Modbus

Overview

Modbus is a simple communication protocol often used for reporting data from an industrial device to an HMI (see HMI Modbus Communication with AKD) or PLC. Modbus TCP extends the protocol to TCP/IP networks by embedding the same Protocol Data Unit within TCP/IP packets. The AKD supports a Modbus TCP service channel for connections with up to three masters.

Most drive parameters are supported over Modbus TCP (see "Modbus Parameter Table") with the exception of commands which output character strings. For information about the Modbus protocol, see: http://www.Modbus.org/specs.php.

Modbus Installation and Setup

Modbus TCP is provided over the service port on the top of the drive (X11 connector, the connector used for WorkBench). Connect the drive and a device such as an HMI to a working Ethernet network. For ease of testing and configuration, connect a PC running WorkBench to the same network.

After booting, the drive will flash its Ethernet IP address on the front display. The drive can be accessed at this address for Modbus on port 502. WorkBench uses the same address, but a different port number.

Once the devices are connected, the connected device can open a connection to the AKD using these settings:

  • IP Address: read from drive display or WorkBench connect screen
  • Port: 502
  • Add Modbus CRC code: No

Overview of Messaging

All parameters with an internal data width of 32-bit and lower are mapped to Modbus as 32-bit (2 register) values. The contents of both registers must be read or written in the same message, by setting the Starting Address to the lowest index of the parameter and the Quantity of Registers to two.

All parameters with an internal data width of 64-bit are mapped to Modbus as 64-bit (4 register) values. The contents of all four registers must be read or written in the same message by setting the Starting Address to the lowest index of the parameter and the Quantity of Registers to four.

Parameters are scaled as in the Terminal window of WorkBench, but note that floating point values are scaled by an additional factor of 1,000 to retain precision.


  • A read attempt of command or write-only parameters will return a value of zero.

Supported Functions

Two Modbus functions are currently supported:

  • Read Holding Registers. Function code = 0x03 (3).
  • Write Multiple Registers. Function code = 0x10 (16).

To allow only 32-bit and 64-bit access, the quantity of registers is limited to two registers for 32-bit variables and four registers for 64-bit variables. You can also read/write to a single register for certain parameters. Other quantities return an exception response.

Read Holding Registers (0x03)

This function code is used to read all registers of one drive parameter.

Request

Function Code

1 Byte

0x03

Starting Address

2 Bytes

0x0000-0xFFFF (see "Modbus Parameter Table")

Quantity of Registers

2 Bytes

Two 32-bit values or four 64-bit values

Normal Response

Function Code

1 Byte

0x03

Byte Count

1 Byte

2 x N*

Register Value

N* x 2 Bytes

Data

*N = Quantity of Registers

Error Response

Function Code

1 Byte

0x83

Exception Code

1 Byte

See Exception Response Codes

Following is an example of reading the position loop feedback PL.FB at index 588 (0x024C), with an actual value of 0x1 2A05 F200.

Request

Function

03

Starting Address

02 4C

Quantity of Registers

00 04

Response

Function

03

Byte Count

08

Register 588

00 00

Register 589

00 01

Register 590

2A 05

Register 591

F2 00

Write Multiple Registers (0x10)

This function code is used to write all registers of one drive parameter.

Request

Function Code

1 Byte

0x10

Starting Address

2 Bytes

0x0000-0xFFFF (see Modbus index in parameter lists)

Quantity of Registers

2 Bytes

2 (32-bit values) or 4 (64-bit values)

Byte Count

1 Byte

2 x N*

Register Value

N* x 2 Bytes

Data

*N = Quantity of Registers

Normal Response

Function Code

1 Byte

0x10

Starting Address

2 Bytes

0x0000-0xFFFF

Quantity of Registers

2 Bytes

2 or 4

Error Response

Function Code

1 Byte

0x90

Exception Code

1 Byte

See Exception Response Codes

Following is an example of setting the mode of digital input 1 (DIN1.MODE) at index 122 (0x007A) to a value of 3.

Request

Function

10

Starting Address

00 7A

Quantity of Registers

00 02

Byte Count

04

Register 122

00 00

Register 123

00 03

Response

Function

10

Starting Address

00 7A

Quantity of Registers

00 02

Exception Response Codes

Standard Codes

Description Exception Code

Illegal Function

1

Illegal data address

2

Illegal Data Value

3

Slave Device Failure

4

Acknowledge

5

Slave Device Busy

6

Memory Parity Error

8

Gateway Path Unavailable

10

Gateway Target Device Failed To Respond

11

Manufacturer Codes

Description Exception Code

Illegal Block Size (must be two registers for 32-bit and four registers for 64-bit parameters)

32

Unknown Parameter (bad address)

33

Error Processing Command (such as "Data value is greater than maximum")

34

Byte Count field is invalid in request

35

Reading Product Serial Numbers Over Modbus

The following register addresses are used to read a serial number over Modbus.

Description Modbus Register Address Attribute
Amount of registers 6000 16 bit
Characters 1 and 2 6001 16 bit
Characters 3 and 4 6002 16 bit
Characters 5 and 6 6003 16 bit
Characters 7 and 8 6004 16 bit
Characters 9 and 10 6005 16 bit
Characters 11 and 12 6006 16 bit

For example, the product serial number "R-6789-12345" can be read as follows.

Modbus Register Address Value
6000 6
6001 0x522D ("R-")
6002 0x3637 ("67")
6003 0x3839 ("89")
6004 0x2D31 ("-1")
6005 0x3233 ("23")
6006 0x3435 ("45")