Modbus TCP Server

Introduction

Modbus TCP is not based on a hierarchical structure, but on a client/server model.

Without any configuration, the embedded Ethernet port of the bus coupler supports Modbus server.

Modbus TCP Server

The Modbus server supports the Modbus requests:

Function Code Dec (Hex)	Subfunction Dec (Hex)	Function
3 (3)	–	Read holding register (%MW)
6 (6)	–	Write single register (%MW)
16 (10)	–	Write multiple registers (%MW)
22 (16)	-	Mask write register
23 (17)	–	Read/write multiple registers (%MW)
43 (2B)	14 (E)	Read device identification

Modbus TCP Configuration

To configure your TM3 Ethernet bus coupler as a Modbus TCP device, add the bus coupler. Then, select Modbus TCP IO Scanner > TM3BCEIP.

TM3 Bus Coupler Modbus TCP Registers

Zone	Access	Registers	Function
Diagnostic Zone	RO	900 - 901	Bus coupler diagnostics
	RO	930 - 931	TM2/TM3 bus and modules status
	RO	932	System state
	RO	991 - 992	Communication diagnostics
	RO	1058...1066	Ethernet communication parameters
	RO	1100...1115	TM3 bus coupler product information
	RO	2512 - 2513	TM3 bus coupler product serial number
IO Scanner Zone	RO	1...99	Subset of bus coupler module input values (first 7 modules)⁽¹⁾
	RW	101...199	Subset of bus coupler module output values (first 7 modules)⁽¹⁾
	RO	3001...3499	Bus coupler module input values (all modules)⁽¹⁾
	RW	3501...3999	Bus coupler module output values (all modules)⁽¹⁾
	RO	13001...13499	Bus coupler module input values (all modules) for use with HMI devices.
	RO	13501...13999	Bus coupler module output values (all modules) for use with HMI devices.
Direct TM3 Configuration	Refer to How to Configure: Configuration Management Registers	15000 - 16499	Allow controllers to send TM3 configuration through Modbus requests.
(1) Access to those registers returns an error when System State (register 932) is not 5 (TM3 bus controlled by modbus TCP). The values of registers 3001…3499, 3501…3999, 13001…13999 are valid only when the register 931 is 0 (Bus status OK, All module status OK).

Bus Coupler Diagnostics

Registers	Function	Description
900	Bus coupler diagnostics	Bits (0...8): Not used
		Bit (9): I/O bus runtime error
		Bits (10-11): Not used
		Bit (13): I/O bus not configured or bus configuration error
		Bits (14-15): Not used
901	I/O modules status	Bit (0...13): Status of first expansion module to status of 14^th expansion module
		Bits (14-15): Not used
		0: No error detected
		1: Error detected

TM3/TM2 Bus and Modules Status

Registers	Function	Bits	Description
930	TM3/TM2 bus and modules status	0…1 Module 1	Module status (2 bits per module): 0 hex: Module OK 1 hex: Module configuration error detected 2 hex: Module runtime error detected 3 hex: Module not present but it is optional module
		2…3 Module 2
		4…5 Module 3
		6…7 Module 4
		8…9 Module 5
		10…11 Module 6
		12…13 Module 7
		14…15 Module 8
931	TM3/TM2 bus and modules status	0…1 Module 9	Module status (2 bits per module): 0 hex: Module OK 1 hex: Module configuration error detected 2 hex: Module runtime error detected 3 hex: Module not present but it is optional module
		2…3 Module 10
		4…5 Module 11
		6…7 Module 12
		8…9 Module 13
		10…11 Module 14
		12…13	Reserved
		14…15	Bus status: 0 hex: Bus OK 1 hex: Bus configuration error detected 2 hex: Bus runtime error detected 3 hex: Bus not configured

System State

Registers	Function	Description
932	State of the system	0 hex: System is booting. 1 hex: TM3 bus is not configured. 2 hex: A TM3 configuration is being transferred. 3 hex: A valid TM3 configuration has been applied successfully. The outputs are set to 0. 4 hex: TM3 bus is controlled by EIP. 5 hex: TM3 bus is controlled by Modbus TCP IO scanner. 6 hex: TM3 bus is controlled by Web server 7 hex: Timeout on fieldbus refresh 8 hex: Firmware update in progress A hex: System state transition in progress.
933	TM3/TM2 bus configuration	Bits [0]: Modbus TCP Data consistency 0 hex: Disable 1 hex: Enable

NOTE: When Modbus TCP is enabled, the values of the status registers (900...901, 930...932) reflect the state of the TM3 Bus Coupler and connected TM3 Expansion modules. Read these status registers before starting IO exchange and take any appropriate actions that might be necessary.

Communication Diagnostic

Registers	Function	Description
991	Number of received messages	Number of messages received.
992	Number of sent messages	Number of messages sent.

Ethernet Communication Parameters

For details on how to use Registers 1050 - 1056 to configure the network configurations, refer to Configure Network Settings through Modbus Command.

