Issue
Troubleshooting modbus TCP communication including scattered read function codes. The scattered holding register read function enables the user to avoid reading a large block of contiguous registers when only few registers are needed and avoid multiple use of functions 3 and 4 in order to read non-contiguous registers
Products
Schneider products that support modbus function code 100 (0x64).
Cause
Function code 100 is not a standard function code so any tools to assist troubleshooting communications will not be able to decode the Modbus request. A scattered read allows reading n non-contiguous registers, where n is between 2 and 100 registers.
Resolution
The data fields inside a modbus TCP client request packet that include a function code 100 are outlined below. The example will request register 29879 (0x74B7) and register 29893 (0x74C5) from modbus device with address 47 (0x2F).
Troubleshooting modbus TCP communication including scattered read function codes. The scattered holding register read function enables the user to avoid reading a large block of contiguous registers when only few registers are needed and avoid multiple use of functions 3 and 4 in order to read non-contiguous registers
Products
Schneider products that support modbus function code 100 (0x64).
Cause
Function code 100 is not a standard function code so any tools to assist troubleshooting communications will not be able to decode the Modbus request. A scattered read allows reading n non-contiguous registers, where n is between 2 and 100 registers.
Resolution
The data fields inside a modbus TCP client request packet that include a function code 100 are outlined below. The example will request register 29879 (0x74B7) and register 29893 (0x74C5) from modbus device with address 47 (0x2F).
| Field name | Example |
|---|---|
| Modbus Device Address | 0x2F |
| Function code | 0x64 |
| Data length in bytes | 0x06 |
| Subfunction code | 0x04 |
| Transmission number(*) | 0xXX |
| First register to read (MSB) | 0x74 |
| First register to read (LSB) | 0xB7 |
| Second register to read (MSB) | 0x74 |
| Second register to read (LSB) | 0xC5 |
| nth register to read (MSB) | N/A |
| nth register to read (LSB) | N/A |
| CRC (MSB) | 0xXX |
| CRC (LSB) | 0xXX |
* note Modbus client will create transmission number, modbus server returns the same number in the reply
Scattered read reply example from modbus TCP device with address 47:
| Field name | Example |
|---|---|
| Modbus Device Address | 0x2F |
| Function code | 0x64 |
| Data length in bytes | 0xXX |
| Subfunction code | 0x04 |
| Transmission number(*) | 0xXX |
| Value of first register to read (MSB) | 0xXX |
| value of first register to read (LSB) | 0xXX |
| Value of second register to read (MSB) | 0xXX |
| Value of second register to read (LSB) | 0xXX |
| nth register to read (MSB) | 0xXX |
| nth register to read (LSB) | 0xXX |
| CRC (MSB) | 0xXX |
| CRC (LSB) | 0xXX |
Released for:Schneider Electric New Zealand
