MODBUS is an application layer messaging protocol, positioned at level 7 of the OSI model, that provides client/server communication between devices connected on different types of buses or networks.
The industry’s serial de facto standard since 1979, Modbus continues to enable millions of automation devices to communicate.
Today, support for the simple and elegant structure of MODBUS continues to grow. The Internet community can access MODBUS at a reserved system port 502 on the TCP/IP stack.
MODBUS is a request/reply protocol and offers services specified by function codes.
Addressing scheme and item types
MODBUS bases its data model on a series of tables that have distinguishing characteristics. The four primary tables are:
The distinctions between inputs and outputs, and between bit-addressable and word-addressable data items, do not imply any application behavior.
It is perfectly acceptable, and very common, to regard all four tables as overlaying one another, if this is the most natural interpretation on the target machine in question.
For each of the primary tables, the protocol allows individual selection of 65536 data items. It’s obvious that all the data handled via MODBUS (bits, registers) must be located in device application memory.
But physical address in memory should not be confused with data reference. The only requirement is to link data reference with physical address.
MODBUS logical reference number, which are used in MODBUS functions (commands), are unsigned integer (0 to 65535).
It is very common that the four tables are associated with the following data/physical types:
Coil (Discrete Output): Relay, Open collector, trigger.
Discrete Input: Digital input, sensor.
Holding Register: Analog output, application defined read/write parameter, mapping of the above coils.
Input Register: Analog input, application defined read only parameter, mapping of the above discrete inputs.
The addressing space of each of the four tables is comprised in the range 0–65535 (0x0000–0xFFFF in hexadecimal).
Addressing models and considerations
However, the register, coil or input ranges are also sometime given with their numbers, in decimal.
This is to simplify documentation, that an old defacto standard widely recognized as Modbus (sometimes referred to as Modicon convention) is still used.
This defacto standard uses the first digit of a register number to identify the register type.
Note that this defacto standard use a 1-based register numbering while addresses use a 0-based index.
Coil (Discrete Output): (0x) 00001–09999 (i.e addressing space from 0x0000–0x270F).
Discrete Input: (1x) 10001–19999 (i.e addressing space from 0x0000–0x270F).
Holding Register: (4x) 40001–49999 (i.e addressing space from 0x0000–0x270F).
Input Register: (3x) 30001–39999 (i.e addressing space from 0x0000–0x270F).
Valid address ranges as originally defined for Modbus were 0 to 9999 (0x0000–0x270F) for each of the above register types.
Valid ranges allowed in the current specification are 0 to 65,535 (0x0000–0xFFFF).
The addresses above 9999 (0x270F) are generally referenced as “extended range addressing”.
Therefore, there is another defacto standard that looks very similar and is as follows:
Coil (Discrete Output): (0x) 000001–065635 (i.e addressing space from 0x0000–0xFFFF).
Discrete Input: (1x) 100001–165635 (i.e addressing space from 0x0000–0xFFFF).
Holding Register: (4x) 400001–465635 (i.e addressing space from 0x0000–0xFFFF).
Input Register: (3x) 300001–365635 (i.e addressing space from 0x0000–0xFFFF).
When using the extended register numbering, it is mandatory that all register numbers have six digits in order to avoid confusion (for instance between holding register 40001 and coil 40001). If coil 40001 is the target, it must appear as 040001.
MXM Implementation
The Medialon Modbus TCP MXM give access to device that support Modbus TCP protocol, it acts as a Modbus Client TCP/IP.
Values into registers (or inputs or coils) and registers (or inputs or coils) organisation is device dependant.
The user should know how the device is organised and what are the available registers (or inputs or coils) in the device.
These information are given by the device manufacturer and is generally referenced as “Mapping Table”.
It remains to analyze these information and check whether the register (or coil) identification is given using the numbering (in such a case, is it expressed in standard defacto or extended defacto manner - see later on for details) or with an address (0x0000–0xFFFF).
IP Address (or name):
IP address or name of the target modbus device.
IP Port:
IP port the target modbus device. The default value is 502 and should be kept.
Auto re-connection:
Enables to automatically try to reconnect the modbus device after a disconnection.
Use Unit Identifier:
If the TCP/IP modbus device is a gateway then this option allows to define which modbus device, behind the gateway is addressed.
In some circumstance, some device, although claiming to be ModbusTCP compliant, acts as a gateway and thus need this ID to be set (for instances, Moxa ioLogic 2xxx products).
Command Timeout:
Specify the amount of time, in millisecond, the device wait for an answer before throwing a timeout error.
Force Multiple Write Commands:
This option allows to force using the “Multiple Write” version of commands even when a single Coil or Register is specified. This option is intended for some Modbus device which does only support Multiple Write operations.
Max Multiple Registers:
Defines the maximum of registers a multiple register command can address. The default value is 32 and can be set up to 123, which is dictated by Modbus protocol. For example, command such as Write Holding Register can have from 32 to 123 register parameters, depending on this settings. All the cues created for this command will have the same maximum number of register’s parameters. The parameter Register Count which indicates the actual number of registers used in this particular command instance (cue) can then be set from 1 to that maximum value (32 to 123).
This has been required by a customer who’s dealing with PLCs which needs to get their settings through a single command using more than 32 registers at once.
Device Commands
Read Input Register
Read into the given variable(s) a register or a serie of registers from the Input registers block.
Address: [Integer] Address of register (1–65535).
Register Count: [Integer] Number of register to read (1-‘Max Multiple Registers’).
Bit Selection: [Enum] Concerned bit in the register
“All”: The returned value give the value of the entire register (real value).
“ Bit 0”: Return Value is 1 if bit 0 of the registeris set otherwize 0.
“ Bit 1”: Return Value is 1 if bit 1 of the registeris set otherwize 0.
“ Bit 2”: Return Value is 1 if bit 2 of the registeris set otherwize 0.
“ Bit 3”: Return Value is 1 if bit 3 of the registeris set otherwize 0.
“ Bit 4”: Return Value is 1 if bit 4 of the registeris set otherwize 0.
“ Bit 5”: Return Value is 1 if bit 5 of the registeris set otherwize 0.
“ Bit 6”: Return Value is 1 if bit 6 of the registeris set otherwize 0.
“ Bit 7”: Return Value is 1 if bit 7 of the registeris set otherwize 0.
“ Bit 8”: Return Value is 1 if bit 8 of the registeris set otherwize 0.
“ Bit 9”: Return Value is 1 if bit 9 of the registeris set otherwize 0.
“ Bit 10”: Return Value is 1 if bit 10 of the registeris set otherwize 0.
“ Bit 11”: Return Value is 1 if bit 11 of the registeris set otherwize 0.
“ Bit 12”: Return Value is 1 if bit 12 of the registeris set otherwize 0.
“ Bit 13”: Return Value is 1 if bit 13 of the registeris set otherwize 0.
“ Bit 14”: Return Value is 1 if bit 14 of the registeris set otherwize 0.
“ Bit 15”: Return Value is 1 if bit 15 of the registeris set otherwize 0.
Return Value 1 to 32: [Integer] Defines the variables that will receive the register values.
Note: When the “Bit Selection” parameter is set to “Bit X”, then the corresponding bit of all read registers is set into the corresponding given variable; in other words, the variable reflect the value of the selected bit (either 0 or 1). The “Bit Selection” parameter is apply to all register values, respectively.
Read Holding Register
Read into the given variable(s) a register or a serie of registers from the Holding registers block.
Address: [Integer] Address of register (1–65535).
Register Count: [Integer] Number of register to read (1-‘Max Multiple Registers’).
Bit Selection: [Enum] Concerned bit in the register
“All”: The returned value give the value of the entire register (real value).
