BASgatewayLX (Hereinafter referred to as LX) supports CSV configuration file. There are decent documents about the format and dozens of configuration samples for vary devices on their website. The convert tool we provided could convert the CSV file to JSON file which could be imported in BACRounter’s WebUI to create a Modbus slave station.
Though LX claims the object name should be unique, but the accessory “Profile Checker” does not check duplicated object name. We found a lots duplicated object names in the samples. So we decided to disable object with duplicated name in converting.
Some CSV files have characters out of UTF8 code page, we guess they are ISO-8859-1 encoding. So if we fail to decode CSV by UTF8, we fall back to ISO-8859-1.
LX supports maximum 64 bytes of object name and description (With ISO-8859-1 encoding?). BACRouter supports 64 bytes too, but with UTF8 encoding. There has possibility that 64 bytes in ISO-8859-1 is larger than 64 bytes when encoding as UTF8. We will tail-cut too long name and description and promote to user.
BACRouter doesn’t allow 2 output objects mapped to overlapped Modbus address, but LX seems to allow it. We will disable the conflicted object in converting.
LX defines register order for every 32 bits data, but BACRouter has to set unitary byte order for all objects. If the consistent byte order definitions are found when converting, the previous definition will be accepted, the conflict will be promoted to user.
BACRouter has object instance range of 0~999 for every slave, but LX seems no limitation. If instance larger than 999 is found, the object will be auto assigned a new instance.
From firmware v4.x，Offline configuration had been introduced. Now user could configure a BACRouter without device on hand, then export configuration to a file. When commissioning on the field, user just need to import previously exported file, “Save&Reboot” to take effect the configuration.
From v4.04，The object definitions for Modbus gateway could be import/export as CSV format. User could effectively setup object to Modbus address mapping In batches with Excel/WPS/Libreoffice, then import it to WebUI for detailed modify.
This type of configuration file keeps all settings in BACRouter. If the firmware version of exporting one is same to importing one, WebUI should not complain of the configuration file.
Modbus Master Configuration File
This type of configuration file keeps setting under the scope of Modbus master. When importing it, collision detecting logic based on current mapping mode will check every enabled slave in this master, if collision is found, the slave will be disabled.
If the master is RTU/ASCII type, it may also be disabled if there are contention for RS485 port.
With these problem, WebUI will prompt user to re-check configuration.
Modbus Slave Configuration File
This type of configuration file keeps setting under the scope of Modbus slave. When importing it, if collision detecting logic based on current mapping mode found problem, the slave will be disabled.
It is allowed to import TCP salve configuration file in RTU/ASCII master, and vice versa, but the slave may be disabled if Modbus parameter setting do not work.
With these problem, WebUI will prompt user to re-check configuration.
From firmware version 4.x, BACRouter has builtin Modbus gateway functionality. This article will try to explain the underlying mechanism.
BACRouter will periodically read point’s value and cache it. “Update interval” defines how often BACRouter update the value.
To improve performance, BACRouter will read as more as possible data in one transcation. In Modbus standard, at most 2000 bits (coil or discrete) or 125 registers (input or holding register) could be read in one request, but specific Modbus slave device may only support a lower value. In BACRouter’s WebUI, there is a Modbus parameter edit dialog in “Slave Settings”, “Multiply read bits” and “Multiply read registers” parameters define the ability of the slave device.
BACRouter will not segment reading of single point even the “Multiply read registers” is less than registers used by the point.
Usually the data we care for has discontinuous Modbus address, for example, We only care for coils on address 1 and 2000, though we could read coil data from address 1 to 2000 in one request and skip returned data from address 2 to 1999, sending two requests independently for coil on address 1 and coil on address 2000 maybe more efficient. “Bits skipped” and “Registers skipped” parameter define how many unused data units between 2 cared data units are allowed to be skipped. As previous example, if “Bits skipped” is set to 1998, the BACRouter will try to read coil 1 and 2000 in single request. If “Bits skipped” is set to 1997, then BACRouter will read Coil 1 first, then Coil 2000, because bits skipped is 1998 and is greater than the setting of 1997.
On the WebUI page for slave, the “Read Group” button will show how the BACRouter will group the reading and test it. User should pay special attention on server exception of “Illegal data address”.
BACRouter will not combine multiple writing demand into one writing request. It always queue write request immediately after receiving command.
For writing single data unit, there are two Modbus function codes available. For example, function code 5 is writing single coil, function code 15 is writing multiple coils but the quantity of coil to write could be assigned to 1. Some devices only support one of them. “Coil write singly” parameter will specify which function code is used.
