- MODBUS is a non-real time & media-independent communication protocol

- It is an open-source protocol, so there are many devices that support Modbus i.e.
SCADA, HMI, Power Meters, fans, mass flow meters, frequency drive level and
temperature transmitters and others.
- MODBUS TCP and PROFINET can live with each other

- The Modbus “Slave Address” field usually used on MODBUS Serial Line is replaced by a
single byte “Unit Identifier” within the MBAP Header. The ‘Unit Identifier’ is used to
communicate via devices such as bridges, routers and gateways that use a single IP
address to support multiple independent MODBUS end units.

- When the Master sends a message to the Slave, it is the function code field which
informs the server of what type of action to perform.

- All MODBUS requests and responses are designed in such a way that the recipient can
verify that a message is finished. For FCs where the MODBUS PDU has a fixed length,

Unrestricted
 the FC alone is sufficient. For function codes carrying a variable amount of data in the
request or response, the data field includes a byte count.

- When MODBUS is carried over TCP, additional length information is carried in the
MBAP header to allow the recipient to recognize message boundaries even if the
message has been split into multiple packets for transmission. The existence of explicit
and implicit length rules, and use of a CRC-32 error check code (on Ethernet) results in
an infinitesimal chance of undetected corruption to a request or response message.

- PROTOCOL DATA UNIT

- Data Volume for Modbus RTU with SIMATIC S7-1500

- Type of Instruction - Number/Request (max.)

(MB_MODE)
- Bit - 249 Bytes
- Word - 248 Bytes
- https://support.industry.siemens.com/cs/ww/en/view/68202723

- Data Volume for Modbus TCP with SIMATIC

Query Bit-Request Word-Request

Read 250 Bytes 250 Bytes
Write 100 Bytes 200 Bytes
https://support.industry.siemens.com/cs/ww/en/view/78028908

Licensing

Modbus RTU

License required: S7300/S7400/ET200M (Inbuilt library in TIA Portal)

(MB_Comm_Load,Mb_Master,MB_Slave blocks)

No license required: S71200/S71500/ET200S/ET200SP (Inbuilt library in TIA Portal)

(MB_Comm_Load,Mb_Master,MB_Slave blocks)

Modbus TCP

License required: S7300/S7400 ((Inbuilt library in TIA Portal)

(MODBUSPN Block for server and client)

No license required: S71200/S71500/ET200SP CPU (Inbuilt library in TIA Portal)

(MB Server and MB client Block)

Unrestricted
 Main Resources and Concepts were delivered in order implement Modbus RTU/TCP
in SIMATIC

Modbus TCP Modbus RTU(RS485)

Transmission Speed 100 mbps 115 kbps
Master/Clients Multi-Client Mono-Master
Communication Mode Unicast Unicast/Broadcast
Distances 100m 1200m
Media Wired/Wireless Wired
Topology Star/Tree/Daisy Chain Daisy Chain
Addressing Device IP Address Slave ID

Modbus Function and

MB_MODE MB_DATA_ADDR MB_DATA_LEN
function data type

Data length (bits)

Start address: Read output bits:
0=Read per call: 01
 1 to 9999  1 to 2000
 1 to 2000

Data length (bits)

Start address: Read input bits:
0 per call: 02
 10001 to 19999  1 to 2000
 1 to 2000

Start address: Data length Read holding

(WORD) per call: register:
 40001 to 49999
0 03
 1 to 125  0 to 9998
 400001 to
465535  1 to 125  0 to 65534

Data length
Start address: Read input words:
0 (WORD) per call: 04
 30001 to 39999  0 to 9998
 1 to 125

Unrestricted
 Data length (bits) Writing an output
Start address:
1=Write per call: 05 bit:
 1 to 9999
 1  0 to 9998

Start address: Data length Write a holding

(WORD) per call: register:
 40001 to 49999
1 06
 1  0 to 9998
 400001 to
465535  1  0 to 65534

Data length (bits) Write multiple

Start address:
1 per call: 15 output bits:
 1 to 9999
 2 to 1968  0 to 9998

Start address: Data length Write multiple

(WORD) per call: holding registers:
 40001 to 49999
1 16
 2 to 123  0 to 9998
 400001 to
465535  2 to 123  0 to 65534

Data length (bits) Write one or more

Start address:
2 per call: 15 output bits:
 1 to 9999
 1 to 1968  0 to 9998

Start address: Data length Write one or more

(WORD) per call: holding registers:
 40001 to 49999
2 16
 1 to 123  0 to 9998
 400001 to
465535  1 to 123  0 to 65534

Read status word

and event counter
of the server:

The MB_DATA_ADDR and  The status

MB_DATA_LEN parameters are not word reflects
11 11 the the
evaluated when this function is
executed. processing
status (0 - not
processing,
0xFFFF -
processing).

Unrestricted
  The event
counter is
incremented
when the
Modbus
request was
executed
successfully. If
an error
occurred
during
execution of a
Modbus
function, a
message is
sent by the
server but the
event counter
is not
incremented.

Check the server

status with the
diagnostic code
Data length 0x0000 (return
80 - (WORD) per call: 08 loop test - the
server sends the
 1 request back):

 1 WORD per
call

Reset the event

counter of the
Data length server with the
81 - (WORD) per call: 08 diagnostic code
0x000A:
 1
 1 WORD per
call

3 to 10,
12 to 79, Reserved
82 to 255

Unrestricted
Unrestricted