Basics

Section 2.1
Modbus Functions

Modbus Functions

What Is in This Section?

This section contains the following topics:
Topic Page
Modbus Protocol 17
Supported Modbus Functions 18

16 NVE41308 04/2016
 Basics

Modbus Protocol

Introduction
The transmission mode used is RTU. The frame does not contain message header and end of message
bytes.

Slave address Request code Data CRC16

The data is transmitted in binary code.

CRC16: cyclical redundancy check.
The end of the frame is detected on a silence greater than or equal to three characters.

Principle
The Modbus protocol is a master/slave protocol

Only one device can transmit on the line at any time.

The master manages the exchanges and only it can take the initiative.
It interrogates each of the slaves in succession
No slave can send a message unless it is invited to do so.
The master repeats the question when there is an incorrect exchange, and declares the interrogated slave
absent if no response is received within a given time period.
If a slave does not understand a message, it sends an exception response to the master. The master may
or may not repeat the request.
Direct slave-to-slave communications are not possible.
For slave-to-slave communication, the application software must therefore be designed to interrogate a
slave and send back data received to the other slave.
The 2 types of dialogue are possible between master and slaves:
 The master sends a request to a slave and waits for its response
 The master sends a request to all slaves without waiting for a response (broadcasting principle)

Addresses
Address specification:
 The drive Modbus address can be configured from 1 to 247.
 Address 0 coded in a request sent by the master is reserved for broadcasting. Drives take account of
the request, but do not respond to it.

NVE41308 04/2016 17
Basics

Supported Modbus Functions

Introduction
The drive supports the following Modbus functions:

Function Name Code Description Remarks

Dec. Hex
Read Holding 03 03 hex Read N output words Maximum PDU length: 63
Registers words
Write One Output Word 06 06 hex Write 1 output word −
Write Multiple 16 10 hex Write N output word Maximum PDU length: 61
Registers words
Read/write Multiple 23 17 hex Read/write multiple registers Maximum PDU length: 20
Registers words (W), 20 words (R)
(Subfunction) 43/14 2B hex/ Encapsulated interface −
Read Device 0E hex transport/Read device identification
Identification
Diagnostics 08 08 hex Diagnostics −

Read Holding Registers

Request

Function code 1 byte 03 hex

Starting address 2 bytes 0000 hex...FFFF hex
Quantity of registers 2 bytes 1...63 (3F hex)

Response

Function code 1 byte 03 hex

Byte count 1 byte 2 x N(1)
Register value N(1) x 2 bytes −
(1) N: Quantity of registers

Request

Detected error code 1 byte 83 hex

Exception code 1 bytes 01...04

For example:
This function can be used to read all drive words, both input words and output words.
Request

Slave no. 03 No. of first word No. of words CRC16

Hi Lo Hi Lo Lo Hi
1 byte 1 byte 2 bytes 2 bytes 2 bytes
Hi = high-order byte, Lo = low-order byte.

Response

Slave no. 03 Number of bytes read First word value Last word value CRC16
Hi Lo Hi Lo Lo Hi
1 byte 1 byte 1 byte 2 bytes 2 bytes 2 bytes
Hi = high-order byte, Lo = low-order byte.

18 NVE41308 04/2016
 Basics

For example: read 4 words W3102...W3105 (0C1E...0C21 hex) in slave 2, using function 3, where:
 SFr = Switching frequency = 4 kHz (W3102 = 0028 hex)
 tFr = Maximum output frequency = 60 Hz (W3103 = 0258 hex)
 HSP = High speed = 50 Hz (W3104 = 01F4 hex)
 LSP = Low speed = 0 Hz (W3105 = 0000 hex)

Request

02 03 0C1E 004 276C

Response

02 03 08 0028 0258 01F4 0000 52B0

Value of: − W3102 W3103 W3104 W3105 −
Parameters: − SFr tFr HSP LSP −

Write 1 Output Word

Request

Function code 1 byte 06 hex

Register address 2 bytes 0000 hex...FFFF hex
Register value 2 bytes 0000 hex...FFFF hex

Response

Function code 1 byte 06 hex

Register address 2 bytes 0000 hex...FFFF hex
Register value 2 bytes 0000 hex...FFFF hex

Detected error

Detected error code 1 byte 06 hex

Exception code 1 bytes 01...04

For example
Request and response(the frame format is identical)

Slave no. 06 Word number Value of word CRC16

Hi Lo Hi Lo Lo Hi
1 byte 1 byte 2 bytes 2 bytes 2 bytes

For example: write value 000D hex in word W9001 (2329 hex) in slave 2 (ACC = 1.3 s).

Request and response 02 06 2329 000D 9270

NVE41308 04/2016 19
Basics

Write Multiple Register

Request

Slave no. 10 No. of first word Number of words Number of Value of first word CRC16
bytes
Hi Lo Hi Lo Hi Lo Lo Hi
1 byte 1 byte 2 bytes 2 bytes 1 byte 2 bytes 2 bytes

Response

Slave no. 10 No. of first word No. of words CRC16

Hi Lo Hi Lo Lo Hi
1 byte 1 byte 2 bytes 2 bytes 2 bytes

For example
Write values 20 and 30 to words W9001 and W9002 on slave 2 (acceleration time = 2 s and deceleration
time = 3 s)
Request

Slave Request No. of Number of Number Value of first Value of Second CRC16
no. code first word words of bytes word word
Hi Lo Hi Lo Hi Lo Hi Lo Lo Hi
02 hex 10 hex 23 29 00 hex 02 hex 04 hex 00 hex 14 hex 00 hex 1E hex 73 hex A4 hex
hex hex

Response

Slave no. Response code No. of first word No. of words CRC16
Hi Lo Hi Lo Lo Hi
02 hex 10 hex 23 hex 29 hex 00 hex 02 hex 9B hex B7 hex

Read/Write Multiple Registers

Description Length in Byte Value Comment

Function code 1 17 hex −
Read starting address 2 XXXX hex Always Modbus address
Quantity 2 03 hex Contain number of holding registers to be read
Write starting address 2 XXXX hex Always Modbus address
Quantity 2 03 hex Contain number of holding registers to be written
Write byte count 1 06 hex The byte count specifies the number of bytes to follow in
the field write register value
Write registers value 6 XXXXXX Value to be written respectively in NCA1 to NCA3, so the
XXXXXX h configured
ex For example: CMD, LFRD, CMI

For example

20 NVE41308 04/2016
 Basics

Read Device Identification

The table provides the device identification details:

ID Name / Description Type

00 hex VendorName ASCII String
01 hex ProductCode ASCII String
02 hex MajorMinorRevision ASCII String
03 hex ProductName ASCII String

For example
Default value to be detailed
Request

Slave no. 2B Type of MEI Read Device Id Object Id CRC16

0E 01 00
Lo Hi
1 byte 1 byte 1 byte 1 byte 1 byte 2 bytes

Response

Slave no. 2B Type of MEI Read Device Id Degree of conformity

0E 01 02
1 byte 1 byte 1 byte 1 byte 1 byte

Number of additional frames Next object Id Number of objects

00 00 03
1 byte 1 byte 1 byte

Id of object number 1 Length of object number 1 Value of object number 1

00 12 Schneider Electric
1 byte 1 byte 18 bytes

Id of object number 2 Length of object number 2 Value of object number 2

01 0B ATV320xxxxxx
1 byte 1 byte 11 bytes

Id of object number 2 Length of object number 2 Value of object number 2

02 04 0201
1 byte 1 byte 4 bytes

CRC16
Lo Hi
1 byte 1 byte

The total response size equals 49 bytes

The three objects contained in the response correspond to the following objects:
 Object number 1: Manufacturer name (always Schneider Electric, that is. 18 bytes).
 Object number 2: Device reference (ASCII string; for example, ATV320xxxxxx, that is. 11 bytes).
 Object number 3: Device version, in MMmm format where MM represents the determinant and mm the
subdeterminant (4-bytes ASCII string; for example,: 0201 for version 2.1).
NOTE: The response to function 43 may be negative; in this case, the response located at the top of the
next page is sent by the Drive rather than the response described above.

NVE41308 04/2016 21
Basics

Diagnostics
Subcode 00 hex: Echo
This function asks the slave being interrogated to echo (return) the message sent by the master in its
entirety.
Subcode 0 A hex: Counter reset
This function resets all the counters responsible for monitoring a slave exchanges.
Subcode 0C hex: Read message counter responsible for counting messages received with checksum
errors.
Subcode 0E hex: Read message counter responsible for counting messages addressed to slave. Read a
word indicating the total number of messages addressed to the slave, regardless of type (excluding
broadcast messages).
Request and response

Slave no. 08 Subcode Data CRC16

Hi Lo Hi Lo Lo Hi
1 byte 1 byte 2 bytes N bytes 2 bytes

Subcode Request Data Response Data Function Executed

00 XX YY XX YY Echo
0A 00 00 00 00 Counter reset
0C 00 00 XX YY Read message counter responsible for counting
(= counter value) messages received with checksum errors
0E 00 00 XX YY Read message counter responsible for counting
(= counter value) messages addressed to slave

For example: values 31 hex and 32 hex echoed by slave 4.

Request and response

Slave no. Request code or response Subcode Value of Value of CRC16

code Hi Lo first byte second byte Lo Hi
02 hex 08 hex 00 hex 00 hex 31 hex 32 hex 74 hex 1B hex

22 NVE41308 04/2016