From 5f86569a9f25e61a3d7c9c68fb74bb8c79c64695 Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 01/15] Solved Issues mentioned in
 https://github.com/arendst/Tasmota/issues/9586

---
 .../TasmotaModbus-3.5.0/src/TasmotaModbus.cpp |  16 +-
 .../TasmotaModbus-3.5.0/src/TasmotaModbus.h   |   2 +-
 .../xdrv_63_modbus_bridge.ino                 | 361 ++++++++++++------
 3 files changed, 248 insertions(+), 131 deletions(-)

diff --git a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
index f543725a5..af80bed5e 100644
--- a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
+++ b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
@@ -55,7 +55,7 @@ int TasmotaModbus::Begin(long speed, uint32_t config)
   return result;
 }
 
-uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t register_count, uint16_t *registers)
+uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t register_count, uint16_t *registers, uint16_t bit_count)
 {
   uint8_t *frame;
   uint8_t framepointer = 0;
@@ -97,9 +97,19 @@ uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint1
   }
   else if ((function_code == 15) || (function_code == 16))
   {
-    frame[framepointer++] = (uint8_t)(register_count >> 8);   // MSB
-    frame[framepointer++] = (uint8_t)(register_count);        // LSB
+    if (function_code == 15)
+    {
+      frame[framepointer++] = (uint8_t)(bit_count >> 8);   // MSB
+      frame[framepointer++] = (uint8_t)(bit_count);        // LSB
+    }
+    else
+    {
+      frame[framepointer++] = (uint8_t)(register_count >> 8);   // MSB
+      frame[framepointer++] = (uint8_t)(register_count);        // LSB
+    }
+    
     frame[framepointer++] = register_count * 2;
+
     if (registers == NULL) 
     {
       free(frame);
diff --git a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h
index f0122b9b0..b5fe65a7f 100644
--- a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h
+++ b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h
@@ -53,7 +53,7 @@ class TasmotaModbus : public TasmotaSerial {
      * 13 = Register data not specified
      * 14 = To many registers
      */
-    uint8_t Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t register_count, uint16_t *registers = NULL);
+    uint8_t Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t register_count, uint16_t *registers = NULL, uint16_t bit_count = 0);
     uint8_t ReceiveBuffer(uint8_t *buffer, uint8_t register_count);
     uint8_t Receive8BitRegister(uint8_t *value);
     uint8_t Receive16BitRegister(uint16_t *value);
diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index ac624d0fc..208c1f1ac 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -26,10 +26,13 @@
  * When USE_MODBUS_BRIDGE_TCP is also defined, this bridge can also be used as an ModbusTCP
  * bridge.
  *
- * Example Command:
+ * Example Commands:
+ *   -- Read Coils --
+ *   ModbusSend {"deviceaddress": 1, "functioncode": 1, "startaddress": 1, "type":"bit", "count":2}
+ *
  *   -- Read Input Register --
  *   ModbusSend {"deviceaddress": 1, "functioncode": 3, "startaddress": 1, "type":"uint16", "count":2}
- * 
+ *
  *   -- Write multiple coils --
  *   ModbusSend {"deviceaddress": 1, "functioncode": 15, "startaddress": 1, "type":"uint16", "count":4, "values":[1,2,3,4]}
 \*********************************************************************************************/
@@ -110,7 +113,7 @@ enum class ModbusBridgeFunctionCode
 {
   mb_undefined = 0,
   mb_readCoilStatus = 1,
-  mb_readContactStatus = 2,
+  mb_readInputStatus = 2,
   mb_readHoldingRegisters = 3,
   mb_readInputRegisters = 4,
   mb_writeSingleCoil = 5,
@@ -158,6 +161,24 @@ struct ModbusBridge
 
 ModbusBridge modbusBridge;
 
+/********************************************************************************************/
+//
+// Helper functions for data conversion between little and big endian
+//
+uint16_t swap_endian16(uint16_t num)
+{
+  return (num>>8) | (num<<8);
+}
+
+uint32_t swap_endian32(uint32_t num)
+{
+  return ((num>>24)&0xff) | // move byte 3 to byte 0
+         ((num<<8)&0xff0000) | // move byte 1 to byte 2
+         ((num>>8)&0xff00) | // move byte 2 to byte 1
+         ((num<<24)&0xff000000); // byte 0 to byte 3
+}
+
+
 /********************************************************************************************/
 //
 // Applies serial configuration to modbus serial port
@@ -232,22 +253,34 @@ void ModbusBridgeHandle(void)
       WiFiClient &client = modbusBridgeTCP.client_tcp[i];
       if (client)
       {
-        uint8_t MBAP_Header[7];
-        MBAP_Header[0] = modbusBridgeTCP.tcp_transaction_id >> 8;
-        MBAP_Header[1] = modbusBridgeTCP.tcp_transaction_id;
-        MBAP_Header[2] = 0;
-        MBAP_Header[3] = 0;
-        MBAP_Header[4] = ((modbusBridge.dataCount * 2) + 3) >> 8;
-        MBAP_Header[5] = (modbusBridge.dataCount * 2) + 3;
-        MBAP_Header[6] = buffer[0]; // Send slave address
-        client.write(MBAP_Header, 7);
-        client.write(buffer + 1, 1); // Send Functioncode
-        uint8_t bytecount[1];
-        bytecount[0] = modbusBridge.dataCount * 2;
-        client.write(bytecount, 1);                             // Send length of rtu data
-        client.write(buffer + 3, (modbusBridge.dataCount * 2)); // Don't send CRC
+        uint8_t header[8];
+        uint8_t nrOfBytes = 8;
+        header[0] = modbusBridgeTCP.tcp_transaction_id >> 8;
+        header[1] = modbusBridgeTCP.tcp_transaction_id;
+        header[2] = 0;
+        header[3] = 0;
+        header[6] = buffer[0]; // Send slave address
+        header[7] = buffer[1]; // Send function code
+        if (buffer[1] <= 4) 
+        {
+          header[4] = ((modbusBridge.dataCount * 2) + 3) >> 8;
+          header[5] = (modbusBridge.dataCount * 2) + 3;
+          header[8] = modbusBridge.dataCount * 2;
+          client.write(header, 9);
+          nrOfBytes += 1;
+          client.write(buffer + 3, (modbusBridge.dataCount * 2)); // Don't send CRC
+          nrOfBytes += modbusBridge.dataCount * 2;
+        }
+        else
+        {
+          header[4] = 0; // Message Length Hi-Byte
+          header[5] = 6; // Message Length Low-Byte
+          client.write(header, 8);
+          client.write(buffer + 2, 4); // Don't send CRC
+          nrOfBytes += 4;
+        }
         client.flush();
-        AddLog(LOG_LEVEL_DEBUG, PSTR("MBS: MBRTCP from Modbus deviceAddress %d, writing %d bytes to client"), buffer[0], (modbusBridge.dataCount * 2) + 9);
+        AddLog(LOG_LEVEL_DEBUG, PSTR("MBS: MBRTCP from Modbus deviceAddress %d, writing %d bytes to client"), buffer[0], nrOfBytes);
       }
     }
 #endif
@@ -278,17 +311,13 @@ void ModbusBridgeHandle(void)
       }
       else
       {
-        if ((modbusBridge.type == ModbusBridgeType::mb_int8 || modbusBridge.type == ModbusBridgeType::mb_uint8)
-          && ((uint8_t)modbusBridge.dataCount * 2 != (uint8_t)buffer[2]))
+        if ((modbusBridge.type == ModbusBridgeType::mb_int8 || modbusBridge.type == ModbusBridgeType::mb_uint8) && ((uint8_t)modbusBridge.dataCount * 2 != (uint8_t)buffer[2]))
           errorcode = ModbusBridgeError::wrongdataCount;
-        else if ((modbusBridge.type == ModbusBridgeType::mb_bit)
-          && ((uint8_t)modbusBridge.dataCount * 2 != (uint8_t)buffer[2]))
+        else if ((modbusBridge.type == ModbusBridgeType::mb_bit) && ((uint8_t)modbusBridge.dataCount * 2 != (uint8_t)buffer[2]))
           errorcode = ModbusBridgeError::wrongdataCount;
-        else if ((modbusBridge.type == ModbusBridgeType::mb_int16 || modbusBridge.type == ModbusBridgeType::mb_uint16)
-          && ((uint8_t)modbusBridge.dataCount * 2 != (uint8_t)buffer[2]))
+        else if ((modbusBridge.type == ModbusBridgeType::mb_int16 || modbusBridge.type == ModbusBridgeType::mb_uint16) && ((uint8_t)modbusBridge.dataCount * 2 != (uint8_t)buffer[2]))
           errorcode = ModbusBridgeError::wrongdataCount;
-        else if ((modbusBridge.type == ModbusBridgeType::mb_int32 || modbusBridge.type == ModbusBridgeType::mb_uint32 || modbusBridge.type == ModbusBridgeType::mb_float)
-          && ((uint8_t)modbusBridge.dataCount * 2 != (uint8_t)buffer[2]))
+        else if ((modbusBridge.type == ModbusBridgeType::mb_int32 || modbusBridge.type == ModbusBridgeType::mb_uint32 || modbusBridge.type == ModbusBridgeType::mb_float) && ((uint8_t)modbusBridge.dataCount * 2 != (uint8_t)buffer[2]))
           errorcode = ModbusBridgeError::wrongdataCount;
       }
     }
@@ -354,11 +383,13 @@ void ModbusBridgeHandle(void)
           char svalue[MBR_MAX_VALUE_LENGTH + 1] = "";
           if (modbusBridge.type == ModbusBridgeType::mb_float)
           {
+            // Convert next 4 bytes to float
             float value = 0;
             if (buffer[1] < 3)
             {
+              // In bit mode  only convert returned bytes
               if (buffer[2] - (count * 4))
-                ((uint8_t *)&value)[0] = buffer[dataOffset + (count * 4)]; // Get int values
+                ((uint8_t *)&value)[0] = buffer[dataOffset + (count * 4)]; // Get float values
               if ((buffer[2] - (count * 4)) >> 1)
                 ((uint8_t *)&value)[1] = buffer[dataOffset + 1 + (count * 4)];
               if ((buffer[2] - (count * 4) - 1) >> 1)
@@ -377,7 +408,17 @@ void ModbusBridgeHandle(void)
           }
           else if (modbusBridge.type == ModbusBridgeType::mb_bit)
           {
-            uint8_t value = (uint8_t)(buffer[dataOffset + (count >> 3)]);
+            uint8_t bits_left = modbusBridge.count - ((count/8) * 8);
+            uint8_t value = 0;
+            if (bits_left < 8)
+            {
+              uint8_t bits_skip = 8 - bits_left;
+              value = (uint8_t)(buffer[dataOffset + ((count + bits_skip) >> 3)]);
+            }
+            else
+            {
+              value = (uint8_t)(buffer[dataOffset + (count >> 3)]);
+            }
             snprintf(svalue, MBR_MAX_VALUE_LENGTH, "%d", ((value >> (count & 7)) & 1));
           }
           else
@@ -389,17 +430,17 @@ void ModbusBridgeHandle(void)
               if (buffer[1] < 3)
               {
                 if (buffer[2] - (count * 4))
-                  ((uint8_t *)&value)[0] = buffer[dataOffset + (count * 4)]; // Get int values
-                if ((buffer[2] - (count * 4)) >> 1)
+                  ((uint8_t *)&value)[0] = buffer[dataOffset + (count * 4)]; // Get uint values
+                if (buffer[2] - ((count * 4) - 1))
                   ((uint8_t *)&value)[1] = buffer[dataOffset + 1 + (count * 4)];
-                if ((buffer[2] - (count * 4) - 1) >> 1)
+                if (buffer[2] - ((count * 4) - 2))
                   ((uint8_t *)&value)[2] = buffer[dataOffset + 2 + (count * 4)];
-                if ((buffer[2] - (count * 4)) >> 2)
+                if (buffer[2] - ((count * 4) - 3))
                   ((uint8_t *)&value)[3] = buffer[dataOffset + 3 + (count * 4)];
               }
               else
               {
-                ((uint8_t *)&value)[3] = buffer[dataOffset + (count * 4)]; // Get int values
+                ((uint8_t *)&value)[3] = buffer[dataOffset + (count * 4)]; // Get uint values
                 ((uint8_t *)&value)[2] = buffer[dataOffset + 1 + (count * 4)];
                 ((uint8_t *)&value)[1] = buffer[dataOffset + 2 + (count * 4)];
                 ((uint8_t *)&value)[0] = buffer[dataOffset + 3 + (count * 4)];
@@ -417,7 +458,7 @@ void ModbusBridgeHandle(void)
               {
                 if (buffer[2] - (count * 2))
                   ((uint8_t *)&value)[0] = buffer[dataOffset + (count * 2)];
-                if ((buffer[2] - (count * 2)) >> 1)
+                if (buffer[2] - ((count * 2) - 1))
                   ((uint8_t *)&value)[1] = buffer[dataOffset + 1 + (count * 2)];
               }
               else
@@ -439,12 +480,6 @@ void ModbusBridgeHandle(void)
               else
                 snprintf(svalue, MBR_MAX_VALUE_LENGTH, "%u", value);
             }
-            /*
-            else if (modbusBridge.type == ModbusBridgeType::mb_bit)
-            {
-              uint8_t value = (uint8_t)(buffer[dataOffset + count]);
-              snprintf(svalue, MBR_MAX_VALUE_LENGTH, "%d%d%d%d%d%d%d%d", ((value >> 7) & 1), ((value >> 6) & 1), ((value >> 5) & 1), ((value >> 4) & 1), ((value >> 3) & 1), ((value >> 2) & 1), ((value >> 1) & 1), (value & 1));
-            }*/
           }
           ResponseAppend_P(PSTR("%s"), svalue);
           if (count < data_count - 1)
@@ -576,18 +611,40 @@ void ModbusTCPHandle(void)
           busy = true;
         }
       }
-      if (buf_len == 12)
+      if (buf_len >= 12)
       {
         uint8_t mbdeviceaddress = (uint8_t)modbusBridgeTCP.tcp_buf[6];
         uint8_t mbfunctioncode = (uint8_t)modbusBridgeTCP.tcp_buf[7];
         uint16_t mbstartaddress = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[8]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[9]));
-        modbusBridge.dataCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+        uint16_t *writeData = NULL;
+
         modbusBridgeTCP.tcp_transaction_id = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[0]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[1]));
+        uint8_t dataSendCount = 0;
 
-        AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus Transactionid:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, Count:%d"),
-               modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, modbusBridge.dataCount);
+        if (mbfunctioncode <= 4)
+        {
+          modbusBridge.dataCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+        }
+        else
+        {
+          // For functioncode 15 & 16 ignore bytecount, tasmotaModbus does calculate this
+          uint8_t dataStartByte = mbfunctioncode <= 6 ? 10 : 11;
+          modbusBridge.dataCount = 1;
+          dataSendCount = (buf_len - dataStartByte) / 2;
+          writeData = (uint16_t *)malloc(dataSendCount);
+          for (uint8_t dataPointer = 0; dataPointer < dataSendCount; dataPointer++)
+          {
+            writeData[dataPointer] = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte+dataPointer]) << 8) 
+                            | ((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte + 1 + dataPointer]));
+          }
+        }
 
-        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, modbusBridge.dataCount);
+        AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus Transactionid:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, sendCount:%d, recvCount:%d"),
+               modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, dataSendCount, modbusBridge.dataCount);
+
+        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, modbusBridge.dataCount, writeData, dataSendCount);
+
+        free(writeData);
       }
     }
     yield(); // avoid WDT if heavy traffic
@@ -603,6 +660,7 @@ void CmndModbusBridgeSend(void)
 {
   uint16_t *writeData = NULL;
   uint8_t writeDataSize = 0;
+  bool bitMode = false;
   ModbusBridgeError errorcode = ModbusBridgeError::noerror;
 
   JsonParser parser(XdrvMailbox.data);
@@ -615,7 +673,9 @@ void CmndModbusBridgeSend(void)
   modbusBridge.startAddress = root.getULong(PSTR(D_JSON_MODBUS_START_ADDRESS), 0);
 
   const char *stype = root.getStr(PSTR(D_JSON_MODBUS_TYPE), "uint8");
-  modbusBridge.count = root.getUInt(PSTR(D_JSON_MODBUS_COUNT), 1);
+  modbusBridge.count = root.getUInt(PSTR(D_JSON_MODBUS_COUNT), 1); // Number of bits or bytes to read / write
+
+  if ((functionCode == 1) || (functionCode == 2) || (functionCode == 15)) bitMode = true;
 
   if (modbusBridge.deviceAddress == 0)
     errorcode = ModbusBridgeError::wrongdeviceaddress;
@@ -634,7 +694,7 @@ void CmndModbusBridgeSend(void)
   if (strcmp(stype, "int8") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_int8;
-    modbusBridge.dataCount = ((modbusBridge.count - 1)/ 2) + 1;
+    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
   }
   else if (strcmp(stype, "int16") == 0)
   {
@@ -644,12 +704,12 @@ void CmndModbusBridgeSend(void)
   else if (strcmp(stype, "int32") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_int32;
-    modbusBridge.dataCount = 2 * modbusBridge.count;
+    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : 2 * modbusBridge.count;
   }
   else if ((strcmp(stype, "uint8") == 0))
   {
     modbusBridge.type = ModbusBridgeType::mb_uint8;
-    modbusBridge.dataCount = ((modbusBridge.count - 1)/ 2) + 1;
+    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
   }
   else if ((strcmp(stype, "uint16") == 0) || (strcmp(stype, "") == 0)) // Default is uint16
   {
@@ -659,37 +719,82 @@ void CmndModbusBridgeSend(void)
   else if (strcmp(stype, "uint32") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_uint32;
-    modbusBridge.dataCount = 2 * modbusBridge.count;
+    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : 2 * modbusBridge.count;
   }
   else if (strcmp(stype, "float") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_float;
-    modbusBridge.dataCount = 2 * modbusBridge.count;
+    modbusBridge.dataCount = bitMode ? 2 * modbusBridge.count : modbusBridge.dataCount = modbusBridge.count;
   }
   else if (strcmp(stype, "raw") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_raw;
-    modbusBridge.dataCount = modbusBridge.count;
+    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
   }
   else if (strcmp(stype, "hex") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_hex;
-    modbusBridge.dataCount = modbusBridge.count;
+    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
   }
   else if (strcmp(stype, "bit") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_bit;
-    modbusBridge.dataCount = ((modbusBridge.count - 1) / 16) + 1;
+    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : ((modbusBridge.count - 1) / 16) + 1 ;
   }
   else
     errorcode = ModbusBridgeError::wrongtype;
 
+  // If functioncode is 15, the count is not the number of registers but the number
+  // of bit to write, so calculate the number data bytes to write.
+  if (modbusBridge.functionCode == ModbusBridgeFunctionCode::mb_writeMultipleCoils)
+  {
+    modbusBridge.dataCount = (((modbusBridge.count - 1) / 16) + 1);
+  }
+
+  // Prevent buffer overflow due to usage of to many registers
   if (modbusBridge.dataCount > MBR_MAX_REGISTERS)
     errorcode = ModbusBridgeError::wrongcount;
 
-  // If write data is specified in JSON copy it into writeData array
+  // Get Json data for writing
   JsonParserArray jsonDataArray = root[PSTR(D_JSON_MODBUS_VALUES)].getArray();
-  if (jsonDataArray.isArray())
+  writeDataSize = jsonDataArray.size();
+
+  // Check if number of supplied data items is valid
+  switch (modbusBridge.functionCode)
+  {
+    case ModbusBridgeFunctionCode::mb_writeMultipleCoils:
+    // In writeMultipleCoil mode the amount of given data bits is less or equal to the count
+    switch (modbusBridge.type)
+    {
+      case ModbusBridgeType::mb_bit:
+        if (modbusBridge.count > writeDataSize) errorcode = ModbusBridgeError::wrongcount;
+      break;
+      case ModbusBridgeType::mb_uint8:
+      case ModbusBridgeType::mb_int8:
+      case ModbusBridgeType::mb_raw:
+      case ModbusBridgeType::mb_hex:
+        if (modbusBridge.count > writeDataSize * 8)  errorcode = ModbusBridgeError::wrongcount;
+      break;
+      case ModbusBridgeType::mb_uint16:
+      case ModbusBridgeType::mb_int16:
+        if (modbusBridge.count > writeDataSize * 16) errorcode = ModbusBridgeError::wrongcount;
+      break;
+      case ModbusBridgeType::mb_uint32:
+      case ModbusBridgeType::mb_int32:
+        if (modbusBridge.count > writeDataSize * 32) errorcode = ModbusBridgeError::wrongcount;
+      break;
+    }
+    break;
+    case ModbusBridgeFunctionCode::mb_writeSingleRegister:
+    case ModbusBridgeFunctionCode::mb_writeSingleCoil:
+      if (modbusBridge.count != 1) errorcode = ModbusBridgeError::wrongcount;
+    case ModbusBridgeFunctionCode::mb_writeMultipleRegisters:
+      if (modbusBridge.count != writeDataSize) errorcode = ModbusBridgeError::wrongcount;
+    break;
+  }
+
+  // If write data is specified in JSON copy it into writeData array
+  if ((errorcode == ModbusBridgeError::noerror) && (jsonDataArray.isArray()))
   {
     if (modbusBridge.dataCount > 40)
     {
@@ -697,73 +802,84 @@ void CmndModbusBridgeSend(void)
     }
     else
     {
-      writeDataSize = jsonDataArray.size();
+      writeData = (uint16_t *)malloc(modbusBridge.dataCount);
 
-      if (modbusBridge.count != writeDataSize)
+      for (uint8_t jsonDataArrayPointer = 0; jsonDataArrayPointer < writeDataSize; jsonDataArrayPointer++)
       {
-        errorcode = ModbusBridgeError::wrongcount;
-      }
-      else
-      {
-        writeData = (uint16_t *)malloc(writeDataSize * 2);
-        for (uint8_t jsonDataArrayPointer = 0; jsonDataArrayPointer < writeDataSize; jsonDataArrayPointer++)
+        if (errorcode != ModbusBridgeError::noerror) break;
+        switch (modbusBridge.type)
         {
-          switch (modbusBridge.type)
+        case ModbusBridgeType::mb_bit:
+        {
+          // Initialize current data/register to 0
+          if (jsonDataArrayPointer % 16 == 0)
           {
-            case ModbusBridgeType::mb_bit:
-              {
-                // Set 2 following bytes to 0
-                if (jsonDataArrayPointer % 16 == 0)
-                {
-                  writeData[jsonDataArrayPointer/15] = 0;
-                }
-                // Swap low and high bytes according to modbus specification
-                uint16_t bitValue = (jsonDataArray[jsonDataArrayPointer].getUInt(0) == 1) ? 1 : 0;
-                uint8_t bitPointer = (jsonDataArrayPointer % 15) + 8;
-                if (bitPointer > 15) bitPointer -= 16;
-
-                writeData[jsonDataArrayPointer/15] += bitValue << bitPointer;
-              }
-            break;
-            case ModbusBridgeType::mb_int8:
-              if (jsonDataArrayPointer % 2) writeData[jsonDataArrayPointer / 2] += (int8_t)jsonDataArray[jsonDataArrayPointer].getInt(0);
-              else writeData[jsonDataArrayPointer] = (int8_t)jsonDataArray[jsonDataArrayPointer / 2].getInt(0) << 8;
-            break;
-            case ModbusBridgeType::mb_uint8:
-              if (jsonDataArrayPointer % 2) writeData[jsonDataArrayPointer / 2] += (uint8_t)jsonDataArray[jsonDataArrayPointer].getInt(0);
-              else writeData[jsonDataArrayPointer / 2] = (uint8_t)jsonDataArray[jsonDataArrayPointer].getInt(0) << 8;
-            break;
-            case ModbusBridgeType::mb_int16:
-              writeData[jsonDataArrayPointer] = (int16_t)jsonDataArray[jsonDataArrayPointer].getInt(0);
-            break;
-            case ModbusBridgeType::mb_uint16:
-              writeData[jsonDataArrayPointer] = (uint16_t)jsonDataArray[jsonDataArrayPointer].getUInt(0);
-            break;
-            case ModbusBridgeType::mb_float:
-              // TODO
-              errorcode = ModbusBridgeError::wrongtype;
-            break;
-            case ModbusBridgeType::mb_int32:
-              writeData[jsonDataArrayPointer++] = (int16_t)(jsonDataArray[jsonDataArrayPointer].getInt(0) >> 16);
-              writeData[jsonDataArrayPointer] = (uint16_t)jsonDataArray[jsonDataArrayPointer].getInt(0);
-            break;
-            case ModbusBridgeType::mb_uint32:
-              writeData[jsonDataArrayPointer++] = (uint16_t)(jsonDataArray[jsonDataArrayPointer].getUInt(0) >> 16);
-              writeData[jsonDataArrayPointer] = (uint16_t)jsonDataArray[jsonDataArrayPointer].getUInt(0);
-            break;
-            case ModbusBridgeType::mb_raw:
-              writeData[jsonDataArrayPointer] = (uint8_t)jsonDataArray[jsonDataArrayPointer*2].getUInt(0) << 8 + (uint8_t)jsonDataArray[(jsonDataArrayPointer*2)+1].getUInt(0);
-            break;
-            case ModbusBridgeType::mb_hex:
-              writeData[jsonDataArrayPointer] = (uint8_t)jsonDataArray[jsonDataArrayPointer*2].getUInt(0) << 8 + (uint8_t)jsonDataArray[(jsonDataArrayPointer*2)+1].getUInt(0);
-            break;
-            default:
-              errorcode = ModbusBridgeError::wrongtype;
-            break;
+            writeData[jsonDataArrayPointer / 15] = 0;
           }
+          // Swap low and high bytes according to modbus specification
+          uint16_t bitValue = (jsonDataArray[jsonDataArrayPointer].getUInt(0) == 1) ? 1 : 0;
+          uint8_t bitPointer = (jsonDataArrayPointer % 16) + 8;
+          if (bitPointer > 15) bitPointer -= 16;
+
+          writeData[jsonDataArrayPointer / 16] += bitValue << bitPointer;
+        }
+        break;
+
+        case ModbusBridgeType::mb_int8:
+          if (jsonDataArrayPointer % 2)
+            writeData[jsonDataArrayPointer / 2] += (int8_t)jsonDataArray[jsonDataArrayPointer].getInt(0);
+          else
+            writeData[jsonDataArrayPointer / 2] = (int8_t)jsonDataArray[jsonDataArrayPointer / 2].getInt(0) << 8;
+          if (modbusBridge.dataCount != writeDataSize / 2) errorcode = ModbusBridgeError::wrongcount;
+          break;
+        
+        case ModbusBridgeType::mb_hex:
+        case ModbusBridgeType::mb_raw:
+        case ModbusBridgeType::mb_uint8:
+          if (jsonDataArrayPointer % 2)
+            writeData[jsonDataArrayPointer / 2] += (uint8_t)jsonDataArray[jsonDataArrayPointer].getUInt(0);
+          else
+            writeData[jsonDataArrayPointer / 2] = (uint8_t)jsonDataArray[jsonDataArrayPointer].getUInt(0) << 8;
+          if (modbusBridge.dataCount != writeDataSize / 2) errorcode = ModbusBridgeError::wrongcount;
+          break;
+        
+        case ModbusBridgeType::mb_int16:
+          writeData[jsonDataArrayPointer] = bitMode ? swap_endian16(jsonDataArray[jsonDataArrayPointer].getInt(0)) 
+            : (int16_t)jsonDataArray[jsonDataArrayPointer].getInt(0);
+          break;
+        
+        case ModbusBridgeType::mb_uint16:
+          writeData[jsonDataArrayPointer] = (uint16_t)swap_endian16(jsonDataArray[jsonDataArrayPointer].getUInt(0));
+          break;
+        
+        case ModbusBridgeType::mb_int32:
+          writeData[(jsonDataArrayPointer * 2)] = bitMode ? swap_endian16(jsonDataArray[jsonDataArrayPointer].getInt(0)) 
+            : (int16_t)(jsonDataArray[jsonDataArrayPointer].getInt(0) >> 16);
+          writeData[(jsonDataArrayPointer * 2) + 1] = bitMode ? swap_endian16(jsonDataArray[jsonDataArrayPointer].getInt(0) >> 16) 
+            : (uint16_t)(jsonDataArray[jsonDataArrayPointer].getInt(0));
+          break;
+        
+        case ModbusBridgeType::mb_uint32:
+          writeData[(jsonDataArrayPointer * 2)] = bitMode ? swap_endian16(jsonDataArray[jsonDataArrayPointer].getUInt(0)) 
+            : (uint16_t)(jsonDataArray[jsonDataArrayPointer].getUInt(0) >> 16);
+          writeData[(jsonDataArrayPointer * 2) + 1] = bitMode ? swap_endian16(jsonDataArray[jsonDataArrayPointer].getUInt(0) >> 16) 
+            : (uint16_t)(jsonDataArray[jsonDataArrayPointer].getUInt(0));
+          break;
+        
+        case ModbusBridgeType::mb_float:
+          // TODO
+        default:
+          errorcode = ModbusBridgeError::wrongtype;
+          break;
         }
       }
     }
+
+    // Adapt data according to modbus protocol
+    if (modbusBridge.functionCode == ModbusBridgeFunctionCode::mb_writeSingleCoil)
+    {
+      writeData[0] = writeData[0] ? 0xFF00 : 0x0000; // High Byte
+    }
   }
 
   // Handle errorcode and exit function when an error has occured
@@ -774,22 +890,13 @@ void CmndModbusBridgeSend(void)
     return;
   }
 
-  // Adapt data according to modbus protocol
-  for (uint8_t writeDataPointer = 0; writeDataPointer < modbusBridge.dataCount; writeDataPointer++)
-  {
-    // For function code 5, on and off are 0xFF00 and 0x0000, not 1 and 0      
-    if (modbusBridge.functionCode == ModbusBridgeFunctionCode::mb_writeSingleCoil)
-    {
-      writeData[writeDataPointer] = writeData[writeDataPointer] ? 0xFF00 : 0x0000; 
-    }
-  }
-
   // If writing a single coil or single register, the register count is always 1. We also prevent writing data out of range
   if ((modbusBridge.functionCode == ModbusBridgeFunctionCode::mb_writeSingleCoil) || (modbusBridge.functionCode == ModbusBridgeFunctionCode::mb_writeSingleRegister))
     modbusBridge.dataCount = 1;
 