In the same way, “Register write singly” is applied to register writing. If any BACnet output object maps to multiple holding registers, it implies the slave device support function code 16 for write multiple registers, “Register write singly” will be automatically disabled, function code 16 will be used for writing any register.
If any read/write request failed, BACRouter will retry it, when the continuous fail count reachs 3, BACRouter will regard the slave device as offline. In offline state, BACRouter will retry the request every “Offline update interval”.
The BACnet side reaction for offline event will be described later.
Modbus Serial Bus
BACRouter supports serial slave devices with different baudrate, parity, RTU/ASCII mode on same RS485 bus. Before sending request, BACRouter will change it serial port parameter based on slave device’s settings.
It should be safe to have 2 devices with same slave address but different baudrate or RTU/ASCII mode, but preventing collision based on different parity might not be enough, because some devices do not examine parity error.
Single Device Mapping Mode
If VBUS network port is not enabled, BACRouter will work in single device mapping mode, every Modbus slave device will be mapped into exclusive object instance space of 1000 in the only BACnet device defined in “Application Settings”.
The actual BACnet object name will be organized as “master_name|slave_name|object_name”, The “|” is name delimiter which could be selected from dozen of characters by user.
As recommended by standard, BACRouter will create one StructuredView object for each slave device.
When the slave device turn to offline in this mode, all points’ reliability will be set to “COMMUNICATION_FAILURE”, if slave device is back to online, upon updating of point value, the point’s reliability will be set back to “NO_FAULT_DETECTED”.
Virtual Device Mapping Mode
If VBUS network port is enabled. Each slave device will be mapped to a virtual BACnet device on VBUS network. The MAC address will start from 1.
In this mode, each slave shall has a unique “Device instance”. The BACnet device name of the slave will be “master_name|slave_name”, The delimiter “|” is select-able.
When the slave device turn to offline in this mode, as recommended by standard, the virtual BACnet device will stop sending/receiving any packet to simulate offline state. if slave device is back to online, after updating all point’s value, the virtual BACnet device will quite offline state.
Slave Device’s Status
For every slave device, BACRouter will create 3 objects in gateway device, one object is Binary_Input with name of “online”, which represents online/offline status of slave device. another object is Analog_Input with name of “update_delay”, which is recently average update time delayed over “”Update interval”, the last one is Analog_Input with name of “fail_rate”, which count a relative long time fail rate on Modbus side.
Those objects’ name have prefix of “master_name|slave_name|comm|”, where “|” is select-able delimiter.
Object Instance Assignment
Object Instance is defined for every object. When the editor dialog for a object is submitted and the object is enabled, the object instance claimed by the object will be assigned, if that assigning fail, a automatically selected instance will be used.
AV/BV/MV is behaving same as AI/BI/MI, except that when AV/BV/MV is mapped to writable Modbus address (0X or 4X), the present value of the object is writable, the writing will be forwarded to Modbus side (See below 2 exceptions).
Exception 1: If AV is mapped to holding register, its data type is customized, but the binding script doesn’t support output, that AV will be read only.
Exception 2: If AV is mapped to multiple holding registers, but the”Register write singly” option is enabled, that implies output will not be supported, so the AV will be read only.
The value of output object is still being polled from Modbus side and set to object’s Relinguish_Default property. If the value read back does not match last value written, BACRouter will set the reliability of that object to “UNRELIABLE_OTHER”, and BACRouter will queue another write after a certain time. When “Tolerate unmatch” option is enabled, If the value read back does not match last value written, the reliability of that object keeps unchanged, and BACRouter will re-write the value on “Offline update interval”. (Update for v4.34)
Because of above verifying mechanism, the BACRouter will prevent defining two output objects with overlaping Modbus writable address.
NaN For Float And Double
NaN is a special value defined by IEEE-754, BACRouter does not accept NaN (Infinite is still valid for BACRouter).
When a point is defined as Float and Double, but NaN is read from slave, BACRouter will set the reliability to “UNRELIABLE_OTHER”.
Unsupported value for script
When a analog object is customized, but the Modbus to BACnet conversion reports unsupported value from the script, that object’s reliability will be set to “UNRELIABLE_OTHER”.
For a Analog Output object, when the BACnet to Modbus conversion reports unsupported value from the script, the object’s reliability will be set to “PROCESS_ERROR”
For a Analog Value object, when the BACnet to Modbus conversion reports unsupported value from the script, that output attempt will be dropped, the object’s reliability will be unchanged.
135-2016br-2: Accept writes of NULL to non-commendable properties.
MSTP driver reports new packets to upper layer immediately instead of a 20ms period.
