wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

36-4 Industrial Communication Systems
36.4 Modbus Application Layer
The Modbus protocol defines three distinct APDUs (Figure 36.3) used in the Modbus application layer.
All three APDUs start with a single-byte value indicating the Modbus function being requested or to
which a reply is being made. Following the “function” byte value come all data and parameters of that
specific function. Data and parameters have a variable number of bytes, depending on the function in
question, and the number of memory registers that are being accessed.
All APDUs are, however, limited in size to a maximum of 253 bytes, due to limitations imposed by
the underlying EIA/TIA-485 layer. The Modbus protocol also specifies that all 16 bit addresses and data
items are encoded using big-endian representation. This means that when a numerical quantity larger
than a single byte is transmitted, the most significant byte is sent first. Nevertheless, some device manufacturers
allow the user to specify whether the device should use big or little-endian encoding.
The request APDU is sent by the client to the server. Upon successful completion of the desired
function, the server replies with a response APDU. If the server encounters an error, the server notifies
the client with an exception response APDU.
36.4.1 Data Access Functions
The Modbus protocol defines a large list of functions. The most often used functions are those associated
with accessing the memory areas (Table 36.2).
All functions listed in Table 36.2, with the exception of functions 0x14, 0x15, 0x16, and 0x18,
Âsimply request that some data be read or written to a specific memory area. Function codes 0x05 and
0x06 are used to write to a single element (coil or holding register, respectively). The remaining functions
allow the client to read from or write to multiple contiguous elements of the same memory area.
Function code (F)
Function code (F)
Exception function code (F + 0 × 08)
Request data
Reply data
Exception code
Request APDU
Response APDU
Exception response APDU
FIGURE 36.3
General format of APDU frames.
TABLE 36.2
Functions Used for Data Access
Memory Area
Function Name
Function
Code (Hex)
Addressable
Elements
Possible Response
Error Codes
Discrete Inputs Read discrete inputs 0x02 1–2000 01, 02, 03, 04
Coils Read coils 0x01 1–2000 01, 02, 03, 04
Coils Write single coil 0x05 1 01, 02, 03, 04
Coils Write multiple coils 0x0F 1–1976 01, 02, 03, 04
Input registers Read input registers 0x04 1–125 01, 02, 03, 04
Holding registers Read holding registers 0x03 1–125 01, 02, 03, 04
Holding registers Write single register 0x06 1 01, 02, 03, 04
Holding registers Write multiple registers 0x10 1–123 01, 02, 03, 04
Holding registers Read/write multiple registers 0x17 1–121 (write) 01, 02, 03, 04
1–125 (read)
Holding registers Mask write register 0x16 1 01, 02, 03, 04
Holding registers Read FIFO queue 0x18 1–32 01, 02, 03, 04
Files Read file record 0x14 01, 02, 03, 04, 08
Files Write file record 0x15 01, 02, 03, 04, 08
© 2011 by Taylor and Francis Group, LLC