0% found this document useful (0 votes)

34 views54 pages

1678 Modbus TCP Protocol Guide

Uploaded by

behzad doroudgar

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

34 views54 pages

1678 Modbus TCP Protocol Guide

Uploaded by

behzad doroudgar

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 54

MODBUS®/TCP PROTOCOL GUIDE

For use with:

SNAP PAC R-Series Controller
SNAP PAC S-Series Controller
SNAP PAC EB Brains
OPTOEMU Sensors
SNAP Ethernet I/O Units
SNAP Simple I/O Units
SNAP Ultimate I/O Units
E1 I/O Units
E2 I/O Units
G4EB2/G4D32EB2 Brains

Form 1678-160520—May 2016

43044 Business Park Drive • Temecula • CA 92590-3614

Phone: 800-321-OPTO (6786) or 951-695-3000
Fax: 800-832-OPTO (6786) or 951-695-2712
www.opto22.com

Product Support Services

800-TEK-OPTO (835-6786) or 951-695-3080
Fax: 951-695-3017
Email: [email protected]
Web: support.opto22.com
Modbus/TCP Protocol Guide
Form 1678-160520—May 2016
Copyright © 2007–2016 Opto 22.
All rights reserved.
Printed in the United States of America.
The information in this manual has been checked carefully and is believed to be accurate; however, Opto 22 assumes no
responsibility for possible inaccuracies or omissions. Specifications are subject to change without notice.
Opto 22 warrants all of its products to be free from defects in material or workmanship for 30 months from the
manufacturing date code. This warranty is limited to the original cost of the unit only and does not cover installation, labor,
or any other contingent costs. Opto 22 I/O modules and solid-state relays with date codes of 1/96 or newer are guaranteed
for life. This lifetime warranty excludes reed relay, SNAP serial communication modules, SNAP PID modules, and modules
that contain mechanical contacts or switches. Opto 22 does not warrant any product, components, or parts not
manufactured by Opto 22; for these items, the warranty from the original manufacturer applies. Refer to Opto 22 form
1042 for complete warranty information.

Wired+Wireless controllers and brains are licensed under one or more of the following patents: U.S. Patent No(s). 5282222,
RE37802, 6963617; Canadian Patent No. 2064975; European Patent No. 1142245; French Patent No. 1142245; British Patent
No. 1142245; Japanese Patent No. 2002535925A; German Patent No. 60011224.
Opto 22 FactoryFloor, groov, Optomux, and Pamux are registered trademarks of Opto 22. Generation 4, groov Server,
ioControl, ioDisplay, ioManager, ioProject, ioUtilities, mistic, Nvio, Nvio.net Web Portal, OptoConnect, OptoControl,
OptoDataLink, OptoDisplay, OptoEMU, OptoEMU Sensor, OptoEMU Server, OptoOPCServer, OptoScript, OptoServer,
OptoTerminal, OptoUtilities, PAC Control, PAC Display, PAC Manager, PAC Project, SNAP Ethernet I/O, SNAP I/O, SNAP OEM
I/O, SNAP PAC System, SNAP Simple I/O, SNAP Ultimate I/O, and Wired+Wireless are trademarks of Opto 22.
ActiveX, JScript, Microsoft, MS-DOS, VBScript, Visual Basic, Visual C++, Windows, and Windows Vista are either registered
trademarks or trademarks of Microsoft Corporation in the United States and other countries. Linux is a registered
trademark of Linus Torvalds. ARCNET is a registered trademark of Datapoint Corporation. Modbus is a registered trademark
of Schneider Electric, licensed to the Modbus Organization, Inc. Wiegand is a registered trademark of Sensor Engineering
Corporation. Allen-Bradley, CompactLogix, ControlLogix, MicroLogix, SLC, and RSLogix are either registered trademarks or
trademarks of Rockwell Automation. CIP and EtherNet/IP are trademarks of ODVA.
groov includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org)
All other brand or product names are trademarks or registered trademarks of their respective companies or organizations.

Opto 22
Automation Made Simple.

ii Modbus/TCP Protocol Guide

Table of Contents

Chapter 1: Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Other Guides You May Need . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
For Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
About Opto 22 Devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Opto 22 Devices as Modbus Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Communication Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Overview of Modbus Communication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Understanding Opto 22 and Modbus Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Function Codes Supported . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Report Slave ID Function Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Communication Packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Exception Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Chapter 2: Configuring I/O for Modbus/TCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Module and Point Positions on I/O Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
SNAP I/O Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
SNAP Example 1: Reading/Writing Digital Point States to Coils and Inputs . . . . . . . . . . 10
SNAP Example 2: Reading/Writing Analog Point Values to Input and
Holding Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
E1 and E2 I/O Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
E1 Example: Reading/Writing Digital Point States to Coils and Inputs . . . . . . . . . . . . . . 14
E2 Example: Reading/Writing Analog Point Values to Input and Holding Registers . . 14
G4EB2 I/O Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
G4EB2 brains with G4 modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
G4EB2 brains with Quad Pak modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Configuring I/O Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Configuring I/O Points for SNAP Analog/Digital I/O Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
SNAP I/O Point Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Examples of Configured SNAP I/O Points for Modbus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Configuring I/O Points for SNAP Digital-Only I/O Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Modbus/TCP Protocol Guide iiiiii

Using I/O Point Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
SNAP Digital I/O Point Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Latches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
SNAP Analog I/O Point Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Scaling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Minimum and Maximum Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Offset and Gain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
E1 Digital Point Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Latches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
E2 Analog Point Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Scaling E2 Analog Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Minimum and Maximum Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Offset and Gain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
A Note on Analog Counts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Chapter 3: The Modbus Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Coils number. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Input Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Holding Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Notes for All Analog Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Analog Module Register Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Change in reporting analog counts for E2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Notes for High-Density Digital (HDD) Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
High-Density Digital Module Register Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Chapter 4: Accessing Other Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Why Access Other Data? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Accessible Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Modbus Master Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Determining Modbus Unit ID and Register. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Finding OptoMMP Memory Map Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Converting OptoMMP Memory Map Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Example: Reading an OptoMMP Memory Map Address . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Example: Writing to an OptoMMP Memory Map Address . . . . . . . . . . . . . . . . . . . . . . . . . 46

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

iv Modbus/TCP Protocol Guide

Chapter 1

1: Introduction

About This Guide

This guide shows you how to use Modbus/TCP to communicate with Opto 22 SNAP Ethernet-based
controllers and I/O units. The following Opto 22 products can communicate using Modbus/TCP:
I/O units with the following processors:
SNAP-PAC-R1 E1
SNAP-PAC-R1-B E2
SNAP-PAC-R1-FM G4EB2
SNAP-PAC-R1-W G4D32EB2
SNAP-PAC-R2 G4D32EB2-UPG
SNAP-PAC-R2-FM SNAP-B3000-ENET
SNAP-PAC-R2-W SNAP-ENET-RTC
SNAP-PAC-EB1 SNAP-ENET-S64
SNAP-PAC-EB1-FM SNAP-ENET-D64
SNAP-PAC-EB1-W SNAP-UP1-ADS
SNAP-PAC-EB2 SNAP-UP1-M64
SNAP-PAC-EB2-FM SNAP-UP1-D64
SNAP-PAC-EB2-W
Standalone controllers:
SNAP-PAC-S1 SNAP-PAC-S2
SNAP-PAC-S1-FM SNAP-PAC-S2-W
SNAP-PAC-S1-W
Energy monitoring units:
OPTOEMU-SNR-3V OPTOEMU-SNR-DR1
OPTOEMU-SNR-DR2

Opto 22’s groov Box and groov Server also communicate with Modbus/TCP devices, but this
guide does not apply to groov. This guide discusses Opto 22 products that act as a Modbus slave;
groov acts as a Modbus master. For information about using Modbus/TCP devices with groov, see
form 2027, groov Build and View User’s Guide.
This guide assumes that you already understand Modbus/TCP programming and communications.
Use this guide in conjunction with the Modbus/TCP specification, available at
http://www.modbus.org/specs.php. The Modicon Modbus Protocol Reference Guide may also be
useful; at the time this guide was written it was available from Schneider Electric at

Modbus/TCP Protocol Guide 11

ABOUT THIS GUIDE

http://www.schneider-electric.com/download/hk/en/details/2052374-Modbus-Protocol-Reference
-Guide-Version-J/?reference=PIMBUS300
IMPORTANT: Before you start, be sure to read form 2011, the Using Modbus Devices with Opto 22
Products technical note, available on our website. The technical note will help you get started with
Modbus and troubleshoot communication.
NOTE: For energy monitoring units, this guide is only a reference. Find primary information for Modbus
communication in form 1958, OptoEMU Sensor Communication Guide.

Contents
This guide includes the following:
Chapter 1: Introduction—Supported Modbus function codes, communication packet, and
exception codes, as well as details about this guide and Opto 22 Product Support.
Chapter 2: Configuring I/O for Modbus/TCP—How to configure and use input/output (I/O) points
and point features with Modbus/TCP.
Chapter 3: The Modbus Memory Map—Coils, inputs, input registers, and holding registers used by
most Opto 22 devices.
Chapter 4: Accessing Other Data—Ways to access data not included in coils, inputs, and registers.

Other Guides You May Need

As you work with the Opto 22 devices using Modbus/TCP, you may need to refer to the following
additional guides. All are available on our website, www.opto22.com. The easiest ways to locate one
are to click the link below or to search on its form number.

For this information See this guide Form #

Modbus basics and troubleshooting Using Modbus Devices with Opto 22 Products 2011

Installing and using SNAP PAC R-series controllers SNAP PAC R-Series Controller User’s Guide 1595

Installing and using SNAP PAC S-series controllers SNAP PAC S-Series Controller User’s Guide 1592

Installing and using SNAP PAC brains SNAP PAC Brain User’s Guide 1690

Installing and using OPTOEMU Sensors OptoEMU Sensor User’s Guide 1932

Communicating with OPTOEMU Sensors using

OptoEMU Sensor Communication Guide 1958
Modbus and Modbus/TCP

Installing and using E1 and E2 brain boards E1 and E2 User’s Guide 1563

Installing and using SNAP Ethernet, SNAP Simple,

SNAP Ethernet-Based I/O Units User’s Guide 1460
and SNAP Ultimate I/O units

Writing custom applications using the OptoMMP

protocol over Ethernet; finding OptoMMP memory OptoMMP Protocol Guide 1465
map addresses

Configuring and working with SNAP PAC controllers

PAC Manager User’s Guide 1704
and brains using the software tool PAC Manager

2 Modbus/TCP Protocol Guide

CHAPTER 1: INTRODUCTION

For this information See this guide Form #

Configuring and working with both SNAP PAC and

legacy I/O units using the software tool PAC Man- PAC Manager User’s Guide, Legacy Edition 1714
ager

For Help
If you have problems using Modbus/TCP with Opto 22 products and cannot find the help you need
in this guide or on our website, contact Opto 22 Product Support.
Phone: 800-TEK-OPTO (800-835-6786 NOTE: Email messages and phone
toll-free in the U.S. and Canada) calls to Opto 22 Product Support
951-695-3080 are grouped together and
Monday through Friday, answered in the order received.
7 a.m. to 5 p.m. Pacific Time

Fax: 951-695-3017

Email: [email protected]

Opto 22 website: www.opto22.com

When calling for technical support, you can help us help you faster if you can provide the following
information to the Product Support engineer:
• Opto 22 hardware part numbers or models that you’re working with
• Software version (available by clicking Help > About in the application’s menu bar)
• Firmware version
• Specific error messages you saw
• Version of your computer’s operating system

About Opto 22 Devices

Opto 22 devices that can communicate using Modbus/TCP include Ethernet-based I/O units, SNAP
PAC standalone controllers, OptoEMU Sensor energy monitoring units, and groov.
The term I/O unit refers to one Opto 22 mounting rack populated with I/O modules and an I/O
processor (on-the-rack controller, brain, or brain board; see processor part numbers on page 1).
Each I/O module can contain 1 to 32 I/O points, depending on the module.
Using Modbus/TCP, you can send data to and from each of these I/O points. The communication
method is described in this chapter. The coils, inputs, and registers you use for I/O point data are
described in Chapter 3.
Opto 22 Ethernet-based devices use a memory-mapped protocol (OptoMMP), which is based on
the IEEE 1394 standard. The coils, inputs, and registers described in Chapter 3 are mapped to areas
within the I/O processor’s memory map.

Modbus/TCP Protocol Guide 33

ABOUT OPTO 22 DEVICES

Although the most common use for communication between Modbus systems and Opto 22
systems is sending and receiving I/O point data on an I/O unit, you may also need to obtain other
data, from either an I/O unit or a controller. This other data, such as Scratch Pad data, exists in the I/O
unit’s or controller’s memory map and can be accessed by following the steps in Chapter 4.
In all these cases the Opto 22 device acts as the Modbus slave.

Opto 22 Devices as Modbus Master

This guide covers the use of Opto 22 devices as Modbus slaves. Opto 22 controllers and
OptoEMU Sensor energy monitoring units can also act as a Modbus master. groov always acts as a
Modbus master.
• For groov, see form 2027, groov Build and View User’s Guide.
• For OptoEMU Sensors, see form 1958, OptoEMU Sensor Communication Guide.
• For Opto 22 controllers, download a free integration kit from our website, www.opto22.com.
Choose the Modbus integration kit you need based on your controller and network.
Before you begin, be sure to read form 2011, the Using Modbus Devices with Opto 22 Products
technical note.

Communication Example
The diagram on the following page shows an example of how an Opto 22 system might
communicate with a Modbus system. This is just one example; many other configurations are
possible.
In this example, the SNAP-PAC-S1 standalone controller runs a PAC Control strategy that monitors
and controls the I/O units and all the I/O points on them. Simultaneously, the Modbus system can
exchange data with the Opto 22 system.
Because the two Ethernet network interfaces on the SNAP-PAC-S1 are independent interfaces with
separate IP addresses, the Opto 22 control network can be segmented from the computer network.
This example shows this type of segmentation, as the PC is attached to Ethernet switch #1 and the
control network is on Ethernet switch #2.
Because the Modbus/TCP hardware is also on switch #2, it can send data to and from every I/O unit
shown. In this example the Modbus/TCP software running on the PC, attached to switch #1, can
access data only from the controller; for instance, it might access data placed in the controller’s
Scratch Pad by the PAC Control strategy.
CAUTION: If you use PAC Control, use the Modbus/TCP integration kit or be careful that Modbus writes
to I/O points do not conflict with strategy logic.

If you are not using PAC Control, Modbus/TCP hardware or software on the same network segment
as I/O units can provide full control for I/O points.

4 Modbus/TCP Protocol Guide

CHAPTER 1: INTRODUCTION

Modbus Communication Example Modbus/TCP

software

Ethernet switch #1

SNAP-PAC-S1
controller (runs
a PAC Control
strategy to Ethernet switch #2 Modbus/TCP
control all I/O hardware
units)

SNAP-PAC-R1 I/O unit E1 I/O unit

SNAP-PAC-R1 I/O unit

E2 I/O unit

SNAP-ENET-S64 I/O unit

Overview of Modbus Communication

Communicating with Opto 22 Ethernet-based devices using Modbus/TCP requires four basic steps:
connect, configure, read/write, and disconnect.
When opening a TCP/IP connection to the system, you normally use port 502. (This is the default
port; it can be changed for security reasons using PAC Manager. See form1704, PAC Manager User’s
Guide, for more information.
Opto 22 devices can handle a maximum of eight connections from Modbus masters (requires
firmware R9.4B or higher—or, for E1 and E2, firmware R1.2a; lower firmware versions handle a
maximum of two connections).
For all coils, inputs, and registers listed in Chapter 3, use a slave ID (Unit ID) of 1 for the device.

Modbus/TCP Protocol Guide 55

OVERVIEW OF MODBUS COMMUNICATION

Understanding Opto 22 and Modbus Differences

Notice that Opto 22 module and point numbers on the I/O unit commonly start numbering at 0
(zero), while Modbus coil or input numbers start at 1; so Modbus coil 1 or input 1 usually equals
Opto 22 point 0 on the module in position 0 on the rack.
Also notice the way Opto 22 uses Modbus registers:

Modbus Registers Opto 22 Use Modbus Registers Opto 22 Use

Coils Digital outputs Register inputs Analog inputs

Inputs Digital inputs Holding registers Analog outputs and miscellaneous

Function Codes Supported

Opto 22 devices use the Modbus function code plus the register number to map to the appropriate
memory map address in the brain.
NOTE: Data on a SNAP PAC standalone controller can be accessed only through advanced Modbus
programming. See Chapter 4: Accessing Other Data for information.

The following table shows Modbus function codes supported for I/O units. (Function codes for a
specific I/O unit depend on the analog/digital capabilities of the brain.)
Modbus Function Definition Opto 22 Equivalent
Code (Hex)

01 Read coil status Read digital output

02 Read input status Read digital input

03 Read holding registers Read analog output

04 Read input registers Read analog input

05 Force single coil Turn on/off one digital output

06 Preset single register Write one analog output

0F Force multiple coils Turn on/off multiple digital outputs

10 Preset multiple registers Write multiple analog outputs

Report hardware and firmware revision levels

11 Report slave ID
(See below: “Report Slave ID Function Code” )

Report Slave ID Function Code

Function code 0x11, Report slave ID, returns data bytes as shown in the following table.
Bytes 1 and 2 are always in the formats shown. The 0x22 in byte 1 indicates an Opto 22 brain; 0xFF
appears in byte 2 because, since the brain is a slave, it is always running.
Byte 1 Byte 2 Bytes 3–6 Bytes 7–10 Bytes 11–14

Slave Run Hardware Version Kernel Version Loader Version

ID Indicator Month Day Year Month Day Year Month Day Year
0x22 0xFF 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01

6 Modbus/TCP Protocol Guide

CHAPTER 1: INTRODUCTION

Communication Packet
As the Modbus/TCP specification requires, Opto 22 devices use a Modbus packet inside a TCP/IP
packet. The Modbus checksum is not used; instead, the Ethernet TCP/IP link layer checksum
guarantees data. The size of the packet is limited to 256 bytes. The packet follows the standard
Modbus/TCP format.
Note: You can read a maximum of 127 input or holding registers in one command 03 or 04.

Exception Errors
If an error occurs, standard Modbus exception codes are returned in the Modbus packet. The
following table, reprinted from the Modicon Modbus Protocol Reference Guide, shows the Modbus
exception codes. If you need more information, see the Modicon documentation.

Code Name Meaning

The function code received in the query is not an allowable action for the
01 ILLEGAL FUNCTION
slave.

ILLEGAL DATA The data address received in the query is not an allowable address for the
02
ADDRESS slave.

A value contained in the query data field is not an allowable value for the
03 ILLEGAL DATA VALUE
slave.

SLAVE DEVICE FAIL- An unrecoverable error occurred while the slave was attempting to perform
04
URE the requested action.

The slave has accepted the request and is processing it, but a long duration
of time will be required to do so. This response is returned to prevent a time-
05 ACKNOWLEDGE
out error from occurring in the master. The master can next issue a Poll Pro-
gram Complete message to determine if processing is completed.

The slave is engaged in processing a long-duration program command. The

06 SLAVE DEVICE BUSY
master should retransmit the message later when the slave is free.

The slave cannot perform the program function received in the query. This
NEGATIVE code is returned for an unsuccessful programming request using function
07
ACKNOWLEDGE code 13 or 14 decimal. The master should request diagnostic or error infor-
mation from the slave.

The slave attempted to read extended memory, but detected a parity error in
MEMORY PARITY
08 the memory. The master can retry the request, but service may be required
ERROR
on the slave device.

Modbus/TCP Protocol Guide 77

OVERVIEW OF MODBUS COMMUNICATION

8 Modbus/TCP Protocol Guide

Chapter 2

2: Configuring I/O for

Modbus/TCP

Introduction
This chapter includes the following:
• Illustrations of module and point positions on I/O units and how they relate to coils, inputs, and
registers in Modbus/TCP (below)
• I/O point configuration required for communication with Modbus/TCP systems (page 17)
• Point features and how to use them with Modbus/TCP (page 25).

Module and Point Positions on I/O Units

Opto 22 I/O units are zero-based: that is, the first module position on the rack is position 0, and the
first point on each module is point 0. The number of points on a module can vary from one to 32,
depending on the module family and part number. Because of this numbering and variation,
reading and writing point data to coils, inputs, and registers can be complex.
Module and point positions are different if you are using SNAP I/O units (see below), E1/E2 I/O units
(see page 13), or G4EB2 I/O units (see page 14).

SNAP I/O Units

I/O units whose I/O processor’s part number begins with “SNAP” are called SNAP I/O units. For
example, I/O units with a SNAP-PAC-R1, SNAP-EB1, or SNAP-ENET-S64 as the I/O processor are all
SNAP I/O units.
SNAP mounting racks may hold 4, 8, 12, or 16 I/O modules. Although these modules may be analog,
digital, or serial, only analog and digital I/O apply to Modbus/TCP communication. Each module
contains 1 to 32 points (channels), depending on the module. Examples of modules are shown in
the following diagram.

Modbus/TCP Protocol Guide 99

MODULE AND POINT POSITIONS ON I/O UNITS

Module position 0, 4-ch digital:

Points: 3 2 1 0

Module position 6, high-density

digital:
Points: 31 0 Module position 8, analog:
Points: 7 6 5 4 3 2 1 0

Module position 12, analog:

Points: 1 0
Module position 14, serial:
Ports: B A

The following examples show how SNAP module and point numbers relate to Modbus coils, inputs,
and registers.

SNAP Example 1: Reading/Writing Digital Point States to Coils and Inputs

The following table shows the coils or inputs you would read or write to for point states on SNAP
4-channel digital modules.
NOTE: For high-density digital modules (digital modules with more than four points), different coils and
inputs are used. See “Input Registers” on page 34 and “Holding Registers” on page 35. Also see “Notes for
High-Density Digital (HDD) Modules” on page 38.

10 Modbus/TCP Protocol Guide

CHAPTER 2: CONFIGURING I/O FOR MODBUS/TCP

Reading/Writing 4-Channel Digital Point States to Coils and Inputs

SNAP 4-Channel Digital I/O SNAP 4-Channel Digital I/O SNAP 4-Channel Digital I/O
Module Point Coil/Input Module Point Coil/Input Module Point Coil/Input
0 1 0 25 0 45
1 2 1 26 1 46
0 6 11
2 3 2 27 2 47
3 4 3 28 3 48
0 5 0 29 0 49
1 6 1 30 1 50
1 7 12
2 7 2 31 2 51
3 8 3 32 3 52
0 9 0 33 0 53
1 10 1 34 1 54
2 8 13
2 11 2 35 2 55
3 12 3 36 3 56
0 13 0 37 0 57
1 14 1 38 1 58
3 9 14
2 15 2 39 2 59
3 16 3 40 3 60
0 17 0 41 0 61
1 18 1 42 1 62
4 10 15
2 19 2 43 2 63
3 20 3 44 3 64
0 21
1 22
5
2 23
3 24

SNAP Example 2: Reading/Writing Analog Point Values to Input and Holding

Registers
Analog point values in input and holding registers are in the form of 32-bit floats. Because Modbus
registers contain only 16 bits, two consecutive registers are used to read or write the data for one
point. The following table shows the input or holding registers you would use to read or write
analog point values, depending upon the number of points on the module (one, two, or four
points).
NOTE: Analog modules with more than four points use different registers. See “Input Registers” on page 34
and “Holding Registers” on page 35. Also see the table showing starting registers on page 38.

Modbus/TCP Protocol Guide 11

11
MODULE AND POINT POSITIONS ON I/O UNITS

Reading/Writing Analog Point Values to Input and Holding Registers (Modules with four
channels or less. Only the first eight modules are shown; the rack may hold up to 16.)

SNAP 4-Channel Analog I/O SNAP 2-Channel Analog I/O SNAP 1-Channel Analog I/O
Module Point Registers Module Point Registers Module Point Registers
0 1-2 0 1-2 0 0 1-2
0
1 3-4 1 3-4 -- -- --
0
2 5-6 -- -- -- -- -- --
3 7-8 -- -- -- -- -- --
0 9-10 0 9-10 1 0 9-10
1
1 11-12 1 11-12 -- -- --
1
2 13-14 -- -- -- -- -- --
3 15-16 -- -- -- -- -- --
0 17-18 0 17-18 2 0 17-18
2
1 19-20 1 19-20 -- -- --
2
2 21-22 -- -- -- -- -- --
3 23-24 -- -- -- -- -- --
0 25-26 0 25-26 3 0 25-26
3
1 27-28 1 27-28 -- -- --
3
2 29-30 -- -- -- -- -- --
3 31-32 -- -- -- -- -- --
0 33-34 0 33-34 4 0 33-34
4
1 35-36 1 35-36 -- -- --
4
2 37-38 -- -- -- -- -- --
3 39-40 -- -- -- -- -- --
0 41-42 0 41-42 5 0 41-42
5
1 43-44 1 43-44 -- -- --
5
2 45-46 -- -- -- -- -- --
3 47-48 -- -- -- -- -- --
0 49-50 0 49-50 6 0 49-50
6
1 51-52 1 51-52 -- -- --
6
2 53-54 -- -- -- -- -- --
3 55-56 -- -- -- -- -- --
0 57-58 0 57-58 7 0 57-58
7
1 59-60 1 59-60 -- -- --
7
2 61-62 -- -- -- -- -- --
3 63-64 -- -- -- -- -- --

12 Modbus/TCP Protocol Guide

CHAPTER 2: CONFIGURING I/O FOR MODBUS/TCP

E1 and E2 I/O Units

I/O units using a digital E1 or analog E2 brain board normally use modules containing only one
point, and the maximum number of points on the rack is 16. Examples of E1 and E2 I/O units are
shown below.

E1 with G4 modules

Module position 0

E2 with G1 modules

Module position 0

E1 with Quad Pak modules

The E1 can also be used with Quad Pak
modules, which have four input or four output
points; but each point is treated as if it were a
separate module.

Module position 0

The following examples illustrate how E1 and E2 module and point numbers relate to Modbus coils,
inputs, and registers. For complete coil, input, and register information, see Chapter 3, “3: The
Modbus Memory Map,” on page 31.

Modbus/TCP Protocol Guide 13

13
MODULE AND POINT POSITIONS ON I/O UNITS

E1 Example: Reading/Writing Digital Point States to Coils and Inputs

The following table shows the coils or inputs you would read or write to for point states on E1 digital
modules.

E1 Digital I/O E1 Digital I/O

Module/Point Coil or Input Module/Point Coil or Input
0 1 8 9
1 2 9 10
2 3 10 11
3 4 11 12
4 5 12 13
5 6 13 14
6 7 14 15
7 8 15 16

E2 Example: Reading/Writing Analog Point Values to Input and Holding

Registers
Point values in input and holding registers are in the form of 32-bit floats. Because Modbus registers
contain only 16 bits, two consecutive registers are used to read or write the data for one point. The
following table shows the input or holding registers you would use to read or write E2 analog point
values.

E2 Analog I/O E2 Analog I/O

Module/Point Input or Holding Module/Point Input or Holding
Registers Registers
0 1-2 8 17-18
1 3-4 9 19-20
2 5-6 10 21-22
3 7-8 11 23-24
4 9-10 12 25-26
5 11-12 13 27-28
6 13-14 14 29-30
7 15-16 15 31-32

G4EB2 I/O Units

These I/O units include part numbers G4EB2, G4D32EB2, and G4D32EB2-UPG. Each I/O unit has 32
total points, all of them digital. They may use G4 modules, which each have one point, or Quad Pak
modules, which each have four points of the same type (all four digital inputs or all four digital
outputs).

14 Modbus/TCP Protocol Guide

CHAPTER 2: CONFIGURING I/O FOR MODBUS/TCP

G4EB2 brains with G4 modules

Each module has just one point. You can mix input and output modules within the same group of
four points.

Module position 0

The following table shows the coils or inputs you would read or write to for point states on G4
modules.

G4 Digital I/O G4 Digital I/O

Module/Point Coil or Input Module/Point Coil or Input
0 1 16 17
1 2 17 18
2 3 18 19
3 4 19 20
4 5 20 21
5 6 21 22
6 7 22 23
7 8 23 24
8 9 24 25
9 10 25 26
10 11 26 27
11 12 27 28
12 13 28 29
13 14 29 30
14 15 30 31
15 16 31 32

Modbus/TCP Protocol Guide 15

15
MODULE AND POINT POSITIONS ON I/O UNITS

G4EB2 brains with Quad Pak modules

Quad Pak modules have four input or four output points per module, so the four points in each
group are either inputs or outputs.

Module position 0 (points 0–3)

The following table shows the coils or inputs you would read or write to for point states on Quad Pak
modules.

Quad Pak Digital I/O Quad Pak Digital I/O

Module Point Coil or Input Module Point Coil or Input
0 1 16 17
1 2 17 18
0 4
2 3 18 19
3 4 19 20
4 5 20 21
5 6 21 22
1 5
6 7 22 23
7 8 23 24
8 9 24 25
9 0 25 26
2 6
0 11 26 27
11 12 27 28
12 13 28 29
13 14 29 30
3 7
14 15 30 31
15 16 31 32

16 Modbus/TCP Protocol Guide

CHAPTER 2: CONFIGURING I/O FOR MODBUS/TCP

Configuring I/O Points

You need to configure points only once and then save configuration to flash memory.
CAUTION: Store to flash only once! Storing to flash memory in a loop can wear out the memory.
If you are using PAC Control, configure points there while you are programming your strategy. If you
are not using PAC Control, configure points in PAC Manager and save to flash memory.
NOTE: You can configure E1 and E2 brain boards like any other I/O unit if you have E1/E2 firmware R1.2a
(and higher) and PAC Project 9.5000 (and higher). Also, if a SNAP PAC controller communicates with the E1
or E2, the controller must have PAC firmware R9.5a (or higher) to use this simplified configuration method.

