11/20/2016

SimplyModbusAboutModbus

Home

About
MODBUS
fc01
fc02
fc03
fc04
fc05
fc06
fc15
fc16
ASCII
TCP
exceptions

About
Enron
MODBUS

RTUMaster

RTUSlave

TCPClient

Download

Purchase

Contact

FrequentlyAskedQuestions

WhatisModbus?

Whatisitusedfor?

Howdoesitwork?

Whatishexadecimal?
HowisdatastoredinStandardModbus?
Whatisafunctioncode?
WhatisaCRC?
WhataretheformatsofModbuscommandsandresponses?
Whataredatatypes?
Whatisbyteandwordordering?
WhatisaModbusMap?
WhatisthedifferencebetweenModbusASCIIandModbusRTU?
Whatareextendedregisteraddresses?
Howdoes2byteaddressingwork?
Howcanyousendeventsandhistoricaldata?
WhatisEnronModbus?
Whatelse?

WhatisModbus?
ModbusisaserialcommunicationprotocoldevelopedbyModiconpublishedbyModiconin1979
forusewithitsprogrammablelogiccontrollers(PLCs).Insimpleterms,itisamethodusedfor
transmittinginformationoverseriallinesbetweenelectronicdevices.Thedevicerequestingthe
informationiscalledtheModbusMasterandthedevicessupplyinginformationareModbusSlaves.
InastandardModbusnetwork,thereisoneMasterandupto247Slaves,eachwithauniqueSlave
Addressfrom1to247.TheMastercanalsowriteinformationtotheSlaves.
TheofficialModbusspecificationcanbefoundatwww.modbus.org/specs.php.
Whatisitusedfor?
Modbusisanopenprotocol,meaningthatit'sfreeformanufacturerstobuildintotheirequipment
withouthavingtopayroyalties.Ithasbecomeastandardcommunicationsprotocolinindustry,and
isnowthemostcommonlyavailablemeansofconnectingindustrialelectronicdevices.Itisused
widelybymanymanufacturersthroughoutmanyindustries.Modbusistypicallyusedtotransmit
signalsfrominstrumentationandcontroldevicesbacktoamaincontrollerordatagathering
system,forexampleasystemthatmeasurestemperatureandhumidityandcommunicatestheresults
toacomputer.Modbusisoftenusedtoconnectasupervisorycomputerwitharemoteterminalunit
(RTU)insupervisorycontrolanddataacquisition(SCADA)systems.VersionsoftheModbus
protocolexistforseriallines(ModbusRTUandModbusASCII)andforEthernet(ModbusTCP).
Howdoesitwork?
Modbusistransmittedoverseriallinesbetweendevices.Thesimplestsetupwouldbeasingleserial
cableconnectingtheserialportsontwodevices,aMasterandaSlave.

>

Thedataissentasseriesofonesandzeroescalledbits.Eachbitissentasavoltage.Zeroesaresent
aspositivevoltagesandaonesasnegative.Thebitsaresentveryquickly.Atypicaltransmission
speedis9600baud(bitspersecond).
Whatishexadecimal?
Whentroubleshootingproblems,itcanbehelpfultoseetheactualrawdatabeingtransmitted.
Longstringsofonesandzeroesaredifficulttoread,sothebitsarecombinedandshownin
hexadecimal.Eachblockof4bitsisrepresentedbyoneofthesixteencharactersfrom0toF.
0000=0

http://www.simplymodbus.ca/FAQ.htm#Modbus

0100=4

1000=8

1100=C

1/4

11/20/2016

SimplyModbusAboutModbus
0001=1

0101=5

1001=9

1101=D

0010=2

0110=6

1010=A

1110=E

0011=3

0111=7

1011=B

1111=F

Eachblockof8bits(calledabyte)isrepresentedbyoneofthe256characterpairsfrom00toFF.
WhatisASCII?
ASCIIstandforAmericanStandardCodeforInformationInterchange.Inthesamewaythatevery
4bitscanbecombinedandrepresentedbyoneofsixteenhexadecimalcharactersfrom0toF,
every8bits(everybyte)canbecombinedandrepresentedbyoneof256ASCIIcharacters,
includingthecommonkeyboardcharacters.Forexample,someofthevaluesforASCIIcharacters
are...
decimal
(base10)

binary
(base2)

Hex
(base16)

ASCII
(base256)

00000000

00

null

00000001

01

"

