Modbus/TCP Driver - Details

Function codes

The following table contains the possible function codes as well as a short description. If WinCC OA operates as a Slave the function code depends on the used PLC.

FC23

The Modbus function code 23 (0x17) gives the opportunity to execute an atomic write/read operation. It is defined in the Modbus specification that the write operation must be executed before the read operation in the device.

This allows to implement a command with returned data in the device, because the operation is done in atomic way.

If the function code is specified with one address, (This is the usual case like all other addresses look like.) the writing to this address executes also a reading of the same address. The corresponding input value can be received on the same DPE (I/O) address or on another DPE with the same address in Input Unsolicited mode.

It is also possible to specify a different read address by adding an optional address part /<read address>[:<length>] to the address reference, e.g. the address M.1.23.5/15 will write address 5 and read address 15.

Note: The read value can be only received on a separate input address specifying the read address of the telegram. For the example above this would be the address M.1.23.15.

To give another example, where the user want to write a blob of 10 bytes starting from address 20 and read a blob of 30 bytes from address 100. So you have to configure one Output address M.<plc number>.23.20:10/100:30 and one Input address in unsolicited mode M.<plc number>.23.100:30.

Debug levels

There are several command line debug options for the Modbus/TCP driver. These options are used to find errors during the driver operation. Information on further options can be queried with -helpdbg (see also manager options).

Transformations

A transformation converts hardware data into a WinCC OA format. The following table contains information of transformations and compatibility with the function codes. The driver controls if a data type and code are compatible. If they are incompatible an error message is displayed.

Writing bits of Holding Registers

If only several bits of the register shall be written, the unused bits are automatically set to 0, since the driver can only write the whole register. To avoid this, you have to configure all 16 bits in WinCC OA, read them and set the bits accordingly. However, the driver does not perform a read before write. This function must be implemented by the user.

Reading bits from Holding or Input Registers

There are the following methods if you want to read bits from Holding Registers and map them to single data point elements.

Method 1

Create a new data point type with a struct node of type bool. Every node you add to this struct is automatically a bool element. You have to add 16 nodes to map all 16 bits of the Holding Register.

Create a data point of this type and add an _address config to the struct node. Configure the register to read (register 10 in this example) and set function code 3 (read multiple registers) and transformation type boolean.

If you read the register the 16bit word is mapped to the 16 bool elements (b1 - b16).

Method 2

Create 16 data points of type bool and add an _address config to each data point. Configure the register to read (register 12 in this example) and set function code 3 (read multiple registers) and transformation type boolean. Define the respective sub index for each element (DPE1 = sub index 0, DPE 2 = sub index 1, ...) to map the bits to the elements.

If you configure Polling for the _address configs, note that you have to use the same poll group for every element since a register is always read as a whole. Otherwise the word is read multiple times.

Error codes

The table in this chapter describes the error codes of the PLC configuration panel (see Configuration panel of the Modbus/TCP driver).

Error Messages

The following table describes the error messages of the Modbus/TCP driver.