-  uint8_t error = tasmotaModbus->Send(modbusBridge.deviceAddress, (uint8_t)modbusBridge.functionCode, modbusBridge.startAddress, modbusBridge.dataCount, writeData);
-  if (error) AddLog(LOG_LEVEL_DEBUG, PSTR("MBS: MBR Driver send error %u"), error);
+  uint8_t error = tasmotaModbus->Send(modbusBridge.deviceAddress, (uint8_t)modbusBridge.functionCode, modbusBridge.startAddress, modbusBridge.dataCount, writeData, modbusBridge.count);
+  if (error)
+    AddLog(LOG_LEVEL_DEBUG, PSTR("MBS: MBR Driver send error %u"), error);
   free(writeData);
   ResponseCmndDone();
 }

From 2926a66fe0112900aab2b2d5e371581a3892920f Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 02/15] Added returning of modbus error codes to TCP client
 https://github.com/arendst/Tasmota/issues/9586#issuecomment-1225437630

---
 .../xdrv_63_modbus_bridge.ino                 | 24 ++++++++++++-------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index 208c1f1ac..5d5ac8f5d 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -240,13 +240,6 @@ void ModbusBridgeHandle(void)
     buffer = (uint8_t *)malloc(9 + (modbusBridge.dataCount * 2)); // Addres(1), Function(1), Length(1), Data(1..n), CRC(2)
     uint32_t error = tasmotaModbus->ReceiveBuffer(buffer, modbusBridge.dataCount);
 
-    if (error)
-    {
-      AddLog(LOG_LEVEL_DEBUG, PSTR("MBS: MBR Driver receive error %d"), error);
-      free(buffer);
-      return;
-    }
-
 #ifdef USE_MODBUS_BRIDGE_TCP
     for (uint32_t i = 0; i < nitems(modbusBridgeTCP.client_tcp); i++)
     {
@@ -261,7 +254,15 @@ void ModbusBridgeHandle(void)
         header[3] = 0;
         header[6] = buffer[0]; // Send slave address
         header[7] = buffer[1]; // Send function code
-        if (buffer[1] <= 4) 
+        if (error)
+        {
+          header[4] = 0; // Message Length Hi-Byte
+          header[5] = 3; // Message Length Low-Byte
+          header[8] = error;
+          nrOfBytes += 1;
+          client.write(header, 9);
+        }
+        else if (buffer[1] <= 4) 
         {
           header[4] = ((modbusBridge.dataCount * 2) + 3) >> 8;
           header[5] = (modbusBridge.dataCount * 2) + 3;
@@ -285,6 +286,13 @@ void ModbusBridgeHandle(void)
     }
 #endif
 
+    if (error)
+    {
+      AddLog(LOG_LEVEL_DEBUG, PSTR("MBS: MBR Driver receive error %d"), error);
+      free(buffer);
+      return;
+    }
+
     ModbusBridgeError errorcode = ModbusBridgeError::noerror;
     if (modbusBridge.deviceAddress == 0)
     {

From a5782f2ca06a43dbad25436e82a422c638fea4f3 Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 03/15] Added usefull url to comments

---
 tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index 5d5ac8f5d..46cb50697 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -35,6 +35,8 @@
  *
  *   -- Write multiple coils --
  *   ModbusSend {"deviceaddress": 1, "functioncode": 15, "startaddress": 1, "type":"uint16", "count":4, "values":[1,2,3,4]}
+ * 
+ * Info for modbusBridgeTCPServer: https://ipc2u.com/articles/knowledge-base/detailed-description-of-the-modbus-tcp-protocol-with-command-examples/
 \*********************************************************************************************/
 
 #define XDRV_63 63

From 2e111dc1129e21002bd656b714bc521b46fc249c Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 04/15] Added RX and TX logging in TasmotaModbus driver

---
 .../TasmotaModbus-3.5.0/src/TasmotaModbus.cpp | 59 ++++++++++++++-----
 1 file changed, 44 insertions(+), 15 deletions(-)

diff --git a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
index af80bed5e..a45dd81e2 100644
--- a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
+++ b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
@@ -19,8 +19,13 @@
   Documentation about modbus protocol: https://www.modbustools.com/modbus.html
 */
 
+#include "Arduino.h"
 #include "TasmotaModbus.h"
 
+extern void AddLog(uint32_t loglevel, PGM_P formatP, ...);
+enum LoggingLevels {LOG_LEVEL_NONE, LOG_LEVEL_ERROR, LOG_LEVEL_INFO, LOG_LEVEL_DEBUG, LOG_LEVEL_DEBUG_MORE};
+
+
 TasmotaModbus::TasmotaModbus(int receive_pin, int transmit_pin) : TasmotaSerial(receive_pin, transmit_pin, 1)
 {
   mb_address = 0;
@@ -135,7 +140,17 @@ uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint1
   uint16_t crc = CalculateCRC(frame, framepointer);
   frame[framepointer++] = (uint8_t)(crc);
   frame[framepointer++] = (uint8_t)(crc >> 8);
-
+  
+  uint8_t *buf;
+  uint16_t bufsize=(framepointer + 1) * 3;
+  buf = (uint8_t *)malloc(bufsize);
+  memset(buf, 0, bufsize);
+  uint16_t i;
+  for (i = 0; i < framepointer;i++)
+    snprintf((char *)&buf[i*3], (bufsize-i*3), "%02X ",frame[i]);
+  AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBR Serial Send: %s"), buf);
+  free(buf);
+  
   flush();
   write(frame, framepointer);
   free(frame);
@@ -162,20 +177,6 @@ uint8_t TasmotaModbus::ReceiveBuffer(uint8_t *buffer, uint8_t data_count)
       } else {
         buffer[mb_len++] = data;
         if (3 == mb_len) {
-          if (buffer[1] & 0x80) {  // 01 84 02 f2 f1
-            if (0 == buffer[2]) {
-              return 3;            // 3 = Illegal Data Value,
-            }
-            return buffer[2];      // 1 = Illegal Function,
-                                   // 2 = Illegal Data Address,
-                                   // 3 = Illegal Data Value,
-                                   // 4 = Slave Error
-                                   // 5 = Acknowledge but not finished (no error)
-                                   // 6 = Slave Busy
-                                   // 8 = Memory Parity error
-                                   // 10 = Gateway Path Unavailable
-                                   // 11 = Gateway Target device failed to respond
-          }
           if ((buffer[1] == 5) || (buffer[1] == 6) || (buffer[1] == 15) || (buffer[1] == 16)) header_length = 4; // Addr, Func, StartAddr
         }
       }
@@ -185,6 +186,34 @@ uint8_t TasmotaModbus::ReceiveBuffer(uint8_t *buffer, uint8_t data_count)
     }
   }
 
+// RX Logging
+  uint8_t *buf;
+  uint16_t bufsize=(mb_len + 1) * 3;
+  buf = (uint8_t *)malloc(bufsize);
+  memset(buf, 0, bufsize);
+  uint16_t i;
+  for (i = 0; i < mb_len;i++)
+    snprintf((char *)&buf[i*3], (bufsize-i*3), "%02X ",buffer[i]);
+  AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBR Serial Received: %s"), buf);
+  free(buf);
+
+  if (buffer[1] & 0x80)
+  { // 01 84 02 f2 f1
+    if (0 == buffer[2])
+    {
+      return 3; // 3 = Illegal Data Value,
+    }
+    return buffer[2]; // 1 = Illegal Function,
+                      // 2 = Illegal Data Address,
+                      // 3 = Illegal Data Value,
+                      // 4 = Slave Error
+                      // 5 = Acknowledge but not finished (no error)
+                      // 6 = Slave Busy
+                      // 8 = Memory Parity error
+                      // 10 = Gateway Path Unavailable
+                      // 11 = Gateway Target device failed to respond
+  }
+  
   if (mb_len < 6) { return 7; }  // 7 = Not enough data
 
 /*

From e292fdd6f56e95ea20e1acdf633cca969ca4847e Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 05/15] Removed MBR from modbus serial logging

---
 lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
index a45dd81e2..047e07b5a 100644
--- a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
+++ b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
@@ -148,7 +148,7 @@ uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint1
   uint16_t i;
   for (i = 0; i < framepointer;i++)
     snprintf((char *)&buf[i*3], (bufsize-i*3), "%02X ",frame[i]);
-  AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBR Serial Send: %s"), buf);
+  AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: Serial Send: %s"), buf);
   free(buf);
   
   flush();
@@ -194,7 +194,7 @@ uint8_t TasmotaModbus::ReceiveBuffer(uint8_t *buffer, uint8_t data_count)
   uint16_t i;
   for (i = 0; i < mb_len;i++)
     snprintf((char *)&buf[i*3], (bufsize-i*3), "%02X ",buffer[i]);
-  AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBR Serial Received: %s"), buf);
+  AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: Serial Received: %s"), buf);
   free(buf);
 
   if (buffer[1] & 0x80)

From fea41407acf2d4d1a5126b8473241c8ead56d401 Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 06/15] changed wrong copying of tcp data to writedata

---
 tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index 46cb50697..8c9d5cbea 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -644,8 +644,8 @@ void ModbusTCPHandle(void)
           writeData = (uint16_t *)malloc(dataSendCount);
           for (uint8_t dataPointer = 0; dataPointer < dataSendCount; dataPointer++)
           {
-            writeData[dataPointer] = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte+dataPointer]) << 8) 
-                            | ((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte + 1 + dataPointer]));
+            writeData[dataPointer] = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte+(dataPointer*2)]) << 8) 
+                            | ((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte + 1 + (dataPointer*2)]));
           }
         }
 

From d33394881688c760ac17bb4f0c432fa76bc49be2 Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 07/15] Solved ModbusTCP writing wrong registers

---
 tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index 8c9d5cbea..f8c0a04c6 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -646,13 +646,14 @@ void ModbusTCPHandle(void)
           {
             writeData[dataPointer] = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte+(dataPointer*2)]) << 8) 
                             | ((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte + 1 + (dataPointer*2)]));
+            AddLog(LOG_LEVEL_DEBUG_MORE, "%d=%04X", dataPointer, writeData[dataPointer]);
           }
         }
 
         AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus Transactionid:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, sendCount:%d, recvCount:%d"),
                modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, dataSendCount, modbusBridge.dataCount);
 