“ Bit 0”: Return Value is 1 if bit 0 of the registeris set otherwize 0.
“ Bit 1”: Return Value is 1 if bit 1 of the registeris set otherwize 0.
“ Bit 2”: Return Value is 1 if bit 2 of the registeris set otherwize 0.
“ Bit 3”: Return Value is 1 if bit 3 of the registeris set otherwize 0.
“ Bit 4”: Return Value is 1 if bit 4 of the registeris set otherwize 0.
“ Bit 5”: Return Value is 1 if bit 5 of the registeris set otherwize 0.
“ Bit 6”: Return Value is 1 if bit 6 of the registeris set otherwize 0.
“ Bit 7”: Return Value is 1 if bit 7 of the registeris set otherwize 0.
“ Bit 8”: Return Value is 1 if bit 8 of the registeris set otherwize 0.
“ Bit 9”: Return Value is 1 if bit 9 of the registeris set otherwize 0.
“ Bit 10”: Return Value is 1 if bit 10 of the registeris set otherwize 0.
“ Bit 11”: Return Value is 1 if bit 11 of the registeris set otherwize 0.
“ Bit 12”: Return Value is 1 if bit 12 of the registeris set otherwize 0.
“ Bit 13”: Return Value is 1 if bit 13 of the registeris set otherwize 0.
“ Bit 14”: Return Value is 1 if bit 14 of the registeris set otherwize 0.
“ Bit 15”: Return Value is 1 if bit 15 of the registeris set otherwize 0.
Return Value 1 to 32: [Integer] Defines the variables that will receive the register values.
Note: When the “Bit Selection” parameter is set to “Bit X”, then the corresponding bit of all read registers is set into the corresponding given variable; in other words, the variable reflect the value of the selected bit (either 0 or 1). The “Bit Selection” parameter is apply to all register values, respectively.
Write Holding Register
Write the given value(s) into a register or a serie of registers of the Holding registers block.
Address: [Integer] Address of register (1–65535).
Register Count: [Integer] Number of register to write (1-‘Max Multiple Registers’).
Bit Selection: [Enum] Concerned bit in the register
“All”: The given value is written into the entire register (real value).
“ Bit 0”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 1”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 2”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 3”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 4”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 5”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 6”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 7”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 8”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 9”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 10”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 11”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 12”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 13”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 14”: Bit 0 of the register is set to 1 if the given value is not 0.
“ Bit 15”: Bit 0 of the register is set to 1 if the given value is not 0.
Value 1 to 32: [Integer] Value(s) to write into register(s).
Note: If the “Register Count” parameter is set to 1, only the first Value (Value 1) is used and the Modbus TCP command used is “Write Single Register”. If the “Register Count” parameter is greater than 1, then “Value 1” to “Value X” (X being the Register Count) are used and the Modbus TCP command used is “Write Multiple Registers”.
Note: The “Bit Selection” is only used when “Register Count” parameter is set to 1. When the “Bit Selection” parameter is set to “Bit X”, then the corresponding bit of that register is set to 1 if the value is not 0, otherwize it is set to 0. Some device does not support bit mask adressing, so in this case let the Bit Selection parameter to “All”.
Read Discrete Input
Read into the given variable(s) the status of an input or a serie of inputs from the Discrete Input block.
Address: [Integer] Address of register (1–65535).
Input Count: [Integer] Number of input to read (1–32).
Return Status 1 to 32: [Integer] Defines the variable(s) that will receive the discrete input(s) status.
Read Coil
Read into the given variable(s) the status of a coil or a serie of coils from the Coils block.
Address: [Integer] Address of register (1–65535).
Coil Count: [Integer] Number of coil to read (1–32).
Return Status 1 ot 32: [Integer] Defines the variable(s) that will receive the coil(s) status.
Write Coil
Write the given status(es) into a coil or a serie of coils of the coil block.
Address: [Integer] Address of register (1–65535).
Coil Count: [Integer] Number of coil to write (1–32).
