Modbus Diagnostic Codes

Supported Diagnostic Codes

Modbus function code 3 provides access to a variety of diagnostic functions, including basic network diagnostics, Ethernet port diagnostics, and Modbus port 502 diagnostics.

To access the function code 3 diagnostics from the local device, set the unit ID to 100.

The following modules support these Modbus diagnostic codes.

Quantum remote I/O head module (140CRP31200)
Quantum distributed I/O head module (140NOC78000)
Quantum control head module (140NOC78100)
Quantum remote I/O adapter module (140CRA31200)
M340 distributed I/O head module (BMXNOC0401)
M340 remote I/O adapter module (BMXCRA31200)
Quantum IEC 61850 module (140NOP85000)
M580 communications module (BMENOC03•1)
M580 communications module (BMENOP0300)

Modbus Function Code 3: Basic Network Diagnostics

Basic network diagnostics start at address 40001(decimal) as described in the following table.

Starting Address (Decimal)	Length (Words)	Register Byte Order		Comments
Starting Address (Decimal)	Length (Words)	MS BYTE	LS BYTE	Comments
40001	2	MS Byte 00	Byte 01	Basic network diagnostic validity
40001	2	Byte 02	LS Byte	Basic network diagnostic validity
40003	1	MS Byte	LS Byte 03	Communication global status
40004	1	MS Byte	LS Byte	Supported communication services
40005	1	MS Byte	LS Byte	Status of communication services
40006	2	IP 1	IP 2	IP address (IP1.IP2.IP3.IP4)
40006	2	IP 3	IP 4	IP address (IP1.IP2.IP3.IP4)
40008	2	SM 1	SM 2	Subnet mask (SM1.SM2.SM3.SM4)
40008	2	SM 3	SM 4	Subnet mask (SM1.SM2.SM3.SM4)
40010	2	GW 1	GW 2	Default gateway (GW1.GW2.GW3.GW4)
40010	2	GW 3	GW 4	Default gateway (GW1.GW2.GW3.GW4)
40012	3	MAC 1	MAC 2	MAC address (MAC1:MAC2:MAC3:MAC4:MAC5:MAC6.
		MAC 3	MAC 4
		MAC 5	MAC 6
40015	3	MS Byte 00	01	Ether frame format capability / configuration / operational
		02	03
		04	LS Byte 05
40018	2	C00	C01	Ethernet receive frames OK
40018	2	C02	C03	Ethernet receive frames OK
40020	2	C00	C01	Ethernet transmit frames OK
40020	2	C02	C03	Ethernet transmit frames OK
40022	1	MS Byte	LS Byte	Number of open client connections
40023	1	MS Byte	LS Byte	Number of open server connections
40024	2	C00	C01	Number of Modbus detected error messages sent
40024	2	C02	C03	Number of Modbus detected error messages sent
40026	2	C00	C01	Number of Modbus messages sent
40026	2	C02	C03	Number of Modbus messages sent
40028	2	C00	C01	Number of Modbus messages received
40028	2	C02	C03	Number of Modbus messages received
40030	8	Char 1	Char 2	Device name
		Char 3	Char 4
		Char 5	Char 6
		Char 7	Char 8
		Char 9	Char 10
		Char 11	Char 12
		Char 13	Char 14
		Char 15	Char 16
40038	2	MS Byte 00	Byte 01	IP assignment mode capability / operational
40038	2	Byte 02	LS Byte 03	IP assignment mode capability / operational

Example: Reading Basic Network Diagnostics with Modbus Function Code 3

Here is an example of how to read registers 40018 and 40019, the Ethernet receive frames OK count registers. The request contains 7 bytes. The starting address, shown as a hex value in byte 2 below, is calculated as follows:

40018 – 40001 = 17 dec = (11 hex)

The number of registers to be diagnosed (2 hex) is shown in byte 4:

Byte Number	Value
0	Function code = 03 (hex)
1	Starting Address Hi = 00 (hex)
2	Starting Address Low = 11 (hex)
3	No. of Registers Hi = 00 (hex)
4	No. of Registers Low = 2 (hex)
5	CRC high byte (inserted by the Modbus sending application)
6	CRC low byte (inserted by the Modbus sending application)

The normal response is returned in 8 bytes. In this example, the expected response is 14229 hex; this value is shown in bytes 2 through 5 of the response:

Byte Number	Value
0	Function code = 03 (hex)
1	Byte count = 4 (hex)
2	1st register data, high byte = 00 (hex)
3	1st register data, low byte = 01 (01 hex)
4	2nd register data, high byte = 42 (hex)
5	2nd register data, low byte = 29 (hex)
6	CRC high byte
7	CRC low byte

Byte Number	Value
0	Original function code + 80 hex (= 83 hex)
1	Detected error code
2	CRC high byte
3	CRC low byte

For more information on Modbus function code 3 and other function codes, refer to the Modicon Modbus Protocol Reference Guide (PI-MBUS-300).

Modbus Function Code 3: Ethernet Internal Port Diagnostic Data

Internal port diagnostics start at address 40040 (decimal) as described in the following table.

Starting Address (Decimal)	Length (Words)	Register Byte Order		Comments
Starting Address (Decimal)	Length (Words)	MS BYTE	LS BYTE	Comments
40040	1	MS Byte	LS Byte	Internal port Diagnostics Data Validity
40041	1	MS Byte	LS Byte	Internal port Logical/Physical Port Number
40042	1	MS Byte	LS Byte	Internal port Ethernet Control Capability
40043	1	MS Byte	LS Byte	Internal port Link Speed Capability
40044	1	MS Byte	LS Byte	Internal port Ethernet Control Configuration
40045	1	MS Byte	LS Byte	Internal port Link Speed Configuration
40046	1	MS Byte	LS Byte	Internal port Ethernet Control Operational
40047	1	MS Byte	LS Byte	Internal port Link Speed Operational
40048	3	MAC 1	MAC 2	MAC Address (MAC1:MAC2:MAC3:MAC4:MAC5:MAC6)
		MAC 3	MAC 4
		MAC 5	MAC 6
40051	2	MSB C00	C01	Internal port Media Counters Data Validity
40051	2	C02	LSB C03	Internal port Media Counters Data Validity
40053	2	MSB C00	C01	Internal port Num Frames Transmitted OK
40053	2	C02	LSB C03	Internal port Num Frames Transmitted OK
40055	2	MSB C00	C01	Internal port Num Frames Received OK
40055	2	C02	LSB C03	Internal port Num Frames Received OK
40057	2	MSB C00	C01	Internal port Num Ether Collisions
40057	2	C02	LSB C03	Internal port Num Ether Collisions
40059	2	MSB C00	C01	Internal port Carrier Sense Errors detected
40059	2	C02	LSB C03	Internal port Carrier Sense Errors detected
40061	2	MSB C00	C01	Internal port Num Ether Excessive Collisions
40061	2	C02	LSB C03	Internal port Num Ether Excessive Collisions
40063	2	MSB C00	C01	Internal port CRC Errors detected
40063	2	C02	LSB C03	Internal port CRC Errors detected
40065	2	MSB C00	C01	Internal port FCS Errors detected
40065	2	C02	LSB C03	Internal port FCS Errors detected
40067	2	MSB C00	C01	Internal port Alignment Errors detected
40067	2	C02	LSB C03	Internal port Alignment Errors detected
40069	2	MSB C00	C01	Internal port Num Internal MAC Tx Errors detected
40069	2	C02	LSB C03	Internal port Num Internal MAC Tx Errors detected
40071	2	MSB C00	C01	Internal port Late Collisions
40071	2	C02	LSB C03	Internal port Late Collisions
40073	2	MSB C00	C01	Internal port Num Internal MAC Rx Errors detected
40073	2	C02	LSB C03	Internal port Num Internal MAC Rx Errors detected
40075	2	MSB C00	C01	Internal port Multiple Collisions
40075	2	C02	LSB C03	Internal port Multiple Collisions
40077	2	MSB C00	C01	Internal port Single Collisions
40077	2	C02	LSB C03	Internal port Single Collisions
40079	2	MSB C00	C01	Internal port Deferred Transmissions
40079	2	C02	LSB C03	Internal port Deferred Transmissions
40081	2	MSB C00	C01	Internal port Frames Too Long
40081	2	C02	LSB C03	Internal port Frames Too Long
40083	2	MSB C00	C01	Internal port Frames Too Short
40083	2	C02	LSB C03	Internal port Frames Too Short
40085	2	MSB C00	C01	Internal port SQE Test Error detected
40085	2	C02	LSB C03	Internal port SQE Test Error detected
40087	1	MS Byte	LS Byte	Internal port Interface Label Length
40088	32	IL char64	IL char63	Internal port Interface Label characters
40089		IL char62	IL char61
...		...	...
40118		IL char04	IL char03
40119		IL char02	IL char01
40120	1	MS Byte	LS Byte	Internal port Interface Counters Diagnostic Validity
40121	2	MSB C00	C01	Internal port Num Octets Received
40121	2	C02	LSB C03	Internal port Num Octets Received
40123	2	MSB C00	C01	Internal port Num Unicast Packets Received
40123	2	C02	LSB C03	Internal port Num Unicast Packets Received
40125	2	MSB C00	C01	Internal port Num Non Unicast Packets Received
40125	2	C02	LSB C03	Internal port Num Non Unicast Packets Received
40127	2	MSB C00	C01	Internal port Num Inbound Packets Discarded
40127	2	C02	LSB C03	Internal port Num Inbound Packets Discarded
40129	2	MSB C00	C01	Internal port Num Inbound Packets Error detected
40129		C02	LSB C03	Internal port Num Inbound Packets Error detected
401331	2	MSB C00	C01	Internal port Num Inbound Packets Unknown
401331	2	C02	LSB C03	Internal port Num Inbound Packets Unknown
40133	2	MSB C00	C01	Internal port Num Octets Sent
40133	2	C02	LSB C03	Internal port Num Octets Sent
40135	2	MSB C00	C01	Internal port Num Unicast Packets Sent
40135	2	C02	LSB C03	Internal port Num Unicast Packets Sent
40137	2	MSB C00	C01	Internal port Num Non Unicast Packets Sent
40137	2	C02	LSB C03	Internal port Num Non Unicast Packets Sent
40139	2	MSB C00	C01	Internal port Num Outbound Packets Discarded
40139	2	C02	LSB C03	Internal port Num Outbound Packets Discarded
40141	2	MSB C00	C01	Internal port Num Outbound Packets Error detected
40141	2	C02	LSB C03	Internal port Num Outbound Packets Error detected

Modbus Function Code 3: Ethernet Port 1 Diagnostic Data

Port 1 diagnostics start at address 40143 (decimal). As described in the following table, port 1 diagnostic data fields are the same as for the internal port, with the appropriate starting address offset.

Starting Address	Length	Register Byte Order		Comments
Starting Address	Length	MS BYTE	LS BYTE	Comments
40143	1	MS Byte	LS Byte	Port 1 Port Diagnostics Data Validity
...	...	...	...	...
40244	2	MSB C00	C01	Port 1 Num Outbound Packets Error detected
40244	2	C02	LSB C02	Port 1 Num Outbound Packets Error detected

Modbus Function Code 3: Ethernet Backplane Port Diagnostic Data

Backplane port diagnostics start at address 40246 (decimal). As described in the following table, backplane port diagnostic data fields are the same as for the internal port and port 1, with the appropriate starting address offset.

Starting Address	Length	Register Byte Order		Comments
Starting Address	Length	MS BYTE	LS BYTE	Comments
40246	1	MS Byte	LS Byte	Backplane Port Diagnostics Data Validity
...	...	...	...	...
40347	2	MSB C00	C01	Backplane Port Num Outbound Packets Error detected
40347	2	C02	LSB C02	Backplane Port Num Outbound Packets Error detected

Modbus Function Code 3: Ethernet Port 3 Diagnostic Data

Port 3 diagnostics start at address 40349 (decimal). As described in the following table, port 3 diagnostic data fields are the same as for the internal port and ports 1 and 2, with the appropriate starting address offset.

Starting Address	Length	Register Byte Order		Comments
Starting Address	Length	MS BYTE	LS BYTE	Comments
40349	1	MS Byte	LS Byte	Port 3 Port Diagnostics Data Validity
...	...	...	...	...
40450	2	MSB C00	C01	Port 3 Num Outbound Packets Error detected
40450	2	C02	LSB C03	Port 3 Num Outbound Packets Error detected

Modbus Function Code 3: Ethernet Port 4 Diagnostic Data

Port 4 diagnostics start at address 40452 (decimal).As described in the following table, port 4 diagnostic data fields are the same as for the internal port and ports 1-3, with the appropriate starting address offset.

Starting Address	Length	Register Byte Order		Comments
Starting Address	Length	MS BYTE	LS BYTE	Comments
40452	1	MS Byte	LS Byte	Port 4 Port Diagnostics Data Validity
...	...	...	...	...
40553	2	MSB C00	C01	Port 4 Num Outbound Packets Error detected
40553	2	C02	LSB C03	Port 4 Num Outbound Packets Error detected

Ethernet Port Not Present

If an Ethernet port is not physically present on the device, the relevant Modbus registers will return data = 0.

Modbus Function Code 3: Modbus TCP Port 502 Diagnostic Data

Modbus TCP port 502 diagnostics start at address 40555 (decimal) as described in the following table.

Starting Address	Length	Register Byte Order		Comments
Starting Address	Length	MS BYTE	LS BYTE	Comments
40555	2	MS Byte 00	Byte 01	Modbus TCP/Port 502 Diagnostic Data Validity
40555	2	Byte 02	LS Byte 03	Modbus TCP/Port 502 Diagnostic Data Validity
40557	1	MS Byte	LS Byte	Port 502 Status
40558	1	MS Byte	LS Byte	Num Open Connections
40559	2	MSB C00	C01	Num MB Messages Sent
40559	2	C02	LSB C03	Num MB Messages Sent
40561	2	MSB C00	C01	Num MB Messages Received
40561	2	C02	LSB C03	Num MB Messages Received
40563	1	MS Byte	LS Byte	Num MB Open Client Connections
40564	1	MS Byte	LS Byte	Num MB Open Server Connections
40565	1	MS Byte	LS Byte	Max Num Connections
40566	1	MS Byte	LS Byte	Max Num Client Connections
40567	1	MS Byte	LS Byte	Max Num Server Connections
40568	2	MSB C00	C01	Num MB Detected Error Messages Sent
40568	2	C02	LSB C03	Num MB Detected Error Messages Sent
40570	1	MS Byte	LS Byte	Num Open Priority Connections
40571	1	MS Byte	LS Byte	Max Num Priority Connections
40572	1	MS Byte	LS Byte	Num Entries in Unauthorized Table
40573	2	MSB - IP1	IP2	Remote IP Address 1	Connection 1
40573	2	IP3	LSB - IP4	Remote IP Address 1
40575	1	MS Byte	LS Byte	Num Attempts to Open Unauthorized Connection 1
40576	2	MSB - IP1	IP2	Remote IP Address 2	Connection 2
40576	2	IP3	LSB - IP4	Remote IP Address 2
40578	2	MS Byte	LS Byte	Num Attempts to Open Unauthorized Connection 2
...	...	...	...	...
40663	2	MSB - IP1	IP2	Remote IP Address 31	Connection 31
40663	2	IP3	LSB - IP4	Remote IP Address 31
40665	1	MS Byte	LS Byte	Num Attempts to Open Unauthorized Connection 31
40666	2	MSB - IP1	IP2	Remote IP Address 32	Connection 32
40666	2	IP3	LSB - IP4	Remote IP Address 32
40668	1	MS Byte	LS Byte	Num Attempts to Open Unauthorized Connection 32

Modbus Function Code 3: Modbus TCP Port 502 Connection Table Data

Modbus TCP port 502 connection table data starts at address 40669 (decimal) as described in the following table.

Starting Address	Length	Register Byte Order		Comments
Starting Address	Length	MS BYTE	LS BYTE	Comments
40669	1	MS Byte	LS Byte	Connection Table Validity
40670	1	MS Byte	LS Byte	Number of Entries
40671	1	MS Byte	LS Byte	Starting Entry Index
40672	1	MS Byte	LS Byte	Connection 1 Index	Connection 1
40673	2	IP1	IP2	Connection 1 Remote IP Address
40673		IP3	IP4	Connection 1 Remote IP Address
40675	1	MS Byte	LS Byte	Connection 1 Remote Port Number
40676	1	MS Byte	LS Byte	Connection 1 Local Port Number
40677	1	MS Byte	LS Byte	Num MB Messages Sent on Connection 1
40678	1	MS Byte	LS Byte	Num MB Messages Received on Connection 1
40679	1	MS Byte	LS Byte	Num MB Detected Error Messages Sent on Connection 1
40680	1	MS Byte	LS Byte	Connection 2 Index	Connection 2
40681	2	IP1	IP2	Connection 2 Remote IP Address
40681	2	IP3	IP4	Connection 2 Remote IP Address
40683	1	MS Byte	LS Byte	Connection 2 Remote Port Number
40684	1	MS Byte	LS Byte	Connection 2 Local Port Number
40685	1	MS Byte	LS Byte	Num MB Messages Sent on Connection 2
40686	1	MS Byte	LS Byte	Num MB Messages Received on Connection 2
40687	1	MS Byte	LS Byte	Num MB Detected Error Messages Sent on Connection 2
...	...	...	...	...
41168	1	MS Byte	LS Byte	Connection 63 Index	Connection 63*
41169	2	IP1	IP2	Connection 63 Remote IP Address
41169	2	IP3	IP4	Connection 63 Remote IP Address
41171	1	MS Byte	LS Byte	Connection 63 Remote Port Number
41172	1	MS Byte	LS Byte	Connection 63 Local Port Number
41173	1	MS Byte	LS Byte	Num MB Messages Sent on Connection 63
41174	1	MS Byte	LS Byte	Num MB Messages Received on Connection 63
41175	1	MS Byte	LS Byte	Num MB Detected Error Messages Sent on Connection 63
41176	1	MS Byte	LS Byte	Connection 64 Index	Connection 64*
41177	2	IP1	IP2	Connection 64 Remote IP Address
41177	2	IP3	IP4	Connection 64 Remote IP Address
415179	1	MS Byte	LS Byte	Connection 64 Remote Port Number
41180	1	MS Byte	LS Byte	Connection 64 Local Port Number
41181	1	MS Byte	LS Byte	Num MB Messages Sent on Connection 64
41182	1	MS Byte	LS Byte	Num MB Messages Received on Connection 64
41183	1	MS Byte	LS Byte	Num MB Detected Error Messages Sent on Connection 64
*140 CRA 312 10 and BMX CRA 312 •0 RIO adapter modules support a maximum of 8 connections.