Packet Failure on Send Request – Incorrect Command Sent with Serial --> mb_master (ESP-IDF v5.4.0) (IDFGH-14820)

[SMledpoint]

Description:
I’m experiencing an issue with the Modbus master operation when running on ESP-IDF v5.4.0. During a read coils operation, the master fails to receive a proper response. The log shows that a timeout occurs (ESP_ERR_TIMEOUT, 0x107) and, upon inspection with a logic analyzer, the transmitted packet appears malformed. The analyzer output indicates extra bytes (reported as “Message too long”) and an incorrect CRC.

Environment:

ESP-IDF Version: v5.4.0
Modbus Master Library: [Serial mb_master]
UART Configuration:
Port: 2
Baud Rate: 9600
Parity: NONE

Log Output:

D (731) intr_alloc: Connected src 24 to int 3 (cpu 0)
D (735) app_start: Starting scheduler on CPU0
I (740) maD (740) intr_alloc: Connected src 25 to int 1 (cpu 1)
D (740) app_start: Starting scheduler on CPU1
in_task: Started on CPU0
D (750) heap_init: New heap initialised at 0x3ffe0440
D (750) heap_init: New heap initialised at 0x3ffe4350
D (760) intr_alloc: Connected src 16 to int 5 (cpu 0)
I (760) main_task: Calling app_main()
I (760) MASTER_LIB: Initializing Modbus master:
I (770) MASTER_LIB: UART PORT:2, BAUD:9600, PARITY:NONE
I (770) MASTER_LIB: PIN TX:23, RX:16
D (780) MB_PORT_COMMON: vMBPortSetMode: Port enter critical.
D (780) MB_PORT_COMMON: vMBPortSetMode: Port exit critical
D (790) MB_PORT_COMMON: eMBMasterRTUInit: Port enter critical.
I (790) uart: queue free spaces: 20
D (800) intr_alloc: Connected src 36 to int 8 (cpu 0)
D (800) MB_PORT_COMMON: xMBMasterPortSerialInit Init serial.
D (810) MB_PORT_COMMON: eMBMasterRTUInit: Port exit critical
D (810) MB_PORT_COMMON: eMBMasterRTUStart: Port enter critical.
D (820) MB_PORT_COMMON: eMBMasterRTUStart: PortD (820) DBG: RTU timer, init FSM state.
D (820) MBM_TIMER: Timer mode: (0) triggered
exit critical
D (830) MB_PORT_COMMON: 0:EV_MASTER_READY
I (830) MASTER_LIB: Modbus master initialized successfully
D (1840) MASTER_LIB: Starting new Modbus operation cycle
I (1840) MASTER_LIB: Attempting READ - CID:0 Relay1 (Slave:1 Coil:0x0000)
D (1840) MB_PORT_COMMON: xMBMasterRunResTake:Take MB resource (500 ticks).
D (1840) MB_PORT_COMMON: 1230907:EV_MASTER_FRAME_TRANSMIT
D (1850) POLL transmit buffer: 01 00 00 00 01
D (1850) MB_PORT_COMMON: eMBMasterRTUSend: Port enter critical.
D (1860) MB_PORT_COMMON: eMBMasterRTUSend: Port exit critical
D (1860) MB_PORT_COMMON: xMBMasterPortSerialSendRequest default
D (1870) MB_PORT_COMMON: vMBMasterPortTimersRespondTimeoutEnable Respond enable timeout.
D (1880) MB_MASTER_SERIAL: MB_TX_buffer sent: (9) bytes.
D (1880) MB_PORT_COMMON: vMBMasterRxSemaRelease:RX semaphore is free.
D (1890) MB_PORT_COMMON: 1230907:EV_MASTER_FRAME_SENT
D (1890) POLL sent buffer: 01 00 00 00 01
D (2880) MBM_TIMER: Timer mode: (1) triggered
D (2880) MB_PORT_COMMON: 1230907:EV_MASTER_ERROR_PROCESS
D (2880) MB_PORT_COMMON: vMBMasterErrorCBRespondTimeout:Callback respond timeout.
D (2880) MB_PORT_COMMON: Transaction (1230907), processing time(us) = 1033744
D (2890) MB_PORT_COMMON: eMBMasterWaitRequestFinish: returned event = 0x100
D (2890) MB_CONTROLLER_MASTER: mbc_serial_master_get_parameter: Bad response to get cid(0) = ESP_ERR_TIMEOUT
E (2900) MB_CONTROLLER_MASTER: mbc_master_get_parameter(75): Master get parameter failure, error=(0x107) (ESP_ERR_TIMEOUT).
E (2920) MASTER_LIB: READ FAILED - CID:0, err=0x107 (ESP_ERR_TIMEOUT)