34

00100010

22

35

00100011

23

36

00100100

24

47

00101111

2F

48

00110000

30

49

00110001

31

56

00111000

38

57

00111001

39

58

00111010

3A

64

01000000

40

65

01000001

41

66

01000010

42

89

01011001

59

90

01011010

5A

91

01011011

5B

95

01011111

5F

96

01100000

60

97

01100001

61

122

01111010

7A

123

01111011

7B

174

10101110

AE

255

11111111

FF

HowisdatastoredinStandardModbus?
InformationisstoredintheSlavedeviceinfourdifferenttables.
Twotablesstoreon/offdiscretevalues(coils)andtwostorenumericalvalues(registers).Thecoils
andregisterseachhaveareadonlytableandreadwritetable.
Eachtablehas9999values.
Eachcoilorcontactis1bitandassignedadataaddressbetween0000and270E.
Eachregisteris1word=16bits=2bytesandalsohasdataaddressbetween0000and270E.
Coil/RegisterNumbers

DataAddresses

Type

TableName

19999

0000to270E

ReadWrite

DiscreteOutputCoils

1000119999

DiscreteInputContacts

0000to270E

ReadOnly

3000139999

0000to270E

ReadOnly

AnalogInputRegisters

4000149999

0000to270E

ReadWrite

AnalogOutputHoldingRegisters

Coil/RegisterNumberscanbethoughtofaslocationnamessincetheydonotappearintheactual
messages.TheDataAddressesareusedinthemessages.
Forexample,thefirstHoldingRegister,number40001,hastheDataAddress0000.
Thedifferencebetweenthesetwovaluesistheoffset.
Eachtablehasadifferentoffset.1,10001,30001and40001.
WhatistheSlaveID?
Eachslaveinanetworkisassignedauniqueunitaddressfrom1to247.Whenthemasterrequests
data,thefirstbyteitsendsistheSlaveaddress.Thiswayeachslaveknowsafterthefirstbyte
whetherornottoignorethemessage.
Whatisafunctioncode?
ThesecondbytesentbytheMasteristheFunctioncode.Thisnumbertellstheslavewhichtableto
accessandwhethertoreadfromorwritetothetable.

http://www.simplymodbus.ca/FAQ.htm#Modbus

2/4

11/20/2016

SimplyModbusAboutModbus
FunctionCode

Action

TableName

01(01hex)

Read

DiscreteOutputCoils

05(05hex)

Writesingle

DiscreteOutputCoil

15(0Fhex)

Writemultiple

DiscreteOutputCoils

02(02hex)

Read

DiscreteInputContacts

04(04hex)

Read

AnalogInputRegisters

03(03hex)

Read

AnalogOutputHoldingRegisters

06(06hex)

Writesingle

AnalogOutputHoldingRegister

16(10hex)

Writemultiple

AnalogOutputHoldingRegisters

WhatisaCRC?
CRCstandsforCyclicRedundancycheck.Itistwobytesaddedtotheendofeverymodbus
messageforerrordetection.EverybyteinthemessageisusedtocalculatetheCRC.Thereceiving
devicealsocalculatestheCRCandcomparesittotheCRCfromthesendingdevice.Ifevenonebit
inthemessageisreceivedincorrectly,theCRCswillbedifferentandanerrorwillresult.
HereisaspreadsheetCRCcalculatorformessagesupto16bytes.
Todownloadacopy,rightclickandselectSaveTargetAs...
WhataretheformatsofModbuscommandsandresponses?
Followthelinksinthistabletoseeexamplesoftherequestsandresponses.
DataAddresses

Read

WriteSingle

WriteMultiple

DiscreteOutputCoils0xxxx

FC01

FC05

FC15

DiscreteInputContacts1xxxx

FC02

NA

NA

AnalogInputRegisters3xxxx

FC04

NA

NA

AnalogOutputHoldingRegisters4xxxx

FC03

FC06

FC16

Whataredatatypes?
TheexampleforFC03showsthatregister40108containsAE41
whichconvertstothe16bits1010111001000001

