using the Titan router as explained in section 3 of this Application Note. Once copied, it can be loaded using the menu “File > Load MIB”. We will choose the file TITAN-MIB.

We can see that the TITAN-MIB device now appears in the menu to the left of the screen, as well as the different OIDs. In particular, we are interested in the OIDs “modbus0” to “modbus32”. The last thing to be configured at this stage is the SNMP version to be used, in this case v2c.

Once completed, we can carry out SNMP readings, observing how these affect the Modbus registers contained in our emulator. For example, by right clicking on OID Modbus 3, we can carry out a “GET” function. The result of this action is shown to the right of the screen (the value 3), which corresponds to the value contained in the Modbus 3 register of our emulator.

To test a SET SNMP command, for example, inserting the value 33 in the same OID, we must write this value in the field “Set Value” and once again right click the OID, selecting the SET command. This change will be visible in the corresponding register of our emulator.

Now we must check the TRAPS. In Section 4 of this Application Note we saw that a TRAP must be sent in the event of any changings in the values contained in the Modbus registers 2 and 10. To see the TRAPS, we must go to the menu “View > Trap Viewer”, specifying the field “Port 162”, as well as inserting the value “public” into the Community field. To finish, we must click “Start”.

Now, by double clicking the Modbus 2 register in our emulator and changing the value of the register to 20 for example, we will see that a new TRAP will appear in the screen, indicating that a change in this register has occurred.

FAQs

• In this Application Note, the process explained is for a Modbus RTU device. Is the process the same for a Modbus TCP device?
  Yes, it is. We would have to change the Modbus address value for the IP address. For example, in this example we specified the value “1” in the Modbus RTU device’s address. We would change this to “192.168.1.100:502” (assuming the IP address were 192.168.1.100 and the TCP port awaiting responses were 502). The following screen shows this change.

• This example sends a TRAP when a register changes value, which is useful for those Modbus registers linked to some type of alarm. Would it be possible for TRAPS to be sent when the value of a register is greater than a certain value?
  Yes, it would. However, the configuration for this scenario is slightly more complex. The configuration would have to be done from the menu “Titan Scripts”. For example, let us
  assume that we want the following to occur:
  1. When the Modbus 10 register (of the Modbus RTU device with address @1) **********, a TRAP must be sent by the Titan router with severity “1” ([.1.3.6.1.4.1.45711.12.1.1)
  2. When the sum of the Modbus 10 and 11 registers (of the Modbus RTU device with address @1) is 50, a TRAP must be sent by the Titan router with severity “2” [.1.3.6.1.4.1.45711.14.1.1)
  3. When the Modbus 12 register (of the Modbus RTU device with address @1) is greater than 50, an SMS must be sent by the Titan router to the cell phone number +34123456 with the text “Temperature Alarm”. (For this option, a SIM card must be inserted in the Titan router)

These three options can be specified in the menu “Other > Titan Scripts”, using the ST (Send Trap) and SS (Send SMS) commands.

• In this example, 33 consecutive Modbus registers are read. How would non-consecutive registers be read (for example, register 200, 210, and the intervals 400-410 and 430-600)?
  This is possible. By default, the register “Number Words” indicates the number of registers to be read from the register identified in “Start”, but it is possible to enter intervals in this field. In order to read the registers as given in the example, we would need to configure the Titan router as shown in the following screen:

Here, we indicate in the “Start” field register number 200. Then, in the “Number Words” field we would enter “0” (200+0=200), “10” (200+10=210), and the intervals “200-210” and “230-400”. Each register/interval is separated by a semi-colon.

• I need my PLC Modbus TCP device to have SNMP connectivity, as per the example given in this Application Note; however, I do not want the Titan router to send the TRAPS, yet the PLC. Is this possible?
  Yes, it is. The Titan router works like a Modbus TCP master, periodically reading the Modbus registers from the PLC, but it can also work simultaneously as a Modbus TCP slave. When the Titan router is in TCP Slave mode, AT commands can be sent via Modbus, through which SMS messages, emails and TRAPS can be sent, as well as the possibility of switching relays or consulting network coverage.
  For more information regarding how to use AT commands with Modbus TCP, please consult Application Note 10 (AN10-Sending SMSs, EMAILs, TRAPS SNMP using Modbus TCP).