Expected Behavior:
The master should send a correctly formatted Modbus RTU request that adheres to the specification.
A proper response should be received from the slave, with valid CRC and data.

Actual Behavior:
The transmitted packet appears malformed (extra “Message too long” segments and incorrect CRC).
The master encounters a timeout (ESP_ERR_TIMEOUT) due to a bad or absent response.
Questions/Request for Assistance:

Is this behavior a known issue with the Modbus master library when used with ESP-IDF v5.4.0?
Could there be a configuration or timing issue (e.g., with the RTU timer or UART settings) that might cause the packet to be malformed?
Are there any recommended workarounds or updates available to address this problem?
I appreciate any guidance or insights you might provide to help resolve this issue. Please let me know if additional logs or configuration details are required.

[alisitsyn]

@SMledpoint, thanks for the report.

upon inspection with a logic analyzer, the transmitted packet appears malformed. The analyzer output indicates extra bytes (reported as “Message too long”) and an incorrect CRC.

Unfortunately, the information in the log above is not enough to find the reason for the issue. The log says it is timeout during waiting for slave response.

Please provide:

1. The complete log as file attached to this issue.
2. sdkconfig file for your application.
3. Logic analyzer pictures where it is clearly showed the master request and incorrect response from slave.
4. Do you use esp-modbus master and slave code in your application? If not, please describe what slave is used. Please also specify the esp-modbus component version used in your application.
5. What kind of esp32 chip or module used in your application.

P.S:
Please consider creating the issues for modbus in correct location.

Thanks.

[SMledpoint]

@alisitsyn,

Thank you for checking up on this case. Here's the information you requested:

Component Details:
ESP32 Module: ESP32 WROOM32
Connected to: TTL HW519 → Modbus R4M9B12
Modbus Library: mb_master serial
ESP-IDF Version: v5.4
espressif/esp-modbus:
version: "^1.0"
Slave Device:
The R4M9B12 slave uses standard protocol/commands for communication.

Attachments:

• Complete log file
• sdkconfig file for the application
• Logic analyzer pictures showing the master request and incorrect response from the slave
• code from the sample test to check the behavior of relay.

Let me know if you need any further information or clarification.

Thank You!

P.S. I’ll make sure to report Modbus-related issues in the correct location moving forward.

Monitor Log.odt

sdkconfig.json

`#include <string.h>
#include <stddef.h>
#include <assert.h>
#include "esp_log.h"
#include "modbus_params.h"
#include "mbcontroller.h"
#include "sdkconfig.h"
#include "driver/uart.h"
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"

#define MB_PORT_NUM         (CONFIG_MB_UART_PORT_NUM)
#define MB_DEV_SPEED        (CONFIG_MB_UART_BAUD_RATE)
#define POLL_TIMEOUT_MS     (100)
#define POLL_TIMEOUT_TICKS  (pdMS_TO_TICKS(POLL_TIMEOUT_MS))

static const char *TAG = "MASTER_LIB";

#define MB_DEVICE_ADDR 0x01  // Example Modbus device address

enum {
    CID_RELAY_1 = 0,
    CID_RELAY_2,
    CID_RELAY_3,
    CID_RELAY_4,
    CID_COUNT
};

const mb_parameter_descriptor_t device_parameters[] = {
    { CID_RELAY_1, "Relay1", "on/off", MB_DEVICE_ADDR, MB_PARAM_COIL,
      0x0000, 1, offsetof(coil_reg_params_t, relay1),
      PARAM_TYPE_U8_B, sizeof(uint8_t) , {{0, 0x01, 0}}, PAR_PERMS_READ_WRITE },
     