Great!Butwhatdoesitmean?Well,itcouldmeanafewthings.
Register40108couldbedefinedasanyofthese16bitdatatypes:
A16bitunsignedinteger(awholenumberbetween0and65535)
register40108containsAE41=44,609(hextodecimalconversion)
A16bitsignedinteger(awholenumberbetween32768and32767)
AE41=20,927
(hextodecimalconversionthatwraps,ifitsover32767thensubtract65536)
AtwocharacterASCIIstring(2typedletters)
AE41=A
Adiscreteon/offvalue(thisworksthesameas16bitintegerswithavalueof0or1.
Thehexdatawouldbe0000or0001)
Register40108couldalsobecombinedwith40109toformanyofthese32bitdatatypes:
A32bitunsignedinteger(anumberbetween0and4,294,967,295)
40108,40109=AE415652=2,923,517,522
A32bitsignedinteger(anumberbetween2,147,483,648and2,147,483,647)
AE415652=1,371,449,774
A32bitsingleprecisionIEEEfloatingpointnumber.
Thisisamathematicalformulathatallowsanyrealnumber(anumberwithdecimal
points)torepresentedby32bitswithanaccuracyofaboutsevendigits.
AE415652=4.395978E11
HereisaspreadsheetIEEEfloatcalculatorforinputsof4bytesor2words.
Todownloadacopy,rightclickandselectSaveTargetAs...
AfourcharacterASCIIstring(4typedletters)
AE415652=AVR
MoreregisterscanbecombinedtoformlongerASCIIstrings.Eachregisterbeingusedtostore
twoASCIIcharacters(twobytes).
Whatisbyteandwordordering?
TheModbusspecificationdoesn'tdefineexactlyhowthedataisstoredintheregisters.Therefore,
somemanufacturersimplementedmodbusintheirequipmenttostoreandtransmitthehigherbyte
firstfollowedbythelowerbyte.(AEbefore41).
Alternatively,othersstoreandtransmitthelowerbytefirst(41beforeAE).
Similarly,whenregistersarecombinedtorepresent32bitdatatypes,Somedevicesstorethe
higher16bits(highword)inthefirstregisterandtheremaininglowwordinthesecond(AE41
before5652)whileothersdotheopposite(5652beforeAE41)
Itdoesn'tmatterwhichorderthebytesorwordsaresentin,aslongasthereceivingdeviceknows
whichwaytoexpectit.
Forexample,ifthenumber2,923,517,522wastobesentasa32bitunsignedinteger,itcouldbe
arrangedanyofthesefourways.

http://www.simplymodbus.ca/FAQ.htm#Modbus

3/4

11/20/2016

SimplyModbusAboutModbus
alsoknowas
AE415652highbytefirsthighwordfirst"bigendian"
5652AE41highbytefirstlowwordfirst
41AE5256lowbytefirsthighwordfirst
525641AElowbytefirstlowwordfirst"littleendian"
WhatisaModbusMap?
Amodbusmapissimplyalistforaslavedevicethatdefines
whatthedatais(eg.pressureortemperaturereadings)
wherethedataisstored(whichtablesanddataaddresses)
howthedataisstored(datatypes,byteandwordordering)
Somedevicesarebuiltwithafixedmapthatisdefinedbythemanufacturer.Whileotherdevices
allowtheoperatortoconfigureorprogramacustommaptofittheirneeds.
WhatisthedifferencebetweenModbusASCIIandModbusRTU?
Thedifferencebetweenthesetwomodesisexplainedhere.
Whatareextendedregisteraddresses?
Sincetherangeoftheanalogoutputholdingregistersis40001to49999,itimpliesthatthere
cannotbemorethan9999registers.Althoughthisisusuallyenoughformostapplications,thereare
caseswheremoreregisterswouldbebeneficial.
Registers40001to49999correspondtodataaddresses0000to270E.Ifweutilizetheremaining
dataaddresses270FtoFFFF,oversixtimesasmanyregisterscanbeavailable,65536intotal.
Thiswouldcorrespondtoregisternumbersfrom40001to105536.
Manymodbussoftwaredrivers(forMasterPCs)werewrittenwiththe40001to49999limitsand
cannotaccessextendedregistersinslavedevices.Andmanyslavedevicesdonotsupportmaps
usingtheextendedregisters.Butontheotherhand,someslavedevicesdosupporttheseregisters
andsomeMastersoftwarecanaccessit,especiallyifcustomsoftwareiswritten.
Howdoes2byteslaveaddressingwork?
Sinceasinglebyteisnormallyusedtodefinetheslaveaddressandeachslaveonanetwork
requiresauniqueaddress,thenumberofslavesonanetworkislimitedto256.Thelimitdefinedin
themodbusspecificationisevenlowerat247.
Togetbeyondthislimit,amodificationcanbemadetotheprotocoltousetwobytesforthe
address.Themasterandtheslaveswouldallberequiredtosupportthismodification.Twobyte
addressingextendsthelimitonthenumberofslavesinanetworkto65535.
Bydefault,theSimplyModbussoftwareuses1byteaddressing.Whenanaddressgreaterthan255
isentered,thesoftwareautomaticallyswitchesto2byteaddressingandstaysinthismodeforall
addressesuntilthe2byteaddressingismanuallyturnedoff.
Howcanyousendeventsandhistoricaldata?
EnronModbusincludescommandsformovingeventsandhistoricaldata..
WhatisEnronModbus?
EnronModbusisamodificationtothestandardModiconmodbuscommunicationprotocol
developedbyEnronCorporation.
SeeEnronModbusfordetails.
Whatelse?
Ifyoureadthispage,Wewouldlovetohearyourcomments.Pleasesendanemailto
info@simplymodbus.caandletusknowwhatyoufoundhelpfulandwhattopicswecouldadd,
expandorclarify.
HomeFAQEnronDownloadPurchaseContact
Copyright2015SimplyModbus.Allrightsreserved

http://www.simplymodbus.ca/FAQ.htm#Modbus

4/4