Modbus Functions
General Description
The Modbus protocol offers a number of functions that are used to read or write data over the Modbus network. The Modbus protocol also offers diagnostic and network-management functions.
Only the Modbus functions handled by the circuit breaker are described here.
Read Functions
The following read functions are available:
|
Function Code |
Subfunction Code |
Name |
Description |
|---|---|---|---|
|
3 (0x03) |
– |
Read holding registers |
Read n output or internal registers |
|
4 (0x04) |
– |
Read input registers |
Read n input registers |
|
43 (0x2B) |
14 (0x0E) |
Read device identification |
Read the identification data of the slave |
|
43 (0x2B) |
15 (0x0F) |
Get date and time |
Read the date and time of the slave |
Read Register Example
The following table shows how to read the RMS current on phase 1 (I1) in registers 21037 and 21038. The address of register 21037 is 21037 - 1 = 21036 = 0x522C. The Modbus address of the Modbus slave is 47 = 0x2F.
|
Master Request |
Slave Reply |
||
|---|---|---|---|
|
Field Name |
Example |
Field Name |
Example |
|
Modbus slave address |
0x2F |
Modbus slave address |
0x2F |
|
Function code |
0x03 |
Function code |
0x03 |
|
Address of the register to read (MSB) |
0x52 |
Data length in bytes |
0x04 |
|
Address of the register to read (LSB) |
0x2C |
Register 1 value (MSB) |
0x44 |
|
Number of registers (MSB) |
0x00 |
Register 1 value (LSB) |
0x0A |
|
Number of registers (LSB) |
0x02 |
Register 2 value (MSB) |
0xC0 |
|
CRC (MSB) |
0xXX |
Register 2 value (LSB) |
0x00 |
|
CRC (LSB) |
0xXX |
CRC (MSB) |
0xXX |
|
– |
CRC (LSB) |
0xXX |
|
The content of registers 21037 and 21038 in FLOAT32 is 0x440AC000. Therefore, the RMS current on phase 1 (I1) is 555.00 A.
Get Date and Time Example
The following table shows how to get the date and time of a Modbus slave.The Modbus address of the Modbus slave is 47 = 0x2F.
|
Master Request |
Slave Reply |
||
|---|---|---|---|
|
Field Name |
Example |
Field Name |
Example |
|
Modbus slave address |
0x2F |
Modbus slave address |
0x2F |
|
Function code |
0x2B |
Function code |
0x2B |
|
Subfunction code |
0x0F |
Subfunction code |
0x0F |
|
Reserved |
0x00 |
Reserved |
0x00 |
|
– |
– |
Date and time |
Refer to Data Type: DATETIME |
Set Date and Time Example
The following table shows how to set date and time of a Modbus slave. The Modbus address of the Modbus slave is 47 = 0x2F, the new date is October 2, 2014, and the new time is 2:32:03:500 p.m.
|
Master Request |
Slave Reply |
||
|---|---|---|---|
|
Field Name |
Example |
Field Name |
Example |
|
Modbus slave address |
0x2F |
Modbus slave address |
0x2F |
|
Function code |
0x2B |
Function code |
0x2B |
|
Subfunction code |
0x10 |
Subfunction code |
0x10 |
|
Reserved1 |
0x00 |
Reserved1 |
0x00 |
|
Not used |
0x00 |
Not used |
0x00 |
|
Year = 2014 |
0x0E |
Year = 2014 |
0x0E |
|
Month = October |
0x0A |
Month = October |
0x0A |
|
Day Of Month = 2 |
0x02 |
Day Of Month = 2 |
0x02 |
|
Hour = 14 |
0x0E |
Hour = 14 |
0x0E |
|
Minutes = 32 |
0x20 |
Minutes = 32 |
0x20 |
|
3 sec. 500 ms |
0x0DAC |
3 sec. 502 ms |
0x0DAE |
The normal response is an echo of the request, returned after the date-time has been updated in the remote device. If the date-time structure content is not consistent with a true date-time (that is, an invalid date-time), the value returned in the Date-Time field is set to 0 by the device.
In case of 24 Vdc power loss, the date and time of the Modbus slaves without battery is not refreshed anymore. It is therefore mandatory to set date and time for all Modbus slaves after recovering the 24 Vdc power supply.
Furthermore, due to the clock drift of each Modbus slave, it is mandatory to set date and time for all Modbus slaves periodically. Recommended period is at least every 15 minutes.
Scattered Holding Register Read Function
The scattered holding register read function is available:
|
Function Code |
Subfunction Code |
Name |
Description |
|---|---|---|---|
|
100 (0x64) |
4 (0x04) |
Read scattered holding register |
Read n non-contiguous registers |
The maximum value for n is 100.
