Read complete object dictionary (FC101) This function code is used to read the complete object dictionary of the controller. To start or restart readout of the object dictionary, sub-function code 55h has to be sent. This code would always reset the readout to the object 0x0000. Every subsequent object dictionary data frame can be read out by sending sub-function code AAh. At the end when all the objects have been read, an exception response is generated, stating abort code "No data available". The format of each object read is as follows: Request: Name Length Value / Remark Slave Address 1 Byte Function Code 1 Byte 65h Sub-function code 1 Byte 55h or AAh Length of data 1 Byte 00h CRC 2 Bytes Response: Name Length Value / Remark Slave Address 1 Byte Function Code 1 Byte 65h Subfunction Code 1 Byte Length of data 1 Byte n times a "Object dictionary frame" 1 - 252 Bytes CRC 2 Bytes An object dictionary frame consists of the following bytes: Name Length Value / Remark Index Low 1 Byte Index High 1 Byte Sub-index 1 Byte No. of data bytes 1 Byte Number m of valid bytes in data field Data byte m-1 Byte Example The following numbers are written in hexadecimal. The address of the slave is "5". Start read out of the object dictionary with the Request: The response is: Read the next part of the object dictionary with the request: The response is: Repeat reading the od with the previous request until the response is an error: Error reaction In case of an error, the following message will be sent: Name Length Example value Slave Address 1 Byte Function code 1 byte 2Bh +80h (171d = 43d + 128d) (indicates error) Modbus exception code 1 byte FFh (extended exception) Extended exception length 2 bytes 6 MEI type 1 byte 0Dh Exception code 1 byte CEh Error code 4 bytes CANopen error code CRC 2 Bytes In case an not supported control option bit is set, the following error message will be sent: Name Length Example value Slave Address 1 Byte Function code 1 byte 2Bh +80h (171d = 43d + 128d) (indicates error) Modbus exception code 1 byte FFh (extended exception) Extended exception length 2 bytes 2 + length of Supported protocol control MEI type 1 byte 0Dh Exception code 1 byte AEh Supported protocol control 1 or 2 bytes See following table CRC 2 Bytes Bit Field name Description 0 Extend flag This bit is used when the object dictionary data set is larger than what fits in one Modbus command. The data set is then extended over multiple Modbus messages, each message being a fragment of the data set. "0" = No multiple message transaction, or end of multiple message transaction; "1" = Part of a multiple message transaction 1 Extend protocol control Length of protocol control, the value "0" indicates a length of 1 byte, the value "1" a length of 2 byte 2 Counter byte option This bit is set to 1 to indicate that the counter byte field is used in this message. If this bit is set to 0 the counter byte does not exist in this message. 3 and 4 Reserved 0 5 Network ID option Not supported, must be "0". 6 Encoded data option Not supported, must be "0". 7 Access flag This bit indicates the access method of the request command, "0" = read, "1" = write 8 to 15 Reserved 0 The following example shows an error in case of a wrong request. The requests reads the object 6061h:00 with a length of 2 byte, but the object is 1 byte long, actually: Request Response
Read complete object dictionary (FC101) This function code is used to read the complete object dictionary of the controller. To start or restart readout of the object dictionary, sub-function code 55h has to be sent. This code would always reset the readout to the object 0x0000. Every subsequent object dictionary data frame can be read out by sending sub-function code AAh. At the end when all the objects have been read, an exception response is generated, stating abort code "No data available". The format of each object read is as follows: Request: Name Length Value / Remark Slave Address 1 Byte Function Code 1 Byte 65h Sub-function code 1 Byte 55h or AAh Length of data 1 Byte 00h CRC 2 Bytes Response: Name Length Value / Remark Slave Address 1 Byte Function Code 1 Byte 65h Subfunction Code 1 Byte Length of data 1 Byte n times a "Object dictionary frame" 1 - 252 Bytes CRC 2 Bytes An object dictionary frame consists of the following bytes: Name Length Value / Remark Index Low 1 Byte Index High 1 Byte Sub-index 1 Byte No. of data bytes 1 Byte Number m of valid bytes in data field Data byte m-1 Byte Example The following numbers are written in hexadecimal. The address of the slave is "5". Start read out of the object dictionary with the Request: The response is: Read the next part of the object dictionary with the request: The response is: Repeat reading the od with the previous request until the response is an error: Error reaction In case of an error, the following message will be sent: Name Length Example value Slave Address 1 Byte Function code 1 byte 2Bh +80h (171d = 43d + 128d) (indicates error) Modbus exception code 1 byte FFh (extended exception) Extended exception length 2 bytes 6 MEI type 1 byte 0Dh Exception code 1 byte CEh Error code 4 bytes CANopen error code CRC 2 Bytes In case an not supported control option bit is set, the following error message will be sent: Name Length Example value Slave Address 1 Byte Function code 1 byte 2Bh +80h (171d = 43d + 128d) (indicates error) Modbus exception code 1 byte FFh (extended exception) Extended exception length 2 bytes 2 + length of Supported protocol control MEI type 1 byte 0Dh Exception code 1 byte AEh Supported protocol control 1 or 2 bytes See following table CRC 2 Bytes Bit Field name Description 0 Extend flag This bit is used when the object dictionary data set is larger than what fits in one Modbus command. The data set is then extended over multiple Modbus messages, each message being a fragment of the data set. "0" = No multiple message transaction, or end of multiple message transaction; "1" = Part of a multiple message transaction 1 Extend protocol control Length of protocol control, the value "0" indicates a length of 1 byte, the value "1" a length of 2 byte 2 Counter byte option This bit is set to 1 to indicate that the counter byte field is used in this message. If this bit is set to 0 the counter byte does not exist in this message. 3 and 4 Reserved 0 5 Network ID option Not supported, must be "0". 6 Encoded data option Not supported, must be "0". 7 Access flag This bit indicates the access method of the request command, "0" = read, "1" = write 8 to 15 Reserved 0 The following example shows an error in case of a wrong request. The requests reads the object 6061h:00 with a length of 2 byte, but the object is 1 byte long, actually: Request Response
Error reaction In case of an error, the following message will be sent: Name Length Example value Slave Address 1 Byte Function code 1 byte 2Bh +80h (171d = 43d + 128d) (indicates error) Modbus exception code 1 byte FFh (extended exception) Extended exception length 2 bytes 6 MEI type 1 byte 0Dh Exception code 1 byte CEh Error code 4 bytes CANopen error code CRC 2 Bytes In case an not supported control option bit is set, the following error message will be sent: Name Length Example value Slave Address 1 Byte Function code 1 byte 2Bh +80h (171d = 43d + 128d) (indicates error) Modbus exception code 1 byte FFh (extended exception) Extended exception length 2 bytes 2 + length of Supported protocol control MEI type 1 byte 0Dh Exception code 1 byte AEh Supported protocol control 1 or 2 bytes See following table CRC 2 Bytes Bit Field name Description 0 Extend flag This bit is used when the object dictionary data set is larger than what fits in one Modbus command. The data set is then extended over multiple Modbus messages, each message being a fragment of the data set. "0" = No multiple message transaction, or end of multiple message transaction; "1" = Part of a multiple message transaction 1 Extend protocol control Length of protocol control, the value "0" indicates a length of 1 byte, the value "1" a length of 2 byte 2 Counter byte option This bit is set to 1 to indicate that the counter byte field is used in this message. If this bit is set to 0 the counter byte does not exist in this message. 3 and 4 Reserved 0 5 Network ID option Not supported, must be "0". 6 Encoded data option Not supported, must be "0". 7 Access flag This bit indicates the access method of the request command, "0" = read, "1" = write 8 to 15 Reserved 0 The following example shows an error in case of a wrong request. The requests reads the object 6061h:00 with a length of 2 byte, but the object is 1 byte long, actually: Request Response
