(<<YourApp>> Help Index)

Modbus Poll Help Index

Quick Start
 The Grid Window
MODBUS Protocol
Description
 Exceptions

Commands
File menu
Edit menu
Connection menu
Setup menu
Functions menu
Display menu
View menu
Window menu
Help menu

OLE Automation
Overview
Setup Functions
Properties
Write Functions
Excel Example

Test Features
Write Single Coil
Write Single Register
Write Multiple Coils
Write Multiple Registers
Mask Write Register
Read/Write Registers
Data Logging
Test Center
Display Communication

Registration and license information

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Modbus Poll Quick Start

Overview

Modbus Poll uses a multiple windows user interface. That means you can open several windows showing different data areas or data from different slave ID’s at the same time. You can write any text in the Alias cells.
In any dialog box you can press the F1 key for more help on that specific topic.

This picture shows two open windows one reading 10 holding registers from address 0 and one reading 10 holding registers from address 100.

If your slave device allows you to change a Holding register then you double click the cell or just start typing a new value in the cell. Then an edit dialog box is shown.

Change the read/write definition

To change the read/write definition of a window you can press F8 or select “read/write definition” from the Setup menu.

Here you define which data to show in the window. This setup shows how to read 10 Holding Registers from address 0. Address 40001 in some protocol descriptions. Note that Modbus Poll uses Modbus addresses which always counts from 0.

Device and MODBUS address ranges
Device address | MODBUS address | Description | Function | R/W
1...10000* | address - 1 | Coils (outputs) | 01 | Read/Write
10001...20000* | address - 10001 | Discrete Inputs | 02 | Read
40001...50000* | address - 40001 | Holding Registers | 03 | Read/Write
30001...40000* | address - 30001 | Input Registers | 04 | Read
* Maximum value is device dependent. If your protocol specify e.g. address 410501 you should select holding registers and address 10500.

How to make a connection

There is no data to display if you have not made a connection. To do so press F3 or select connect from the connection menu. For more detailed help press F1.

This connection uses a serial port for Modbus RTU communication.

5 different connection types are available however only 2 of them are standard Modbus connections:

  • Serial port
  • Modbus TCP/IP

For serial connection you may need an USB to RS485, or an RS232 to RS485 converter.

More features

  • Log data to a text file

  • Log data directly to Excel sheet

  • View communication traffic

  • Test center for test with custom test strings

  • Display in many formats such as Hex, binary, float etc.

RS 232 DB9 Pinout

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Modifying the Document)

Data Grid

Quick Start
Main Index

If Holding registers (03) or Input registers (04) displayed:
Press F2 to edit or just start typing a new value

If Coils (01) or Discrete inputs (02) are displayed:
Press F2 to edit or just type 0, 1 or space to toggle.

Double click works like F2

05 = Write single coil
06 = Write single register
15 = Write multiple coils
16 = Write multiple registers

The top line shows the number of polls and errors.

Grid features:

  • Cell selection using the mouse, with optional Control and Shift key combinations.
  • Auto row or column sizing when dividers are double-clicked.
  • Individual cells can have separate text and background colors.
  • Individual cells can have separate fonts.
  • Ctrl-C, Ctrl-X and Ctrl-V perform clipboard copy, cut and paste, and Ctrl-A for "Select All"
  • OLE Drag and drop.
  • F2 for edit an alias cell.
  • Shift + F10 = context menu
  • You can't paste to value cells

Hints:

  • Use "Save workspace" (File menu) to Saves a list of the open windows, their sizes and their positions on the screen to a workspace file so that the screen will look the same the next time you open the workspace file.
  • F3 opens the connection dialog.
  • F8 opens the Read/Write definition dialog.

Status line:
The line in read shows status and errors.

Read more here.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


Modbus Decription

Protocol Description

MODBUS® Protocol is a messaging structure, widely used to establish master-slave communication between intelligent devices. A MODBUS message sent from a master to a slave contains the address of the slave, the 'command' (e.g. 'read register' or 'write register'), the data, and a check sum (LRC or CRC).
Since Modbus protocol is just a messaging structure, it is independent of the underlying physical layer. It is traditionally implemented using RS232, RS422, or RS485

The Query
The function code in the query tells the addressed slave device what kind of action to perform. The data bytes contains any additional information that the slave will need to perform the function. For example, function code 03 will query the slave to read holding registers and respond with their contents. The data field must contain the information telling the slave which register to start at and how many registers to read. The error check field provides a method for the slave to validate the integrity of the message contents.

The Response
If the slave makes a normal response, the function code in the response is an echo of the function code in the query. The data bytes contain the data collected by the slave, such as register values or status. If an error occurs, the function code is modified to indicate that the response is an error response, and the data bytes contain a code that describes the error. The error check field allows the master to confirm that the message contents are valid.

Controllers can be setup to communicate on standard Modbus networks using either of two transmission modes: ASCII or RTU.

ASCII Mode
When controllers are setup to communicate on a Modbus network using ASCII (American Standard Code for Information Interchange) mode, each eight-bit byte in a message is sent as two ASCII characters. The main advantage of this mode is that it allows time intervals of up to one second to occur between characters without causing an error.

Coding System
Hexadecimal ASCII printable characters 0 ... 9, A ... F
Bits per Byte
1 start bit
7 data bits, least significant bit sent first
1 bit for even / odd parity-no bit for no parity
1 stop bit if parity is used-2 bits if no parity
Error Checking
Longitudinal Redundancy Check (LRC)

RTU Mode
When controllers are setup to communicate on a Modbus network using RTU (Remote Terminal Unit) mode, each eight-bit byte in a message contains two four-bit hexadecimal characters. The main advantage of this mode is that its greater character density allows better data throughput than ASCII for the same baud rate. Each message must be transmitted in a continuous stream.

Coding System
Eight-bit binary, hexadecimal 0 ... 9, A ... F
Two hexadecimal characters contained in each eight-bit field of the message
Bits per Byte
1 start bit
8 data bits, least significant bit sent first
1 bit for even / odd parity-no bit for no parity
1 stop bit if parity is used-2 bits if no parity
Error Check Field
Cyclical Redundancy Check (CRC)

In ASCII mode, messages start with a colon ( : ) character (ASCII 3A hex), and end with a carriage return-line feed (CRLF) pair (ASCII 0D and 0A hex).
The allowable characters transmitted for all other fields are hexadecimal 0 ... 9, A ... F. Networked devices monitor the network bus continuously for the colon character. When one is received, each device decodes the next field (the address field) to find out if it is the addressed device.
Intervals of up to one second can elapse between characters within the message. If a greater interval occurs, the receiving device assumes an error has occurred. A typical message frame is shown below.

Start | Address | Function | Data | LRC | End
: | 2 Chars | 2 Chars | N Chars | 2 Chars | CR LF

RTU Framing
In RTU mode, messages start with a silent interval of at least 3.5 character times. This is most easily implemented as a multiple of character times at the baud rate that is being used on the network (shown as T1-T2-T3-T4 in the figure below). The first field then transmitted is the device address.
The allowable characters transmitted for all fields are hexadecimal 0 ... 9, A ... F. Networked devices monitor the network bus continuously, including during the silent intervals. When the first field (the address field) is received, each device decodes it to find out if it is the addressed device.
Following the last transmitted character, a similar interval of at least 3.5 character times marks the end of the message. A new message can begin after this interval.
The entire message frame must be transmitted as a continuous stream. If a silent interval of more than 1.5 character times occurs before completion of the frame, the receiving device flushes the incomplete message and assumes that the next byte will be the address field of a new message.
Similarly, if a new message begins earlier than 3.5 character times following a previous message, the receiving device will consider it a continuation of the previous message. This will set an error, as the value in the final CRC field will not be valid for the combined messages. A typical message frame is shown below.

Start | Address | Function | Data | CRC | End
3.5 Char time | 8 Bit | 8 Bit | N * 8Bit | 16 Bit | 3.5 Char time

Address Field
The address field of a message frame contains two characters (ASCII) or eight bits (RTU). The individual slave devices are assigned addresses in the range of 1 ... 247.

Function Field

The Function Code field tells the addressed slave what function to perform.
The following functions are supported by Modbus poll.

01 READ COIL STATUS
02 READ INPUT STATUS
03 READ HOLDING REGISTERS
04 READ INPUT REGISTERS
05 WRITE SINGLE COIL
06 WRITE SINGLE REGISTER
15 WRITE MULTIPLE COILS
16 WRITE MULTIPLE REGISTERS
22 MASK WRITE REGISTER
23 READ/WRITE REGISTERS

The data field contains the requested or send data.

Contents of the Error Checking Field
Two kinds of error-checking methods are used for standard Modbus networks. The error checking field contents depend upon the method that is being used.

ASCII
When ASCII mode is used for character framing, the error-checking field contains two ASCII characters. The error check characters are the result of a Longitudinal Redundancy Check (LRC) calculation that is performed on the message contents, exclusive of the beginning colon and terminating CRLF characters.
The LRC characters are appended to the message as the last field preceding the CRLF characters.
LRC Example Code

RTU
When RTU mode is used for character framing, the error-checking field contains a 16-bit value implemented as two eight-bit bytes. The error check value is the result of a Cyclical Redundancy Check calculation performed on the message contents.
The CRC field is appended to the message as the last field in the message. When this is done, the low-order byte of the field is appended first, followed by the high-order byte. The CRC high-order byte is the last byte to be sent in the message.
CRC Example Code

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Protocol Exceptions

When a master device sends a query to a slave device, it expects a normal response. One of four possible events can occur from the master's query:

If the slave device receives the query without a communication error and can handle the query normally, it returns a normal response.

If the slave does not receive the query due to a communication error, no response is returned. The master program will eventually process a time-out condition for the query.

If the slave receives the query, but detects a communication error (CRC), no response is returned. The master program will eventually process a time-out condition for the query.

If the slave receives the query without a communication error, but cannot handle it (for example if the request is to read a non-existent register), the slave will return an exception response informing the master of the nature of the error.

The exception response message has two fields that differentiate it from a normal response:

Function code field: In a normal response the slave echoes the function code of the original query in the function code field of the response. All function codes have a most-significant bit (MSB) of 0. This makes the function code value in an exception response exactly 80 hexadecimal higher than the value would be for a normal response.

With the function code's MSB set, the master's application program can recognize the exception response and can examine the data field for the exception code.