    { CID_RELAY_2, "Relay2", "on/off", MB_DEVICE_ADDR, MB_PARAM_COIL,
      0x0001, 1, offsetof(coil_reg_params_t, relay2),
      PARAM_TYPE_U8_B, sizeof(uint8_t), {{0, 0x01, 0}}, PAR_PERMS_READ_WRITE },

    { CID_RELAY_3, "Relay3", "on/off", MB_DEVICE_ADDR, MB_PARAM_COIL,
      0x0002, 1, offsetof(coil_reg_params_t, relay3),
      PARAM_TYPE_U8_B, sizeof(uint8_t), {{0, 0x01, 0}}, PAR_PERMS_READ_WRITE },

    { CID_RELAY_4, "Relay4", "on/off", MB_DEVICE_ADDR, MB_PARAM_COIL,
      0x0003, 1, offsetof(coil_reg_params_t, relay4),
      PARAM_TYPE_U8_B, sizeof(uint8_t), {{0, 0x01, 0}}, PAR_PERMS_READ_WRITE },
};

const uint16_t num_device_parameters = sizeof(device_parameters) / sizeof(device_parameters[0]);

/*
   Returns the pointer to the data in the corresponding register structure
   based on the parameter descriptor.
/
static void master_get_param_data(const mb_parameter_descriptor_t* param_descriptor)
{
    assert(param_descriptor != NULL);
    void* instance_ptr = NULL;
   
    switch(param_descriptor->mb_param_type) {
        case MB_PARAM_COIL:
           instance_ptr = (void*)((uint8_t*)&coil_reg_params + param_descriptor->param_offset);
            break;
        case MB_PARAM_HOLDING:
           // instance_ptr = (void*)((uint8_t*)&holding_reg_params + param_descriptor->param_offset);
            break;
        case MB_PARAM_INPUT:
           // instance_ptr = (void*)((uint8_t*)&input_reg_params + param_descriptor->param_offset);
            break;
        case MB_PARAM_DISCRETE:
           // instance_ptr = (void*)((uint8_t*)&discrete_reg_params + param_descriptor->param_offset);
            break;
        default:
            ESP_LOGE(TAG, "Unknown parameter type: %d", param_descriptor->mb_param_type);
            break;
    }
    return instance_ptr;
}

/*
   This function performs a read-modify-write operation for each device parameter.
   It calls the master get/set APIs which in turn build the Modbus PDU.
   The low-level send function (eMBMasterRTUSend) will prepend the slave address and
   append the CRC to complete the frame.
*/
static void master_operation_func(void *arg)
{
    esp_err_t err;
    uint8_t type = 0;

    for (uint16_t cid = 0; cid < num_device_parameters; cid++) {
        const mb_parameter_descriptor_t* pd = &device_parameters[cid];
        void* data_ptr = master_get_param_data(pd);

        // Log read attempt details with the expected Modbus register address.
        ESP_LOGI(TAG, "Attempting READ - CID:%d %s (Slave:%d Coil:0x%04X)",
                 pd->cid, pd->param_key, pd->mb_slave_addr, pd->mb_reg_start);
       
        // Read current state from the slave device.
        err = mbc_master_get_parameter(pd->cid, (char*)pd->param_key, (uint8_t*)data_ptr, &type);
        if (err == ESP_OK) {
            // Since PARAM_TYPE_U16 is used, we assume a 16-bit value.
            uint8_t current_state = (uint8_t)data_ptr;
            ESP_LOGI(TAG, "READ SUCCESS - CID:%d %s = 0x%04X (Slave:%d Coil:0x%04X)",
                     pd->cid, pd->param_key, current_state, pd->mb_slave_addr, pd->mb_reg_start);

            // Toggle state. Typically, 0xFF00 means ON and 0x0000 means OFF.
            uint8_t new_state = (current_state == 0xFF) ? 0x00 : 0xFF;
            // Update the data that will be used for the write operation.
            (uint8_t)data_ptr = new_state;

            // Log the write attempt.
            ESP_LOGI(TAG, "Attempting WRITE - CID:%d %s = 0x%04X (Slave:%d Coil:0x%04X)",
                     pd->cid, pd->param_key, new_state, pd->mb_slave_addr, pd->mb_reg_start);

