In CLIENT RTU the Function Codes are not correct impemented

[varionix]

I have a Server which has Funtion Code "Read Holding Registers (0x03, FC3)" implemented. The server has 25 Holdingregisters.
The data Format of each register is a signed 16bit

when i check the Client request it shows :
'Port': Start polling
'IAQ': Tx: 01 04 00 00 00 02 71 CB
'IAQ': Rx: 01 84 01 82 C0
'IAQ': Returned Modbus-exception with code 1

Tx: 01 04 is here the Function Code 0x04 and not how ist should be 0x03 !

i have the test double checked with an other tool QModMaster which gives the right Functioncode and Respond Results

when i check the other Function Codes it seems that they are not correct implemented. Functioncodes do not relay on the modbus registers as stated in modbus description

[serhmarch]

Hello. Item address with left digit 3 (like 300001) is input register, not holding and function number to read is 0x04.
If you want to read holding registers use 4x address (like 400001).

Very similar thread: #5 (comment)

[varionix]

my server handles request by function code 0x03 and then returns the requested amount of registers (startregister - amount)
the registers are defined in an array (c++). when request for function code 3 it looks to the array and returns the requested values (start-amount)

that means your programm adress 3x is not related to function code 3 (read Holding Registers) ?

[serhmarch]

Yes. It is a different thing.

0x,1x,3x,4x are just memory type identifiers notation and those identifiers do not correspond to Modbus function numbers:

• 0x - intended for coils (discrete outputs, boolean), corresponding modern PLC notation is %M or %Q (e.g. 000001 coil in modern notation can be accessed like %M0 or %Q0), can have Read/Write access, corresponding access functions are READ_COILS (which number is 1) and WRITE_MULTIPLE_COILS(15, 0x0F);
• 1x - intended for discrete inputs (boolean), corresponding modern PLC notation is %I (e.g. 100001 boolean in modern notation can be accessed like %I0), has ReadOnly access, corresponding access function is READ_DISCRETE_INPUTS (2);
• 3x - intended for analog inputs (16 bit word), corresponding modern PLC notation is %IW (e.g. 300001 word in modern notation can be accessed like %IW0), has ReadOnly access, corresponding access function is READ_INPUT_REGISTERS(4 (!), yes, it doesn't match with memory type id);
• 4x - intended for holding registers (analog outputs, 16 bit word), corresponding modern PLC notation is %MW (e.g. 400001 word in modern notation can be accessed like %MW0), , can have Read/Write access, corresponding access functions are READ_HOLDING_REGISTERS(3 (!), yes, it doesn't match with memory type id again) and WRITE_MULTIPLE_REGISTERS(16, 0x10);

This is an old notation used since the 1980s by Modicon (now Schneider Electric) in PLC software (e.g. Modsoft and Concept). And the elements use an address number (starts with 1, e.g. 400001, 400000 is incorrect) instead of an offset (starts with 0). But the offset (not the number) of the discrete/register is used to transfer data.

[varionix]

OK Thank you
It works so far

slava ukraine

[serhmarch]

Thx. Glory to heroes