« Close

Datasheets and User Guides

App Notes

Software & Driver

 

UD Modbus (Old, Deprecated)

This page is for the deprecated Modbus map called UD Modbus, which applies to:

U3:  Hardware 1.30 (U3C), Firmware 1.05+
U6:  Firmware 1.00+
UE9:  Comm 1.48+, Control 1.97+

The registers listed below are supported to work as specified, but no new development is planned for UD Modbus.  The T-series devices use our current Modbus map which is active and fully-supported.

 

UD Modbus Software

The LJSocket page catalogs our experience connecting to Modbus software. We list of some of the quirks we’ve seen, e.g., a zero-based offset vs. one-based offset.

Examples of Modbus communication in LabVIEW are attached to the bottom of this page. These work for direct Modbus communication to the UE9, or Modbus communication over USB using LJSocket.

Modbus Support:    
Device Hardware Version First Firmware
U3 1.2 Not Supported
U3 1.21 Not Supported
U3 1.3 Modbus Added in FW 1.05
U6 2 Modbus Added in FW 1.00
UE9 1.1 Modbus Added in Control 1.70, reworked in 1.97. Ethernet support in Comm 1.43 and USB support in Comm 1.48

UD Modbus Protocol

LabJack devices implement the Modbus TCP protocol. For USB devices such as the U3 and U6, use LJSocket to provide a TCP socket interface. Without LJSocket, there is no COTS software we know of that can communicate using Modbus TCP over the LabJack’s USB interface.

Only Modbus functions 3 (Read Multiple), 4 (Read One), 6 (Write One), and 16 (Write Multiple) are supported. In COTS software this often means specifying “Holding” registers.

On the U3/U6/UE9, when a Modbus command is sent by USB the low-level packet must have 2 zeros appended to the front.  This is how the U3/U6/UE9 knows that the packet (after the 2 zeros) is Modbus, and not the normal low-level protocol.  The response does not have anything added and is pure Modbus.  This is generally handled automatically at higher levels (e.g. LJSocket adds the zeros).  SkyMotes only speak Modbus, so commands should always be pure Modbus with no added zeros.

Ethernet Modbus packets on the UE9 are limited to 256 bytes.  USB Modbus packets on the UE9 are limited to 256 bytes, including the 2 zeros appended to the command.  USB Modbus packets on the U3 and U6 are limited to 64 bytes, including the 2 zeros appended to the command.  SkyMote Modbus packets over USB or Ethernet are limited to 64 bytes.

While the Modbus website goes into more detail, here are the bytes the LabJack devices expect:

Requests          
Function Name Read Reg. Read Regs. Write Reg Write Regs.  
Function Number 4 3 6 16 Description
Byte[0:1] Trans ID Trans ID Trans ID Trans ID Send anything
Byte[2:3] Protocol ID Protocol ID Protocol ID Protocol ID Always pass zero
Byte[4:5] Length Length Length Length Number of bytes starting at byte 6
Byte 6 Unit ID Unit ID Unit ID Unit ID For U3, U6, and UE9 pass 0xff
Byte 7 4 3 6 16 Function #
Byte[8:9] Address Address Address Address As it appears in the Modbus map
Byte[10:11] Num Regs (n) Num Regs (n) Reg Value Num Regs (n)  
Byte 12       Byte Count (2*n)  
Byte 13...       Reg Values...  
           
           
  Read Reg. Read Regs. Write Reg Write Regs.  
Responses 4 3 6 16  
Byte[0:1] Trans ID Trans ID Trans ID Trans ID Echo of sent value
Byte[2:3] Protocol ID Protocol ID Protocol ID Protocol ID  
Byte[4:5] Length Length Length Length Number of bytes starting at byte 6
Byte 6 Unit ID Unit ID Unit ID Unit ID  
Byte 7 4 3 6 16  
Byte 8 Byte Count (2*n) Byte Count (2*n) Address Address  
Byte 9 Reg Data Reg Data      
Byte 10 .... .... Reg Value Num Regs (n)  
Byte 11          

 

If developing your own software, functions 3 (Read Multiple Registers) and 16 (Write Multiple Registers) are all that is needed, so here is more detail about those:

Read Multiple Registers (function #3)