Registers	Function
1050	Start or apply the network configuration. 1= Start 0= Apply
1051	IP Address HIGH word
1052	IP Address LOW word
1053	Subnet Mask HIGH word
1054	Subnet Mask LOW word
1055	Gateway Address HIGH word
1056	Gateway Address LOW word
1057	Detected error. (Refer to the errors per bit in the table below)
1058	MAC address
1059
1060
1061	IP address
1062	IP address
1063	Subnet mask
1064	Subnet mask
1065	Gateway
1066	Gateway

This table describes the errors per bit for register 1057:

Bit Field	Error bit ( 0 = No error, 1 = Error)	Description
Bit 0	Invalid IP	90.0.0.1 and 90.0.0.2 are not allowed, as they are reserved in the bus coupler for RNDIS network.
Bit 1	Invalid IP	Incorrect value for high byte. Value should not be zero. Value should not be greater than or equal to 224. Examples of invalid IP addresses: 0.xxx.xxx.xxx 224.xxx.xxx.xx 255.xxx.xxx.xxx
Bit 2	Invalid IP	Loop back is not allowed. The high byte value of IP address or high byte should not be 127. Example: IP address of 127.xxx.xxx.xxx is not allowed.
Bit 3	Invalid subnet mask	The maximum value allowed for last byte is 252. Examples of invalid subnet mask values: xxx.xxx.xxx.253 xxx.xxx.xxx.254 xxx.xxx.xxx.255
Bit 4	Invalid Subnet mask	Subnet mask must contain continuous ones, with no zero in-between. Example of invalid address: 160.0.0.0 [10100000.00000000.00000000.00000000]
Bit 5	Invalid IP	IP address should not be a broadcast address. Broadcast address is calculated by inverting the bits of subnet mask, then bitwise OR with IP address. Example: A configuration with IP address of 10.10.0.3 and subnet mask of 255.255.255.252 is invalid because the resulting broadcast address is equal to the IP address.
Bit 6	Invalid Subnet	IP class is not covered. The bitwise AND of IP address with inverted bit values of subnet mask should not be 0. Example: An IP address of 10.10.0.4 and a subnet mask of 255.255.255.252 are not allowed as IP class is not covered by subnet mask.
Bit 7	Invalid Gateway	The high byte value of the gateway address is incorrect. Zero is not allowed. 127 is not allowed. The value should be less than 224. Examples of incorrect gateway addresses: 0.xxx.xxx.xxx 127.xxx.xxx.xxx 255.xxx.xxx.xxx
Bit 8	Invalid Gateway	Gateway address of 255.255.255.255 is not allowed.
Bit 9	Invalid IP	Returns error if Gateway address is equal to broadcast address. Broadcast address is calculated by inverting the bits of subnet mask, then bitwise OR with IP address. Example of invalid configuration: IP address: 10.10.0.100 Subnet mask: 255.255.255.0 Gateway: 10.10.0.255
Bit 10	Invalid Gateway	Host ID is calculated by inverting the bits of subnet mask, then bitwise AND with gateway address. The resultant value should not be 0. Example of invalid configuration: Subnet mask: 255.255.255.192 Gateway: 10.10.0.192
Bit 11	Invalid IP	Network is not reachable. Returns error if (IP AND subnet) is not equal to (gateway AND subnet). Example of invalid configuration: IP address: 10.10.0.128 Subnet mask: 255.255.255.192 Gateway: 10.10.0.64
Bit 12	Invalid subnet	Subnet mask 0.0.0.0 is not allowed.
Bit 13	Not used	–
Bit 14-15	Status bits: indicate the status of the network settings configuration	Bit 15	Bit 14	Description
		0	0	Default value at power on.
		0	1	Bus coupler is saving the network configuration (after `0`is written to Register 1050).
		1	0	Network configuration is saved, power cycle is pending.
		1	1	Network configuration is in error or a timeout has occurred.
		Example: Without error, saving configuration: 4000 hex Configuration saved: 8000 hex Configuration timeout: C000 hex Zero subnet error: D000 hex

TM3 Bus Coupler Product Information

Registers	Function
1100	TM3 bus coupler product code
2507-2508	TM3 bus coupler product firmware version
2512-2513	TM3 bus coupler product serial number
2601	Rotary switch ONES position
2602	Rotary switch TENS position

Bus Coupler and Module Description Registers

The following table shows the registers supported by TM3 bus coupler for expansion modules:

Register	Access	Function
1100	RO	TM3 bus coupler product code
1101	RO	TM3 bus coupler software version
1102	RO	Type of expansion module 1
1103	RO	Type of expansion module 2
1104	RO	Type of expansion module 3
1105	RO	Type of expansion module 4
1106	RO	Type of expansion module 5
1107	RO	Type of expansion module 6
1108	RO	Type of expansion module 7
1109	RO	Type of expansion module 8
1110	RO	Type of expansion module 9
1111	RO	Type of expansion module 10
1112	RO	Type of expansion module 11
1113	RO	Type of expansion module 12
1114	RO	Type of expansion module 13
1115	RO	Type of expansion module 14

Bus Coupler Status and Configuration

The following table shows registers used for the Bus Coupler Status and Configuration interface:

Register	Function	Description
2502 - 2506	Reserved	Not used
2507	Firmware major revision	-
2508	Firmware minor revision	-
2512 - 2513	Serial number	-
2514 - 2515	Reserved	Not used
2518	Total number of I/O modules detected	Maximum of 14 modules
2519	Slot 0 module ID, if present	-
2520	Slot 1 module ID, if present	-
2521	Slot 2 module ID, if present	-
2522	Slot 3 module ID, if present	-
2523	Slot 4 module ID, if present	-
2524	Slot 5 module ID, if present	-
2525	Slot 6 module ID, if present	-
2526	Slot 7 module ID, if present	-
2527	Slot 8 module ID, if present	-
2528	Slot 9 module ID, if present	-
2529	Slot 10 module ID, if present	-
2530	Slot 11 module ID, if present	-
2531	Slot 12 module ID, if present	-
2532	Slot 13 module ID, if present	-
2533 - 2600	Reserved	Reserved
2601	Value of Rotary switch ONES	-
2602	Value of Rotary switch TENS	-