Modbus Functions

General Description

The Modbus protocol offers a number of functions that are used to read or write data over the Modbus network. The Modbus protocol also offers diagnostic and network-management functions.

Only the Modbus functions handled by the circuit breaker are described here.

Read Functions

The following read functions are available:

Function Code	Subfunction Code	Name	Description
3 (0x03)	–	Read holding registers	Read n output or internal registers
4 (0x04)	–	Read input registers	Read n input registers
43 (0x2B)	14 (0x0E)	Read device identification	Read the identification data of the server
43 (0x2B)	15 (0x0F)	Get date and time	Read the date and time of the server

NOTE: Number of registers n is limited to 52 with MasterPacT MicroLogic E trip unit.

Read Register Example

The following table shows how to read the rms current on phase 1 (I1) in register 1016. The address of register 1016 is 1016 - 1 = 1015 = 0x03F7. The Modbus address of the Modbus server is 47 = 0x2F.

Client Request		Server Reply
Field Name	Example	Field Name	Example
Modbus server address	0x2F	Modbus server address	0x2F
Function code	0x03	Function code	0x03
Address of the register to read (MSB)	0x03	Data length in bytes	0x02
Address of the register to read (LSB)	0xF7	Register value (MSB)	0x02
Number of registers (MSB)	0x00	Register value (LSB)	0x2B
Number of registers (LSB)	0x01	CRC (MSB)	0xXX
CRC (MSB)	0xXX	CRC (LSB)	0xXX
CRC (LSB)	0xXX	–

The content of register 1016 (address 0x03F7) is 0x022B = 555. Therefore, the rms current on phase 1 (I1) is 555 A.

Get Date and Time Example

The following table shows how to get the date and time of a Modbus server.The Modbus address of the Modbus server is 47 = 0x2F.

Client Request		Server Reply
Field Name	Example	Field Name	Example
Modbus server address	0x2F	Modbus server address	0x2F
Function code	0x2B	Function code	0x2B
Subfunction code	0x0F	Subfunction code	0x0F
Reserved	0x00	Reserved	0x00
–	–	Date and time	Refer to the DATETIME data type

Set Date and Time Example

The following table shows how to set date and time of a Modbus server. The Modbus address of the Modbus server is 47 = 0x2F, the new date is October 2, 2014, and the new time is 2:32:03:500 p.m.

NOTE: Use the broadcast mode (with Modbus server address = 0) to set the date and time of all Modbus servers.

Client Request		Server Reply
Field Name	Example	Field Name	Example
Modbus server address	0x2F	Modbus server address	0x2F
Function code	0x2B	Function code	0x2B
Subfunction code	0x10	Subfunction code	0x10
Reserved1	0x00	Reserved1	0x00
Not used	0x00	Not used	0x00
Year = 2014	0x0E	Year = 2014	0x0E
Month = October	0x0A	Month = October	0x0A
Day Of Month = 2	0x02	Day Of Month = 2	0x02
Hour = 14	0x0E	Hour = 14	0x0E
Minutes = 32	0x20	Minutes = 32	0x20
3 sec. 500 ms	0x0DAC	3 sec. 502 ms	0x0DAE

The normal response is an echo of the request, returned after the date-time has been updated in the remote device. If the date-time structure content is not consistent with a true date-time (that is, an invalid date-time), the value returned in the Date-Time field is set to 0 by the device.

In case of 24 Vdc power loss, the date and time of the Modbus servers without battery is not refreshed anymore. It is therefore mandatory to set date and time for all Modbus servers after recovering the 24 Vdc power supply.

Furthermore, due to the clock drift of each Modbus server, it is mandatory to set date and time for all Modbus servers periodically. Recommended period is at least every 15 minutes.

Scattered Holding Register Read Function

The scattered holding register read function is available:

Function Code	Subfunction Code	Name	Description
100 (0x64)	4 (0x04)	Read scattered holding register	Read n non-contiguous registers

The maximum value for n is 100 but when using a MasterPacT MicroLogic A or E trip unit, it is recommended to have n lower or equal to 21.

The scattered holding register read function enables the user to:

avoid reading a large block of contiguous registers when only few registers are needed
avoid multiple use of functions 3 and 4 in order to read non-contiguous registers

Read Scattered Holding Register Example

The following table shows how to read the addresses of the register 664 (address 0x0297) and register 666 (address 0x0299) of a Modbus server. The Modbus address of the Modbus server is 47 = 0x2F.

Client Request		Server Reply
Field Name	Example	Field Name	Example
Modbus server address	0x2F	Modbus server address	0x2F
Function code	0x64	Function code	0x64
Data length in bytes	0x06	Data length in bytes	0x06
Subfunction code	0x04	Subfunction code	0x04
Transmission number⁽¹⁾	0xXX	Transmission number⁽¹⁾	0xXX
Address of first register to read (MSB)	0x02	Value of the first register read (MSB)	0x12
Address of first register to read (LSB)	0x97	Value of the first register read (LSB)	0x0A
Address of second register to read (MSB)	0x02	Value of the second register read (MSB)	0x74
Address of second register to read (LSB)	0x99	Value of the second register read (LSB)	0x0C
CRC (MSB)	0xXX	CRC (MSB)	0xXX
CRC (LSB)	0xXX	CRC (LSB)	0xXX
(1) The client gives the transmission number in the request. The server returns the same number in the reply.

Write Functions

The following write functions are available:

Function Code	Subfunction Code	Name	Description
6 (0x06)	–	Preset single register	Write 1 register
16 (0x10)	–	Preset multiple registers	Write n registers
43 (0x2B)	16 (0x10)	Set date and time	Write the date and time of the server

NOTE: Number of registers n is limited to 52 with MasterPacT MicroLogic E trip units.

Diagnostic Functions

The following diagnostic functions are available:

Function Code	Subfunction Code	Name	Description
8 (0x08)	–	Diagnostic	Manage diagnostic counters
8 (0x08)	10 (0x0A)	Clear counters and diagnostic register	Reset all diagnostic counters
8 (0x08)	11 (0x0B)	Return bus message counter	Read the counter of correct bus messages managed by the server
8 (0x08)	12 (0x0C)	Return bus communication error counter	Read the counter of incorrect bus messages managed by the server
8 (0x08)	13 (0x0D)	Return bus exception error counter	Read the counter of exception responses managed by the server
8 (0x08)	14 (0x0E)	Return server message counter	Read the counter of messages sent to the server
8 (0x08)	15 (0x0F)	Return server no response counter	Read the counter of broadcast messages
8 (0x08)	16 (0x10)	Return server negative acknowledge counter	Read the counter of messages sent to the server but not answered because of the Negative Acknowledge exception code 07
8 (0x08)	17 (0x11)	Return server busy counter	Read the counter of messages sent to the server but not answered because of the Server Device Busy exception code 06
8 (0x08)	18 (0x12)	Return bus overrun counter	Read the counter of incorrect bus messages due to overrun errors
11 (0x0B)	–	Get communication event counter	Read Modbus event counter

Diagnostic Counters

Modbus uses diagnostic counters to enable performance and error management. The counters are accessible using the Modbus diagnostic functions (function codes 8 and 11). The Modbus diagnostic counters and the Modbus event counter are described in the following table:

Counter Number	Counter Name	Description
1	Bus message counter	Counter of correct bus messages managed by the server
2	Bus communication error counter	Counter of incorrect bus messages managed by the server
3	Server exception error counter	Counter of exception responses managed by the server and incorrect broadcast messages
4	Server message counter	Counter of messages sent to the server
5	Server no response counter	Counter of broadcast messages
6	Server negative acknowledge counter	Counter of messages sent to the server but not answered because of the Negative Acknowledge exception code 07
7	Server busy count	Counter of messages sent to the server but not answered because of the Server Device Busy exception code 06
8	Bus character overrun counter	Counter of incorrect bus messages due to overrun errors
9	Comm. event counter	Modbus event counter (this counter is read with function code 11)

Counters Reset

The diagnostic counters are reset to 0 when:

the maximum value 65535 is reached,
they are reset by a Modbus command (function code 8, sub-function code 10),
the power supply is lost,
the communication parameters are modified.