Modbus/TCP

This topic describes the RMC support of the Modbus/TCP Ethernet protocol. Whether you are using it to communicate with the RMC from a PLC or from a custom application, this information may be useful.

The Modicon Modbus/TCP protocol is one of the simplest protocols and has an open standard. This means the protocol specification is publicly available. See the Modicon Modbus/TCP web site at https://www.modbus.org for complete details on the protocol.

Supported Modbus function codes:

The following function codes are supported. Function codes 3 and 16 are the most common.

Read Multiple Registers (FC 3) - very common
Read Input Registers (FC 4)
Write Single Register (FC 6)
Get Diagnostics (FC 8)
Write Multiple Registers (FC 16) - - very common
Read/Write Registers (FC 23)

Addressing and Data Format

See the Modbus Addressing topic.

Implementation Notes

Word Order

RMC registers are Big-Endian 32-bit words and use two (2) holding registers each. In 32-bit words, the RMC expects that the least significant 16 bits comes first. Most Modbus masters have a setting for selecting this, since the Modbus protocol never specified this.

Zero-Based vs. One-Based

Modbus addresses that the user sees are 1-based. Since all RMC registers are 32-bit and use two Modbus registers, all RMC register addresses are therefore odd, for example 404097. However, internally to the protocol, the addresses are one-based. Some device manufacturers have confused this and mistakenly made their protocol zero-based for the user. In such cases, you will need to enter your addresses in the external device as zero-based. For example, the RMC address 408001 would be entered 408000.

Common Function Codes

Typically, only functions 3 and 16 are used. Function 23 can be used to improve performance by doing a read and write in a single function. FC 4 and 8 were included for compatibility with existing Modbus/TCP masters, but otherwise add no value to the RMC.

Unit Identifier (Slave Address)

The Unit Identifier (Slave Address) field in the Modbus/TCP is only used by routing devices. Since the Slave Address is not used by the RMC, it should be set to zero (0) in requests to the RMC.

Advanced

To create a connection with the RMC over Modbus/TCP, open a client socket with the RMC on TCP port 502. The RMC will only respond to Modbus/TCP requests on this port. Other ports are reserved or used by other protocols.
The RMC handles incoming packets on a first-in first-out (FIFO) basis, making it possible to send multiple requests and then wait for the replies.

The RMC can handle up to 64 open TCP/IP connections at once. Typically each device uses one connection at a time, allowing the RMC to be connected to up to 64 devices at once.
Multiple-register reads and writes are limited to 100 16-bit words for writes and 125 16-bit words for reads—per the Modbus/TCP specification—even though the length field in the Modbus/TCP header makes it look like larger packets would be supported.
Floating point numbers are 32-bit values and use two (2) holding registers each. The least significant 16 bits comes first.

Troubleshooting

If the data that is being read from or written to the RMC is appearing, but not correctly, the problem is likely one or more of the following:

The 16-bit word order is wrong
Find the setting in the Modbus master to swap the 16-bit word order within a 32-bit value.
Zero-based instead of one-based
The device manufacturer mistakenly made their protocol zero-based for the user. You will need to enter your addresses in the external device as zero-based. For example, the RMC address 408001 would be entered 408000.
Data Type
Make sure that if you are writing a 32-bit floating point value, that data type is correctly set in the external device to a 32-bit floating point (often called a REAL data tyep). For DINT or DWORD, the data type in the external device is commonly called 32-bit integer.

Tip: To help determine word order or zero-based errors, set an RMC variable (not the first variable, or some problem may not show up easily) to a DWORD type, then in the external device, write a hexadecimal value, such as 16#11223344 to the RMC. You will quickly see in the RMC what the problem is.