Académique Documents
Professionnel Documents
Culture Documents
Introduction
At the physical level, MODBUS over Serial Line systems may use
different physical interfaces (RS485, RS232). TIA/EIA-485
(RS485)
MODBUS ON TCP/IP
Gateway Gateway
MODBUS ON RS232
MODBUS ON RS485
PLC
I/O
Device I/O
Device
• The master node issues a MODBUS request to the slave nodes in two
modes :
• broadcast mode, the master can send a request to all slaves. No response
is returned to broadcast requests sent by the master. The broadcast
requests are necessarily writing commands. All devices must accept the
broadcast for writing function. The address 0 is reserved to identify a
broadcast exchange.
Master
Request
Reply
Unicast Mode
Master
Request
Broadcast Mode
MODBUS Addressing Rules
0 – Broadcast address
From 1 to 247 – Slave individual addresses
From 248 to 255 – Reserved
The MODBUS Master node has no specific address, only the slave nodes
must have an address. This address must be unique on a MODBUS serial
bus.
MODBUS Frame Description
MODBUS PDU
MODBUS ADU
MODBUS PDU
All devices must implement the RTU Mode. The ASCII transmission
mode is an option.
RTU Mode:
Slave Function
Data CRC
Address Code
1 byte 1 byte 0 up to 252 byte (s) 2 bytes
Example : The byte 0X5B is encoded as two characters : 0x35 and 0x42
( 0x35 ="5", and 0x42 ="B" in ASCII ).
<= 1 Sec
Response Time Out:
When a unicast request is sent to a slave, the master goes into "Waiting for
reply" state, and a “Response Time-out” is started. It prevents the Master from
staying indefinitely in "Waiting for reply" state. Value of the Response time-out
is application dependant.
Request
Function code 1 Byte 0x01
Starting Address 2 Bytes 0x0000 to 0xFFFF
Quantity of coils 2 Bytes 1 to 2000 (0x7D0)
Response
Function code 1 Byte 0x01
Byte count 1 Byte N*
Coil Status n Byte n = N or N+1
*N = Quantity of Outputs / 8, if the remainder is different of 0 ⇒ N = N+1
Error
Function code 1 Byte Function code + 0x80
Exception code 1 Byte 01 or 02 or 03 or 04
Request
Function code 1 Byte 0x02
Starting Address 2 Bytes 0x0000 to 0xFFFF
Quantity of Inputs 2 Bytes 1 to 2000 (0x7D0)
Response
Function code 1 Byte 0x02
Byte count 1 Byte N*
Input Status N* x 1 Byte
*N = Quantity of Inputs / 8 if the remainder is different of 0 ⇒ N = N+1
Error
Error code 1 Byte 0x82
Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Read Holding Registers:
Request
Function code 1 Byte 0x03
Starting Address 2 Bytes 0x0000 to 0xFFFF
Quantity of Registers 2 Bytes 1 to 125 (0x7D)
Response
Function code 1 Byte 0x03
Byte count 1 Byte 2 x N*
Register value N* x 2 Bytes
*N = Quantity of Registers
Error
Error code 1 Byte 0x83
Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Read Input Registers:
Request
Function code 1 Byte 0x04
Starting Address 2 Bytes 0x0000 to 0xFFFF
Quantity of Input Registers 2 Bytes 0x0001 to 0x007D
Response
Function code 1 Byte 0x04
Byte count 1 Byte 2 x N*
Input Registers N* x 2 Bytes
*N = Quantity of Input Registers
Error
Error code 1 Byte 0x84
Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Write Single Coil:
Request
Function code 1 Byte 0x05
Output Address 2 Bytes 0x0000 to 0xFFFF
Output Value 2 Bytes 0x0000 or 0xFF00
Response
Function code 1 Byte 0x05
Output Address 2 Bytes 0x0000 to 0xFFFF
Output Value 2 Bytes 0x0000 or 0xFF00
Error
Error code 1 Byte 0x85
Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Write Single Register:
Request
Function code 1 Byte 0x06
Register Address 2 Bytes 0x0000 to 0xFFFF
Register Value 2 Bytes 0x0000 to 0xFFFF
Response
Function code 1 Byte 0x06
Register Address 2 Bytes 0x0000 to 0xFFFF
Register Value 2 Bytes 0x0000 to 0xFFFF
Error
Error code 1 Byte 0x86
Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Write Multiple Coils:
Request
Function code 1 Byte 0x0F
Starting Address 2 Bytes 0x0000 to 0xFFFF
Quantity of Outputs 2 Bytes 0x0001 to 0x07B0
Byte Count 1 Byte N*
Outputs Value N* x 1 Byte
*N = Quantity of Outputs / 8, if the remainder is different of 0 ⇒ N = N+1
Response
Function code 1 Byte 0x0F
Starting Address 2 Bytes 0x0000 to 0xFFFF
Quantity of Outputs 2 Bytes 0x0001 to 0x07B0
Error
Error code 1 Byte 0x8F
Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Write Multiple Registers:
Request
Function code 1 Byte 0x10
Starting Address 2 Bytes 0x0000 to 0xFFFF
Quantity of Registers 2 Bytes 0x0001 to 0x007B
Byte Count 1 Byte 2 x N*
Registers Value N* x 2 Bytes value
*N = Quantity of Registers
Response
Function code 1 Byte 0x10
Starting Address 2 Bytes 0x0000 to 0xFFFF
Quantity of Registers 2 Bytes 1 to 123 (0x7B)
Error
Error code 1 Byte 0x90
Exception code 1 Byte 01 or 02 or 03 or 04
Data types supported by AxisLogger:
Sr. No. AxisLogger Data type Meaning
1 Boolean Binary 1 Bit
2 Unsigned Int 2 Bytes (unsigned short)
3 Int 2 Bytes (short)
4 LongR1R2 4 Bytes (long) Lower Word first, Higher Word next
5 LongR2R1 4 Bytes (long) Higher Word first, Lower Word next
6 DWORDR1R2 4 Bytes (unsigned long) Lower Word first, Higher Word
next
7 DWORDR2R1 4 Bytes (unsigned long) Higher Word first, Lower Word
next
8 FloatR1R2 4 Bytes (float) Lower Word first, Higher Word next
9 FloatR2R1 4 Bytes (float) Higher Word first, Lower Word next
10 2BytesBCD 2 Bytes (BCD)
11 4BytesBCDR1R2 4 Bytes (BCD) Lower Word first, Higher Word next
12 4BytesBCDR2R1 4 Bytes (BCD) Higher Word first, Lower Word next
13 Custom1Byte 1 Byte from given offset in Block
14 Custom2Bytes 2 Bytes from given offset in Block
15 Custom3Bytes 3 Bytes from given offset in Block
16 Custom4Bytes 4 Bytes from given offset in Block
Tag Configuration in AxisLogger:
Analog Tag Configuration:
DigiTag Configuration:
Example SLAVE
Holding Regs
Request
MASTER Input Regs
Response
Coils
Discrete Inputs
Request to read 1 Holding Register 400001
Start Start Start Start
Address Address Address Address
Start Slave ID Function CRC L CRC H End
High Low High Low
>=3.5 >=3.5
01 03 00 00 00 01
Char Char
<=1.5Sec
Response Data Value is 0x1234
No
Data Data
Of
Start Slave ID Function Byte 1 Byte 2 CRC L CRC H End
Bytes
>=3.5 >=3.5
01 01 02 0x12 0x34
Char Char
THANK YOU