• Home
• Device Configuration/Parameterization
• Modbus/TCP Configuration

Modbus/TCP Configuration

This topic contains the following sections:

• General on Modbus/TCP
• Modbus/TCP function codes
• Modbus/TCP registers
• Modbus/TCP configuration in PLCnext Engineer

General on Modbus/TCP

Modbus/TCP is an open client/server protocol for control communication, in which various functions for read and write access to digital inputs and outputs and to registers are defined.

In the Modbus/TCP network, the device requesting information is the Modbus/TCP client, and the device supplying information is the Modbus/TCP server. The Modbus/TCP system always consists of one client that triggers the request and initiates communication with one or more servers (a Modbus/TCP server cannot initiate communication to a Modbus/TCP client). Each server is accessed by a unique address (Unit ID).

After the connection between the client and server is established, the client device initiates a transaction (request for information) and sends it to one or more Modbus/TCP servers located on the network. The Modbus/TCP server then processes the request (i.e., reads from and writes to Modbus/TCP registers) and sends back a response. Each client request consists (amongst others) of a server address, a function code defining the requested action from the addressed server, and a checksum (defines the end of the request). If no error occurs, the server responses by supplying the data as requested or by confirming that the action requested by the Modbus/TCP client was carried out. The server response (message) contains the server's address, the function code (same function code as in the request) data, and a checksum.

Further Info This topic does not explain in detail how the Modbus/TCP protocol works. For detailed information on the Modbus/TCP protocol see www.modbus.org.

Modbus/TCP function codes

The Modbus/TCP protocol defines several function codes that are used to access the Modbus/TCP registers. The function codes define the message type and the action (read or write data over the Modbus/TCP network) to be performed on the Modbus/TCP server. In PLCnext Engineer, the following function codes are implemented from the standard Modbus/TCP protocol:

Function code	Function name	Description
FC01	Read Coils	Read the status (ON or OFF) of 1 to 2000 contiguous coils of the server.
FC03	Read Holding Registers	Read one or more output holding registers (1 register = 2 bytes).
FC04	Read Input Registers	Read from 1 to 125 contiguous input registers of the server.
FC05	Write Single Coil	Write a single bit output to ON (sets the bit to 0xFF00) or OFF (bit = 0x0000).
FC06	Write Single Register	Write a single input register or output register.
FC15	Write Multiple Coils	Write a single bit output to ON (sets the bit to 0xFF00) or OFF (bit = 0x0000) for each coil in a sequence of coils.
FC16	Write Multiple Registers	Write a block of contiguous input or output registers (1 to 123 registers).
FC23	Read/Write Multiple Registers	Performs a combination of one read operation and one write operation in a single Modbus/TCP transaction. The write operation is performed before the read operation.

Modbus/TCP registers

In the Modbus/TCP protocol data to be transmitted or received is organized in registers which are accessed by a specific address. All data is stored in coil registers (1-bit), discrete input registers (1-bit), holding registers (16-bits), and input registers (16-bits). For identification of the variables on the server, register addresses are used. The register address is a 16-bit unsigned integer which is transmitted with every Modbus/TCP request triggered by the client. The following table shows the address ranges, the corresponding data types that can be stored in it and the read/write permissions of the data types (read permission = register can be read by the client; write permission = client can write to the register).

Address range (dec)	Modbus/TCP data type (register type)	Access
00001...09999	Coil	Read/Write
10001...19999	Discrete input	Read-only
30001...39999	Input register	Read-only
40001...49999	Holding register	Read/Write

Further Info See the topics "Configuring Modbus/TCP Remote Servers" and "Configuring the Modbus/TCP Local Server" for details how to configure the registers for a remote and local Modbus/TCP server.

Modbus/TCP configuration in PLCnext Engineer

Note The configuration of the Modbus/TCP client and the Modbus/TCP remote servers is only supported for PLCnext Technology targets with a firmware version 2024.6 or newer. Refer to the PLCnext Info Center regarding Modbus/TCP support for specific controllers.

Note The configuration of the Modbus/TCP local server is only supported for PLCnext Technology targets with a firmware version 2026.0 or newer. Refer to the PLCnext Info Center regarding Modbus/TCP support for specific controllers.

Note The Modbus Client TCP service must be enabled on the WBM page 'System Services' of the controller to configure Modbus communication.

Note Modbus/TCP client and server devices are provided in a separate library named Modbus. In order to be able to use the Modbus/TCP devices in the project, the 'Modbus' library has to be integrated in the COMPONENTS area in the project (see the topic "Adding libraries" for details).

In PLCnext Engineer, configuration of the Modbus/TCP client, the Modbus/TCP remote servers and the Modbus/TCP local server (embedded server of PLCnext Technology controllers; available as for firmware version 2026.0 or newer) is done with the editors available for the PLANT nodes 'Modbus TCP Client' (client and remote servers) and 'Modbus TCP Server' (local server). The Modbus/TCP client and the Modbus/TCP local server can be used independently of each other or in combination with each other on the controller. In the editors, you: