Skip to Content

Register Login

Industry Online Support

Technical Forum

Navigation

Modbus slave RTU Function Code 4

Created by: Sean Greaves at: 5/11/2010 10:11 AM (5 Replies)

Rating (1)

Thanks 3

6 Entries

5/11/2010 10:11 AM	Rate (0)
Sean Greaves Experienced Member Joined: 9/27/2006 Last visit: 1/17/2022 Posts: 62 Rating: (0)	Hello This is the first time I have used Modbus communications in S7 (CP341-RS422/485 6ES7 341-1CH02-0AE0)and I am having trouble understanding the assignment of DB numbers, base/offset numbers and resulting word numbers. I am using Fuction Code 4 (read input registers) and would like to use DB300 as my base-DB-number, the information sent to the Modbus master would be 7 words within DB300 starting at DBW300 would the actual decimal number be 30301 input register. Hope you understand the enquiry any help would be appreciated. Gengus

Suggestion To thank Quote Answer

5/11/2010 11:35 AM	Rate (1)
smiffy Platinum Expert Joined: 1/17/2007 Last visit: 10/21/2024 Posts: 1547 Rating: (537)	The address you encode into DB300 would not be 30301 it would actually be 300. This is because the modbus driver requires an OFFSET not the actual modbus address. The actual modbus address (30001) is only still used for historical reasons. When Modicon originally designed the modbus protocol, this undoubtably related to a actual memory address in their PLC, but it has no meaning to modern day PLC's. It is just a convenient way of referring to the data. Modbus has 4 types of data:- Coils: Addressed as digitals (each new address maps to a bit), can be read from or written to and have a base address of 00001 in modbus speak, and are accessed using function codes 1, 5 & 15. Discrete Inputs: Addressed as digitals (each new address maps to a bit), are read only (cannot be written to) and have a base address of 10001 in modbus speak and are accessed using function code 2. Holding registers: Addressed as analogues (each new address maps to a 16-bit register), can be read from or written to and have a base address of 40001 in modbus speak, and are accessed using function codes 3, 6 & 16. Input registers: Addressed as analogues (each new address maps to a 16-bit register), are read only (cannot be written to) and have a base address of 30001 in modbus speak and are accessed using function code 4. The offset value you specify for the start address is the offset from these base addresses. So and offset of 100 refers to modbus coil address 00101, modbus discrete input address 10101, modbus holding register address 40101 and modbus input register address 30101. So in your particular case, you want to access modbus address 30301. So the offset value you specify would be 30301 - input register base address of 30001 = 300.
	Programming today is the race between software engineers building bigger and better idiot proof programs, and the universe producing bigger and better idiots. So far, the universe is winning...
Suggestion To thank Quote Answer
This contribution was helpful to 3 thankful Users J_Bell dchartier sk0t

5/11/2010 11:57 AM	Rate (0)
Sean Greaves Experienced Member Joined: 9/27/2006 Last visit: 1/17/2022 Posts: 62 Rating: (0)	Hi Smiffy Thank you for your reply. When I configure my data block (DB300) must it be 512 words in length.When the Modbus master reads the complete word address can it use the individual bit addresses and if so can all 16 bits be used for system informationor aresome required for message status etc. Thank you Sean

Suggestion To thank Quote Answer

5/11/2010 4:58 PM	Rate (0)
smiffy Platinum Expert Joined: 1/17/2007 Last visit: 10/21/2024 Posts: 1547 Rating: (537)	Gengus When I configure my data block (DB300) must it be 512 words in length. The size of your DB will depend on a number of things:- 1) Are you the slave or the master? 2) If you are a slave, how big is your database? If master, how much data are you asking for from the slave? Gengus When the Modbus master reads the complete word address can it use the individual bit addresses and if so can all 16 bits be used for system informationor aresome required for message status etc. I am not sure I entirely understand what you are asking here. All sixteen bits of the data registers are free for your use. The modbus protocol does not put any system data in these. The data registers will be part of one of your interface DB's. You will not be reading / sending bits, you will be reading / sending 16-bit registers as you are using function code 4 which is read input registers. These data registers can contain any data you like, the modbus protocol driver does not care - to it, it is just data nothing else. You could send real values (spread over 2 registers), integers, or 16 bits packed into a register. The data format is entirely up to you. The only thing to be aware of is that you have to read / send a full register, you cannot read / send a part-register. So if you are using a register to hold packed bits and you are only holding (say) six bits in it, you would still have to read the whole 16-bit register. With digital specific data base types (coils or discrete inputs), you can read a specific amount of bits, even down to a single bit (but even with this the minimum amount of data that can be sent is 1 byte - in this case the unused bits of the byte will be padded with zeros). Both ends must be aware of how the data is formatted so they can encode / decode the data as intended. For example, if one end is using a register that contains packed digitals, and the other end decodes this as an integer, then it will get a strange value. The format for the data has to be agreed by both ends and the application layer has to decode the data and use it as intended.
	Last edited by: smiffy at: 5/12/2010 12:24 PM Programming today is the race between software engineers building bigger and better idiot proof programs, and the universe producing bigger and better idiots. So far, the universe is winning...
Suggestion To thank Quote Answer

5/11/2010 5:03 PM	Rate (0)
Sean Greaves Experienced Member Joined: 9/27/2006 Last visit: 1/17/2022 Posts: 62 Rating: (0)	Thank you Smiffy I have a better understanding of the Function. Regards Sean

Suggestion To thank Quote Answer

9/28/2015 4:28 PM	Rate (0)
Min_Moderator Platinum Member Joined: 9/3/2014 Last visit: 3/13/2019 Posts: 4766 Rating: (122)	New question published by javed88 is split to a separate thread with the subject Read double word in 30000 series address in modbus communication, TIA V13. Best regards Min_Moderator

Suggestion To thank Quote Answer

|

Share this page:

Share this page on...

Follow us on