Siemens SIMATIC S7-1200 - Page 1167

Communication processor and Modbus TCP
13.5 Modbus communication
S7-1200 Programmable controller
System Manual, V4.2, 09/2016, A5E02486680-AK
1167
Table 13- 53 Write data functions: Write remote I/O and modify program data
Modbus function code
Write slave (server) functions - standard addressing
05
Write one output bit: 1 bit per request
06 Write one holding register: 1 word per request
15
Write one or more output bits: 1 to 1968 bits per request
16 Write one or more holding registers: 1 to 123 words per request
● Modbus function codes 08 and 11 provide slave device communication diagnostic
information.
● Modbus function code 0 broadcasts a message to all slaves (with no slave response).
The broadcast function is not available for Modbus TCP, because communication is
connection based.
Table 13- 54 Modbus network station addresses
Station
Address
RTU station
Standard station address
1 to 247
Extended station address 1 to 65535
TCP station
Station address
IP address and port number
Modbus memory addresses
The actual number of Modbus memory addresses available depends on the CPU model,
how much work memory exists, and how much CPU memory is used by other program data.
The table below gives the nominal value of the address range.
Table 13- 55 Modbus memory addresses
Station
Address range
RTU station
Standard memory address
10K
Extended memory address
64K
TCP station
Standard memory address
10K
Modbus RTU communication
Modbus RTU (Remote Terminal Unit) is a standard network communication protocol that
uses the RS232 or RS485 electrical connection for serial data transfer between Modbus
network devices. You can add PtP (Point to Point) network ports to a CPU with a RS232 or
RS485 CM or a RS485 CB.
Modbus RTU uses a master/slave network where all communications are initiated by a
single Master device and slaves can only respond to a master’s request. The master sends a
request to one slave address and only that slave address responds to the command.