Modbus and Modbus

TCP

Client/Server communications protocol designed

by Modicon in 1979 for use with its PLCs
Openly published and free of royalties or licensing
fees
The most common industrial communications
protocol in the US
Used widely for Building Management Systems
Passes raw words of bits without processing them
Originally a serial protocol very similar to RS-485,
it now has a TCP variant
Also available as Modbus Plus, which is
proprietary to Modicon and requires specialized
hardware

Modbus and Modbus

TCP

Basic Modbus protocol does not support floating

point or ASCII
A MODBUS Request is the message sent on
the network by the Client to initiate a transaction
A MODBUS Indication is the Request message
received on the Server side
A MODBUS Response is the Response
message sent by the Server
A MODBUS Confirmation is the Response
Message received on the Client side

Modbus TCP

Modbus TCP

Basic Requirements

The Ethernet physical interface must be

present
The Modbus TCP firmware for the Ethernet
processor must be installed
V 1.117 or newer PMAC or V1.941 or newer
Turbo PMAC firmware must be installed
A user buffer of 256 or more words must
have been defined with the DEFINE UBUFFER
command
I67 must be set to a value greater than 0.

Modbus TCP
Basic Setup with PEWIN32
Pro2
-Configure->Modbus
Setup
-Set the start address - In the standard Turbo PMAC
CPU/memory configuration (Option 5C0), this address
will be $010700
-The software will automatically set I67 to the correct
value The book says it will do so after setting it equal
to any number > 0, then SAVE and $$$, but this does
not always work
-You must choose the size of the buffer default is
256 words
-Press Setup Modbus Buffer button

Modbus TCP Setup

-Press Update PMAC button this will SAVE and $$$

ACC-65ETH

Set up the IP address of the ACC-65ETH as per the hardware

reference manual using the web browser and the default
address of http://192.6.94.50

Go to the Modbus TCP configuration utility in PEWIN32

Pro2
Choose the next unused Active Socket. If you are not
using a socket for PMAC interrupts, you may use Socket 1
Choose Modbus Client as the Active Mode
Set Timer 1 to 50 (250 ms)
Set the Server Address as per that set in the ACC-65ETH
Set the Timer to 1
Set the FC Command Description to 23 (read/write
multiple words)

ACC-65ETH

Set the Modbus Reference Number for the Write to 4

Set the Modbus Reference Number for the Read to 0
Set the PMAC Reference Number for the Write to 36
Set the PMAC Reference Number for the Read to 32
Set both Lengths to 4
Press the Update Command button, then the Update PMAC
button
This writes the command shown in the Command text box to
memory in the PMAC. You can check this by pointing MVARs
to the Modbus Command memory space at the start of the
Modbus Buffer space.

ACC-65ETH
Data begins at i67+$80+$10 (PMAC Reference 32=16 words
=$10)
Assuming i67=$10700:
X:$10790,0,16

Digital inputs 0-15

32

Y:$10790,0,16

24Vok input and digital inputs 16-23 33

X:$10791,0,12

ADC Input1

34

Y:$10791,0,12

ADC Input2

35

X:$10792,0,16

Digital Outputs 0-15

36

Y:$10792,0,16
37

RLY1, RLY2, Digital outputs 16-23

X:$10793,0,12
38

DAC 1

The PMAC Modbus/TCP-IP configuration

& buffer memory format
Offset
from
I67

23

X Memory

Sock #0
Mode(upper4
of 8 bits)

TBD (16 bits)

IP future

IP future

Future Spare

Future Spare

40xB

Repeat above for Sockets 1-3

Repeat above for Sockets 1-3

0xC

TBD
(8 bits)

0xD

TBD

TBD

0xE

TBD

TBD

0xF

TBD

TBD

0x1
0
0x6
9

Start of 1st Client Modbus Cmd List

Start of 1st Client Modbus Cmd List

0x8
0

Start of 16 bit Client/Server Modbus Buffer

Start of 16 bit Client/Server Modbus Buffer

TBD
(8 bits)

23

Server IP0

Period Timer
4
(8 bits)

Y Memory

TBD (8 bits)

Client
CmdListStrt
(8bits)

Server IP1

Server IP2

Period Timer 3
(8 bits)

Period Timer
2
(8 bits)

Client
CmdListEnd
(8bits)
Server IP3

Period Timer 1
(8 bits)

The PMAC Modbus/TCP-IP

configuration
& buffer memory format
The Socket Modes ( upper 4 of 8 bits):
0 - Socket NOT ACTIVE
1 - Server TCP, PMAC ASCII protocol.
IP Address = 0.0.0.0

2 - Server TCP, PMACtoClient Interrupt ASCII string.

IP Address = 0.0.0.0 Only available on
Turbo UMACs.
3 - Server Modbus/TCP-IP. IP Address not used.
4 - Client Modbus/TCP-IP. IP Address of Server.

The IP Address 192.6.94.5 is stored as:

IP0=192, IP1=6, IP2=94, IP3=5

M6703=first digit=4 for

Client
M6704=IP address
192.168.0.50
M6710 M6715 are
commands for PMAC ASCII on
Socket 0
M6716=start of FC23 for
Socket 1
M6717=end of FC23 for
Socket 1

Modbus Client Command

List Memory Format
X:23

16

X:15

Timer (3 bits)/
Function Code (5 bits)

Y:23

16

Y:15 -

Modbus Reference Count (length) PMAC Reference # (16

# (16 bits)
(8 bits)
bits)

$370000040020,$000004040024

First Word = Read Data

$37 = Timer 1, FC 23
$0000 = Modbus Reference Number = 0
$04 = Length = 4
$0020 = PMAC Reference Number = $20

$00 = no function for FC 23

$0004 = Modbus Reference Number = 0
Second Word = Write Data
$04 = Length = 4
$0024 = PMAC Reference Number = $20

Reference Numbers

The PMAC one is the offset into the PMAC

Modbus Server/Client buffer where the
Modbus data is read from or written to.
The Modbus one is sent over Modbus/TCPIP with the data. Note the PMAC &
Modbus reference numbers are actual
offsets and do not abide by the
standard Modbus reference number
where you subtract one from it to get
the offset into memory. We start at
zero and not one.

Memory Allocation

PMAC Modbus/TCP Client/Server Buffer Size is fixed at

128 x 32 bits.
Length for FC23 is fixed in 2 x Modbus Bytes = 16 bits
Length for FC2 and FC15 is in bits
Always use all 32 bits of one Modbus memory location
for one type do not use 16 bits for inputs and 16 for
outputs

Wago Modular I/O

Setting up a Wago 750-342 Modbus

TCP module and rack with a 753-512
(2 DO), a 753-502 ( 4 DI), 753-4011
(2 AO), and a 753-403 (2 AI)
Run BootPServer, and Edit BootPTab
If using no Proxy server then edit the line that starts with KeinProxy:
Wago1NoProxy:ht=1:ha=0030DE00B6DF:ip=192.168.0.52:
If using proxy then edit the line that starts with Hamburg:
Wago1Proxy:ht=1:ha=0030DE00B6DF:ip=192.168.0.52:T3=0A.01.FE
.01:

NOTE: IP address of the proxy server is in Hex

NOTE: ha parameter must match the MAC address of your 750-342

Wago Modular I/O

When addressing, first of all the more

complex modules (modules occupying 1 or
more bytes) are taken into account in
accordance with their physical order behind
the field bus coupler. As such, they occupy
the addresses starting with word 0.

Following this, the data of the other modules

(modules occupying less than 1 byte) follow,
grouped into bytes. In accordance with the
physical byte-wise order this data is used to
fill up the bytes. As soon as a full byte is
occupied by the bit-oriented modules, the
next byte is automatically started.

Wago Modular I/O

FC23, PMAC refs 40, 44, Modbus

ref 0,4
Note that Wago documentation
starts with 0, not 1
DO found at i67+$95
AO found at i67+$94
DI found at i67+$97
AI found at i67+$96

Wago Modular I/O

Data width >= 1 word/channel
Analog input modules
Analog output modules
Input modules for thermal elements
Input modules for resistance sensors
Pulse width output modules
Interface module
Up/down counter
I/O modules for angle and path
measurement

Wago Modular I/O

Data width = 1 Bit / channel

Digital input modules
Digital output modules
Digital output modules with diagnosis
(2 Bit / channel)
Power supply modules with fuse holder
/ diagnosis
Solid State power relay
Relay output modules

Automation Direct GS
Series VFD

Set IP Address using DIP switch

Set SW2 and SW3 to RS-485
Parameters to set using IE or keypad:

P 3.00: 03 (keypad stop ena) 04

(keypad stop disabled)
P 4.00: 05 (frequency determined by
RS485 interface)
P 4.04: 01 (states is to enable reverse command from
analog but when = 0 the remote RUN command dead)
P 9.00: xx (unique communication address 1-254)
P 9.01: 01 (9600 baud data transmission rate)
P 9.02: 05 (MODBUS RTU mode - 8 data bits, odd parity, 1
stop bit)