Modbus script: context add point name and point description.
Modbus supports multistate objects on 2 registers.
Modbus support analog objects on part of register.
Modbus support customized analog objects on up to 24 registers.
Modus add “Tolerate unmatch” option when mapping output object. When the read back value does not match last output value, “Reliability” property keeps unchanged, Output value will be re-written on “Offline update interval”.
Modbus driver remove some over-skill optimizations: merge multiple write requests on same register to single write; cache analog conversion from Modbus to BACnet.
TCP slave report server exception may cause segment fault.
WebUI: On the Modbus slave setting page, users often incorrectly click “Edit” or “Copy” button. “Edit” button is removed, Point editing popup now could be fired by click object name or property.
A long time BACnet bug is found: Default writing priority is not set when priority is ignored in the APDU.
Modbus: BV/BO mapping to bit in holding register should refer to “Write register singly” instead of “Write coil singly” when choosing write function code.
Modbus: Extends TCP slave address(id) range from 1~247 to 0~255
Modbus bug introduced by v4.23: Offline device may increase fail-rate to online device.
WebUI: More detailed Modbus fail messages will be reported on “Read Test” and “Write Test”
WebUI: UI optimized for Modbus parameter editing.
WebUI bug introduced by v4.25: Modbus “Write Test” should not be enabled when mapping to read-only Modbus address, or BACnet object type is input.
WebUI: promote user to notice conflict of “Register write singly” setting when “Write Test” writing to multiple registers.
WebUI: enable drag&drop to move point in slave settings
WebUI: enable drag&drop to move state when editing multi-state object.
WebUI: When exporting something to a file, popup a dialog to modify file name.
WebUI bugfix: Modbus slave “Reset” button will not rollback modification of “Batch Data Address”.
WebUI: Modbus slave adds new “Reorder Instance” function to reorder object instance of points.
Total limitation for capture buffer size is changed from 16M to 12M.
WebUI bugfix: Modbus slave’s “Batch Conversion” should skip customized data type.
WebUI: Exported Modbus master/slave configuration should carry referenced script. When importing configuration, script in it will be imported too.
BIP udp port’s low limitation is lowered down to 1024.
Many bugfixs and improvements for script:
When there is a OOM, all scripts will be temporally unloaded one by one, memory reclaimed for each script will be logged. The maximum reclaimed one will be regards as leaking memory and be forcedly completely unloaded (even the byte code will be dropped), other scripts will be reloaded to run again.
WebUI adds “Runtime Info” for script to help finding memory leaking.
Script importing will go to edit mode.
New and imported script can replace old script with same name after confirmation.
We always get reports from clients about weird Modbus devices which can not be linearly converted from Modbus value to float used by BACnet analog object. so we introduce Lua script to extend BACRouter’s ability to mapping such devices.
User could import/create/edit Lua script by the WebUI. Thanking to the WASM support in modern Web browsers, User could run and debug Lua script by the WebUI, even though the Modbus device is offline. The error will be caught and promoted to user, the Lua print function will output to web browser’s console.
As a result, BACRouter drops support for IE, but Edge will still work.
From v4.23, we abstract Modbus rs485 driver to support common rs485 devices in the future, but that may introduced bugs in Modbus Gateway function for serial devices (MSTP was not affected, because it’s different driver). This release fix some of them:
Offline devices may cause segment fault.
Device responding time for the WebUI raw test result is inaccurate.
Bugfix: Buffer overflow when Modbus module maps Ananlog_Output to multiple registers.
Bugfix: Modbus TCP bug would be triggered when there are more than one slaves defined under a TCP master and the “Keepalive” is 0.
WebUI removes support for IE10.
Historical data of runtime info could be reset.
MS/TP runtime info introduces colored mac table.
Support for BACRouter-S (single ms/tp port router) is integrated.
Modbus Gateway CSV file importing:
1. There is a bug ignoring Modbus data unit type from 2th point.
2. Mulltistate point without states defined need not to be forcedly disabled.
From v3.00, we added a integrity check: A relayed NPDU with 255 hop count is regards as malformed and will be dropped. The log will show: [WARN]npdu_decode_pci: hop count should not be 255 for relayed npdu
Dropping such NPDU may causes interoperability problem with other routers. Though the hop count is incorrect here, BTL test does not completely cover it, So there are still BTL passed routers have such bug.
Modbus: MultiState objects could be mapped from bit range in a register.
There is a bug on rescue upgrade that old configuration is not deleted which may prevent WebUI from loading. If old version WebUI could not be loaded because of invalid configuration, please rescue upgrade to this version twice, first time it will upgrade firmware, the second time it will delete old configuration.