Data field: In a normal response the slave may return data or statistics in the data field (any information that was requested in the query). In an exception response the slave returns an exception code in the data field. This defines the slave condition that caused the exception.

Query
The master addresses a query to slave device 01h. The function code (03) is for a Read Registers, it requests the status of the register at an address, which is out of range.

Example of a master query and slave exception response:

Name | RTU (hex)
Slave Address | 01
Function | 03
Starting Address HI | 07
Starting Address LO | 03
No of Registers Hi | 00
No of Registers Lo | 02
Error Check Lo | C0
Error Check Hi | 3C

Response

Example of a response to the query:

Field Name | RTU (hex)
Slave Address | 01
Function | 83
Exception Code | 02
Error Check Lo | C0
Error Check Hi | F1

Exception Codes

Code | Field Name | Meaning
01 | Illegal Function | The function code received in the query is not an allowable action for the server (or slave). This may be because the function code is only applicable to newer devices, and was not implemented in the unit selected. It could also indicate that the server (or slave) is in the wrong state to process a request of this type, for example because it is unconfigured and is being asked to return register values.
02 | Illegal Data Address | The data address received in the query is not an allowable address for the server (or slave). More specifically, the combination of reference number and transfer length is invalid. For a controller with 100 registers, a request with offset 96 and length 4 would succeed, a request with offset 96 and length 5 will generate exception 02.
03 | Illegal Data Value | A value contained in the query data field is not an allowable value for server (or slave). This indicates a fault in the structure of the remainder of a complex request, such as that the implied length is incorrect. It specifically does NOT mean that a data item submitted for storage in a register has a value outside the expectation of the application program, since the MODBUS protocol is unaware of the significance of any particular value of any particular register.
04 | Slave Device Failure | An unrecoverable error occurred while the server (or slave) was attempting to perform the requested action.
05 | Acknowledge | Specialized use in conjunction with programming commands. The server (or slave) has accepted the request and is processing it, but a long duration of time will be required to do so. This response is returned to prevent a timeout error from occurring in the client (or master). The client (or master) can next issue a Poll Program Complete message to determine if processing is completed.
06 | Slave Device Busy | Specialized use in conjunction with programming commands. The server (or slave) is engaged in processing a long–duration program command. The client (or master) should retransmit the message later when the server (or slave) is free.
0A | Gateway path unavailable | Specialized use in conjunction with gateways, indicates that the gateway was unable to allocate an internal communication path from the input port to the output port for processing the request.
0B | Gateway target device failed to respond | Specialized use in conjunction with gateways, indicates that no response was obtained from the target device. Usually means that the device is not present on the network.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Function 01 (01hex) Read Coils

Reads the ON/OFF status of discrete coils in the slave.

Request
The request message specifies the starting coil and quantity of coils to be read.

Example of a request to read 10...22 (Coil 11 to 23) from slave device address 4:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 04 | 0 4
Function | 01 | 0 1
Starting Address Hi | 00 | 0 0
Starting Address Lo | 0A | 0 A
Quantity of Coils Hi | 00 | 0 0
Quantity of Coils Lo | 0D | 0 D
Error Check Lo | DD | LRC (E 4)
Error Check Hi | 98 |
Trailer | None | CR LF
Total Bytes | 8 | 17

Response
The coil status response message is packed as one coil per bit of the data field. Status is indicated as: 1 is the value ON, and 0 is the value OFF. The LSB of the first data byte contains the coil addressed in the request. The other coils follow toward the high-order end of this byte and from low order to high order in subsequent bytes. If the returned coil quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeroes (toward the high-order end of the byte). The byte count field specifies the quantity of complete bytes of data.

Example of a response to the request:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 04 | 0 4
Function | 01 | 0 1
Byte Count | 02 | 0 2
Data (Coils 7...10) | 0A | 0 A
Data (Coils 27...20) | 11 | 1 1
Error Check Lo | B3 | LRC (D E)
Error Check Hi | 50 | None
Trailer | None | CR LF
Total Bytes | 7 | 15


(Untitled)

Function 02(02hex) Read Discrete Inputs

Reads the ON/OFF status of discrete inputs in the slave.

Request
The request message specifies the starting input and quantity of inputs to be read.

Example of a request to read 10...22 (input 10011 to 10023) from slave device address 4:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 04 | 0 4
Function | 02 | 0 2
Starting Address Hi | 00 | 0 0
Starting Address Lo | 0A | 0 A
Quantity of inputs Hi | 00 | 0 0
Quantity of inputs Lo | 0D | 0 D
Error Check Lo | 99 | LRC (E 3)
Error Check Hi | 98 |
Trailer | None | CR LF
Total Bytes | 8 | 17

Response
The input status response message is packed as one input per bit of the data field. Status is indicated as: 1 is the value ON, and 0 is the value OFF. The LSB of the first data byte contains the input addressed in the request. The other inputs follow toward the high-order end of this byte and from low order to high order in subsequent bytes. If the returned input quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeroes (toward the high-order end of the byte). The byte count field specifies the quantity of complete bytes of data.

Example of a response to the request:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 04 | 0 4
Function | 02 | 0 2
Byte Count | 02 | 0 2
Data (Inputs 17...10) | 0A | 0 A
Data (Inputs 27...20) | 11 | 1 1
Error Check Lo | B3 | LRC (D D)
Error Check Hi | 14 | None
Trailer | None | CR LF
Total Bytes | 7 | 15


(Untitled)

Function 03 (03hex) Read Holding Registers

Read the binary contents of holding registers in the slave.

Request
The request message specifies the starting register and quantity of registers to be read.

Example of a request to read 0...1 (register 40001 to 40002) from slave device 1:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 01 | 0 1
Function | 03 | 0 3
Starting Address Hi | 00 | 0 0
Starting Address Lo | 00 | 0 0
Quantity of Registers Hi | 00 | 0 0
Quantity of Registers Lo | 02 | 0 2
Error Check Lo | C4 | LRC (F A)
Error Check Hi | 0B |
Trailer | None | CR LF
Total Bytes | 8 | 17

Response
The register data in the response message are packed as two bytes per register, with the binary contents right justified within each byte. For each register the first byte contains the high-order bits, and the second contains the low-order bits.

Example of a response to the request:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 01 | 0 1
Function | 03 | 0 3
Byte Count | 04 | 0 4
Data Hi | 00 | 0 0
Data Lo | 06 | 0 6
Data Hi | 00 | 0 0
Data Lo | 05 | 0 5
Error Check Lo | DA | LRC (E D)
Error Check Hi | 31 | None
Trailer | None | CR LF
Total Bytes | 9 | 19


(Untitled)

Function 04 (04hex) Read Input Registers

Read the binary contents of input registers in the slave.

Request
The request message specifies the starting register and quantity of registers to be read.

Example of a request to read 0...1 (register 30001 to 30002) from slave device 1:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 01 | 0 1
Function | 04 | 0
Starting Address Hi | 00 | 0 0
Starting Address Lo | 00 | 0 0
Quantity of Registers Hi | 00 | 0 0
Quantity of Registers Lo | 02 | 0 2
Error Check Lo | 71 | LRC (F 9)
Error Check Hi | CB |
Trailer | None | CR LF
Total Bytes | 8 | 17

Response
The register data in the response message are packed as two bytes per register, with the binary contents right justified within each byte. For each register the first byte contains the high-order bits, and the second contains the low-order bits.

Example of a response to the request:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 01 | 0 1
Function | 04 | 0 4
Byte Count | 04 | 0 4
Data Hi | 00 | 0 0
Data Lo | 06 | 0 6
Data Hi | 00 | 0 0
Data Lo | 05 | 0 5
Error Check Lo | DB | LRC (E C)
Error Check Hi | 86 | None
Trailer | None | CR LF
Total Bytes | 9 | 19


(Untitled)

Function 05 (05hex) Write Single Coil

Writes a single coil to either ON or OFF.

Request
The request message specifies the coil reference to be written. Coils are addressed starting at zero-coil 1 is addressed as 0.

The requested ON / OFF state is specified by a constant in the request data field. A value of FF 00 hex requests the coil to be ON. A value of 00 00 requests it to be OFF. All other values are illegal and will not affect the coil.

Here is an example of a request to write coil 173 ON in slave device 17:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 11 | 1 1
Function | 05 | 0 5
Coil Address Hi | 00 | 0 0
Coil Address Lo | AC | A C
Write Data Hi | FF | 0 0
Write Data Lo | 00 | F F
Error Check Lo | 4E | LRC (3 F)
Error Check Hi | 8B |
Trailer | None | CR LF
Total Bytes | 8 | 17

Response
The normal response is an echo of the request, returned after the coil state has been written.
Example of a response to the request:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 11 | 1 1
Function | 05 | 0 5
Coil Address Hi | 00 | 0 0
Coil Address Lo | AC | A C
Write Data Hi | FF | 0 0
Write Data Lo | 00 | F F
Error Check Lo | 4E | LRC (3 F)
Error Check Hi | 8B |
Trailer | None | CR LF
Total Bytes | 8 | 17


(Untitled)

Function 06 (06hex) Write Single Register

Writes a value into a single holding register.

Request
The request message specifies the register reference to be Written. Registers are addressed starting at zero-register 1 is addressed as 0.

The requested Write value is specified in the request data field. Here is an example of a request to Write register 40002 to 00 03 hex in slave device 17.

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 11 | 1 1
Function | 06 | 0 6
Register Address Hi | 00 | 0 0
Register Address Lo | 01 | 0 1
Write Data Hi | 00 | 0 0
Write Data Lo | 03 | 0 3
Error Check Lo | 9A | LRC (E 5)
Error Check Hi | 9B |
Trailer | None | CR LF
Total Bytes | 8 | 17

Response
The normal response is an echo of the request, returned after the register contents have been written.

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 11 | 1 1
Function | 06 | 0 6
Coil Address Hi | 00 | 0 0
Coil Address Lo | 01 | 0 1
Write Data Hi | 00 | 0 0
Write Data Lo | 03 | 0 3
Error Check Lo | 9A | LRC (E 5)
Error Check Hi | 9B |
Trailer | None | CR LF
Total Bytes | 8 | 17


(Untitled)

Function 15 (0Fhex) Write Multiple Coils

Writes each coil in a sequence of coils to either ON or OFF.

Request
The request message specifies the coil references to be written. Coils are addressed starting at zero-coil 1 is addressed as 0.

