Slave Address; Data Consistency; Data Encoding; Function Codes - Emerson Mentor MP Advanced User's Manual

Parameter structure Keypad and display
6.2.2

Slave address

The first byte of the frame is the slave node address. Valid slave node
addresses are 1 through 247 decimal. In the master request this byte
indicates the target slave node; in the slave response this byte indicates
the address of the slave sending the response.
Global addressing
Address zero addresses all slave nodes on the network. Slave nodes
suppress the response messages for broadcast requests.
6.2.3

MODBUS registers

The MODBUS register address range is 16bit (65536 registers) which at
the protocol level is represented by indexes 0 through 65535.
PLC registers
Modicon PLCs typically define 4 register 'files' each containing 65536
registers. Traditionally, the registers are referenced 1 through 65536
rather than 0 through 65535. The register address is therefore
decremented on the master device before passing to the protocol.
File type Description
1 Read only bits ("coil")
2 Read / write bits ("coil")
3 Read only 16bit register
4 Read / write 16bit register
The register file type code is NOT transmitted by MODBUS and all
register files can be considered to map onto a single register address
space. However, specific function codes are defined in MODBUS to
support access to the "coil" registers.
All standard CT drive parameters are mapped to register file '4' and the
coil function codes are not required.
CT parameter mapping
All CT products are parameterized using the #menu.param notation.
Indexes 'menu' and 'param' are in the range 0 through 99. The
#menu.param is mapped into the MODBUS register space as menu*100
+ param.
To correctly map the parameters at the application layer, the slave
device increments the received register address. The consequence of
this behavior is that #0.0 cannot be accessed.
CT MODBUS PLC
parameter register
#X.Y 40000 + X x 100 + Y X x 100 + Y - 1
Examples:
#1.2 40102
#1.0 40100
#0.1 40001
#70.0 47000
Data types
The MODBUS protocol specification defines registers as 16bit signed
integers. All CT devices support this data size.
Refer to the section 6.2.7 Extended data types on page 208 for detail on
accessing 32bit register data.
6.2.4

Data consistency

All CT devices support a minimum data consistency of one parameter
(16bit or 32bit data). Some devices support consistency for a complete
multiple register transaction.
6.2.5

Data encoding

MODBUS RTU uses a 'big-endian' representation for addresses and
data items (except the CRC, which is 'little-endian'). This means that
when a numerical quantity larger than a single byte is transmitted, the
MOST significant byte is sent first. So for example
16 - bits 0x1234 would be
32 - bits 0x12345678 would be
Mentor MP Advanced User Guide
Issue Number: 4
Parameter description
Parameter x.00
format
Register address
Comments
(protocol level)
#0.0 cannot
be accessed
101
99
0
6999
0x12 0x34
0x12 0x34 0x56 0x78
www.onxcontrol.com
Advanced parameter
descriptions
6.2.6

Function codes

The function code determines the context and format of the message
data. Bit 7 of the function code is used in the slave response to indicate
an exception.
The following function codes are supported:
Code
3 Read multiple 16bit registers
6 Write single register
16 Write multiple 16bit registers
23 Read and write multiple 16bit registers
FC03 Read multiple
Read a contiguous array of registers. The slave imposes an upper limit
on the number of registers, which can be read. If this is exceeded the
slave will issue an exception code 2.
Table 6-1 Master request
Byte
Slave destination node address 1 through 247, 0 is
0
global
1 Function code 0x03
2 Start register address MSB
3 Start register address LSB
4 Number of 16bit registers MSB
5 Number of 16bit registers LSB
6 CRC LSB
7 CRC MSB
Table 6-2 Slave response
Byte
0 Slave source node address
1 Function code 0x03
2 Length of register data in read block (in bytes)
3 Register data 0 MSB
4 Register data 0 LSB
3+byte count CRC LSB
4+byte count CRC MSB
FC06 Write single register
Writes a value to a single 16bit register. The normal response is an echo
of the request, returned after the register contents have been written.
The register address can correspond to a 32bit parameter but only 16
bits of data can be sent.
Table 6-3 Master request
Byte
0 Slave node address 1 through 247 0 is global
1 Function code 0x06
2 Register address MSB
3 Register address LSB
4 Register data MSB
5 Register data LSB
6 CRC LSB
7 CRC MSB
Serial comms
Performance
protocol
Description
Description
Description
Description
207