11. Connection to other devices11.4 Modbus TCPa. Byte 0 contains the request's function codeb. The remaining bytes are function-specificIf an error occurs, the Modbus TCP server will send an error messagel Error-Framea. Byte 0 always contains the request's error code (0x80 + function code)b. Byte 1 contains the exception code (error-specific)Following is a description of the request & response function codes for each of the func-tion descriptions in the table above:11.4.2.1 Read Coils 0x01:This function reads the entered number of bit outputs starting from a specified startingaddress and then returns the result in bytes (8 outputs per byte)Function Code 1 byte 0x01 ;Read CoilsStart address 2 byte Must always be 1 less than the starting output you want(zero-based)Number of out-puts2 byte 1 to 2000 (0x7D0)Table 94: Request-PDUResponse to the request being received1. The starting address is analyzed (distributed among bytes 1 and 2)a. Byte 1 = Hi; Byte 2 = Lo2. The number of outputs is analyzed (distributed among bytes 3 and 4)a. Byte 3 = Hi; Byte 4 = Lo3. The output states are reada. From the start of the (starting address) to (starting address + number ofoutputs)Function Code 1 byte 0x01 ;Read CoilsBye Count 1 byte NOutput values n * 1 byte valueTable 95: Response-PDUn= Number of outputs read / 8Preparation for sending the response1. The read bits are encoded in bytes(1 but per output state; 1=ON, 0=OFF)2. The LSB of the first byte, i.e., bit 0, contains the state of the output that isaddressed first in the request. The other outputs follow in ascending order.easyE4 11/18 MN050009 EN www.eaton.com 547