Status 1 to 32: [Integer] Status to write into the register(s) (0–1).
Note: If the “Coil Count” parameter is set to 1, only the first Status (Status 1) is used and the Modbus TCP command used is “Write Single Coil”. If the “Coil Count” parameter is greater than 1, then “Status 1” to “Status X” (X being the Coil Count) are used and the Modbus TCP command used is “Write Multiple Coils”.
Change IP Address
Switch the connection to another server.
Address: [String] New IP address to switch to.
Device Variables
Status
[Enum] Current general status.
“Unconnected”: Modbus device is not connected
“Connecting”: A connection to a Modbus device is in progress
“Connected”: Modbus device is connected.
Error
[Enum] Current error status.
“No Error”: There is no error
“Illegal Command”: The command is not an allowable action for the modbus device. This may be because the function code is only applicable to newer devices, and was not implemented in the unit selected. It could also indicate that the device is in the wrong state to process a request of this type, for example because it is unconfigured and is being asked to return register values
“Illegal Data Address”: The address is not an allowable address for the device
“Illegal Data Value”: The value (status) is not an allowable value (status) for device
“Slave Device Failure”: An unrecoverable error occurred while the device was attempting to perform the requested action.
“Process In backgound”: Specialized use in conjunction with programming commands. The device has accepted the command and is processing it, but a long duration of time will be required to do so. The returned value from the register is not valid or the value sent to a register is not yet processed
“Slave Device Busy”: Specialized use in conjunction with programming commands. The device is engaged in processing a long duration program command. The command should be retransmited later when device is free
“Memory Parity Error”: The device attempted to read a register, but detected a parity error in the memory. The command can be sent again, but service may be required on the device
“Gateway Path Unavailable”: Specialized use in conjunction with gateways, indicates that the gateway was unable to allocate an internal communication path from the input port to the output port for processing the request. Usually means that the gateway is misconfigured or overloaded
“Gateway Target Device Failed”: Specialized use in conjunction with gateways, indicates that no response was obtained from the target device. Usually means that the device is not present on the network
“Unknown Error”: An undocumented error occured.
Revisions
V 1.0.1
Added Support for Showmaster.
V 1.0.2
Added Support for Showmaster Pro.
V 6.0.0
Modified: Support of Manager V6/Showmaster V2.
V 6.0.1
Fixed Setup dialog doesn’t open on the correct screen on a multi-screen configuration.
V 6.0.2
Fixed: Device variables are not reset after a project load (Requires Manager 6.0.3+).
V 6.1.0
Added: Support for Showmaster LE & Showmaster XS platforms.
V 6.1.1
Improved: Log traces management.
V 6.1.2
Fixed: The Setup dialog box is not always fully visible at the device creation time.
V 6.1.3
Improved: “Write Coil” and “Write Holding Register” commands are now automatically using the Single/Multiple Coil/Register Write Modbus TCP commands, according to the number of Coils/Registers specified (i.e 1 or more) in the command.
Improved: This help document contains more detailed explanations for some commands.
V 6.1.4
Fixed: When a command timeout occurs, the following commands may be out of sync.
Improved: A command timeout setting has been added in the setup
Improved: Traces have been added in case of command timeout.
V 6.1.5
Added: Option for using Multiple Write Commands instead of Single Write when using only 1 coil/register
Fixed: Low traces were not tracing when abnormal frame were received
V 6.1.6
Improved: Better detection of “Message Out of Sequence” errors.
V 6.2.0
Added: Compatibility for Overture CS.
V 6.3.0
Added: The number of multiple register within a command can be changed in the setup.
V 6.3.1
Fixed: After a Showmaster startup, the Modbus TCP connection might stay “unconnected”.
V 6.7.0
Improved: Support for High DPI displays (require Manager 6.7.0+ or Showmaster Editor 2.7.0+)
Changed: Compatibility for Manager 6.7.0 and Showmaster Editor 2.7.0