Материал: m013802e_b
5.3.1.5 Read Input Register (Function code 0x04)
This function serves to read a number of input words (also ”input register”). Broadcast is not supported and the maximum number is limited to 128 registers in one frame.
|
Inquiry: |
|
|
The inquiry determines the address of the start word (start register) and the number of |
|
яюэьыъщэш |
the register to be read. |
|
Addressing starts with 0. The Modicon address starts with 1 (0x01). |
||
|
||
|
Example for an inquiry of the registers 0 and 1 ofslave 11: |
Field name |
Example |
RTU |
ASCII |
|
Start of frame |
- |
t1-t2-t3 |
”:” |
0x3a |
Slave address |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Function code |
0x04 |
0x03 |
”03” |
0x30, 0x33 |
Starting address high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Starting address low |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Number of points high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Number of points low |
0x02 |
0x02 |
”02” |
0x30, 0x32 |
Error Check (LRC / CRC) |
- |
0xC4 |
”F0” |
0x46, 0x30 |
|
|
0xA1 |
|
|
End of frame |
|
t1-t2-t3 |
- |
0xD, 0xA |
Table 5.36: Example enquiry, Read Input Register
Replay:
The register data of the answer is packed as 2 bytes per register. The first byte has the higher value bits, the second the lower values. A reply to the above inquiry appears as follows:
Field name |
Example |
RTU |
ASCII |
|
Start of frame |
- |
t1-t2-t3 |
”:” |
0x3A |
Slave address |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Function code |
0x04 |
0x03 |
”03” |
0x30, 0x33 |
Byte Count |
0x04 |
0x04 |
”04” |
0x30, 0x34 |
Data Hi (Register 0) |
0x3F |
0x3F |
”3F” |
0x33, 0x46 |
Data Lo (Register 0) |
0xFB |
0xFB |
”FB” |
0x46, 0x42 |
Data Hi (Register 1) |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Data Lo (Register 1) |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Error Check (LRC / CRC) |
- |
0x2D |
”B4” |
0x42, 0x34 |
|
|
0x61 |
|
|
End of frame |
- |
t1-t2-t3 |
- |
0xD, 0xA |
Table 5.37: Example reply, Read Input Register
The contents of register 0 are shown hexadecimal by two byte values: 0x3F and 0xFB or 16379 decimal. The contents of register 1 are 0x00 and 0x00 or 0 decimal.
60 |
MODBUS / Configuration |
15.12.99
5.3.1.6 Force Single Coil (Function code 0x05):
With the aid of this function a single output bit is written. This function can also be sent as a broadcast, in which case the same bit is set in all slaves. With coupler/controller the number of I/O points is limited to 256.
Inquiry:
The required ON or OFF status is specified in the data field of the inquiry. A value of 0xFF00 sets the output bit to 1, a value of 0x00 on 0. Other values are not specified and have no effect on the output condition. In this example the bit 0 is set to 1 in slave 11:
Field name |
Example |
RTU |
ASCII |
|
Start of frame |
- |
t1-t2-t3 |
”:” |
0x3a |
Slave address |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Function code |
0x05 |
0x05 |
”05” |
0x30, 0x35 |
Coil address high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Coil address low |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Force data high |
0xFF |
0xFF |
”FF” |
0x46, 0x46 |
Force data low |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Error Check (LRC / CRC) |
- |
0x8C |
”F1” |
0x46, 0x31 |
|
|
0x90 |
|
|
End of frame |
|
t1-t2-t3 |
- |
0xD, 0xA |
Table 5.38: Example inquiry, Force Single Coil
Reply:
The reply is an echo of the inquiry and will be or is returned when the bit is set.
Field name |
Example |
RTU |
ASCII |
|
Start of frame |
- |
t1-t2-t3 |
”:” |
0x3a |
Slave address |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Function code |
0x05 |
0x05 |
”05” |
0x30, 0x35 |
Coil address high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Coil address low |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Force data high |
0xFF |
0xFF |
”FF” |
0x46, 0x46 |
Force data low |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Error Check (LRC / CRC) |
- |
0x8C |
”F1” |
0x46, 0x31 |
|
|
0x90 |
|
|
End of frame |
|
t1-t2-t3 |
- |
0xD, 0xA |
Table 5.39: Example reply, Force Single Coil
MODBUS / Configuration |
61 |
15.12.99
5.3.1.7 Preset Single Register (Function code 0x06):
This function writes a value in one single output word (also ”Output register”). This function can also be sent as a broadcast, in which case the same output word is set in all slaves.
Inquiry:
яюэьыъщэш Addressing starts with 0. The Modicon address starts with 1 (0x01). The inquiry determines the address of the first output word to be set. The value to be set is determined in the inquiry data field.
In the example the register 0 is set in slave 11.
Field name |
Example |
RTU |
ASCII |
|
Start of frame |
- |
t1-t2-t3 |
”:” |
0x3a |
Slave address |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Function code |
0x06 |
0x06 |
”06” |
0x30, 0x36 |
Register address high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Register address low |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Preset data high |
0x12 |
0x12 |
”12” |
0x31, 0x32 |
Preset data low |
0x34 |
0x34 |
”34” |
0x33, 0x34 |
Error Check (LRC / CRC) |
- |
0x8C |
”A9” |
0x41, 0x39 |
|
|
0x17 |
|
|
End of frame |
|
t1-t2-t3 |
- |
0xD, 0xA |
Table 5.40: Example inquiry, Preset Single Register
Reply:
The reply is an echo of the inquiry and is sent after setting the register.
