ModBus: Resource mapping
The ModBus protocol was originally devised for use with Modicon PLCs. Modicon uses an address allocation scheme whereby each resource type (i.e. inputs, memory, outputs etc) is allocated its own address range. Addresses are in decimal, they are 1-based and the ten thousands digit denotes the resource type. Despite the fact that Modicon addresses are 1-based, meaning the first of anything is number 1 rather than number 0, in ModBus messages (datagrams) addresses are 0-based. Also, the ten thousands digit (the resource type designation) is not transmitted on ModBus. Instead, ModBus uses different message types (functions) to specify different types of resources.
With the exception of OBLCD addresses which are supported on both SPLat MODBUS master & slave, all this addressing is for the slave. It provides a mechanism to allow the slave to expose MODBUS items in various formats simply by using unique address ranges.
The following table summarizes the Modicon style resource addressing and how it maps into SPLat resources. You will find this most useful if a device you are using to communicate with SPLat is documented using predominantly Modicon terminology. (The subsequent table couches the same information in more modern computer terms).
As an example, any Modicon reference that has a 0 as its ten thousands digit denotes a "coil". This is called a "0xxxx reference" in Modicon terminology. In Modicon 0xxxx can mean an internal "coil" or an external coil. An internal coil is what we call a semaphore in SPLat, i.e. a 1-bit internal variable. An external coil is what we call an output. To allow you to select between semaphores and outputs at the SPLat end, we assign (map) one block of Modicon "coil" addresses to semaphores and another block to outputs.
Note: If you are using a ModBus compatible product other than Modicon brand (now owned by Schneider Automation), it is very likely that the terminology used is not the same as Modicon. You will have to analyze the manufacturer's documentation to determine their terminology. The best and safest clue is the ModBus function (message) types.
| SPLat resource | ModBus function | Description/clarification | |
|---|---|---|---|
| 00001 to 01000 | Semaphores 0 to 0999 counting from RAM0, bit0 | 1:ReadCoils 5:WriteSingleCoil 15: WriteMultCoils |
ModBus "coil" references map to SPLat digital outputs or semaphores depending on the address supplied by the master. Semaphores are counted from the start of RAM. |
| 01001 to 02000 | Digital outputs 0 to 0999 | ||
| 40001 to 40250 | RAM 0 to 0249 in Word mode with byte addressing. | 3:ReadHReg 4:ReadHRegs 6:WriteHReg 16: WriteMultHregs |
Each word in ModBus maps to two bytes in SPLat. In ModBus the most significant byte appears first (Big Endian). In SPLat the most significant byte is the lowest address. The ModBus address is the byte address. |
| 40257 to 41000 | NVEM2 or NVEM3 if present in Word mode with byte addressing. | Each word in ModBus maps to two bytes in SPLat. In ModBus the most significant byte appears first (Big Endian). In SPLat the most significant byte is the lowest address. The ModBus address is the byte address. In firmware built from 14 April 2022, will read from NVEM2 (if present) or NVEM3 (if present and no NVEM2) with a 0-byte offset (40251 reads from address 250 of NVEM2/3). |
|
| 41001 to 41251 | RAM 0 to 0250 in Byte mode with byte addressing | Each word in ModBus maps to 1 byte in SPLat. The most significant byte of the ModBus word is forced to zero or discarded. In firmware built from 14 April 2022, will read from NVEM2 (if present) or NVEM3 (if present and no NVEM2) with a 0-byte offset (41251 reads from address 250 of NVEM2/3). |
|
| 41257 to 42000 | NVEM2 or NVEM3 if present in Byte mode with byte addressing | Each word in ModBus maps to 1 byte in SPLat. The most significant byte of the ModBus word is forced to zero or discarded. In firmware built from 14 April 2022, will read from NVEM2 (if present) or NVEM3 (if present and no NVEM2) with a 0-byte offset (41251 reads from address 250 of NVEM2/3). |
|
| 43001 to 43125 | RAM 0 to 249 in Word mode with word addressing | Each word in ModBus maps to two bytes in SPLat. In ModBus the most significant byte appears first (Big Endian). In SPLat the most significant byte is the lowest address. The ModBus address is the word address in SPLat RAM. In firmware built from 14 April 2022, will read from NVEM2 (if present) or NVEM3 (if present and no NVEM2) with a 0-byte offset (43126 reads from address 250 of NVEM2/3). |
|
| 43129 to 44000 | NVEM2 or NVEM3 if present in Word mode with word addressing | Each word in ModBus maps to two bytes in SPLat. In ModBus the most significant byte appears first (Big Endian). In SPLat the most significant byte is the lowest address. The ModBus address is the word address in SPLat RAM. In firmware built from 14 April 2022, will read from NVEM2 (if present) or NVEM3 (if present and no NVEM2) with a 0-byte offset (43126 reads from address 250 of NVEM2/3). |
