Supported Diagnostic Codes
Modbus function code 3 provides access to a variety of diagnostic functions, including basic network diagnostics, Ethernet port diagnostics, and Modbus port 502 diagnostics.
To access the function code 3 diagnostics from the local device, set the unit ID to 100.
The following modules support these Modbus diagnostic codes.
Quantum remote I/O head module (140CRP31200)
Quantum distributed I/O head module (140NOC78000)
Quantum control head module (140NOC78100)
Quantum remote I/O adapter module (140CRA31200)
M340 distributed I/O head module (BMXNOC0401)
M340 remote I/O adapter module (BMXCRA31200)
Quantum IEC 61850 module (140NOP85000)
M580 communications module (BMENOC03•1)
M580 communications module (BMENOP0300)
Modbus Function Code 3: Basic Network Diagnostics
Basic network diagnostics start at address 40001(decimal) as described in the following table.
Starting Address (Decimal) |
Length (Words) |
Register Byte Order |
Comments |
|
---|---|---|---|---|
MS BYTE |
LS BYTE |
|||
40001 |
2 |
MS Byte 00 |
Byte 01 |
Basic network diagnostic validity |
Byte 02 |
LS Byte |
|||
40003 |
1 |
MS Byte |
LS Byte 03 |
Communication global status |
40004 |
1 |
MS Byte |
LS Byte |
Supported communication services |
40005 |
1 |
MS Byte |
LS Byte |
Status of communication services |
40006 |
2 |
IP 1 |
IP 2 |
IP address (IP1.IP2.IP3.IP4) |
IP 3 |
IP 4 |
|||
40008 |
2 |
SM 1 |
SM 2 |
Subnet mask (SM1.SM2.SM3.SM4) |
SM 3 |
SM 4 |
|||
40010 |
2 |
GW 1 |
GW 2 |
Default gateway (GW1.GW2.GW3.GW4) |
GW 3 |
GW 4 |
|||
40012 |
3 |
MAC 1 |
MAC 2 |
MAC address (MAC1:MAC2:MAC3:MAC4:MAC5:MAC6. |
MAC 3 |
MAC 4 |
|||
MAC 5 |
MAC 6 |
|||
40015 |
3 |
MS Byte 00 |
01 |
Ether frame format capability / configuration / operational |
02 |
03 |
|||
04 |
LS Byte 05 |
|||
40018 |
2 |
C00 |
C01 |
Ethernet receive frames OK |
C02 |
C03 |
|||
40020 |
2 |
C00 |
C01 |
Ethernet transmit frames OK |
C02 |
C03 |
|||
40022 |
1 |
MS Byte |
LS Byte |
Number of open client connections |
40023 |
1 |
MS Byte |
LS Byte |
Number of open server connections |
40024 |
2 |
C00 |
C01 |
Number of Modbus detected error messages sent |
C02 |
C03 |
|||
40026 |
2 |
C00 |
C01 |
Number of Modbus messages sent |
C02 |
C03 |
|||
40028 |
2 |
C00 |
C01 |
Number of Modbus messages received |
C02 |
C03 |
|||
40030 |
8 |
Char 1 |
Char 2 |
Device name |
Char 3 |
Char 4 |
|||
Char 5 |
Char 6 |
|||
Char 7 |
Char 8 |
|||
Char 9 |
Char 10 |
|||
Char 11 |
Char 12 |
|||
Char 13 |
Char 14 |
|||
Char 15 |
Char 16 |
|||
40038 |
2 |
MS Byte 00 |
Byte 01 |
IP assignment mode capability / operational |
Byte 02 |
LS Byte 03 |
Example: Reading Basic Network Diagnostics with Modbus Function Code 3
Here is an example of how to read registers 40018 and 40019, the Ethernet receive frames OK count registers. The request contains 7 bytes. The starting address, shown as a hex value in byte 2 below, is calculated as follows:
40018 – 40001 = 17 dec = (11 hex)
The number of registers to be diagnosed (2 hex) is shown in byte 4:
Byte Number |
Value |
---|---|
0 |
Function code = 03 (hex) |
1 |
Starting Address Hi = 00 (hex) |
2 |
Starting Address Low = 11 (hex) |
3 |
No. of Registers Hi = 00 (hex) |
4 |
No. of Registers Low = 2 (hex) |
5 |
CRC high byte (inserted by the Modbus sending application) |
6 |
CRC low byte (inserted by the Modbus sending application) |
The normal response is returned in 8 bytes. In this example, the expected response is 14229 hex; this value is shown in bytes 2 through 5 of the response:
Byte Number |
Value |
---|---|
0 |
Function code = 03 (hex) |
1 |
Byte count = 4 (hex) |
2 |
1st register data, high byte = 00 (hex) |
3 |
1st register data, low byte = 01 (01 hex) |
4 |
2nd register data, high byte = 42 (hex) |
5 |
2nd register data, low byte = 29 (hex) |
6 |
CRC high byte |
7 |
CRC low byte |
Byte Number |
Value |
---|---|
0 |
Original function code + 80 hex (= 83 hex) |
1 |
Detected error code |
2 |
CRC high byte |
3 |
CRC low byte |
For more information on Modbus function code 3 and other function codes, refer to the Modicon Modbus Protocol Reference Guide (PI-MBUS-300).
Modbus Function Code 3: Ethernet Internal Port Diagnostic Data
Internal port diagnostics start at address 40040 (decimal) as described in the following table.
Starting Address (Decimal) |
Length (Words) |
Register Byte Order |
Comments |
|
---|---|---|---|---|
MS BYTE |
LS BYTE |
|||
40040 |
1 |
MS Byte |
LS Byte |
Internal port Diagnostics Data Validity |
40041 |
1 |
MS Byte |
LS Byte |
Internal port Logical/Physical Port Number |
40042 |
1 |
MS Byte |
LS Byte |
Internal port Ethernet Control Capability |
40043 |
1 |
MS Byte |
LS Byte |
Internal port Link Speed Capability |
40044 |
1 |
MS Byte |
LS Byte |
Internal port Ethernet Control Configuration |
40045 |
1 |
MS Byte |
LS Byte |
Internal port Link Speed Configuration |
40046 |
1 |
MS Byte |
LS Byte |
Internal port Ethernet Control Operational |
40047 |
1 |
MS Byte |
LS Byte |
Internal port Link Speed Operational |
40048 |
3 |
MAC 1 |
MAC 2 |
MAC Address (MAC1:MAC2:MAC3:MAC4:MAC5:MAC6) |
MAC 3 |
MAC 4 |
|||
MAC 5 |
MAC 6 |
|||
40051 |
2 |
MSB C00 |
C01 |
Internal port Media Counters Data Validity |
C02 |
LSB C03 |
|||
40053 |
2 |
MSB C00 |
C01 |
Internal port Num Frames Transmitted OK |
C02 |
LSB C03 |
|||
40055 |
2 |
MSB C00 |
C01 |
Internal port Num Frames Received OK |
C02 |
LSB C03 |
|||
40057 |
2 |
MSB C00 |
C01 |
Internal port Num Ether Collisions |
C02 |
LSB C03 |
|||
40059 |
2 |
MSB C00 |
C01 |
Internal port Carrier Sense Errors detected |
C02 |
LSB C03 |
|||
40061 |
2 |
MSB C00 |
C01 |
Internal port Num Ether Excessive Collisions |
C02 |
LSB C03 |
|||
40063 |
2 |
MSB C00 |
C01 |
Internal port CRC Errors detected |
C02 |
LSB C03 |
|||
40065 |
2 |
MSB C00 |
C01 |
Internal port FCS Errors detected |
C02 |
LSB C03 |
|||
40067 |
2 |
MSB C00 |
C01 |
Internal port Alignment Errors detected |
C02 |
LSB C03 |
|||
40069 |
2 |
MSB C00 |
C01 |
Internal port Num Internal MAC Tx Errors detected |
C02 |
LSB C03 |
|||
40071 |
2 |
MSB C00 |
C01 |
Internal port Late Collisions |
C02 |
LSB C03 |
|||
40073 |
2 |
MSB C00 |
C01 |
Internal port Num Internal MAC Rx Errors detected |
C02 |
LSB C03 |
|||
40075 |
2 |
MSB C00 |
C01 |
Internal port Multiple Collisions |
C02 |
LSB C03 |
|||
40077 |
2 |
MSB C00 |
C01 |
Internal port Single Collisions |
C02 |
LSB C03 |
|||
40079 |
2 |
MSB C00 |
C01 |
Internal port Deferred Transmissions |
C02 |
LSB C03 |
|||
40081 |
2 |
MSB C00 |
C01 |
Internal port Frames Too Long |
C02 |
LSB C03 |
|||
40083 |
2 |
MSB C00 |
C01 |
Internal port Frames Too Short |
C02 |
LSB C03 |
|||
40085 |
2 |
MSB C00 |
C01 |
Internal port SQE Test Error detected |
C02 |
LSB C03 |
|||
40087 |
1 |
MS Byte |
LS Byte |
Internal port Interface Label Length |
40088 |
32 |
IL char64 |
IL char63 |
Internal port Interface Label characters |
40089 |
IL char62 |
IL char61 |
||
... |
... |
... |
||
40118 |
IL char04 |
IL char03 |
||
40119 |
IL char02 |
IL char01 |
||
40120 |
1 |
MS Byte |
LS Byte |
Internal port Interface Counters Diagnostic Validity |
40121 |
2 |
MSB C00 |
C01 |
Internal port Num Octets Received |
C02 |
LSB C03 |
|||
40123 |
2 |
MSB C00 |
C01 |
Internal port Num Unicast Packets Received |
C02 |
LSB C03 |
|||
40125 |
2 |
MSB C00 |
C01 |
Internal port Num Non Unicast Packets Received |
C02 |
LSB C03 |
|||
40127 |
2 |
MSB C00 |
C01 |
Internal port Num Inbound Packets Discarded |
C02 |
LSB C03 |
|||
40129 |
2 |
MSB C00 |
C01 |
Internal port Num Inbound Packets Error detected |
C02 |
LSB C03 |
|||
401331 |
2 |
MSB C00 |
C01 |
Internal port Num Inbound Packets Unknown |
C02 |
LSB C03 |
|||
40133 |
2 |
MSB C00 |
C01 |
Internal port Num Octets Sent |
C02 |
LSB C03 |
|||
40135 |
2 |
MSB C00 |
C01 |
Internal port Num Unicast Packets Sent |
C02 |
LSB C03 |
|||
40137 |
2 |
MSB C00 |
C01 |
Internal port Num Non Unicast Packets Sent |
C02 |
LSB C03 |
|||
40139 |
2 |
MSB C00 |
C01 |
Internal port Num Outbound Packets Discarded |
C02 |
LSB C03 |
|||
40141 |
2 |
MSB C00 |
C01 |
Internal port Num Outbound Packets Error detected |
C02 |
LSB C03 |
Modbus Function Code 3: Ethernet Port 1 Diagnostic Data
Port 1 diagnostics start at address 40143 (decimal). As described in the following table, port 1 diagnostic data fields are the same as for the internal port, with the appropriate starting address offset.
Starting Address |
Length |
Register Byte Order |
Comments |
|
---|---|---|---|---|
MS BYTE |
LS BYTE |
|||
40143 |
1 |
MS Byte |
LS Byte |
Port 1 Port Diagnostics Data Validity |
... |
... |
... |
... |
... |
40244 |
2 |
MSB C00 |
C01 |
Port 1 Num Outbound Packets Error detected |
C02 |
LSB C02 |
Modbus Function Code 3: Ethernet Backplane Port Diagnostic Data
Backplane port diagnostics start at address 40246 (decimal). As described in the following table, backplane port diagnostic data fields are the same as for the internal port and port 1, with the appropriate starting address offset.
Starting Address |
Length |
Register Byte Order |
Comments |
|
---|---|---|---|---|
MS BYTE |
LS BYTE |
|||
40246 |
1 |
MS Byte |
LS Byte |
Backplane Port Diagnostics Data Validity |
... |
... |
... |
... |
... |
40347 |
2 |
MSB C00 |
C01 |
Backplane Port Num Outbound Packets Error detected |
C02 |
LSB C02 |
Modbus Function Code 3: Ethernet Port 3 Diagnostic Data
Port 3 diagnostics start at address 40349 (decimal). As described in the following table, port 3 diagnostic data fields are the same as for the internal port and ports 1 and 2, with the appropriate starting address offset.
Starting Address |
Length |
Register Byte Order |
Comments |
|
---|---|---|---|---|
MS BYTE |
LS BYTE |
|||
40349 |
1 |
MS Byte |
LS Byte |
Port 3 Port Diagnostics Data Validity |
... |
... |
... |
... |
... |
40450 |
2 |
MSB C00 |
C01 |
Port 3 Num Outbound Packets Error detected |
C02 |
LSB C03 |
Modbus Function Code 3: Ethernet Port 4 Diagnostic Data
Port 4 diagnostics start at address 40452 (decimal).As described in the following table, port 4 diagnostic data fields are the same as for the internal port and ports 1-3, with the appropriate starting address offset.
Starting Address |
Length |
Register Byte Order |
Comments |
|
---|---|---|---|---|
MS BYTE |
LS BYTE |
|||
40452 |
1 |
MS Byte |
LS Byte |
Port 4 Port Diagnostics Data Validity |
... |
... |
... |
... |
... |
40553 |
2 |
MSB C00 |
C01 |
Port 4 Num Outbound Packets Error detected |
C02 |
LSB C03 |
Ethernet Port Not Present
If an Ethernet port is not physically present on the device, the relevant Modbus registers will return data = 0.
Modbus Function Code 3: Modbus TCP Port 502 Diagnostic Data
Modbus TCP port 502 diagnostics start at address 40555 (decimal) as described in the following table.
Starting Address |
Length |
Register Byte Order |
Comments |
||
---|---|---|---|---|---|
MS BYTE |
LS BYTE |
||||
40555 |
2 |
MS Byte 00 |
Byte 01 |
Modbus TCP/Port 502 Diagnostic Data Validity |
|
Byte 02 |
LS Byte 03 |
||||
40557 |
1 |
MS Byte |
LS Byte |
Port 502 Status |
|
40558 |
1 |
MS Byte |
LS Byte |
Num Open Connections |
|
40559 |
2 |
MSB C00 |
C01 |
Num MB Messages Sent |
|
C02 |
LSB C03 |
||||
40561 |
2 |
MSB C00 |
C01 |
Num MB Messages Received |
|
C02 |
LSB C03 |
||||
40563 |
1 |
MS Byte |
LS Byte |
Num MB Open Client Connections |
|
40564 |
1 |
MS Byte |
LS Byte |
Num MB Open Server Connections |
|
40565 |
1 |
MS Byte |
LS Byte |
Max Num Connections |
|
40566 |
1 |
MS Byte |
LS Byte |
Max Num Client Connections |
|
40567 |
1 |
MS Byte |
LS Byte |
Max Num Server Connections |
|
40568 |
2 |
MSB C00 |
C01 |
Num MB Detected Error Messages Sent |
|
C02 |
LSB C03 |
||||
40570 |
1 |
MS Byte |
LS Byte |
Num Open Priority Connections |
|
40571 |
1 |
MS Byte |
LS Byte |
Max Num Priority Connections |
|
40572 |
1 |
MS Byte |
LS Byte |
Num Entries in Unauthorized Table |
|
40573 |
2 |
MSB - IP1 |
IP2 |
Remote IP Address 1 |
Connection 1 |
IP3 |
LSB - IP4 |
||||
40575 |
1 |
MS Byte |
LS Byte |
Num Attempts to Open Unauthorized Connection 1 |
|
40576 |
2 |
MSB - IP1 |
IP2 |
Remote IP Address 2 |
Connection 2 |
IP3 |
LSB - IP4 |
||||
40578 |
2 |
MS Byte |
LS Byte |
Num Attempts to Open Unauthorized Connection 2 |
|
... |
... |
... |
... |
... |
|
40663 |
2 |
MSB - IP1 |
IP2 |
Remote IP Address 31 |
Connection 31 |
IP3 |
LSB - IP4 |
||||
40665 |
1 |
MS Byte |
LS Byte |
Num Attempts to Open Unauthorized Connection 31 |
|
40666 |
2 |
MSB - IP1 |
IP2 |
Remote IP Address 32 |
Connection 32 |
IP3 |
LSB - IP4 |
||||
40668 |
1 |
MS Byte |
LS Byte |
Num Attempts to Open Unauthorized Connection 32 |
Modbus Function Code 3: Modbus TCP Port 502 Connection Table Data
Modbus TCP port 502 connection table data starts at address 40669 (decimal) as described in the following table.
