Modbus/TCP Server - Details
Redundancy
In a redundant WinCC OA system one Modbus Server is running on each side. The connectToRedundantHosts config entry provides two options for connecting the Modbus server to the WinCC OA system.
-
connectToRedundantHosts = 0: The Modbus Server is connected only to the local Event Manager. This means that a client has to connect to both Modbus Servers in the system and the client has to send commands to both servers, because the passive Event Manager blocks value changes.
-
connectToRedundantHosts = 1: It does not matter which Modbus Server is selected by the client. However, if the client sends commands to both servers, the commands are received twice in WinCC OA application.
The Modbus Server does not support redundant connections. If a client establishes two connections, both connections are considered as normal connection. This means a message in monitoring direction is sent on both connections. If the client sends a command on both connections, both commands are processed and forwarded to the application.
Memory areas and supported function codes
The memory of the WinCC OA Modbus/TCP server is separated into 4 areas which can be accessed via different function codes. Up to 65536 bits or registers can be used for each area.
| Memory area | Register or bit number | Access via |
| 1: Input discretes | Bit 0 - 65535 | FC2 read discrete inputs |
| 2: Coils | Bit 0 - 65535 | FC1 read coils, FC5 write single coils, FC15 write multiple coils |
| 3: Input register | Register 0 - 65535 | FC4 read input register |
| 4: Holding register | Register 0 - 65535 | FC3 read holding registers, FC6 write single register, FC16 write multiple register |
The following table contains a short description of function codes supported by the WinCC OA Modbus/TCP server.
| Function code | Code | Description |
| read coils | 1 | Reads the ON/OFF status of a discrete output. |
| read input discretes | 2 | Reads the ON/OFF status of a discrete input. |
| read multiple registers | 3 | Reads the binary content of Holding Register. |
| read input registers | 4 | Reads the binary content of input Register. |
| write coil | 5 | Sets a single coil to either ON or OFF |
| write single register | 6 | Writes a value in a holding register. |
| force multiple coils | 15 | Sets each coil in a sequence of coils to either ON or OFF. |
| write multiple registers | 16 | Writes values in multiple holding registers. |
Data types
The supported data points must be mapped to Modbus registers. The number of used registers can be defined on the UserData of each node.
For example, this is necessary if you want to represent a data point element of type int as one Modbus register. In that case the user must ensure that the data point element does not exceed the number range of the Modbus register. If a data point element which occupies more than one register is mapped, you have to ensure that the next data point element is mapped to the next free register. Overlapping mappings will result in an error message.
To define the number of used registers use either the Plantmodel Editor - Modbus tab or the CTRL function cnsSetProperty.
The Plantmodel Editor automatically sets the appropriate key on the UserData. If you use cnsSetProperty, you have to set the key "OA:DMOD" to define the number of used dyn elements and the key "OA:MOD" to define the number of used registers.
Following data types (as well as the corresponding dyn types) are supported:
| Data type | Default number of used registers |
| uint | 2 |
| int | 2 |
| float | 4 |
| bool | |
| bit32 | 2 |
| long | 4 |
| ulong | 4 |
| bit64 | 4 |
| string | |
| blob | |
| time | 4 (date/time, saved as G12DateTime) |
Data point elements of type bool or dyn_bool can only be mapped to memory area 1 or 2. All other data types can only be mapped to memory area 3 or 4.
In case of WinCC OA data types without a defined length (e.g. dyn types or string), the user must explicitly define the length when mapping to the Modbus data model.
G12DateTime format
A time data type is mapped to the Modbus memory area in the following format:
| G12DateTime (date and time, coded as four unsigned 16bit words | ||
|
[16 bits] (Motorola format) (seconds * 1000) + milliseconds |
||
|
[8 bits] Minutes |
[1 bit] DST flag |
[7 bits] Hours |
|
[3 bits] weekday (mon = 1) |
[5 bits] day of month |
[8bits] month (jan = 1) |
|
[8 bits] year of century (9 = 2009) |
[8 bits] zero-padding |
|