Automation Direct GS
Series VFD

download NetEdit3 from Automation Direct at:

http://www.hosteng.com/SW-Products/NetEdit3.z
ip
Insure that NWLink IPX/SPX/NetBios compatible
protocol is loaded on your PC by going to the
properties of your Ethernet connection
Run NetEdit 3 and select TC/PIP as type
Press the Scan Network Button. If this is the
first time you have talked to this device you will
see the address 255.255.255.0. Click on this
address and set to the desired network
address. This address should be in the same
range as that of the PMAC.
Now you must power the drive down and back
up. If you open NetEdit again you should now
see the drive type listed in the address.

Automation Direct GS
Series VFD

Connect to the drive using IE to set

drive parameters
Calculating Modbus Reference for the
GS-EDRV

Take the GS parameter number (for

example, 6.31 is the current error code)
Take the digits after the decimal place and
convert to hex (for 6.31 this will be $1F)
Multiply the digit(s) before the decimal by
$100 and add to the results of the previous
calculation (for 6.31 this will yield $61f
Convert this to decimal ($61f -> 1567) and
this is your Modbus Reference

Automation Direct GS
Series VFD
Command

Data Location

read frequency command

M1660
(base+
$80)

FC3

2330

set frequency command NOTE - divide by 10 to

get freq - so 500 = 50.0

m1661

FC16

2330

read run command

m1662

FC3

2331

set run command

m1663

FC16

2331

read direction command

m1664

FC3

2332

set direction command

m1665

FC16

2332

read current error code

m1666

FC3

1567

read last error code

m1667

FC3

1568

Modbus Reference

PMAC
Reference

Count
(leng
th)

Command
Type

Automation Direct GS
Series VFD

Read/Write
Hex
Speed Reference
Run Command
Direction
091CH
External Fault 091DH
Fault reset
091EH
Jog 091FH 42336
Status
2101H
Frequency cmd
Output frequency
Output current
DC-bus voltage
Output voltage
Motor RPM
2107H
Scale freq (low)
Scale freq (high)
% Load
210BH
Firmware Version

Modbus
091AH 42331
091BH 42332
42333
42334
42335
48450
2102H
2103H
2104H
2105H
2106H
48456
2108H
2109H
48460
2110H

48451
48452
48453
48454
48455
48457
48458
48465

$91a=2330
4 is used as a holder
Modbus Reference
start with 1, not 0
The correct Modbus
Reference for us is
2330, not 2331

Phoenix FL IL BK
Modbus I/O

In the demo this is a client

at 192.168.2.80 on Socket 3
FC3 with Modbus Ref 0,
PMAC Ref 6, Count 1, and
FC6 with Modbus Ref 384,
PMAC Ref 24, Count 1

Demo has 16 digital inputs mapped to M839

and 16
digital outputs mapped to M1
Demo is being set output values by the PMAC,
and
the QTERM is reading input
values

Phoenix FL IL BK
Modbus I/O

Base configuration at the module

can be done with IE

QTerm

Acting as a client in the demo

PLCs running on PMAC interpreting
command words from the client
M844 Feedrate override
M841 Command Word
M846 Rotary Position A
M847 Rotary Position B

QTerm
M841
1

Function
Axis Select

2
4

Feedhold
Cycle Start

8
16

Home
Estop

32
4096

Program Set
J+

8192
16384

JJ=

Exor Uniop Terminal

Client mode
or Server
mode
Basic HMI
with
developmen
t package

Exor Uniop Terminal

Exor Uniop Terminal

Modbus TCP Software

Control Panel

Allows command of the PMAC with no

code on the PMAC exactly as the DPR
Control Panel does
I69 enables (firmware 1.942 and up)
Typically set to $80 to set the start of
the panel memory space $80 long
words after the start of Modbus memory
Reserves 26 long words

PMAC/TURBO Firmware Modbus (I69) Memory Map

PMAC
Address
(I69 +)