The requested ON / OFF states are specified by contents of the request data field. A logical 1 in a bit position of the field requests the corresponding coils to be ON. A logical 0 requests it to be OFF.

Below is an example of a request to write a series of ten coils starting at coil 20 (addressed as 19, or 13 hex) in slave device 17.

The request data contents are two bytes: CD 01 hex (1100 1101 0000 0001 binary). The binary bits correspond to the coils in the following way:

Bit: 1 1 0 0 1 1 0 1 0 0 0 0 0 0 0 1

Coil: 27 26 25 24 23 22 21 20 - - - - - - 29 28

The first byte transmitted (CD hex) addresses coils 27 ... 20, with the least significant bit addressing the lowest coil (20) in this set.

The next byte transmitted (01 hex) addresses coils 29 and 28, with the least significant bit addressing the lowest coil (28) in this set. Unused bits in the last data byte should be zero-filled.

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 11 | 1 1
Function | 0F | 0 F
Coil Address Hi | 00 | 0 0
Coil Address Lo | 13 | 1 3
Quantity of Coils Hi | 00 | 0 0
Quantity of Coils Lo | 0A | 0 A
Byte Count | 02 | 0 2
Write Data Hi | CD | C D
Write Data Lo | 01 | 0 1
Error Check Lo | BF | LRC (F 3)
Error Check Hi | 0B |
Trailer | None | CR LF
Total Bytes | 11 | 23

Response
The normal response returns the slave address, function code, starting address, and number of coils written. Here is an example of a response to the request shown above

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 11 | 1 1
Function | 0F | 0 F
Coil Address Hi | 00 | 0 0
Coil Address Lo | 13 | 1 3
Quantity of Coils Hi | 00 | 0 0
Quantity of Coils Lo | 0A | 0 A
Error Check Lo | 26 | LRC (C 3)
Error Check Hi | 99 |
Trailer | None | CR LF
Total Bytes | 8 | 17


(Untitled)

Function 16 (10hex) Write Multiple Registers

Writes values into a sequence of holding registers

Request
The request message specifies the register references to be written. Registers are addressed starting at zero-register 1 is addressed as 0.

The requested write values are specified in the request data field. Data is packed as two bytes per register.

Here is an example of a request to write two registers starting at 40002 to 00 0A and 01 02 hex, in slave device 17:

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 11 | 1 1
Function | 10 | 1 0
Starting Address Hi | 00 | 0 0
Starting Address Lo | 01 | 0 1
Quantity of Registers Hi | 00 | 0 0
Quantity of Registers Lo | 02 | 0 2
Byte Count | 04 | 0 4
Data Hi | 00 | 0 0
Data Lo | 0A | 0 A
Data Hi | 01 | 0 1
Data Lo | 02 | 0 2
Error Check Lo | C6 | LRC (C B)
Error Check Hi | F0 |
Trailer | None | CR LF
Total Bytes | 13 | 23

Response
The normal response returns the slave address, function code, starting address, and quantity of registers written. Here is an example of a response to the request shown above.

Field Name | RTU (hex) | ASCII Characters
Header | None | : (Colon)
Slave Address | 11 | 1 1
Function | 10 | 1 0
Starting Address Hi | 00 | 0 0
Starting Address Lo | 01 | 0 1
Quantity of Registers Hi | 00 | 0 0
Quantity of Registers Lo | 02 | 0 2
Error Check Lo | 12 | LRC (D C)
Error Check Hi | 98 |
Trailer | None | CR LF
Total Bytes | 8 | 17


(Untitled)

CRC Example Code

This function is an example how to calculate a CRC word using the C language.

unsigned short CRC16 (const unsigned char *nData, unsigned short wLength)
{
static const unsigned short wCRCTable[] = {
   0X0000, 0XC0C1, 0XC181, 0X0140, 0XC301, 0X03C0, 0X0280, 0XC241,
   0XC601, 0X06C0, 0X0780, 0XC741, 0X0500, 0XC5C1, 0XC481, 0X0440,
   0XCC01, 0X0CC0, 0X0D80, 0XCD41, 0X0F00, 0XCFC1, 0XCE81, 0X0E40,
   0X0A00, 0XCAC1, 0XCB81, 0X0B40, 0XC901, 0X09C0, 0X0880, 0XC841,
   0XD801, 0X18C0, 0X1980, 0XD941, 0X1B00, 0XDBC1, 0XDA81, 0X1A40,
   0X1E00, 0XDEC1, 0XDF81, 0X1F40, 0XDD01, 0X1DC0, 0X1C80, 0XDC41,
   0X1400, 0XD4C1, 0XD581, 0X1540, 0XD701, 0X17C0, 0X1680, 0XD641,
   0XD201, 0X12C0, 0X1380, 0XD341, 0X1100, 0XD1C1, 0XD081, 0X1040,
   0XF001, 0X30C0, 0X3180, 0XF141, 0X3300, 0XF3C1, 0XF281, 0X3240,
   0X3600, 0XF6C1, 0XF781, 0X3740, 0XF501, 0X35C0, 0X3480, 0XF441,
   0X3C00, 0XFCC1, 0XFD81, 0X3D40, 0XFF01, 0X3FC0, 0X3E80, 0XFE41,
   0XFA01, 0X3AC0, 0X3B80, 0XFB41, 0X3900, 0XF9C1, 0XF881, 0X3840,
   0X2800, 0XE8C1, 0XE981, 0X2940, 0XEB01, 0X2BC0, 0X2A80, 0XEA41,
   0XEE01, 0X2EC0, 0X2F80, 0XEF41, 0X2D00, 0XEDC1, 0XEC81, 0X2C40,
   0XE401, 0X24C0, 0X2580, 0XE541, 0X2700, 0XE7C1, 0XE681, 0X2640,
   0X2200, 0XE2C1, 0XE381, 0X2340, 0XE101, 0X21C0, 0X2080, 0XE041,
   0XA001, 0X60C0, 0X6180, 0XA141, 0X6300, 0XA3C1, 0XA281, 0X6240,
   0X6600, 0XA6C1, 0XA781, 0X6740, 0XA501, 0X65C0, 0X6480, 0XA441,
   0X6C00, 0XACC1, 0XAD81, 0X6D40, 0XAF01, 0X6FC0, 0X6E80, 0XAE41,
   0XAA01, 0X6AC0, 0X6B80, 0XAB41, 0X6900, 0XA9C1, 0XA881, 0X6840,
   0X7800, 0XB8C1, 0XB981, 0X7940, 0XBB01, 0X7BC0, 0X7A80, 0XBA41,
   0XBE01, 0X7EC0, 0X7F80, 0XBF41, 0X7D00, 0XBDC1, 0XBC81, 0X7C40,
   0XB401, 0X74C0, 0X7580, 0XB541, 0X7700, 0XB7C1, 0XB681, 0X7640,
   0X7200, 0XB2C1, 0XB381, 0X7340, 0XB101, 0X71C0, 0X7080, 0XB041,
   0X5000, 0X90C1, 0X9181, 0X5140, 0X9301, 0X53C0, 0X5280, 0X9241,
   0X9601, 0X56C0, 0X5780, 0X9741, 0X5500, 0X95C1, 0X9481, 0X5440,
   0X9C01, 0X5CC0, 0X5D80, 0X9D41, 0X5F00, 0X9FC1, 0X9E81, 0X5E40,
   0X5A00, 0X9AC1, 0X9B81, 0X5B40, 0X9901, 0X59C0, 0X5880, 0X9841,
   0X8801, 0X48C0, 0X4980, 0X8941, 0X4B00, 0X8BC1, 0X8A81, 0X4A40,
   0X4E00, 0X8EC1, 0X8F81, 0X4F40, 0X8D01, 0X4DC0, 0X4C80, 0X8C41,
   0X4400, 0X84C1, 0X8581, 0X4540, 0X8701, 0X47C0, 0X4680, 0X8641,
   0X8201, 0X42C0, 0X4380, 0X8341, 0X4100, 0X81C1, 0X8081, 0X4040 };

unsigned char nTemp;
unsigned short wCRCWord = 0xFFFF;

   while (wLength--)
   {
      nTemp = *nData++ ^ wCRCWord;
      wCRCWord >>= 8;
      wCRCWord  ^= wCRCTable[nTemp];
   }
   return wCRCWord;

} // End: CRC16

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

LRC Example Code

This function is an example how to calculate a LRC BYTE using the C language.

BYTE LRC (BYTE *nData, WORD wLength)
{
BYTE nLRC = 0 ; // LRC char initialized

for (int i = 0; i < wLength; i++)
nLRC += *nData++;

return (BYTE)(-nLRC);

} // End: LRC

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(File menu commands)

The File menu offers the following commands:

New | Creates a new document.
Open | Opens an existing document.
Close | Closes an opened document.
Save | Saves an opened document using the same file name.
Save As | Saves an opened document to a specified file name.
Open Workspace | Opens an existing workspace.
Save Workspace | Saves the workspace.
Print | Prints a document.
Print Preview | Displays the document on the screen as it would appear printed.
Print Setup | Selects a printer and printer connection.
Exit | Exits Modbus Poll.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Edit menu commands)

The Edit menu offers the following commands:

Cut | Deletes data from the document and moves it to the clipboard.
Copy | Copies data from the document to the clipboard.
Paste | Pastes data from the clipboard into the document.
Select All | Select all cells

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Connection menu commands

The Connection menu offers the following commands:

Connect (F3) | Select port, baudrate etc.
Disconnect (F4) | Close the port.
Auto Enable | Enable auto connection at startup.
Auto Disable | Disable auto connection at startup.
Quick Connect (F5) | Connect using current settings.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Setup menu commands

The Setup menu offers the following commands:

Read/Write Definition (F8) | Setup Slave ID, Address, Quantity, etc.
Read/Write Once (F6) | If read/write is not enabled, this command issue a single read or write request
Read/Write Enabled (Shift+F6) | Enable Read/Write.
Excel Log | Logs Modbus data to Excel
Excel Logging Off (ALT+Q) | Stop Excel logging.
Log (Alt+L) | Logs the data to a text file.
Logging Off (Alt+O) | Stop text file logging.
Reset Counters (F12) | Reset transmit and error counters.
Reset All Counters (Shift+F12) | Reset transmit and error counters in all windows.
Use as default | Use the current settings as your default next time you run Modbus Poll.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Functions menu commands

