Modbus/TCP Configuration

This topic contains the following sections:

General on Modbus/TCP

Modbus/TCP is an open client/server protocol for control communication, in which various functions for read and write access to digital inputs and outputs and to registers are defined.

In the Modbus/TCP network, the device requesting information is the Modbus/TCP client, and the device supplying information is the Modbus/TCP server. The Modbus/TCP system always consists of one client that triggers the request and initiates communication with one or more servers (a Modbus/TCP server cannot initiate communication to a Modbus/TCP client). Each server is accessed by a unique address (Unit ID).

After the connection between the client and server is established, the client device initiates a transaction (request for information) and sends it to one or more Modbus/TCP servers located on the network. The Modbus/TCP server then processes the request (i.e., reads from and writes to Modbus/TCP registers) and sends back a response. Each client request consists (amongst others) of a server address, a function code defining the requested action from the addressed server, and a checksum (defines the end of the request). If no error occurs, the server responses by supplying the data as requested or by confirming that the action requested by the Modbus/TCP client was carried out. The server response (message) contains the server's address, the function code (same function code as in the request) data, and a checksum.

Further Info
This topic does not explain in detail how the Modbus/TCP protocol works. For detailed information on the Modbus/TCP protocol see www.modbus.org.

Modbus/TCP function codes

The Modbus/TCP protocol defines several function codes that are used to access the Modbus/TCP registers. The function codes define the message type and the action (read or write data over the Modbus/TCP network) to be performed on the Modbus/TCP server. In PLCnext Engineer, the following function codes are implemented from the standard Modbus/TCP protocol:

Function code Function name Description

FC01 Read Coils Read the status (ON or OFF) of 1 to 2000 contiguous coils of the server.

FC03 Read Holding Registers Read one or more output holding registers (1 register = 2 bytes).

FC04 Read Input Registers Read from 1 to 125 contiguous input registers of the server.

FC05 Write Single Coil Write a single bit output to ON (sets the bit to 0xFF00) or OFF (bit = 0x0000).

FC06 Write Single Register Write a single input register or output register.

FC15 Write Multiple Coils Write a single bit output to ON (sets the bit to 0xFF00) or OFF (bit = 0x0000) for each coil in a sequence of coils.

FC16 Write Multiple Registers Write a block of contiguous input or output registers (1 to 123 registers).

FC23 Read/Write Multiple Registers Performs a combination of one read operation and one write operation in a single Modbus/TCP transaction. The write operation is performed before the read operation.

Function code	Function name	Description
FC01	Read Coils	Read the status (ON or OFF) of 1 to 2000 contiguous coils of the server.
FC03	Read Holding Registers	Read one or more output holding registers (1 register = 2 bytes).
FC04	Read Input Registers	Read from 1 to 125 contiguous input registers of the server.
FC05	Write Single Coil	Write a single bit output to ON (sets the bit to 0xFF00) or OFF (bit = 0x0000).
FC06	Write Single Register	Write a single input register or output register.
FC15	Write Multiple Coils	Write a single bit output to ON (sets the bit to 0xFF00) or OFF (bit = 0x0000) for each coil in a sequence of coils.
FC16	Write Multiple Registers	Write a block of contiguous input or output registers (1 to 123 registers).
FC23	Read/Write Multiple Registers	Performs a combination of one read operation and one write operation in a single Modbus/TCP transaction. The write operation is performed before the read operation.

Modbus/TCP registers

In the Modbus/TCP protocol data to be transmitted or received is organized in registers which are accessed by a specific address. All data is stored in coil registers (1-bit), discrete input registers (1-bit), holding registers (16-bits), and input registers (16-bits). For identification of the variables on the server, register addresses are used. The register address is a 16-bit unsigned integer which is transmitted with every Modbus/TCP request triggered by the client. The following table shows the address ranges, the corresponding data types that can be stored in it and the read/write permissions of the data types (read permission = register can be read by the client; write permission = client can write to the register).

Address range (dec) Modbus/TCP data type (register type) Access

00001...09999 Coil Read/Write

10001...19999 Discrete input Read-only

30001...39999 Input register Read-only

40001...49999 Holding register Read/Write

Address range (dec)	Modbus/TCP data type (register type)	Access
00001...09999	Coil	Read/Write
10001...19999	Discrete input	Read-only
30001...39999	Input register	Read-only
40001...49999	Holding register	Read/Write

Further Info
See the topic "Configuring Modbus/TCP Servers" for details how to configure the registers for a Modbus/TCP server.

Modbus/TCP configuration in PLCnext Engineer

Note
Modbus/TCP configuration is only supported for PLCnext Technology targets with a firmware version 2024.6 or newer.

Note
The Modbus Client TCP service must be enabled on the WBM page 'System Services' of the controller to configure Modbus communication.

In PLCnext Engineer, configuration of the Modbus/TCP client and servers is done with the editors available for the Modbus TCP PLANT node (node is only available if your configuration contains a controller with an integrated Modbus/TCP controller). Here you:

Configure the Modbus/TCP client
Insert Modbus/TCP servers using the client's station editor and edit the client's data list.
Configure the Modbus/TCP servers
Configure the Modbus/TCP server settings and server registers.