A bug on Modbus virtual device mode is fixed which cause malfunction when virtual devices are more than 5.
A WebUI bug when Modbus slave number overflowing limitation is fixed.
The limiations of Modbus master and slave are changed from 100 to 128.
A WebUI bug when disabling “Packet capture mapping” is fixed.
More name delimiter characters are added. Internal object names are modified to avoid collision with new name delimiter characters.
Reject-Message-To-Network should be unicasted to compliant to BTL.
TTL of registered foreign device should plus 30 seconds to compliant to BTL.
Confirmed service sent to broadcast address should be dropped on application layer to compliant to BTL
BBMD should drop unicasted forwarded npdu from local subnet with same udp port.
Bug on multiple BBMD detection when checking existence of entry in BDT with different udp port is fixed.
WebUI adds network settings page, which will show routing table.
A bug on slave proxy is fixed: when there is a unicasted who-is send to slave device, the device instance range carried by the service should be respected, same as broadcasted one.
MS/TP duplicate detection algorithm which is learned from duplicating of JCI FEC2611 and IOM3731 is added.
MS/TP duplicated MAC detection is implemented. Duplicated MAC will be shown by Red color in “Recently active other devices”. Because of complexity of behavior on duplicating situation, the detection is inaccurate and for reference only.
A potential bug introduced from 3.0 in the low level MS/TP state machine is fixed.
Based testing and clients’ feedback, many(maybe most) devices does not obey the MS/TP receive frame finite state machine described in BACnet standard when they encounter error. Our proprietary “Timeout Interrupt” feature will cause trouble or degrade performance in this situation. So “Timeout Interrupt” feature is removed.
More statistics is added to MS/TP runtime information page.
WebUI bug on BIP’s Foreign Device Mode introduced from 3.08 is fixed.
Fix mstp calculation bug on time used for invalid packet.
Fix bug on mstp slave proxy introduced by 3.08
Some minor WebUI improvements.
The config file format is changed much between 2.x and 3.x, so from 3.00 to 3.09, when upgrade firmware, the upgrading script will install new config file. This version add a “Keep config” option when upgrade firmware. If config file have something wrong, the WebUI will popup a warning when it is opened.
Fixs bug introduced in 3.08 when fetch mstp runtime info.
Some minor WebUi improvements.
Bugfix: 1 hop broadcast distribution is optional for BBMD, From version 3.00, BACRouter force other BBMDs to use 1 hop distribution if cross-network broadcast support is enabled. It’s incorrect behavior and fixed in this version.
BDT editing UI is improved. When submitting, BDT entries will be checked to detect possible misconfigure. The checking is also taken when receiving Write_BDT BVLL message.
If multiple BBMD support is not enabled, when receiving forwarded npdu from BBMD not present in local BDT, the npdu will be dropped and logged. It will help distinguishing configure problem of BBMD on most situation. “Report multiple BBMD” function in last verion is covered by this function, so it’s removed.
The filename of downloaded config is set as IP_Version.json, for example: 192.168.100.1_3.08.json
Config uploaded from file will be edited in WebUI before saving to eliminate any potential incompatibility.
Ethernet is disabled by default. If BIP and Ethernet are enabled at the same time, a warning of possible circular route will be promoted.
The default capture size increases to 4M.
Capture control function is mapped to BACnet. Each datalink port has its “Capture buf_size” and “Capture command” Multi_State_Value. “Capture buf_size” could be set between “64K” to “16M”. “Capture command” could be set between “Stop&Clean”, “Start”, “Stop”.
Password for root could be modified from WebUI now.
BACRouter verifies other router’s live by query its routing table with Initialize-Routing-Table message. But addendum 135-2012AL removed the enforced supporting of Initialize-Routing-Table from router. So in this version BACRouter also monitors Reject-Message-To-Network message that could only be sent by router.
BIP BVLL header of forwarded npdu is 6 bytes larger than other npdu, so there was potential bug on packet length verification that is fixed on this release.
Minor bugfixs for UI
“Download config” and “Upload config” are added to “System setting”
Add Packet capture feature：
Supported on all ports(Ethernet, BIP, MSTP).
Because Wireshark could not decode MSTP extended frames, MSTP extended frames are converted to traditional data frames. Fortunately, Wireshark doesn’t complain about overflowed data length.
MSTP packet could be downloaded as “Interval format”. it could be used to show exact idle time before packet by selecting “Seconds Since Previous Captured Pakcet” as “Time Display Format” in Wireshark. It is very helpful to analyze timing and performance problem.
