Communication operation and setting

(2) Outline
The Modbus protocol is the communication protocol developed by Modicon for PLC.
The Modbus protocol performs serial communication between the master and slave using the dedicated message
frame. The dedicated message frame has the functions that can perform data read and write. Using the functions,
you can read and write the parameter values from the inverter, write the input command of the inverter, and check
the operating status. In this product, the inverter data are classified in the holding register area (register addresses
40001 to 49999). By accessing the assigned holding register address, the master can communicate with the inverter
which is a slave.
REMARKS
There are two different serial transmission modes: ASCII (American Standard Code for Information Interchange) mode and RTU
(Remote Terminal Unit) mode. This product supports only the RTU mode in which 1-byte (8-bit) data is transmitted as-is.
Only the communication protocol is defined by the Modbus protocol, and the physical layer is not stipulated.

(3) Message format

Query communication
PLC (Master)

Query Message

Inverter (slave)
Broadcast communication
PLC (Master)

Inverter response time

(Refer to the following table for the
data check time)

Data absence time Response Message

(3.5 bytes or more)

Query Message
No Response

Inverter (slave)
Data check time

Item
Various monitors, operation command,
frequency setting (RAM)
Parameter read/write, frequency
setting (EEPROM)
Parameter clear/all clear
Reset command

Check Time
< 12ms
< 30ms
< 5s
No answer

1) Query
The master sends a message to the slave (= inverter) at the specified address.
2) Normal Response
After receiving the query from the master, the slave executes the requested function and returns the corresponding
normal response to the master.
3) Error Response
If an invalid function code, address or data is received, the slave returns it to the master.
When a response description is returned, the error code indicating that the request from the master cannot be
executed is added.
No response is returned for the hardware-detected error, frame error and CRC check error.
4) Broadcast
By specifying address 0, the master can send a message to all slaves. All slaves that received the message from the
master execute the requested function. In this communication, the slaves do not return a response to the master.
REMARKS
The slave executes the function independently of the inverter station number setting (Pr. 331) during broadcast communication.

328

Communication operation and setting

(4) Message frame (protocol)
Communication method
Basically, the master sends a query message (question) and the slave returns a response message
(response). When communication is normal, Device Address and Function Code are copied as they are, and
when communication is abnormal (function code or data code is illegal), bit 7 (= 80h) of Function Code is
turned on and the error code is set to Data Bytes.
Query message from Master
Device Address
Function Code

Device Address
Function Code

Eight-Bit
Data Bytes

Eight-Bit
Data Bytes

Error Check

Error Check
Response message from slave

The message frame consists of the four message fields as shown above.
By adding the no-data time (T1: Start, End) of 3.5 characters to the beginning and end of the message data,
the slave recognizes it as one message.
Protocol details
The four message fields will be explained below.
Start

1) ADDRESS

2) FUNCTION

T1

8bit

3) DATA

8bit

Message Field

T1

Description
The address is 1 byte long (8 bits) and any of 0 to 247 can be set. Set 0 to send a broadcast
message (all-address instruction) or any of 1 to 247 to send a message to each slave.
When the slave responds, it returns the address set from the master.
The value set to Pr. 331 RS-485 communication station number is the slave address.
The function code is 1 byte long (8 bits) and any of 1 to 255 can be set. The master sets the
function that it wants to request from the slave, and the slave performs the requested
operation. The following table gives the supported function codes. An error response is
returned if the set function code is other than those in the following table.
When the slave returns a normal response, it returns the function code set by the master.
When the slave returns an error response, it returns H80 + function code.

Code
2) FUNCTION field

End

H03
H06
H08
H10
H46

Function Name

Outline

Read Holding Register

Preset Single Register

Reads the holding register data.

Writes data to the holding register.
Makes a function diagnosis.
Diagnostics
(communication check only)
Writes data to multiple consecutive
Preset Multiple Registers
holding registers.
Reads the number of registers that
Read Holding Register
succeeded in communication last
Access Log
time.

Broadcast
Communication
Disallowed
Allowed
Disallowed
Allowed

Disallowed

Table 1: Function code list

3) DATA field

4) CRC CHECK field

The format changes depending on the function code (refer to page 330). Data includes the byte
count, number of bytes, description of access to the holding register, etc.
The received message frame is checked for error. CRC check is performed, and 2 byte long
data is added to the end of the message. When CRC is added to the message, the low-order
byte is added first and is followed by the high-order byte.
The CRC value is calculated by the sending side that adds CRC to the message. The receiving
side recalculates CRC during message receiving, and compares the result of that calculation
and the actual value received in the CRC CHECK field. If these two values do not match, the
result is defined as error.

329

PARAMETERS

1) ADDRESS field

8bit

4) CRC CHECK
L
H
8bit
8bit