Page 6 / 15
PV500-67 03/17
3. COMMANDS (MESSAGES)
Modbus standard has several commands used to access different types of data. The XR10CX only uses the data type
called Holding Registers (40001
– 49999) and Output Coils (00001 – 09999). There are only 3 commands needed to
access the Holding Registers, and 2 commands for the Output Coils. The Modbus specification allow reading and
writing to multiple sequential registers, but the maximum number of registers that can be read or written to in one
command is 5. The limit for reading Coils is 80 and writing coils is only 1 at a time. This is a limitation of the XR10CX
device. In the following commands, the actual address will be used, the command indicates the type of register it is.
For example, the first Register 40001 will have address 0 and the first Coil 00001 will also have address 0.
3.1 READ OUTPUT COIL (0x01):
Read Coils from device. Coil status will be packed into the data bytes in the response. Only requested Coil data is valid
and the extra bits that may be present for padding the bytes should be ignored.
3.1.1 MASTER COMMAND TO READ COILS (0x01):
Slave Address:
(1 byte): Device address that receives the command. Range: 1-247.
Function Code:
(1 byte): Code = 0x01 (Read Output Coil).
Coil Address:
(2 bytes): The address of the first coil to be read, reading multiple registers is sequential.
Number of Coils:
(2 bytes): Number of Elements (Coils) that the device has to return (3 = 3 Coils or bits). No more
than 80 Elements (Coils) allowed. (Each coil is 1 bit).
CRC:
(2 bytes): CRC calculated for the frame data received and is used to verify the integrity of data received.
3.1.2 SUCCESSFUL RESPONSE, READ COILS (0x01):
Slave Address:
(1 byte): The address of the slave responding. Same as the address in the initiating command.
Function Code:
(1 byte): Code = 0x01 Echo from the initiating command.
Number of Bytes:
(1 byte): Defines the number of bytes followed minus the CRC.
Data:
Byte data buffer
, length is “Number of Bytes” long. Coil data I contained in this data. The first 8 Coils will be the
first Byte.
CRC:
(2 bytes):
3.1.3 EXCEPTION RESPONSE, READ HOLDING REGISTER (0x01):
Slave Address:
(1 byte): The address of the slave responding. Same as the address in the initiating command.
Exception Response:
(1 byte): Code = 0x01 Echo from the initiating command plus high bit 0x80 = 0x81.
Exception Code:
(1 byte): Defines the number of bytes followed minus the CRC. See Table 1 for explanation of
exceptions.
CRC:
(2 bytes):
Slave
Address
Function
Code 0x01
Coil
Address
(MSByte)
Coil
Address
(LSByte)
Number of
Coils
(MSByte)
Number of
Coils
(LSByte)
CRC
(LSByte)
CRC
(MSByte)
Slave
Address
Success
echo:
Code
0x01
Number
of
Bytes
Data 1
Data
n
CRC
(LSByte)
CRC
(MSByte)
Data …
Slave
Address
Exception
0x01 + 0x80
Error: 0x81
Exception
Code
see list
CRC
(LSByte)
CRC
(MSByte)
