Professional Documents
Culture Documents
1 of 4
Products
Applications
Software
http://www.csimn.com/CSI_pages/Modbus101.html#mb101_fncodes
Shop Online
Support
Company
Site Map
Home
Online Help
This page will not teach you everything about Modbus, but will attempt to answer some of the most
frequently asked questions. If you still have questions about Modbus after reviewing this
information, just click Support above.
Modbus - Bird's Eye View
The most commonly used form of Modbus
protocol is RTU over RS-485.
A Modbus RTU network has one Master and
one or more Slaves. Each slave has a unique
8-bit device address or unit number. Packets
sent by the master include the address of the
slave the message is intended for. The slave
must respond only if its address is recognized,
and must respond within a certain time period
or the master will call it a "no response" error.
Modbus data is most often read and written as
"registers" which are 16-bit pieces of data.
Most often, the register is either a signed or
unsigned 16-bit integer. If a 32-bit integer or
floating point is required, these values are
actually read as a pair of registers. The most
commonly used register is called a Holding
Register, and these can be read or written. The
other possible type is Input Register, which is
read-only.
The exceptions to registers being 16 bits are
the coil and the discrete input, which are each
1 bit only. Coils can be read or written, while
discrete inputs are read-only. Coils are usually
associated with relay outputs.
The type of register being addressed by a
Modbus request is determined by the function
code. The most common codes are 3 for
"read holding registers", and may read 1 or
more. Function code 6 is used to write a single
holding register. Function code 16 is used to
write one or more holding registers.
Modbus documentation is not standardized.
Therefore, holding register #1 could be
documented as address 0, register 1, or
register 40001. See more explanation of
notation in sections on this page.
What is Modbus?
Where do I start?
Review of Modbus Register Types
Review of Modbus Function Codes
Review of Modbus Exception (error) Codes
Modbus: When 40001 really means 1, or 0 really means 1
40001: Modicon convention notation for Modbus registers
If registers are 16-bits, how do I read Floating Point or 32-bit data?
What does notation like 40001:7 mean?
How do I read individual bits in a register?
Can I put 2 gateways on the same Modbus network?
How many devices can I have on a Modbus network?
What is the difference between Modbus RTU, TCP, and ASCII?
Where can I get a copy of the Modbus protocol specification?
Where can I find out about RS-485 wiring?
What is Modbus?
Modbus is an industrial protocol standard that has been in use for many years. Modbus ASCII and Modbus RTU are relatively simple
serial protocols that use EIA-232 or EIA-485 to transmit data packets. The protocol defines function codes and the encoding scheme
for transferring data as either single points (1-bit, coils) or as 16-bit data registers. This basic data packet is then encapsulated
according to the protocol specifications for Modbus ASCII, RTU, or TCP.
The TCP version of Modbus follows the OSI Network Reference Model; however the serial implementations of Modbus do not.
Modbus/TCP defines the presentation and application layers in the OSI model.
Modbus protocol is defined as a master/slave protocol, meaning a device operating as a master will poll one or more devices
operating as a slave. This means a slave device cannot volunteer information; it must wait to be asked for it. The master will write
data to a slave devices registers, and read data from a slave devices registers. A register address or register reference is always in
the context of the slaves registers.
Modbus/TCP makes the definition of master and slave less obvious because Ethernet allows peer to peer communication. The
definition of client and server are better known entities in Ethernet based networking. In this context, the slave becomes the server
and the master becomes the client. There can be more than one client obtaining data from a server. In Modbus terms, this means
there can be multiple masters as well as multiple slaves. Rather than defining master and slave on a physical device by device basis, it
now becomes the system designers responsibility to create logical associations between master and slave functionality.
Where do I start?
Here are the first few things you need to find out:
(1) What is the physical connection?
Modbus RTU uses RS-485 or RS-232. Modbus TCP uses Ethernet. If you are looking for a Control Solutions gateway, you will need
to pick the model that matches the electrical interface of the equipment you want to connect. If you are choosing a Control
Solutions I/O device, pick one that matches your network.
(2) How are the registers mapped?
When using a gateway to interface a Modbus device to a non-Modbus network, you need to get documentation from the equipment
manufacturer that describes the available registers and how to address them. Modbus protocol does not provide a means for
registers to automatically identify themselves. Control Solutions cannot determine this information for you. You must consult the
equipment manufacturer.
When using Control Solutions I/O devices (such as AddMe III) you will find this information in the online help files that came with the
3/5/2015 9:19 PM
http://www.csimn.com/CSI_pages/Modbus101.html#mb101_fncodes
Modbus RTU requires that you know or define baud rate, character format (8 bits no parity, etc), and slave ID (aka slave address,
unit number, unit ID). A mis-match in any of these will result in no communication.
Modbus TCP requires that you know or define IP addresses on the network. In some cases, you also need unit ID's. Control
Solutions Modbus TCP devices may use the unit ID, or may ignore it, depending on the device and the application.
Control Solutions gateways will support all register types when the gateway is the master, or when operating in direct mode (Babel
Buster SP-GW). Control Solutions gateways that connect a non-Modbus device to a Modbus network use only holding registers to
represent the non-Modbus device data (e.g. copy LonWorks network variable data to holding registers).
Most Control Solutions I/O devices use only holding registers for all types of inputs and outputs. This convention originated with the
introduction of configurable hardware that could map any type of input or output to the same register.
Register Type
Read Coil
15
16
Illegal Function
The function code received in the query is not recognized by the slave or is not
allowed by the slave.
The data address (register number) received in the query is not an allowed address
for the slave, i.e., the register does not exist. If multiple registers were requested,
at least one was not permitted.
The value contained in the query's data field is not acceptable to the slave.
An unrecoverable error occurred while the slave was attempting to perform the
requested action
10
11
2 of 4
3/5/2015 9:19 PM
3 of 4
http://www.csimn.com/CSI_pages/Modbus101.html#mb101_fncodes
=
=
=
=
Coil = 00001-09999
Discrete Input = 10001-19999
Input Register = 30001-39999
Holding Register = 40001-49999
Translating references to addresses, reference 40001 selects the holding register at address 0000 (also referred to as register
number 1). The reference 40001 will appear in documentation and is used to define the Modbus register in the location property of
the functional block in a LonWorks gateway. The address 0000 will be transmitted in the message packet. Addresses are often not
directly used by the application or the user.
On occasion, it is necessary to access more than 10,000 of a register type. Based on the original convention, there is another
defacto standard that looks very similar. Additional register types and reference ranges recognized by Babel Buster (LonWorks)
gateways are as follows:
0x
1x
3x
4x
=
=
=
=
Coil = 000001-065535
Discrete Input = 100001-165535
Input Register = 300001-365535
Holding Register = 400001-465535
When using the extended register referencing, it is mandatory that all register references be exactly six digits. This is the only way
Babel Buster will know the difference between holding register 40001 and coil 40001. If coil 40001 is the target, it must appear as
040001.
3/5/2015 9:19 PM
4 of 4
http://www.csimn.com/CSI_pages/Modbus101.html#mb101_fncodes
3/5/2015 9:19 PM