How to decode modbus Scattered Holding Register Read Function

Issue
Troubleshooting modbus TCP communication including scattered read function codes. The scattered holding register read function enables the user to avoid reading a large block of contiguous registers when only few registers are needed and avoid multiple use of functions 3 and 4 in order to read non-contiguous registers

Products
Schneider products that support modbus function code 100 (0x64).

Cause
Function code 100 is not a standard function code so any tools to assist troubleshooting communications will not be able to decode the Modbus request. A scattered read allows reading n non-contiguous registers, where n is between 2 and 100 registers.

Resolution
The data fields inside a modbus TCP client request packet that include a function code 100 are outlined below. The example will request register 29879 (0x74B7) and register 29893 (0x74C5) from modbus device with address 47 (0x2F).

Field name	Example
Modbus Device Address	0x2F
Function code	0x64
Data length in bytes	0x06
Subfunction code	0x04
Transmission number(*)	0xXX
First register to read (MSB)	0x74
First register to read (LSB)	0xB7
Second register to read (MSB)	0x74
Second register to read (LSB)	0xC5
nth register to read (MSB)	N/A
nth register to read (LSB)	N/A
CRC (MSB)	0xXX
CRC (LSB)	0xXX

* note Modbus client will create transmission number, modbus server returns the same number in the reply

Scattered read reply example from modbus TCP device with address 47:

Field name	Example
Modbus Device Address	0x2F
Function code	0x64
Data length in bytes	0xXX
Subfunction code	0x04
Transmission number(*)	0xXX
Value of first register to read (MSB)	0xXX
value of first register to read (LSB)	0xXX
Value of second register to read (MSB)	0xXX
Value of second register to read (LSB)	0xXX
nth register to read (MSB)	0xXX
nth register to read (LSB)	0xXX
CRC (MSB)	0xXX
CRC (LSB)	0xXX

Released for:Schneider Electric Canada