The Functions menu offers the following commands:

Write Single Coil (Alt+F5) | Function 05 write single coil
Write Single Register (Alt+F6) | Function 06 write single register
Write Coils (Alt+F7) | Function 15 write multiple coils
Write Registers (Alt+F8) | Function 16 write multiple registers
Report Slave ID | Function 17 report slave ID
Mask Write Register | Function 22 mask write register
Read Write Registers | Function 23 read write multiple registers
Test Center | Show the test center where you can send your own strings.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Display menu commands

The Display menu offers the following commands:

Signed (Alt+Shift+S) | Values are displayed as signed (-32767 to 32768).
Unsigned (Alt+Shift+U) | Values are displayed as unsigned (0 to 65565).
Hex (Alt+Shift+H) | Values are displayed in Hexadecimal, (0000 to FFFF).
Binary (Alt+Shift+B) | Values are displayed as 16 bits.
Long AB CD | Values are displayed as signed long. 2 registers are used.
Long CD AB | Values are displayed as signed long. 2 registers are used. Word swapped.
Long BA DC | Values are displayed as signed long. 2 registers are used. Byte swapped.
Long DC BA | Values are displayed as signed long. 2 registers are used. Byte and word swapped.
Float AB CD | Values are displayed in floating point. 2 registers are used.
Float CD AB | Values are displayed in floating point. 2 registers are used. Word swapped.
Float BA DC | Values are displayed in floating point. 2 registers are used. Byte swapped.
Float DC BA | Values are displayed in floating point. 2 registers are used. Byte and word swapped.
Double AB CD EF GH | Values are displayed in double floating point. 4 registers are used.
Double GH EF CD AB | Values are displayed in double floating point. 4 registers are used. Word swapped.
Double BA DC FE HG | Values are displayed in double floating point. 4 registers are used. Byte swapped.
Double HG FE DC BA | Values are displayed in double floating point. 4 registers are used. Byte and word swapped.
PLC Addresses | Display addresses as a PLC. Eg. Holding registers from 40001.
Protocol addresses | Display addresses as in the protocol definition starting from zero.
Error Counters | Display error counters.
Communication | Display the serial traffic in each direction.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(View menu commands)

The View menu offers the following commands:

Toolbar | Shows or hides the toolbar.
Status Bar | Shows or hides the status bar.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Window menu commands)

The Window menu offers the following commands, which enable you to arrange multiple views of multiple documents in the application window:

Cascade | Arranges windows in an overlapped fashion.
Tile | Arranges windows in non-overlapped tiles.
Arrange Icons | Arranges icons of closed windows.
Window 1, 2, ... | Goes to specified window.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Help menu commands)

The Help menu offers the following commands, which provide you assistance with this application:

Help Topics | Offers you an index to topics on which you can get help.
About | Displays the version number of this application.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Automation Overview

Automation (formerly known as OLE Automation) makes it possible for one application to manipulate objects implemented in another application.

An Automation client is an application that can manipulate exposed objects belonging to another application. This is also called an Automation controller.

An Automation server is an application that exposes programmable objects to other applications. Modbus Poll is an automation server

That means you can use any program that supports VBA (Visual Basic for Applications) such as Visual Basic, Excel etc. to interpret and show the MODBUS data according to your specific requirements.

The VBA links to the mbpoll.tlb file, (Type Library) which is installed in the directory where you installed Modbus Poll. If not registered automatic then use references in the tools menu in Visual Basic and browse for mbpoll.tlb.

Refer to the Excel example
Excel example sheet for additional details.


(Untitled)

Automation Connection Functions

The following properties and functions do the same as you setup in the connection dialog (F3).

Property Connection As Integer
Description
Connection selects the desired connection. A serial port or one of the Ethernet connections can be selected.
Valid values:
0 Serial port
1 Modbus TCP/IP
2 Modbus UDP/IP
3 Modbus ASCII/RTU over TCP/IP
4 Modbus ASCII/RTU over UDP/IP

Property BaudRate As Long
Description
Applicable only for Connection = 0
Valid values:
300
600
1200
2400
4800
9600
14400
19200
38400
56000
57600
115200
128000
256000
Default value = 9600
Example:
BaudRate = 9600

Property DataBits as Integer
Description
Applicable only for Connection = 0
Valid values:
7
8
Default value = 8
Example:
DataBits = 8

Property Parity as Integer
Description
Applicable only for Connection = 0
Valid values:
0 = None
1 = Odd
2 = Even
Default value = 2
Example:
Parity = 2

Property StopBits as Integer
 Description
Applicable only for Connection = 0
Valid values:
1
2
Default value = 1
Example:
StopBits = 1

Property SerialPort as Integer
 Description
Applicable only for Connection = 0
Valid values:
1…255
Default value = 1
Example:
SerialPort = 1

Property ResponseTimeout as Integer
 Description
ResponseTimeout specifies the length of time in ms that Modbus Poll should wait for a response from a slave device before giving up.
Valid values:
50…100000
Default value = 1000
Example:
ResponseTimeout = 1000

Property ServerPort as Long
 Description
Applicable only for Connection = 1...4
Valid values:
0…65535
Default value = 502
Example:
ServerPort = 502

Property ConnectTimeout as Integer
 Description
Specifies the length of time that Modbus Poll should wait for a TCP/IP connection to succeed.
Applicable only for Connection = 1...4
Valid values:
100…30000ms
Default value = 1000ms
Example:
ConnectTimeout = 1000

Property IPVersion as Integer
Valid values:
4 IP Version 4
6 IP Version 6
Default value = 4
Example:
IPVersion = 4

Function OpenConnection() As Integer
 Description
Opens the connection selected with the Connection property.
Return Value
Zero if success. Nonzero value if failed.

Example how to open a Modbus TCP/IP connection:
Public app As Object
Dim res As Integer
‘ Create an object to Modbus Poll
Set app =
CreateObject("Mbpoll.Application")
app.Connection = 1    ' Select Modbus TCP/IP
app.IPVersion = 4
app.IPAddress = “192.168.1.27”
app.ServerPort = 502
app.ConnectTimeout = 1000
app.ResponseTimeout = 1000
res = OpenConnection()

Example how to setup a serial connection:
Public app As Object
Dim status As Integer
‘ Create an object to Modbus Poll
Set app = CreateObject("Mbpoll.Application")

app.Connection = 0               ‘ Mode is serial port
app.SerialPort = 1               ‘ Com port 1
app.BaudRate = 9600              ‘ 9600 baud
app.Parity = 0                   ‘ None parity
app.Mode = 0                     ‘ RTU mode
app.ResponseTimeout = 1000       ‘ Wait 1000ms until give up
status = app.OpenConnection()


(Untitled)

Automation Read Functions

The following functions do the same as you setup in the read/write definition dialog (F8). Read functions are associated with a Modbus Poll document. (The window with data)
Example:

First a Modbus Poll document is needed.
Public doc As Object
Set doc = CreateObject("Mbpoll.Document")
res = doc.ReadCoils(1, 0, 100, 1000) ‘ Read 100 coils every 1000ms

Remarks:
You must create a Read before you can use properties to get data.

Function ReadCoils(SlaveID As Integer, Address As Long, Quantity As Integer, ScanRate As Long) As Integer

Return Value
True if success. False if not success

Parameters
SlaveID, The slave address 1 to 255.
Address, The data address (Base 0)
Quantity, The number of data. 1 to 2000.
ScanRate, 0 to 60000ms

Function ReadDiscreteInputs(SlaveID As Integer, Address As Long, Quantity As Integer, ScanRate As Long) As Integer

Return Value
True if success. False if not success

Parameters
SlaveID, The slave address 1 to 255.
Address, The data address (Base 0)
Quantity, The number of data. 1 to 2000.
ScanRate, 0 to 60000ms

Function ReadHoldingRegisters(SlaveID As Integer, Address As Long, Quantity As Integer, ScanRate As Long) As Integer

Return Value
True if success. False if not success

Parameters
SlaveID, The slave address 1 to 255.
Address, The data address (Base 0)
Quantity, The number of data. 1 to 125.
ScanRate, 0 to 60000ms

Function ReadInputRegisters(SlaveID As Integer, Address As Long, Quantity As Integer, ScanRate As Long) As Integer

Return Value
True if success. False if not success

Parameters
SlaveID, The slave address 1 to 255.
Address, The data address (Base 0)
Quantity, The number of data. 1 to 125.
ScanRate, 0 to 60000ms

Remarks
You have to create a Read before you can use properties to get the returned registers

Sub ShowWindow()
As default Modbus document windows are hidden. The ShowWindow function makes Modbus Poll visible and show the document with data content.

Property ReadResult As Integer
Return Value
Use this property to check if communication established with ReadHoldingRegisters
etc. is running successful.
0 = SUCCESS
1 = TIMEOUT ERROR
2 = CRC ERROR
3 = RESPONSE ERROR (The response was not the expected slave id, function or address)
4 = WRITE ERROR
5 = READ ERROR
6 = PORT NOT OPEN ERROR
10 = DATA UNINITIALIZED
11 = INSUFFICIENT BYTES RECEIVED
81h = ILLEGAL FUNCTION
82h = ILLEGAL DATA ADDRESS
83h = ILLEGAL DATA VALUE
84h = FAILURE IN ASSOCIATED DEVICE
85h = ACKNOWLEDGE
86h = BUSY, REJECTED MESSAGE
87h = NAK-NEGATIVE ACKNOWLEDGMENT

Property WriteResult As Integer
Description
Returns a write result as integer.
Use this function to check if a write was successful. The value is DATA_UNINITIALIZED until the result from the slave is available. See ReadResult for a list of possible values.


(Untitled)

Automation Properties

The below properties are used to set or get values in the internal write/read arrays in Modbus Poll. The Index used is not a Modbus Address. The Index always counts from 0 no matter of the address used. The data properties are associated with a Modbus Poll document. (The window with data)

Example 1:
doc is assumed created first. See Excel example.
doc.SRegisters(0) = 1
doc.SRegisters(1) = 10
doc.SRegisters(2) = 1234
‘Write 3 registers stored in Modbus Poll internal array
‘to Modbus address 100 (40101)
res = doc.WriteMultipleRegisters(1, 100, 3)

Example 2 with floating point values:
doc.Floats(0) = 1.3
doc.Floats(2) = 10.5
doc.Floats(4) = 1234.12
status = doc.WriteMultipleRegisters(1, 0, 6)
‘Write the 6 register stored in Modbus Poll
'6 Registers are written as float is 32 bit wide.

Property Coils(Index As Integer) As Integer
Description
Sets a coil in the write array structure or return a coil from the read array.
Syntax
Object.Coils(Index) [=newvalue]

Property SRegisters(Index As Integer) As Integer
Description
Sets a signed register in the write array structure or return a register from the read array.
Syntax
Object.SRegisters (Index) [=newvalue]

Property URegisters(Index As Integer) As Long
Description
Sets an unsigned register in the write array structure or return a register from the read array.
Syntax
Object.URegisters (Index) [=newvalue]

Property Longs(Index As Integer) As Long
Description
Sets a long in the write array structure or return a long from the read array.
Syntax
Object.Longs (Index) [=newvalue]

Property Floats(Index As Integer) As Single
Description
Sets a float in the write array structure or return a float from the read array.
Syntax
Object.Floats (Index) [=newvalue]

Property Doubles(Index As Integer) As Double
Description
Sets a double in the write array structure or return a double from the read array
Syntax
Object.Doubles (Index) [=newvalue]

Property ByteOrder As Integer
Description
Sets the byte order used by Longs, Floats and Doubles properties.
0 = AB CD (Default)
1 = CD AB
2 = BA DC
3 = DC BA

Example for Longs:

Byte Order: AB CD
The decimal number 123456789 or in hexadecimal 07 5B CD 15
Order as they come over the wire in a Modbus message: 07 5B CD 15

Syntax
Object.ByteOrder [=newvalue]


(Untitled)

Automation Write Functions

The write functions write the values stored in the array filled by the properties. The functions are associated with a Modbus Poll document. (The window with data)

Function WriteSingleCoil(SlaveID As Integer, Address As Long) As Integer

Return Value
True if write array is ready and the data are sent. False if array empty or error in parameters.
The controlling application is responsible for verifying the write operation by reading back the value written.

Parameters
SlaveID, The slave address 0 to 255
Address, The data address (Base 0)
Description
Write the first coil stored in the write array.
Function 05 is used.

Function WriteSingleRegister (SlaveID As Integer, Address As Long) As Integer

Return Value
True if write array is ready and the data are sent. False if array empty or error in parameters.
The controlling application is responsible for verifying the write operation by reading back the value written.

Parameters
SlaveID, The slave address 0 to 255
Address, The data address (Base 0)
Description
Write the first register stored in the write array.
Function 06 is used.

Function WriteMultipleCoils(SlaveID As Integer, Address As Long, Quantity As Integer) As Integer

Return Value
True if write array is ready and the data are sent. False if array empty or error in parameters.
The controlling application is responsible for verifying the write operation by reading back the value written.

Parameters
SlaveID, The slave address 0 to 255
Address, The data address (Base 0)
Quantity, The number of data. 1 to 1968
Description
Write the coils stored in the write array.
Function 15 is used.

Function WriteMultipleRegisters(SlaveID As Integer, Address As Long, Quantity As Integer) As Integer

Return Value
True if write array is ready and the data are sent. False if array empty or error in parameters.
The controlling application is responsible for verifying the write operation by reading back the value written.

Parameters
SlaveID, The slave address 0 to 255
Address, The data address (Base 0)
Quantity, The number of data. 1 to 123
Description
Write the registers stored in the write array.
Function 16 is used.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Automation Excel Example

This example opens two windows. One reading registers and another reading Coils.
Modbus Poll is hidden but you can show it by uncomment the “ShowWindow” line. This will show one of the windows.

An example is also included with the Modbus Poll installation.
Start -> All Programs -> Modbus Poll -> Examples

Public doc1 As Object
Public doc2 As Object
Public app As Object
Dim res As Integer
Dim n As Integer

Private Sub StartModbusPoll_Click()
   Set app = CreateObject("Mbpoll.Application")
   Set doc1 = CreateObject("Mbpoll.Document")
   Set doc2 = CreateObject("Mbpoll.Document")

   ' Read 10 Holding Registers every 1000ms
   res = doc1.ReadHoldingRegisters(1, 0, 10, 1000)
   ' Read 10 Coil Status every 1000ms
   res = doc2.ReadCoils(1, 0, 10, 1000)
   ‘ doc1.ShowWindow()

   app.Connection = 1 ' Modbus TCP/IP
   app.IPAddress = "127.0.0.1" ' local host
   app.ServerPort = 502
   app.ConnectTimeout = 1000
   res = app.OpenConnection()
End Sub

Private Sub Read_Click()
   Cells(5, 7) = doc1.ReadResult() 'Show results for the requests
   Cells(6, 7) = doc2.ReadResult()

   For n = 0 To 9
      Cells(5 + n, 2) = doc1.SRegisters(n)
   Next n

   For n = 0 To 9
      Cells(18 + n, 2) = doc2.Coils(n)
   Next n
End Sub


(Untitled)

Write Single Coil command (Functions menu)

Use this command to write a single coil (Function 05).

If coil status is displayed, you can also double click on an item in order to write a single coil.

Broadcast supported. Slave ID 0.

Shortcuts
Keys: ALT+F5

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Write Single Register command (Functions menu)

Use this command to write a single register (Function 06).

If holding registers are displayed, you can also double click on an item in order to write a single register.

Broadcast supported. Slave ID 0.

Shortcuts
Keys: ALT+F6

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Write Multiple Coils command (Functions menu)

Use this command to write multiple coils (Function 15).

As default the Slave ID, Address and Length are the same as defined for the view window.
With the save button you can save the coil pattern and you can load the coils from a previously saved file.
The file is saved as text format which means it can be edited with notepad.

Broadcast supported. Slave ID 0.

Shortcuts
Keys: ALT+F7

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Write Multiple Registers command (Functions menu)

Use this command to write multiple registers (Function 16).

As default the Slave ID, Address and Length are the same as defined for the view window.
With the save button you can save the registers and you can load the registers from a previously saved file.
The file is saved as text format which means it can be edited with notepad.

To edit a value you can double click the value or you can press edit when the value is selected.

Broadcast supported. Slave ID 0.

Shortcuts
Keys: ALT+F8

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Report Slave ID command (Functions menu)

Use this command to report slave ID (Function 17).

Here is an example to report the ID and status:

Request:

Slave ID | 0x01
Function Code | 0x11
CRC | 0xC0
CRC | 0x2C

Response:

Slave ID | 0x01
Function Code | 0x11
Byte Count | 0x04
Slave ID | 0x02
Run Indicator Status | 0xFF
Additional Data | 0x00
Additional Data | 0x00
CRC | 0xC8
CRC | 0xC9

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Mask Write Register command (Functions menu)

Use this command to mask write register (Function 22).

Broadcast not supported.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Read Write Register command (Functions menu)

Use this command to read write multiple registers (Function 23).

As default the Slave ID, Address and Length are the same as defined for the view window.
With the save button you can save the registers and you can load the registers from a previously saved file.
The file is saved as text format which means it can be edited with notepad.

To edit a value you can double click the value or you can press edit when the value is selected.

Broadcast not supported.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Log command (Setup menu)

Use this command to log the data to a text file. Each Modbus Window logs to its individual text file. When you want to stop the data logging then select the logging off command on the setup menu.

Log Rate:

  • Each read: Write a log line for all Modbus requests. Log frequency as scan rate.
  • Select: Specify the log rate in seconds. Independent of scan rate.
    Remark: If the scan rate is e.g. 10000ms it makes no sense to set a 1 sec log rate as data are logged only when new data are ready.

Delimiters:
As delimiter you can use one of following options:

  • Fixed width: Means that the values are organized in columns.
  • Comma: Values separated by a comma.
  • Tab: Values separated by a tab.

Log if data changed only:
Specify that a new log line is written only if any data is changed since last log.

Log Errors:
Specify that errors such a timeout etc. are logged.

Log Date:
Specify that the current date is added to the log time.

Start Log when ok is pressed:
Specify that logging is started when ok button is pressed. Otherwise the log setup is just stored when *mbp file is saved.

Start Log when *mbp is opened:
Specify that logging is automatically started when a *.mbp file is opened.

Flush to file immediately:
This ensures that log lines are not cashed in the file system but physical written immediately.

Append:
Specify that logs are appended to selected file. Otherwise a new file is created.

Example of a text file with fixed width:

22:28:13 <40001>  17395      0      0      0      0      0      0      0      0
22:28:14 <40001>  17396      1      0      0      0      0      0      0      0
22:28:15 <40001>  17394      1      0      0      2     55      0      0      0
22:28:16 <40001>  13350      1      0      0      4      0      0      0      0

Shortcuts
Keys: Alt+L

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Test Center command (Functions menu)

Use this command to open the test center dialog.

The purpose of this test dialog is to help MODBUS slave device developers to test the device with any string of their own composition.
The list box displays the transmitted data as well as the received data.
You can have several test strings in the pull down list box. When you have entered a string then press the "Add to List" button then the string is added to the list.
The selected string is send when the "Send" button is pressed.
With the "Save list" button you can store the strings in a text file.

Check the "Add Check" check box if you want to add a CRC or LRC to the end of the input string.

ASCII Example:
String in the combo box:
3A 30 31 30 33 30 30 30 30 30 30 30 41

The transmitted string if LRC is added:
3A 30 31 30 33 30 30 30 30 30 30 30 41 46 32 0D 0A
A CR LF pair are also added

TCP/IP Example:
Read 10 holding registers.
00 00 00 00 00 06 01 03 00 00 00 0A

First 6 bytes are the TCP/IP header.

Hints: With a text editor as notepad or similar you can prepare strings to be used in the test.
The first line in the file must be the string ‘Test Center’. This is how Modbus Poll know that the file is the correct format.
Open one window only and uncheck the "Read/Write enable" check box in the definition dialog in order to disable all other communication while using the test center.

Remark: Only added strings are saved. A string in the edit field is not saved if not added to the list.

Use the Copy button to copy selected Tx/Rx strings to the clipboard.
The SHIFT and CTRL keys can be used together with the mouse to select and deselect strings, select groups of strings, and select non-adjacent strings.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Communication command (Display menu)

Use this command to display the traffic on the serial line.

Note:
This window show only data sent and received by Modbus Poll. You can’t use it as a data sniffer.

Stop:
Use the stop button to temporary stop the update of the window in order to look closer to the data or save them to a file in text format.

