8
Modbus Protocol (Modbus/TCP)
Introduction
88
Manual – Fieldbus Interface DFE33B EtherNet/IP and Modbus/TCP
8 Modbus Protocol (Modbus/TCP)
8.1 Introduction
Modbus/TCP is an open protocol based on TCP/IP. It has become established as one
of the first standard solutions for industrial Ethernet interface modules for process data
transfer.
Modbus frames are exchanged via TCP/IP port 502. Every master IP address is
accepted. Modbus exclusively uses the coding "BIG ENDIAN" (Motorola data format or
high byte first).
Access is not possible via "Peer Cop". Ensure that the bus master used supports "IO
scanning".
Modbus/TCP is integrated into the DFE33B option as of firmware version .11.
8.1.1 Mapping and addressing
The logical Modbus address range includes 64 k words and is addressed using the
reference number (offset). There can be four different tables in the address range:
• Binary inputs (RO)
• Binary outputs (RW)
• Input register (RO)
• Output register (RW)
The tables can be separate or can overlap.
The DFE33B option provides the following data areas:
• A table is created for process data transfer that permits both write access (for
setpoints) and read access (for actual values).
This table begins at offset 4 and ends at offset 0FF
hex
. Depending on how the
DFE33B is used, there are 10 to 24 cyclically transmitted process data words in it.
• The process data output words from the controller are also saved in another table.
This table allows for the current setpoints to be read on one or several other clients
(e. g. visualization).
This table begins at offset 104
hex
and ends at offset 1FF
hex
.
• Parameter access is implemented in a third table.
This table begins at offset 200
hex
, ends at offset 2FF
hex
and contains four words of
the MOVILINK
®
parameter channel (see "Fieldbus Unit Profile" manual).
• The other address range of offset 400
hex
to FFFF
hex
is reserved and must not be
addressed.
The data word at offset 219
hex
(8606
dec
) is a special case that allows you to write
(and read) the timeout monitoring time.
TIP
Note the following for control systems from Schneider Electric:
The address range frequently begins at 40001
hex
. This corresponds to the value "0"
for the offset.