-        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, modbusBridge.dataCount, writeData, dataSendCount);
+        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, dataSendCount, writeData);
 
         free(writeData);
       }

From ffcdce604151a83f325dc2eae6067e7aa3b56511 Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 08/15] Fixed FC16
 https://github.com/arendst/Tasmota/issues/9586#issuecomment-1226120239

---
 tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index f8c0a04c6..6fa1ed4e7 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -634,11 +634,12 @@ void ModbusTCPHandle(void)
         if (mbfunctioncode <= 4)
         {
           modbusBridge.dataCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+          dataSendCount = 1;
         }
         else
         {
           // For functioncode 15 & 16 ignore bytecount, tasmotaModbus does calculate this
-          uint8_t dataStartByte = mbfunctioncode <= 6 ? 10 : 11;
+          uint8_t dataStartByte = mbfunctioncode <= 6 ? 10 : 13;
           modbusBridge.dataCount = 1;
           dataSendCount = (buf_len - dataStartByte) / 2;
           writeData = (uint16_t *)malloc(dataSendCount);
@@ -653,7 +654,7 @@ void ModbusTCPHandle(void)
         AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus Transactionid:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, sendCount:%d, recvCount:%d"),
                modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, dataSendCount, modbusBridge.dataCount);
 
-        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, dataSendCount, writeData);
+        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, dataSendCount, writeData, modbusBridge.dataCount);
 
         free(writeData);
       }

From 5bd28954fa00c27455243e4ef4f3f49705fbd84f Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 09/15] Fixed reading functioncode 1 & 2 for ModbusTCP Returned
 bytes need to be even (limitation of TasmotaModbus.cpp)
 https://github.com/arendst/Tasmota/issues/9586

---
 .../xdrv_63_modbus_bridge.ino                 | 40 ++++++++++++++-----
 1 file changed, 30 insertions(+), 10 deletions(-)

diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index 6fa1ed4e7..a9038a906 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -240,6 +240,7 @@ void ModbusBridgeHandle(void)
   {
     uint8_t *buffer;
     buffer = (uint8_t *)malloc(9 + (modbusBridge.dataCount * 2)); // Addres(1), Function(1), Length(1), Data(1..n), CRC(2)
+    memset(buffer, 0, 9 + (modbusBridge.dataCount * 2));
     uint32_t error = tasmotaModbus->ReceiveBuffer(buffer, modbusBridge.dataCount);
 
 #ifdef USE_MODBUS_BRIDGE_TCP
@@ -260,10 +261,21 @@ void ModbusBridgeHandle(void)
         {
           header[4] = 0; // Message Length Hi-Byte
           header[5] = 3; // Message Length Low-Byte
+          header[7] = buffer[1] | 0x80; // Send function code
           header[8] = error;
           nrOfBytes += 1;
           client.write(header, 9);
         }
+        else if (buffer[1] <= 2) 
+        {
+          header[4] = ((modbusBridge.dataCount * 2) + 3) >> 8;
+          header[5] = (modbusBridge.dataCount * 2) + 3;
+          header[8] = modbusBridge.dataCount * 2;
+          client.write(header, 9);
+          nrOfBytes += 1;
+          client.write(buffer + 3, modbusBridge.dataCount * 2); // Don't send CRC
+          nrOfBytes += modbusBridge.dataCount * 2;
+        }
         else if (buffer[1] <= 4) 
         {
           header[4] = ((modbusBridge.dataCount * 2) + 3) >> 8;
@@ -627,23 +639,31 @@ void ModbusTCPHandle(void)
         uint8_t mbfunctioncode = (uint8_t)modbusBridgeTCP.tcp_buf[7];
         uint16_t mbstartaddress = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[8]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[9]));
         uint16_t *writeData = NULL;
+        uint16_t bitCount = 0;
+        uint16_t registerCount = 0;
 
         modbusBridgeTCP.tcp_transaction_id = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[0]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[1]));
-        uint8_t dataSendCount = 0;
 
-        if (mbfunctioncode <= 4)
+        if (mbfunctioncode <= 2)
         {
-          modbusBridge.dataCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
-          dataSendCount = 1;
+          // Odd number of bytes for registers is not supported at this moment
+          registerCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+          modbusBridge.dataCount = ((registerCount - 1) >> 4) + 1; 
+        }
+        else if (mbfunctioncode <= 4)
+        {
+          registerCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+          modbusBridge.dataCount = registerCount;
         }
         else
         {
           // For functioncode 15 & 16 ignore bytecount, tasmotaModbus does calculate this
           uint8_t dataStartByte = mbfunctioncode <= 6 ? 10 : 13;
+          registerCount = (buf_len - dataStartByte) / 2;
           modbusBridge.dataCount = 1;
-          dataSendCount = (buf_len - dataStartByte) / 2;
-          writeData = (uint16_t *)malloc(dataSendCount);
-          for (uint8_t dataPointer = 0; dataPointer < dataSendCount; dataPointer++)
+          writeData = (uint16_t *)malloc(registerCount);
+          if (mbfunctioncode == 15) bitCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+          for (uint8_t dataPointer = 0; dataPointer < registerCount; dataPointer++)
           {
             writeData[dataPointer] = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte+(dataPointer*2)]) << 8) 
                             | ((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte + 1 + (dataPointer*2)]));
@@ -651,10 +671,10 @@ void ModbusTCPHandle(void)
           }
         }
 
-        AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus Transactionid:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, sendCount:%d, recvCount:%d"),
-               modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, dataSendCount, modbusBridge.dataCount);
+        AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus TransactionId:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, registerCount:%d, recvCount:%d bitCount:%d"),
+               modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, registerCount, modbusBridge.dataCount, bitCount);
 
-        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, dataSendCount, writeData, modbusBridge.dataCount);
+        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, registerCount, writeData, bitCount);
 
         free(writeData);
       }

From 9c11eb41d47a623448eda52ae648074005f480da Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 10/15] Changed Modbus to also support nr of bytes for
 functioncode 1,2 & 15.
 https://ozeki.hu/p_5876-mobdbus-function-code-1-read-coils.html

---
 .../TasmotaModbus-3.5.0/src/TasmotaModbus.cpp | 16 ++++----
 .../TasmotaModbus-3.5.0/src/TasmotaModbus.h   |  7 +++-
 .../xdrv_63_modbus_bridge.ino                 | 39 +++++++++++--------
 3 files changed, 35 insertions(+), 27 deletions(-)

diff --git a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
index 047e07b5a..19a438b0d 100644
--- a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
+++ b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
@@ -60,18 +60,18 @@ int TasmotaModbus::Begin(long speed, uint32_t config)
   return result;
 }
 
-uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t register_count, uint16_t *registers, uint16_t bit_count)
+uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t register_count, uint16_t *registers, uint16_t bit_count, uint16_t byte_count)
 {
   uint8_t *frame;
   uint8_t framepointer = 0;
-
+  if (byte_count == 0) byte_count = register_count * 2;
   if (function_code < 7)
   {
     frame = (uint8_t *)malloc(8); // Addres(1), Function(1), Start/Coil Address(2), Registercount or Data (2), CRC(2)
   }
   else
   {
-    frame = (uint8_t *)malloc(9 + (register_count * 2)); // Addres(1), Function(1), Start/Coil Address(2),Quantity of registers (2), Bytecount(1), Data(1..n), CRC(2)
+    frame = (uint8_t *)malloc(9 + byte_count); // Addres(1), Function(1), Start/Coil Address(2),Quantity of registers (2), Bytecount(1), Data(1..n), CRC(2)
   }
 
   mb_address = device_address;  // Save address for receipt check
@@ -125,10 +125,9 @@ uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint1
       free(frame);
       return 12; // Wrong register count
     }
-    for (int registerpointer = 0; registerpointer < register_count; registerpointer++)
+    for (int bytepointer = 0; bytepointer < byte_count; bytepointer++)
     {
-      frame[framepointer++] = (uint8_t)(registers[registerpointer] >> 8);  // MSB
-      frame[framepointer++] = (uint8_t)(registers[registerpointer]);       // LSB
+      frame[framepointer++] = (uint8_t)(registers[bytepointer/2] >> (byte_count % 2 ? 0 : 1));  // MSB, LSB, MSB ....
     }
   }
   else 
@@ -162,12 +161,13 @@ bool TasmotaModbus::ReceiveReady()
   return (available() > 4);
 }
 
-uint8_t TasmotaModbus::ReceiveBuffer(uint8_t *buffer, uint8_t data_count)
+uint8_t TasmotaModbus::ReceiveBuffer(uint8_t *buffer, uint8_t register_count, uint16_t byte_count)
 {
   mb_len = 0;
   uint32_t timeout = millis() + 10;
   uint8_t header_length = 3;
-  while ((mb_len < (data_count * 2) + header_length + 2) && (millis() < timeout)) {
+  if (byte_count == 0) byte_count = (register_count * 2);
+  while ((mb_len < byte_count + header_length + 2) && (millis() < timeout)) {
     if (available()) {
       uint8_t data = (uint8_t)read();
       if (!mb_len) {               // Skip leading data as provided by hardware serial
diff --git a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h
index b5fe65a7f..19e631baf 100644
--- a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h
+++ b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h
@@ -53,8 +53,11 @@ class TasmotaModbus : public TasmotaSerial {
      * 13 = Register data not specified
      * 14 = To many registers
      */
-    uint8_t Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t register_count, uint16_t *registers = NULL, uint16_t bit_count = 0);
-    uint8_t ReceiveBuffer(uint8_t *buffer, uint8_t register_count);
+    uint8_t Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t register_count, uint16_t *registers = NULL, uint16_t bit_count = 0, uint16_t byte_count = 0);
+    // Registercount is nr of registers for function code 3,4 and 16, 1 for function code 5 & 6 and nr of coils/inputs for function code 1,2 and 15
+    // Bitcount is used for function code 15 to specify how many bits have to be set
+    // Bytecount is used for function code 1,2 and 15 to specify how many bytes have to be written
+    uint8_t ReceiveBuffer(uint8_t *buffer, uint8_t register_count, uint16_t byte_count = 0);
     uint8_t Receive8BitRegister(uint8_t *value);
     uint8_t Receive16BitRegister(uint16_t *value);
     uint8_t Receive32BitRegister(float *value);
diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index a9038a906..ddac4f9bc 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -155,6 +155,7 @@ struct ModbusBridge
   ModbusBridgeType type = ModbusBridgeType::mb_undefined;
 
   uint16_t dataCount = 0;
+  uint16_t byteCount = 0;
   uint16_t startAddress = 0;
   uint8_t deviceAddress = 0;
   uint8_t count = 0;
@@ -239,9 +240,10 @@ void ModbusBridgeHandle(void)
   if (data_ready)
   {
     uint8_t *buffer;
-    buffer = (uint8_t *)malloc(9 + (modbusBridge.dataCount * 2)); // Addres(1), Function(1), Length(1), Data(1..n), CRC(2)
-    memset(buffer, 0, 9 + (modbusBridge.dataCount * 2));
-    uint32_t error = tasmotaModbus->ReceiveBuffer(buffer, modbusBridge.dataCount);
+    if (modbusBridge.byteCount == 0) modbusBridge.byteCount = modbusBridge.dataCount * 2;
+    buffer = (uint8_t *)malloc(9 + modbusBridge.byteCount); // Addres(1), Function(1), Length(1), Data(1..n), CRC(2)
+    memset(buffer, 0, 9 + modbusBridge.byteCount);
+    uint32_t error = tasmotaModbus->ReceiveBuffer(buffer, modbusBridge.byteCount);
 