Command [# Bytes = 12]
Bytes 0-1:  0-65535 (Transaction ID, echoed by device)
Bytes 2-3: 0 (Protocol ID)
Byte 4:  0 (MSB of Length)
Byte 5:  6 (LSB of Length)
Byte 6:  0-254 (Unit ID, echoed on U3/U6/UE9, 0 for SkyMote bridge, 1-254 for mote)
Byte 7:  3 (function #)
Bytes 8 & 9:  0-65535 (MSB and LSB, respectively, of starting register address)
Byte 10:  0 (MSB of #Registers)
Byte 11:  1-27 or 1-123 (LSB of #Registers, # of registers to read)

Response [# Bytes = 9 + 2*#Registers, max is 64 or 256]
Bytes 0-3:  Echo of command bytes 0-3 (Transaction ID and Protocol ID)
Byte 4:  0 (MSB of Length)
Byte 5:  3 + 2*#Registers (LSB of Length)
Byte 6:  Unit ID
Byte 7:  3 (function #)
Bytes 8:  2-54 or 2-246 (2*#Registers)
Bytes 9+:  Data

Write Multiple Registers (function #16)

Command [# Bytes = 13 + 2*#Registers, max is 62/64 or 254/256]
Bytes 0-1:  0-65535 (Transaction ID, echoed by device)
Bytes 2-3: 0 (Protocol ID)
Byte 4:  0 (MSB of Length)
Byte 5:  7 + 2*#Registers (LSB of Length)
Byte 6:  0-254 (Unit ID, echoed on U3/U6/UE9, 0 for SkyMote bridge, 1-254 for mote)
Byte 7:  16 (function #)
Bytes 8 & 9:  0-65535 (MSB and LSB, respectively, of starting register address)
Byte 10:  0 (MSB of #Registers)
Byte 11:  1-24/25 or 1-120/121 (LSB of #Registers, # of registers to write)
Bytes 12:  2-48/50 or 2-240/242 (2*#Registers)
Bytes 13+:  Data

Response [# Bytes = 12]
Bytes 0-3:  Echo of command bytes 0-3 (Transaction ID and Protocol ID)
Byte 4:  0 (MSB of Length)
Byte 5:  6 (LSB of Length)
Byte 6:  Unit ID
Byte 7:  16 (function #)
Bytes 8 & 9:  0-65535 (MSB and LSB, respectively, of starting register address)
Byte 10:  0 (MSB of #Registers)
Byte 11:  1-24/25 or 1-120/121 (LSB of #Registers, # of registers to write)

Note:  "Length" is number of bytes after the "Length" parameter.  From the Modbus spec.

 

Examples

Here is an example LabJackPython session that communicates with a U6 connected over USB. Debugging is turned on to show the bytes sent and received. These are done directly over USB, not through LJSocket, so the outgoing packets have 2 extra zeros in front that tell the USB device this is a Modbus packet.

>>> import u6
>>> d = u6.U6()
>>> d.debug = True
>>> d.readRegister(0)
Sent:  [0x0, 0x0, 0xa6, 0x3f, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2]
Response:  [0xa6, 0x3f, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x4, 0xb8, 0xf5, 0x70, 0x0]
-0.00011703372001647949

The Python code reads from register 0, which the map below states is AIN0. Here’s how to read from AIN1:

>>> d.readRegister(2)
Sent:  [0x0, 0x0, 0xa6, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x2, 0x0, 0x2]
Response:  [0xa6, 0x40, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x4, 0x40, 0x9d, 0x94, 0xfc]
4.9244365692138672

AIN1 is at register 2 because each analog input takes 2 registers (32-bits). The Modbus map below lists how many registers each address requires in the “Min Regs” column. Here’s how to read AIN0, AIN1, AIN2, and AIN3 at the same time:

>>> d.readRegister(0, numReg = 8)
Sent:  [0x0, 0x0, 0xa6, 0x41, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8]
Response:  [0xa6, 0x41, 0x0, 0x0, 0x0, 0x13, 0x0, 0x3, 0x10, 0xb8, 0xee, 0xe0, 0x0, 0x40, 0x9d, 0xa7, 0xbe, 0x3f, 0x3, 0x84, 0x62, 0x3f, 0x16, 0x24, 0xe8]
[-0.00011390447616577148, 4.9267263412475586, 0.51373875141143799, 0.58650064468383789] 

Because the addresses (0, 2, 6, and 8) are all consecutive, we can request 8 registers starting at address 0. The four floating point values are returned as a sequence of 16 bytes, and LabJackPython (and other Modbus software) knows how to recombine them.

Here’s how to set DAC0 to 3.7 V.

>>> d.writeRegister(5000, 3.7)
Sent:  [0x0, 0x0, 0xa6, 0x42, 0x0, 0x0, 0x0, 0xb, 0x0, 0x10, 0x13, 0x88, 0x0, 0x2, 0x4, 0x40, 0x6c, 0xcc, 0xcd]
Response:  [0xa6, 0x42, 0x0, 0x0, 0x0, 0x6, 0x0, 0x10, 0x13, 0x88, 0x0, 0x2]
3.7000000000000002

We’ve wired DAC0 to AIN1 so that we can read it back:

>>> d.readRegister(2)
Sent:  [0x0, 0x0, 0xa6, 0x43, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x2, 0x0, 0x2]
Response:  [0xa6, 0x43, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x4, 0x40, 0x6c, 0x5d, 0x37]
3.6931893825531006

UD Modbus Map

We've made the UD Modbus map available as a spreadsheet (opens in new window). The spreadsheet may refer to alpha, beta, or unreleased firmware. Contact us for assistance.

In the columns marked “Read” and “Write”, we indicate the progress we’ve made with the following legend:

  • x means that the register is fully implemented and tested to the satisfaction of our team.
  • n means that the register is implemented, but not fully tested to the satisfaction of our team.
  • f means that the register won’t throw an error, but isn’t implemented. This is most commonly used for features that devices don’t offer. For example, the UE9/U6 doesn’t have FIOs that can become Analog, so the FIO Analog registers don’t do anything on the UE9/U6.
  • If the space is blank, then it means it isn’t implemented, and will throw a Modbus error if you try to access it.

    The “Min Regs” column indicates if you need to read more than one register. Each register is 16 bits. For example, AIN readings are 32-bit floating point numbers, and so they must be read in increments of 2 16-bit registers.

          Supported         
          U3 FW 1.28  UE9 Ctrl 2.04  U6 Ctrl 1.06 
Address Description Min
Regs
Data
Type
More Info Read Write Read Write Read Write
0 Analog Inputs 2 single   x   x   x  
1000 AIN Res 1 u16   x f x x x x
1500 AIN Range 1 u16   x f x x x x
2000 AIN Settling 1 u16   x f x x x x
2500 AIN Options 1 u16   x f x   x x
3000 AIN Neg Chn 1 u16   x x x   x x
                     
5000 DAC Values 2 single   x   x x x x
                     
6000 DIO State 1 u16   x x x x x x
6100 DIO Direction 1 u16   x n x x x n
6200 Power Switch State 1 u16              
6700 FIO States (Upper Byte is Mask) 1 u16 Masks are only n n x x x n
6701 EIO States (Upper Byte is Mask) 1 u16 meaningful n n x x x n
6702 CIO States (Upper Byte is Mask) 1 u16 when writing n n x x x n
6703 MIO States (Upper Byte is Mask) 1 u16              
6750 FIO Directions (Upper Byte is Mask) 1 u16   n n x x x n
6751 EIO Directions (Upper Byte is Mask) 1 u16   n n x x x n
6752 CIO Directions (Upper Byte is Mask) 1 u16   n n x x x n
6753 MIO Directions (Upper Byte is Mask) 1 u16              
6800 Raw Single IO State 1 u16   n n x x n n
6900 Raw Single IO Direction 1 u16   n n x x n n
                     
7000 Timer Clock (Long) 2 u32   x x x x x x
7002 Timer Divisor (Long) 2 u32   x x x x x x
7100 Timer Config 2 u32   x x x x x x
7200 Timers (Read/Reset) 2 u32/i32   n n x x x x
7300 Counters (Read/Reset) 2 u32   n n x x n n
                     
8000 Stream Config                  
8200 Stream Start                  
8210 Stream Stop                  
8500 Stream Data                  
                     
9000 SHT                  
                     
9100 I2C Options 8   R / W     x x    
9101 I2C Speed           x x    
9102 I2C SDA           x x    
9103 I2C SCL           x x    
9104 I2C Address           x x    
9105 I2C Num To Tx           x x    
9106 I2C Num To Rx           x x    
9107-9122 I2C Tx Data           x x    
                     
9200 SPI                  
9300 UART                  
                     
10000 VBatt                  
10002 Temperature (C? K? F?)                  
10004 RH%                  
10006 Light (Lux? Cd?)                  
10008 Pressure (Unit?)                  
                     
10800 Motion Detected?                  
10802 Motion Settings                  
10012 Sound (# Addresses?)                  
                     
10800 Switch A                  
10810 Switch B                  
10900 Relay A                  
                     
12000 RX LQI   single              
12002 TX LQI   single              
12004 Get Battery   single              
12006 Get Temp   single              
12008 Get Light   single              
12010 Get Motion   single              
12012 Get Sound   single              
12014 Get RH%   single              
12016 Get Pressure   single              
                     
14000 TLB Check-In Report 1 24                
14000 Status/Reserved 1 u16 bit 0 - Flashing            
14001 RX LQI (Byte0), TX LQI (Byte1) 1 2 bytes              
14002 Battery Voltage (V) 2 single              
14004 Bump Count / Motion 1 u16              
14005 # MMA Sample 1 u16              
14006 Temperature (C) 2 single              
14008 Light Current (Units?) 2 single              
14010 Light Max 2 single              
14012 Light Min 2 single              
14014 Sound Current (Units?) 2 single              
14016 Sound Max 2 single              
14018 Sound Min 2 single              
14020 RH % 2 single              
14022 Reserved 2 reserved              
                     
14030 TLB Check-In Report 2 23                
14030 Status/Reserved 1 u16              
14031 Temperature Max 2 single              
14033 Temperature Min 2 single              
14035 Temperature Average 2 single              
14037 Light Average 2 single              
14039 Sound Average 2 single              
14041 RH % Max 2 single              
14043 RH % Min 2 single              
14045 RH % Average 2 single              
14047 Reserved 6 reserved              
                     
10700 Burst Settings                  
10701 Frequency Index                  
10702 Burst Num Samples                  
10703 Burst Channel 0                  
10704 Burst Channel 1                  
                     
35100 Buzz Duration                  
35101 Buzz 1                  
35102 Buzz 2                  
35103 Power                  
35104 Inten 1                  
35105 Inten 2                  
                     
40000 Script Settings                  
40100 Script Debug                  
40200 Script Stop                  
40300 Script GO                  
41004-41999 Script RAM                  
42004-42999 Script App                  
                     
                     
50000 General Config                  
50000 PANID   u16              
50001 Channel Mask 1   Bridge only, bit 0 = chan 11, bit 16 = chan 26            
                     
50100 Sleeping Mote Config                  
50100 Process Interval 2 u16              
50102 Sleep Time / Check In Time (ms) 2 u16              
50104 Sleep Options 2 u16              
50106 numChildCommFailures 2 u16              
                     
                     
50120 Network Password 8   byte 0 = Options, bytes 1-15 = Password            
                     
50400 Spontaneous config 1   First bit = 0(off), 1(on)            
                     
                     
                     
50500 Pin Offset 1     x x x f x x
50501 Num Timers Enabled 1     x x x x x x
50502 Counter Mask 1     x x x x x x
                     
50590 FIO Analog 1   Bitmask (1=Analog, 0=digital) x x     f f
50591 EIO Analog 1   Bitmask (1=Analog, 0=digital) x x     f f
                     
50800 SWDT Settings 6         x x    
50801 SWDT Time           x x    
50802 DIO Response A           x x    
50803 DIO Response B           x x    
50804 DAC0 Response           x x    
50805 DAC1 Response           x x    
                     
55000 Detailed Error 1         x      
55900 Reserved                  
                     
                     
                     
                     
Ethernet Processor
(56000-56999)
                   
56000 Firmware Version 1 u16              
56002 Buffer Status 12 u32              
56004 NumEthRX   u32              
56006 NumEthTX   u32              
56008 NumPIBRX   u32              
56010 NumPIBTX   u32              
56012 Num Mapped   u32              
  Eth Processor Last Error   u16              
  DM Overflows   u16              
  DM OVF During   u16              
  DM OVF During   u16              
  Num iPIB TOs   u16              
  Nun oPIB TOs   u16              
                     
56100 Settings (Read only) 12 u32              
56102 Current IP   u32              
56104 Current Subnet   u32              
56106 Current Gateway   u32              
56108 Current DNS   u32              
56110 Current Alt DNS   u32              
                     
56150 Settings 12 u32              
56152 Default IP   u32              
56154 Default Subnet   u32              
56156 Default Gateway   u32              
56158 Reserved   u32              
56160 Reserved   u32              
                     
56200 MAC (802.3, 6-byte) 3                
                     
                     
                     
56900 Flash Lock Key                  
56902 Flash Erase 2                
56904 Flash Pointer                  
56906 Flash Write 18                
56908 Flash Read                  
                     
56998 W = Enter flash mode / R = BL Version                  
56999 Restart (4C4A)                  
                     
                     
USB Processor
(57000-57999)
                   
57000 USB Processor Firmware Version 1 2 bytes [ MSB, LSB]            
57001 USB Proc. Buffer Status 1 u16              
57002 NumUSBRX 2 u32              
57004 NumUSBTX 2 u32              
57006 NumPIBRX 2 u32              
57008 NumPIBTX 2 u32              
57010 USB Processor Last Error 1 u16              
57011 DM Overflows 1 u16              
57012 DM OVF During PIB TRNX 1 u16              
57013 DM OVF During USB TRNX 1 u16              
57014 Num PIB TOs 1 u16              
57015 Nun USB TOs 1 u16              
57016 Num Spontaneous Sent 2 u32              
57018 Num Spontaneous Dropped 2 u32              
                     
57020 Error History (last 16 errors)   u16              
                     
57050 VUSB 2 single              
57052 VJack 2 single              
57054 VST 2 single              
                     
57998 W = Enter flash mode / R = BL Version   u16              
57999 Restart (4C4A)   u16              
                     
                     
                     
                     
58000 Device Name (USB String Format)     Writing Byte 0 erases     x x    
                     
                     
59000 Flash Lock Key 2                
59020 0xAA55 1                
59021 0xC33C 1                
59022 Address to Write 2                
59024 Start of 32 bytes of data 1-40   (16 registers long)            
                     
59074 0xAA55                  
59075 0xC33C                  
59076 Block to Erase     2 registers            
                     
59080 Start of Image                  
59082 Length of Image (Bytes)                  
59084 Start of 20-byte checksum                  
                     
59100 Read Address 2                
59120 Data from flash                  
                     
59198 Change mode (0=norm, 1=flash)                  
                     
59200 Num Known Devices 2 u32              
59202 Device 0 ID 1 u16              
59329 Device 127 ID 1 u16              
                     
59400 Network Channel 1 u16              
                     
59410 Energy Scan 8   16 bytes, byte0 = chan11, takes 2212 ms            
                     
                     
59940 Wireless to UART ping test                  
                     
59950 AIN binary / Num Samples                  
59952 AIN Max / Range                  
59953 AIN Min / JN_Chn (0-3)                  
59954 AIN Avg /                  
59955 AIN Standard Deviation /                  
                     
                     
                     
                     
59980 Set Hardware Config                  
59988 Range Test Mode. Num Minutes                  
59989 Hi Power Mode. Num Minutes                  
59990 Rapid mode timeout (Minutes) 1                
59999 Reset (0x4C4A)                  
                     
                     
                     
                     
60000-60999 User Mem 16         x      
61000-61999 Calibration Data 16         x      
                     
64000-64007 AES Key       n   x x    
64008-64009 IP Address for CloudDot 2 string   n   x x    
64010 Port for CloudDot 1 int   n   x x    
64016 Heartbeat       n   x x    
                     
65000 Product ID 1 int   x   x   x  
65001 Serial Number 2 int   x   x   x  
65003 Local ID 1 int   x   x   x  
65004 Hardware Version 1 int   x   x   x  
65005 Hardware Options 1 int   x   x   x  
65006 Firmware Version 1 spf   x   x   x  
65007 Bootloader Version 1 spf   x   x   x  
65008 Other Versions 1 spf       x      
                     
65100 Product ID 2                
65102 Firmware Version 1                
65103 Unit ID 1                
65104 MAC (805.15.4, 8-byte) 4                
65108 Serial Number 2                
65110 Device Name 16                

6 comments

Hi. I'm trying to use the Labjack U6-PRO through MODBUS to read voltages in the microvolt range. I've tried to set AIN0 channel range to +-0.01 but I can't get it to work. I've allready set it to differential by setting the AIN1 channel as the negative one. What is the value that I should send to the 1500 register to set the AIN0 range to +-0.01? Also, what would be the typical noise value for this channel using a resolution index 12 and a range +-0.01V. Thanks

 

For the 0.01V range you want a gain of x1000, and the ResolutionIndex for that is 3 (from Section 5.2.5.2).  Do a test with AIN0 & AIN1 both jumpered to GND and you should see an effective resolution of about 0.2uV (from Appendix B).

Thanks. What would be the typical resistor values to make the jumper to GND on both AIN0 and AIN1 channels?

Regards

If you mean for the noise test, I would just use wires.  0 ohms would be ideal.

If you mean that you have a floating signal and need a resistor from AIN1 to GND to provide a weak reference (Differential Readings App Note), then it depends on your signal but 10k to 1M are typical.

The reference in the modbus map above seems to be broken. (2015-06-05)

It looks like the Modbus map was broken for a short time, but is working now.