Starting Address |
Length |
Register Byte Order |
Comments |
||
---|---|---|---|---|---|
MS BYTE |
LS BYTE |
||||
40669 |
1 |
MS Byte |
LS Byte |
Connection Table Validity |
|
40670 |
1 |
MS Byte |
LS Byte |
Number of Entries |
|
40671 |
1 |
MS Byte |
LS Byte |
Starting Entry Index |
|
40672 |
1 |
MS Byte |
LS Byte |
Connection 1 Index |
Connection 1 |
40673 |
2 |
IP1 |
IP2 |
Connection 1 Remote IP Address |
|
IP3 |
IP4 |
||||
40675 |
1 |
MS Byte |
LS Byte |
Connection 1 Remote Port Number |
|
40676 |
1 |
MS Byte |
LS Byte |
Connection 1 Local Port Number |
|
40677 |
1 |
MS Byte |
LS Byte |
Num MB Messages Sent on Connection 1 |
|
40678 |
1 |
MS Byte |
LS Byte |
Num MB Messages Received on Connection 1 |
|
40679 |
1 |
MS Byte |
LS Byte |
Num MB Detected Error Messages Sent on Connection 1 |
|
40680 |
1 |
MS Byte |
LS Byte |
Connection 2 Index |
Connection 2 |
40681 |
2 |
IP1 |
IP2 |
Connection 2 Remote IP Address |
|
IP3 |
IP4 |
||||
40683 |
1 |
MS Byte |
LS Byte |
Connection 2 Remote Port Number |
|
40684 |
1 |
MS Byte |
LS Byte |
Connection 2 Local Port Number |
|
40685 |
1 |
MS Byte |
LS Byte |
Num MB Messages Sent on Connection 2 |
|
40686 |
1 |
MS Byte |
LS Byte |
Num MB Messages Received on Connection 2 |
|
40687 |
1 |
MS Byte |
LS Byte |
Num MB Detected Error Messages Sent on Connection 2 |
|
... |
... |
... |
... |
... |
|
41168 |
1 |
MS Byte |
LS Byte |
Connection 63 Index |
Connection 63* |
41169 |
2 |
IP1 |
IP2 |
Connection 63 Remote IP Address |
|
IP3 |
IP4 |
||||
41171 |
1 |
MS Byte |
LS Byte |
Connection 63 Remote Port Number |
|
41172 |
1 |
MS Byte |
LS Byte |
Connection 63 Local Port Number |
|
41173 |
1 |
MS Byte |
LS Byte |
Num MB Messages Sent on Connection 63 |
|
41174 |
1 |
MS Byte |
LS Byte |
Num MB Messages Received on Connection 63 |
|
41175 |
1 |
MS Byte |
LS Byte |
Num MB Detected Error Messages Sent on Connection 63 |
|
41176 |
1 |
MS Byte |
LS Byte |
Connection 64 Index |
Connection 64* |
41177 |
2 |
IP1 |
IP2 |
Connection 64 Remote IP Address |
|
IP3 |
IP4 |
||||
415179 |
1 |
MS Byte |
LS Byte |
Connection 64 Remote Port Number |
|
41180 |
1 |
MS Byte |
LS Byte |
Connection 64 Local Port Number |
|
41181 |
1 |
MS Byte |
LS Byte |
Num MB Messages Sent on Connection 64 |
|
41182 |
1 |
MS Byte |
LS Byte |
Num MB Messages Received on Connection 64 |
|
41183 |
1 |
MS Byte |
LS Byte |
Num MB Detected Error Messages Sent on Connection 64 |
|
*140 CRA 312 10 and BMX CRA 312 •0 RIO adapter modules support a maximum of 8 connections. |