Modbus Registers


Thread Starter

David Pleydell

Looking through the standard for modbus, there are commands to read registers. There are some for 0x references, coils. Then Read 1x references, holding registers (4x references)...
What does this mean?
I have a Loop powered device that the user may want to know the 4mA, 20mA span points, the damping value, the engineering units etc
So i really want to know where i should be putting my data in terms of the modbus registers.

Also how does the master on RS485 networks determine the addresses for the slaves? HART sends a command and gets the slave address from the reply does modbus have something similar?

Adolfo Jimmy Saldivias Valarezo

I think somebody asked this question before, so you may want to browse on the website for previous answers to this question. Anyway, the references are the names of the memory positions in Modicon.

0x means any address in the memory map who begins with 0 followed by 4 digits. This addresses are used to store status of discrete bits either for
use as flags in your program or to indicate to the output module if it is to open or close a discrete output (it depends on how is the PLC configured).

1x means any address in the map who begins with 1 followed by 4 digits. This addresses are used to READ the discrete inputs of the modules.

3X means any address in the map who begins with 3 followed by 4 digits. This addresses are used to READ the analog inputs of the modules.

4X means any address in the map who begins with 4 followed by 4 digits. This addresses are used either to WRITE a value to a analog output module or to write a value to be used in calculations during your program.

On your post you asked about

span points: what do you mean by that? I could think that span is the values that the variable 4..20 mA can take in terms of the numerical value that the Modicon PLC can assign to a given value of current. If this is what you mean by span, you can check the site of, since the value will depend on the module that the system is using. On the site of modicon you will find
the different modules availables as well as the values assigned to the current.

damping value: what do you mean by that? If you mean the time taken between readings (which is what damping usually means) it depends on how the PLC was programmed as well as on the scan time, which in turn depends on the number of networks of the program....

the engineering units: what do you mean by that? if you mean the scaling to engineering units, it will depend on the algorithm used by the person who did the plc programming.

where i should be putting my data in terms of the modbus registers: at no place if you are only looking to read data from the plc.

how does the master on RS485 determine the address? the devices on a modbus plus network have dip switches to identify their number on the network.

Jimmy Saldivias

Darold Woodward

The information below is pretty accurate, but I'm going to add just a bit more information. The key thinking process to get this working is that Modbus was designed to work between Modicon PLCs.
That means that non-Modicon devices are trying to "look like" Modicon PLCs through the Modbus interface. If you understand a bit about Modicon PLCs you will have a much easier time.

The leading 0, 1, 3, or 4 is a type identifier with the types as described below. 0x and 1x references are binary information used for coils and indications respectively. 3x and 4x are 16-bit references are for analog inputs and holding registers respectively. Indications and inputs are purely inputs to the PLC where coils and holding registers are used both as internal calculated results and as addresses for output points.

The 4 digit part is only partially correct. If you look at addressing over time, there has been a need for more range and the addresses used have expanded in the number of digits. Five digit addressing (4 address digits plus type identifier) are probably the most common and most widely supported. However, you will notice in
the Modbus message that 16 bits are available. That means that the number of digits in the reference inside the PLC or HMI driver can also be 6-digit addressing (4xxxxx or for example 463489). With the 5-digit addresses (4xxxx) the maximum register is 49999 while the 6-digit addressing can reach 465535. The limit is the
maximum number you can express with the 16 bits. This range is available for each type (0x, 1x, 3x, and 4x).

An important thing to remember is that the application layer reference and the Modbus message reference for addresses are different. Modbus registers in the application world (inside PLC, etc.) are 1 based (i.e. 30001 - 39999 or 300001 to 365535). Addresses in Modbus requests are zero based. This means that a request for 400001 is a function code 03 with the register address of 0.

As far as all of your data, you can pretty much locate it anywhere. The most common and probably most interoperable way is probably to use 0x and 4x registers and keep the maximum register used below 9999. The user needs to program the master
to query a network node for the desired registers and present the data to the application layer. The key part is to fully document for the user your data map.

Modbus network node addresses can be determined by dip switches or by software configuration in slave devices. The user then programs the Modbus master to query the appropriate network node and collect data from the appropriate register

I suggest you get a Modbus slave device (or software simulator) and Modbus master device (of the type your end-users probably will use) and play with them to get an idea of how they work. Then you can also test for interoperability when you're done. There are also lots of simple test-set type programs that simulate masters and
slaves that you can also use to get a good feel for how Modbus messaging works.

Darold Woodward PE
Schweitzer Engineering Laboratories
[email protected]