If you are not using these firmware and software versions (or if you prefer to use the previous method to
reconfigure existing E1s or E2s), see Opto 22 form 1576, I/O Configuration for E1 and E2 Brain Boards.

Configuring I/O Points for SNAP Analog/Digital I/O Units

IMPORTANT: If you are using PAC Control or PAC Manager, do not use this section. Configure points
within PAC Control or PAC Manager. Use this section to configure I/O points only if Modbus/TCP will be the
only communication to the I/O unit.

(For SNAP digital-only I/O units, see page 25.) All SNAP analog/digital I/O units recognize analog,
serial, and high-density digital modules on the rack. Positions on the rack that don’t contain
modules the I/O unit recognizes are assumed to contain digital input modules. If the individual
point types on the module differ from the default type for that module, you must configure the
points using the tables below.

SNAP I/O Point Types

The following tables show SNAP I/O modules that can be used with Ethernet-based I/O units and
Modbus/TCP (some older I/O units cannot use all of these modules; see the module’s data sheet for
compatibility). Default point types are shaded. If a point differs from the default, use the value in the
Point Type (Hex) column to configure the point. For examples of point configuration, see page 24,
following the tables.
Digital Inputs and Outputs

Module & Description Point Type Point Type Module Type

(Dec) (Hex) (Hex)
4-channel digital input module* 256 100 00
4-channel digital output module* 384 180 00
* High-density digital modules are automatically recognized; points do not require configuration.

Modbus/TCP Protocol Guide 17

Modbus/TCP Protocol Guide 23

23
CONFIGURING I/O POINTS

Analog Outputs

Part Number &

Module Type (Hex)

Points per Module

Point Type (Dec)

Point Type (Hex)

Default Unit of
Description

Measurement

Underrange

Overrange
Low scale

Full scale
SNAP-AOA-3: 4 - 20 mA 131 83 83 1 mA 4.0 4.0 20.0 20.0
SNAP-AOV-5: 0 - 10 VDC 133 85 85 1 VDC 0.0 0.0 10.0 10.0
SNAP-AOA-23: 4 - 20 mA 163 A3 A3 2 mA 4.0 4.0 20.0 20.0
SNAP-AOA-23-iSRC: 4 - 20 mA 163 A3 B3 2 mA 4.0 4.0 20.0 20.0
SNAP-AOA-23-iSRC-FM: 4 - 20 mA 163 A3 B3 2 mA 4.0 4.0 20.0 20.0
SNAP-AOA-23-iH: 4 - 20 mA 163 A3 AB 2 mA 4.0 4.0 20.0 20.0
SNAP-AOV-25: 0 - 10 VDC 165 A5 A5 2 VDC 0.0 0.0 10.0 10.0
SNAP-AOV-27: -10 - +10 VDC 167 A7 A7 2 VDC -10.0 -10.0 10.0 10.0
SNAP-AOA-28: 0 - 20 mA 168 A8 A8 2 mA 0.0 0.0 20.0 20.0
SNAP-AOVA-8: 0 - 5 VDC 144 90 CF 8 VDC 0.0 0.0 5.0 5.0
SNAP-AOVA-8: 0 - 10 VDC 145 91 CF 8 VDC 0.0 0.0 10.0 10.0
SNAP-AOVA-8: -5 to +5 VDC 146 92 CF 8 VDC -5.0 -5.0 5.0 5.0
SNAP-AOVA-8: -10 to +10 VDC 147 93 CF 8 VDC -10.0 -10.0 10.0 10.0
SNAP-AOVA-8: 4 - 20 mA 148 94 CF 8 mA 4.0 4.0 20.0 20.0
SNAP-AOVA-8: 0 - 20 mA 149 95 CF 8 mA 0.0 0.0 20.0 20.0
SNAP-AOD-29: TPO 5 - 60 VDC 169 A9 A9 2 percent n/a 0.0 100.0 n/a
SNAP-AOD-29-HFi: TPO 2.5-24 VDC 131 83 B9 2 percent n/a 0.0 100.0 n/a

Examples of Configured SNAP I/O Points for Modbus

To configure I/O points for Modbus/TCP, write the point configuration data from the previous table
to holding registers 11271–13318. Since the data for this area of the Modbus map is in the form of
32-bit integers, use two consecutive registers to write the data to one point.
For example, look at the tables starting on page 17. If the module in position 0 on the rack is a
SNAP-AIV with a -5 to +5 V input, it is not the default for that module. Therefore you must configure
its points. Now take a look at the Holding Registers section of the Modbus map on page 35. You will
write to the Configure Points area, registers 11271–13318. Since it takes two registers per point and
the analog module has two points, you write the hex value 0B (for a -5 to +5 V analog input) to the
first four registers, 11271–11274.
As another example, suppose the module in position 1 on the rack is a 4-channel digital output
module. Since the default is a 4-channel digital input module, you must configure its points. You
write the hex value 180 (for a 4-channel digital output module) to the registers for module 1.

24 Modbus/TCP Protocol Guide

CHAPTER 2: CONFIGURING I/O FOR MODBUS/TCP

Configuring I/O Points for SNAP Digital-Only I/O Units

The digital-only SNAP-UP1-D64 and SNAP-ENET-D64 I/O units assume that all positions on the rack
contain 4-channel digital input modules. If a position contains an output module, you must
configure its points as outputs.
For example, suppose the module in position 0 on the rack is a 4-channel digital output module. To
configure its points, write a 1 to coils 193–196. See the Modbus memory map on page 32. (Be sure
you are looking in the column for these digital-only I/O units.)
NOTE: SNAP digital-only I/O units support 4-channel digital modules only; they do not support
high-density digital modules.

Using I/O Point Features

The I/O point features available on Opto 22 I/O units used with Modbus/TCP depend on the
combined capabilities of the I/O processor and the module. Note that some features available
through other communication methods (PAC Control, Optomux, or OptoMMP, depending on the
processor) are not available in the Modbus memory map.
The following features are discussed in this chapter. See the referenced pages for more information
on using them in your application.

Feature Description See

For SNAP For E1/E2
(digital inputs and outputs)—A digital point is either on or off. You can
Point States read the current state of a digital input or write an on/off state to a digi- page 10 page 14
tal output.
(analog inputs and outputs)—An analog point has a range of values.
Point
You can read the current value of an analog input or write a value to an page 11 page 14
Values
analog output.
(digital inputs)—When the value of a digital input point changes from
off to on, an on-latch is automatically set. While the value of the point
Latches may return to off, the on-latch remains set, as a record of the change, page 26 page 27
until you clear it. Similarly, an off-latch is set when the value of a digital
point changes from on to off, and it remains set until cleared.
(digital inputs)—A counter keeps track of the number of times a digital
input changes from off to on. The count accumulates until it reaches
the maximum count available in the I/O unit or until you reset the
counter to zero. For example, to count the number of widgets produced
Counters page 26 page 28
per shift, you would clear the counter at the start of each shift and read
it at the end of each shift.
The speed of the counter depends upon the I/O processor’s capabili-
ties and the speed of the module used.
(analog points)—Analog input and output points can be scaled as
Scaling needed. For example, you can scale a -5 V to +5 V input point to reflect page 27 page 28
0% to 100%
(analog inputs)—Minimum and maximum values are sometimes called
peaks and valleys. You can read these values at any time, for example,
Minimum &
to record minimum and maximum temperatures. You can also reset
maximum page 27 page 28
min/max values. For example, if you want to record the maximum tem-
values
perature at point 2 in each 24-hour period, you must reset the values
after they are read each day.

Modbus/TCP Protocol Guide 25

25
USING I/O POINT FEATURES

Feature Description See

For SNAP For E1/E2
(analog inputs) Offset and gain calculations are used to calibrate ana-
log points. If a -50 mV to +50 mV input receives signals that are slightly
Offset and
off (not exactly -50 mV at the lowest point, for example), the offset and page 27 page 29
gain
gain can be calculated so that values will appear accurately when
read.

SNAP Digital I/O Point Features

Refer to the “3: The Modbus Memory Map” on page 31 to find the coils, inputs, and registers
mentioned in this section. For explanations of point features, see page 25.

Latches
Latches are a point feature automatically available on SNAP Ethernet-based I/O units; they do not
require configuration. To use latches, see the Modbus memory maps beginning on page 31.

Counters

High-Speed Counters. Analog/digital I/O units with high-speed capability (such as

SNAP-PAC-R1 and SNAP-PAC-EB1 I/O units) support high-speed counters on any 4-channel digital
input; the actual counter speed depends on the module. Digital-only and analog/simple digital I/O
units (such as SNAP-PAC-R2 and SNAP-PAC-EB2 I/O units) do not support high-speed counters.
High-speed counters require configuration. See below, “Using Counters.”

Other Counters. Points on high-density digital modules automatically provide counting. These
counters are not high speed; see the module’s data sheet for specific information.

Using Counters. High-speed counters involve two steps: configure the counter and read data.
Counters on high-density digital modules do not need configuration for Modbus/TCP.
• To configure a high-speed counter, write to holding registers 13319–15366. Remember that you
use two consecutive registers for each point, since the data is in the form of a 32-bit integer. For
example, to configure module 0, point 0 as a counter, you would write the following:
To these registers: 13319 13320
Write this: 0 1

• To read high-speed counter data, read input registers 385–512. Read two consecutive registers
per point.
• To clear a high-speed counter, write to coils 257–320. For example, to clear the counter on
module 0, point 0, you would write a 1 to coil 257.
• To read counters on high-density digital modules, read input registers 513–2560 (or read and
clear counters using input registers 2561–4608). Read two consecutive registers per point.

SNAP Analog I/O Point Features

Analog point features apply to all SNAP analog/digital I/O units. For explanations of point features,
see page 25.

