COMMERCIAL IN CONFIDENCE
Page 11
2.4
ModBus Message Construction.
The following message function codes are implemented in the instrument. Where a value of xx is
shown, substitute the correct value for your installation and the data item required. All CRCs are shown
as ?? since must be automatically generated according to the data contained in the message.
2.4.1
Read Coil Status (single bit read)
Byte No
Meaning
Value (hex)
1
Slave address
xx
2
ModBus Function code (read coil status)
01
3
Starting Address MSB, always
00
4
Starting Address LSB
xx
5
No of points MSB
00
6
No of points LSB
01
7
CRC lo byte
??
8
CRC hi byte
??
Note that in this implementation, only one bit may be read per message, so the number of
points should always be set to 1, but in fact this value is ignored anyway. If the address is not a
valid readable bit, an error response code 2 (invalid address) is returned, otherwise the
following response is sent:
Byte No
Meaning
Value (hex)
1
Slave address
xx
2
ModBus Function code (read coil status)
01
3
Byte count
01
4
Bit value (01 if bit is set, 00 if not)
00 or 01
5
CRC lo byte
??
6
CRC hi byte
??
2.4.2
Read Holding Registers
Byte No
Meaning
Value (hex)
1
Slave address
xx
2
ModBus Function code (read holding register)
03
3
Starting Address MSB
xx
4
Starting Address LSB
xx
5
No of registers MSB
00
6
No of registers LSB
01
7
CRC lo byte
??
8
CRC hi byte
??
Note that the only one register may be read per message, so the number of registers should be 1
(although this value is ignored in this implementation). The normal response will be:
Byte No
Meaning
Value (hex)
1
Slave address
xx
2
ModBus Function code (read register)
03
3
Byte count (always 2, even though the register may be only 1
byte wide)
02
4
Data MSB (will be 0 if a single byte register)
xx
5
Data LSB
xx
6
CRC lo byte
??
7
CRC hi byte
??