 #ifdef USE_MODBUS_BRIDGE_TCP
     for (uint32_t i = 0; i < nitems(modbusBridgeTCP.client_tcp); i++)
@@ -268,23 +270,23 @@ void ModbusBridgeHandle(void)
         }
         else if (buffer[1] <= 2) 
         {
-          header[4] = ((modbusBridge.dataCount * 2) + 3) >> 8;
-          header[5] = (modbusBridge.dataCount * 2) + 3;
-          header[8] = modbusBridge.dataCount * 2;
+          header[4] = modbusBridge.byteCount >> 8;
+          header[5] = modbusBridge.byteCount + 3;
+          header[8] = modbusBridge.byteCount;
           client.write(header, 9);
           nrOfBytes += 1;
-          client.write(buffer + 3, modbusBridge.dataCount * 2); // Don't send CRC
-          nrOfBytes += modbusBridge.dataCount * 2;
+          client.write(buffer + 3, modbusBridge.byteCount); // Don't send CRC
+          nrOfBytes += modbusBridge.byteCount;
         }
         else if (buffer[1] <= 4) 
         {
-          header[4] = ((modbusBridge.dataCount * 2) + 3) >> 8;
-          header[5] = (modbusBridge.dataCount * 2) + 3;
-          header[8] = modbusBridge.dataCount * 2;
+          header[4] = modbusBridge.byteCount >> 8;
+          header[5] = modbusBridge.byteCount + 3;
+          header[8] = modbusBridge.byteCount;
           client.write(header, 9);
           nrOfBytes += 1;
-          client.write(buffer + 3, (modbusBridge.dataCount * 2)); // Don't send CRC
-          nrOfBytes += modbusBridge.dataCount * 2;
+          client.write(buffer + 3, modbusBridge.byteCount); // Don't send CRC
+          nrOfBytes += modbusBridge.byteCount;
         }
         else
         {
@@ -646,13 +648,15 @@ void ModbusTCPHandle(void)
 
         if (mbfunctioncode <= 2)
         {
-          // Odd number of bytes for registers is not supported at this moment
+          // Odd number of bytes for registers is not supported at this moment (TasmotaModbus reads registers (words) not bytes)
           registerCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+          modbusBridge.byteCount = ((registerCount - 1) >> 3) + 1; 
           modbusBridge.dataCount = ((registerCount - 1) >> 4) + 1; 
         }
         else if (mbfunctioncode <= 4)
         {
           registerCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+          modbusBridge.byteCount = registerCount * 2;
           modbusBridge.dataCount = registerCount;
         }
         else
@@ -660,6 +664,7 @@ void ModbusTCPHandle(void)
           // For functioncode 15 & 16 ignore bytecount, tasmotaModbus does calculate this
           uint8_t dataStartByte = mbfunctioncode <= 6 ? 10 : 13;
           registerCount = (buf_len - dataStartByte) / 2;
+          modbusBridge.byteCount = 2;
           modbusBridge.dataCount = 1;
           writeData = (uint16_t *)malloc(registerCount);
           if (mbfunctioncode == 15) bitCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
@@ -671,10 +676,10 @@ void ModbusTCPHandle(void)
           }
         }
 
-        AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus TransactionId:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, registerCount:%d, recvCount:%d bitCount:%d"),
-               modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, registerCount, modbusBridge.dataCount, bitCount);
+        AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus TransactionId:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, registerCount:%d, recvCount:%d bitCount:%d bytecount:%d"),
+               modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, registerCount, modbusBridge.dataCount, bitCount, modbusBridge.byteCount);
 
-        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, registerCount, writeData, bitCount);
+        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, registerCount, writeData, bitCount, modbusBridge.byteCount);
 
         free(writeData);
       }

From 1ac5b6fd7f0c3504e4e8c05cb6180ad3f0474886 Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 11/15] Rework in progress ModbusTCP fully tested OK Modbus via
 Commands: function 1..5 tested ok function 6 fail function 15 & 16 not tested

---
 .../TasmotaModbus-3.5.0/src/TasmotaModbus.cpp | 41 ++++-----
 .../TasmotaModbus-3.5.0/src/TasmotaModbus.h   |  9 +-
 .../xdrv_63_modbus_bridge.ino                 | 90 ++++++++++++-------
 3 files changed, 80 insertions(+), 60 deletions(-)

diff --git a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
index 19a438b0d..e2c9f4182 100644
--- a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
+++ b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
@@ -60,11 +60,14 @@ int TasmotaModbus::Begin(long speed, uint32_t config)
   return result;
 }
 
-uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t register_count, uint16_t *registers, uint16_t bit_count, uint16_t byte_count)
+uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t count, uint16_t *write_data)
 {
   uint8_t *frame;
   uint8_t framepointer = 0;
-  if (byte_count == 0) byte_count = register_count * 2;
+
+  uint16_t byte_count = count * 2; // In register mode count is nr of registers (2 bytes)
+  if ((function_code == 1) || (function_code == 2) || (function_code == 15)) byte_count = (count / 8) + 1; // In bitmode count is nr of bits
+
   if (function_code < 7)
   {
     frame = (uint8_t *)malloc(8); // Addres(1), Function(1), Start/Coil Address(2), Registercount or Data (2), CRC(2)
@@ -82,52 +85,44 @@ uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint1
   frame[framepointer++] = (uint8_t)(start_address);        // LSB
   if (function_code < 5)
   {
-    frame[framepointer++] = (uint8_t)(register_count >> 8);  // MSB
-    frame[framepointer++] = (uint8_t)(register_count);       // LSB
+    frame[framepointer++] = (uint8_t)(count >> 8);  // MSB
+    frame[framepointer++] = (uint8_t)(count);       // LSB
   }
   else if ((function_code == 5) || (function_code == 6))
   {
-    if (registers == NULL) 
+    if (write_data == NULL) 
     {
       free(frame);
       return 13; // Register data not specified
     }
-    if (register_count != 1)
+    if (count != 1)
     {
       free(frame);
       return 12; // Wrong register count
     }
-    frame[framepointer++] = (uint8_t)(registers[0] >> 8);  // MSB
-    frame[framepointer++] = (uint8_t)(registers[0]);       // LSB
+    frame[framepointer++] = (uint8_t)(write_data[0] >> 8);  // MSB
+    frame[framepointer++] = (uint8_t)(write_data[0]);       // LSB
   }
   else if ((function_code == 15) || (function_code == 16))
   {
-    if (function_code == 15)
-    {
-      frame[framepointer++] = (uint8_t)(bit_count >> 8);   // MSB
-      frame[framepointer++] = (uint8_t)(bit_count);        // LSB
-    }
-    else
-    {
-      frame[framepointer++] = (uint8_t)(register_count >> 8);   // MSB
-      frame[framepointer++] = (uint8_t)(register_count);        // LSB
-    }
+    frame[framepointer++] = (uint8_t)(count >> 8);   // MSB
+    frame[framepointer++] = (uint8_t)(count);        // LSB
     
-    frame[framepointer++] = register_count * 2;
+    frame[framepointer++] = byte_count;
 
-    if (registers == NULL) 
+    if (write_data == NULL) 
     {
       free(frame);
       return 13; // Register data not specified
     }
-    if (register_count == 0)
+    if (count == 0)
     {
       free(frame);
       return 12; // Wrong register count
     }
-    for (int bytepointer = 0; bytepointer < byte_count; bytepointer++)
+    for (uint16_t bytepointer = 0; bytepointer < byte_count; bytepointer++)
     {
-      frame[framepointer++] = (uint8_t)(registers[bytepointer/2] >> (byte_count % 2 ? 0 : 1));  // MSB, LSB, MSB ....
+      frame[framepointer++] = (uint8_t)(write_data[bytepointer/2] >> (byte_count % 2 ? 0 : 1));  // MSB, LSB, MSB ....
     }
   }
   else 
diff --git a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h
index 19e631baf..520bb166d 100644
--- a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h
+++ b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.h
@@ -53,11 +53,12 @@ class TasmotaModbus : public TasmotaSerial {
      * 13 = Register data not specified
      * 14 = To many registers
      */
-    uint8_t Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t register_count, uint16_t *registers = NULL, uint16_t bit_count = 0, uint16_t byte_count = 0);
-    // Registercount is nr of registers for function code 3,4 and 16, 1 for function code 5 & 6 and nr of coils/inputs for function code 1,2 and 15
-    // Bitcount is used for function code 15 to specify how many bits have to be set
-    // Bytecount is used for function code 1,2 and 15 to specify how many bytes have to be written
+    uint8_t Send(uint8_t device_address, uint8_t function_code, uint16_t start_address, uint16_t count, uint16_t *writeData = NULL);
+    // Count is nr of registers for function code 3,4,6 and 16, nr of coils/inputs for function code 1,2 and 15 and must be 1 for function code 5 and 6
+
     uint8_t ReceiveBuffer(uint8_t *buffer, uint8_t register_count, uint16_t byte_count = 0);
+    // Bytecount is mandatory for functioncode 1 and 2 because they can return an odd number of bytes.
+
     uint8_t Receive8BitRegister(uint8_t *value);
     uint8_t Receive16BitRegister(uint16_t *value);
     uint8_t Receive32BitRegister(float *value);
diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index ddac4f9bc..8296b2327 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -34,9 +34,15 @@
  *   ModbusSend {"deviceaddress": 1, "functioncode": 3, "startaddress": 1, "type":"uint16", "count":2}
  *
  *   -- Write multiple coils --
- *   ModbusSend {"deviceaddress": 1, "functioncode": 15, "startaddress": 1, "type":"uint16", "count":4, "values":[1,2,3,4]}
+ *   ModbusSend {"deviceaddress": 1, "functioncode": 15, "startaddress": 1, "type":"bit", "count":4, "values":[1,0,1,1]}
  * 
- * Info for modbusBridgeTCPServer: https://ipc2u.com/articles/knowledge-base/detailed-description-of-the-modbus-tcp-protocol-with-command-examples/
+ * Info for modbusBridgeTCPServer: 
+ *    https://ipc2u.com/articles/knowledge-base/detailed-description-of-the-modbus-tcp-protocol-with-command-examples/
+ * 
+ * Info for modbus serial communications:
+ *    https://ozeki.hu/p_5879-mobdbus-function-code-4-read-input-registers.html
+ *    https://www.modbustools.com/modbus.html
+ *    https://ipc2u.com/articles/knowledge-base/modbus-rtu-made-simple-with-detailed-descriptions-and-examples/
 \*********************************************************************************************/
 
 #define XDRV_63 63
@@ -243,7 +249,8 @@ void ModbusBridgeHandle(void)
     if (modbusBridge.byteCount == 0) modbusBridge.byteCount = modbusBridge.dataCount * 2;
     buffer = (uint8_t *)malloc(9 + modbusBridge.byteCount); // Addres(1), Function(1), Length(1), Data(1..n), CRC(2)
     memset(buffer, 0, 9 + modbusBridge.byteCount);
-    uint32_t error = tasmotaModbus->ReceiveBuffer(buffer, modbusBridge.byteCount);
+    uint32_t error = tasmotaModbus->ReceiveBuffer(buffer, 0, modbusBridge.byteCount);
+    modbusBridge.byteCount = 0;
 
 #ifdef USE_MODBUS_BRIDGE_TCP
     for (uint32_t i = 0; i < nitems(modbusBridgeTCP.client_tcp); i++)
@@ -376,6 +383,7 @@ void ModbusBridgeHandle(void)
       else if ((buffer[1] > 0) && (buffer[1] < 7)) // Read Registers
       {
         uint8_t dataOffset = 3;
+        if (buffer[1] == 6) dataOffset = 4;
         Response_P(PSTR("{\"" D_JSON_MODBUS_RECEIVED "\":{"));
         ResponseAppend_P(PSTR("\"" D_JSON_MODBUS_DEVICE_ADDRESS "\":%d,"), buffer[0]);
         ResponseAppend_P(PSTR("\"" D_JSON_MODBUS_FUNCTION_CODE "\":%d,"), buffer[1]);
@@ -641,45 +649,55 @@ void ModbusTCPHandle(void)
         uint8_t mbfunctioncode = (uint8_t)modbusBridgeTCP.tcp_buf[7];
         uint16_t mbstartaddress = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[8]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[9]));
         uint16_t *writeData = NULL;
-        uint16_t bitCount = 0;
-        uint16_t registerCount = 0;
+        uint16_t count = 0;
 
         modbusBridgeTCP.tcp_transaction_id = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[0]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[1]));
 
         if (mbfunctioncode <= 2)
         {
           // Odd number of bytes for registers is not supported at this moment (TasmotaModbus reads registers (words) not bytes)
-          registerCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
-          modbusBridge.byteCount = ((registerCount - 1) >> 3) + 1; 
-          modbusBridge.dataCount = ((registerCount - 1) >> 4) + 1; 
+          count = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+          modbusBridge.byteCount = ((count - 1) >> 3) + 1; 
+          modbusBridge.dataCount = ((count - 1) >> 4) + 1; 
         }
         else if (mbfunctioncode <= 4)
         {
-          registerCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
-          modbusBridge.byteCount = registerCount * 2;
-          modbusBridge.dataCount = registerCount;
+          count = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+          modbusBridge.byteCount = count * 2;
+          modbusBridge.dataCount = count;
         }
         else
         {
           // For functioncode 15 & 16 ignore bytecount, tasmotaModbus does calculate this
           uint8_t dataStartByte = mbfunctioncode <= 6 ? 10 : 13;
-          registerCount = (buf_len - dataStartByte) / 2;
+          uint16_t byteCount = (buf_len - dataStartByte);
           modbusBridge.byteCount = 2;
           modbusBridge.dataCount = 1;
-          writeData = (uint16_t *)malloc(registerCount);
-          if (mbfunctioncode == 15) bitCount = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
-          for (uint8_t dataPointer = 0; dataPointer < registerCount; dataPointer++)
+
+          writeData = (uint16_t *)malloc((byteCount / 2)+1);
+          
+          if ((mbfunctioncode == 15) || (mbfunctioncode == 16)) count = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
+          else count = 1;
+          
+          for (uint16_t dataPointer = 0; dataPointer < byteCount; dataPointer++)
           {
-            writeData[dataPointer] = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte+(dataPointer*2)]) << 8) 
-                            | ((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte + 1 + (dataPointer*2)]));
-            AddLog(LOG_LEVEL_DEBUG_MORE, "%d=%04X", dataPointer, writeData[dataPointer]);
+            if (dataPointer % 2 == 0)
+            {
+              writeData[dataPointer / 2] = (uint16_t)(((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte + dataPointer]) << 8);
+              AddLog(LOG_LEVEL_DEBUG_MORE, "%d=%04X", dataPointer/2, writeData[dataPointer/2]);
+            }
+            else
+            { 
+              writeData[dataPointer / 2] |= ((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte + dataPointer]);
+              AddLog(LOG_LEVEL_DEBUG_MORE, "%d=%04X", dataPointer/2, writeData[dataPointer/2]);
+            }
           }
         }
 
-        AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus TransactionId:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, registerCount:%d, recvCount:%d bitCount:%d bytecount:%d"),
-               modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, registerCount, modbusBridge.dataCount, bitCount, modbusBridge.byteCount);
+        AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus TransactionId:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, count:%d, recvCount:%d"),
+               modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, count, modbusBridge.dataCount);
 
-        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, registerCount, writeData, bitCount, modbusBridge.byteCount);
+        tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, count, writeData);
 
         free(writeData);
       }
@@ -731,7 +749,8 @@ void CmndModbusBridgeSend(void)
   if (strcmp(stype, "int8") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_int8;
-    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
+    modbusBridge.dataCount = bitMode ? modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
+    if (bitMode) modbusBridge.byteCount = (modbusBridge.count / 8) + 1;
   }
   else if (strcmp(stype, "int16") == 0)
   {
@@ -741,12 +760,12 @@ void CmndModbusBridgeSend(void)
   else if (strcmp(stype, "int32") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_int32;
-    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : 2 * modbusBridge.count;
+    modbusBridge.dataCount = bitMode ? modbusBridge.count : 2 * modbusBridge.count;
   }
   else if ((strcmp(stype, "uint8") == 0))
   {
     modbusBridge.type = ModbusBridgeType::mb_uint8;
-    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
+    modbusBridge.dataCount = bitMode ? modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
   }
   else if ((strcmp(stype, "uint16") == 0) || (strcmp(stype, "") == 0)) // Default is uint16
   {
@@ -756,27 +775,27 @@ void CmndModbusBridgeSend(void)
   else if (strcmp(stype, "uint32") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_uint32;
-    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : 2 * modbusBridge.count;
+    modbusBridge.dataCount = bitMode ? modbusBridge.count : 2 * modbusBridge.count;
   }
   else if (strcmp(stype, "float") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_float;
-    modbusBridge.dataCount = bitMode ? 2 * modbusBridge.count : modbusBridge.dataCount = modbusBridge.count;
+    modbusBridge.dataCount = bitMode ? 2 * modbusBridge.count : modbusBridge.count;
   }
   else if (strcmp(stype, "raw") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_raw;
-    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
+    modbusBridge.dataCount = bitMode ? modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
   }
   else if (strcmp(stype, "hex") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_hex;
-    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
+    modbusBridge.dataCount = bitMode ? modbusBridge.count : ((modbusBridge.count - 1) / 2) + 1;
   }
   else if (strcmp(stype, "bit") == 0)
   {
     modbusBridge.type = ModbusBridgeType::mb_bit;
-    modbusBridge.dataCount = bitMode ? modbusBridge.dataCount = modbusBridge.count : ((modbusBridge.count - 1) / 16) + 1 ;
+    modbusBridge.dataCount = bitMode ? modbusBridge.count : ((modbusBridge.count - 1) / 16) + 1 ;
   }
   else
     errorcode = ModbusBridgeError::wrongtype;
@@ -785,7 +804,7 @@ void CmndModbusBridgeSend(void)
   // of bit to write, so calculate the number data bytes to write.
   if (modbusBridge.functionCode == ModbusBridgeFunctionCode::mb_writeMultipleCoils)
   {
-    modbusBridge.dataCount = (((modbusBridge.count - 1) / 16) + 1);
+    modbusBridge.dataCount = modbusBridge.count;
   }
 
   // Prevent buffer overflow due to usage of to many registers
@@ -825,6 +844,7 @@ void CmndModbusBridgeSend(void)
     case ModbusBridgeFunctionCode::mb_writeSingleRegister:
     case ModbusBridgeFunctionCode::mb_writeSingleCoil:
       if (modbusBridge.count != 1) errorcode = ModbusBridgeError::wrongcount;
+    break;
     case ModbusBridgeFunctionCode::mb_writeMultipleRegisters:
       if (modbusBridge.count != writeDataSize) errorcode = ModbusBridgeError::wrongcount;
     break;
@@ -931,10 +951,14 @@ void CmndModbusBridgeSend(void)
   if ((modbusBridge.functionCode == ModbusBridgeFunctionCode::mb_writeSingleCoil) || (modbusBridge.functionCode == ModbusBridgeFunctionCode::mb_writeSingleRegister))
     modbusBridge.dataCount = 1;
 
