Modbus/TCP Configuration

This topic contains the following sections:

General on Modbus/TCP

Modbus/TCP is an open client/server protocol for control communication, in which various functions for read and write access to digital inputs and outputs and to registers are defined.

In the Modbus/TCP network, the device requesting information is the Modbus/TCP client, and the device supplying information is the Modbus/TCP server. The Modbus/TCP system always consists of one client that triggers the request and initiates communication with one or more servers (a Modbus/TCP server cannot initiate communication to a Modbus/TCP client). Each server is accessed by a unique address (Unit ID).

After the connection between the client and server is established, the client device initiates a transaction (request for information) and sends it to one or more Modbus/TCP servers located on the network. The Modbus/TCP server then processes the request (i.e., reads from and writes to Modbus/TCP registers) and sends back a response. Each client request consists (amongst others) of a server address, a function code defining the requested action from the addressed server, and a checksum (defines the end of the request). If no error occurs, the server responses by supplying the data as requested or by confirming that the action requested by the Modbus/TCP client was carried out. The server response (message) contains the server's address, the function code (same function code as in the request) data, and a checksum.

Further Info
This topic does not explain in detail how the Modbus/TCP protocol works. For detailed information on the Modbus/TCP protocol see www.modbus.org.

Modbus/TCP function codes

The Modbus/TCP protocol defines several function codes that are used to access the Modbus/TCP registers. The function codes define the message type and the action (read or write data over the Modbus/TCP network) to be performed on the Modbus/TCP server. In PLCnext Engineer, the following function codes are implemented from the standard Modbus/TCP protocol:

Function code Function name Description

FC01 Read Coils Read the status (ON or OFF) of 1 to 2000 contiguous coils of the server.

FC03 Read Holding Registers Read one or more output holding registers (1 register = 2 bytes).

FC04 Read Input Registers Read from 1 to 125 contiguous input registers of the server.

FC05 Write Single Coil Write a single bit output to ON (sets the bit to 0xFF00) or OFF (bit = 0x0000).

FC06 Write Single Register Write a single input register or output register.

FC15 Write Multiple Coils Write a single bit output to ON (sets the bit to 0xFF00) or OFF (bit = 0x0000) for each coil in a sequence of coils.

FC16 Write Multiple Registers Write a block of contiguous input or output registers (1 to 123 registers).

FC23 Read/Write Multiple Registers Performs a combination of one read operation and one write operation in a single Modbus/TCP transaction. The write operation is performed before the read operation.

Function code	Function name	Description
FC01	Read Coils	Read the status (ON or OFF) of 1 to 2000 contiguous coils of the server.
FC03	Read Holding Registers	Read one or more output holding registers (1 register = 2 bytes).
FC04	Read Input Registers	Read from 1 to 125 contiguous input registers of the server.
FC05	Write Single Coil	Write a single bit output to ON (sets the bit to 0xFF00) or OFF (bit = 0x0000).
FC06	Write Single Register	Write a single input register or output register.
FC15	Write Multiple Coils	Write a single bit output to ON (sets the bit to 0xFF00) or OFF (bit = 0x0000) for each coil in a sequence of coils.
FC16	Write Multiple Registers	Write a block of contiguous input or output registers (1 to 123 registers).
FC23	Read/Write Multiple Registers	Performs a combination of one read operation and one write operation in a single Modbus/TCP transaction. The write operation is performed before the read operation.

Modbus/TCP registers

In the Modbus/TCP protocol data to be transmitted or received is organized in registers which are accessed by a specific address. All data is stored in coil registers (1-bit), discrete input registers (1-bit), holding registers (16-bits), and input registers (16-bits). For identification of the variables on the server, register addresses are used. The register address is a 16-bit unsigned integer which is transmitted with every Modbus/TCP request triggered by the client. The following table shows the address ranges, the corresponding data types that can be stored in it and the read/write permissions of the data types (read permission = register can be read by the client; write permission = client can write to the register).

Address range (dec) Modbus/TCP data type (register type) Access

00001...09999 Coil Read/Write

10001...19999 Discrete input Read-only

30001...39999 Input register Read-only

40001...49999 Holding register Read/Write

Address range (dec)	Modbus/TCP data type (register type)	Access
00001...09999	Coil	Read/Write
10001...19999	Discrete input	Read-only
30001...39999	Input register	Read-only
40001...49999	Holding register	Read/Write

Further Info
See the topic "Configuring Modbus/TCP Servers" for details how to configure the registers for a Modbus/TCP server.

Modbus/TCP configuration in PLCnext Engineer

In PLCnext Engineer, configuration of the Modbus/TCP client and servers is done with the editors available for the Modbus TCP PLANT node (node is only available if your configuration contains a controller with an integrated Modbus/TCP controller). Here you:

Configure the Modbus/TCP client
Insert Modbus/TCP servers using the client's station editor and edit the client's data list.
Configure the Modbus/TCP servers
Configure the Modbus/TCP server settings and server registers.