|
| 46001 to 47000 | NVEM1 in Word mode with word addressing | Each word in ModBus maps to two bytes in SPLat. In ModBus the most significant byte appears first (Big Endian). In SPLat the most significant byte is the lowest address. The ModBus address is the word address in SPLat RAM. In firmware built from 14 April 2022, will read from NVEM1. |
|
| 47001 to 48000 | NVEM2 if present in Word mode with word addressing | Each word in ModBus maps to two bytes in SPLat. In ModBus the most significant byte appears first (Big Endian). In SPLat the most significant byte is the lowest address. The ModBus address is the word address in SPLat RAM. In firmware built from 14 April 2022, will read from NVEM2 (if present). |
|
| 48001 to 49000 | NVEM3 if present in Word mode with word addressing | Each word in ModBus maps to two bytes in SPLat. In ModBus the most significant byte appears first (Big Endian). In SPLat the most significant byte is the lowest address. The ModBus address is the word address in SPLat RAM. In firmware built from 14 April 2022, will read from NVEM3 (if present). |
|
| 42001 to 42040 | OBLCD readout | 3: Read Hregs | New in dialect 21 Firmware in standard products. Returns the ASCII character content of the OnBoard LCD display buffer, 2 bytes per word. Only allowed if there is an LCD present - not for touchscreen products. More ... |
| 10001 to 11000 | Input 0000 to 0999, debounced | 2: Read inputs | Master can poll SPLat for debounced inputs |
| 45001 to 46000 | NVEM0 in Word mode with Word addressing | 3: Read Hregs | Available in all 8-bit code. Available in 32-bit code for firmware built from 30 August 2021. |
The 4xxxx references access what Modicon calls Holding Registers. This is a fairly open-ended resource type in Modicon, and is the one that most other vendors use to fulfill their specific needs. You will for example be most likely to see the speed control register of a Variable Speed Drive mapped as a 4xxxx reference. Holding registers in the Modicon world are 16-bits long, corresponding to 2 bytes in SPLat. Because of that we have defined word mode and byte mode mappings. Word mode transfers 2 bytes per holding register. Byte mode transfers 1 byte per holding register. Byte mode wastes message capacity (bandwidth) but lets you read or set individual bytes in SPLat without involving the adjacent byte.
The next table contains the same basic information but re-cast into the actual addresses appearing in the ModBus messages. These addresses are 1 less than the 4 last digits of Modicon reference, because addresses on ModBus are 0-based. We have given both the decimal and the hex versions.
| SPLat resource | Decimal | Hex | ModBus Function | ||||
|---|---|---|---|---|---|---|---|
| From | To | From | To | ||||
| Semaphores 0 to 0999 counting from RAM0, bit0 | 0000 | 0999 | 0000 | 03E7 | 15: Force coils | ||
| Digital outputs 0 to 0999 | 1000 | 1999 | 03E8 | 07CF | |||
| RAM 0 to 0999 in Word mode, Byte addressing. | 0000 | 0999 | 0000 | 03E7 | 16: Preset Hregs | ||
| RAM 0 to 0999 in Byte mode | 1000 | 1999 | 03E8 | 07CF | |||
| RAM 0 to 0999 in Word mode, Word addressing | 3000 | 3999 | 0BB8 | 0F9F | |||
| OBLCD display buffer (Dialect >= 21). Transferred 2 bytes per word. More ... | 2000 | 2039 | 07D0 | 07F7 | 3: Read Hregs | ||
| Inputs | 0000 | 0999 | 0000 | 03E7 | 2: Read inputs | ||
Byte and Word addressing
When accessing SPLat variables in byte mode, the ModBus register equals the SPLat RAM address. For example:
bCounter mEQU 56
bTemperature mEQU 57
This is ModBus register 1056 and 1057, which is Modicon address 41057 & 41058.
The 2 word styles of addressing give two very different results. Word mode with Byte addressing (0000 - 0999), the ModBus register equals the SPLat RAM address, eg:
wCounter mEQU 70,2
wTemperature mEQU 72,2
This is ModBus register 0070 and 0072, which is Modicon address 40071 & 40073. However, notice how the ModBus registers are not consecutive, 0071 is not used. They must skip over the LSB (least significant byte). This can lead to trouble if you try reading address 0071 as you will get a rubbish value derived from both variables. However, if you specify the start address as 70 and read 2 registers, then you'll get the correct result, namely wCounter & wTemperature.
The third method of addressing is Word mode with Word addressing, 3000 - 3999. In this mode SPLat RAM is considered to be 16bits wide, thus ensuring consecutive addressing. Using the same example:
wCounter mEQU 70,2
wTemperature mEQU 72,2
This is now ModBus register 0035 and 0036, which is Modicon address 43036 & 43037. So you halve the SPLat RAM address to get the register address and now they are consecutive, ie 70 / 2 = 0035 and 72 / 2 = 0036.
However this mode does have a restriction. In this mode your SPLat variables MUST lie on even address boundaries. So this is NOT legal, the variable can't be addressed correctly:
wCounter mEQU 81,2 ;ILLEGAL!!