Document Version: V1.1
Gateways & Firmware Requirement:
| Software | E2C Factory | E2C Field | E2C Facility |
|---|---|---|---|
| Gateways supporting | EG3120 EG5120 EG5200 | LG3120 | LG5120 |
| Firmware Requirement(RobustOS Pro Version) | ≥2.3.103 | =2.4.110 | (TBD) |
This manual guides field technicians to quickly configure the Robustel edge computing gateway to forward collected data to higher-level systems (such as SCADA, MES, or upper computer software) using the Northbound Modbus TCP Slave protocol.
This manual is written for field implementation engineers. You do not need deep theoretical knowledge of the Modbus protocol. By following these step-by-step instructions, you can easily configure the gateway as a Modbus TCP Slave, map internal data tags to Modbus registers, and verify the data using third-party tools.
Gateway Role: From Collector to Server
In a typical IIoT project, imagine the gateway as a translator between your local sensors and the upper-level system. The data flow consists of two main stages:
First Stage (Southbound): The local field devices (such as a Modbus TCP Sensor) are connected to the gateway. The gateway actively collects data from these devices and stores the values internally as Tags.
Second Stage (Northbound): The gateway operates as a Modbus TCP Slave on the network. It takes those internal Tags, converts them into standard Modbus register addresses, and exposes them so that a higher-level system, such as SCADA, MES, or a Modbus testing tool like Modbus Slave, can continuously read the values.
(Note: This document uses the LG3120 gateway and E2C Field software as an example. The configuration process for other supported gateway and software combinations is very similar.)
Before starting the configuration, please ensure the following preparations are met:
| Device | Requirement |
|---|---|
| Gateway | Robustel Gateway with E2C Field/E2C Factory/E2C Facility software installed. In this document, we use LG3120 with E2C Field for an example. |
| Debugging PC | A PC used to log into the gateway's Web UI and run the Modbus testing software (Modbus Slave). |
| Southbound Device | A Modbus TCP Slave device (e.g., PLC or sensor simulator) to provide the initial data source. |
| Ethernet Cable | Standard Ethernet cables to connect the gateway, the debugging PC, and the Modbus TCP device. |
LAN Connectivity: The gateway, the debugging PC, and the Modbus TCP device must be connected to the same Local Area Network (LAN) (e.g., connected to the same switch or the gateway's LAN ports).
IP Allocation: Ensure all devices have valid IP addresses in the same subnet (e.g., 192.168.0.x) and there are no IP conflicts.
Port Accessibility: Ensure the PC's firewall allows TCP traffic on port 502 (the standard Modbus TCP port).
Modbus Testing Tool: Download and install Modbus Slave on your debugging PC. It is a free, industry-standard tool used to search and verify Modbus TCP Slave data.
Before forwarding data via Modbus, the gateway must first collect data from the field devices. In this guide, we will use a Modbus TCP sensor simulator as an example to collect two tags: Temperature and Humidity.
Connect your PC to the gateway's LAN port.
Open a web browser and enter the gateway's IP address (the default is usually 192.168.0.1).
Log in with your credentials and click【Edge Computing】 in the gateway's Web GUI to enter the E2C Field interface.
(Note: This section assumes that you already have a Modbus Slave device physically connected to the gateway via an Ethernet cable.)
On the left menu of E2C Field, go to【Data Collection】>【Wired Device】.
Click the【+Create】 button to add a new device.
Select【Modbus TCP】 as the Driver.
Fill in the basic device parameters (refer to your sensor's manual):
| Parameter | Description | Default / Example Value |
|---|---|---|
| Name | A recognizable name for your Modbus device. | Sensor1 |
| Driver | The communication protocol used by the device. | Modbus TCP |
| IP Address | The IP address of the Modbus TCP slave device. | 192.168.0.17 |
| Port Number | The TCP port number for Modbus communication. | 502 |
| Slave Address | The Modbus unit identifier or device address. | 2 |
| Polling Cycle | The interval (in seconds) at which the gateway reads data. | 1 |
Now we need to read the specific registers from the Modbus device. Let's assume the client's Modbus Slave manual states that the Temperature data is stored in Holding Register 40001 and Humidity is stored in Holding Register 40002.
Click on the newly created device (Sensor1) to enter its configuration page.
In the Tag List section, click【Add】 to create two tags. Fill in the following parameters:
| Parameter | Description | Example Value |
|---|---|---|
| Name | The name of the data point. | Temperature, Humidity |
| Tag Type | Choose between Device Tag or Virtual Tag. | Device Tag |
| Function Code | The Modbus function code for reading. | 03 |
| Address | The specific register address of the data point. | 0, 1 |
| Data Type | The data format of the register. | short (int16) |
| R/W Permission | Select Read Only or Read & Write. | Read Only |
Click Save at the bottom, and then click Publish at the top right to start data collection.
Tip: You can check the Status to verify if the Temperature and Humidity tags aresuccessfully read values before proceeding to the Modbus configuration.
This is the core step where we expose our internal tags to the Modbus network.
Go to【Data Forwarding】.
Click the【+Create】 button at the top, select【Modbus TCP Slave】, and click【Save】.
You will enter the Modbus TCP Configuration page. Enable Modbus TCP Configuration and configure the Basic Settings:
| Parameter | Description & Action | |
|---|---|---|
| Modbus TCP Slave Configuration | Switch for Modbus TCP slave configuration. Default: Off (disabled). When enabled, cloud service configuration becomes available. | Off (disabled), On (enabled) |
| Port Number | The TCP port number on which the Modbus TCP server listens. Required. Range: 1-65535. | 502 (standard port) |
| 16-bit Integer Byte Order | Byte order for 16-bit integers. Default: AB. Required. Options: AB (big-endian), BA (little-endian). | AB |
| 32-bit Integer Byte Order | Byte order for 32-bit integers. Default: ABCD. Required. Options: ABCD (big-endian), CDAB, BADC, DCBA (little-endian). | ABCD |
| 32-bit Float Byte Order | Byte order for 32-bit floating point values. Default: ABCD. Required. Options: ABCD (big-endian), CDAB, BADC, DCBA (little-endian). | ABCD |
| 64-bit Integer Byte Order | Byte order for 64-bit integers. Default: ABCDEFGH. Required. Options: ABCDEFGH (big-endian), GHEFCDAB (little-endian), etc., depending on system support. | ABCDEFGH |
| Maximum Connections | Maximum number of concurrent Modbus TCP client connections. Required. Range: 1-32. | 10 |
| Mapped Value Settings | Mapped value settings. Default option: Data Operation Value. When enabled, the system transforms data according to the device point configuration in Data Collection and forwards the transformed data by default. Currently only the Data Operation Value option is available. | Data Operation Value (default option) |
After completing the basic settings, you need to add a slave and map the tags created during data collection to specific register addresses under this slave.
Before you start mapping, please review the following planning principles:
Address Continuity: To minimize reads from your SCADA, map tags that are polled together to consecutive register addresses. For example: Temperature → 40001, Humidity → 40002.
Data Type Footprint: An int16 consumes 1 register. A float32 consumes 2 consecutive registers (e.g., 40001-40002). A string consumes multiple registers by byte. Plan your address space to avoid overlaps.
Function Code Selection: Most SCADA systems use 03 Holding Register for analog values. 04 Input Register is read-only and suitable for device status. 01/02 are for boolean values.
Naming Convention: Use meaningful names for slaves and mapping tables (e.g., Slave_SCADA_Room1) for easier maintenance.
In the "Modbus TCP Slave List" section, click 【Add Slave】.
Configure the following parameters:
| Parameter | Description | Example |
|---|---|---|
| Mapping Table Name | A unique, identifiable name for this slave. Required. | Slave_For_SCADA |
| Slave Address | The Modbus unit identifier (Slave ID / Unit ID). The upper-level system must specify this address when reading data. Required. Range: 1-247. No default; must be filled. | 1 |
After adding the slave, you need to add tag mappings for this slave. The upper-level system (e.g., Modbus Slave) does not understand internal tag names like "Temperature"; it only recognizes standard Modbus register addresses (e.g., 40001).The system supports two methods: Add Mapping (single) and Batch Add Mapping (bulk creation).
Use this method to map tags one by one.
In the row of the newly created slave, click the 【Add】 button on the right.
Fill in the mapping parameters according to the table below, then click 【Save】 :
| Parameter | Description | Example |
|---|---|---|
| Device | Select the southbound device from which the data originates. Required. Choose from the dropdown. | Sensor1 |
| Tag | Select the specific data tag to map. Required. After selection, R/W Permission and Original Data Type are automatically displayed. R/W Permission Note: If Read & Write is displayed, the upper-level system (e.g., Modbus Slave) can read the value and also write to modify the tag value on the gateway (i.e., write-back). If Read Only is displayed, the upper-level system can only read; write operations will have no effect. | Temperature |
| Mapped Data Type | Determines the data type exposed to the upper-level system via the Modbus register. Required. Should match or be compatible with the original data type. | int16 |
| Initial Mapping Function Code | Determines which Modbus function code the upper-level system uses to access this register. Required.- 03 (Holding Register): Most common; used for reading/writing 2-byte data.- 04 (Input Register): Read-only; used for reading 2-byte data.- 01 (Coil): Used for reading/writing 1-bit (boolean) data.- 02 (Discrete Input): Read-only; used for reading 1-bit (boolean) data. | 03 |
| Initial Mapped Address | The starting Modbus logical register address (e.g., 0, 1, 100) to which you want to map this tag. Required. Range: 1-65535. No default. Note: This address is the offset relative to the function code. | 1 |
| Mapped Address (Auto-calculated) | The final Modbus address automatically calculated by the system based on the "Initial Mapping Function Code" and "Initial Mapped Address". This field is for confirmation and cannot be edited. | If function code is 03 and initial address is 1 , this field shows 40001 |
Use this method to map multiple tags from the same device at once, saving significant configuration time.
In the row of the newly created slave, click the 【Batch Add Mapping】 button.
In the pop-up window, configure the following:
| Parameter | Description | Example |
|---|---|---|
| Initial Mapping Function Code | Select the Modbus function code for all tags in this batch. Required. The system will only display tags from the selected device that support this function code. | 03 (Holding Register) |
| Initial Mapped Address | The starting logical register address for the first tag in the batch. Required. Range: 1-65535. | 1 |
| Device | Select the southbound device whose tags you want to map. Required. | Sensor1 |
After selecting the device, the table below will automatically display all tags from that device that match the selected function code. Check the boxes next to the tags you want to map (multiple selection allowed).
The system will automatically calculate the Mapped Address for each selected tag based on the starting address and the data type size. For example, if you select 3 tags starting from address 1, the mapped addresses will display as 40001 ~ 40004 (the exact range depends on the number and data types of the selected tags).
Click 【Save】 to complete the batch mapping.
Repeat steps 5.2.1 and 5.2.2 to create all required slaves and complete the mapping configuration for all tags you need to forward (e.g., Humidity).
All configurations take effect immediately upon saving; no need to click the 【Publish】 button.
Now, let's test if our gateway is successfully working as a Modbus TCP Slave.
Open the Modbus Slave software on your PC.
Click Connection > Connect on the menu bar.
In the pop-up window, configure the following parameters:
Connection Type: Select Modbus TCP/IP
IP Address: Enter the gateway's IP address (e.g., 192.168.0.1)
Port: Enter 502 (or the port number you configured in Basic Settings)
Click OK
Click Setup > Slave Definition on the menu bar, and configure the following parameters:
Slave ID: Enter the slave address you configured (e.g., 1)
Function: Select 03 Holding Register (4x)
Address: Enter 1 (corresponding to mapped address 40001)
Quantity: Enter the number of registers to read (e.g., 1 for Temperature)
Click OK
In the Modbus Slave main window, you should see real-time data displayed at addresses 40001. If the displayed values match the values collected from the southbound device, your Modbus TCP Slave data forwarding is successful.
Testing Write-Back Function (Only for Read & Write points).If a mapped point shows Read & Write in the Mapping Table, you can use Modbus Slave to write a value to the gateway, and the gateway will write this value back to the corresponding southbound device.
In Modbus Slave , locate the register address you want to write to (e.g., 40001).
Double-click the Value cell for that address.
Enter a new value in the pop-up window and click OK.
Observe whether the value changes. If it updates successfully, the write-back function is working. If the value does not change or reverts to the original value, check:
Whether the point's R/W Permission is Read & Write (if Read Only, write-back is not supported).
Whether the southbound device supports write operations.
Debugging Workflow (Check in this order)1. Network Layer: From your SCADA/upper computer, run ping [gateway IP address] in CMD/Terminal.- Fails? Check cable connections, IP address configuration, and whether your firewall allows the Modbus TCP port you configured.2. Service Layer: Use the Modbus Slave software to try connecting to the gateway.- Timeout? Check whether the Modbus TCP Slave Configuration switch on the gateway is enabled and whether the port number matches your configuration (default 502).3. Data Layer: Connected but reads 0 or error values?- a. Go back to the gateway Web UI → Data Collection. Check if the Tag you mapped has live, updating values.- b. If the Tag is fine, check if the Slave ID in your configuration matches the one in Modbus Slave.- c. Check the Mapped Address: The offset address you configured (e.g., 1) maps to Modbus address 40001. Does the address in Modbus Slave match?
| Issue / Phenomenon | Possible Cause | Solution |
|---|---|---|
| Modbus Slave cannot connect to the gateway | PC and gateway are not on the same network subnet. | Ping the gateway's IP address from your PC to verify network connectivity. Check if Windows Firewall is blocking the Modbus TCP port you configured. |
| Modbus Slave connects successfully, but values are 0 or frozen | Southbound collection failed, so the tag has no data. | Go to Data Collection to verify that the Modbus device is online and data is updating normally. |
| Modbus Slave reports "Timeout" | Incorrect Slave ID or register address configuration. | Check that the Slave ID in Modbus Slave matches the slave address configured in the gateway. Verify that the register address mapping is correct. |
| Modbus Slave reads data successfully for some addresses but reports errors or incorrect values for others | The Quantity (number of registers to read) in Modbus Slave cuts across non-continuous mapping ranges. For example, if your mappings occupy addresses 1-2, 3, 4-5 (three discontinuous segments), setting Quantity to 4 attempts to read across segment boundaries, causing errors. | The Quantity value must fully cover a set of continuous mapped addresses without truncation. Valid quantities in the above example: 2 (covers 1-2 only), 3 (covers 1-3), or 5 (covers 1-5). Invalid quantities: 1 (truncates 1-2) or 4 (cuts across 1-2 and 3 incorrectly). Ensure Quantity aligns exactly with the start and end of your mapping segments. |
| After writing a new value in Modbus Slave, the value does not change or reverts to the original value | The R/W Permission of this mapped point is Read Only, which does not support write-back. | Go to Data Forwarding > Modbus Mapping Table to check the R/W permission of this point. Only points marked Read & Write support write-back. |
| A point shows Read & Write in Data Collection, but appears as Read Only in the Mapping Table | The original data type of this point is RAW-DATA, STRING, or BCD. According to system rules, these three data types are forced to read-only when forwarded. | This is normal system behavior, not a configuration error. The three data types mentioned above are defaulted and forced to read-only during forwarding. No action is required. |
| When configuring a mapping, the "Mapped Data Type" dropdown only shows STRING, with no other types available | The original data type of this point is RAW-DATA, STRING, or BCD. According to system rules, these three types can only be converted to STRING when forwarded. | This is normal system behavior, not a configuration error. The system automatically restricts the available options. Simply use the default selection. |