0

A client application sends a Modbus 0x08 diagnostics query to Schneider modicun PLC over TCP/IP. The software describes itself as designed for Modicon Micro/Compact/Quantum/Momentum/584/984.

Payload receieved:

0000   00 00 00 00 00 06 00 08 00 15 00 03               ............

I interpret this request as:

Transaction Identifier: 0
Protocol Identifier: 0
Length: 6
Unit Identifier: 0
Function Code: 8
Subfunction: 0x15 (21)
Data: 0003

Received:

0000   00 00 00 00 00 53 00 08 00 15 00 03 4c 00 00 54   .....S......L..T
0010   10 01 df 01 c0 d5 00 00 00 03 00 00 00 00 00 00   ................
0020   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0030   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0040   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0050   00 00 00 00 00 06 c6 15 0a                        .........

Transaction Identifier: 0
    Protocol Identifier: 0
    Length: 0x53 (83)
    Unit Identifier: 0
    Function Code: 8
    Subfunction: 0x15 (21)
    Data: 000c2960bbff005056e53596080045000081acb100008006b6810a15c606c0a8468001f6ca7018bd77d328e389bf5018faf000e600000000000000530008001500034c0000541001df01c0d500000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c6150a

I'm trying to create an emulator that can respond to this 0x8 function code so I can do basic tests of the software without hardware. While I have found documents describing diagnostics with "subfunction" < 21 I can't find any documentation/specification for this subfunction 21.

Any idea what information is being requested here and what type of data is being sent in the response?

1 Answer 1

1

Google returned to me this document with information about function 0x8 subfunction 0x15:

https://www.modbus.org/docs/PI_MBUS_300.pdf

21 (15 Hex) Get/Clear Modbus Plus Statistics Returns a series of 54 16-bit words (108 bytes) in the data field of the response (this function differs from the usual two-byte length of the data field). The data contains the statistics for the Modbus Plus peer processor in the slave device.

Be aware that this document describes MBPlus, not MBTCP/IP, but i hope information still will be useful for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.