26 Modbus/TCP Protocol Guide

CHAPTER 2: CONFIGURING I/O FOR MODBUS/TCP

Analog point features generally require that you read or write to two consecutive registers for each
point, since the data is in the form of a 32-bit IEEE float. Data is in Big Endian format. You can change
the word order if you wish, using the Modbus memory map. See Holding Register 1029 on page 36.
If you change word order, be sure to store configuration information to flash (Holding Register 1026)
so it will be saved when the I/O unit is turned off.

Scaling
To scale an analog point, write the low-scale value to holding registers 7175–9222 and the
high-scale value to holding registers 9223–11270. Write to two consecutive registers for each point
you are scaling.

Minimum and Maximum Values

Minimum and maximum values are analog point features. The I/O unit automatically keeps track of
minimum and maximum values; they do not require configuration. You can read the values at any
time, for example to record minimum and maximum temperatures. You can also clear them.
• To read min/max values, read input registers 6657–10752. Read two consecutive registers per
point.
• To clear min/max values, write 1 bits to coils 3585–5632.

Offset and Gain

Offset and gain are also analog point features on SNAP I/O units. Setting offset and gain for analog
input points is important to make sure that values appear accurately when read. If a -50 mV to +50
mV input receives signals that are slightly off (not exactly -50 mV at the lowest point, for example),
you can set offset and gain to adjust them.
Calculate offset first, and then calculate gain. The offset must be calculated at the point’s low scale,
and the gain must be calculated at the point’s high scale.
Once you have calculated offset and gain values, write them to the I/O unit. To set offset, write to
holding registers 3079–5126, using two consecutive registers per point. To set gain, write to holding
registers 5127–7174.

E1 Digital Point Features

For explanations of digital point features, see page 25.

Latches
Latches are a digital point feature available on E1 brain boards. They do not require configuration.
Read and clear latches as shown in the following table and the Modbus memory map beginning on
page 31.

To do this Use these coils/inputs

Read the on-latch state Read inputs 65–80
Read the off-latch state Read inputs 129–144
Clear on-latches Write to coils 129–144
Clear off-latches Write to coils 193–208

Modbus/TCP Protocol Guide 27

27
USING I/O POINT FEATURES

Counters
Using counters involves three steps: configure the counter (holding registers 769-800), activate the
counter (coils 65-80), and read data (input registers 385-416). See the Modbus memory map
beginning on page 31 to find the coils and registers mentioned.

To do this Use these coils/registers

Write to holding registers 769–800. Remember that you use two consecutive
registers for each point, since the data is in the form of a 32-bit integer but the
registers are 16 bits each. For example, to configure point #1 as a counter, you
would write 01 to registers 769-770.
Configure a counter
To these registers: 769 770
Write this: 0 1

Write to coils 65-80. For example, to activate the counter for point #1, you would
Activate a counter
write to coil number 65.
Read counter data Read input registers 385–416. Read two consecutive registers per point.
Write to coils 257–272. For example, to clear the counter on point #1, you would
Clear a counter
write a 1 to coil 257.

E2 Analog Point Features

For explanations of analog point features, see page 25.
Analog point features generally require that you read or write two consecutive registers for each
point, since the data is in the form of a 32-bit IEEE float. Data is in Big Endian format. You can change
the word order if you wish, using Holding Register 1029, which is described on page 36. If you
change word order, be sure to store configuration information to flash (Holding Register 1026) so it
will be saved when power to the brain board is cycled.

Scaling E2 Analog Points

Configuration of E1 and E2 brain boards is simplified in E1/E2 firmware R1.2a (and higher) and in
PAC Project 9.5000 (and higher). Also, if a SNAP PAC controller communicates with the E1 or E2, the
controller must have PAC firmware R9.5a (or higher) to use the simplified configuration method.
If you are not using these firmware and software versions, you must scale analog points when you
configure I/O. For details, see Opto 22 form 1576, I/O Configuration for E1 and E2 Brain Boards.

Minimum and Maximum Values

Minimum and maximum values (also called peaks and valleys) are automatically tracked on the E2
and do not require configuration. For example, you can read the values at any time to record
minimum and maximum pressures. You can also clear them.
NOTE: The E2 does not maintain minimum and maximum values for temperature.

• To read min/max values, read input registers 129–160 (min) and 257–288 (max). Read two
consecutive registers per point.
• To clear min/max values, write 1 bits to coils 321–336 (min) and 385–400 (max).

28 Modbus/TCP Protocol Guide

CHAPTER 2: CONFIGURING I/O FOR MODBUS/TCP

Offset and Gain

You can monitor current values for offset and gain using holding registers 129–160 and 257–288. To
perform calibration on analog points, use PAC Manager. See the PAC Manager User’s Guide.

A Note on Analog Counts

As mentioned, the configuration method for E2 I/O units was simplified in E2 firmware R1.2a and
PAC Project R9.5. With the new method, you can configure E2s in PAC Control and PAC Manager just
as you would other I/O units, and configure their points as G1 modules rather than similar SNAP
modules.
This change makes a difference in how the E2 I/O unit reports counts. Modules configured directly
as G1 modules (the new method) will report counts as G1 counts (0 to +4095 nominal range).
Modules configured under the old method will report counts as SNAP counts (0 to +25000, or
-25000 to +25000).

Modbus/TCP Protocol Guide 29

29
USING I/O POINT FEATURES

30 Modbus/TCP Protocol Guide

Chapter 3

3: The Modbus Memory Map

Introduction
The following tables show the coils, inputs, input registers, and holding registers that apply to
Opto 22 devices supporting Modbus/TCP. We call these the Modbus memory map.
New areas have been added to the Modbus memory map to accommodate new higher-density
digital and analog modules. As a result, the functions of some coil, input, and register numbers have
been duplicated in larger areas. In the following tables, the older numbers are shown in brackets.
These older numbers can still be used for backward compatibility, but we recommend using the
referenced larger areas for new development.
NOTE: Because digital counters and module configuration require more than one bit, they are handled in
input and holding registers.

For all actions in this chapter, use a unit ID (slave ID) of 1.

If you need to take actions not shown in the following tables, see Chapter 4.

Coils number
For SNAP 4-channel digital I/O modules: For these modules, up to 64 points are available on the
largest SNAP I/O rack; therefore, digital coils contain 64 numbers. Each number contains the data for
one point. Data is either 0 or 1.
For digital and analog I/O on E1 and E2 I/O units: These racks contain up to 16 points, so coils
contain 16 numbers, each with the data for one point. Data is either 0 or 1.
For SNAP high-density digital I/O and SNAP analog minimum/maximum: Coils contain 512
numbers, with an extra 512 coils reserved. See “Notes for High-Density Digital (HDD) Modules” on
page 38 and “The following table shows starting registers for the first point on each module on the
largest rack.” on page 38.
The Coils table begins on the following page.

Modbus/TCP Protocol Guide 31

31
COILS NUMBER

Action Coil Numbers Notes

E1 E2

SNAP-B3000-ENET

SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1

SNAP-PAC-EB2

SNAP-UP1-M64

SNAP-UP1-D64
SNAP-PAC-R1

SNAP-PAC-R2
Read or Write Point State on
4-channel or 1-channel digital 1–64 1–64 1–64 1–16 -- 1 = On, 0 = Off
outputs

1 = On, 0 = Off. Configure as a point

Activate Counters on 4-channel
65–128 -- -- 65–80 -- feature first. See “Counters” on
or 1-channel digital modules
page 26.

Read or Clear On-latch on

4-channel or 1-channel digital 129–192 65–128 65–128 129–144 -- 1 = clear latches; 0 = do nothing
modules

Read or Clear Off-latch on

4-channel or 1-channel digital 193–256 129–192 129–192 193–208 -- 1 = clear latches; 0 = do nothing
modules

Clear Counters on 4-channel or

257–320 -- -- 257–272 -- 1 = clear counters; 0 = do nothing
1-channel digital modules

Clear Analog Minimum Values

[321–384]1 1 = clear minimum values; 0 = do
on analog modules with 4 Use 3585 -- -- 321–336
Use 3585 nothing
points or less

Clear Analog Maximum Values

[385–448]1 1 = clear maximum values; 0 = do
on analog modules with 4 Use 4609 -- -- 385–400
Use 4609 nothing
points or less

Read or Write Point State on

513–1536 513–1536 -- -- -- 1 = On, 0 = Off
HDD2 modules

Clear On-latch
1537–2560 1537–2560 -- -- -- 1 = clear latches; 0 = do nothing
(HDD2 modules)

Clear Off-latch
2561–3584 2561–3584 -- -- -- 1 = clear latches; 0 = do nothing
(HDD2 modules)

Clear Analog Minimum Values 1 = clear minimum values; 0 = do

3585–4608 3585–4608 -- -- --
on all analog modules nothing

Clear Analog Maximum Values 1 = clear minimum values; 0 = do

4609–5632 4609–5632 -- -- --
on all analog modules nothing

(See (See (See (See

Configure Point Type
Holding Holding 193–256 Holding Holding 1 - output; 0 = input
(4-channel digital)
Registers) Registers) Registers) Registers)

(See 257 (or (See (See Using Modbus Command 05, write 1
Store Configuration to Flash Holding Holding 257 Holding Holding to store point configuration data to
Registers) Register) Registers) Registers) flash. Reading always returns 0.

Using Modbus Command 05, write 1

(See 258 (or (See (See
to reset. Resetting clears latches and
Reset to Factory Defaults Holding Holding 258 Holding Holding
turns off digital outputs. Reading
Registers) Register) Registers) Registers)
always returns 0.

32 Modbus/TCP Protocol Guide

CHAPTER 3: THE MODBUS MEMORY MAP

Action Coil Numbers Notes

E1 E2

SNAP-B3000-ENET

SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1

SNAP-PAC-EB2

SNAP-UP1-M64

SNAP-UP1-D64
SNAP-PAC-R1

SNAP-PAC-R2
(See 259 (or (See (See Using Modbus Command 05, write 1
Clear Point Configuration
Holding Holding 259 Holding Holding to set point configuration data to
(4-channel digital)
Registers) Register) Registers) Registers) defaults. Reading always returns 0.

Using Modbus Command 05, write 1

to reset hardware, which is just like
(See 260 (or (See (See
cycling power to the device. If point
Reset Hardware Holding Holding 260 Holding Holding
configuration data has not been
Registers) Register) Registers) Registers)
stored to flash, points are reset to
defaults. Reading always returns 0.

1 These coil numbers were used in the past and still work, but for new development, use the referenced coil numbers instead.
2 High-density digital (digital modules with more than 4 points)

Inputs
SNAP 4-channel digital input modules: inputs contain 64 numbers, each with the data for one
point. Data is either 0 or 1.
I/O modules for E1 and E2 I/O units: inputs contain 16 numbers, each with the data for one point.
Data is either 0 or 1.
SNAP high-density digital input modules: inputs contain 512 numbers, with an extra 512
numbers reserved. See “Notes for High-Density Digital (HDD) Modules” on page 38.

Action Input Numbers Notes

E1 E2
SNAP-B3000-ENET

SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1

SNAP-PAC-EB2

SNAP-UP1-M64

SNAP-UP1-D64
SNAP-PAC-R1

SNAP-PAC-R2

Read 4-channel Digital Inputs 1–64 1–64 1–64 1–16 -- 1 = On, 0 = Off

Read State of On-latches (4-channel digital modules) 65–128 65–128 65–128 65–80 -- 1 = On, 0 = Off

129–
Read State of Off-latches (4-channel digital modules) 129–192 129–192 129–144 -- 1 = On, 0 = Off
192

Read Counter Active State (4-channel digital mod-

193–256 -- -- 193–208 -- 1 = Active, 0 = Inactive
ules)

Read HDD* Modules 513–1536 513–1536 -- -- -- 1 = On, 0 = Off

Read On-Latches (HDD* modules) 1537–2560 1537–2560 -- -- -- 1 = On, 0 = Off

Read Off-Latches (HDD* modules) 2561–3584 2561–3584 -- -- -- 1 = On, 0 = Off

* High-density digital (digital modules with more than 4 points)

Modbus/TCP Protocol Guide 33

33
INPUT REGISTERS

Input Registers
Input register data is in the form of 32-bit floats or 32-bit integers. Because Modbus registers contain
only 16 bits, you must use two consecutive registers to read the data for one point, starting with an
odd-numbered register.
This table includes registers for 1-, 2-, 4-, 8-, and 32-channel analog modules. For help in working
with analog modules, see “Notes for All Analog Modules” on page 36.
For high-density digital modules, see “Notes for High-Density Digital (HDD) Modules” on page 38.

Action Input Register Numbers Notes

E1 E2

SNAP-B3000-ENET

SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B

SNAP-UP1-ADS
SNAP-PAC-EB1

SNAP-PAC-EB2

SNAP-UP1-M64

SNAP-UP1-D64
SNAP-PAC-R1

SNAP-PAC-R2
Read Analog Values on analog modules with 4 points [1–128]1 [1–128]1
-- -- 1–32 IEEE 32-bit float
or less Use 4609 Use 4609

Read Analog Minimum Values (Inputs only; modules [129–256]1 [129–256]1

-- -- 129–160 IEEE 32-bit float
with 4 points or less) Use 6657 Use 6657

Read Analog Maximum Values (Inputs only; modules [257–384]1 [257–384]1

-- -- 257–288 IEEE 32-bit float
with 4 points or less) Use 8705 Use 8705

Read Digital Counter Data on 4-channel or 1-channel

385–512 -- -- 385–416 -- 32-bit integer
digital modules

Read Digital Counter Data on HDD2 modules 513–2560 513–2560 -- -- -- 32-bit integer

Read & Clear Digital Counter Data on HDD2 modules 2561–4608 2561–4608 -- -- -- 32-bit integer

Read Analog Values (all analog modules) 4609–6656 4609–6656 -- -- -- IEEE 32-bit float

Read Analog Minimum Values (all analog input mod-

6657–8704 6657–8704 -- -- -- IEEE 32-bit float
ules)

Read Analog Maximum Values (all analog input mod-

8705–10752 8705–10752 -- -- -- IEEE 32-bit float
ules)

1 These register numbers were used in the past and still work, but for new development, use the referenced numbers instead.
2 High-density digital (digital modules with more than 4 points)

You can read a maximum of 127 registers in one command.

34 Modbus/TCP Protocol Guide

CHAPTER 3: THE MODBUS MEMORY MAP

Holding Registers
Most of this data is also in the form of 32-bit integers or 32-bit floats. For these formats, you must use
two consecutive registers to read or write the data for one point, starting with an odd-numbered
register.
This table includes registers for 1-, 2-, 4-, 8-, and 32-channel analog modules. For help in working
with analog modules, see “Notes for All Analog Modules” on page 36.

Action Holding Register Numbers Notes

E1 E2

SNAP-B3000-ENET

SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B

SNAP-UP1-ADS
SNAP-PAC-EB1

SNAP-PAC-EB2

SNAP-UP1-M64

SNAP-UP1-D64
SNAP-PAC-R1

SNAP-PAC-R2

Read or Write Analog Outputs in

[1–128]1 [1–128]1
Engineering Units (modules with -- -- 1–32 IEEE 32-bit float
Use 1031 Use 1031
4 points or less)

Set Analog Offset (modules with [129–256]1 [129–256]1

-- -- 129–160 IEEE 32-bit float
4 points or less) Use 3079 Use 3079

Set Analog Gain (modules with 4 [257–384]1 [257–384]1

-- -- 257–288 IEEE 32-bit float
points or less) Use 5127 Use 5127

Set Point Low Scale Value (mod- [385–512]1 [385–512]1

-- -- 385–416 IEEE 32-bit float
ules with 4 points or less) Use 7175 Use 7175

Set Point High Scale Value (mod- [513–640]1 [513–640]1

-- -- 513–544 IEEE 32-bit float
ules with 4 points or less) Use 9223 Use 9223

Configure Points (modules with 4 [641–768]1 [641–768]1 See 32-bit integer (See page 17 for
641–6722 641–6722
points or less) Use 11271 Use 11271 Coils information on configuring points.)

Configure Point Features (count-

[769–896]1 32-bit integer (See page 25 for
ers on 4-channel or 1-channel Use 13319 -- 769–800 --
Use 13319 information on counters.)
digital modules)

Reserved 897–1024 769–1024 -- 897–1024 897–1024 Reserved

16-bit integer. 1 sets degrees in F;

Set Degrees in F or C 1025 1025 -- -- 1025
0 sets degrees in C.

16-bit integer. Any non-zero value

1026 See stores configuration to flash, so it
Store Configuration to Flash 1026 1026 1026
(Or Coil 257) Coils is restored when the brain is
turned on. 0 = no action.

16-bit integer. Any non-zero value

resets the brain to defaults as fol-
lows: Clears offsets and gains,
1027 See counters, latches, and min/max
Reset to Factory Defaults 1027 1027 1027
(Or Coil 258) Coils data; turns off digital outputs; sets
analog outputs to zero scale (0
counts). (1027 is equal to 1028 fol-
lowed by 1030.)

1028 See 16-bit integer. Any non-zero value

Clear Point Configuration 1028 1028 1028
(Or Coil 259) Coils clears flash.

Modbus/TCP Protocol Guide 35

35
NOTES FOR ALL ANALOG MODULES

Action Holding Register Numbers Notes

E1 E2

SNAP-B3000-ENET

SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B

SNAP-UP1-ADS
SNAP-PAC-EB1

SNAP-PAC-EB2

SNAP-UP1-M64

SNAP-UP1-D64
SNAP-PAC-R1

SNAP-PAC-R2
16-bit integer. 0 = Big Endian;
Set 32-bit Float Format 1029 1029 -- 1029 1029
1 = Word-swapped Big Endian.

Using Modbus Command 06, write

any non-zero value to reset hard-
ware, which is like cycling power
1030 See to the brain. If point configuration
Hardware Reset 1030 1030 1030
(Or Coil 260) Coils data has not been stored to flash
or flash has been cleared (1028),
points are reset to defaults.
Reading always returns 0.

Read or Write Analog Outputs

1031–3078 1031–3078 -- -- -- IEEE 32-bit float
(all analog modules)

Set Analog Offset

3079–5126 3079–5126 -- -- -- IEEE 32-bit float
(all analog modules)

Set Analog Gain

5127–7174 5127–7174 -- -- -- IEEE 32-bit float
(all analog modules)

Set Point Low Scale Value

7175–9222 7175–9222 -- -- -- IEEE 32-bit float
(all analog modules)

Set Point High Scale Value

9223–11270 9223–11270 -- -- -- IEEE 32-bit float
(all analog modules)

Configure Points (all modules) 11271–13318 11271–13318 -- -- -- 32-bit integer

Configure Point Features

13319–15366 13319–15366 -- -- -- 32-bit integer
(all modules)

1 These register numbers were used in the past and still work, but for new development, use the referenced numbers instead.
2 The method to configure E1 and E2 brain boards is simplified in E1/E2 firmware R1.2a (and higher) and in PAC Project 9.5000 (and
higher). Also, if a SNAP PAC controller communications with the E1 or E2, the controller must have PAC firmware R9.5a (or higher) to
use the simplified configuration method. If you are not using these firmware and software versions (or if you prefer to use the previous
method to reconfigure existing E1s or E2s), see Opto 22 form 1576, I/O Configuration for E1 and E2 Brain Boards.

You can read a maximum of 127 registers in one command.

Notes for All Analog Modules

Changes have been made to the Modbus memory map to accommodate higher-density SNAP
analog input and output modules. Analog modules range from 1 to 32 points. Adjust your reads and
writes depending on the module you have; for example, if your analog module has two points, use
only the registers for the first two points. If it has eight points, use only the registers for the first eight
points.

