11. Connection to other devices
11.4 Modbus TCP
a. Byte 0 contains the request's function code
b. The remaining bytes are function-specific
If an error occurs, the Modbus TCP server will send an error message
l Error-Frame
a. Byte 0 always contains the request's error code (0x80 + function code)
b. Byte 1 contains the exception code (error-specific)
Following is a description of the request & response function codes for each of the func-
tion descriptions in the table above:
11.4.2.1 Read Coils 0x01:
This function reads the entered number of bit outputs starting from a specified starting
address and then returns the result in bytes (8 outputs per byte)
Function Code 1 byte 0x01 ;Read Coils
Start address 2 byte Must always be 1 less than the starting output you want
(zero-based)
Number of out-
puts
2 byte 1 to 2000 (0x7D0)
Table 94: Request-PDU
Response to the request being received
1. The starting address is analyzed (distributed among bytes 1 and 2)
a. Byte 1 = Hi; Byte 2 = Lo
2. The number of outputs is analyzed (distributed among bytes 3 and 4)
a. Byte 3 = Hi; Byte 4 = Lo
3. The output states are read
a. From the start of the (starting address) to (starting address + number of
outputs)
Function Code 1 byte 0x01 ;Read Coils
Bye Count 1 byte N
Output values n * 1 byte value
Table 95: Response-PDU
n= Number of outputs read / 8
Preparation for sending the response
1. The read bits are encoded in bytes
(1 but per output state; 1=ON, 0=OFF)
2. The LSB of the first byte, i.e., bit 0, contains the state of the output that is
addressed first in the request. The other outputs follow in ascending order.
easyE4 11/18 MN050009 EN www.eaton.com
547