Copy:
Copy a selected line to the clipboard. Then use ctrl+V to paste it e.g. to the Test Center.

Clear:
Clear the content of the window.

Log:
Log to a file.

Stop on Error:
Stop the update of the window in case an error is detected.

Time Stamp:
Add a time stamp to each line. The resolution of the time stamp is limited to the resolution of the system timer, which is typically in the range of 10 milliseconds to 16 milliseconds.

HINT:
Leave this window open while doing other commands.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Registration and license information

This Software is owned by Witte Software and protected by national copyright laws and international copyright treaties. Modbus Poll is a shareware application which may be distributed to any person for test without charge.
The trial period is limited to 30 days.
All features are enabled during the first 10 minutes after port connection hereafter the port will be disconnected and you have to restart.
When you register you will receive a registration key.

One registered copy of the Software may either be used by a single person who uses the software personally on one or more computers, or installed on a single computer used by multiple people, but not both.

An organization may purchase a multi-user site license amounting to either the number of individuals who have access to the Software on any number of computers, or the number of computers that will access the Software by any number of individuals. A site is defined as all company locations within a 10 mile radius. Site licenses do not cover subsidiary companies, or customers of a company.
For information on quantity pricing and site licenses, please visit http://www.modbustools.com

LIMITED WARRANTY. THE SOFTWARE IS PROVIDED AS IS AND WITTE SOFTWARE DISCLAIMS ALL WARRANTIES RELATING TO THIS SOFTWARE, WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

LIMITATION ON DAMAGES. NEITHER WITTE SOFTWARE NOR ANYONE INVOLVED IN THE CREATION, PRODUCTION, OR DELIVERY OF THIS SOFTWARE SHALL BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, OR INCIDENTAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE SUCH SOFTWARE EVEN IF WITTE SOFTWARE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR CLAIMS. IN NO EVENT SHALL WITTE SOFTWARE’S LIABILITY FOR ANY DAMAGES EXCEED THE PRICE PAID FOR THE LICENSE TO USE THE SOFTWARE, REGARDLESS OF THE FORM OF CLAIM. THE PERSON USING THE SOFTWARE BEARS ALL RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Choose Color Dialog)

Choose Color dialog box

<< Write application-specific help here. >>


(File Open dialog box)

The following options allow you to specify which file to open:

File Name

Specifies the file you want to open. This box lists files with the extension you select in the List Files of Type field.

List Files of Type

Specifies the type of file you want to open:

*.mbp

Drives

Specifies the drive in which Modbus Poll stores the file that you want to open.

Directories

Specifies the directory in which Modbus Poll stores the file that you want to open.

Network

Click this button to connect to a network location, assigning it a new drive letter.


(File Save As dialog box)

The following options allow you to specify the name and location of the file you're about to save:

File Name

Specifies a file name to save a document with a different name. Modbus Poll adds the extension you specify in the Save File As Type box.

Drives

Specifies the drive in which you want to store the document.

Directories

Specifies the directory in which you want to store the document.

Network

Click this button to connect to a network location, assigning it a new drive letter.


(Find Dialog)

Find dialog box

<< Write application-specific help here. >>


(Choose Font Dialog)

Choose Font dialog box

<< Write application-specific help here. >>


(Print dialog box)

The following options allow you to specify how the document should be printed:

Printer

Displays the active printer and printer connection. Choose the Setup option to change the printer and printer connection.

Setup

Displays a Print Setup dialog box, so you can select a printer and printer connection.

Print Range

Specifies the pages you want to print:

All | Prints the entire document.
Selection | Prints the currently selected text.
Pages | Prints the range of pages you specify in the From and To fields.

Copies

Specifies the number of copies you want to print for the above page range.

Collate Copies

Prints copies in page number order, instead of separated multiple copies of each page.

Print Quality

Specifies the quality of the printing. Generally, lower quality printing takes less time to produce.


(Print Progress Dialog)

The Printing dialog box is shown during the time that Modbus Poll is sending output to the printer. The page number indicates the progress of the printing.

To abort printing, choose Cancel.


(Print Setup dialog box)

The following options allow you to select the destination printer and its connection.

Printer

Specifies the printer you want to use. Choose the default printer, or choose the Specific Printer option and select one of the current installed printers shown in the box. You install printers and configure ports using Control Panel.

Orientation

Specifies Portrait or Landscape.

Paper Size

Specifies the size of paper that the document is to be printed on.

Paper Source

Specifies the paper source, because some printers offer multiple trays for different paper sources.

Options

Displays a dialog box where you can make additional choices about printing, specific to the type of printer you have selected.

Network

Click this button to connect to a network location, assigning it a new drive letter.


(No Help Available)

No help is available for this message box.


(Docking Toolbar Area)

This area is provided to contain dockable toolbars, such as the default toolbar created for the application. Docking toolbars can be dragged onto or off this client area, and arrange themselves according to the space available.


(print preview toolbar)

The print preview toolbar offers you the following options:

Print

Opens the Print dialog box to start a print job.

Next Page

Previews the next printed page.

Prev Page

Previews the previous printed page.

One Page / Two Page

Previews one or two printed pages at a time.

Zoom In

Takes a closer look at the printed page.

Zoom Out

Takes a larger look at the printed page.

Close

Returns from print preview to the editing window.


(status bar)

The status bar is displayed at the bottom of the Modbus Poll window. To display or hide the status bar, use the Status Bar command in the View menu.

The left area of the status bar describes actions of menu items as you use the arrow keys to navigate through menus. This area similarly shows messages that describe the actions of toolbar buttons as you press them, before releasing them. If after viewing the description of the toolbar button command you wish not to execute the command, then release the mouse button while the pointer is off the toolbar button.

The right areas of the status bar indicates the connection.


(toolbar)

The toolbar is displayed across the top of the application window, below the menu bar. The toolbar provides quick mouse access to many tools used in Modbus Poll,

To hide or display the toolbar, click Toolbar from the View menu.


(File Exit command)

Exit command (File menu)

Use this command to end your Modbus Poll session. You can also use the Close command on the application Control menu. Modbus Poll prompts you to save documents with unsaved changes.


(Untitled)

Auto disable command (Connection menu)

Use this command to disable auto connection at startup.


(Untitled)

Auto enable command (Connection menu)

Use this command to enable auto connection at startup.


(Untitled)

Connection command (Connection menu)

Use this command to configure the connection.

There are 5 connection types:

  1. Modbus RTU/ASCII:
    Modbus over serial line. RS232 or RS485. A USB serial converter can be used.
  2. Modbus TCP/IP:
    Select TCP/IP if you want to communicate with a MODBUS TCP/IP network. In this case, slave ID is the same as the Unit ID used in MODBUS TCP/IP.
    The port number is default 502.
    Read more here how to setup your network.
    If the connection fails then try if you can ping your device at the command prompt. If the ping command fails then Modbus Poll fails too.
  3. Modbus UDP/IP:
    Select UDP/IP if you want to communicate with a MODBUS UDP/IP network. This is the same as Modbus TCP/IP but the connection less UDP protocol is used instead. (Non-standard)
  4. Modbus RTU/ASCII Over TCP/IP:
    This is a RTU or ASCII message send over a TCP/IP network instead of serial lines. (Non-standard)
  5. Modbus RTU/ASCII Over UDP/IP:
    This is a RTU or ASCII message send over a UDP/IP network instead of serial lines. (Non-standard)

Note: Connection type 3-4 is not standard Modbus as specified by www.modbus.org but they are added for convenience.

Connect Timeout:
Specifies the length of time that Modbus Poll should wait for a TCP/IP connection to succeed.

Response Timeout:
Specifies the length of time that Modbus Poll should wait for a response from a slave device before giving up.

Min Delay between polls:
This setting ensures a minimum delay until next request is transmitted no matter of the scan rate. The resolution of this setting is approximately 15ms. It's possible on some computers to obtain better resolution but not all.
Important: If you set this value lower than 20ms the 3.5 char time gap between response and a new request can not be guaranteed. This is because the Windows scheduler switch task every 10 - 20ms.

  1. If you Polls several slaves in a serial RS485 network you should NOT set the value lower than 20ms. This is to ensure the 3.5 char time gap.
  2. In a TCP/IP network less than 20ms is ok.
  3. Serial connection to only one slave device less than 20ms is ok.

RTS Toggle:
Specifies that the RTS line will be high if bytes are available for transmission. After all buffered bytes have been sent, the RTS line will be low.

You can use this to switch direction if you have a 232/485 converter without automatic direction switch.

Warning:
The use of RTS controlled RS232/RS485 converters should be avoided if possible. It is difficult to determine the exact time when to switch off the transmitter with non real-time operating systems like Windows and Linux. If it is switched off to early characters might still sit in the FIFO or the transmit register of the UART and these characters will be lost. Hence the slave will not recognize the message. On the other hand if it is switched off too late then the slave's message is corrupted and the master will not recognize the message.

DSR:
Specifies whether the DSR (data-set-ready) signal is monitored for output flow control. If this member is TRUE and DSR is turned off, output is suspended until DSR is sent again.

CTS:
Specifies whether the CTS (clear-to-send) signal is monitored for output flow control. If this checkbox is enabled and CTS is turned off, output is suspended until CTS is sent again.

DTR:
Specifies whether the DTR will be enabled or disabled whenever the port is opened.

Remove Echo:
If your device or RS232/RS485 converter echoes the chars just sent.

Shortcuts
Keys: F3

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Disconnection command (Connection menu)

Use this command to close the connection.

Shortcuts
Keys: F4


(Untitled)

Quick Connection command (Connection menu)

Use this command to connect using current settings

Shortcuts
Keys: F5


(Help Using Help Command)

Context Help command

Use this command to obtain help on some portion of Modbus Poll. When you choose the toolbar's Context Help button, the mouse pointer will change to an arrow and question mark. Then click somewhere in the Modbus Poll window, such as another toolbar button. The help topic will be shown for the item you clicked.


(Untitled)

Binary command (Display menu)

Use this command to display data as binary values 0000 1000 1000 0011

Shortcuts
Keys: ALT +Shift+B

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Double command (Display menu)

Use this command to display data in double floating point format. 4 Registers are used.

IEEE 754 specification is used.

