MODBUS Client communication protocol

Supported device types and versions
Communication line configuration
Line protocol parameters
Station configuration
I/O tag configuration
Note to FloBoss 103 device
Note to Honeywell
Literature
Changes and modifications
Document revisions

Supported device types and versions

---

The protocol executes client (master) communication with arbitrary devices which supports a standard MODBUS RTU and ASCII in the versions of serial communication as well as MODBUS over TCP/IP. Moreover, it supports two extensions:

• Byte mode - allows working with devices that get back the values of registers as 1 byte (in contrast with Modbus standard in which the register value is 2 bytes).

• Variable mode - allows working with devices that get back values of registers with different sizes than standard 2 bytes. It was implemented because of support the flowmeter FloBoss 103 made by Fisher Controls International (at this time a part of Emerson Process Management): 1-byte variables, 4-byte unsigned/signed integers, text strings of length 10,12,20,40 characters, 6-byte time stamp, and other.

Communication line configuration

---

• Line category Serial (serial communication)

• Line category SerialOverUDP Device Redundant (serial communication).

• Line category RFC2217 Client (serial communication).

• Line category TCP/IP-TCP and TCP/IP-TCP Redundant (MODBUS over TCP/IP). Reserved TCP port 502 is used in common, but it is possible to use any other one according to the setting of the device. The line number is not used, set the value e.g. to 1.
  Note: For redundant systems, it is possible to enter multiple names addresses separated by commas.
  Note: In the case of WAGO 750-8100 type PLC and communication via MODBUS TCP, it was necessary to set a small polling period (e.g. 1 second) in the time parameters of the station. In the case of a longer period (5 seconds), the connection was closed quite often by the PLC.

Line protocol parameters

---

A dialog window of communication line configuration - Protocol parameters tab.
They influence some optional protocol parameters.

The line protocol contains the following parameters:

Station configuration

---

• Communication protocol "Modbus Client".

• The station address is a decimal number mostly in the range of 1 up to 247. Address 0 is reserved as broadcast.

 

Station protocol parameters

Configuration dialog box - tab Parameter.
They influence some optional parameters of the protocol. The following station protocol parameters can be set:

Table 1

I/O tag configuration

---

Possible types of I/O tag values for invariable mode: Ai, Ao, Di, Do, Ci, Co, TxtI.

Possible types of I/O tag values for variable mode: Ai, Ao, Di, Do, Ci, Cout, TxtI, TxtO, TiA.

 

I/O tag address:

The main address space in the protocol MODBUS is divided into the following registers:

• Coils type (reading/writing)

• Discrete Inputs (reading)

• Holding Registers (reading/writing)

• Input Registers (reading)

Independent addressing with the address size of 2 bytes, i.e. addresses from 0 up to 65535 (so-called MODBUS PDU addressing model), is in an address space of each type of register. Some devices work with address space starting with 1 (so-called MODBUS Data Model). In this case, it is necessary to deduct 1 in the address at configuration I/O tags in the D2000 system or change the setting of the parameter Addressing model to the MODBUS data Model.

I/O tag address can be in a basic or extended format (for a variable mode).

Basic format of I/O tag address:
Address format is [I|U|Uu|Ul|f|F|L|Ll|S|Sl|B|X|sn.|an.|An.][d|D][b][s]RdFn[-WrFn[d]].Address[.BitNr] in which:

• First character defines a type of I/O tag:

  • I - Integer16 (default) - one register is read, signed

  • U - Unsigned16 - one register is read, unsigned

  • Uu - Unsigned16 - one register is read, unsigned, only upper byte is considered (1st in sequence)

  • Ul - Unsigned16 - one register is read, unsigned, only lower byte is considered (2nd in sequence)

  • f - Float (4 bytes = 2 registers) - two registers with Address and Address+1 are read and transmitted as big-endian (see Note).

  • F - Float (4 bytes = 2 registers) - two registers with Address and Address+1 are read and transmitted as little-endian (so-called Modicon format), (see Note)

  • L - Unsigned long (4 bytes = 2 registers) - two registers with Address and Address+1 are read, unsigned, and transmitted as big-endian (see Note)

  • Ll - Unsigned long (4 bytes = 2 registers) - two registers with Address and Address+1 are read and transmitted as little-endian, unsigned (see Note)

  • S - Signed long (4 bytes = 2 registers) - two registers with Address and Address+1 are read, signed, and transmitted as big-endian (see Note)

  • Sl - Signed long (4 bytes = 2 registers) - two registers with Address and Address+1 are read and transmitted as little-endian, signed (see Note)

  • B - Byte unsigned, only the upper 8 bits of the register value

  • X - Byte unsigned, only the lower 8 bits of the register value

  • sn. - Text string with the length of n characters, one register is one character, n registers with Address up to Address+n-1 are read

  • an. - Text string with the length of 2*n characters, one register is two ASCII characters, characters are transmitted in the same order as they appear in the string,  n registers with Address up to Address+n-1 are read

  • An. - Text string with the length of 2*n characters, one register is two ASCII characters, characters are transmitted in big-endian order (i.e. "1234" is transmitted as "2143"),  n registers with Address up to Address+n-1 are read

• Modifier d indicates that a number is an 8-byte number (4 consecutive registers). It can be used for types L, Ll, S, Sl, F,f, and it is used for configuration of signed/unsigned 8-byte integer as well as an 8-byte float (big-endian <B8>..<B1> and little-endian <B1>..<B8> formats).
  Modifier D indicates that a number is an 8-byte number (4 consecutive registers). It can be used for types Ll, Sl, F and it is used for configuration of signed/unsigned 8-byte integer as well as an 8-byte float (little-endian format <B2><B1><B4><B3><B6><B5><B8><B7>).
  Note: when using a modifiers d or D, the I/O tag must be of Analog type (Ai), because Integer type (Ci) in D2000 is implemented as a 4-byte variable and overflow might occur. Writing of Integer type (Co) as an 8-byte number is supported.

• Modifier b indicates that figure is coded by BCD. It can be used for I/O tags of I, U, B, L, Ll types.

• Modifier s indicates that a status register (Unsigned16) located on address Address is followed by a big-endian Float value located on address Address+1 .. Address+2. This indicator is used for type f and it is implemented for calorimeter Endress+Hauser RMS621. The following table shows the values of the status register and their mapping to D2000 attributes.

• Parameter RdFn is a function of the Modbus protocol for a data reading. The following functions are implemented:

  • 1 - Read Coils: binary status reading

  • 2 - Read Discrete Inputs: binary input reading

  • 3 - Read Holding Registers: status register reading (Integer16/Unsigned16 and Float32 - reads two successive registers)

  • 4 - Read Input Registers: input register reading (Integer16/Unsigned16 and Float32 - reads two successive registers)

  • 0 - A value is not read, it is only written. The function for writing (WrFn) must be set.

• Parameter WrFn is the function of the Modbus protocol for data writing. The following functions are implemented:

  • 5 - Write Single Coil: binary status writing (default for Read Coils)

  • 6 - Write Single Register: status register writing (default for Read Holding Registers)

  • 16 - Write Multiple registers: multiple registers writing, it must be used when 2-register type is written (e.g. Float, Unsigned long, etc.).
    Note: function can be used to write more than two registers at once if a text string is used. Example:
    if we have an I/O tag with address a3.0-16.#8A00 (i.e. text string covering 3 registers, having length of 6 characters) and we write a string '123456', then hexadecimal values 0x3132, 0x3334 and 0x3536 (ASCII code for '1' is 0x31, for '2' is 0x32 etc) will be written to registers 0x8A00, 0x8A01 and 0x8A02.

  • 22 - Mask Write Register:  write affects only the value of the particular bit BitNr of the status register. It is usable only for Do value types with the address parameter BitNr.

• Parameter d activates the function "delayed write". Sending of the value is delayed until the request to write the value of the object without parameter d comes. All accumulated requests waiting to be written are sent. If the function WrFn is set to "Write Multiple Registers", the values are sent in one packet.

• Parameter Address is a 2-byte address of register (0-65536). See also the protocol parameter Addressing model.
  Note: address can be specified as a hexadecimal number using a number sign (#), e.g. #50CE

• Parameter BitNr is a number of bit in a word. The values 0-7 are allowed to be used for binary statuses and inputs, values 0-15 are allowed to be used for reading of bit from 16-bit status or input registers.

 

Note about the byte and register order

1. MODBUS protocol uses the big-endian, i.e. the most significant byte (MSB) is transmitted as first. Examples:

2. When values are read from two registers as big-endian the received bytes are analysed in this way: