Libraries
9.2 Overview of Modbus communication
S7-200 SMART
System Manual, V2.3, 07/2017, A5E03822230-AF
473
Overview of Modbus communication
STEP 7-Micro/WIN SMART and the S7-200 SMART CPUs make communicating to Modbus
devices easier by including pre-configured subroutines and interrupt routines for Modbus
RTU communication through the serial ports of the CPUs.
Modbus addresses are five-to-six digit numbers that indicate the data type as well as the
address value.
Modbus RTU master addressing
Modbus RTU master instructions map the address to the correct functions to send to the
slave device. (The address corresponds to the Addr input parameter of the
MBUS_MSG/MB_MSG2 (Page 483) instruction.) The Modbus address definitions are as
follows:
● 00001 to 09999 are discrete outputs (coils)
● 10001 to 19999 are discrete inputs (contacts)
● 30001 to 39999 are input registers (generally analog inputs)
● (40001 to 49999) and (400001 to 465535) are holding registers
All Modbus addresses are one-based, meaning that the first data value starts at address
one. The actual range of valid addresses depends on the slave device. Different devices
support different data types and address ranges.
Modbus RTU slave addressing
The Modbus RTU slave instructions support the following addresses:
● 00001 to 00256 are discrete outputs mapped to Q0.0 - Q31.7.
● 10001 to 10256 are discrete inputs mapped to I0.0 - I31.7.
● 30001 to 30056 are analog input registers mapped to AIW0 - AIW110.
● 40001 to 49999 and 400001 to 465535 are holding registers mapped to V memory.