$0

PMAC/Mo
dbus Ref.
#

0/1

X: Memory Parameter

Y: Memory Parameter

Coordinate System Feed Pot Override

Enable

Motor/Coordinate System Enable

$1

2/3

Coordinate 1 System Feed Pot Override

Motor/Coordinate System 1 Request

$2

4/5

Coordinate 2 System Feed Pot Override

Motor/Coordinate System 2 Request

$3

6/7

Coordinate 3 System Feed Pot Override

Motor/Coordinate System 3 Request

$4

8/9

Coordinate 4 System Feed Pot Override

Motor/Coordinate System 4 Request

$5

10/11

Coordinate 5 System Feed Pot Override

Motor/Coordinate System 5 Request

$6

12/13

Coordinate 6 System Feed Pot Override

Motor/Coordinate System 6 Request

$7

14/15

Coordinate 7 System Feed Pot Override

Motor/Coordinate System 7 Request

$8

16/17

Coordinate 8 System Feed Pot Override

Motor/Coordinate System 8 Request

$9

18/19

Reserved

Reserved

$A

20/21

Reserved

Reserved

$B

22/23

Reserved

Reserved

$C

24/25

Reserved

Reserved

$D

26/27

Reserved

Reserved

$E

28/29

Reserved

Reserved

$F

30/31

Reserved

Reserved

Bit Format of Control Panel Motor/Coordinate

System Enable Word (Y:I69)

BIT

Control Panel Motor/Coordinate System Enable Mask

(Set bit to enable; PMAC clears on taking action)
0 Motor/Coordinate System # 1 + Mtr/CS offset
1 Motor/Coordinate System # 2 + Mtr/CS offset
2 Motor/Coordinate System # 3 + Mtr/CS offset
3 Motor/Coordinate System # 4 + Mtr/CS offset
4 Motor/Coordinate System # 5 + Mtr/ CS offset
5 Motor/Coordinate System # 6 + Mtr/CS offset
6 Motor/Coordinate System # 7 + Mtr/CS offset
7 Motor/Coordinate System # 8 + Mtr/CS offset

15 8 Turbo Mtr/CS offset is limited to 31 (PMAC not used)

Bit Format of Coordinate System (CS) Feed Pot

Override Enable Word (X:I69)
BIT

Set bit to enable Override, clear bit to disable

0 Coordinate System # 1 + CS offset
1 Coordinate System # 2 + CS offset
2 Coordinate System # 3 + CS offset
3 Coordinate System # 4 + CS offset
4 Coordinate System # 5 + CS offset
5 Coordinate System # 6 + CS offset
6 Coordinate System # 7 + CS offset
7 Coordinate System # 8 + CS offset

15 8 Turbo CS offset is limited to 8 (PMAC not used)

Bit Format of Motor/Coordinate System

Words (Y:I69+1 to 8)
BIT

REQUEST (1 = action requested; 0 = no action

requested)
0-7 (Reserved for Delta Tau Future Use)
8 Jog-Minus
9 Jog-Plus

(Motor Only) *
(Motor Only) *

10 Pre-Jog - J= (Motor Only)

11 Start (RUN)

(Coord. Sys. Only)

12 Step (STEP/QUIT)
13 Stop (ABORT)
14 Home

(Coord. Sys. Only)

(Coord. Sys. Only)

(Motor Only)

15 Feed Hold (HOLD)

(Coord. Sys. Only)

* When both Jog-Minus and Jog-Plus are set, motor will stop

New Features (1.943+,

1.117+)

Add eight more direct control bits

commands:
B, K, J:*, J^*, J=*, >, <, and ^K
Read/Write an ASCII (PMAC Modbus
Address 0xF000)
Read/Write PMAC In (PMAC Modbus
Address 0x1000-0x3FFF), Mn (PMAC
Modbus Address 0x4000-0x7FFF) , Pn
(PMAC Modbus Address 0x8000-0xBFFF)
and Qn (PMAC Modbus Address 0xC0000xEFFF) using a Modbus 32 bit float data
type.

New Features (1.943+,

1.117+)

Read/Write PMAC Qn C.S. #

(PMAC Modbus Address 0xF500)
Read & Clear PMAC Modbus
Command Error Status word
(PMAC Modbus Address 0xF100)
Read/Write PMAC Modbus
Registers relative to I69 (PMAC
Modbus Address 0xF200-0xF2FF)
Read/Write PMAC Modbus Coils
relative to I69 (PMAC Modbus
Address 0xF300-0xF4FF)

Gotchas

With a non-Turbo PMAC do not do power on

phasing as it turns off background processing
long enough for the Ethernet processor to
initialize without the main processor initializing
the i67 sockets
Make sure that server Port 502 is not being
blocked by firewall software
Make sure that firewall software is not blocking
client ports (>1024, exact port dependent on
device, but different port for every open client
socket
Server vs Client in 3d party documentation
Addressing in 3d party documentation