Since a single byte is normally used to define the slave address and each slave on a network requires a unique address, the number of slaves on a network is limited to 256. The limit defined in the modbus specification is even lower at 247.
master和slave之間走的Modbus 協定其封包格式有分ASCII 或RTU兩種
ASCII 為文字模式, 用character 傳送, RTU 為binary 模式傳送
封包格式: Slave ID | Function Code | Data | CRC
RTU 訊息格式
Information is stored in the Slave device in four different tables.
Two tables store on/off discrete values (coils) and two store numerical values (registers). The coils and registers each have a read-only table and read-write table.
Each table has 9999 values. Each coil or contact is 1 bit and assigned a data address between 0000 and 270E. Each register is 1 word = 16 bits = 2 bytes and also has data address between 0000 and 270E.
Coil/Register Numbers
Data Addresses
Type
Table Name
1-9999
0000 to 270E(9999)
Read-Write
Discrete Output Coils
10001-19999
0000 to 270E
Read-Only
Discrete Input Contacts
30001-39999
0000 to 270E
Read-Only
Analog Input Registers
40001-49999
0000 to 270E
Read-Write
Analog Output Holding Registers
Coil/Register Numbers can be thought of as location names since they do not appear in the actual messages. The Data Addresses are used in the messages.For example, the first Holding Register, number 40001, has the Data Address 0000. The difference between these two values is the offset.
Each table has a different offset. 1, 10001, 30001 and 40001.
What is a function code?
The second byte sent by the Master is the Function code. This number tells the slave which table to access and whether to read from or write to the table.
Function Code (Command) 3 is to read 4xxx registers, and 4 for 3xxx registers.
Function Code
Action
Table Name
01 (01 hex)
Read
Discrete Output Coils
05 (05 hex)
Write single
Discrete Output Coil
15 (0F hex)
Write multiple
Discrete Output Coils
02 (02 hex)
Read
Discrete Input Contacts
04 (04 hex)
Read
Analog Input Registers
03 (03 hex)
Read
Analog Output Holding Registers
06 (06 hex)
Write single
Analog Output Holding Register
16 (10 hex)
Write multiple
Analog Output Holding Registers
Example:
Read Holding Registers (FC=03)
Request
This command is requesting the content of analog output holding registers # 40108 to
40110 from the slave device with address 17. 11 03 006B 0003 7687 11: The Slave Address (11 hex = address17 ) 03: The Function Code 3 (read Analog Output Holding Registers) 006B: The Data Address of the first register requested.
( 006B hex = 107 , + 40001 offset = input #40108 ) 0003: The total number of registers requested. (read 3 registers 40108 to 40110) 7687: The CRC (cyclic redundancy check) for error checking. Response 11 03 06 AE41 5652 4340 49AD 11: The Slave Address (11 hex = address17 ) 03: The Function Code 3 (read Analog Output Holding Registers) 06: The number of data bytes to follow (3 registers x 2 bytes each = 6 bytes) AE41: The contents of register 40108 5652: The contents of register 40109 4340: The contents of register 40110 49AD: The CRC (cyclic redundancy check).
Read Coil Status (FC=01) Request
This command is requesting the ON/OFF status of discrete coils # 20 to 56
from the slave device with address 17. 11 01 0013 0025 0E84
11: The Slave Address (11 hex = address17 ) 01: The Function Code 1 (read Coil Status) 0013: The Data Address of the first coil to read.
( 0013 hex = 19 , + 1 offset = coil #20 ) 0025: The total number of coils requested. (25 hex = 37, inputs 20 to 56 ) 0E84: The CRC (cyclic redundancy check) for error checking. Response 11 01 05 CD6BB20E1B 45E6 11: The Slave Address (11 hex = address17 ) 01: The Function Code 1 (read Coil Status) 05: The number of data bytes to follow (37 Coils / 8 bits per byte = 5 bytes) CD: Coils 27 - 20 (1100 1101) 6B: Coils 35 - 28 (0110 1011) B2: Coils 43 - 36 (1011 0010) 0E: Coils 51 - 44 (0000 1110) 1B: 3 space holders & Coils 56 - 52 (0001 1011) 45E6: The CRC (cyclic redundancy check).
The more significant bits contain the higher coil variables. This shows that coil 36 is off (0) and 43 is on (1). Due to the number of coils requested, the last data field1Bcontains the status of only 5 coils. The three most significant bits in this data field are filled in with zeroes.
RS485 模組 (MAX485)的Pin 腳定義:
pin 1 :RO (receive out)
pin 2 RE (receive enable)
pin 3 :DE (data enable)
pin 4 :DI (data in)
pin 5, pin 8 : Gnd and Vcc onnected
pin 6,7 : A and B the RS485 pair
RO------->UART TX DI<------- UART RX 把/RE and DE 短路, 然後MCU/Pi 用一根GPIO 決定 /RE 或 DE.(即是決定是在送還是在收的狀態, 因為RS485是單工)
本課程之 Driver 開發範例皆直接於 Raspberry Pi 平台上進行，並將 Raspberry Pi 視為一套完整的 Linux 主機開發環境。教學內容涵蓋 Linux Driver 的核心設計觀念、各項驅動程式技術主題的系統性講解，並搭配實際開發成果與操作示範（Demo）影片，協助學員由理論延伸至實務，完整掌握驅動程式的開發流程與系統整合方法。
課程實作範例基於 Linux Kernel 4.14 LTS（Long Term Support）版本進行設計。此版本具備架構成熟、API 穩定且子系統複雜度適中的特性，特別適合用於拆解與理解 Linux Driver 的核心設計原理。學員能清楚掌握中斷機制、裝置模型、資源管理、平台驅動、Device Tree 與各子系統之間的架構關係，而非僅停留於高度自動化 API 的操作層面。
Linux Driver 的核心架構自 4.x 至 6.x 版本之間並未產生本質性的改變，主要差異在於 API 設計與實作形式的演進。本課程著重於培養學員對 Linux 裝置模型、子系統整合與資源生命週期管理的系統性能力，確保所學知識可無縫遷移至 5.x、6.x 及未來核心版本，並實際應用於產業級開發與產品導入場景。~ 2025/12/3
