Modbus Addressing

Hi,

First of all I'm quite new to modbus. I'm working on a Project, and I need to make some modbus readible for the system. In the manual for the Product I have found many address that I want to use. The question is, how do I translate those to a modbus address?

For example: I got an alarm tag that has the Modbuss address 286 in the document for the Equipment. If I want to use that, must I translate that to 30286, or should I just use 286?

It depends.

If the address is a Holding register address then it is in the (4)xxxxx Holding Register memory area.

If the address is a Input register address then it is in the (3)xxxxx Input Register memory area.

The leading numerals (3) or (4) are not part of the Modbus message, but are used to help human beings (or master/client software) figure out which memory area is used so that the correct, corresponding Modbus Function Code (FC) is used by the Modbus Master/client to poll/request the data.

(3)xxxxx uses Function Code 04 to access Input Registers.
(4)xxxxx uses Function Code 03 to access Holding Registers.

Some Master/Clients use the leading numeral to interpret which function code to use. Other Master/Clients do not use the leading numeral because somewhere else the Function code has been selected and the leading numeral is not needed, only the register or indexed value is needed.

The documentation should be clear as to whether the data is an input register or Holding register. I would expect an alarm to be a Holding register, unless it is considered a coil, which uses Function Code 01 that addresses the (0)xxxxx register block

If, for example, it is a Holding register, then sometimes one just needs to try it as 286 or 40286 or 400286 and see what comes up.

The other Gotcha is the one-offset. Some devices start counting from zero. Typical hex addressed registers start counting at zero. Some devices start counting from one. Typical decimal addressed register start counting at one.

But there are exceptions. That's why it is critical to read a 'known' (non-zero) value and make sure that the value is correct, to make sure that you're reading the correct register. Zero values don't count because unused registers are frequently set to zero, so you could read the wrong register and get a zero value.

Hi,

Alarm tag usually in form of digital, 0 for normal and 1 for alarm of the opposite. so if mapped to Modbus, usually digital data will be mapped into coil and you should use Modbus function code of 01. For you sample, you can use FC1 to read digital data from Coil with modbus address is 286.

Sometimes several digital alarm tag consolidated together into integer and mapped to Holding Register. if this case, you should use modbus function code 03. then your PLC/OPC/SCADA should extract the bit from received integer. For your case you can use FC03 to read integer value from 286/40286. afterward, you can extract the bit that represented your alarm. for example if the bit used is bit 1, you should use your PLC/SCADA/OPC to read this bit only using several means depend on your PLC/OPC/SCADA. For example, AB PLC can use MVM instruction or just simply use MOV to the bit.

I can suggest you to use simple modbus simulator software such as Modscan so after confirmed what addressing format is used then you can simply copy the address format into you PLC/OPC/SCADA.

hope this help,
Ikhtiander