Durante todo el año recibimos muchos mail, pidiéndonos información para realizar trabajos sobre autómatas. Así que ahora es el momento para recordaros que necesitamos de vuestra colaboración enviándonos los que ya habéis presentado.

Chapter 2
Data and Control Functions

Modbus Function Formats

V Function Codes

V Read Coil Status

V Read Input Status

V Read Holding Registers

V Read Input Registers

V Force Single Coil

V Preset Single Register

V Read Exception Status

V Fetch Comm Event Counter

V Fetch Comm Event Log

V Force Multiple Coils

V Preset Multiple Registers

V Report Slave ID

V Read General Reference

V Write General Reference

V Mask Write 4x Register

V Read / Write 4x Registers

V Read FIFO Queue

2.1 Modbus Function Formats

Note: Unless specified otherwise, numerical values (such as addresses, codes, or data) are expressed as decimal values in the text of this section. They are expressed as hexadecimal values in the message fields of the figures.

2.1.1 Data Addresses in Modbus Messages

All data addresses in Modbus messages are referenced to zero. The first occurrence of a data item is addressed as item number zero. For example:

V Coil 1 in a programmable controller is addressed as coil 0000 in the data address field of a Modbus message

V Coil 127 decimal is addressed as coil 007E hex (126 decimal)

V Holding register 40001 is addressed as register 0000 in the data address field of the message. The function code field already specifies a holding register operation. Therefore the 4x reference is implicit.

V Holding register 40108 is addressed as register 006B hex (107 decimal)

2.1.2 Field Contents in Modbus Messages

The following tables show examples of a Modbus query and normal response. Both examples show the field contents in hexadecimal, and also show how a message could be framed in ASCII or in RTU mode.

Query

Response

The master query is a Read Holding Registers request to slave device address 06. The message requests data from three holding registers, 40108 ... 40110.

Note: The message specifies the starting register address as 0107 (006B hex).

The slave response echoes the function code, indicating this is a normal response. The Byte Count field specifies how many eight-bit data items are being returned. It shows the count of eight-bit bytes to follow in the data, for either ASCII or RTU. With ASCII, this value is half the actual count of ASCII characters in the data. In ASCII, each four-bit hexadecimal value requires one ASCII character, therefore two ASCII characters must follow in the message to contain each eight-bit data item.

For example, the value 63 hex is sent as one eight-bit byte in RTU mode (01100011). The same value sent in ASCII mode requires two bytes, for ASCII 6 (0110110) and 3 (0110011). The Byte Count field counts this data as one eight-bit item, regardless of the character framing method (ASCII or RTU).

How to Use the Byte Count Field

When you construct responses in buffers, use a Byte Count value that equals the count of eight-bit bytes in your message data. The value is exclusive of all other field contents, including the Byte Count field.

2.1.3 Field Contents on Modbus Plus

Modbus messages sent on Modbus Plus networks are imbedded into the Logical Link Control (LLC) level frame. Modbus message fields consist of eight-bit bytes, similar to those used with RTU framing.

The Slave Address field is converted to a Modbus Plus routing path by the sending device. The CRC field is not sent in the Modbus message, because it would be redundant to the CRC check performed at the High-level Data Link Control (HDLC) level.

The rest of the message remains as in the standard serial format. The application software (e.g., MSTR blocks in controllers, or Modcom III in hosts) handles the framing of the message into a network packet.

Figure 7 shows how a Read Holding Registers query would be imbedded into a frame for Modbus Plus transmission.

Figure 7 Field Contents on Modbus Plus

2.2 Function Codes

The listing below shows the function codes supported by Modicon controllers. Codes are listed in decimal; Y indicates that the function is supported, and N indicates that it is not supported.

2.2.1 01 Read Coil Status

Reads the ON / OFF status of discrete outputs (0x references, coils) in the slave. Broadcast is not supported. The maximum parameters supported by various controller models are listed on page .

Query

The query message specifies the starting coil and quantity of coils to be read. Coils are addressed starting at zero-coils 1 ... 16 are addressed as 0 ... 15.