MSTP support real time analysis for max master and show it on run time info, if the value is not matched to the setting, “unmatched” is showed after it.
MSTP support sniffer mode. it could analyze and record data without interfering the bus.
The WebUI of MSTP port add options for basic mode and extend mode.
The timeout settings for MSTP are changed from Integer to Float.
MSTP port’s slave proxy is only support broadcasted Who-Is in previous version. Now it support unicast too.
MSTP port’s slave proxy send unicasted I-AM instead of broadcasted one in previous version.
There is a bug in previous version that Who-Is packet readed by MSTP slave proxy module bypass source address routing verify. it’s fixed this time.
BBMD module add option to log error when multiple BBMDs are found in local lan.
Modify feature introduced by version 2.17. “Accept unmatched destination IP” option is provided, if it is selected, only warning message will be logged, else error message will be be logged and the packet will be dropped.
Process 0 in unconfirmed COV notification service is reserved for unsubscribed notificationCOV. Not longer reports error when can not find matched process for 0.
In previous version, when BACRouter receive Original-broadcast BVLL from unicast address or Original-unicast BVLL from broadcast address, it would print error message then drop it. A customer reported that Johnson Controls’ CCT sends Original-broadcast BVLL to unicast address, so now we only print warning message.
From version 2.0.8, only proprietary network layer messages would be relayed. Now all unknown network layer messages will be relayed.
Redirect URL from “/” to “/?” to support Edge web browser (avoid keep asking authorization)
MSTP: Fix bug in standard state machine which would cause passing token to self when duplicated token is found.
MSTP: With standard state machine device in sole master mode would send max_info_frames * Npoll frames after polling one master. A more reasonable behavior is implemented that device send max_info_frames * Npoll frames after finish polling all masters.
Fixed bug introduced from 2.0, it should not wait reply when it send expecting reply request to mac address 255 on MSTP.
Potential bug (barely) may be triggered if MSTP auto mac and baudrate forcing are enabled together.
Optimizing route entry protection: Deletion from route hop will bypass protection.
Support devices utilizing 6.5.3 methods 1 and 4 for establishing the address of a BACnet router for a particular DNET.
This update help building up routing table quickly in large BACnet inter-network.
When BACRouter startups, it broadcasts out Who_Is_Router_To_Network without network number specified to learn routing info from other routers.
When Who_Is_Router_To_Network/Router_Busy_To_Network/Router_Available_To_Network without network number specified is received, BACRouter reports network number up to 1120 instead of 112 in previous version.
Bugfix: ReadRange on property_list should not return object_identifier; object_name; object_type.
Delay 1 second for sending Network_Number_Is when router startup, because if router is a BIP foreign device, the foreign device registering have not completed yet.
Protect route entry 60 seconds from last activity. Avoid broadcast storm in circular routing path.
Bugfix: Vendor proprietary network message should be correctly relayed.
When relay Reject-Message-To-Network with reason 4(Too long), use unicast address instead of broadcast address.
Relax daemon’s max_apdu_retries to 10, in accord with WebUI.
Compliant to BACnet Router and BBMD device profile.
Try to purge invalid route entry if no reply is received for Who_Is_Router_To_Network or Initializing_Routing_Table. This feature helps to rescue from mess network configuration.
Avoid sending too many I_Am_Router_To_Network with circular routing path.
Reduce memory consumption in complicated inter-network.
Avoid BBMD broadcast storm. If Forwarded-NPDU is received from broadcast address, do not re-broadcast it.
When relay Reject-Message-To-Network with reason 1/2/4, use broadcast address.
Discard Reject-Message-To-Network with incorrect route info.
Check source net of incoming NPDU.(Trickily handle Initializing-Routing-Table)
Bug: global broadcasted initializing-routing-table should be executed.
Bug: WebUI BIP mode select should not be applied without submiting.
Limit number of route entry in runtime info page to avoid request failure in very large internetwork.
Fix WebUI Bug for verifying BDT.
Save configuration and restart when receive reinitialize-device service request.
BIP BBMD NAT mode support udp port modifying.
BIP BBMD NAT mode do not listen to local net broadcast address and not send broadcast to local net.
BIP foreign device mode do not listen to local net broadcast address.
Regards device sent Who-Is-Router-To-Network has no route to that network.(Delete that route entry from route table)
When Initializing-Routing-Table request modify network number of route port, I-Am-Route-To-Network is sent to report new network number.
Fix bug introduced by ver2.0 for saving new BDT modified by BVLL Write-Broadcast-Distribution-Table message.
Add upgrade entry “http://ip/app/upgrade for rescue.