Field name |
Example |
RTU |
ASCII |
|
Start of frame |
- |
t1-t2-t3 |
”:” |
0x3a |
Slave address |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Function code |
0x06 |
0x06 |
”06” |
0x30, 0x36 |
Register address high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Register address low |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Preset data high |
0x12 |
0x12 |
”12” |
0x31, 0x32 |
Preset data low |
0x34 |
0x34 |
”34” |
0x33, 0x34 |
Error Check (LRC / CRC) |
- |
0x8C |
”A9” |
0x41, 0x39 |
|
|
0x17 |
|
|
End of frame |
|
t1-t2-t3 |
- |
0xD, 0xA |
Table 5.41: Example reply, Preset Single Register
62 |
MODBUS / Configuration |
15.12.99
5.3.1.8 Fetch Comm Event Counter (Function code 0x0B):
This function returns a status word and an event counter from the communication event counter of the slave. With this counter the master can determine whether the slave has treated the slave without a fault.
Following each successful news processing the counter counts up. This counting process is not performed in the case of exception replies, poll commands or counter inquiries.
The event counter can be reset using the diagnosis function (Code 0x08), the restart subfunction communications option (Code 0x01) or clear counters and the diagnosis register (Code 0x0A).
Inquiry:
In the example the communication counter of the slave 11 is read:
Field name |
Example |
RTU |
ASCII |
|
Start of frame |
- |
t1-t2-t3 |
”:” |
0x3a |
Slave address |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Function code |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Error Check (LRC / CRC) |
- |
0x47 |
”EA” |
0x45, 0x41 |
|
|
0x47 |
|
|
End of frame |
|
t1-t2-t3 |
- |
0xD, 0xA |
Table 5.42: Example inquiry, Fetch Comm Event Counter
Reply:
The reply contains a 2 byte status word and a 2 byte event counter. The status word only contains zeroes.
The following table shows an example of a reply:
Field name |
Example |
RTU |
ASCII |
|
Start of frame |
- |
t1-t2-t3 |
”:” |
0x3a |
Slave address |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Function code |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Status high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Status low |
0x00 |
0x00 |
”00” |
0x31, 0x33 |
Event count high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Event count low |
0x03 |
0x03 |
”03” |
0x30, 0x33 |
Error Check (LRC / CRC) |
- |
0xE4 |
”E7” |
0x45, 0x37 |
|
|
0xA0 |
|
|
End of frame |
|
t1-t2-t3 |
- |
0xD, 0xA |
Table 5.43: Example reply, Fetch Comm Event Counter
The event counter shows that 3 (0x03) events were counted.
MODBUS / Configuration |
63 |
15.12.99
5.3.1.9 Force Multiple Coils (Function code 0x0F):
Using this function a number of output bits are set to 1 or 0. With a broadcast transmission the same bits are set in all activated on slaves. The maximum number is 256 bits.
|
Inquiry: |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The first point is addressed with 0. The Modicon address starts with 1 (0x01). |
|
|||||||||||||||
яюэьыъщэш |
|
||||||||||||||||
|
The inquiry news specifies the bits to be set. The requested 1 or 0 states are determined |
||||||||||||||||
|
by the contents of the inquiry data field. |
|
|
|
|
|
|
|
|
||||||||
|
In this example 16 bits are set, starting with the address 0 in slave 11. The inquiry |
||||||||||||||||
|
contains 2 bytes with the value 0xA5F0 in other words 1010 0101 1111 0000 binary. |
||||||||||||||||
|
Bit: |
1 |
0 |
1 |
0 |
0 |
1 |
0 |
1 |
1 |
1 |
1 |
1 |
0 |
0 |
0 |
0 |
|
Coil: |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
15 |
14 |
13 |
12 |
11 |
10 |
9 |
8 |
The first byte transmits the 0xA5 to the addresses 7 to 0, whereby 0 is the lowest value bit. The next byte transmits 0xF0 to the addresses 15 to 8, whereby the lowest value bit is 8.
Field name |
Example |
RTU |
ASCII |
|
Start of frame |
- |
t1-t2-t3 |
”:” |
0x3a |
Slave address |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Function code |
0x0F |
0x0F |
”0F” |
0x30, 0x46 |
Coil address high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Coil address low |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Quantity of coils high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Quantity of coils low |
0x10 |
0x10 |
”10” |
0x31, 0x30 |
Byte Counter |
0x02 |
0x02 |
”02” |
0x30, 0x32 |
Force data high (coils 7 ... 0) |
0xA5 |
0xA5 |
”A5” |
0x41, 0x35 |
Force data low (coils 15 ... 8) |
0xF0 |
0xF0 |
”F0” |
0x46, 0x30 |
Error Check (LRC / CRC) |
- |
0xE7 |
”3F” |
0x33, 0x46 |
|
|
0x94 |
|
|
End of frame |
|
t1-t2-t3 |
- |
0xD, 0xA |
Table 5.44: Example inquiry, Force Multiple Coils |
|
|
|
|
Reply:
The reply is the address of the slave, the function code, the starting address and the number of set bits.
Fieldname |
Example |
RTU |
ASCII |
|
Start of frame |
- |
t1-t2-t3 |
”:” |
0x3a |
Slave address |
0x0B |
0x0B |
”0B” |
0x30, 0x42 |
Function code |
0x0F |
0x0F |
”0F” |
0x30, 0x46 |
Coil address high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Coil address low |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Quantity of coils high |
0x00 |
0x00 |
”00” |
0x30, 0x30 |
Quantity of coils low |
0x10 |
0x10 |
”10” |
0x31, 0x30 |
Error Check (LRC / CRC) |
- |
0x54 |
”D6” |
0x44, 0x36 |
|
|
0xAD |
|
|
End of frame |
|
t1-t2-t3 |
- |
0xD, 0xA |
Table 5.45: Example reply, Force Multiple Coils
64 |
MODBUS / Configuration |
15.12.99