wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Modbus 36-15
Modbus TCP frame
MBAP header
Modbus application layer PDU (APDU)
Transaction
identifier
Protocol
identifier
Length
Unit
ID
Func.
code
Start
address
Register
count
Byte
count
Data for
register
Data for
register
A3
6E
00
00 00 0B 01
10 00 01 00 02 4 E1 24
E2 48
Request (from PLC to RTU)
A3 6E 00 00 00 06 01 10 00 01 00 02
Reply (from RTU to PLC)
FIGURE 36.14
Example Modbus transaction between the PLC and the RTU.
holding registers, this particular RTU will ignore any attempt to write to registers in this second contiguous
area. Registers in this second contiguous area should therefore be considered as being “read only.”
As may be seen from this table, the four digital inputs of the first DDI 3420 module are mapped onto
the holding register at address 5392. The least significant 4 bits of the following register at address 5393
will contain status information (short-circuit, power failure) related to these same inputs.
A Modbus master changes the outputs on the next module, the DDO 3410 with four digital outputs,
by writing the desired state to the holding register at address 0001. This DDO 3410 module uses another
two registers in the input area: the first (at address 5394) echoes the value stored in the register 0001,
while the following (at address 5395) stores the actual status of the physical outputs.
The AVI 1270 module uses the registers 5396 and 5398 to store the input voltage of each analog input,
while the other two registers, at addresses 5397 and 5399, store status information (over and undervoltage
errors and warnings). The AVO 1250 uses the registers at addresses 0002 and 0003 to receive
the voltage values that should be applied to the analog outputs, and the registers at 5400 and 5401 store
status information (over and under-voltage errors).
An example of a possible exchange of Modbus message frames between the PLC and this particular
RTU (functioning as Modbus server) is described in Figure 36.14. In this exchange, the PLC uses the
Modbus function “Write Multiple Registers” to change the analog output values stored in registers 0002
and 0003 to the values 0xE124 and 0xE248, respectively. Note that the starting address of 0002 is sent
on the wire as 0001 since this particular RTU follows the Modbus specification to the letter, and all
documentation assumes that the memory areas start at address 1, which is then sent on the wire as 0.
Acronyms
APDU
ASCII
CRC
EIA
FIFO
HMI
IP
LAN
LRC
MBAP
PLC
RTU
SCADA
TCP
TIA
Application layer protocol data unit
American Standard Code for Information Interchange
Cyclic redundancy check
Electronics Industries Association
First in first out
Human–machine interface
Internet protocol
Local area network
Longitudinal redundancy check
Modbus application protocol
Programmable logic controller
Remote terminal unit
Supervisory control and data acquisition
Transmission control protocol
Telecommunications Industry Association
© 2011 by Taylor and Francis Group, LLC