Overview Modbus TCP Slave


With this function block the controller becomes a Modbus TCP slave (server). A third-party system acting as Modbus master, e.g. a building management system, a PLC, an energy manager or an inverter, can read values from the controller and write values into it.

Each input and output of the block corresponds to one variable and occupies 1, 2 or 4 Modbus registers, depending on the settings:
  • Inputs are the values the master reads. The master receives the current value of the connected variable.
  • Outputs are the values the master writes. The written value is sent to the connected variable and is thus available in the program, in the visualisation and on the bus.
Variables must be connected to the inputs and outputs. Internal connections to other blocks are not possible because the value is carried by the variable. An input without a variable returns 0 to the master.

Supported function codes:
  • FC 3: Read Holding Registers – reads inputs
  • FC 4: Read Input Registers – reads inputs (same values as FC 3)
  • FC 6: Write Single Register – writes one output
  • FC 16: Write Multiple Registers – writes one or more outputs
No Modbus ID (unit ID) needs to be set; the controller answers every ID. Addressing is done via the IP address of the controller and the TCP port.

A block can have up to 64 inputs and outputs. If more values or different data types are needed, create several blocks with different start addresses. All blocks with the same port together form one slave; blocks with different ports are separate slaves. A disabled block is not answered.

After a change of the parameters or of the connected variables the slave restarts after about 5 seconds. Existing connections are closed; the master has to reconnect.

Inputs
Address Read One input per variable. The pin is labelled with its register address (e.g. 100), the tooltip reads “Read 100”. The master reads the value with FC 3 or FC 4, at any time and without any action of the program.
Not connected: the master reads 0.

Outputs
Address Write One output per variable, labelled with its register address (tooltip “Write 100”). When the master writes with FC 6 or FC 16, the value is sent to the connected variable immediately. Whether the value is treated as signed depends on the data type of the connected variable.
Not connected: the master receives a valid response, but the value is not passed on anywhere.

Parameters
Number of IO Number of inputs and outputs, 1 to 64. There are always as many inputs as outputs. Input and output with the same number have the same register address: reading returns the input, writing sets the output.
TCP port TCP port on which the slave accepts connections, 1 to 65535. Default is 502, the standard port for Modbus TCP. Blocks with the same port share one slave. The port must not be used by another service of the controller, e.g. 10001 (Studio/APP), 80/443 (web interface) or the port of the Network API. If the runtime runs under Linux without root privileges, only ports from 1024 upwards are possible.
Register data type Integer or Float (floating point). Applies to all inputs and outputs of the block. The connected variables are converted and therefore do not need to have the same data type. With Integer, decimal places are truncated (21.7 becomes 21). Float is only possible with 2 or 4 registers per variable; with 1 register the value is always transferred as integer.
Registers per variable Number of registers per input and output:
  • 1: 16 bit, integer
  • 2: 32 bit, integer or float (IEEE 754 single precision)
  • 4: 64 bit, integer or float (IEEE 754 double precision)
First register address Register address of input and output 1, 0 to 65535. The others follow at intervals of “Registers per variable”.

See also common parameters of all function blocks.

Addressing and data format
The register address of an input or output is:

Address = First register address + (number − 1) × registers per variable

Addresses are counted from 0, as they appear in the telegram. Some masters count from 1 or use the 4xxxx notation for holding registers. There, address 100 has to be entered as 101 or 40101.

Rules for a request:
  • The request must start at the start address of a variable. A request starting in the middle of a variable returns the registers from the beginning of that variable; the values are then shifted.
  • The register count should be a multiple of “Registers per variable”. When reading, exactly the requested registers are returned; a variable that is cut off at the end only with its first registers. When writing, only complete variables are taken over.
  • A request must not extend beyond the last input or output of the block and must not span several blocks, even if their addresses are contiguous.
Byte order is big endian, the most significant register comes first (no word swap, often called “ABCD”). This corresponds to the Modbus standard. Some masters call this “high word first”.

Registers per variable Integer Float
1 16 bit: −32768 … 32767, read as unsigned 0 … 65535 not possible, transferred as 16-bit integer
2 32 bit: −2147483648 … 2147483647 32 bit, about 7 significant digits
4 64 bit 64 bit, about 15 significant digits

Examples
Example 1 – states and counters, 1 register: First register address 100, registers per variable 1, data type Integer. Input and output 1 have address 100, 2 has 101, 3 has 102 etc. A switching state is read as 0/1, a setpoint of 21 °C as 21.