Here is an example of a query to read coils 20 ... 56 from slave device 17:

Response

The coil status in the response message is packed as one coil per bit of the data field. Status is indicated as: 1 = ON; 0 = OFF. The LSB of the first data byte contains the coil addressed in the query. The other coils follow toward the high order end of this byte, and from low order to high order in subsequent bytes.

If the returned coil quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeros (toward the high order end of the byte). The Byte Count field specifies the quantity of complete bytes of data.

Here is an example of a response to the query:

The status of coils 27 ... 20 is shown as the byte value CD hex, or binary 1100 1101. Coil 27 is the MSB of this byte, and coil 20 is the LSB. Left to right, the status of coils 27 ... 20 is ON-ON-OFF-OFF-ON-ON-OFF-ON.

By convention, bits within a byte are shown with the MSB to the left, and the LSB to the right. Thus the coils in the first byte are 27 ... 20, from left to right. The next byte has coils 35 ... 28, left to right. As the bits are transmitted serially, they flow from LSB to MSB: 20 . . . 27, 28 . . . 35, and so on.

In the last data byte, the status of coils 56 ... 52 is shown as the byte value 1B hex, or binary 0001 1011. Coil 56 is in the fourth bit position from the left, and coil 52 is the LSB of this byte. The status of coils 56 ... 52 is: ON-ON-OFF-ON-ON.

Note: The three remaining bits (toward the high-order end) are zero-filled.

2.2.2 02 Read Input Status

Reads the ON / OFF status of discrete inputs (1x references) in the slave. Broadcast is not supported. The maximum parameters supported by various controller models are listed on page .

Query

The query message specifies the starting input and quantity of inputs to be read. Inputs are addressed starting at zero-inputs 1 ... 16 are addressed as 0 ... 15.

Here is an example of a request to read inputs 10197 ... 10218 from slave device 17:

Response

The input status in the response message is packed as one input per bit of the data field. Status is indicated as: 1 = ON; 0 = OFF. The LSB of the first data byte contains the input addressed in the query. The other inputs follow toward the high order end of this byte, and from low order to high order in subsequent bytes.

If the returned input quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeros (toward the high order end of the byte). The Byte Count field specifies the quantity of complete bytes of data.

Here is an example of a response to the query:

The status of inputs 10204 ... 10197 is shown as the byte value AC hex, or binary 1010 1100. Input 10204 is the MSB of this byte, and input 10197 is the LSB. Left to right, the status of inputs 10204 ... 10197 is ON-OFF-ON-OFF-ON-ON-OFF-OFF.

The status of inputs 10218 ... 10213 is shown as the byte value 35 hex, or binary 0011 0101. Input 10218 is in the third bit position from the left, and input 10213 is the LSB. The status of inputs 10218 ... 10213 is: ON-ON-OFF-ON-OFF-ON.

Note: The two remaining bits (toward the high order end) are zero-filled.

2.2.3 03 Read Holding Registers

Reads the binary contents of holding registers (4x references) in the slave. Broadcast is not supported. The maximum parameters supported by various controller models are listed on page .

Query

The query message specifies the starting register and quantity of registers to be read. Registers are addressed starting at zero- registers 1 ... 16 are addressed as 0 ... 15.

Here is an example of a request to read registers 40108 ... 40110 from slave device 17:

Response

The register data in the response message are packed as two bytes per register, with the binary contents right justified within each byte. For each register, the first byte contains the high order bits and the second contains the low order bits.

Data is scanned in the slave at the rate of 125 registers per scan for 984-X8X controllers (984-685, etc), and at the rate of 32 registers per scan for all other controllers. The response is returned when the data is completely assembled.

Here is an example of a response to the query:

The contents of register 40108 are shown as the two byte values of 02 2B hex, or 555 decimal. The contents of registers 40109 ... 40110 are 00 00 and 00 64 hex, or 0 and 100 decimal.

2.2.4 04 Read Input Registers

Reads the binary contents of input registers (3X references) in the slave. Broadcast is not supported. The maximum parameters supported by various controller models are listed on page .

Query

The query message specifies the starting register and quantity of registers to be read. Registers are addressed starting at zero- registers 1 ... 16 are addressed as 0 ... 15.

Here is an example of a request to read register 30009 from slave device 17:

Response

The register data in the response message are packed as two bytes per register, with the binary contents right justified within each byte. For each register, the first byte contains the high-order bits and the second contains the low-order bits.

