Since a single byte is normally used to define the slave address and each slave on a network requires a unique address, the number of slaves on a network is limited to 256. The limit defined in the modbus specification is even lower at 247.
master和slave之間走的Modbus 協定其封包格式有分ASCII 或RTU兩種
ASCII 為文字模式, 用character 傳送, RTU 為binary 模式傳送
封包格式: Slave ID | Function Code | Data | CRC
RTU 訊息格式
Information is stored in the Slave device in four different tables.
Two tables store on/off discrete values (coils) and two store numerical values (registers). The coils and registers each have a read-only table and read-write table.
Each table has 9999 values. Each coil or contact is 1 bit and assigned a data address between 0000 and 270E. Each register is 1 word = 16 bits = 2 bytes and also has data address between 0000 and 270E.
Coil/Register Numbers
Data Addresses
Type
Table Name
1-9999
0000 to 270E(9999)
Read-Write
Discrete Output Coils
10001-19999
0000 to 270E
Read-Only
Discrete Input Contacts
30001-39999
0000 to 270E
Read-Only
Analog Input Registers
40001-49999
0000 to 270E
Read-Write
Analog Output Holding Registers
Coil/Register Numbers can be thought of as location names since they do not appear in the actual messages. The Data Addresses are used in the messages.For example, the first Holding Register, number 40001, has the Data Address 0000. The difference between these two values is the offset.
Each table has a different offset. 1, 10001, 30001 and 40001.
What is a function code?
The second byte sent by the Master is the Function code. This number tells the slave which table to access and whether to read from or write to the table.
Function Code (Command) 3 is to read 4xxx registers, and 4 for 3xxx registers.
Function Code
Action
Table Name
01 (01 hex)
Read
Discrete Output Coils
05 (05 hex)
Write single
Discrete Output Coil
15 (0F hex)
Write multiple
Discrete Output Coils
02 (02 hex)
Read
Discrete Input Contacts
04 (04 hex)
Read
Analog Input Registers
03 (03 hex)
Read
Analog Output Holding Registers
06 (06 hex)
Write single
Analog Output Holding Register
16 (10 hex)
Write multiple
Analog Output Holding Registers
Example:
Read Holding Registers (FC=03)
Request
This command is requesting the content of analog output holding registers # 40108 to
40110 from the slave device with address 17. 11 03 006B 0003 7687 11: The Slave Address (11 hex = address17 ) 03: The Function Code 3 (read Analog Output Holding Registers) 006B: The Data Address of the first register requested.
( 006B hex = 107 , + 40001 offset = input #40108 ) 0003: The total number of registers requested. (read 3 registers 40108 to 40110) 7687: The CRC (cyclic redundancy check) for error checking. Response 11 03 06 AE41 5652 4340 49AD 11: The Slave Address (11 hex = address17 ) 03: The Function Code 3 (read Analog Output Holding Registers) 06: The number of data bytes to follow (3 registers x 2 bytes each = 6 bytes) AE41: The contents of register 40108 5652: The contents of register 40109 4340: The contents of register 40110 49AD: The CRC (cyclic redundancy check).
Read Coil Status (FC=01) Request
This command is requesting the ON/OFF status of discrete coils # 20 to 56
from the slave device with address 17. 11 01 0013 0025 0E84
11: The Slave Address (11 hex = address17 ) 01: The Function Code 1 (read Coil Status) 0013: The Data Address of the first coil to read.
( 0013 hex = 19 , + 1 offset = coil #20 ) 0025: The total number of coils requested. (25 hex = 37, inputs 20 to 56 ) 0E84: The CRC (cyclic redundancy check) for error checking. Response 11 01 05 CD6BB20E1B 45E6 11: The Slave Address (11 hex = address17 ) 01: The Function Code 1 (read Coil Status) 05: The number of data bytes to follow (37 Coils / 8 bits per byte = 5 bytes) CD: Coils 27 - 20 (1100 1101) 6B: Coils 35 - 28 (0110 1011) B2: Coils 43 - 36 (1011 0010) 0E: Coils 51 - 44 (0000 1110) 1B: 3 space holders & Coils 56 - 52 (0001 1011) 45E6: The CRC (cyclic redundancy check).
The more significant bits contain the higher coil variables. This shows that coil 36 is off (0) and 43 is on (1). Due to the number of coils requested, the last data field1Bcontains the status of only 5 coils. The three most significant bits in this data field are filled in with zeroes.
RS485 模組 (MAX485)的Pin 腳定義:
pin 1 :RO (receive out)
pin 2 RE (receive enable)
pin 3 :DE (data enable)
pin 4 :DI (data in)
pin 5, pin 8 : Gnd and Vcc onnected
pin 6,7 : A and B the RS485 pair
RO------->UART TX DI<------- UART RX 把/RE and DE 短路, 然後MCU/Pi 用一根GPIO 決定 /RE 或 DE.(即是決定是在送還是在收的狀態, 因為RS485是單工)