The scattered holding register read function enables the user to:
-
avoid reading a large block of contiguous registers when only few registers are needed
-
avoid multiple use of functions 3 and 4 in order to read non-contiguous registers
Scattered Holding Register Read Example
The following table shows how to read the addresses of the register 664 (address 0x0297) and register 666 (address 0x0299) of a Modbus slave. The Modbus address of the Modbus slave is 47 = 0x2F.
|
Master Request |
Slave Reply |
||
|---|---|---|---|
|
Field Name |
Example |
Field Name |
Example |
|
Modbus slave address |
0x2F |
Modbus slave address |
0x2F |
|
Function code |
0x64 |
Function code |
0x64 |
|
Data length in bytes |
0x06 |
Data length in bytes |
0x06 |
|
Subfunction code |
0x04 |
Subfunction code |
0x04 |
|
Transmission number(1) |
0xXX |
Transmission number(1) |
0xXX |
|
Address of first register to read (MSB) |
0x02 |
Value of the first register read (MSB) |
0x12 |
|
Address of first register to read (LSB) |
0x97 |
Value of the first register read (LSB) |
0x0A |
|
Address of second register to read (MSB) |
0x02 |
Value of the second register read (MSB) |
0x74 |
|
Address of second register to read (LSB) |
0x99 |
Value of the second register read (LSB) |
0x0C |
|
CRC (MSB) |
0xXX |
CRC (MSB) |
0xXX |
|
CRC (LSB) |
0xXX |
CRC (LSB) |
0xXX |
|
(1) The master gives the transmission number in the request. The slave returns the same number in the reply. |
|||
Write Functions
The following write functions are available:
|
Function Code |
Subfunction Code |
Name |
Description |
|---|---|---|---|
|
6 (0x06) |
– |
Preset single register |
Write 1 register |
|
16 (0x10) |
– |
Preset multiple registers |
Write n registers |
|
43 (0x2B) |
16 (0x10) |
Set date and time |
Write the date and time of the slave |
Diagnostic Functions
The following diagnostic functions are available:
|
Function Code |
Subfunction Code (2 bytes) |
Name |
Description |
|---|---|---|---|
|
8 (0x08) |
10 (0x000A) |
Clear counters and diagnostic register |
Reset all diagnostic counters |
|
8 (0x08) |
11 (0x000B) |
Return bus message counter |
Read the counter of correct bus messages managed by the slave |
|
8 (0x08) |
12 (0x000C) |
Return bus communication error counter |
Read the counter of incorrect bus messages managed by the slave |
|
8 (0x08) |
13 (0x000D) |
Return bus exception error counter |
Read the counter of exception responses managed by the slave |
|
8 (0x08) |
14 (0x000E) |
Return slave message counter |
Read the counter of messages sent to the slave |
|
8 (0x08) |
15 (0x000F) |
Return slave no response counter |
Read the counter of broadcast messages |
|
8 (0x08) |
16 (0x0010) |
Return slave negative acknowledge counter |
Read the counter of messages sent to the slave but not answered because of the Negative Acknowledge exception code 07 |
|
8 (0x08) |
17 (0x0011) |
Return slave busy counter |
Read the counter of messages sent to the slave but not answered because of the Slave Device Busy exception code 06 |
|
8 (0x08) |
18 (0x0012) |
Return bus overrun counter |
Read the counter of incorrect bus messages due to overrun errors |
|
11 (0x0B) |
– |
Get communication event counter |
Read Modbus event counter |
Diagnostic Counters
Modbus uses diagnostic counters to enable performance and error management. The counters are accessible using the Modbus diagnostic functions (function codes 8 and 11). The Modbus diagnostic counters and the Modbus event counter are described in the following table:
|
Counter Number |
Counter Name |
Description |
|---|---|---|
|
1 |
Bus message counter |
Counter of correct bus messages managed by the slave |
|
2 |
Bus communication error counter |
Counter of incorrect bus messages managed by the slave |
|
3 |
Slave exception error counter |
Counter of exception responses managed by the slave and incorrect broadcast messages |
|
4 |
Slave message counter |
Counter of messages sent to the slave |
|
5 |
Slave no response counter |
Counter of broadcast messages |
|
6 |
Slave negative acknowledge counter |
Counter of messages sent to the slave but not answered because of the Negative Acknowledge exception code 07 |
|
7 |
Slave busy count |
Counter of messages sent to the slave but not answered because of the Slave Device Busy exception code 06 |
|
8 |
Bus character overrun counter |
Counter of incorrect bus messages due to overrun errors |
|
9 |
Comm. event counter |
Modbus event counter (this counter is read with function code 11) |
Counters Reset
The diagnostic counters are reset to 0 when:
-
the maximum value 65535 is reached
-
they are reset by a Modbus command (function code 8, sub-function code 10)
-
the power supply is lost
-
the communication parameters are modified.