Modbus addressing?


Thread Starter

Mario de Sousa

I am currently working on getting the modbus module back up, but need some help.

I have been testing it against a SCADA package that decrements the address before sending it on the wire (e.g. address 1 is sent as 0 on the wire, etc...), but an OMRON variable speed drive I am also using has registers starting off at 0.

Which of the above should I code to? In other words, should I encode an address value of 1 as 0 or 1 on the wire?



Mario J. R. de Sousa
[email protected]

The box said it requires Windows 95 or better, so I installed Linux

LinuxPLC mailing list
[email protected]

Kelvin Proctor


I sould suggest that you should should write 0 onto the wire. There is a bit of ambiguity as to how devices interpret an address of 0x0000 in a Modbus packet. So call that address 0 others 1.

But if your Omron drive has a register 0 (as you stated) then you will want to write 0 to the wire.

Hope this helps.



Randy Silbaugh

The first address is 0x00 in Modbus RTU. Unfortunately in the Modicon world the first register always starts with a 1 (i.e. 400001, 300001, etc). While you can generally apply the rule of subtracting 1 from the 4x,3x,0x,1x,and
6x register to get the modbus RTU address some manufactures get confused and modbus RTU address 1 gets incorrectly id'd as 40001 (or what ever the
modicon register type is).

Frame size: Good luck.
You are correct in that the size is not specified. They list Maximum Query/Response Parameters which is dependant upon the type of Modicon controller being used. From the documentation I have the maximum number of
data registers is up to 254 for the type 484 PLC controller. It is as low as 32 for a type M84. An interesting note I find at the bottom of each page for certain controllers and messages is that the maximum length of the entire message must not exceed 256 bytes (Messages specified are read(func
20)/write(func 21) general reference and program 884/M84(func 18)).
There is a description of the RTU response BYTE COUNT field that equals the count of 8-bit bytes in your data message. So you could take this as the maximum data field size of 255 (0 to 255).

Slave address 1 byte
Function 1 byte
Byte count 1 byte
data field 255 bytes
CRC 2 bytes

Total 260 bytes

This is for the slave response.

The master message need to take into account the limitations of the slave response.

I hope this helps...

Randy Silbaugh

LinuxPLC mailing list
[email protected]

Wayne Johnston

The short answer: 0

The long answer: The address in the command sent is the offset of the register from the first register of that type. So when reading register
00001 using function code 1, the offset is 0. When reading register 30001 using function code 4, the offset is 0.


MAT-devel mailing list

Thread starter Similar threads Forum Replies Date
M Modbus 0
R Modbus 6
N Modbus 2
N Modbus 1
D Modbus 2