Here is an example of a response to the query on the opposite page:

The contents of register 30009 are shown as the two byte values of 00 0A hex, or 10 decimal.

2.2.5 05 Force Single Coil

Forces a single coil (0x reference) to either ON or OFF. When broadcast, the function forces the same coil reference in all attached slaves. The maximum parameters supported by various controller models are listed on page .

Note: The function will override the controller's memory protect state and the coil's disable state. The forced state will remain valid until the controller's logic next solves the coil. The coil will remain forced if it is not programmed in the controller's logic.

Query

The query message specifies the coil reference to be forced. Coils are addressed starting at zero-coil 1 is addressed as 0.

The reguested ON / OFF state is specified by a constant in the query data field. A value of FF 00 hex requests the coil to be ON. A value of 00 00 requests it to be OFF. All other values are illegal and will not affect the coil.

Here is an example of a request to force coil 173 ON in slave device 17:

Response

The normal response is an echo of the query, returned after the coil state has been forced.

Here is an example of a response to the query:

2.2.6 06 Preset Single Register

Presets a value into a single holding register (4x reference). When broadcast, the function presets the same register reference in all attached slaves. The maximum parameters supported by various controller models are listed on page .

Note: The function will override the controller's memory protect state. The preset value will remain valid in the register until the controller's logic next solves the register contents. The register's value will remain if it is not programmed in the controller's logic.

Query

The query message specifies the register reference to be preset. Registers are addressed starting at zero-register 1 is addressed as 0.

The reguested preset value is specified in the query data field. M84 and 484 controllers use a 10-bit binary value, with the six high order bits set to zeros. All other controllers use 16-bit values.

Here is an example of a request to preset register 40002 to 00 03 hex in slave device 17:

Response

The normal response is an echo of the query, returned after the register contents have been preset.

Here is an example of a response to the query:

2.2.7 07 Read Exception Status

Reads the contents of eight Exception Status coils within the slave controller. Certain coils have predefined assignments in the various controllers. Other coils can be programmed by the user to hold information about the contoller's status-e.g., machine ON/OFF, heads retracted, safeties satisfied, error conditions exist, or other user-defined flags. Broadcast is not supported.

The function provides a simple method for accessing this information, because the Exception Coil references are known (no coil reference is needed in the function). The predefined Exception Coil assignments are:

Query

Here is an example of a request to read the exception status in slave device 17:

Response

The normal response contains the status of the eight Exception Status coils. The coils are packed into one data byte, with one bit per coil. The status of the lowest coil reference is contained in the least significant bit of the byte.

Here is an example of a response to the query:

In this example, the coil data is 6D hex (0110 1101 binary). Left to right, the coils are OFF-ON-ON-OFF-ON-ON-OFF-ON. The status is shown from the highest to the lowest addressed coil.

If the controller is a 984, these bits are the status of coils 8 ... 1. If the controller is a 484, these bits are the status of coils 264 ... 257. In this example, coil 257 is ON, indicating that the controller's batteries are OK.

2.2.8 11 (0B Hex) Fetch Comm Event Counter

Returns a status word and an event count from the slave's communications event counter. By fetching the current count before and after a series of messages, a master can determine whether the messages were handled normally by the slave. Broadcast is not supported.

The controller's event counter is incremented once for each successful message completion. It is not incremented for exception responses, poll commands, or fetch event counter commands.

The event counter can be reset by means of the Diagnostics function (code 08), with a subfunction of Restart Communications Option (code 00 01) or Clear Counters and Diagnostic Register (code 00 0A).

Query

Here is an example of a request to fetch the communications event counter in slave device 17:

Response

The normal response contains a two-byte status word, and a two-byte event count. The status word will be all ones (FF FF hex) if a previously issued program command is still being processed by the slave (a busy condition exists). Otherwise, the status word will be all zeros.

Here is an example of a response to the query:

In this example, the status word is FF FF hex, indicating that a program function is still in progress in the slave. The event count shows that 264 (01 08 hex) events have been counted by the controller.

2.2.9 12 (0C Hex) Fetch Comm Event Log

Returns a status word, event count, message count, and a field of event bytes from the slave. Broadcast is not supported. The status word and event count are identical to that returned by the Fetch Communications Event Counter function (11, 0B hex).

The message counter contains the quantity of messages processed by the slave since its last restart, clear counters operation, or power-up. This count is identical to that returned by the Diagnostic function (code 08), subfunction Return Bus Message Count (code 11, 0B hex).

The event bytes field contains 0 ... 64 bytes, with each byte corresponding to the status of one Modbus send or receive operation for the slave. The events are entered by the slave into the field in chronological order. Byte 0 is the most recent event. Each new byte flushes the oldest byte from the field.

Query

Here is an example of a request to fetch the communications event log in slave device 17:

Response

The normal response contains a two-byte status word field, a two-byte event count field, a two-byte message count field, and a field containing 0 ... 64 bytes of events. A byte-count field defines the total length of the data in these four fields.

Here is an example of a response to the query:

In this example, the status word is 00 00 hex, indicating that the slave is not processing a program function. The event count shows that 264 (01 08 hex) events have been counted by the slave. The message count shows that 289 (01 21 hex) messages have been processed.

The most recent communications event is shown in the Event 0 byte. Its contents (20 hex) show that the slave has most recently entered the Listen Only Mode.

The previous event is shown in the Event 1 byte. Its contents (00 hex) show that the slave received a Communications Restart.

What the Event Bytes Contain

An event byte returned by the Fetch Communications Event Log function can be any one of four types. The type is defined by bit 7 (the high-order bit) in each byte. It may be further defined by bit 6.

Slave Modbus Receive Event

This type of event byte is stored by the slave when a query message is received. It is stored before the slave processes the message. This event is defined by bit 7 set to a logic 1. The other bits will be set to a logic 1 if the corresponding condition is TRUE. The bit layout is:

Slave Modbus Send Event

This type of event byte is stored by the slave when it finishes processing a query message. It is stored if the slave returned a normal or exception response, or no response. This event is defined by bit 7 set to a logic 0, with bit 6 set to a 1. The other bits will be set to a logic 1 if the corresponding condition is TRUE. The bit layout is:

Slave Entered Listen Only Mode

This type of event byte is stored by the slave when it enters the Listen Only Mode. The event is defined by a contents of 04 hex. The bit layout is:

Slave Initiated Communication Restart

This type of event byte is stored by the slave when its communications port is restarted. The slave can be restarted by the Diagnostics function (code 08), with subfunction Restart Communications Option (code 00 01).

That function also places the slave into a Continue on Error or Stop on Error mode. If the slave is placed into Continue on Error mode, the event byte is added to the existing event log. If the slave is placed into Stop on Error mode, the byte is added to the log and the rest of the log is cleared to zeros. The event is defined by a contents of zero. The bit layout is:

2.2.10 15 (0F Hex) Force Multiple Coils

Forces each coil (0x reference) in a sequence of coils to either ON or OFF. When broadcast, the function forces the same coil references in all attached slaves. The maximum parameters supported by various controller models are listed on page .

Note: The function will override the controller's memory protect state and a coil's disable state. The forced state will remain valid until the controller's logic next solves each coil. Coils will remain forced if they are not programmed in the controller's logic.

Query

The query message specifies the coil references to be forced. Coils are addressed starting at zero-coil 1 is addressed as 0.

The reguested ON / OFF states are specified by contents of the query data field. A logical 1 in a bit position of the field requests the corresponding coil to be ON. A logical 0 requests it to be OFF.

The following page shows an example of a request to force a series of ten coils starting at coil 20 (addressed as 19, or 13 hex) in slave device 17.

The query data contents are two bytes: CD 01 hex (1100 1101 0000 0001 binary). The binary bits correspond to the coils in the following way:

Bit: 1 1 0 0 1 1 0 1 0 0 0 0 0 0 0 1

Coil: 27 26 25 24 23 22 21 20 - - - - - - 29 28

The first byte transmitted (CD hex) addresses coils 27 ... 20, with the least significant bit addressing the lowest coil (20) in this set.

The next byte transmitted (01 hex) addresses coils 29 and 28, with the least significant bit addressing the lowest coil (28) in this set. Unused bits in the last data byte should be zero-filled.