Byte Order: A B C D E F G H

The double floating point number 123456789.00 or in hexadecimal 41 9D 6F 34 54 00 00 00

Order as they come over the wire in a Modbus message: 41 9D 6F 34 54 00 00 00

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Double Byte Swapped command (Display menu)

Use this command to display data in double floating point format. 4 Registers are used.

IEEE 754 specification is used.

Byte Order: B A D C F E H G

The double floating point number 123456789.00 or in hexadecimal 41 9D 6F 34 54 00 00 00

Order as they come over the wire in a Modbus message: 9D 41 34 6F 00 54 00 00

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Double Byte and Word Swapped command (Display menu)

Use this command to display data in double floating point format. 4 Registers are used.

IEEE 754 specification is used.

Byte Order: H G F E D C B A

The double floating point number 123456789.00 or in hexadecimal 41 9D 6F 34 54 00 00 00

Order as they come over the wire in a Modbus message: 00 00 00 54 34 6F 9D 41

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Double Word Swapped command (Display menu)

Use this command to display data in double floating point format. 4 Registers are used.

IEEE 754 specification is used.

Byte Order: G H E F C D A B

The double floating point number 123456789.00 or in hexadecimal 41 9D 6F 34 54 00 00 00

Order as they come over the wire in a Modbus message: 00 00 54 00 6F 34 41 9D

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Float command (Display menu)

Use this command to display data in floating point format. 2 Registers are used.

IEEE 754 specification is used.

Byte Order: A B C D

The floating point number 123456.00 or in hexadecimal 47 F1 20 00

Order as they come over the wire in a Modbus message: 47 F1 20 00

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Float Byte Swapped command (Display menu)

Use this command to display data in floating point format. 2 Registers are used.

IEEE 754 specification is used.

Byte Order: B A D C

The floating point number 123456.00 or in hexadecimal 47 F1 20 00

Order as they come over the wire in a Modbus message: F1 47 00 20

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Float Byte and Word Swapped command (Display menu)

Use this command to display data in floating point format. 2 Registers are used.

IEEE 754 specification is used.

Byte Order: D C B A

The floating point number 123456.00 or in hexadecimal 47 F1 20 00

Order as they come over the wire in a Modbus message: 00 20 F1 47

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Float Word Swapped command (Display menu)

Use this command to display data in floating point format. 2 Registers are used.

IEEE 754 specification is used.

Byte Order: C D A B

The floating point number 123456.00 or in hexadecimal 47 F1 20 00

Order as they come over the wire in a Modbus message: 20 00 47 F1

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Hex command (Display menu)

Use this command to display data as HEX values. Range 0 to FFFF.

Shortcuts
Keys: ALT +Shift+H

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Signed Long command (Display menu)

Use this command to display data as signed 32 bit integers. Range -2147483647 to 2147483648.

Byte Order: A B C D

The decimal number 123456789 or in hexadecimal 07 5B CD 15

Order as they come over the wire in a Modbus message: 07 5B CD 15

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Signed Long Byte Swapped command (Display menu)

Use this command to display data as signed 32 bit integers. Range -2147483647 to 2147483648.

Byte Order: B A D C

The decimal number 123456789 or in hexadecimal 07 5B CD 15

Order as they come over the wire in a Modbus message: 5B 07 15 CD

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Signed Long Byte and Word Swapped command (Display menu)

Use this command to display data as signed 32 bit integers. Range -2147483647 to 2147483648.

Byte Order: D C B A

The decimal number 123456789 or in hexadecimal 07 5B CD 15

Order as they come over the wire in a Modbus message: 15 CD 5B 07

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Signed Long Word Swapped command (Display menu)

Use this command to display data as signed 32 bit integers. Range -2147483647 to 2147483648.

Byte Order: C D A B

The decimal number 123456789 or in hexadecimal 07 5B CD 15

Order as they come over the wire in a Modbus message: CD 15 07 5B

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

PLC Addresses command (Display menu)

Use this command to display addresses starting from 40001 if e.g. holding registers are displayed.

Base 1 is used for the address.


(Untitled)

Protocol Addresses command (Display menu)

Use this command to display addresses as in the protocol request and response.

Base 0 is used for the address.

This is convenient when testing the protocol of a slave device as protocol addresses always starts from zero.


(Untitled)

Signed command (Display menu)

Use this command to display data as signed 16 bit integers. Range -32767 to 32768.

Shortcuts
Keys: ALT+Shift+S

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Unsigned command (Display menu)

Use this command to display data as signed 16 bit integers. Range 0 to 65535.

Shortcuts
Keys: ALT +Shift+U

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Copy command (Edit menu))

Use this command to copy selected data onto the clipboard. This command is unavailable if there is no data currently selected.

Copying data to the clipboard replaces the contents previously stored there.


(Cut command (Edit menu))

Use this command to remove the currently selected data from the document and put it on the clipboard. This command is unavailable if there is no data currently selected.

Cutting data to the clipboard replaces the contents previously stored there.


(Paste command (Edit menu))

Use this command to insert a copy of the clipboard contents at the insertion point. This command is unavailable if the clipboard is empty.


(Untitled)

Excel Logging Off command (Setup menu)

Use this command to stop the Excel logging function.

Shortcuts
Keys: Alt+Q

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(File Close command)

Close command (File menu)

Use this command to close all windows containing the active document. Modbus Poll suggests that you save changes to your document before you close it. If you close a document without saving, you lose all changes made since the last time you saved it. Before closing an untitled document, Modbus Poll displays the Save As dialog box and suggests that you name and save the document.


(File 1, 2, 3, 4 command)

1, 2, 3, 4 command (File menu)

Use the numbers and filenames listed at the bottom of the File menu to open the last four documents you closed. Choose the number that corresponds with the document you want to open.


(File New command)

New command (File menu)

Use this command to create a new document in Modbus Poll.

You can open an existing document with the Open command.


(File Open command)

Open command (File menu)

Use this command to open an existing document in a new window. You can open multiple documents at once. Use the Window menu to switch among the multiple open documents. See Window 1, 2, ... command.

You can create new documents with the New command.


(Untitled)

Open Workspace (File menu)

Opens a workspace file with a list of windows so that the screen will look the same as when you saved the workspace file.


(File Print command)

Print command (File menu)

Use this command to print a document. This command presents a Print dialog box, where you may specify the range of pages to be printed, the number of copies, the destination printer, and other printer setup options.


(File Print Preview command)

Print Preview command (File menu)

Use this command to display the active document as it would appear when printed. When you choose this command, the main window will be replaced with a print preview window in which one or two pages will be displayed in their printed format. The print preview toolbar offers you options to view either one or two pages at a time; move back and forth through the document; zoom in and out of pages; and initiate a print job.


(File Print Setup command)

Print Setup command (File menu)

Use this command to select a printer and a printer connection. This command presents a Print Setup dialog box, where you specify the printer and its connection.


(File Save command)

Save command (File menu)

Use this command to save the active document to its current name and directory. When you save a document for the first time, Modbus Poll displays the Save As dialog box so you can name your document. If you want to change the name and directory of an existing document before you save it, choose the Save As command.


(File Save As command)

Save As command (File menu)

Use this command to save and name the active document. Modbus Poll displays the Save As dialog box so you can name your document.

To save a document with its existing name and directory, use the Save command.


(Untitled)

Save Workspace (File menu)

Saves a list of the open windows, their sizes and their positions on the screen to a workspace file so that the screen will look the same the next time you open the workspace file.


(Untitled)

Read/Write Once command (Functions menu)

Use this command to make one request.

“Enable Read/Write” must be disabled in the Read/Write definition dialog box in order to use this function.

Shortcuts
Keys: F6


(Index command (Help menu))

Use this command to display the opening screen of help. From the opening screen, you can jump to step-by-step instructions for using Modbus Poll and various types of reference information.

Once you open help, you can click the Contents button whenever you want to return to the opening screen.


(Using Help command (Help menu))

Use this command for instructions about using help.


(Title Bar)

The title bar is located along the top of a window. It contains the name of the application and document.

To move the window, drag the title bar. Note: You can also move dialog boxes by dragging their title bars.

A title bar may contain the following elements:

Application Control menu button

Document Control menu button

Maximize button

Minimize button

Name of the application

Name of the document

Restore button


(No Help Available)

No help is available for this area of the window.


(Untitled)

Excel Log command (Setup menu)

Use this command to log the data to a Excel spreadsheet. Each Modbus Window logs to its individual Excel spreadsheet. When you want to stop the data logging then select the Excel logging off command on the setup menu.

Log Rate:

  • Each read: Write a log line for all Modbus requests. Log frequency as scan rate.
  • Select: Specify the log rate in seconds. Independent of scan rate.
    Remark: If the scan rate is e.g. 10000ms it makes no sense to set a 1 sec log rate as data are logged only when new data are ready.
  • Stop after: Specify how many rows to log before stop. Note that Excel 2003 is limited to 65,536 rows and Excel 2007 1,048,576 rows.

Shortcuts
Keys: Alt+X

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Logging Off command (Setup menu)

Use this command to stop the logging function.

Shortcuts
Keys: Alt+O

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Close command (Control menus))

Use this command to close the active window or dialog box.

Double-clicking a Control menu box is the same as choosing the Close command.

Note: If you have multiple windows open for a single document, the Close command on the document Control menu closes only one window at a time. You can close all windows at once with the Close command on the File menu.


(Maximize command (System menu))

Use this command to enlarge the active window to fill the available space.


(System Minimize Command)

Minimize command (application Control menu)

Use this command to reduce the Modbus Poll window to an icon.


(Move command (Control menu))

Use this command to display a four-headed arrow so you can move the active window or dialog box with the arrow keys.

Note: This command is unavailable if you maximize the window.


(Next Window command (document Control menu))

Use this command to switch to the next open document window. Modbus Poll determines which window is next according to the order in which you opened the windows.


(Previous Window command (document Control menu))

Use this command to switch to the previous open document window. Modbus Poll determines which window is previous according to the order in which you opened the windows.


(Restore command (Control menu))

Use this command to return the active window to its size and position before you chose the Maximize or Minimize command.


(Size command (System menu))

Use this command to display a four-headed arrow so you can size the active window with the arrow keys.

After the pointer changes to the four-headed arrow:

1.Press one of the direction keys (left, right, up, or down arrow key) to move the pointer to the border you want to move.

2.Press a direction key to move the border.

3.Press ENTER when the window is the size you want.

Note: This command is unavailable if you maximize the window.


