Table of Contents
Advertisement
Appendix G
Modbus Protocol Illustration
For a detailed specification of the Modbus protocol,
reference the Modicon website address
www.modbus.org.
The Modbus protocol provides the internal standard for
parsing messages. During communications on a Modbus
network, the protocol determines how each slave will
know its device address, recognize a message addressed
to it, determine the kind of action to be taken, and
extract any data or other information contained in the
message. If a reply is required, the slave will construct the
reply message and send it using Modbus protocol.
The following is a brief description of the Modbus com-
mands supported by the Modbus Network Card. Each
command consists of the following:
•
a sample query message that is sent out by the
master device to the designated slave
•
the slave's reply message to the master device
The query and reply messages show how the information
is packeted and sent out using the Modbus Protocol.
Each query message consists of the following:
•
Slave Address – address of the slave you wish to
establish communications with.
•
Function Code – code that lets the slave know what
command is being requested, e.g. read coil,
write single coil.
•
Starting Address High/Low Order – high and low
byte of the address the master reads from or
writes to. Coils and Registers are addressed start-
ing at 0. For instance Coil 1 is address 0 and
Register 40001 is address 0.
•
Error Check Field – contains either a CRC ( RTU
mode) or LRC ( ASCII mode) error check value.
The query message for specific functions requires some
of the following information:
•
Number of Data Points High/Low Order – high
and low byte of the number of addresses the
master wants to read.
•
Data High/Low Order – high and low byte of the
data that will be written to the slave device.
•
Number of Coils High/Low Order – high and low
byte for the number of coils to force ON
or OFF .
•
Number of Regs High/Low Order – high and low
byte for the number of registers to preset.
•
Byte Count – is the number of data bytes which
are sent to the slave.
ABB Zenith
I
These query and reply messages are for both RTU and
ASCII
Field contains a CRC or LRC respectively. Each value
in the query message is a hexadecimal value.
Read Coil Status (Function Code 01)
Query
This function allows the master device to obtain the
/ OFF bit status of various coils from the
ON
addressed slave.
Figure G1 is a sample read coil status request to read
coils 9-24 ( MX 150/250 status bits) from slave device 5.
Slave
Address
05h
Figure G1 – Read Coil Status Query Message
Response
An example response to the Read Coil Status is shown
in Figure G2. The response includes the slave address,
function code, number of data bytes sent, the data,
and error checking.
Slave
Address
05h
Figure G2 – Read Coil Status Response Message
The data consists of one bit per coil (1= ON , 0= OFF ).
The status of coils 9-16 is C1 (hex) or 1100 0001 (binary).
Reading left to right, coils 16, 15, and 9 are ON and the
remainder is OFF . The other data byte is decoded similarly.
Read Holding Register (Function Code 03)
Read holding registers allows the master device to obtain
the binary contents of holding registers 4xxxx in the
addressed slave.
Query
Figure G3 is an example that reads registers
40006-40007 from slave 8.
Slave
Address
08h
Figure G3 – Read Holding Register Query Message
MX150/MX250 Series Modbus Network Card (71R-2200)
modes depending on whether the Error Check
Starting
Starting
Function
Address
Address
Code
High Order
Low Order
01h
00h
08h
Data Coil
Function
Byte
Status
Code
Count
9-16
01h
02h
C1h
Starting
Starting
Function
Address
Address
Code
High Order
Low Order
03h
00h
05h
Error
No. of Data
No. of Data
Check Field
Points
Points
(LRC or
High Order
Low Order
CRC)
00h
10h
—
Data Coil
Error Check Field
Status
(LRC or CRC)
17-24
A2h
—
Error
No. of Data
No. of Data
Check Field
Points
Points
(LRC or
High Order
Low Order
CRC)
00h
02h
—
19
I
Advertisement
Table of Contents