            // Write new state to the slave device.
            err = mbc_master_set_parameter(pd->cid, (char*)pd->param_key, (uint8_t*)data_ptr, &type);
            if (err == ESP_OK) {
                ESP_LOGI(TAG, "WRITE SUCCESS - CID:%d %s = 0x%04X",
                         pd->cid, pd->param_key, new_state);
            } else {
                ESP_LOGE(TAG, "WRITE FAILED - CID:%d, err=0x%x (%s)",
                         pd->cid, err, esp_err_to_name(err));
            }
        } else {
            ESP_LOGE(TAG, "READ FAILED - CID:%d, err=0x%x (%s)",
                     pd->cid, err, esp_err_to_name(err));
        }
        vTaskDelay(POLL_TIMEOUT_TICKS);
    }
}

/*
   Initializes the Modbus master by configuring the UART, setting up the Modbus
   communication parameters, and starting the master stack.
*/
static esp_err_t master_init(void)
{
    ESP_LOGI(TAG, "Initializing Modbus master:");
    ESP_LOGI(TAG, "UART PORT:%d, BAUD:%d, PARITY:%s",
             MB_PORT_NUM, MB_DEV_SPEED, "NONE");
    ESP_LOGI(TAG, "PIN TX:%d, RX:%d",
             CONFIG_MB_UART_TXD, CONFIG_MB_UART_RXD);

    // Add explicit UART configuration
    uart_config_t uart_config = {
        .baud_rate = MB_DEV_SPEED,
        .data_bits = UART_DATA_8_BITS,
        .parity = UART_PARITY_DISABLE,
        .stop_bits = UART_STOP_BITS_1,
        .flow_ctrl = UART_HW_FLOWCTRL_DISABLE
    };
    ESP_ERROR_CHECK(uart_param_config(MB_PORT_NUM, &uart_config));

    mb_communication_info_t comm = {
        .port = MB_PORT_NUM,
        .mode = MB_MODE_RTU,
        .baudrate = MB_DEV_SPEED,
        .parity = MB_PARITY_NONE,
    };

    void* master_handler = NULL;
    ESP_ERROR_CHECK(mbc_master_init(MB_PORT_SERIAL_MASTER, &master_handler));
    ESP_ERROR_CHECK(mbc_master_setup(&comm));
    ESP_ERROR_CHECK(uart_set_pin(MB_PORT_NUM, CONFIG_MB_UART_TXD, CONFIG_MB_UART_RXD,
                                 UART_PIN_NO_CHANGE, UART_PIN_NO_CHANGE));
    ESP_ERROR_CHECK(mbc_master_start());
    ESP_ERROR_CHECK(mbc_master_set_descriptor(device_parameters, num_device_parameters));
    ESP_LOGI(TAG, "Modbus master initialized successfully");
    return ESP_OK;
}

void app_main(void)
{
    esp_log_level_set("mbcontroller", ESP_LOG_VERBOSE);
    esp_log_level_set("MASTER_LIB", ESP_LOG_DEBUG);

    ESP_ERROR_CHECK(master_init());
    vTaskDelay(pdMS_TO_TICKS(1000));
   
    while (1) {
        ESP_LOGD(TAG, "Starting new Modbus operation cycle");
        master_operation_func(NULL);
        ESP_LOGD(TAG, "Operation cycle completed");
        vTaskDelay(pdMS_TO_TICKS(5000));
    }
}

`

[alisitsyn]

@SMledpoint , thank you for update. On the pictures above I can see only the Modbus master request: 01 01 00 00 00 01 FD CA which is correct and no any response from your slave. So, the master handles the request correctly with the timeout. Please check your device service manual to setup it accordingly. If you still think the master handles the response from slave incorrectly, please provide the actual data of master request and slave response on A, B or TXD, RXD pins accordingly.
Thank you.

[SMledpoint]

@alisitsyn

Thank you for responding. The packet issue was due to faulty slave hardware. After replacing the hardware, it is now able to send the correct packets without any errors. Thank you!

[alisitsyn]

@SMledpoint , thank you for update. Good luck with your project!