How to send "login" string via Modbus?

Attempting to bring my boiler into my home automation suite but failing at the Modbus part of it. What I have is a Honeywell Sola controller which requires a login string of "sola" to be entered before any coils or registers can be written. The link to the document that I've been working off of is:

https://customer.honeywell.com/resources/Techlit/TechLitDocuments/65-0000s/65-0310.pdf

It looks like the address is hex 00B1, decimal 0177. Using QModMaster to attempt writing, but getting an illegal function error. Can anyone point me in the right direction?

Thanks in advance...I am a real noob to Modbus.
 
Hello and good day,

I was reading your post, and had look on the web research and find a operation manual from OEM;

Did you first have a look on this manual ?
If not i suggest you to study the OEM manual by this way you will have better picture on your issue and how to resolve it.

Here is the link:
https://www.nexinstrument.com > assets > images > 27122016honeywell > pdf

Hoping that it will be a support,
Do not hesitate to write us what is returning from your issue,

Will be glad to resolve your issue and everybody can have best practice from it,

Regards,
James
 
What exactly is the Modbus problem?

Is the problem reading values from the SOLA where you get an error or can't connect or get Time out?

Or can you successfully read data via Modbus, but not write data to the SOLA?
 
I am able to connect and read some registers, but am unable to change any registers or coils until I send the login string to the controller. Just can't seem to be able to figure it out.
 
I have no idea what a SOLA boiler is, but I can apply some Modbus experience to try and point you in the right direction, but I'm not sure your Modbus Master will execute the Function Code 10 (decimal) (0x16) properly.

In various places in the Honeywell document, register 0177 is noted as both a log-in password and as necessary to write register values, so I suspect that you are correct that writing the password to 0177 will allow you to write other values (in separate, later transactions; after writing a valid password).

The explanations are on pages 51, with the critical statements on page 52, below:

------------------------- pg 51 --------------------------
Function Codes

Some holding registers contain variable length data in them, e.g., register 186 (OS number) that extend common Modbus access for holding registers. Only a single register address is assigned to these parameters even though they may contain more than two bytes (16-bits) of data. These registers MUST be accessed individually ONLY in order that no confusion exists about parameter boundaries (note j).

Note j.
Standard Modbus protocol doesn’t support the concept of variable length data. The SOLA Modbus interface varies from the (Modbus) protocol in that it supports a single register definition for text data. These special registers must be accessed exclusively by themselves in order for them to be supported.

Register Writes
Writing to any data register may require an access level password before it can be changed (written) by the Modbus master. For those data registers requiring access security a password matching the one contained in the SOLA must be provided before the SOLA allows the data to be changed.

A valid password login remains in effect for 10 minutes before another login is required (SOLA timeout for password login).

See User Interface Data Attribute Table section for more information regarding how access security is determined.

Two Modbus registers are defined to manage the register data access login:
• (0x00B1) Password
• (0x0013) Register Access Status

The Modbus master writes a password into the Password register to request write access privileges to the data registers. Even though this register is a holding register, and therefore, should normally only accept a 16-bit value, it accepts alphanumeric text up to 20 characters in length.

Due to this length change this register must be written individually and not as part of a group register write.

Results of the login are reported by the SOLA in the Register Access Status register. If the Modbus master writes the correct installer password, the status register indicates this result and all data with installer access level and below can be changed. If the Modbus master writes the correct OEM password, the status register indicates this result and all data with OEM access level and below can be changed.
------------------------- end pg 51 --------------------

------------------------- pg 52 --------------------
(Function Code) 06 (0x06) Write Single Register

This function is used to write data to a single register in the SOLA. The SOLA register address and 16-bit data value to write into the register are sent to the SOLA, and the SOLA returns an acknowledged response.

NOTE: This function (command) cannot be used for variable length text data registers.

16 (0x10) Write Multiple Registers

This function is used to write data into multiple SOLA registers with a single request. The SOLA registers must be located consecutively in the register map since only a base address is provided. The Modbus master provides the starting register address, the number of registers to write, the total number of bytes, followed by the actual data itself. The SOLA writes the data into each register and acknowledges the completion with a response echoing the number of registers written.

When writing text data to a register representing variable length text, the number of registers should be specified as one and the byte count be the number of bytes in the text data

------------------------- end pg 52 --------------------

The key statements for writing the password are:

1. Function Code 06 (0x06) (Write Single Register) cannot be used for variable length text data registers.

2. (Function Code) 16 (0x10) Write Multiple Registers is used to write data into multiple SOLA registers with a single request.

3. When writing text data to a register representing variable length text, the number of registers should be specified as one and the byte count be the number of bytes in the text data

That explanation still leaves some questions:

- Are the password characters conventional ASCII characters?

Speculation: I would start by making the assumption that yes, they're 8 bit, single byte ASCII characters

- what is the high order/low order for password characters?

It doesn't say. Test it. To test the high/low order, for the password SOLA, you can try the ASCII characters 0x53 0x4F 0x4C 0x41 in that order. And if that doesn't work, then try the reverse order, 0x41 0x4C 0x4F 0x53.

- Does a shorter-than-20-character password have to be packed with null characters to fill a 20 character password buffer?

Speculation - I don't know, you'll just have to experiment and keep track of which high/low byte order works and whether or not a shorter-than-20-character password is accepted without throwing an exception code if the password write FC is not packed with null characters to make a full 20 character password.

- will your Modbus Master's Function Code 16 (0x10) accept a number-of-registers value of one, but number-of-bytes that is more than the 2 bytes expected in a single Modbus register? In other words, for the password SOLA, will FC16 accept a number-of-registers value of 1, but a byte count of 4? I know for a fact, some won't because the master only asks for the number of registers and calculates the number of bytes by multiplying by 2 to get the number bytes. Number-of-bytes is not a user entry.

Speculation - I have no idea, it's never come up before so I've never tried it and I don't even have a means to test it, because as Honeywell admits, this does not meet standard Modbus convention (note j).

Test it, and please let us know what you find works or doesn't.
 
Hello and good day,

I was reading your post, and had look on the web research and find a operation manual from OEM;

Did you first have a look on this manual ?
If not i suggest you to study the OEM manual by this way you will have better picture on your issue and how to resolve it.

Here is the link:
https://www.nexinstrument.com > assets > images > 27122016honeywell > pdf

Hoping that it will be a support,
Do not hesitate to write us what is returning from your issue,

Will be glad to resolve your issue and everybody can have best practice from it,

Regards,
James

I'm unable to view that. Gives me a 403.....
 
Ah ok I see 403 is an error code message displayed ; right?

I dont know you should use mozilla firefox at least it get it .

James
I just downloaded that manual. Thank you. It appears that I need to set up the boiler control as master, even though there are no slaves. Unfortunately, I need to go out of town for a few days and won't have a chance to try it until Friday.
 
We've successfully interfaced our gateway products to several boilers that use the Honeywell SOLA controller. I believe you may need to write the entire password field (10 registers total) starting at Holding Register 178 (40178 - 40187). You may also want to try writing to the other password registers, starting at Holding Register 1281 (401281 - 401290), which are a duplicate of the 178 register (we use the 1281 registers). Note that the Honewell documentation uses a 0-based register address, so you need to add 1 to get the register number. The value for the first registers should be 0x736F, the second should be 0x6C61, and the rest should be 0.
 
Thank you jschulze for shedding the light of experience on the topic. Password is 0x736F 0x6C61 is ASCII for sola (all lower case), 0x534F 0x4C41 (SOLA in caps).

Questions
Are the remaining 16 characters are 0x00 (ASCII null) characters, not 0x3030 (the number, zero) characters?

Were you able to use a standard HMI Modbus master Function Code 16 or did you have custom generate the FC to get a byte count (20) that does not match the the register count (one)?
 
Thank you jschulze for shedding the light of experience on the topic. Password is 0x736F 0x6C61 is ASCII for sola (all lower case), 0x534F 0x4C41 (SOLA in caps).
The default password is "sola", however this can be changed on the SOLA controller, so confirm that you are sending the correct password as configured on your controller. Also, this password must be sent at least every 10 minutes, as the SOLA automatically logs you out every 10 minutes. You can monitor Holding Register 14 (40014) Register Access Status to see if write access in enabled at any time. A value of 0 means that no register writes are allowed.
Questions
Are the remaining 16 characters are 0x00 (ASCII null) characters, not 0x3030 (the number, zero) characters?
Sorry for the confusion, the remaining characters should be 0x00 (ASCII null).
Were you able to use a standard HMI Modbus master Function Code 16 or did you have custom generate the FC to get a byte count (20) that does not match the the register count (one)?
Yes, we use the standard Function Code 16 to write all of the registers in a single request. The register count needs to be 10 (and the byte count 20), since you are sending 10 registers. The Honeywell documentation is confusing on this regard, since if you look at register address 177 for the password, it states that the very next register at address 178 is the temperature units. However, for register addresses 1280 - 1289 it does show the whole block of 10 registers for the password. That is the main reason we write to Holding Registers 1281 - 1290 (addresses 1280 - 1289).
 
Thanks again for clarifying the character packing, the password timer and alternative addressing but I take my hat off for you for your explanation of how FC16 works as expected with a register count of 10 and a byte count of 20; Honeywell's description for FC16 just did not make sense to me.
 
We've successfully interfaced our gateway products to several boilers that use the Honeywell SOLA controller. I believe you may need to write the entire password field (10 registers total) starting at Holding Register 178 (40178 - 40187). You may also want to try writing to the other password registers, starting at Holding Register 1281 (401281 - 401290), which are a duplicate of the 178 register (we use the 1281 registers). Note that the Honewell documentation uses a 0-based register address, so you need to add 1 to get the register number. The value for the first registers should be 0x736F, the second should be 0x6C61, and the rest should be 0.
Thank you so much! I will certainly try this when I get back this weekend. One other thing I believe I need to do is disconnect the front panel display from the primary SOLA modbus port and connect my master in place. Or have you kept the displays and just used the second modbus connection?
 
I assume by front panel display, you're referring to the S7999D SOLA Operator Interface Display. If so, I believe you can keep this connected, as the display is designed to have a BAS connected to one its RS-485 ports and 1 or more SOLA controllers to the other RS-485 port. You should be able to access each SOLA controller by its unique Modbus slave address through the display.

Details can be found starting in the Wiring section of the Honeywell documentation here:
https://customer.honeywell.com/resources/Techlit/TechLitDocuments/65-0000s/65-0315.pdf
 
Top