(Untitled)

Read/Write Definition command (Setup menu)

Use this command to define the data to be monitored for the active window.
Slave ID:
1 to 255. (MODBUS protocol specification say 247). The value 0 is also accepted to communicate directly to a MODBUS/TCP or MODBUS/UDP devices.

Address:
Addresses in the Modbus protocol are confusing! Modbus Poll use protocol/message address counting from 0 to 65535.

  • Protocol/message address:
    Some protocol specifications use the protocol/message address counting from 0 to 65535 along with a function code. This is also what the new Modbus specifications use. This is the address inside the message sent on the wire.
  • Devcie address:
    Some protocol specifications use device address/registers. Registers counts from 1. The first digit describes the function to be used. That means the device address 40101 is identified by address 100. The “4” means Holding registers and 4x registers counts from 1. And even more confusing: 4x means function code 03 and 3x means function code 04!

5 digits vs. 6 digits addressing:
The address format 4x counts from 40001 to 49999. The next address is not 50000. In old days 9999 addresses was enough. There are cases where 9999 is not enough. Then a zero is added. 40101 become 400101 and so on. This is called 6 digits addressing or extended addressing. This is not a problem with Modbus Poll. 410001 become 10000. The “4” is thrown away and the rest 10001 is decremented by 1 as we count from 0 instead of 1.

Address Examples:
These examples show how to setup Modbus Poll if a specification use device addresses.

  • Read Holding Registers:
    You want to read 20 registers from device address 40011, slave ID 2 every 1000ms. From the “4” we know this is function 03 “Read Holding Registers”.
    - Slave ID = 2
    - Function = ”03 Read Holding Registers (4x)”
    - Address = 10 (11 minus 1)
    - Quantity = 20
    - Scan rate = 1000
  • Read Discrete Inputs:
    You want to read 1000 coils from address 110201, slave ID 5 every 500ms. From the “1” we know this is function 02 “Read Discrete Inputs”
    - Slave ID = 5
    - Function = ”02 Read Discrete Inputs (1x)”
    - Address = 10200 (10201 - 1)
    - Quantity = 1000
    - Scan rate = 500

Address range is 1 to 65535 if PLC Addresses (Base 1) are displayed.
0 to 65535 if Protocol Addresses (Base 0) are displayed.

The quantity depends on the chosen function:
Coils 1 to 2000.
Registers 1 to 125.

Scan Rate:
The scan rate can be set from 0 to 3600000ms. Note that setting the scan rate less than the transaction time makes no sense. If a serial connection at 9600baud is used and 125 registers are requested the transaction time is roughly 8 + 2 + 250 + 2 = 262ms + the gap (>3.5 char time) between the request and the response. In this case setting the scan rate at e.g. 100ms do not make sense as the transaction time is at least 262ms + delay in the slave (gap) + min time between polls. (Set in the connection dialog).

The ‘Read/Write Disabled’ check box can be used to temporary enable or disable the communication for this window.
If 'Read/Write' is disabled you can make requests with the ‘Read/Write Once’ button.

The ‘Disable on error’ check box is used to disable Read/Write in case of error.

The ‘Hide Alias Columns’ is used to hide all alias columns.

'Address in cell' If enabled, the address is also shown in the value cell like: 40001 = 00010

‘Rows’ specify the number of rows in the grid you prefer.

Enron/Daniel:
Enron or Enron/Daniels Modbus is Standard Modbus with a few "Vendor Extensions". The exact impact of these extensions is context dependant, but most common Modbus commands work as expected. There are some custom vendor-defined functions available - but few users expect or use them. The largest impact has to do with how 32-bit data values are read/written.

Enron-Modbus defines two special 4x holding register ranges:

  • 4x5001 to 4x5999 are assumed 32-bit long integers (4-bytes per register).
  • 4x7001 to 4x7999 are assumed 32-bit floating points (4-bytes per register).

Dealing with 32-bit values in Modbus is NOT unique to Enron-MB. However, Enron-MB takes the debatable step of returning 4-bytes per register instead of the 2-bytes implied by the term "holding register" in the Modbus specification. This means a poll of registers 4x5001 and 4x5002 in Enron-Modbus returns 8-bytes or two 32-bit integers, whereas Standard Modbus would only return 4-bytes or one 32-bit integer treated as two 16-bit integers. In addition, polling register 4x5010 in Enron-MB returns the tenth 32-bit long integer, whereas Standard Modbus would consider this 1/2 of the fifth 32-bit long integer in this range.

Shortcuts
Keys: F8

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Read/Write Enabled command (Setup menu)

The ‘Read/Write Disabled’ check box can be used to temporary enable or disable the communication for this window.
If 'Read/Write' is disabled you can make requests with the ‘Read/Write Once’ button.

Shortcuts
Keys: Shift+F6

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Reset Counters command (Setup menu)

Use this command to reset the Tx and error counters.

Shortcuts
Keys: F12

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Reset All Counters command (Setup menu)

Use this command to reset the Tx and error counters in all windows.

Shortcuts
Keys: Shift + F12

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Untitled)

Use as Default command (Setup menu)

Use this command to store the settings of the current window.

Those settings will be used as default next time you open a window.


(View Status Bar Command)

Status Bar command (View menu)

Use this command to display and hide the status bar, which describes the action to be executed by the selected menu item or pressed toolbar button, and keyboard latch state. A checkmark appears next to the menu item when the status bar is displayed.

See Status Bar for help on using the status bar.


(View Toolbar command)

Toolbar command (View menu)

Use this command to display and hide the toolbar, which includes buttons for some of the most common commands in Modbus Poll, such as File Open. A checkmark appears next to the menu item when the toolbar is displayed.

See Toolbar for help on using the toolbar.


(1, 2, ... command (Window menu))

Modbus Poll displays a list of currently open document windows at the bottom of the Window menu. A checkmark appears in front of the document name of the active window. Choose a document from this list to make its window active.


(Window Arrange Icons Command)

Use this command to arrange the icons for minimized windows at the bottom of the main window. If there is an open document window at the bottom of the main window, then some or all of the icons may not be visible because they will be underneath this document window.


(Cascade command (Window menu))

Use this command to arrange multiple opened windows in an overlapped fashion.


(Tile command (Window menu))

Use this command to arrange multiple opened windows in a nonoverlapped fashion.


(Tile Horizontal command (Window menu))

Use this command to vertically arrange multiple opened windows in a nonoverlapped fashion.


(Tile Vertical command (Window menu))

Use this command to arrange multiple opened windows side by side.


(Untitled)

TCP/IP Connection

To make a connection to a MODBUS device, the network settings of the PC have to be modified and disconnected from any other network. The PC can be connected to the MODBUS device by means of a crossed network cable.

If a switch is used the cable don't need to be crossed and no changes should be done on the PC. Consult your system administrator for IP address, subnet mask, etc.

The screen dumps below are based on a Windows XP system, but it will be quite similar when using other Window systems.

Click on 'Start' and select 'Control Panel'

Double click on 'Network Connections'

Double click on 'Local Area Connection'

Click on 'Properties'

Double click on 'Internet Protocol (TCP/IP)'

If the device IP address = 192.168.2.21 then enter 192.168.2.22

Close all dialog boxes.

Now you are ready to enter the IP address in Modbus Poll. If the connection fails then try the 'ping' command at a command prompt.

Click on 'Start' and select run. Type 'cmd' and click ok.

Type 'ping' and the address of the MODBUS device. In this case you see a time-out meaning that a connection is not possible. If 'ping' won't work then Modbus Poll won't work either.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com


(Scroll bars)

Displayed at the right and bottom edges of the document window. The scroll boxes inside the scrollbars indicate your vertical and horizontal location in the document. You can use the mouse to scroll to other parts of the document.


(Modifying the Document)

Status Line

Field name | Meaning
No connection | Either serial or TCP/IP connection is open.
Insufficient bytes received | The expected number of bytes is not received.
Byte count error | The byte count in the response is not correct. Compared to the expected.
Write Error This is an error reported by the serial driver. This could happen if a USB/RS232/485

converter is used and the USB cable is unplugged. There are 4 types:

  • Break condition
  • I/O error
  • Serial connection error
  • Output buffer overflow

Write error using TCP/IP connection is normally caused by lost connection.

Read Error This is an error reported by the serial driver. There are 6 types:
  • Framing error
  • Character buffer overrun
  • Parity error
  • Input buffer overflow
  • I/O error
  • Break condition

Read error using TCP/IP connection is normally caused by lost connection.

Checksum Error | The CRC/LRC value of the received response is not correct.
Timeout Error | The response is not received within the expected time.
Response Error | The response is not the expected one. Different slave ID.
Illegal Function | The function code received in the query is not an allowable action for the server (or slave). This may be because the function code is only applicable to newer devices, and was not implemented in the unit selected. It could also indicate that the server (or slave) is in the wrong state to process a request of this type, for example because it is unconfigured and is being asked to return register values.
Illegal Data Address | The data address received in the query is not an allowable address for the server (or slave). More specifically, the combination of reference number and transfer length is invalid. For a controller with 100 registers, a request with offset 96 and length 4 would succeed, a request with offset 96 and length 5 will generate exception 02.
Illegal Data Value | A value contained in the query data field is not an allowable value for server (or slave). This indicates a fault in the structure of the remainder of a complex request, such as that the implied length is incorrect. It specifically does NOT mean that a data item submitted for storage in a register has a value outside the expectation of the application program, since the MODBUS protocol is unaware of the significance of any particular value of any particular register.
Slave Device Failure

An unrecoverable error occurred while the server (or slave) was attempting to perform the requested action.

Acknowledge

Specialized use in conjunction with programming commands. The server (or slave) has accepted the request and is processing it, but a long duration of time will be required to do so. This response is returned to prevent a timeout error from occurring in the client (or master). The client (or master) can next issue a Poll Program Complete message to determine if processing is completed.

Slave Device Busy

Specialized use in conjunction with programming commands. The server (or slave) is engaged in processing a long–duration program command. The client (or master) should retransmit the message later when the server (or slave) is free.

Gateway path unavailable

Specialized use in conjunction with gateways, indicates that the gateway was unable to allocate an internal communication path from the input port to the output port for processing the request.

Gateway target device failed to respond

Specialized use in conjunction with gateways, indicates that no response was obtained from the target device. Usually means that the device is not present on the network.

Copyright © 2002 - 2015 Witte Software http://www.modbustools.com