Example 2 – temperatures with decimals, 2 registers: First register address 100, registers per variable 2, data type Float. Input and output 1 have address 100 (registers 100 and 101), 2 has 102, 3 has 104 etc. The value 22.5 is stored as 0x41B4 0x0000 in the two registers. In the master select “float 32 bit, big endian” and read 2 registers each starting at address 100.

Example 3 – meter readings, 4 registers: First register address 0, registers per variable 4, data type Float. Input and output 1 have address 0, 2 has 4, 3 has 8 etc. Suitable for large energy meter readings that would not be precise enough with 32 bit.

Example 4 – telegram: The master reads input 1 from example 2 (FC 3, 2 registers from address 100, transaction 1, unit ID 1). All values hexadecimal:

Request:  00 01 00 00 00 06 01 03 00 64 00 02
Response: 00 01 00 00 00 07 01 03 04 41 B4 00 00

After function code 03 the response contains the byte count 04 followed by the two registers with the value 22.5. If an address outside the block is requested, the response is
00 01 00 00 00 03 01 83 02 (exception 02).

Example 5 – different data types: An energy manager is to read switching states and power values. Block A: Integer, 1 register, first address 0, 20 IO → addresses 0 to 19. Block B: Float, 2 registers, first address 1000, 10 IO → addresses 1000, 1002 … 1018. The master polls the two ranges separately.

Limits
  • Reading: at most 125 registers per request; writing with FC 16: at most 123 registers per request (Modbus standard). Larger requests are answered with exception 03.
  • FC 6 writes exactly one register and is therefore only useful with 1 register per variable. With 2 or 4 registers the output takes the 16-bit value as a whole number. Use FC 16 instead.
  • At most 64 inputs and outputs per block.
  • At most 32 simultaneous connections per port.
  • Coils and discrete inputs (FC 1, 2, 5, 15) are not supported. Switching states are transferred as registers with 0/1.
  • Every write to an output with a KNX variable creates a telegram on the bus. The master should therefore write values only on change, not cyclically.

Troubleshooting
The telegrams of the slave can be monitored in the Studio with the Modbus SL button in the status bar: direction (I/O), timestamp and content in hex. Rejected requests are additionally logged by the controller with the requested address, e.g. READ REGISTER: UNKNOWN REGISTER, ADDRESS: 99.

Observation Cause and remedy
Master cannot connect
  • The port in the master does not match the TCP port parameter.
  • The port is used by another program or another service of the controller. The controller then reports ERROR BIND PORT and retries every 5 seconds. Choose a different port.
  • Wrong IP address, firewall or separate network.
  • Block disabled, on a disabled page, or project not transferred to the controller.
  • More than 32 connections: the controller reports MAXIMUM CONNECTIONS. The master often opens a new connection for every request without closing the old one.
Connection drops briefly After every change of parameters or variables the slave restarts. The master should reconnect automatically.
Exception 01 (Illegal Function) The function code is not supported, e.g. coils (FC 1/5). Select holding registers (FC 3/16) or input registers (FC 4) in the master.
Exception 02 (Illegal Data Address)
  • The address is outside all blocks on this port. The most common cause is an offset of 1: the master counts from 1 or uses the 40001 notation.
  • The request extends beyond the last input/output or spans two blocks. Increase the number of IO or split the request.
  • When writing, the register count is smaller than “Registers per variable”.
Exception 03 (Illegal Data Value) Too many registers in one request (reading more than 125, writing more than 123) or an incomplete write telegram. Split the request in the master.
Values are nonsensical, e.g. very large numbers
  • Data type or register count in the master do not match the block (float instead of integer, 16 instead of 32 bit).
  • Word swap enabled in the master. The slave sends the most significant register first.
  • The request does not start at the start address of a variable (with 2 registers e.g. 101 instead of 100).
Value is always 0 No variable is connected to the input, or the variable has not received a value yet.
Decimal places are missing Data type Integer truncates. Use Float with 2 registers or scale the value in the program (e.g. × 10).
Written value does not arrive
  • No variable is connected to the output.
  • FC 6 was used with 2 or 4 registers. Use FC 16.
  • The address of an input was written, but the corresponding output has no variable. Inputs cannot be written.