A listing of commonly-used Modbus function codes appears in the following table.
Modbus Function Codes
Live data inside of any digital device is always located at some address within that device’s random-access memory (RAM).
The Modbus “984” addressing standard deﬁnes sets of ﬁxed numerical addresses where various types of data may be found in a PLC or other control device.
The absolute address ranges (according to the Modbus 984 scheme) are shown in this table, with each address holding 16 bits of data:
Note how all the Modbus address ranges begin at the number one, not zero as is customary for so many digital systems.
For example, a PLC with sixteen analog input channels numbered 0 through 15 by the manufacturer may “map” those input registers to Modbus addresses 30001 through 30016, respectively.
While this ﬁxed addressing scheme was correct for the original PLCs developed by Modicon, it almost never corresponds directly to the addresses within a modern Modbus master or slave device.
Manufacturers’ documentation for Modbus-compatible devices normally provides Modbus “mapping” references so technicians and engineers alike may determine which Modbus addresses refer to speciﬁc bit or word registers in the device.
In some cases, the conﬁguration software for a Modbus-compatible device provides a utility where you may assign speciﬁc device variables to standard Modbus register numbers.
An example of a Modbus variable mapping page appears in this screenshot taken from the conﬁguration utility for an Emerson Smart Wireless gateway, used to “map” data from variables within WirelessHART radio-based industrial ﬁeld instruments to Modbus registers within the gateway device where other devices on a wired network may read that data:
As you can see here, the primary variable within temperature sensor TT-101 (TT-101.PV) has been mapped to Modbus register 30001, where any Modbus master device on the wired network will be able to read it.
Likewise, the secondary variable within level switch LSL-78 (LSL-78.SV) has been mapped to Modbus register 30041.
It is important to note that Modbus registers are 16 bits each, which may or may not exactly ﬁt the bit width of the device variable in question. If the device variable happens to be a 32-bit ﬂoating point number, then two contiguous Modbus registers must be used to hold that variable, only the ﬁrst of which will likely appear on the Modbus mapping page (i.e. the Modbus map will only show the ﬁrst Modbus register of that pair).
If the device variable happens to be a boolean (single bit), then it is likely only one bit within the 16-bit Modbus register will be used, the other 15 bits being “wasted” (unavailable) for other purposes.
Details such as this may be documented in the manual for the device performing the Modbus mapping (in this case the Emerson Smart Wireless Gateway), or you may be forced to discover them by experimentation.
© 2019-2021 by Tony R. Kuphaldt – under the terms and conditions of the Creative Commons Attribution 4.0 International Public License