Response

The normal response returns the slave address, function code, starting address, and quantity of coils forced. Here is an example of a response to the query shown above:

2.2.11 16 (10 Hex) Preset Multiple Registers

Presets values into a sequence of holding registers (4x references). When broadcast, the function presets the same register references in all attached slaves. The maximum parameters supported by various controller models are listed on page .

Note: The function will override the controller's memory protect state. The preset values will remain valid in the registers until the controller's logic next solves the register contents. The register values will remain if they are not programmed in the controller's logic.

Query

The query message specifies the register references to be preset. Registers are addressed starting at zero-register 1 is addressed as 0.

The requested preset values are specified in the query data field. M84 and 484 controllers use a 10-bit binary value, with the six high order bits set to zeros. All other controllers use 16-bit values. Data is packed as two bytes per register.

Here is an example of a request to preset two registers starting at 40002 to 00 0A and 01 02 hex, in slave device 17:

Response

The normal response returns the slave address, function code, starting address, and quantity of registers preset. Here is an example of a response to the query shown above.

2.2.12 17 (11 Hex) Report Slave ID

Returns a description of the type of controller present at the slave address, the current status of the slave Run indicator, and other information specific to the slave device. Broadcast is not supported.

Query

Here is an example of a request to report the ID and status of slave device 17:

Response

The format of a normal response is shown below. The data contents are specific to each controller type.

Summary of Slave IDs

These are the Slave ID codes returned by Modicon controllers in the first byte of the data field:

184 / 384

The 184 or 384 controller returns a byte count of either 4 or 74 (4A hexadecimal). If the controller's J347 Modbus Slave Interface is setup properly, and its internal PIB table is normal, the byte count will be 74. Otherwise the byte count will be 4. The four bytes that are always returned are:

Bytes 5 ... 10, returned for a correct J347 setup and normal PIB, are:

Bytes 11 ... 74 contain the PIB table. This data is valid only if the controller is running (as shown in Byte 2). The table is as follows:

584

The 584 controller returns a byte count of 9, as follows:

984

The 984 controller returns a byte count of 9, as follows:

Note: Bit 0 of the Machine State word defines the use of the memory downsize values in words 99, 100, and 175 (63, 64, and AF hexadecimal) of the configuration table. If bit 0 = logic 1, downsizing is calculated as follows:

Page 0 size (16-bit words) = (Word 99 * 4096) - (Word 175 lo byte * 16)

State table size (16-bit words) = (Word 100 * 1024) - (Word 175 hi byte * 16)

Micro 84

The Micro 84 controller returns a byte count of 8, as follows:

484

The 484 controller returns a byte count of 5, as follows:

884

The 884 controller returns a byte count of 8, as follows:

2.2.13 20 (14 Hex) Read General Reference

Returns the contents of registers in Extended Memory file (6x) references. Broadcast is not supported. The function can read multiple groups of references. The groups can be separate (noncontiguous), but the references within each group must be sequential.

Query

The query contains the standard Modbus slave address, function code, byte count, and error check fields. The rest of the query specifies the group or groups of references to be read. Each group is defined in a separate sub-request field which contains seven bytes:

V The reference type-one byte (must be specified as 6)

V The Extended Memory file number-two bytes (1 ... 10, 0001 ... 000A hex)

V The starting register address within the file-two bytes

V The quantity of registers to be read-two bytes

The quantity of registers to be read, combined with all other fields in the expected response, must not exceed the allowable length of Modbus messages-256 bytes.

The available quantity of Extended Memory files depends upon the installed size of Extended Memory in the slave controller. Each file except the last one contains 10,000 registers, addressed as 0000 ... 270F hexadecimal (0000 - ... 9999 decimal).

For controllers other than the 984-785 with Extended Registers, the last (highest) register in the last file is:

For the 984-785 with Extended Registers, the last (highest) register in the last file is shown in the two tables below.

Examples of a query and response follow. An example of a request to read two groups of references from slave device 17 is shown. Group 1 consists of two registers from file 4, starting at register 2 (address 0001). Group 2 consists of two registers from file 3, starting at register 10 (address 0009).

Response

The normal response is a series of sub-responses, one for each sub-request. The byte count field is the total combined count of bytes in all sub-responses. In addition, each sub-response contains a field that shows its own byte count.

2.2.14 21 (15 Hex) Write General Reference

Writes the contents of registers in Extended Memory file (6x) references. Broadcast is not supported.

The function can write multiple groups of references. The groups can be separate (noncontiguous), but the references within each group must be sequential.

Query

The query contains the standard Modbus slave address, function code, byte count, and error check fields. The rest of the query specifies the group or groups of references to be written, and the data to be written into them. Each group is defined in a separate sub-request field which contains seven bytes plus the data:

V The reference type-one byte (must be specified as 6)

V The Extended Memory file number-two bytes (1 ... 10, 0001 ... 000A hex)

V The starting register address within the file-two bytes

V The quantity of registers to be written-two bytes

V The data to be written-two bytes/register

The quantity of registers to be written, combined with all other fields in the query, must not exceed the allowable length of Modbus messages-256 bytes.

For controllers other than the 984-785 with Extended Registers, the last (highest) register in the last file is:

For the 984-785 with Extended Registers, the last (highest) register in the last file is shown in the two tables below.

Examples of a query and response follow. An example of a request to write one group of references into slave device 17 is shown. The group consists of three registers in file 4, starting at register 8 (address 0007).

Response

The normal response is an echo of the query.

2.2.15 22 (16 Hex) Mask Write 4x Register

Modifies the contents of a specified 4x register using a combination of an AND mask, an OR mask, and the register's current contents. The function can be used to set or clear individual bits in the register. Broadcast is not supported.

Note: This function is supported in the 984-785 controller only.

Query

The query specifies the 4x reference to be written, the data to be used as the AND mask, and the data to be used as the OR mask.

The function's algorithm is:

Result = (Current Contents AND And_Mask) OR (Or_Mask AND And_Mask )

For example,

Note: If the Or_Mask value is zero, the result is simply the logical ANDing of the current contents and And_Mask. If the And_Mask value is zero, the result is equal to the Or_Mask value.

Note: The contents of the register can be read with the Read Holding Registers function (function code 03). They could, however, be changed subsequently as the controller scans its user logic program.

Here is an example of a Mask Write to register 5 in slave device 17, using the above mask values:

Response

The normal response is an echo of the query. The response is returned after the register has been written.

2.2.16 23 (17 Hex) Read / Write 4x Registers

Performs a combination of one read and one write operation in a single Modbus transaction. The function can write new contents to a group of 4x registers, and then return the contents of another group of 4x registers. Broadcast is not supported.

Note: This function is supported in the 984-785 controller only.

Query

The query specifies the starting address and quantity of registers of the group to be read. It also specifies the starting address, quantity of registers, and data for the group to be written. The byte count field specifies the quantity of bytes to follow in the write data field.

Here is an example of a query to read six registers starting at register 5, and to write three registers starting at register 16, in slave device 17:

Response

The normal response contains the data from the group of registers that were read. The byte count field specifies the quantity of bytes to follow in the read data field.

Here is an example of a response to the query:

2.2.17 24 (18 Hex) Read FIFO Queue

Reads the contents of a first-in first-out (FIFO) queue of 4x registers. The function returns a count of the registers in the queue, followed by the queued data. Up to 32 registers can be read-the count, plus up to 31 queued data registers. The queue count register is returned first, followed by the queued data registers.

The function reads the queue contents, but does not clear them. Broadcast is not supported.

Note: This function is supported in the 984-785 controller only.

Query

The query specifies the starting 4x reference to be read from the FIFO queue. This is the address of the pointer register used with the controller's FIN and FOUT function blocks. It contains the count of registers currently contained in the queue. The FIFO data registers follow this address sequentially.

An example of a Read FIFO Queue query to slave device 17 is shown below. The query is to read the queue starting at the pointer register 41247 (04DE hex).

Response

In a normal response, the byte count shows the quantity of bytes to follow, including the queue count bytes and data register bytes (but not including the error check field).

The queue count is the quantity of data registers in the queue (not including the count register).

If the queue count exceeds 31, an exception response is returned with an error code of 03 (Illegal Data Value).

Here is an example of a normal response to the previous query:

In this example, the FIFO pointer register (41247 in the query) is returned with a queue count of 3. The three data registers follow the queue count. These are: