Modbus Communication Programming Example (1)
Recently, I have been writing about Modbus and fieldbus introductions separately, which are more conceptual and do not involve specific examples. Many readers may still find it insufficiently detailed. Since I am no longer engaged in specific programming debugging, providing direct examples is quite challenging. I referenced some materials from the internet and Schneider Electric’s internal resources to create the following cases, utilizing some of others’ work. If the original authors are concerned about copyright issues, please contact me; I respect your ownership.
I have mentioned the function codes of Modbus in my posts; there are not many commonly used ones. Here are more (though not all):
Function Code (Decimal) Hexadecimal Description
01 01 Read Coil
02 02 Read Discrete Input
03 03 Read Holding Register
04 04 Read Input Register
05 05 Write Single Coil
06 06 Write Single Register
07 07 Read Exception Status
08 08 Diagnostics
0B 0B Get Event Counter
0C 0C Get Event Log
0F 0F Write Multiple Coils
10 10 Write Multiple Registers
11 11 Report Slave ID
16 16 Mask Write Register
17 17 Read/Write Multiple Registers
18 18 Read FIFO Queue
The DATA_EXCH function block is used for Premium and M340 to transfer data to another device, supporting all Modbus function codes. DATA_EXCH represented in Ladder Diagram:
Pin Definitions:
ADR is the address pin, which requires the ADDR function block for the PREMIUM series. For the M340 series, the ADDM function block is needed. TYPE is the type pin: 1 for receive/send, 2 for receive only, and 3 for send only. EMIS is the send table, RECP is the receive table, and GEST is the exchange management table.
Example 1: Read N Bits (Function Code 01)
In the EMIS array, the first word’s low byte is function code 01, and the high byte is the starting bit to read 1. The second word’s low byte is the starting bit to read 1, and the high byte is the length of bits to read 5. The third word’s low byte is the length of bits to read 5. Finally, in the exchange management table’s fourth word, define the length of this report byte: 1 byte for the function code, 2 bytes for the starting address of the data, and 2 bytes for the length of bits to read, so the total length is 1 + 2 + 2 = 5.
Assigning values in TWIDO as follows:
In RECP, the first word is the return code.
The second word is the data read.
Modbus Communication Programming Example (2)
Example 2: Read N Words (Function Code 03)
In the EMIS array, the first word’s low byte is function code 03, and the high byte is the starting address of the word to read 1.
The second word’s low byte is the starting address of the word to read 1, and the high byte is the length of words to read 6. The third word’s low byte is the length of words to read 6. Finally, in the exchange management table’s fourth word, define the length of this report byte: 1 byte for the function code, 2 bytes for the starting address of the data, and 2 bytes for the length of words to read, so the total length is 1 + 2 + 2 = 5.
Assigning values in TWIDO as follows:
In RECP, the first word is the return code.
The second word onwards is the data read.
Modbus Communication Programming Example (3)
Example 3: Write Single Word (Function Code 06)
In the EMIS array, the first word’s low byte is function code 06, and the high byte is the address of the word to be written to the slave 11. The second word’s low byte is the address of the word to be written to the slave 11, and the high byte is the address of the word to be written by the master 90. The third word’s low byte is the address of the word to be written by the master 90. Finally, in the exchange management table’s fourth word, define the length of this report byte: 1 byte for the function code, 2 bytes for the slave’s write address, and 2 bytes for the master’s write address, so the total length is 1 + 2 + 2 = 5.
Assigning values in the master as follows:
Displaying in TWIDO as follows:
Modbus Communication Programming Example (4)
Example 4: Write N Words (Function Code 16)
In the EMIS array, the first word’s low byte is function code 16, and the high byte is the starting address of the word to be written to the slave 20. The second word’s low byte is the starting address of the word to be written to the slave 20, and the high byte is the length of words to be written 3. The third word’s low byte is the length of words to be written 3, and the high byte is double the length of words to be written. The fourth to sixth words are the words to be written by the master, with the high and low byte order needing to be swapped. Finally, in the exchange management table’s fourth word, define the length of this report byte: 1 byte for the function code, 2 bytes for the slave’s write address, 2 bytes for the length of words to be written, 1 byte for double the length of words to be written, and 6 bytes for the words to be written by the master, so the total length is 1 + 2 + 2 + 1 + 6 = 12.
Assigning values in the master as follows:
Displaying in TWIDO as follows:
Additionally, note that when refreshing data, the EN pin must be disconnected to read or write again. Through experimentation, placing the completion bit of the exchange management table (i.e., the lowest bit of GEST’s first word) before the EN pin does not work well, so it is best to create a token loop instruction. Place the token before the EN pin, and only read or write when the token is obtained.
Function Code 05:
Welcome everyone to discuss on the forum~
Knowledge should be shared without reservation~
Source / China Industrial Control Network Industrial Control Forum, please indicate the source when reprinting.
Previous Highlights ▼
Workshop maintenance essentials, useful at any time!
How to achieve encoder positioning function using PLC control?
6 classic circuit diagrams analysis to help you advance to a senior electrician, do you know them all?
Illustrated! Electrical control cabinet component installation and wiring specifications~
Sharing three PLC control system examples, feel free to take them!
Systematically learn the working principles of frequency converters; do you understand these basic concepts?
Comprehensive explanation of various directional control valve principles and differences~
Newcomers, come here! Common issues with S7-1500T~
Example | Mitsubishi PLC controlling frequency converter using RS485
Uncommon engines, only seen by experts!
[Industrial Dream Chaser] My story in the automation control profession
Essentials | Starting with Modbus to discuss fieldbus!
Recommended to bookmark | Common electrical formulas and application examples!
Super comprehensive electrical engineering formulas, algorithms, and diagrams, recommended to bookmark!
Secrets of frequency converter working principles and wiring diagrams
Meanings of various wires in power supply systems
Recommended to bookmark | 28 common lighting control circuit diagrams~
Three-phase electricity principles and connections, differences from two-phase and single-phase electricity
Essentials | What is the essential difference between electrical control and PLC?
Essentials | Analysis of 16 common module circuits, a must-have for engineers~
Principles of robotic arm movement and in-depth analysis of its internal structure!
Omron PLC instruction application cases (Q&A analysis)
Organized | A quick guide to understanding frequency converters and their application industries
Common electronic component testing methods and experience collection~
Detailed explanation of PLC indirect addressing and direct addressing~
In a way, the shortest distance between industrial control people is just a small secretary apart. Follow me to gain more resources and information. The little secretary will take you to explore a broader new world of industrial intelligence!
—— Information Secretary
Click “Read the original text” for more.