« Close

Datasheets and User Guides

App Notes

Software & Driver

 

UD Modbus (Old, Deprecated)

This page is for the deprecated Modbus map called UD Modbus, which applies to:

U3:  Hardware 1.30 (U3C), Firmware 1.05-1.46
U6:  Firmware 1.00-1.39
UE9:  Comm 1.48+, Control 1.97+

For the T7, and U3/U6s with newer firmware, see the new Modbus information.

 

Modbus Software

The LJSocket page catalogs our experience connecting to Modbus software. We list of some of the quirks we’ve seen, e.g., a zero-based offset vs. one-based offset.

Examples of Modbus communication in LabVIEW are attached to the bottom of this page. These work for direct Modbus communication to the UE9, or Modbus communication over USB using LJSocket.

Modbus Support:    
Device Hardware Version First Firmware
U3 1.2 Not Supported
U3 1.21 Not Supported
U3 1.3 Modbus Added in FW 1.05
U6 2 Modbus Added in FW 1.00
UE9 1.1 Modbus Added in Control 1.70, reworked in 1.97. Ethernet support in Comm 1.43 and USB support in Comm 1.48

Modbus Protocol

LabJack devices implement the Modbus TCP protocol. For USB devices such as the U3 and U6, use LJSocket to provide a TCP socket interface. Without LJSocket, there is no COTS software we know of that can communicate using Modbus TCP over the LabJack’s USB interface.

Only Modbus functions 3 (Read Multiple), 4 (Read One), 6 (Write One), and 16 (Write Multiple) are supported. In COTS software this often means specifying “Holding” registers.

On the U3/U6/UE9, when a Modbus command is sent by USB the low-level packet must have 2 zeros appended to the front.  This is how the U3/U6/UE9 knows that the packet (after the 2 zeros) is Modbus, and not the normal low-level protocol.  The response does not have anything added and is pure Modbus.  This is generally handled automatically at higher levels (e.g. LJSocket adds the zeros).  SkyMotes only speak Modbus, so commands should always be pure Modbus with no added zeros.

Ethernet Modbus packets on the UE9 are limited to 256 bytes.  USB Modbus packets on the UE9 are limited to 256 bytes, including the 2 zeros appended to the command.  USB Modbus packets on the U3 and U6 are limited to 64 bytes, including the 2 zeros appended to the command.  SkyMote Modbus packets over USB or Ethernet are limited to 64 bytes.

While the Modbus website goes into more detail, here are the bytes the LabJack devices expect:

Requests          
Function Name Read Reg. Read Regs. Write Reg Write Regs.  
Function Number 4 3 6 16 Description
Byte[0:1] Trans ID Trans ID Trans ID Trans ID Send anything
Byte[2:3] Protocol ID Protocol ID Protocol ID Protocol ID Always pass zero
Byte[4:5] Length Length Length Length Number of bytes starting at byte 6
Byte 6 Unit ID Unit ID Unit ID Unit ID For U3, U6, and UE9 pass 0xff
Byte 7 4 3 6 16 Function #
Byte[8:9] Address Address Address Address As it appears in the Modbus map
Byte[10:11] Num Regs (n) Num Regs (n) Reg Value Num Regs (n)  
Byte 12       Byte Count (2*n)  
Byte 13...       Reg Values...  
           
           
  Read Reg. Read Regs. Write Reg Write Regs.  
Responses 4 3 6 16  
Byte[0:1] Trans ID Trans ID Trans ID Trans ID Echo of sent value
Byte[2:3] Protocol ID Protocol ID Protocol ID Protocol ID  
Byte[4:5] Length Length Length Length Number of bytes starting at byte 6
Byte 6 Unit ID Unit ID Unit ID Unit ID  
Byte 7 4 3 6 16  
Byte 8 Byte Count (2*n) Byte Count (2*n) Address Address  
Byte 9 Reg Data Reg Data      
Byte 10 .... .... Reg Value Num Regs (n)  
Byte 11          

 

If developing your own software, functions 3 (Read Multiple Registers) and 16 (Write Multiple Registers) are all that is needed, so here is more detail about those:

Read Multiple Registers (function #3)

Command [# Bytes = 12]
Bytes 0-1:  0-65535 (Transaction ID, echoed by device)
Bytes 2-3: 0 (Protocol ID)
Byte 4:  0 (MSB of Length)
Byte 5:  6 (LSB of Length)
Byte 6:  0-254 (Unit ID, echoed on U3/U6/UE9, 0 for SkyMote bridge, 1-254 for mote)
Byte 7:  3 (function #)
Bytes 8 & 9:  0-65535 (MSB and LSB, respectively, of starting register address)
Byte 10:  0 (MSB of #Registers)
Byte 11:  1-27 or 1-123 (LSB of #Registers, # of registers to read)

Response [# Bytes = 9 + 2*#Registers, max is 64 or 256]
Bytes 0-3:  Echo of command bytes 0-3 (Transaction ID and Protocol ID)
Byte 4:  0 (MSB of Length)
Byte 5:  3 + 2*#Registers (LSB of Length)
Byte 6:  Unit ID
Byte 7:  3 (function #)
Bytes 8:  2-54 or 2-246 (2*#Registers)
Bytes 9+:  Data

Write Multiple Registers (function #16)

Command [# Bytes = 13 + 2*#Registers, max is 62/64 or 254/256]
Bytes 0-1:  0-65535 (Transaction ID, echoed by device)
Bytes 2-3: 0 (Protocol ID)
Byte 4:  0 (MSB of Length)
Byte 5:  7 + 2*#Registers (LSB of Length)
Byte 6:  0-254 (Unit ID, echoed on U3/U6/UE9, 0 for SkyMote bridge, 1-254 for mote)
Byte 7:  16 (function #)
Bytes 8 & 9:  0-65535 (MSB and LSB, respectively, of starting register address)
Byte 10:  0 (MSB of #Registers)
Byte 11:  1-24/25 or 1-120/121 (LSB of #Registers, # of registers to write)
Bytes 12:  2-48/50 or 2-240/242 (2*#Registers)
Bytes 13+:  Data

Response [# Bytes = 12]
Bytes 0-3:  Echo of command bytes 0-3 (Transaction ID and Protocol ID)
Byte 4:  0 (MSB of Length)
Byte 5:  6 (LSB of Length)
Byte 6:  Unit ID
Byte 7:  16 (function #)
Bytes 8 & 9:  0-65535 (MSB and LSB, respectively, of starting register address)
Byte 10:  0 (MSB of #Registers)
Byte 11:  1-24/25 or 1-120/121 (LSB of #Registers, # of registers to write)

Note:  "Length" is number of bytes after the "Length" parameter.  From the Modbus spec.

 

Example

Here is an example LabJackPython session that communicates with a U6 connected over USB. Debugging is turned on to show the bytes sent and received. These are done directly over USB, not through LJSocket, so the outgoing packets have 2 extra zeros in front that tell the USB device this is a Modbus packet.

>>> import u6
>>> d = u6.U6()
>>> d.debug = True
>>> d.readRegister(0)
Sent: [0x0, 0x0, 0xa6, 0x3f, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2]
Response: [0xa6, 0x3f, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x4, 0xb8, 0xf5, 0x70, 0x0]
-0.00011703372001647949

The Python code reads from register 0, which the map below states is AIN0. Here’s how to read from AIN1:

>>> d.readRegister(2)
Sent: [0x0, 0x0, 0xa6, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x2, 0x0, 0x2]
Response: [0xa6, 0x40, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x4, 0x40, 0x9d, 0x94, 0xfc]
4.9244365692138672

AIN1 is at register 2 because each analog input takes 2 registers (32-bits). The Modbus map below lists how many registers each address requires in the “Min Regs” column. Here’s how to read AIN0, AIN1, AIN2, and AIN3 at the same time:

>>> d.readRegister(0, numReg = 8)
Sent: [0x0, 0x0, 0xa6, 0x41, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8]
Response: [0xa6, 0x41, 0x0, 0x0, 0x0, 0x13, 0x0, 0x3, 0x10, 0xb8, 0xee, 0xe0, 0x0, 0x40, 0x9d, 0xa7, 0xbe, 0x3f, 0x3, 0x84, 0x62, 0x3f, 0x16, 0x24, 0xe8]
[-0.00011390447616577148, 4.9267263412475586, 0.51373875141143799, 0.58650064468383789]

Because the addresses (0, 2, 6, and 8) are all consecutive, we can request 8 registers starting at address 0. The four floating point values are returned as a sequence of 16 bytes, and LabJackPython (and other Modbus software) knows how to recombine them.

Here’s how to set DAC0 to 3.7 V.

>>> d.writeRegister(5000, 3.7)
Sent: [0x0, 0x0, 0xa6, 0x42, 0x0, 0x0, 0x0, 0xb, 0x0, 0x10, 0x13, 0x88, 0x0, 0x2, 0x4, 0x40, 0x6c, 0xcc, 0xcd]
Response: [0xa6, 0x42, 0x0, 0x0, 0x0, 0x6, 0x0, 0x10, 0x13, 0x88, 0x0, 0x2]
3.7000000000000002

We’ve wired DAC0 to AIN1 so that we can read it back:

>>> d.readRegister(2)
Sent: [0x0, 0x0, 0xa6, 0x43, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x2, 0x0, 0x2]
Response: [0xa6, 0x43, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x4, 0x40, 0x6c, 0x5d, 0x37]
3.6931893825531006

Modbus Map

We've made the latest Modbus map available as a spreadsheet (opens in new window). The spreadsheet may refer to alpha, beta, or unreleased firmware. Contact us for assistance.

In the columns marked “Read” and “Write”, we indicate the progress we’ve made with the following legend:

  • x means that the register is fully implemented and tested to the satisfaction of our team.
  • n means that the register is implemented, but not fully tested to the satisfaction of our team.
  • f means that the register won’t throw an error, but isn’t implemented. This is most commonly used for features that devices don’t offer. For example, the UE9/U6 doesn’t have FIOs that can become Analog, so the FIO Analog registers don’t do anything on the UE9/U6.
  • If the space is blank, then it means it isn’t implemented, and will throw a Modbus error if you try to access it.

    The “Min Regs” column indicates if you need to read more than one register. Each register is 16 bits. For example, AIN readings are 32-bit floating point numbers, and so they must be read in increments of 2 16-bit registers.

    The online jsBeautifier program can organize your JavaScript code, even if it is unreadable.

          Supported         
          U3 FW 1.28  UE9 Ctrl 2.04  U6 Ctrl 1.06  UEW B 0.06  SM 0.06 
Address Description Min
Regs
Data
Type
More Info Read Write Read Write Read Write Read Write Read Write
0 Analog Inputs 2 single   x   x   x          
1000 AIN Res 1 u16   x f x x x x        
1500 AIN Range 1 u16   x f x x x x        
2000 AIN Settling 1 u16   x f x x x x        
2500 AIN Options 1 u16   x f x   x x        
3000 AIN Neg Chn 1 u16   x x x   x x        
                             
