First venture into MODBUS, how to send a password?

It seems you picked a fairly complicated system as your first foray into Modbus. It sounds like you have 3 Modbus devices in your system: the heat pump itself, the display, and the WiFi gateway. One of these devices must be the master and the other two are the slaves.

I recommend first determining which device is the master. I believe you've already removed the WiFi gateway and still see communications, so you just need to find out whether the master device is the display or the heat pump. The easiest way to do this is to monitor communications (using LED's or software on your PC) and powering off or removing one of the devices from the network. If there is still communications traffic, the device powered on and connected to the network is the master.

Now the problem:
Home Assistant is very likely a Modbus Master. You can only have one Modbus master on the bus. If you want to connect Home Assistant to a Modbus device, the typical way of doing this is to connect directly to the Modbus device (which must be a Modbus slave) without any other master on the bus (i.e. Home Assistant can be the only Modbus master on the RS-485 bus).

If the display is the master, then you could simply disconnect the display and connect Home Assistant to the heat pump. However, you would have to be alright with not having the display anymore and the WiFi gateway would not work unless you can configure Home Assistant to duplicate the messages that the display sent to the WiFi gateway.

Alternatively, you can connect a gateway to the system that supports "sniffing" the existing Modbus network. This gateway can listen to the communications between the display, heat pump, and WiFi gateway, extract the register values exchanged, and make them available to a separate RS-485 Modbus network. Now keep in mind, though, since the display is the master, you are limited to only being able to "sniff" the registers that the display is requesting.

ICC's Mirius gateway can be used for sniffing a Modbus RTU network and exposing the data to another Modbus RTU master:
http://www.iccdesigns.com/protocol-gateways/66-mirius.html
 
1. >I'm also a bit unsure how to read the data (e.g. 1013). Is it a holding register, input register or ?

The leading numeral in parentheses indicates whether the register is a holding register or an input register.
Leading numeral (4) is a Holding register, like (4)1013 or (4)01013
Leading numeral (3) is an Input register, like (3)1013, or (3)01013.

Some masters want the leading numeral defined, others do not, I can't recall whether Simply Modbus does or does not. Modscan assumes the (4) and wants the indexed decimal value.

The listed values are likely Holding registers because the column citing R/W, read or write is possible for Holding registers, whereas Input registers are Read Only.

One other note, there is a one-offset phenomenon, due to whether the register list starts at zero or starts at one.

Normally, decimal values are one-based, (4)0001, (4)0002, (4)0003, etc.
Normal hex values start at zero: 0000, 0001, 0002, 0003, etc. (and hex values do not use the leading numeral)

That table shows the decimal and hex values as identical, if hex 3F8 is zero based, then the equivalent value for Modscan (which uses one based decimal register addresses) would be (4)1017, not the (4)1016 shown on the table. You should be able to tell by whether the data values match up with the register address or whether they're offset by one.

2. The Simply Modbus Slave

Simply Modbus is the Master, issuing polls to the heat pump, which is the slave.
 
You might try connecting Simply Modbus to the 2nd RS-485 and see what the effect is. No telling how sophisticated the unit is, but it just might map Modbus to a separate memory for both RS-485 ports. Who knows?
 
Succss! (Or at least on my way to success)
I finally managed to get some data out!

By using a modbus slave software, I can get data out from device 1, which as I see it, is the Master.
I learned that by reading register H37, I can read what the unit id is (1).
If I read e.g. 1030 which is the current setpoint, I get 281 which is equivalent to 28.1 degrees celsius.

So I can now communicate with some of the registers on the the heater.

But as you also mentioned @jschulze, Home Assistant acts as a Master, so does the heater (Probably, not the display). I cannot have two masters, so I need to figure out how to solve that puzzle.

Also reading registers > 2000 gives an error in reading the register and an error on the heater. Don't quite understand that part yet.

But I'm on my way, at least

@David_2 It could be worth a try. Just a bit afraid of breaking something :oops:
 
By using a modbus slave software, I can get data out from device 1, which as I see it, is the Master.
I learned that by reading register H37, I can read what the unit id is (1).
If I read e.g. 1030 which is the current setpoint, I get 281 which is equivalent to 28.1 degrees celsius.

But as you also mentioned @jschulze, Home Assistant acts as a Master, so does the heater (Probably, not the display). I cannot have two masters, so I need to figure out how to solve that puzzle.
I think you might have this backwards. Reading a register is an action that only a master can perform. Also, only a slave has a slave address (unit id). Are you perhaps using Simply Modbus Master?

Did you disconnect the display to determine if the display or the heat pump is the master on the bus?

If you are indeed using Simply Modbus Slave, you've added two slaves to your network with the same address (both at address 1). This can cause communication issues between the display and the heat pump, since two devices would attempt to respond to the same request.
 
Top