The DL3500 can be configured as a Modbus network "Master". In this mode it enables SLC’s and other devices on
a DH-485 network to initiate various commands to read and write coils, inputs and registers of slave devices on a
Modbus network. The Modbus interface can be set for RS232 or RS422/RS485. Typical DH-485 stations that can
communicate with Modbus via the DL3500 include devices such as PLC3’s, PLC5’s, SLC5/03’s, PCs, HMIs and
other intelligent OEM devices.
(Now referred to as PLC’s in this document)
Communication between Modbus and the DL3500 must be initiated from a DH-485 PLC.
The DL3500 must be the only Master on the Modbus network and does not require a Modbus address. The DL3500
is an active station on DH-485 and requires a unique DH-485 station address number.
The DL3500 can accept
PLC3 Word Range Read/Write or PLC5 Typed Read/Write message commands from any station on the DH-
485 network.
The Destination Data Table Address or TAG is normally used to address a specific File and Word in another PLC
on the network. This address is interpreted by the DL3500 in a specific way and permits data to be mapped from a
PLC and a Modbus slave device. This allows the PLC programmer to directly address a specific register in a
Modbus slave device without any previous configuration being necessary in the DL3500.
1.1 ADDRESS MAPPING BETWEEN A-B AND MODBUS
The design of the DL3500 Modbus Master and the PLC message command structure allows the DL3500 to use the
contents of the Destination Data Table Address in the PLC for direct address mapping to Modbus. The DL3500
decodes the Destination DT Address to access to various Modbus Slave stations, commands and addresses. The
actual Modbus station number and addresses ranges that can be accessed depends on the PLC type, DH-485
message type and Programming software used.
In the configuration software the type of PLC used is selected. See below.

Modbus Parameters-DL32 V3.1
Destination (Target) Data Table Address Decoding Options for PLC5 Type commands (Used by SLC’s and PLC’s):
• SLC’s-(NXYY:Z) – If allowed to enter 999:9999 to have access to all Modbus registers and Coils for
slaves 1-99.
o Also used for PLC’s and other devices
• SLC’s-(NXYZ:Z) – if allowed to enter 999:999 to have access to all Modbus registers and Coils for slaves
1-9.
o Also used for PLC’s and other devices
• MicroLogix’s and SLC’s-(NYXZ:Z) – If only allowed to enter 255:255 to have access to Modbus registers
and Coils from 1 to 9255, for slaves 1-3.
o Note: Registers and Coils – 1-255, 1000-1255, 2000-2255, etc
o Y =0 for Slave 1, 1 for Slave 2, 2 for Slave 3
1.1.1 DESTINATION DATA TABLE ADDRESS FORMAT
If a PLC is being used to generate messages for the DL3500 to convert and send to a Modbus network, values are
entered into the Destination Data Table Address of the PLC’s DH-485 Message Command in the format below.
MMI’s and other applications would have a similar destination address structure for reading and writing data to
from a PLC - refer to OEM application specific documentation.
When a PLC is communicating with other devices over the DH+ network, the destination data table address
(DDTA) has different meanings depending on whether it is communicating with another PLC or if it is
communicating with a DL3500 Modbus Master. Below are descriptions of the different meanings for the DDTA.
The usual format of destination data table address (DDTA) is : X y : z
When communicating with another PLC over DH-485, the DDTA has the following meaning:
• X = File type (single alphabetic character)
• y = File number (0 - 63, 0-255, 0 - 999 and 0 - 9999 depends on PLC type)
• z = Word number (0 - 255, 0 - 999 or 0 - 9999 depends on PLC type)
If the same destination address is received by a DL3500 Modbus Master, the DDTA means the following :
• X = Modbus Command i.e. Modbus commands 01 to 06, 15 and 16 (depends on if you are
accessing Coils., Status words or Registers.
• y = Modbus slave station address i.e. max Modbus range 1 - 255
• z = Modbus (bit/register) address i.e. max Modbus range 1 - 9999)
o z = Sub-function code for Modbus 08 Diagnostic Command
NOTE: Using PLC3 and PLC5 have slightly different definitions for the Xy portion.
PLC3 commands:
• allow the X to be sent as different file type to designate different Modbus Address Ranges and
Commands. I.E. N=4x registers, B=0x coils
PLC5 commands:
• do not allow the X to be sent as different file types so the y:z has to be decoded to access the different
Modbus Addresses (registers and coils)
1.2 DH-485 AND MODBUS COMMANDS
1.2.1 DH-485 MESSAGE COMMANDS
The DL3500-DH-485 set to Modbus Master Mode can generate Modbus protocol functions on receipt of the following DH-485 message commands :
• PLC-3 Word Range Read or Word Range Write Commands
• PLC-5 Typed Read or Typed Write Commands
• PLC-5 Word Range Read and Writes
A-B PLCs can generate the following commands:
• SLC’s PLC-5 Typed Read/Write Commands
• PLC-3 PLC-3 Word Range Read/Write Commands
• PLC-5 PLC-3 Word Range Read/Write Commands and PLC-5 Typed Read/Write Commands
1.2.2 MODBUS COMMANDS
The Modbus commands and addresses that can be generated depend on the specific DH-485 message command
received. The DL3500-DH-485 in Master Mode is designed to work with DH-485 message commands including
PLC-5 Typed Read and Write and PLC-3 Word Range Read and Write. Use the PLC-3 Word Range Read and
Write commands whenever possible because the larger address field of these commands provides the additional
flexibility necessary to generate the full range of Modbus commands and addresses.
1.2.3 PLC-3 WORD RANGE COMMANDS (PLC-3’s and 5’s)
MODBUS DATA AND CONTROL COMMANDS USING PLC-3 WORD RANGE READ / WRITE COMMANDS
On receiving a PLC-3 Word Range Read or Word Range Write Message Command (MC) a DL3500 Modbus
Master decodes the command’s Destination Data Table Address (DDTA) File type (character). Then, dependent on
whether the DH-485 message is a read or a write it can generate the following Modbus command as below:
Note:
1. For the Modbus 05 command set the first word of data in the PLC data table to FF00 (hex) to turn the
coil
ON and 0000 to turn the coil
OFF.
1.2.3.1 MODBUS DIAGNOSTICS COMMANDS
MODBUS DIAGNOSTIC COMMANDS USING PLC-3 WORD RANGE R/W COMMANDS
1.2.4 PLC-5 TYPED R/W & WORD RANGE R/W (PLC-5’s and SLC’s)
MODBUS DATA AND CONTROL COMMANDS USING PLC-5 TYPED READ / WRITE COMMANDS
On receiving a PLC-5 Typed Read or Word Range Write Message Command (MC) a DL3500-DH-485 Modbus
Master decodes the command’s Destination Data Table Address (DDTA) File type (character). Then, dependent on
whether the DH-485 message is a read or a write it can generate the following Modbus command :
1.2.4.1 PLC5 TYPED COMMANDS USING NXYY:Z DECODE
Used if allowed to enter 999:9999, this will allow access to all Modbus registers and Coils for slaves 1-99.
Note:
• Z = 0-9,999 for the Modbus Register
.
• Leave out Leading 0’s in Destination Data Table
.
1.2.4.2 PLC5 TYPED COMMANDS USING NXYZ:Z DECODE
Used if allowed to enter 999:999, this will allow access to all Modbus registers and Coils for slaves 1-9.
Note:
• Z = 0-9,999. The ones digit of the XYZ is used for the Thousands digit of the
Modbus Register
• Leave out Leading 0’s in Destination Data Table
1.2.4.3 PLC5 TYPED COMMANDS USING NYXZ:Z DECODE
Used if allowed to enter 255:255, this will allow access to certain Modbus registers and Coils for slaves 1-3.
Note:
• MicroLogix’s and SLC’s-(NYXZ:Z) – If only allowed to enter 255:255 to have access to Modbus
registers and Coils from 1 to 9255, for slaves 1-3.
o Note: Registers and Coils – 1-255, 1000-1255, 2000-2255, etc
o Y =0 for Slave 1, 1 for Slave 2, 2 for Slave 3
• Leave out Leading 0’s in Destination Data Table
1.2.4.4 MODBUS DIAGNOSTIC COMMANDS
MODBUS DIAGNOSTIC COMMANDS USING PLC-5 TYPED READ / WRITE COMMANDS
A) Diagnostic Write Commands
Write diagnostic Sub functions 1, 3, 4, 10, and 20
Use the following PLC3 Address: DXyyy: ZZZZ
Where: X = 0,1, and 9 & yyy - Slave address
ZZZZ depends on the particular sub function – See below
If X = 0 then the Write sub function is 1 and ZZZZ is the Data
X = 1 then the Write sub function is 3 and ZZZZ is the Data
X = 9 then the Write sub function depends on ZZZZ equal to 4, 10, and 20.
B) Diagnostic Read Commands
Read diagnostic Sub functions 0, 2, and 11 through 19
Use the following PLC3 Address: DXyyy: ZZZZ
Where: X = 0, 1, and 9 & yyy - Slave address
ZZZZ depends on the particular sub function – See below
If X = 0 then the Read sub function is and ZZZZ is the Data
X = 9 then the Read sub function depends on ZZZZ equal to 2 and 11 through 19.
1.2.5 BROADCAST COMMAND
A-B’s DH-485 network does not typically support Broadcast. However, using a PLC message command with the
Destination Data Table Address containing a File Address of 0 in the write commands specified in sections 1.3.1
and 1.3.2 above will generate a Modbus Broadcast command to all Modbus Slave stations. The DL3500-DH-485
will not get an “ACK” response to a Broadcast command from any Modbus slave device.
NOTE : THIS IS NOT SUPPORTED FOR SECTION 1.2.4.3 THE PLC5 TYPED COMMANDS USING NYXZ:Z DECODE OPTION
1.3 DH-485 MESSAGE COMMAND
To read and write to slave devices on Modbus it is necessary to program DH-485 message instructions in one (or
more) active PLCs on the DH-485 network. You can use either PLC-3, PLC-5 Word Range Read / Write or PLC-5
Typed Read / Write communication commands.
Setup for the DL3500 Modbus Master using the RSLogix message instruction
Entering either a “PLC-5 Typed Read” or "PLC-3 Word Range Read" in the "Communication Command" block of
the message instruction to the DL3500-DH-485 Modbus Master and an “N” as the Destination Data Table Address
File type character will cause a Modbus function code of "03" to be generated if the message command is sent to the
DH-485 station address of a DL3500-DH-485 set to Modbus Master mode. Entering a “PLC-5 Typed Write” or
"PLC-3 Word Range Write" Master and an “N” as the Destination Data Table Address File type character will
cause the DL3500-DH-485 to generate a Modbus function code of "16".
Enter the starting address of the A-B File : Word(s) to be used for read or write in the "PLC-5 Data Table Address"
block of the DH-485 message instruction. Enter the number of words or registers to be transmitted in the "Size in
Elements" field of the message function block. Enter the DH-485 station address configured in the DL3500-DH-
485 in the "Local Node Address" field.
The Modbus command, Modbus slave station address and Modbus start address are entered in the "Destination Data
Table" field. See above sections on the decoding of the DDTA.
Check that the Modbus Slave Station address and Modbus Registers required can be entered into the specific PLC’s
Destination Data Table Address field using PLC programming software.
1.3.1 A-B SLC TO MODBUS EXAMPLE
Devices such as SLC’s can initiate PLC-5 Typed Read and Write commands to the DL3500-DH-485 over the DH-
485. The Dl3500 then issues an appropriate Modbus read or write command to read or write the data to a Slave
device on a Modbus Network.
For example a SLC initiates a PLC-5 Type Read command using an N File type in the DDTA - this is translated to a
Modbus Read Holding Register command (03). This command reads data from the Modbus Slave 4xxxx register
address (es) specified in the DDTA and writes it to the file / word(s) specified in the PLC-5 Data Table Address.
Conversely a PLC-5 Type Write command generates a Modbus Pre-set Multiple Holding Registers command (16)
which reads data from the SLC file / word(s) specified and writes it to a Modbus Slave station's 4xxxx register(s).
1.3.1.1 DH-485 TO MODBUS HOLDING REGISTERS (4X) EXAMPLES
1.4 COMMUNICATIONS SEQUENCE
The DL3500-DH-485 receives message commands from a PLC over its DH-485 port, converts them to the
appropriate Modbus message and sends them out on its serial port. The Modbus Slave response is received,
translated into an appropriate DH-485 response and then returned to the originating PLC.
Modbus Master/Slave protocol does not permit multiple messages on the Modbus network. The DL3500 processes
one message at a time out of its Modbus port, although it can handle multiple requests from PLC’s on the DH-485
network, the programmer should ensure a response is received before initiating another request. The DL3500 unit
will respond to the DH-485 interface with appropriate error messages in the event of detectable errors on Modbus
such as timeouts.
1.5 MODBUS MESSAGE DATA LENGTH CONSIDERATIONS
The following shows the maximum number of holding registers that can be sent or received in a single Modbus
message when using the DL3500 gateway. The limits are because of the different structure of Modbus and A-B DH-
485 protocols, and also due to the internal memory structure of the DL3500.
• Up to 100 Modbus Holding Registers can be read in a single transaction
• Up to 100 Modbus Holding Registers can be written in a single transaction
1.6 MODBUS MASTER USING BM85 MODBUS PLUS / MODBUS BRIDGE MUX
The DL3500-DH-485 Modbus Master will also communicate with Modicon PLCs and other devices on Modbus
Plus when connected to one of the four Modbus ports of a NW-BM85-000 Modbus Plus/Modbus Network Bridge
Mux (see DL3500 users guide for cable drawings).
If PLCs and other stations on DH-485 are required to initiate communications with one or more Modicon PLCs on
Modbus Plus then the BM85’s Bridge Mux port connecting it to the DL3500-DH-485 must be configured in Slave
mode.
The serial communications parameters for the Bridge Mux Modbus port interface to the DL3500-DH-485 must be
the same as those set in the DL3500.
1.7 DH-485 AND MODBUS - GENERAL
Each addressed slave station must be a unique address on Modbus and the DL3500-DH-485 must be the only
Master Station on the Modbus network. Any station on the DH-485 network can be a “Master” that can address any
Modbus Slave Station from 1 - 255. This means that effectively the Modbus network can have multiple A-B PLC
Modbus Masters with the DL3500 acting as a traffic cop.
Modbus (Slave) station address numbers may be the same as DH-485 station address numbers provided that all
Slave Station addresses are unique on Modbus, and all DH-485 network addresses are unique on the DH-485
network.