5000 DAC Values 2 single   x   x x x x        
                             
6000 DIO State 1 u16   x x x x x x        
6100 DIO Direction 1 u16   x n x x x n        
6200 Power Switch State 1 u16                      
6700 FIO States (Upper Byte is Mask) 1 u16 Masks are only n n x x x n        
6701 EIO States (Upper Byte is Mask) 1 u16 meaningful n n x x x n        
6702 CIO States (Upper Byte is Mask) 1 u16 when writing n n x x x n        
6753 MIO States (Upper Byte is Mask) 1 u16                      
6750 FIO Directions (Upper Byte is Mask) 1 u16   n n x x x n        
6751 EIO Directions (Upper Byte is Mask) 1 u16   n n x x x n        
6752 CIO Directions (Upper Byte is Mask) 1 u16   n n x x x n        
6753 MIO Directions (Upper Byte is Mask) 1 u16                      
6800 Raw Single IO State 1 u16   n n x x n n        
6900 Raw Single IO Direction 1 u16   n n x x n n        
                             
7000 Timer Clock (Long) 2 u32   x x x x x x        
7002 Timer Divisor (Long) 2 u32   x x x x x x        
7100 Timer Config 2 u32   x x x x x x        
7200 Timers (Read/Reset) 2 u32/i32   n n x x x x        
7300 Counters (Read/Reset) 2 u32   n n x x n n        
                             
8000 Stream Config                          
8200 Stream Start                          
8210 Stream Stop                          
8500 Stream Data                          
                             
9000 SHT                          
                             
9100 I2C Options 8   R / W     x x            
9101 I2C Speed           x x            
9102 I2C SDA           x x            
9103 I2C SCL           x x            
9104 I2C Address           x x            
9105 I2C Num To Tx           x x            
9106 I2C Num To Rx           x x            
9107-9122 I2C Tx Data           x x            
                             
9200 SPI                          
9300 UART                          
                             
10000 VBatt                       x  
10002 Temperature (C? K? F?)                   x   x  
10004 RH%                       x  
10006 Light (Lux? Cd?)                       x  
10008 Pressure (Unit?)                       x  
                             
10800 Motion Detected?                       x  
10802 Motion Settings                       x x
10012 Sound (# Addresses?)                          
                             
10800 Switch A                          
10810 Switch B                          
10900 Relay A                          
                             
12000 RX LQI   single                   x  
12002 TX LQI   single                   x  
12004 Get Battery   single                   x  
12006 Get Temp   single                   x  
12008 Get Light   single                   x  
12010 Get Motion   single                   x  
12012 Get Sound   single                   x  
12014 Get RH%   single                   x  
12016 Get Pressure   single                      
                             
14000 TLB Check-In Report 1 24                        
14000 Status/Reserved 1 u16 bit 0 - Flashing                 x  
14001 RX LQI (Byte0), TX LQI (Byte1) 1 2 bytes                   x  
14002 Battery Voltage (V) 2 single                   x  
14004 Bump Count / Motion 1 u16                   x  
14005 # MMA Sample 1 u16                   x  
14006 Temperature (C) 2 single                   x  
14008 Light Current (Units?) 2 single                   x  
14010 Light Max 2 single                   x  
14012 Light Min 2 single                   x  
14014 Sound Current (Units?) 2 single                   x  
14016 Sound Max 2 single                   x  
14018 Sound Min 2 single                   x  
14020 RH % 2 single                   x  
14022 Reserved 2 reserved                      
                             
14030 TLB Check-In Report 2 23                     x  
14030 Status/Reserved 1 u16                   x  
14031 Temperature Max 2 single                   x  
14033 Temperature Min 2 single                   x  
14035 Temperature Average 2 single                   x  
14037 Light Average 2 single                   x  
14039 Sound Average 2 single                   x  
14041 RH % Max 2 single                   x  
14043 RH % Min 2 single                   x  
14045 RH % Average 2 single                   x  
14047 Reserved 6 reserved                   x  
                             
10700 Burst Settings                          
10701 Frequency Index                          
10702 Burst Num Samples                          
10703 Burst Channel 0                          
10704 Burst Channel 1                          
                             
35100 Buzz Duration                          
35101 Buzz 1                          
35102 Buzz 2                          
35103 Power                          
35104 Inten 1                          
35105 Inten 2                          
                             
40000 Script Settings                          
40100 Script Debug                          
40200 Script Stop                          
40300 Script GO                          
41004-41999 Script RAM                          
42004-42999 Script App                          
                             
                             
50000 General Config                          
50000 PANID   u16                     x
50001 Channel Mask 1   Bridge only, bit 0 = chan 11, bit 16 = chan 26                   x
                             
50100 Sleeping Mote Config                          
50100 Process Interval 2 u16                   f f
50102 Sleep Time / Check In Time (ms) 2 u16                   x x
50104 Sleep Options 2 u16                   x x
50106 numChildCommFailures 2 u16                   x x
                          x x
                             
50120 Network Password 8   byte 0 = Options, bytes 1-15 = Password                 x x
                             
50400 Spontaneous config 1   First bit = 0(off), 1(on)                    
                             
                             
                             
50500 Pin Offset 1     x x x f x x        
50501 Num Timers Enabled 1     x x x x x x        
50502 Counter Mask 1     x x x x x x        
                             
50590 FIO Analog 1   Bitmask (1=Analog, 0=digital) x x     f f        
50591 EIO Analog 1   Bitmask (1=Analog, 0=digital) x x     f f        
                             
50800 SWDT Settings 6         x x            
50801 SWDT Time           x x            
50802 DIO Response A           x x            
50803 DIO Response B           x x            
50804 DAC0 Response           x x            
50805 DAC1 Response           x x            
                             
55000 Detailed Error 1         x           x  
55900 Reserved                          
                             
                             
                             
                             
Ethernet Processor
(56000-56999)
                           
56000 Firmware Version 1 u16               x      
56002 Buffer Status 12 u32                      
56004 NumEthRX   u32                      
56006 NumEthTX   u32                      
56008 NumPIBRX   u32                      
56010 NumPIBTX   u32                      
56012 Num Mapped   u32                      
  Eth Processor Last Error   u16                      
  DM Overflows   u16                      
  DM OVF During   u16                      
  DM OVF During   u16                      
  Num iPIB TOs   u16                      
  Nun oPIB TOs   u16                      
                             
56100 Settings (Read only) 12 u32               x      
56102 Current IP   u32               x      
56104 Current Subnet   u32               x      
56106 Current Gateway   u32               x      
56108 Current DNS   u32               x      
56110 Current Alt DNS   u32               x      
                             
56150 Settings 12 u32               x x    
56152 Default IP   u32               x x    
56154 Default Subnet   u32               x x    
56156 Default Gateway   u32               x x    
56158 Reserved   u32               x Filler    
56160 Reserved   u32               x Filler    
                             
56200 MAC (802.3, 6-byte) 3                        
                             
                             
                             
56900 Flash Lock Key                          
56902 Flash Erase 2                        
56904 Flash Pointer                          
56906 Flash Write 18                        
56908 Flash Read                          
                             
56998 W = Enter flash mode / R = BL Version                          
56999 Restart (4C4A)                          
                             
                             
USB Processor
(57000-57999)
                           
57000 USB Processor Firmware Version 1 2 bytes [ MSB, LSB]             x      
57001 USB Proc. Buffer Status 1 u16               x      
57002 NumUSBRX 2 u32               x      
57004 NumUSBTX 2 u32               x      
57006 NumPIBRX 2 u32               x      
57008 NumPIBTX 2 u32               x      
57010 USB Processor Last Error 1 u16               x      
57011 DM Overflows 1 u16               x      
57012 DM OVF During PIB TRNX 1 u16               x      
57013 DM OVF During USB TRNX 1 u16               x      
57014 Num PIB TOs 1 u16               x      
57015 Nun USB TOs 1 u16               x      
57016 Num Spontaneous Sent 2 u32                      
57018 Num Spontaneous Dropped 2 u32                      
                             
57020 Error History (last 16 errors)   u16               x      
                             
57050 VUSB 2 single               P      
57052 VJack 2 single               x      
57054 VST 2 single               x      
                             
57998 W = Enter flash mode / R = BL Version   u16                      
57999 Restart (4C4A)   u16                      
                             
                             
                             
                             
58000 Device Name (USB String Format)     Writing Byte 0 erases     x x            
                             
                             
59000 Flash Lock Key 2                   x x x
59020 0xAA55 1                       x
59021 0xC33C 1                       x
59022 Address to Write 2                       x
59024 Start of 32 bytes of data 1-40   (16 registers long)                   x
                             
59074 0xAA55                         x
59075 0xC33C                         x
59076 Block to Erase     2 registers                   x
                             
59080 Start of Image                         x
59082 Length of Image (Bytes)                         x
59084 Start of 20-byte checksum                         x
                             
59100 Read Address 2                   x x x
59120 Data from flash                   x   x  
                             
59198 Change mode (0=norm, 1=flash)                          
                             
59200 Num Known Devices 2 u32               x      
59202 Device 0 ID 1 u16               x      
59329 Device 127 ID 1 u16               x      
                             
59400 Network Channel 1 u16                   x  
                             
59410 Energy Scan 8   16 bytes, byte0 = chan11, takes 2212 ms                    
                             
                             
59940 Wireless to UART ping test                          
                             
59950 AIN binary / Num Samples                          
59952 AIN Max / Range                          
59953 AIN Min / JN_Chn (0-3)                          
59954 AIN Avg /                          
59955 AIN Standard Deviation /                          
                             
                             
                             
                             
59980 Set Hardware Config                       x x
59988 Range Test Mode. Num Minutes                       x p
59989 Hi Power Mode. Num Minutes                          
59990 Rapid mode timeout (Minutes) 1                        
59999 Reset (0x4C4A)                         x
                             
                             
                             
                             
60000-60999 User Mem 16         x              
61000-61999 Calibration Data 16         x              
                             
64000-64007 AES Key       n   x x            
64008-64009 IP Address for CloudDot 2 string   n   x x            
64010 Port for CloudDot 1 int   n   x x            
64016 Heartbeat       n   x x            
                             
65000 Product ID 1 int   x   x   x          
65001 Serial Number 2 int   x   x   x          
65003 Local ID 1 int   x   x   x          
65004 Hardware Version 1 int   x   x   x          
65005 Hardware Options 1 int   x   x   x          
65006 Firmware Version 1 spf   x   x   x       x  
65007 Bootloader Version 1 spf   x   x   x          
65008 Other Versions 1 spf       x              
                             
65100 Product ID 2                     x  
65102 Firmware Version 1                     x  
65103 Unit ID 1                     x x
65104 MAC (805.15.4, 8-byte) 4                     x  
65108 Serial Number 2                     x  
65110 Device Name 16                 x x x x

6 comments

Hi. I'm trying to use the Labjack U6-PRO through MODBUS to read voltages in the microvolt range. I've tried to set AIN0 channel range to +-0.01 but I can't get it to work. I've allready set it to differential by setting the AIN1 channel as the negative one. What is the value that I should send to the 1500 register to set the AIN0 range to +-0.01? Also, what would be the typical noise value for this channel using a resolution index 12 and a range +-0.01V. Thanks

 

For the 0.01V range you want a gain of x1000, and the ResolutionIndex for that is 3 (from Section 5.2.5.2).  Do a test with AIN0 & AIN1 both jumpered to GND and you should see an effective resolution of about 0.2uV (from Appendix B).

Thanks. What would be the typical resistor values to make the jumper to GND on both AIN0 and AIN1 channels?

Regards

If you mean for the noise test, I would just use wires.  0 ohms would be ideal.

If you mean that you have a floating signal and need a resistor from AIN1 to GND to provide a weak reference (Differential Readings App Note), then it depends on your signal but 10k to 1M are typical.

The reference in the modbus map above seems to be broken. (2015-06-05)

It looks like the Modbus map was broken for a short time, but is working now.