Application and Installation Guide EMCP 4 SCADA Data Links
©2013 Caterpillar
All rights reserved. Page 12
4 EMCP 4 SCADA COMMUNICATION
Modbus communication consists of the client (PC, PLC, or other customer device) making requests to
read from or write to certain addresses on the server (EMCP 4). The server only responds to requests,
and responds in a well-defined manner. The client must know about the addresses defined on the server;
addressing is explained in section 4.1. The client requests to read from or write to certain addresses by
using a set of Function Codes; section 4.2 describes the Function Codes supported by the EMCP 4.
4.1 ADDRESSING
Modbus addresses reference registers called Holding Registers that are each 2 bytes long. Larger pieces
of data occupy consecutive registers, with the most significant word (pair of bytes) in the lowest address
register, and the least significant word (pair of bytes) in the highest address register.
EMCP 4 Modbus addresses are described throughout this document, and are normally referenced by the
name and decimal address, like this: Write Access Password (700). However, there is a different
addressing model called “PDU Addressing” in which Modbus addresses for Holding Registers are in the
range 40,000-49,999. For applications using PDU Addressing, simply add 40,000 to the addresses given
in this document.
Modbus addresses given in this document are different from the address numbers transmitted over the
data link. The address of 1 is the lowest address, but is transmitted as 0x0000. Therefore, when register
addresses are given in hexadecimal, note that the decimal value must be decreased by 1 and then
converted to hex. So Write Access Password (700) is actually transmitted over the data link as 700-1 =
699 0x02BB.
4.2 SUPPORTED FUNCTION CODES
On both Modbus RTU and TCP, all communication occurs by the use of Function Codes to a set of
Addresses. The addresses are all Holding Registers, and the EMCP 4 supports the following Function
Codes:
3 (0x03) – Read Registers
6 (0x06) – Write Single Register
16 (0x10) – Write Multiple Registers
3 (0X03) – READ REGISTERS
Send this Function Code to read data, single or up to 125 consecutive registers, from the EMCP 4. Note
that the query will contain the register count, while the response will contain the byte count (byte count =
register count x 2). Note also that the query has a fixed length of 8 bytes, whereas the response has a
variable length depending on the number of registers requested, with a minimum of 7 bytes.
T
ABLE 4-1: READ REGISTERS - REQUEST
Address Fcn Code Addr hi Addr lo Num hi Num lo CRC lo CRC hi
Slave addr. 0x03 Starting Reg address Number of Registers (N) CRC16 error checking
To Next Page
Loading...