Supported Diagnostic Codes

Modbus function code 3 provides access to a variety of diagnostic functions, including basic network diagnostics, Ethernet port diagnostics, and Modbus port 502 diagnostics.

To access the function code 3 diagnostics from the local device, set the unit ID to 100.

The following modules support these Modbus diagnostic codes.

  • Quantum remote I/O head module (140CRP31200)

  • Quantum distributed I/O head module (140NOC78000)

  • Quantum control head module (140NOC78100)

  • Quantum remote I/O adapter module (140CRA31200)

  • M340 distributed I/O head module (BMXNOC0401)

  • M340 remote I/O adapter module (BMXCRA31200)

  • Quantum IEC 61850 module (140NOP85000)

  • M580 communications module (BMENOC03•1)

  • M580 communications module (BMENOP0300)

Modbus Function Code 3: Basic Network Diagnostics

Basic network diagnostics start at address 40001(decimal) as described in the following table.

Starting Address (Decimal)

Length (Words)

Register Byte Order

Comments

MS BYTE

LS BYTE

40001

2

MS Byte 00

Byte 01

Basic network diagnostic validity

Byte 02

LS Byte

40003

1

MS Byte

LS Byte 03

Communication global status

40004

1

MS Byte

LS Byte

Supported communication services

40005

1

MS Byte

LS Byte

Status of communication services

40006

2

IP 1

IP 2

IP address (IP1.IP2.IP3.IP4)

IP 3

IP 4

40008

2

SM 1

SM 2

Subnet mask (SM1.SM2.SM3.SM4)

SM 3

SM 4

40010

2

GW 1

GW 2

Default gateway (GW1.GW2.GW3.GW4)

GW 3

GW 4

40012

3

MAC 1

MAC 2

MAC address (MAC1:MAC2:MAC3:MAC4:MAC5:MAC6.

MAC 3

MAC 4

MAC 5

MAC 6

40015

3

MS Byte 00

01

Ether frame format capability / configuration / operational

02

03

04

LS Byte 05

40018

2

C00

C01

Ethernet receive frames OK

C02

C03

40020

2

C00

C01

Ethernet transmit frames OK

C02

C03

40022

1

MS Byte

LS Byte

Number of open client connections

40023

1

MS Byte

LS Byte

Number of open server connections

40024

2

C00

C01

Number of Modbus detected error messages sent

C02

C03

40026

2

C00

C01

Number of Modbus messages sent

C02

C03

40028

2

C00

C01

Number of Modbus messages received

C02

C03

40030

8

Char 1

Char 2

Device name

Char 3

Char 4

Char 5

Char 6

Char 7

Char 8

Char 9

Char 10

Char 11

Char 12

Char 13

Char 14

Char 15

Char 16

40038

2

MS Byte 00

Byte 01

IP assignment mode capability / operational

Byte 02

LS Byte 03

Example: Reading Basic Network Diagnostics with Modbus Function Code 3

Here is an example of how to read registers 40018 and 40019, the Ethernet receive frames OK count registers. The request contains 7 bytes. The starting address, shown as a hex value in byte 2 below, is calculated as follows:

40018 – 40001 = 17 dec = (11 hex)

The number of registers to be diagnosed (2 hex) is shown in byte 4:

Byte Number

Value

0

Function code = 03 (hex)

1

Starting Address Hi = 00 (hex)

2

Starting Address Low = 11 (hex)

3

No. of Registers Hi = 00 (hex)

4

No. of Registers Low = 2 (hex)

5

CRC high byte (inserted by the Modbus sending application)

6

CRC low byte (inserted by the Modbus sending application)

The normal response is returned in 8 bytes. In this example, the expected response is 14229 hex; this value is shown in bytes 2 through 5 of the response:

Byte Number

Value

0

Function code = 03 (hex)

1

Byte count = 4 (hex)

2

1st register data, high byte = 00 (hex)

3

1st register data, low byte = 01 (01 hex)

4

2nd register data, high byte = 42 (hex)

5

2nd register data, low byte = 29 (hex)

6

CRC high byte

7

CRC low byte

Byte Number

Value

0

Original function code + 80 hex (= 83 hex)

1

Detected error code

2

CRC high byte

3

CRC low byte

For more information on Modbus function code 3 and other function codes, refer to the Modicon Modbus Protocol Reference Guide (PI-MBUS-300).

