ControlByWeb X-600M - Modbus Function Code Summary; PLC Device Addressing for Modbus

Modbus Operation X-600M Users Manual
5.1 X-600M Function Code Summary
X-600M supports the following function codes:
Code Name Modbus
Function
X-600M Feature X-600M Start Address
Hexadecimal Decimal
Read Coils 01 Mapped Relays See address table See address table
Read Discrete Inputs 02 Mapped Inputs See address table See address table
Read Holding Register 03 Mapped Analog
I/O
See address table See address table
Write Single Coil 05 Mapped Relays See address table See address table
Write Multiple Coils 15 Mapped Relays See address table See address table
Write Multiple Registers 16 Mapped
Regsiters
See address table See address table
The X-600M has two TCP sockets available for Modbus/TCP. This allows two connections to be open at
one time. Requests for more than two open connections will be rejected.
When an error occurs, an error code is returned. Most Modbus client software will interpret this code in a
human readable form. The code is comprised of the original function code plus 0x80. For example, an
error during the read coils function 0x01 would return 0x81. Each error has a qualifying exception
number. The following are the possible exception codes and their meanings:
0x01 - Function code not supported (also when Modbus is disabled in the setup pages).
0x02 - Incorrect starting address/quantity of output combination.
5.2 PLC Device Addressing
There are generally two schemes for accessing Modbus devices, the first is by specifying the Modbus
function code, memory type, and address. The second, sometimes called PLC addressing, requires only
the address.
Modbus protocol uses four different address ranges for discrete inputs, coils, input registers, and holding
registers. The function code determines the address range of the message. The following are common
function codes and their respective address ranges.
Code Name Modbus
Function
Data Type* PLC Address
Mode 485
PLC Address
Mode 584/984
Coils (Read/Write) 01, 05, 15 Discrete 1-1000 1-10000
Discrete Inputs (Read only) 02 Discrete 1001-2000 10001-20000
Registers (Read only) 04 8-64 bits 3001-4000 30001-40000
Holding Registers
(Read/Write)
03, 06, 16 8-64 bits 4001-5000 40001-50000
*Data types may be implemented at the discretion of the manufacturer. Address ranges may also over
Page 100 Xytronix Research & Design, Inc.