Titan – Modbus TCP Slave

The Titan routers can be configured to behave as a Modbus TCP/RTU slave device. For example, using Modbus TCP protocol, it is possible to change the internal relays remotely (via 3G, Ethernet or WiFi) as well as consulting their statuses, the status of the digital input and sending/receiving SMS messages or sending emails via Modbus TCP.

Remember that relays can also be controlled remotely via AT commands, be these sent by SMS, 3G, Ethernet or WiFi. This can be configured using the menu “Other > Remote Console”.

Below we can find a table with the Modbus address for the Titan registers. The Modbus commands that are permitted are 0x03 to read and 0x10 to write.

 1  R  0 … 32635  Firmware version
 2  R  0 … 32635  Firmware subversion
 3  R/W  0, 1  Relay 1 (0 = relay open/1 = relay activated)
 4  R/W  0, 1  Relay 2 (0 = relay open/1 = relay activated)
 5  R  0, 1  Digital input status. 0 = input to GND, 1 = input not connected
 98  W  0 … 32635  Length of AT command to be executed
 99  R  0 … 32635  Length of AT command response
 100…354  W  ASCII  AT command text (in ASCII)
 500…754  R  ASCII  AT command response text (in ASCII)
 1000  R/W  0, 1  1 indicates a new SMS received. A PLC should write ‘1’ after reading the SMS
 1001  R  0 … 18  Length of cell number that sent the SMS
1002…1019  R  ASCII  Cell number that sent the SMS
1020  R  0 … 18  Length of SMS
1021…1180  R  ASCII  Text of SMS

AT Commands via Modbus TCP Protocol

Another interesting characteristic of the Titan routes is the option to execute AT commands via Modbus protocol. For example, if we have a PLC acting as a Master Modbus TCP, we can send an AT command via Modbus TCP protocol to the router in order to obtain information such as network coverage, or send an SMS, read a radio sensor (temperature, pulse counter, digital input or a 4/20mA input, etc.), read the time or reset the router.

The following pages will explain the process of sending AT commands via Modbus TCP.

Procedure for Sending AT Commands via Modbus TCP

The process is simple and the best way to understand it is using a practical example. For example, imagine we want to execute the command AT+CSQ to obtain the network coverage.

  • First we must write the AT command in ASCII code, using the registers 100 and onwards
 100  65  ASCII for letter: A
 101  84  ASCII for letter: T
 102  43  ASCII for character: +
 103  67  ASCII for letter: C
 104  83  ASCII for letter: S
 105  81  ASCII for letter: Q
  • The command AT+CSQ has six characters, therefore we must input in register 98 the value “6” for the command to be executed
 98  6 Size of command to be executed
  • Then we must check the command’s execution, which we can see in register 99. The value we are reading represents the length of the response. A value of 0 indicates there is no response (the execution is incomplete)
 99  28 Size of response to command
  • Finally, we must read the 28 registers where the response is contained (register 500 onwards)
 5000 65 A
501 84 T
502 43 +
503 67 C
504 83 S
505 81 Q
506 13 \r
507 13 \r
508 10 \n
509 43 +
510 67 C
511 83 S
512 81 Q
513 58 :
514 32 [space]
515 49 1
516 54 6
517 44
518 57 9
519 13 9
520 13 \r
521 10 \n
522 13 \r
523 10 \n
524 79 O
525 75 K
526 13 \r
527 10 \n

For this AT command the relevant registers are 515 and 516, which indicate a network coverage of 16.

Remember that in order to use this characteristic to send SMS messages, the AT command is AT^MTXTUNNEL=SMS,phone,message, as previously outlined in this guide.

Procedure for Receiving SMS Messages

The process for receiving SMS messages via Modbus TCP is very simple. The PLC should periodically check register 1000. If the value read is “1”, this indicates that there is a new SMS message, which can be read from regsiters 1001 to 1180. After reading the message, the value of register 1000 should be changed back to “0”.


  • Once configured click on the “SAVE CONFIG” button to save changes. Restart the router so changes apply
  • Check the modbus registry table inside the Titan router configuration menus, in the section Other > Modbus Slave