Modbus Function Code 3: Ethernet Internal Port Diagnostic Data

Internal port diagnostics start at address 40040 (decimal) as described in the following table.

Starting Address (Decimal)

Length (Words)

Register Byte Order

Comments

MS BYTE

LS BYTE

40040

1

MS Byte

LS Byte

Internal port Diagnostics Data Validity

40041

1

MS Byte

LS Byte

Internal port Logical/Physical Port Number

40042

1

MS Byte

LS Byte

Internal port Ethernet Control Capability

40043

1

MS Byte

LS Byte

Internal port Link Speed Capability

40044

1

MS Byte

LS Byte

Internal port Ethernet Control Configuration

40045

1

MS Byte

LS Byte

Internal port Link Speed Configuration

40046

1

MS Byte

LS Byte

Internal port Ethernet Control Operational

40047

1

MS Byte

LS Byte

Internal port Link Speed Operational

40048

3

MAC 1

MAC 2

MAC Address (MAC1:MAC2:MAC3:MAC4:MAC5:MAC6)

MAC 3

MAC 4

MAC 5

MAC 6

40051

2

MSB C00

C01

Internal port Media Counters Data Validity

C02

LSB C03

40053

2

MSB C00

C01

Internal port Num Frames Transmitted OK

C02

LSB C03

40055

2

MSB C00

C01

Internal port Num Frames Received OK

C02

LSB C03

40057

2

MSB C00

C01

Internal port Num Ether Collisions

C02

LSB C03

40059

2

MSB C00

C01

Internal port Carrier Sense Errors detected

C02

LSB C03

40061

2

MSB C00

C01

Internal port Num Ether Excessive Collisions

C02

LSB C03

40063

2

MSB C00

C01

Internal port CRC Errors detected

C02

LSB C03

40065

2

MSB C00

C01

Internal port FCS Errors detected

C02

LSB C03

40067

2

MSB C00

C01

Internal port Alignment Errors detected

C02

LSB C03

40069

2

MSB C00

C01

Internal port Num Internal MAC Tx Errors detected

C02

LSB C03

40071

2

MSB C00

C01

Internal port Late Collisions

C02

LSB C03

40073

2

MSB C00

C01

Internal port Num Internal MAC Rx Errors detected

C02

LSB C03

40075

2

MSB C00

C01

Internal port Multiple Collisions

C02

LSB C03

40077

2

MSB C00

C01

Internal port Single Collisions

C02

LSB C03

40079

2

MSB C00

C01

Internal port Deferred Transmissions

C02

LSB C03

40081

2

MSB C00

C01

Internal port Frames Too Long

C02

LSB C03

40083

2

MSB C00

C01

Internal port Frames Too Short

C02

LSB C03

40085

2

MSB C00

C01

Internal port SQE Test Error detected

C02

LSB C03

40087

1

MS Byte

LS Byte

Internal port Interface Label Length

40088

32

IL char64

IL char63

Internal port Interface Label characters

40089

IL char62

IL char61

...

...

...

40118

IL char04

IL char03

40119

IL char02

IL char01

40120

1

MS Byte

LS Byte

Internal port Interface Counters Diagnostic Validity

40121

2

MSB C00

C01

Internal port Num Octets Received

C02

LSB C03

40123

2

MSB C00

C01

Internal port Num Unicast Packets Received

C02

LSB C03

40125

2

MSB C00

C01

Internal port Num Non Unicast Packets Received

C02

LSB C03

40127

2

MSB C00

C01

Internal port Num Inbound Packets Discarded

C02

LSB C03

40129

2

MSB C00

C01

Internal port Num Inbound Packets Error detected
 

C02

LSB C03

401331

2

MSB C00

C01

Internal port Num Inbound Packets Unknown

C02

LSB C03

40133

2

MSB C00

C01

Internal port Num Octets Sent

C02

LSB C03

40135

2

MSB C00

C01

Internal port Num Unicast Packets Sent

C02

LSB C03

40137

2

MSB C00

C01

Internal port Num Non Unicast Packets Sent

C02

LSB C03

40139

2

MSB C00

C01

Internal port Num Outbound Packets Discarded

C02

LSB C03

40141

2

MSB C00

C01

Internal port Num Outbound Packets Error detected

C02

LSB C03

Modbus Function Code 3: Ethernet Port 1 Diagnostic Data

Port 1 diagnostics start at address 40143 (decimal). As described in the following table, port 1 diagnostic data fields are the same as for the internal port, with the appropriate starting address offset.

Starting Address

Length

Register Byte Order

Comments

MS BYTE

LS BYTE

40143

1

MS Byte

LS Byte

Port 1 Port Diagnostics Data Validity

...

...

...

...

...

40244

2

MSB C00

C01

Port 1 Num Outbound Packets Error detected

C02

LSB C02

Modbus Function Code 3: Ethernet Backplane Port Diagnostic Data

Backplane port diagnostics start at address 40246 (decimal). As described in the following table, backplane port diagnostic data fields are the same as for the internal port and port 1, with the appropriate starting address offset.

Starting Address

Length

Register Byte Order

Comments

MS BYTE

LS BYTE

40246

1

MS Byte

LS Byte

Backplane Port Diagnostics Data Validity

...

...

...

...

...

40347

2

MSB C00

C01

Backplane Port Num Outbound Packets Error detected

C02

LSB C02

Modbus Function Code 3: Ethernet Port 3 Diagnostic Data

Port 3 diagnostics start at address 40349 (decimal). As described in the following table, port 3 diagnostic data fields are the same as for the internal port and ports 1 and 2, with the appropriate starting address offset.

Starting Address

Length

Register Byte Order

Comments

MS BYTE

LS BYTE

40349

1

MS Byte

LS Byte

Port 3 Port Diagnostics Data Validity

...

...

...

...

...

40450

2

MSB C00

C01

Port 3 Num Outbound Packets Error detected

C02

LSB C03

Modbus Function Code 3: Ethernet Port 4 Diagnostic Data

Port 4 diagnostics start at address 40452 (decimal).As described in the following table, port 4 diagnostic data fields are the same as for the internal port and ports 1-3, with the appropriate starting address offset.

Starting Address

Length

Register Byte Order

Comments

MS BYTE

LS BYTE

40452

1

MS Byte

LS Byte

Port 4 Port Diagnostics Data Validity

...

...

...

...

...

40553

2

MSB C00

C01

Port 4 Num Outbound Packets Error detected

C02

LSB C03

Ethernet Port Not Present

If an Ethernet port is not physically present on the device, the relevant Modbus registers will return data = 0.

Modbus Function Code 3: Modbus TCP Port 502 Diagnostic Data

Modbus TCP port 502 diagnostics start at address 40555 (decimal) as described in the following table.

Starting Address

Length

Register Byte Order

Comments

  

MS BYTE

LS BYTE

40555

2

MS Byte 00

Byte 01

Modbus TCP/Port 502 Diagnostic Data Validity

  

Byte 02

LS Byte 03

40557

1

MS Byte

LS Byte

Port 502 Status

40558

1

MS Byte

LS Byte

Num Open Connections

40559

2

MSB C00

C01

Num MB Messages Sent

C02

LSB C03

40561

2

MSB C00

C01

Num MB Messages Received

C02

LSB C03

40563

1

MS Byte

LS Byte

Num MB Open Client Connections

40564

1

MS Byte

LS Byte

Num MB Open Server Connections

40565

1

MS Byte

LS Byte

Max Num Connections

40566

1

MS Byte

LS Byte

Max Num Client Connections

40567

1

MS Byte

LS Byte

Max Num Server Connections

40568

2

MSB C00

C01

Num MB Detected Error Messages Sent

C02

LSB C03

40570

1

MS Byte

LS Byte

Num Open Priority Connections

40571

1

MS Byte

LS Byte

Max Num Priority Connections

40572

1

MS Byte

LS Byte

Num Entries in Unauthorized Table

40573

2

MSB - IP1

IP2

Remote IP Address 1

Connection 1

IP3

LSB - IP4

40575

1

MS Byte

LS Byte

Num Attempts to Open Unauthorized Connection 1

40576

2

MSB - IP1

IP2

Remote IP Address 2

Connection 2

IP3

LSB - IP4

40578

2

MS Byte

LS Byte

Num Attempts to Open Unauthorized Connection 2

...

...

...

...

...

  

40663

2

MSB - IP1

IP2

Remote IP Address 31

Connection 31

IP3

LSB - IP4

40665

1

MS Byte

LS Byte

Num Attempts to Open Unauthorized Connection 31

40666

2

MSB - IP1

IP2

Remote IP Address 32

Connection 32

IP3

LSB - IP4

40668

1

MS Byte

LS Byte

Num Attempts to Open Unauthorized Connection 32

Modbus Function Code 3: Modbus TCP Port 502 Connection Table Data

Modbus TCP port 502 connection table data starts at address 40669 (decimal) as described in the following table.

Starting Address

Length

Register Byte Order

Comments

  

MS BYTE

LS BYTE

40669

1

MS Byte

LS Byte

Connection Table Validity

  

40670

1

MS Byte

LS Byte

Number of Entries

40671

1

MS Byte

LS Byte

Starting Entry Index

40672

1

MS Byte

LS Byte

Connection 1 Index

Connection 1

40673

2

IP1

IP2

Connection 1 Remote IP Address

IP3

IP4

40675

1

MS Byte

LS Byte

Connection 1 Remote Port Number

40676

1

MS Byte

LS Byte

Connection 1 Local Port Number

40677

1

MS Byte

LS Byte

Num MB Messages Sent on Connection 1

40678

1

MS Byte

LS Byte

Num MB Messages Received on Connection 1

40679

1

MS Byte

LS Byte

Num MB Detected Error Messages Sent on Connection 1

40680

1

MS Byte

LS Byte

Connection 2 Index

Connection 2

40681

2

IP1

IP2

Connection 2 Remote IP Address

IP3

IP4

40683

1

MS Byte

LS Byte

Connection 2 Remote Port Number

40684

1

MS Byte

LS Byte

Connection 2 Local Port Number

40685

1

MS Byte

LS Byte

Num MB Messages Sent on Connection 2

40686

1

MS Byte

LS Byte

Num MB Messages Received on Connection 2

40687

1

MS Byte

LS Byte

Num MB Detected Error Messages Sent on Connection 2

...

...

...

...

...

  

41168

1

MS Byte

LS Byte

Connection 63 Index

Connection 63*

41169

2

IP1

IP2

Connection 63 Remote IP Address

IP3

IP4

41171

1

MS Byte

LS Byte

Connection 63 Remote Port Number

41172

1

MS Byte

LS Byte

Connection 63 Local Port Number

41173

1

MS Byte

LS Byte

Num MB Messages Sent on Connection 63

41174

1

MS Byte

LS Byte

Num MB Messages Received on Connection 63

41175

1

MS Byte

LS Byte

Num MB Detected Error Messages Sent on Connection 63

41176

1

MS Byte

LS Byte

Connection 64 Index

Connection 64*

41177

2

IP1

IP2

Connection 64 Remote IP Address

IP3

IP4

415179

1

MS Byte

LS Byte

Connection 64 Remote Port Number

41180

1

MS Byte

LS Byte

Connection 64 Local Port Number

41181

1

MS Byte

LS Byte

Num MB Messages Sent on Connection 64

41182

1

MS Byte

LS Byte

Num MB Messages Received on Connection 64

41183

1

MS Byte

LS Byte

Num MB Detected Error Messages Sent on Connection 64

*140 CRA 312 10 and BMX CRA 312 •0 RIO adapter modules support a maximum of 8 connections.