-  uint8_t error = tasmotaModbus->Send(modbusBridge.deviceAddress, (uint8_t)modbusBridge.functionCode, modbusBridge.startAddress, modbusBridge.dataCount, writeData, modbusBridge.count);
-  if (error)
-    AddLog(LOG_LEVEL_DEBUG, PSTR("MBS: MBR Driver send error %u"), error);
+  uint8_t error = tasmotaModbus->Send(modbusBridge.deviceAddress, (uint8_t)modbusBridge.functionCode, modbusBridge.startAddress, modbusBridge.dataCount, writeData);
   free(writeData);
+ 
+  if (error)
+  {
+    AddLog(LOG_LEVEL_DEBUG, PSTR("MBS: MBR Driver send error %u"), error);
+    return;
+  } 
   ResponseCmndDone();
 }
 

From a19edd498399e7500461d18a5d7a27b45d5673f8 Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 09:11:36 +0200
Subject: [PATCH 12/15] Solved endian on uint16

---
 tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index 8296b2327..dd98b1734 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -383,7 +383,6 @@ void ModbusBridgeHandle(void)
       else if ((buffer[1] > 0) && (buffer[1] < 7)) // Read Registers
       {
         uint8_t dataOffset = 3;
-        if (buffer[1] == 6) dataOffset = 4;
         Response_P(PSTR("{\"" D_JSON_MODBUS_RECEIVED "\":{"));
         ResponseAppend_P(PSTR("\"" D_JSON_MODBUS_DEVICE_ADDRESS "\":%d,"), buffer[0]);
         ResponseAppend_P(PSTR("\"" D_JSON_MODBUS_FUNCTION_CODE "\":%d,"), buffer[1]);
@@ -906,7 +905,8 @@ void CmndModbusBridgeSend(void)
           break;
         
         case ModbusBridgeType::mb_uint16:
-          writeData[jsonDataArrayPointer] = (uint16_t)swap_endian16(jsonDataArray[jsonDataArrayPointer].getUInt(0));
+          writeData[jsonDataArrayPointer] = bitMode ? swap_endian16(jsonDataArray[jsonDataArrayPointer].getUInt(0)) 
+            : (int16_t)jsonDataArray[jsonDataArrayPointer].getUInt(0);
           break;
         
         case ModbusBridgeType::mb_int32:

From 37574169a9ddab53993bd9d8992a0ab69f49c1f0 Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 10:19:24 +0200
Subject: [PATCH 13/15] Fixed wrong bytecount

---
 lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
index e2c9f4182..252f3efd4 100644
--- a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
+++ b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
@@ -66,7 +66,7 @@ uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint1
   uint8_t framepointer = 0;
 
   uint16_t byte_count = count * 2; // In register mode count is nr of registers (2 bytes)
-  if ((function_code == 1) || (function_code == 2) || (function_code == 15)) byte_count = (count / 8) + 1; // In bitmode count is nr of bits
+  if ((function_code == 1) || (function_code == 2) || (function_code == 15)) byte_count = ((count-1) / 8) + 1; // In bitmode count is nr of bits
 
   if (function_code < 7)
   {
@@ -122,7 +122,7 @@ uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint1
     }
     for (uint16_t bytepointer = 0; bytepointer < byte_count; bytepointer++)
     {
-      frame[framepointer++] = (uint8_t)(write_data[bytepointer/2] >> (byte_count % 2 ? 0 : 1));  // MSB, LSB, MSB ....
+      frame[framepointer++] = (uint8_t)(write_data[bytepointer/2] >> (bytepointer % 2 ? 0 : 8));  // MSB, LSB, MSB ....
     }
   }
   else 

From f57acac48b53e27779b07cd4800f3afc6a5bca37 Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 10:40:02 +0200
Subject: [PATCH 14/15] Fixed Modbus TCP function 1 & 2 not working

---
 tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index dd98b1734..a90e2b16c 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -250,7 +250,6 @@ void ModbusBridgeHandle(void)
     buffer = (uint8_t *)malloc(9 + modbusBridge.byteCount); // Addres(1), Function(1), Length(1), Data(1..n), CRC(2)
     memset(buffer, 0, 9 + modbusBridge.byteCount);
     uint32_t error = tasmotaModbus->ReceiveBuffer(buffer, 0, modbusBridge.byteCount);
-    modbusBridge.byteCount = 0;
 
 #ifdef USE_MODBUS_BRIDGE_TCP
     for (uint32_t i = 0; i < nitems(modbusBridgeTCP.client_tcp); i++)
@@ -316,6 +315,7 @@ void ModbusBridgeHandle(void)
       return;
     }
 
+    modbusBridge.byteCount = 0;
     ModbusBridgeError errorcode = ModbusBridgeError::noerror;
     if (modbusBridge.deviceAddress == 0)
     {
@@ -654,7 +654,6 @@ void ModbusTCPHandle(void)
 
         if (mbfunctioncode <= 2)
         {
-          // Odd number of bytes for registers is not supported at this moment (TasmotaModbus reads registers (words) not bytes)
           count = (uint16_t)((((uint16_t)modbusBridgeTCP.tcp_buf[10]) << 8) | ((uint16_t)modbusBridgeTCP.tcp_buf[11]));
           modbusBridge.byteCount = ((count - 1) >> 3) + 1; 
           modbusBridge.dataCount = ((count - 1) >> 4) + 1; 
@@ -693,8 +692,8 @@ void ModbusTCPHandle(void)
           }
         }
 
-        AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus TransactionId:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, count:%d, recvCount:%d"),
-               modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, count, modbusBridge.dataCount);
+        AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: MBRTCP to Modbus TransactionId:%d, deviceAddress:%d, functionCode:%d, startAddress:%d, count:%d, recvCount:%d, recvBytes:%d"),
+               modbusBridgeTCP.tcp_transaction_id, mbdeviceaddress, mbfunctioncode, mbstartaddress, count, modbusBridge.dataCount, modbusBridge.byteCount);
 
         tasmotaModbus->Send(mbdeviceaddress, mbfunctioncode, mbstartaddress, count, writeData);
 

From 728c10829428dc92891bf03f2ce46feac5b27b14 Mon Sep 17 00:00:00 2001
From: JeroenSt <nospam@nospam.org>
Date: Sat, 27 Aug 2022 10:54:41 +0200
Subject: [PATCH 15/15] Removed logging and changed maximum number of
 coils/inputs

---
 lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp | 7 ++++++-
 tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino   | 8 +++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
index 252f3efd4..95db697f5 100644
--- a/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
+++ b/lib/lib_basic/TasmotaModbus-3.5.0/src/TasmotaModbus.cpp
@@ -25,6 +25,7 @@
 extern void AddLog(uint32_t loglevel, PGM_P formatP, ...);
 enum LoggingLevels {LOG_LEVEL_NONE, LOG_LEVEL_ERROR, LOG_LEVEL_INFO, LOG_LEVEL_DEBUG, LOG_LEVEL_DEBUG_MORE};
 
+//#define TASMOTAMODBUSDEBUG
 
 TasmotaModbus::TasmotaModbus(int receive_pin, int transmit_pin) : TasmotaSerial(receive_pin, transmit_pin, 1)
 {
@@ -134,7 +135,8 @@ uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint1
   uint16_t crc = CalculateCRC(frame, framepointer);
   frame[framepointer++] = (uint8_t)(crc);
   frame[framepointer++] = (uint8_t)(crc >> 8);
-  
+
+#ifdef TASMOTAMODBUSDEBUG  
   uint8_t *buf;
   uint16_t bufsize=(framepointer + 1) * 3;
   buf = (uint8_t *)malloc(bufsize);
@@ -144,6 +146,7 @@ uint8_t TasmotaModbus::Send(uint8_t device_address, uint8_t function_code, uint1
     snprintf((char *)&buf[i*3], (bufsize-i*3), "%02X ",frame[i]);
   AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: Serial Send: %s"), buf);
   free(buf);
+#endif
   
   flush();
   write(frame, framepointer);
@@ -181,6 +184,7 @@ uint8_t TasmotaModbus::ReceiveBuffer(uint8_t *buffer, uint8_t register_count, ui
     }
   }
 
+#ifdef TASMOTAMODBUSDEBUG
 // RX Logging
   uint8_t *buf;
   uint16_t bufsize=(mb_len + 1) * 3;
@@ -191,6 +195,7 @@ uint8_t TasmotaModbus::ReceiveBuffer(uint8_t *buffer, uint8_t register_count, ui
     snprintf((char *)&buf[i*3], (bufsize-i*3), "%02X ",buffer[i]);
   AddLog(LOG_LEVEL_DEBUG_MORE, PSTR("MBS: Serial Received: %s"), buf);
   free(buf);
+#endif
 
   if (buffer[1] & 0x80)
   { // 01 84 02 f2 f1
diff --git a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
index a90e2b16c..479ea560b 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_63_modbus_bridge.ino
@@ -317,6 +317,7 @@ void ModbusBridgeHandle(void)
 
     modbusBridge.byteCount = 0;
     ModbusBridgeError errorcode = ModbusBridgeError::noerror;
+
     if (modbusBridge.deviceAddress == 0)
     {
 #ifdef USE_MODBUS_BRIDGE_TCP
@@ -682,12 +683,10 @@ void ModbusTCPHandle(void)
             if (dataPointer % 2 == 0)
             {
               writeData[dataPointer / 2] = (uint16_t)(((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte + dataPointer]) << 8);
-              AddLog(LOG_LEVEL_DEBUG_MORE, "%d=%04X", dataPointer/2, writeData[dataPointer/2]);
             }
             else
             { 
               writeData[dataPointer / 2] |= ((uint16_t)modbusBridgeTCP.tcp_buf[dataStartByte + dataPointer]);
-              AddLog(LOG_LEVEL_DEBUG_MORE, "%d=%04X", dataPointer/2, writeData[dataPointer/2]);
             }
           }
         }
@@ -806,7 +805,10 @@ void CmndModbusBridgeSend(void)
   }
 
   // Prevent buffer overflow due to usage of to many registers
-  if (modbusBridge.dataCount > MBR_MAX_REGISTERS)
+  if ((!bitMode) && (modbusBridge.dataCount > MBR_MAX_REGISTERS))
+    errorcode = ModbusBridgeError::wrongcount;
+
+  if ((bitMode) && (modbusBridge.dataCount > MBR_MAX_REGISTERS * 8))
     errorcode = ModbusBridgeError::wrongcount;
 
   // Get Json data for writing