The Modbus protocol is widely used in industry. Unlike Modbus serial link, Modbus TCP/IP is not based on a hierarchical structure, but on a client / server model.
The transfer of information between a Modbus client and server is initiated when the client sends a request to the server to transfer information, to execute a command, or to perform one of many other possible functions.
After the server receives the request, it executes the command or retrieves the required data from its memory. The server then responds to the client by either acknowledging that the command is complete or by providing the requested data.
The Modicon M218 Logic Controller implements both client and server services so that it can initiate communications with other controllers and I/O devices, and respond to requests from other controllers, SCADA, HMIs and other devices.
Without any configuration, the embedded Ethernet port of the controller supports Modbus Server.
The Modbus Server is included in the firmware, and does not require any programming action from the user. Due to this feature, it is accessible in RUNNING, STOPPED and EMPTY states.
The Modbus TCP Client supports the following function blocks from the PLCCommunication library without any configuration:
oADDM
oREAD_VAR
oSEND_RECV_MSG
oSINGLE_WRITE
oWRITE_READ_VAR
oWRITE_VAR
For further information, see Function Block Descriptions of the PLCCommunication Library.
The Modbus Server supports the following Modbus requests:
|
Function Code Dec (Hex) |
Sub-function Dec (Hex) |
Function |
|---|---|---|
|
1 (1h) |
|
Read digital outputs (%Q) |
|
2 (2h) |
|
Read digital inputs (%I) |
|
3 (3h) |
|
Read holding register (%MW) |
|
6 (6h) |
|
Write single register (%MW) |
|
8 (8h) |
|
|
|
15 (Fh) |
|
Write multiple digital outputs (%Q) |
|
16 (10h) |
|
Write multiple registers (%MW) |
|
23 (17h) |
|
Read/write multiple registers (%MW) |
|
43 (2Bh) |
14 (Eh) |
The following table contains the Data Selection Code list:
|
Data Selection Code |
Description |
|---|---|
|
0x00 |
Reserved |
|
0x01 |
|
|
0x02 |
|
|
0x03 |
|
|
0x04 |
|
|
0x05 - 0x7E |
Reserved for other public codes |
|
0x7F |
Data Structure Offsets |
Basic Network Diagnostics
|
Field Name |
Bytes |
TR Designation |
|---|---|---|
|
Basic NW Diag Validity |
4 |
- |
|
Communication Global Status |
2 |
- |
|
Supported Communication Services |
2 |
- |
|
Status of Communication Services |
2 |
- |
|
IP Address |
4 |
IP Address |
|
Subnet Mask |
4 |
Subnet Mask |
|
Default Gateway |
4 |
Default Gateway |
|
MAC Address |
6 |
MAC Address |
|
Ether Frame Format Capability / Configuration / Operational |
6 |
Ethernet Frame Format |
|
Ether Rcv Frames OK |
4 |
Total number of Ethernet Frames received OK |
|
Ether Xmit Frames OK |
4 |
Total number of Ethernet Frames Transmitted OK |
|
Reserved |
2 |
- |
|
Num MB Open Server Connections |
2 |
Num_Open_ServerCnx |
|
Num MB Error Msgs Sent |
4 |
Num_MB_Error_Msgs_Sent |
|
Num MB Msgs Sent |
4 |
Num_MB_Msgs_Sent |
|
Num MB Msgs Rcvd |
4 |
Num_MB_Msgs_Rcvd |
|
Device Name |
16 |
Device Name |
|
IP Assignment Mode Capability / Operational |
4 |
IPAssignment ModeCapability; IPAssignmentModeOperational |
|
Total: |
78 |
|
Ethernet Port Diagnostic: Port Diagnostics Data Validity
|
Field Name |
Bytes |
TR Designation |
|---|---|---|
|
Port Diagnostics Data Validity |
2 |
- |
|
Logical/Physical Port Number |
2 |
- |
|
Ether Control Capability |
2 |
Cable Type - Duplex Status |
|
Link Speed Capability |
2 |
Speed |
|
Ether Control Configuration |
2 |
- |
|
Link Speed Configuration |
2 |
Speed |
|
Ether Control Operational |
2 |
- |
|
Link Speed Operational |
2 |
Speed |
|
Port MAC Address |
6 |
MAC Address |
|
Media Counters |
72 |
- |
|
Reserved |
46 |
- |
|
Total: |
140 |
|
Ethernet Port Diagnostic: Media Counters Diagnostic Data Validity
|
Field Name |
Bytes |
TR Designation |
|---|---|---|
|
Media Counters Data Validity |
4 |
- |
|
Num Frames Xmit OK |
4 |
Frames transmitted OK |
|
Num Frames Received OK |
4 |
Frames received OK |
|
Reserved |
60 |
- |
|
Total: |
72 |
|
Modbus TCP/Port 502 Diagnostics
Modbus TCP/Port 502 Diagnostics:
|
Field Name |
Bytes |
TR Designation |
|---|---|---|
|
Modbus TCP/Port 502 Diag Validity |
4 |
- |
|
Port 502 Status |
2 |
- |
|
Num Open Connections |
2 |
Num_Open_Cnx |
|
Num MB Msgs Sent |
4 |
Num_MB_Msgs_Xmit |
|
Num MB Msgs Received |
4 |
Num_MB_Msgs_Rcvd |
|
Num Open Client Connections |
2 |
Num_Open_ClientCnx |
|
Reserved |
2 |
- |
|
Max Num Connections |
2 |
Max_Num_Cnx |
|
Max Num Client Connections |
2 |
Max_Num_ClientCnx |
|
Reserved |
2 |
- |
|
Num MB Error Msgs Sent |
4 |
Num_MB_Error_Msgs_Sent |
|
Reserved |
102 |
- |
|
Total: |
34 + 6*N + 2 |
|
Modbus TCP/Port 502 Connection Table
Modbus TCP/Port 502 Connection Table:
|
Field Name |
Bytes |
TR Designation |
|---|---|---|
|
Connection Table Validity |
2 |
- |
|
Number of Entries (NE) |
2 |
- |
|
Starting Entry Index (SE) |
2 |
- |
|
Connection Table Entry 1 |
16 |
- |
|
Connection Table Entry 2 |
16 |
- |
|
Reserved |
... |
- |
|
Connection Table Entry N |
16 |
- |
|
Total: |
6 + 16 * N |
|
Read Device Identification Request
The table below list the objects that can be read with a read device identification request (basic identification level):
|
Object ID |
Object Name |
Type |
Value |
|---|---|---|---|
|
00h |
Vendor name |
ASCII string |
Schneider Electric |
|
01h |
Product code |
ASCII string |
Controller reference eg: TM218LDA40DR2HN |
|
02h |
Major / minor revision |
ASCII string |
aa.bb.cc.dd (same as device descriptor) |
