MODBUS interface description

General description

Top

Introduction

This document describes the protocol used by the MODBUS server of the module.
The OPEN MODBUS protocol is based on the widely known MODBUS protocol.
OPEN MODBUS is an open protocol and is not manufacturer dependent.
It is mainly used to connect PLC and I/O devices.

Why a MODBUS Server on the MSX-E modules?

Thanks to the MODBUS server, it is possible to manage an MSX-E module with e.g.: a Siemens S7 PLC.
The S7 PLC can start acquisitions and read data from the MSX-E module!

Technical details

Please note that only MODBUS over TCP is standardized. Nonetheless in this present
version the server implements OPEN MODBUS/TCP class 0 and one function of the class 2 even on UDP sockets.

The MODBUS/TCP class 0 defines two types of query: FC3 and FC16.

The MODBUS/TCP server implement the following query of the class 2 : FC23.
The MODBUS server offer a virtual memory organisation: registers (functions)
are mapped to be equivalent to SOAP functions.

Characteristics of this communication channel as the standardisation document describes it are:

The ADDI-DATA MSX-E Modbus server offers the following extension to the standard:

As answer to query a client may receive an acknowledgement (named standard response onward) or an exception.
If an exception or an error occured, you can use the GetLastCommandStatus command to get the real error number (from the remote server).
Real error numbers are described for each command in the "Returns" field.

The chapter below describes the available functions and their parameters.
It also contains the precise description of all frames implied in a given action.

FC3 (read multiple register) Functions

Top

Functions in this group are used to read values on the module.

    Register: 0
    Register: 10000
    Register: 1
    Register: 10200
    Register: 2
    Register: 10500
    Register: 3
    Register: 10550
    Register: 21000
    Register: 21150
    Register: 15000
    Register: 15050
    Register: 15300
    Register: 15450
    Register: 15600
    Register: 15650
    Register: 26000
    Register: 26050
    Register: 26100
    Register: 26150
    Register: 26200
    Register: 26250
    Register: 26300
    Register: 26350
    Register: 37000
    Register: 37100

Function GetLastCommandStatus

For new application(s) or automate communication it is recommended to use the function GetLastCommandStatusEx.

Description

Return the result of the last remote function call

Parameters:

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer00x00000x0000
word count216-bit integer540x36000x0036

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer1120x70000x0070
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count216-bit integer1080x6C000x006C
ReturnValue432-bit integerSee the description above0x????????0x????????
Syserrno432-bit integerSee the description above0x????????0x????????
Errstr1008-bit integer arraySee the description above0x??[100]0x??[100]

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function GetLastCommandStatusEx

Description

Return the result of the last remote function call

Parameters:

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer100000x10270x2710
word count216-bit integer540x36000x0036

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer1110x6F000x006F
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count18-bit integer1080x6C0x6C
ReturnValue432-bit integerSee the description above0x????????0x????????
Syserrno432-bit integerSee the description above0x????????0x????????
Errstr1008-bit integer arraySee the description above0x??[100]0x??[100]

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MXCommon__GetModuleType

For new application(s) or automate communication it is recommended to use the function MXCommon__GetModuleTypeEx.

Description

Returns the type of the MSX-E Module

Parameters:

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer10x01000x0001
word count216-bit integer1000x64000x0064

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer2040xCC000x00CC
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count216-bit integer2000xC8000x00C8
str2008-bit integer arraySee the description above0x??[200]0x??[200]

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MXCommon__GetModuleTypeEx

Description

Returns the type of the MSX-E Module

Parameters:

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer102000xD8270x27D8
word count216-bit integer1000x64000x0064

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer2030xCB000x00CB
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count18-bit integer2000xC80xC8
str2008-bit integer arraySee the description above0x??[200]0x??[200]

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MXCommon__GetTime

For new application(s) or automate communication it is recommended to use the function MXCommon__GetTimeEx.

Description

Get the time on the module

Parameters:

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer20x02000x0002
word count216-bit integer40x04000x0004

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer120x0C000x000C
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count216-bit integer80x08000x0008
tv_sec432-bit integerSee the description above0x????????0x????????
tv_usec432-bit integerSee the description above0x????????0x????????

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MXCommon__GetTimeEx

Description

Get the time on the module

Parameters:

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer105000x04290x2904
word count216-bit integer40x04000x0004

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer110x0B000x000B
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count18-bit integer80x080x08
tv_sec432-bit integerSee the description above0x????????0x????????
tv_usec432-bit integerSee the description above0x????????0x????????

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MXCommon__TestCustomerID

For new application(s) or automate communication it is recommended to use the function MXCommon__TestCustomerIDEx.

Description

Permit to test the Customer ID (if the module has the right customer Key )

Parameters:

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer30x03000x0003
word count216-bit integer160x10000x0010

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer360x24000x0024
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count216-bit integer320x20000x0020
bValueArray168-bit integer arraySee the description above0x??[16]0x??[16]
bCryptedValueArray168-bit integer arraySee the description above0x??[16]0x??[16]

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MXCommon__TestCustomerIDEx

Description

Permit to test the Customer ID (if the module has the right customer Key )

Parameters:

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer105500x36290x2936
word count216-bit integer160x10000x0010

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer350x23000x0023
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count18-bit integer320x200x20
bValueArray168-bit integer arraySee the description above0x??[16]0x??[16]
bCryptedValueArray168-bit integer arraySee the description above0x??[16]0x??[16]

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MSXE3317__PressureGetNumberOfChannels

Description

Return the number of pressure channels.

Parameters:

Returns:

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer210000x08520x5208
word count216-bit integer20x02000x0002

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer70x07000x0007
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count18-bit integer40x040x04
ulNumber432-bit integerSee the description above0x????????0x????????

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MSXE3317__PressureCalibrationGetCurrentStatus

Description

Return the type of the analog input channels

Parameters:

Returns:

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer211500x9E520x529E
word count216-bit integer80x08000x0008

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer190x13000x0013
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count18-bit integer160x100x10
ulStatus432-bit integerSee the description above0x????????0x????????
ulChannel432-bit integerSee the description above0x????????0x????????
fRefValue432-bit floating pointSee the description above0x????????0x????????
ulDigitalValue432-bit integerSee the description above0x????????0x????????

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MSXE3317__AcquisitionGetNumberOfChannels

Description

Return the number of acquisition channels.

Parameters

Returns

Possible return value on the remote system (read them with GetLastCommandStatusEx).

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer150000x983A0x3A98
word count216-bit integer20x02000x0002

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer70x07000x0007
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count18-bit integer40x040x04
ulNumber432-bit integerSee the description above0x????????0x????????

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MSXE3317__AcquisitionGetChannelsInfo

Description

Return the acquisition channels type and hardware position.

Parameters:

Returns

Possible return value on the remote system (read them with GetLastCommandStatusEx).

Query frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer60x06000x0006
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Reference number (=register)216-bit integer150500xCA3A0x3ACA
word count216-bit integer960x60000x0060

Response frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer1950xC3000x00C3
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x030x030x03
Byte count18-bit integer1920xC00xC0
ulType6432-bit integer arraySee the description above0x????????[16]0x????????[16]
ulHwPosition6432-bit integer arraySee the description above0x????????[16]0x????????[16]
ulChannelIndex6432-bit integer arraySee the description above0x????????[16]0x????????[16]

Exception frame layout

FieldSize (Bytes)TypeValuelittle endian (Intel)big endian (Motorola)
transaction identifier216-bit integerUser defined - copied by server - usually 00x00000x0000
protocol identifier216-bit integer00x00000x0000
length216-bit integer30x03000x0003
unit identifier18-bit integer0 or 10x00 or 0x010x00 or 0x01
MODBUS Function code18-bit integer0x830x830x83
Exception code18-bit integerSee corresponding chapter????

Function MSXE3317__AcquisitionAutoRefreshGetValues

Description

Returns the values acquired in auto refresh mode

Parameters: