Modbus Addressing
The default data types for dynamically defined tags are shown in bold. The Function Codes are displayed in decimal.
5-Digit Addressing vs. 6-Digit Addressing
In Modbus addressing, the first digit of the address specifies the primary table. The remaining digits represent the device's data item. The maximum value of the data item is a two-byte unsigned integer (65,535). Internally, this driver requires six digits to represent the entire address table and item. It is important to note that many Modbus devices may not support the full range of the data item. To avoid confusion when entering an address for such a device, this driver "pads" the address (adds a digit) according to what was entered in the address field. If a primary table type is followed by up to 4 digits (example: 4x, 4xx, 4xxx or 4xxxx), the address stays at or pads, with extra zeroes, to five (5) digits. If a primary table type is followed by five (5) digits (example: 4xxxxx), the address does not change. Internally, addresses entered as 41, 401, 4001, 40001 or 400001 are all equivalent representations of an address specifying primary table type 4 and data item 1.
Primary Table | Description |
|---|---|
0 | Output Coils |
1 | Input Coils |
3 | Internal Registers |
4 | Holding Registers |
Modbus Addressing in Decimal Format
Address | Range | Data Type | Access* | Function Code |
|---|---|---|---|---|
Output Coils | 000001-065536 | Boolean | Read/Write | 01, 05, 15 |
Input Coils | 100001-165536 | Boolean | Read Only | 02 |
Internal Registers | 300001-365536 300001-365535 300001-365533 3xxxxx.0/1-3xxxxx.15/16*** | Word, Short, BCD Float, DWord, Long, LBCD Double Boolean | Read Only | 04 |
Internal Registers As String with HiLo Byte Order | 300001.2H-365536.240H .Bit is string length, range 2 to 240 bytes. | String** | Read Only | 04 |
Internal Registers As String with LoHi Byte Order | 300001.2L-365536.240L .Bit is string length, range 2 to 240 bytes. | String** | Read Only | 04 |
Holding Registers | 400001-465536 400001-465535 400001-465533 4xxxxx.0/1-4xxxxx.15/16*** | Word, Short, BCD Float, DWord, Long, LBCD Double Boolean | Read/Write | 03, 06, 16 03, 06, 16, 22 |
Holding Registers As String with HiLo Byte Order | 400001.2H-465536.240H .Bit is string length, range 2 to 240 bytes. | String** | Read/Write | 03, 16 |
Holding Registers As String with LoHi Byte Order | 400001.2L-465536.240L .Bit is string length, range 2 to 240 bytes. | String** | Read/Write | 03, 16 |
*All Read/Write addresses may be set as Write Only by prefixing a "W" to the address such as "W40001." This prevents the driver from reading the register at the specified address. Any attempts by the client to read a Write Only tag results in obtaining the last successful write value to the specified address. If no successful writes have occurred, the client receives 0/NULL for numeric/string values for an initial value.
Caution: Setting the Client Access privileges of Write Only tags to Read Only causes writes to these tags to fail and the client to always receive 0/NULL for numeric/string values.
**For more information, refer to String Support. ***For more information, refer to Zero-Based Bit Addressing in Settings.Modbus Addressing in Hexadecimal Format
Address | Range | Data Type | Access | Function Code |
|---|---|---|---|---|
Output Coils | H000001-H0FFFF | Boolean | Read/Write | 01, 05, 15 |
Input Coils | H100001-H1FFFF | Boolean | Read Only | 02 |
Internal Registers | H300001-H310000 H300001-H3FFFF H300001-H3FFFD H3xxxxx.0/1-H3xxxxx.F/10* | Word, Short, BCD Float, DWord, Long, LBCD Double Boolean | Read Only | 04 |
Internal Registers As String with HiLo Byte Order | H300001.2H-H3FFFF.240H. Bit is string length, range 2 to 240 bytes. | String** | Read Only | 04 |
Internal Registers As String with LoHi Byte Order | H300001.2L-H3FFFF.240L. Bit is string length, range 2 to 240 bytes. | String** | Read Only | 04 |
Holding Registers | H400001-H410000 H400001-H4FFFF H400001-H4FFFD H4xxxxx.0/1-H4xxxxx.F/10* | Word, Short, BCD, Float, DWord, Long, LBCD, Double, Boolean | Read/Write | 03, 06, 16 03, 06, 16, 22 |
Holding Registers As String with HiLo Byte Order | H400001.2H-H4FFFF.240H. Bit is string length, range 2 to 240 bytes. | String** | Read/Write | 03, 16 |
Holding Registers As String with LoHi Byte Order | H400001.2L-H4FFFF.240L. Bit is string length, range 2 to 240 bytes. | String** | Read/Write | 03, 16 |
*For more information, refer to Zero-Based Bit Addressing in Settings. **For more information, refer to String Support.String Support
The Modbus model supports reading and writing holding register memory as an ASCII string. When using holding registers for string data, each register contains two bytes of ASCII data. The order of the ASCII data within a given register can be selected when the string is defined. The length of the string can be from 2 to 240 bytes and is entered in place of a bit number. The length must be entered as an even number. The byte order is specified by appending either a "H" or "L" to the address.
String Examples
1. To address a string starting at 40200 with a length of 100 bytes and HiLo byte order, enter "40200.100H".
2. To address a string starting at 40500 with a length of 78 bytes and LoHi byte order, enter "40500.78L".
Note: The string's length may be limited by the maximum size of the write request that the device allows. If, while utilizing a string tag, an error message of "Unable to write to address <address> on device <device>: Device responded with exception code 3" is received in the server event window, this means that the device did not like the string's length. If possible, shorten the string.Normal Address Examples
1. The 255th output coil would be addressed as '0255' using decimal addressing or 'H0FF' using hexadecimal addressing.
2. Some documentation refers to Modbus addresses by function code and location. For instance, function code 3; location 2000 would be addressed as '42000' or 'H47D0'. The leading '4' represents holding registers or function code 3.
3. Some documentation refers to Modbus addresses by function code and location. For instance, setting function code 5 location 100 would be addressed as '0100' or 'H064'. The leading '0' represents output coils or function code 5. Writing 1 or 0 to this address would set or reset the coil.
Array Support
Arrays are supported for internal and holding register locations for all data types except for Boolean and Strings. Arrays are also supported for input and output coils (Boolean data types). There are two methods of addressing an array. The following examples use holding register locations:
4xxxx [rows] [cols]
4xxxx [cols] this method assumes rows is equal to one.
For arrays, rows multiplied by cols cannot exceed the block size that has been assigned to the device for the register / coil type. For register arrays of 32-bit data types, rows multiplied by cols multiplied by 2 cannot exceed the block size.
Packed Coil Address Type
The Packed Coil address type allows access to multiple consecutive coils as an analog value. This feature is available for both input coils and output coils, polled mode only. The only valid data type is Word. The syntax is:
Output coils: 0xxxxx#nn Word Read/Write
Input coils: 1xxxxx#nn Word Read Only
where xxxxx is the address of the first coil (decimal and hex values allowed), and nn is the number of coils to be packed into an analog value (1-16, decimal only).
The bit order is such that the start address is the LSB (least significant bit) of analog value.