36 Modbus/TCP Protocol Guide

CHAPTER 3: THE MODBUS MEMORY MAP

Coils contain 32 numbers per module for clearing analog minimum and maximum values. Data for
each coil is either 0 or 1. Registers and corresponding points for a 32-channel analog module in
position 0 are shown below as an example:
Coil 3585 3586 3587 3588 3589 3590 3591 3592 3609 3610 3611 3612 3613 3614 3615 3616
Point 1 2 3 4 5 6 7 8 25 26 27 28 29 30 31 32

Input and holding registers contain 64 registers for each module (since the data for each point
requires two registers). For example, on a 32-channel analog module in position 0:
Register 4609 4611 4613 4615 4617 4619 4621 4623 4657 4659 4661 4663 4665 4667 4669 4671
4610 4612 4614 4616 4618 4620 4622 4624 4658 4660 4662 4664 4666 4668 4670 4672
Point 1 2 3 4 5 6 7 8 25 26 27 28 29 30 31 32

Analog Module Register Table

The following table shows starting registers for the first point on each module on the largest rack.

Coils Input Registers Holding Registers

Module Position

Read/Write Output
Clear Max Value

Calculate Offset
Read Max Value
Clear Min Value

Read Min Value

Config Feature
Calculate Gain

Set High Scale

Set Low Scale

Config Point
Read Value

0 3585 4609 4609 6657 8705 1031 3079 5127 7175 9223 11271 13319

1 3617 4641 4737 6785 8833 1159 3207 5255 7303 9351 11335 13383

2 3649 4673 4865 6913 8961 1287 3335 5383 7431 9479 11399 13447

3 3681 4705 4993 7041 9089 1415 3463 5511 7559 9607 11463 13511

4 3713 4737 5121 7169 9217 1543 3591 5639 7687 9735 11527 13575

5 3745 4769 5249 7297 9345 1671 3719 5767 7815 9863 11591 13639

6 3777 4801 5377 7425 9473 1799 3847 5895 7943 9991 11655 13703

7 3809 4833 5505 7553 9601 1927 3975 6023 8071 10119 11719 13767

8 3841 4865 5633 7681 9729 2055 4103 6151 8199 10247 11783 13831

9 3873 4897 5761 7809 9857 2183 4231 6279 8327 10375 11847 13895

10 3905 4929 5889 7937 9985 2311 4359 6407 8455 10503 11911 13959

11 3937 4961 6017 8065 10113 2439 4487 6535 8583 10631 11975 14023

12 3969 4993 6145 8193 10241 2567 4615 6663 8711 10759 12039 14087

13 4001 5025 6273 8321 10369 2695 4743 6791 8839 10887 12103 14151

14 4033 5057 6401 8449 10497 2823 4871 6919 8967 11015 12167 14215

15 4065 5089 6529 8577 10625 2951 4999 7047 9095 11143 12231 14279

Modbus/TCP Protocol Guide 37

37
NOTES FOR HIGH-DENSITY DIGITAL (HDD) MODULES

Change in reporting analog counts for E2

The configuration method for E2 I/O units was simplified in E2 firmware R1.2a and PAC Project R9.5.
With the new method, you can configure E2s in PAC Control and PAC Manager just as you would
other I/O units, and configure their points as G1 modules rather than similar SNAP modules.
This change makes a difference in how the E2 I/O unit reports counts. Modules configured
directly as G1 modules (the new method) will report counts as G1 counts (0 to +4095 nominal
range). Modules configured under the old method will report counts as SNAP counts (0 to +25000,
or -25000 to +25000).

Notes for High-Density Digital (HDD) Modules

SNAP high-density digital input and output modules contain more than 4 points per module. They
have been handled differently in the Modbus memory map because additional registers have been
reserved.
Coils and inputs contain 32 numbers for each module, with an additional 32 reserved. Data for
each number is either 0 or 1. Numbers and corresponding points for a 32-channel HDD module in
position 0 are shown below as an example:
Coil/Input 513 514 515 516 517 518 519 520 537 538 539 540 541 542 543 544
Point 1 2 3 4 5 6 7 8 25 26 27 28 29 30 31 32

Coils or inputs from 545–576 are reserved, and then Module 1 starts at 577. On a 16-point HDD
module, module 0 would use coils or inputs 513–528; numbers 529–576 are reserved; and module
1 would still start at 577. See “High-Density Digital Module Register Table” on page 38 for additional
module starting numbers.
Registers contain 64 numbers for each module (since the data for each point requires two
registers), and an additional 64 registers are reserved. For example, on a 32-channel module in
position 0:
Register 513 515 517 519 521 523 525 527 561 563 565 567 569 571 573 575
514 516 518 520 522 524 526 528 562 564 566 568 570 572 574 576
Point 1 2 3 4 5 6 7 8 25 26 27 28 29 30 31 32

Registers 577–640 are reserved, and then module 1 starts at 641. See the table below for additional
modules.

High-Density Digital Module Register Table

The following table shows starting registers for the first point on each module on the largest rack.

Module Coils/Inputs Input Registers

Position
State On-Latch State Off-Latch State Counter Data Read & Clear Counter

0 513 1537 2561 513 2561

1 577 1601 2625 641 2689

2 641 1665 2689 769 2817

3 705 1729 2753 897 2945

38 Modbus/TCP Protocol Guide

CHAPTER 3: THE MODBUS MEMORY MAP

Module Coils/Inputs Input Registers

Position
State On-Latch State Off-Latch State Counter Data Read & Clear Counter

4 769 1793 2817 1025 3073

5 833 1857 2881 1153 3201

6 897 1921 2945 1281 3329

7 961 1985 3009 1409 3457

8 1025 2049 3073 1537 3585

9 1089 2113 3137 1665 3713

10 1153 2177 3201 1793 3841

11 1217 2241 3265 1921 3969

12 1281 2305 3329 2049 4097

13 1345 2369 3393 2177 4225

14 1409 2433 3457 2305 4353

15 1473 2497 3521 2433 4481

Modbus/TCP Protocol Guide 39

39
NOTES FOR HIGH-DENSITY DIGITAL (HDD) MODULES

40 Modbus/TCP Protocol Guide

Chapter 4

4: Accessing Other Data

Introduction
In most cases, communication between Modbus/TCP and Opto 22 systems uses the Modbus
memory map detailed in Chapter 3, which was designed to make communication easier. Always
look in Chapter 3 first to see if the data you want is available there.
However, if you need to read and write data in additional areas of the device’s memory map not
covered in Chapter 3, you can do so with any of the following controllers or I/O units:

SNAP-PAC-S1 OPTOEMU-SNR-DR1
SNAP-PAC-R1 OPTOEMU-SNR-DR2
SNAP-PAC-R1-B SNAP-B3000-ENET
SNAP-PAC-R2 SNAP-ENET-S64
SNAP-PAC-EB1 SNAP-UP1-M64
SNAP-PAC-EB2 SNAP-UP1-ADS
OPTOEMU-SNR-3V

NOTE: Digital-only I/O units and E1 and E2 I/O units do not support this advanced Modbus programming.

Why Access Other Data?

Some common reasons for needing to access other data in a device’s memory map include:
• Finding out the device’s unit type and firmware revision.
• Reading data placed in the device’s Scratch Pad area (for example, by a PAC Control strategy or
by another device) or writing data to the device’s Scratch Pad. Scratch Pad areas may include
bits, integers, floats, and strings, depending on the device. See form1704, PAC Manager User’s
Guide, for more information on Scratch Pad areas.

Accessible Data
All of the Opto 22 device’s regular OptoMMP memory map addresses in the range F000 0000 to
F1EB FFFE are directly available for reading and writing.
Addresses outside that range (or scattered addresses) may be indirectly accessed in one contiguous
chunk by using the Custom Data Access Area (F0D6 0000 to F0D6 0FFC) and Custom Configuration

Modbus/TCP Protocol Guide 41

41
DETERMINING MODBUS UNIT ID AND REGISTER

Area (F0D5 0000 to F0D5 0FFC) to map selected addresses into one area that is available for Modbus
reads and writes.
The complete OptoMMP memory map is in an appendix in Opto 22 form 1465, OptoMMP Protocol
Guide. This guide is available on our website, www.opto22.com; you’ll need it to obtain memory
map addresses, data type, and data length. For some addresses you’ll also need this guide to
interpret the data you receive (for example, a firmware version) or to know what data to send.
You can also use the Modbus Calculator in PAC Manager to convert memory map addresses to their
corresponding Modbus values.
When you’re working with the memory map addresses in the OptoMMP Protocol Guide, remember
that they refer to Opto 22 input/output points, which are zero-based. That is, the first module
position is position 0, and the first point on any module is point 0.

Modbus Master Requirements

As explained in Chapter 1, Opto 22 devices use a Modbus packet inside TCP/IP. The Modbus
checksum is not used; instead, the Ethernet TCP/IP link layer checksum guarantees data. The size of
the packet is limited to 256 bytes.
In order to access additional memory map addresses, the Modbus master needs to support Class 0
commands and the following function codes:

03 Read holding registers

06 Preset single register
10 Preset multiple registers

Determining Modbus Unit ID and Register

For the Modbus Memory Map in Chapter 3, you always use a unit ID (slave ID) of 1. However,
Opto 22 memory mapped devices contain far more data than can fit in the registers provided by the
Modbus protocol. To add more data, we used additional unit IDs.
To read and write to these other areas of the memory map, you need to determine the Modbus Unit
ID and Register Address that are equivalent to the I/O unit’s memory map address.
The easiest way is to use PAC Manager software to convert addresses. PAC Manager is included on
the CD that came with the Opto 22 device; it is also available for download from our website,
www.opto22.com (search on PAC Manager).
The basic steps for determining the Modbus Unit ID and Register are shown below; see form 1704,
PAC Manager User’s Guide for additional help. Or you can use form 1465, OptoMMP Protocol Guide, to
find the memory map addresses. Both guides are available on our website at www.opto22.com.

Finding OptoMMP Memory Map Addresses

Find the memory map address you need by locating it in form 1465, OptoMMP Protocol Guide, or by
using PAC Manager’s Inspect window. Here’s how to use PAC Manager’s Inspect window to find an
address. The Opto 22 device must be accessible from your PC in order to use this method.

42 Modbus/TCP Protocol Guide

CHAPTER 4: ACCESSING OTHER DATA

1. Start PAC Manager as follows:

– In Windows 7 and Windows Vista, press the Windows Start key, and then click Programs >
Opto 22 > PAC Project 9.5 > PAC Manager.
– In Windows 10 and Windows 8.1, press the Windows Start key, type PAC Manager 9.5
and then press the Enter key.

2. Click the Inspect icon .

Modbus/TCP Protocol Guide 43

43
DETERMINING MODBUS UNIT ID AND REGISTER

3. Type the device’s name or IP address in the Device Name field. Then click the button on the left
side of the window that corresponds to the memory map address you need to find.
For example, to find the memory map address for the device’s firmware version, click Status
Read.

Memory map address for Firmware Version

You need to know only the last eight digits of the memory map address, in this case, F030001C.

44 Modbus/TCP Protocol Guide

CHAPTER 4: ACCESSING OTHER DATA

Converting OptoMMP Memory Map Addresses

Now that you have found the memory map addresses you need, you can convert them.
1. From PAC Manager’s Tools menu, choose Modbus Calculator.

2. To convert an I/O unit memory map address to a Modbus Unit ID and Register Address, type
the last eight digits of the I/O unit’s memory map address in the MemMap Address field.
Make sure there are no spaces in the address (for example, type F0300020).

3. Click the right-arrow icon .

The equivalent Modbus Unit ID and Register appear.

NOTE: The Modbus unit ID and registers are decimal.

Modbus/TCP Protocol Guide 45

45
DETERMINING MODBUS UNIT ID AND REGISTER

Example: Reading an OptoMMP Memory Map Address

For example, suppose you want to read the status of Scratch Pad bits. You can determine the
memory map address in one of two ways:
• Use the PAC Manager Inspect window to find the address you want and copy it.
• Look in the OptoMMP Protocol Guide, find Scratch Pad addresses, and locate the address for the
current state of Scratch Pad bits.
Either way, you determine that the memory map address is F0D80000. Using PAC Manager, you
convert the MemMap address F0D80000 to a Unit ID of 110 and a Register Number of 0.
See the OptoMMP Protocol Guide to interpret the data you read.

Example: Writing to an OptoMMP Memory Map Address

As another example, suppose you want to send a powerup clear (PUC) to the Opto 22 device. This
operation code is in the Status Write area of the I/O unit’s memory map address. To determine the
address and format of the data to write in order to send a PUC, check the Status Write area in .
From the memory map appendix, you determine that the memory map address for an operation
code is F0380000, and the specific data you must write to send a PUC is 0x00000001. Using the
Modbus conversion page, you find that address F0380000 equals a Unit ID of 30 and a Register
Number of 0.

46 Modbus/TCP Protocol Guide

Index

A definition, 25
E1 digital point, 28
analog point SNAP digital point, 26
gain, definition, 26
maximum value, definition, 25
minimum value, definition, 25 D
offset, definition, 26
on E2 data, Modbus float format, 27, 28
counts, 38 digital point
features, 28 counter, definition, 25
gain, 29 latch, definition, 25
minimum/maximum values, 28 on E1
offset, 29 counters, 28
reading and writing value, 14 features, 27
scaling, 28 latches, 27
on SNAP, 36 reading and writing value, 14
configuration example, 24 on SNAP
features, 26 configuration example, 24
gain, 27 counters, 26
minimum/maximum values, 27 features, 26
offset, 27 high-density digital, 38
reading and writing value, 11 latches, 26
scaling, 27 reading and writing state, 10
point types, inputs, 18 state, definition, 25
point types, outputs, 24 documentation, 2
scaling, definition, 25
value, definition, 25
E
E2 analog counts, 38
C error codes, 7
calibrating analog input points, 26 exception codes, 7
coils, 31
communication overview, 5
communication packet format, 7 F
configuring I/O point firmware revision, determining, 41
SNAP analog/digital, 17 float format, Modbus, 27, 28
SNAP digital-only, 25 format
control strategy and Modbus, 4 of communication packet, 7
counter of Modbus float, 27, 28

Modbus/TCP Protocol Guide 47

47
function codes for Modbus/TCP, 6 E1 digital point, 27
SNAP digital point, 26

G
G4 I/O, 14 M
G4D32EB2 maximum value, 25
I/O module position, 14 minimum value, 25
G4EB2 minimum/maximum value
I/O module position, 14 E2 analog point, 28
gain SNAP analog point, 27
definition, 26 Modbus
E2 analog point, 29 and PAC Control strategy, 4
SNAP analog point, 27 coils, 31
communicating with Opto 22 devices, 3
communication diagram, 4
H communication overview, 5
hardware used with Modbus/TCP, 3 communication packet, 7
help, 3 exception errors, 7
high-density digital modules, 38 float format, 27, 28
holding registers, 35 function codes supported, 6
holding registers, 35
input registers, 34
I inputs, 33
I/O features
definitions, 25
E1 digital point, 27
O
E2 analog point, 28 off-latch, 25
SNAP analog point, 26 offset
SNAP digital point, 26 definition, 26
I/O module E2 analog point, 29
position on E1 rack, 13 SNAP analog point, 27
position on E2 rack, 13 on-latch, 25
position on G4EB2 or G4D32EB2 rack, 14 Opto 22 hardware, 3
position on SNAP rack, 9 Opto 22 memory-mapped protocol, 3
I/O point Opto 22 product support, 3
configuring SNAP analog/digital, 17 OptoMMP, 3
configuring SNAP digital-only, 25 finding memory map addresses, 42
features, 26 memory map, reading and writing to, 41
point types, 17
position on E1 rack, 13
position on E2 rack, 13 P
position on SNAP rack, 9 PAC Control, 4
SNAP configuration examples, 24 PAC Manager, 42
I/O, SNAP, high-density digital, 38 peak, 25
input registers, 34 point types, SNAP, 17
inputs, 33 product support, 3

L Q
latches Quad Pak, 13
definition, 25 Quad Pak I/O, 14

48 Modbus/TCP Protocol Guide

R T
reading technical support, 3
E1 digital points, 14 troubleshooting
E2 analog points, 14 exception errors, 7
SNAP analog modules, 36
SNAP analog points, 11
SNAP digital points, 10 V
SNAP high-density digital modules, 38 valley, 25
report slave ID command, 6 value of analog point, definition, 25

S W
scaling writing
description, 25 E1 digital points, 14
E2 analog point, 28 E2 analog points, 14
SNAP analog point, 27 SNAP analog modules, 36
Scratch Pad, reading or writing to, 41 SNAP analog points, 11
SNAP I/O SNAP digital points, 10
point configuration examples, 24 SNAP high-density digital modules, 38
point types, 17
state of digital point, definition, 25

Modbus/TCP Protocol Guide 49

49
50 Modbus/TCP Protocol Guide

M221 USer Guide
No ratings yet
M221 USer Guide
1,190 pages
01 Modicon m218 Logic Controller Programming Guide
100% (1)
01 Modicon m218 Logic Controller Programming Guide
188 pages
Modicon M221: Logic Controller Programming Guide
No ratings yet
Modicon M221: Logic Controller Programming Guide
292 pages
Easergy P5 - Communication - P5 - EN M - 11A - 2019 - 05
No ratings yet
Easergy P5 - Communication - P5 - EN M - 11A - 2019 - 05
176 pages
BOM RTU560 General Day1
No ratings yet
BOM RTU560 General Day1
107 pages
Modicon Quantum Ethernet 02
No ratings yet
Modicon Quantum Ethernet 02
255 pages
Door Controller
No ratings yet
Door Controller
199 pages
Alcatel Lucent Configuration Guide
100% (14)
Alcatel Lucent Configuration Guide
30 pages
1465 OptoMMP Protocol Guide
No ratings yet
1465 OptoMMP Protocol Guide
218 pages
1704 PAC Manager Users Guide
No ratings yet
1704 PAC Manager Users Guide
280 pages
DOCA0091EN-05 Modbus NSX
No ratings yet
DOCA0091EN-05 Modbus NSX
228 pages
Modicon M218 Logic Controller: Programming Guide
No ratings yet
Modicon M218 Logic Controller: Programming Guide
184 pages
PPC464-S IV Databook
No ratings yet
PPC464-S IV Databook
228 pages
TM2DO Programming
0% (1)
TM2DO Programming
218 pages
AGS-20 - Installation, Configuration and Commissioning Guideline - v01
50% (2)
AGS-20 - Installation, Configuration and Commissioning Guideline - v01
44 pages
1756-Um058 - En-P - ControlLogix Digital IO Modules User Manual
No ratings yet
1756-Um058 - En-P - ControlLogix Digital IO Modules User Manual
186 pages
ATV320 Modbus TCP EtherNet IP Manual NVE41313 02 PDF
No ratings yet
ATV320 Modbus TCP EtherNet IP Manual NVE41313 02 PDF
155 pages
1678 Modbus TCP Protocol Guide
No ratings yet
1678 Modbus TCP Protocol Guide
64 pages
TCP Motor Official Manual
No ratings yet
TCP Motor Official Manual
245 pages
Modicon M221 Logic Controller Programming Guide
No ratings yet
Modicon M221 Logic Controller Programming Guide
152 pages
Due® and Due® Controller Series Serial Communications and Configuration Software
No ratings yet
Due® and Due® Controller Series Serial Communications and Configuration Software
148 pages
ATV212 Modbus Manual en S1A53844 02
No ratings yet
ATV212 Modbus Manual en S1A53844 02
66 pages
FENA-01 - 11 - 21 - Ethernet Adapter - User's Manual - Rev B
No ratings yet
FENA-01 - 11 - 21 - Ethernet Adapter - User's Manual - Rev B
388 pages
Shneider Manuela M221 Persona
No ratings yet
Shneider Manuela M221 Persona
296 pages
IXC2 User Manual
0% (1)
IXC2 User Manual
102 pages
Rightsight Photoelectric Sensors With Io-Link Interface: User Manual
No ratings yet
Rightsight Photoelectric Sensors With Io-Link Interface: User Manual
86 pages
Eio0000004273 00
No ratings yet
Eio0000004273 00
510 pages
Fieldbus Guide V1.02
100% (1)
Fieldbus Guide V1.02
62 pages
UART - