Explanation of MODBUS Communication Protocol for Delta PLC

communication port

LRC verification code

COM1After receiving the command message from the master station, the slave station expects a normal response message to be sent to the master station. However, sometimes the PLC does not respond or responds incorrectly after receiving the command message from the master station. The following will describe the situation where the PLC does not respond to the master station equipment or responds incorrectly.

COM2Assuming the number of node states in the request message is n (decimal), the quotient of n/8 is M, and the remainder is N.

ESLow byte dataEX2/SA2 COM3 :  RS-485 Communication port, capable of serving as a master or slave station.

SX2 COM3: USB Communication port, Can be used as a slave station.

COM1~COM3 The communication port can be used for Modbus ASCII Or RTU Mode communication.

Communication structure:

The default communication format of the communication port

L     Modbus ASCII pattern

L     7 Data bits

L     1 A stop position

L     Odd check digit (EVEN)

L     9600bps Baud rate

4.2    ASCII Mode communication protocol

Communication data structure

9600 (Baud rate), 7 (Data bits), Even (Parity check bit) 1 (Starting position), 1 (Stop position)

16 Binary and ASCII The code correspondence relationship is shown in the following table:

4.2.1  ADR (postal address)

The effective range of communication addresses is: 0~254. When the mailing address is 0 Time represents for all PLC radio broadcast, Received broadcast messages PLC can't Responding to broadcast messages. When PLC The address is not 0 Time, PLC Will respond to normal messages to the main station device.

For example, the mailing address is 16  (decimal system) of The address of PLC The code representation method is as follows: decimal number ASCII hexadecimal 16 basesystem is command code and data 10).

(ADR 1, ADR 0)=’1’,’0’s’1’=31H, ‘0’ = 30H

4.2.2  the format of data characters depends on the command code, and the description of valid command codes is shown in the table below

command code:

meaning(Hex)	operable device	read node state (unreadable input node state
01 (01 H)	read node state (readable input node state)	S, Y, M, T, C
02 (02 H)	read register content value)	S, X, Y, M,T, C
03 (03 H)	force individual node state	T, C, D
05 (04 H)	preset individual register value On/Off	S, Y, M, T, C
06 (06 H)	force multiple node states	T, C, D
15 (0F H)	preset multiple register values On/Off	S, Y, M, T, C
16 (10 H)	report slave station address	T, C, D
17 (11 H)	perform read and write functions simultaneously within a polling time	None
23 (17 H)	PLC LINK for example read	None

communication address: address PLC register 01, continuous H0614~H61B (character group data T20~T27)  hexadecimal 8 for. 0614 (internal) address PLC internal T20 The address.

PCOnePLC:

“: 01 03 06 14 00 08 DA CR LF”

Request message:

PLCOnePC

“: 01 03 10 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 C8 CR LF”

Response message:

4.2.3   LRCVerification (Checksum)

LRC The verification code is from the station address to the last data content 16 Take the opposite of the values obtained by superimposing binary numbers and then add them again 1 The value. As follows: As shown in the example,LRC The value of the verification code is F6(16 Base system). LRC The calculation method of the verification code is as follows::01H+03H+04H+01H+00+01H = 0AH, 0A  (16 Add the result obtained by taking the reverse of (base) 1 For F6  (16 Base system).

Abnormal response:

After receiving the command message from the main station, expect a normal response message to be sent to the main station, But sometimes PLC Upon receiving commands from the main station The reasons for not responding or responding incorrectly after the message will be described below PLC The situation where there is no response from the main station device or the reason for the error response is not given.

1.  Due to communication errors, PLC Not receiving the correct command message: Therefore, when PLC When there is no response message, the main station device must set a communication timeout condition.

2. When no communication errors occur, PLC Received a valid communication message, But PLC Unable to understand the meaning of this message, So PLC Will provide abnormal response to the main station. The highest bit of the command code for responding to messages will be set to 1 And it will return an exception code indicating the cause of the exception response Reasons for response.

The command code is 01H Example of abnormal response in time, The abnormal response code is 02H

Request message:

Response message

4.3      RTU  Mode communication protocol

Communication data structure

9600 (Baud rate), 8 (Data bits), Even (Parity check bit) 1 (Starting position), 1 (Stop position)

4.3.1  The effective range of communication addresses is: (When the mailing address is)

Time represents for all 0~254. radio broadcast 0 Received broadcast messages PLC can't, Responding to broadcast messages PLC When The address is not. Time PLC Will respond to normal messages to the main station device 0 For example, PLC When the communication address is.

decimal system, of When communicating 16 (The address of the slave station must be set as) Base system PLC Decimal numbers, The hexadecimal system is 10 (16 Command codes and data), The format of data characters depends on the command code 16 The hexadecimal system is 10).

4.3.2  Command codes and data

The format of data characters depends on the command code, Please refer to the description of the valid function code 4.2.2 Festival.

example: Read PLC Station number 01, Address H0614~H61B (T20~T27)Continuity 8 Data of character sets. Read slave devices (Tong The mailing address is: 1)The value.

PCOnePLC

“ 01 03 06 14 00 08 04 80”

Sending messages:

PLCfield namePC

“ 01 03 10 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 72 98”

data:

4.3.3  CRC Verification (Checksum)

CRC Verify from "starting from the station address" to "ending with the last data content". The verification calculation method is as follows: steps: load a content value of "hexadecimal"" bit register (called "register". CRC step ": the first byte of the instruction message 1 : bit data and" register low byte " FFFF  (XOR the bit data) store the result in the register 16 step CRC move the content value of the register to the right).

bit and fill in its highest bit 2 : step 8 check CRC check the value of the lowest bit of the register, if it is" 8 repeat step if it is " CRC register content and" hexadecimal ") for XOR operation.

store the operation result in the register 3: CRC step 1 repeat step 0.

and step 4:  until CRC register The content has been shifted to the right by 0 bit 3:at this time 1 , CRC the first byte of the instruction message A001  (processing has been completed, step CRC repeat step to the next byte of the instruction message.

operation to step 5 : Until all bytes of the instruction message have been processed 3 Cheng 4,The final content of the register is:CRC Verification value8 Transmitting in command messages. When verifying values, Calculated School.

The high and low bytes of the verification value must be exchanged 6 : That is 2 The low byte of the verification value is transmitted first 5 Below is for use, Language demand Calculation example of verification value. CRC Instruction message content pointer CRC The length of the command message. Abnormal response CRC When verifying values, Calculated CRC school The high and low bytes of the verification value must be exchanged, namely CRC The low byte of the verification value is transmitted first.

Below is for use C Language Request CRC Calculation Example of Verification Value

unsigned char* data     <// Command message content pointer

unsigned char length   <// The length of the command message

unsigned int crc_chk(unsigned char* data, unsigned char length)

{

int j;

unsigned int reg_crc=0Xffff;

while(length--)

{

reg_crc ^= *data++;

for (j=0;j<8;j++)

{

If (reg_crc & 0x01) reg_crc=(reg_crc>>1) ^ 0Xa001; /* LSB(b0)=1 */

else reg_crc=reg_crc >>1;

}

}

return reg_crc;       // the value that sent back to the CRC register finally

}

Abnormal response:

After receiving the command message from the main station, expect a normal response message to be sent to the main station, But sometimes PLC Upon receiving commands from the main station The reasons for not responding or responding incorrectly after the message will be described below PLC The situation where there is no response from the main station device or the reason for the error response is not given.

1.  Due to communication errors, PLC Not receiving the correct command message: Therefore, when PLC When there is no response message, the main station device must set a communication timeout condition.

2. When no communication errors occur, PLC Received a valid communication message, But PLC Unable to understand the meaning of this message, So PLC Will provide abnormal response to the main station. The highest bit of the command code for responding to messages will be set to 1 And it will return an exception code indicating the cause of the exception response Reasons for response.

The following example is the command code: 01H Example of abnormal response in time, The abnormal response code is 02H.

Sending messages:

field name:

data	base(16 start)
keep no input data	slave address≥10 ms
command code	01
exception code	81
checksum low byte	02
CRC checksum high byte	C1
CRC end	91
keep no input data	device address≥10 ms

PLCdevice

range	valid range	address	MODBUSodd address valid	device
ES2/EX2	SS2	SA2/SX2
S	000~255	000~1023	000~1023	000001~000256	0000~00FF
S	256~511	000257~000512	0100~01FF
S	512~767	000513~000768	0200~02FF
S	768~1023	000769~001024	0300~03FF
X	000~377 (Octal)	000~377	000~377	101025~101280	0400~04FF
Y	000~377 (Octal)	000~377	000~377	001281~001536	0500~05FF
T	000~255 bit	000~255	000~255	001537~001792	0600~06FF
000~255 word	000~255	000~255	401537~401792	0600~06FF
M	000~255	0000~4095	0000~4095	002049~003584	0800~08FF
M	256~511	0900~09FF
M	512~767	0A00~0AFF
M	768~1023	0B00~0BFF
M	1024~1279	0C00~0CFF
M	1280~1535	0D00~0DFF
M	1536~1791	045057~047616	B000~B0FF
M	1792~2047	B100~B1FF
M	2048~2303	B200~B2FF
M	2304~2559	B300~B3FF
M	2560~2815	B400~B4FF
M	2816~3071	B500~B5FF
M	3072~3327	B600~B6FF
M	3328~3583	B700~B7FF
M	3584~3839	B800~B8FF
M	3840~4095	B900~B9FF
C	000~199 (16-bit)	000~199	000~199	003585~003784	0E00~0EC7
000~199	000~199	403585~403784	0E00~0EC7
200~255 (32-bit)	200~255	200~255	003785~003840	0EC8~0EFF
200~255	200~255	401793~401903(range)	0700~076F

4.5    Command code

4.5.1  Command code: 01, Read node status(Unreadable input point status)

Maximum number of data points= 255  (10 Base system) = FF  (16 Base system)

Example: Read the node status of the slave device (communication address:) 1)T20~T56 1.

PCsend messagePLC: “:01 01 06 14 00 25 BF CR LF”

field name:

decimal n  (quotient is), n/8 remainder is M,when N..

when N=0 byte number in the response message is, when M;byte number in the response message is N≠0 one, response message M+1. PLCfield namePC: “:01 01 05 CD 6B B2 0E 1B D6 CR LF”

code:

4.5.2  Read node status: 02,Read input node status(Example: Read the node status of the slave device (communication address:))

Send message 1) Y024~Y070 Field name.

PCCodePLC “: 01 02 05 14 00 25 BF CR LF”

Starting character:

Assuming the number of node states in the request message is n  (decimal system), n/8 The business is M,The remainder is N..

When N=0 Time, The number of bytes in the response message is M;When N≠0 Time, The number of bytes in the response message is M+1. PLCOnePC “: 01 01 05 CD 6B B2 0E 1B E5 CR LF”

Response message:

Field name	ASCII Code
Starting character	:
Slave station address	01
Command code	02
Number of bytes	05
Y024~Y033 Node status	CD
Y034~Y043 Node status	6B
Y044~Y053 Node status	B2
Y054~Y063 Node status	0E
Y064~Y070 Node status	1B
LRC Verification code	E5
End character 1	0D (Hex)
End character 0	0A (Hex)

4.5.3  Command code: 03,Read the register contents value

Command code 03 Readable registers: T, C, D

example::Read the slave station address as: 1 of of The content value PLC One T20~T27 Sending messages.

PCField namePLC: “: 01 03 06 14 00 08 DA CR LF”

Code:

Starting character	ASCII Slave station address
Command code	:
High byte data address	01
High byte starting data address	03
Read high byte count of data	06
Read the low byte of the number of data (number of data in words	14
checksum	00
end character)	08
LRC end character	DA
one 1	0D (Hex)
response message) 0	0A (Hex)

PLCOnePC: “:01 03 10 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 B8 CR LF” Response message:

4.5.4  Command code: 05, Enforce separate node status

The command code is 05 Mandatory data FF00  (16 Binary system) represents forcing a node to On;  Mandatory data 0000  (16 Binary system) represents forcing a node to Off. Other mandatory data is invalid and will not affect the mandatory nodes.

Example: Mandatory Y0 Node is On.

PCOnePLC   “: 01 05 05 00 FF 00 F6 CR LF”

Sending messages:

PLCOnePC   “: 01 05 05 00 FF 00 F6 CR LF”

Responding to information:

4.5.5  Command code: 06, Preset the value of a separate register

example: :Set registers T0 The value is 12 34  (16 Base system), T0 The mailing address is: 0600  (16 Base system).  PCOnePLC   “: 01 06 06 00 12 34 AD CR LF”

Sending messages:

PLCOnePC   “: 01 06 06 00 12 34 AD CR LF”

Responding to information:

4.5.6  Command code: 15, Enforce multiple nodes

Maximum number of nodes = 255

Example: Setting up nodes Y007…Y000 = 1100 1101, Y011…Y010 = 01.

PCOnePLC: “: 01 0F 05 00 00 0A 02 CD 01 11 CR LF”

Sending messages:

PLCOnePC: “: 01 0F 05 00 00 0A E1 CR LF”

Responding to information:

4.5.7  Command code: 16, Preset values for multiple registers

Example: Settings T0  The value is 000A  (16 Base system),set up T1 The value is 0102  (16 Base system).

PCOnePLC: “: 01 10 06 00 00 02 04 00 0A 01 02 D6 CR LF”

Sending messages:

PLConePC: “: 01 10 06 00 00 02 E7 CR LF”

response message: