I have seen some of the software supporting 30000 as well as 300000 and 40000 as well as 400000. What is the difference between 5-digit addressing and 6-digit addressing? How to take care in device software? I need to address more data.

The following is a typical command for 5 digit addressing.
“01 03 00 00 00 06 C5 C8”

Here I am accessing data from node ‘01’, function code is 03 and data size is 6 bytes. Here the range of data is up to FF FF, that is 65535 in decimal.

In case of 6 digit addressing I can access more data or I can have more data in my product. (Form 400000 to 499999, this means 99999 bytes) how does the modbus support this kind of application?

Thanks & regards
A. N. Muralidhara.

 

>I have seen some of the software supporting 30000 as well as 300000 and 40000 as well as 400000. What is the difference between 5-digit addressing and 6-digit addressing? How to take care in device software? I need to address more data>

There no difference !

Using 5 o 6 digits references is the results of the history : on "antiques" PLCs, the size of the Data Memory was quite small and 5 digits references (i.e. 4 digits range; MSB digit indicating the data type) allowed to discriminate between 0 001 to 9 999 adresses of the same data type.

With further PLCs, data memory had been expanded, and the need for an additional digit came up, allowing to discriminate (theoretically) between 00 001 to 99 999 adresses of the same data type.

So first, just remember that 5 digits or 6 digits is only a mean of representing the manipulated data, seen from the programming device : the MSB digit giving the data type, and the LSB digits giving the position of the target variable on the array holding the data corresponding to this type


>clip>
> In case of 6 digit addressing I can access more data or I can have more data in my product. (Form 400000 to 499999, this means 99999 bytes) how does the modbus support this kind of application?"

(fortunately)despite these data memory size expansions, Modbus protocol address field specification remained the same !

i.e. the address field is a 16 bits field; that allows to discriminate a reference offset range between 0x0000 and 0xFFFF (i.e. 00 001 and 65 535)
(as you said)

Now, in order to get a clear idea of it, try to always figure out what is the modbus frame address field value (i.e. the reference address offset) that will be carried.

E.g. if you specify 40 001 or 400 001 : in both case, this value will be 0x0000
Idem, if you specify 41 024 or 401 024 : in both case, this value will be 0x03FF

Hope this could help
Best regards
Jean-Pierre

 

The 5 and 6 digit addressing refers to the range of references in the device. First of all, the leading digit "0" for an internal coil or discrete output, "1" for a discrete input, 3" for an analog input, and "4" for a holding register or analog output, is NOT PART OF THE ADDRESS. It is a data type, not a number.

For "5 digit" addressing, 40000 to 49999, the actual range is 10,000 0 to 9999). This was the "limit" in the earlier PLCs by Modicon. When the PLCs were changed (memory became smaller and cheaper), the range became 400000 to 4xxxxx. The upper limit was a function of the processor memory. Now the PLC offered far more than 10,000 addressable references so the addressing had to be adjusted.

In the Modbus message "frame" there are four (4) hex values available for the reference address.
0000 hex to FFFF hex, which is 0 to 65535.

When you read 412345, you use Modbus function code 4 (Read Holding Registers) and address 12345.
Since all data addresses are reference to zero, holding register 12345 is addressed as 12344 and will be in the message "frame" as 3038 hex.

 

In regards to the posted notes: how can I reference addresses above 65000 or ffff such as 465000 as there are only 4 hex fields. How can I address 491234 ? or am I limited to 65000?

 

> In regards to the posted notes: how can I reference addresses above 65000 or ffff such as 465000 as there are only 4 hex fields. How can I address 491234 ? or am I limited to 65000?

You are limited to 65,536 words of 4xxxxxx data storage. Thus the LAST data word in a Modicon PLC (and supported by Modbus Protocol) can be 465535 which is read as word FFFF.

It is best to simply think always in terms of the 6 digit reference number. The first digit is always the data type:
0= Coil or user controllable boolean
1= Digital Input or I/O controlled boolean
2= Sequencer reference (not currently in use)
3= 16 bit word input or I/O controlled input word
4= 16 bit word user memory
5= Latch reference (not currently in use)
6= User Data File memory, only on largest model PLCs, this memory is for storage only, it cannot be used within logic instructions (math, logic table etc). Data is copied from this memory to use in 4xxxxx references, and can be writen to from 4xxxx registers.

The other five digits, value 1 to 65535 of a reference number define a memory location. so 450000 is the 50,000th data word location in memory. This is a "human" representation. Computers count 0 to xxxxxx so when requested via Modbus protocol, you must subtract one from the reference number.

Note that the Modbus protocol can handle a much greater range of data than any model Modicon PLC actually supports.
In the first case, if the PLC uses a 16 bit database, it is limited to a 11 bit address field or 0000 to 2047 references. In such systems this means there can be no more than 2048 coils, discrete inputs, input words and holding words (2048 data words in + out,2048 data bits or booleans in+out).
Even in PLCs with 24 bit databases (provides 16 bit data address field) the limit is maximum 8192 digital inputs + maxiumum 9999 coils which is far less than Modbus Protocol may allow.
Finally, the user actually establishes the configuration so even in the case of memory words they may configure less than 65536 data words.

Should you query a slave requesting data outside the range it contains, the slave should respond with an exception code indicating data out of range.

Note that function code 17 allows you to query a plc to get its data configuration... If the host does this each time it comes on-line, it can test outgoing queries to ensure they are witin range...

 

> I have seen some of the software supporting 30000 as well as 300000 and 40000 as well as 400000. What is the difference between 5-digit addressing and 6-digit addressing? How to take care in device software? I need to address more data.
>
> The following is a typical command for 5 digit addressing.
> “01 03 00 00 00 06 C5 C8”
>
> Here I am accessing data from node ‘01’, function code is 03 and data size is 6 bytes. Here the range of data is up to FF FF, that is 65535 in decimal.
>
> In case of 6 digit addressing I can access more data or I can have more data in my product. (Form 400000 to 499999, this means 99999 bytes) how does the modbus support this kind of application?
>
> Thanks & regards
> A. N. Muralidhara.

Sorry to say but your example is in error. The Modbus Query to read data words must use the value 00 03 not 00 06 to read 3 data words. The response will be:
Slave Address, Function code, data byte count (not word) which is probably what is leading you to the wrong query structure.
The master query is a Read Holding Registers request to slave device address 06.
The message requests data from three holding registers, 400108 through 400110.
Here is an example in RTU:
Field Name (Hex) Characters 8–Bit Field

Slave Address: 06
Function Code: 03
Starting Address Hi: 00
Starting Address Lo: 6B
No. of Registers Hi: 00
No. of Registers Lo: 03
Error Check CRC (16 bits/ 2 bytes)
Total Bytes: 8

SAMPLE RESPONSE

Slave Address: 06
Function Code: 03
Byte Count: 06
Data Hi: 02
Data Lo: 2B
Data Hi: 00
Data Lo: 00
Data Hi: 00
Data Lo: 63
Error Check CRC (16 bits/2bytes)
Total Bytes: 11

 

From my experience the x00000 addresses are base 10 and the x0000 addresses are base 16 (hex). The base 10 addresses will only go up to 65535 (zero based) or 65536 (1 based). I still haven't figure out any method to the madness of the address
being 1 or 0 based other than looking at the vendor's documentation. The protocol level is always 0 based. Any 1 based documented addresses need to be converted to 0 based for use in the protocol.

 

While it does allow the addressing of additional registers, I believe the use of 6-digit addressing arose when the Modicon instruction set started using 16 bit math and there was a need to differentiate between something like the number 30001 and the address 30001. Prior to this the largest number allowed was 9999.

 

> In case of 6 digit addressing I can access more data or I can have
> more data in my product. (Form 400000 to 499999, this means 99999
> bytes) how does the modbus support this kind of application?

The Modbus message definition has two bytes in which to store a 16-bit binary data address. The largest value that can be represented as an
unsigned base-2 integer in 16 bits is (2^16)-1 or 65535.

The fact that it takes 5 digits to write the largest 16-bit unsigned binary number doesn't imply that we can store in 16 bits the largest
number that can be written in 5 digits. So the largest holding register address supported by the Modbus protocol is 465535, not 499999.

The 6-digit human-readable representation of a Modbus data address simply allows us to express - in human-readable documentation - the entire range of addresses supported by the protocol.

The 5-digit representation was a convenient shorthand for expressing the entire range of addresses supported by the largest Modicon device
(40001-49999) available once upon a time.

Hope this helps clear things up,

Greg Goodman
Chiron Consulting

 

Greg Goodman wrote:
> The 6-digit human-readable representation of a Modbus data address
> simply allows us to express - in human-readable documentation - the
> entire range of addresses supported by the protocol.
>
> The 5-digit representation was a convenient shorthand for expressing the
> entire range of addresses supported by the largest Modicon device
> (40001-49999) available once upon a time.

Of course, the other way to do this is to say 40000-4FFFF as the address. Yaskawa, for one, does this with their "Memobus" protocol, their name for Modbus extended to the full 16 bit range. As a programmer, I like this myself, but I've seen more than my share of confusion when it comes to hex numbers from my customers, and this discussion has prompted me to, in the future, explicitly specify (or allow the choice) how Modbus address are entered and displayed.

Alex Pavloff
Software Engineer
Eason Technology

 

1 digit.

 

Some vendor’s extensions:
* 32 bit data, so 1 address reads 32 bits.
* IEEE floating point (2 16 bit consecutive addresses. (or one 32 bit-see above)
* 8 bit data (read is 16 (2*8), write forces zero in upper byte).
* mixed data (float, int32, int16, int8, bit8, bit16, ...)
* word swap.
* 16-bit slave address.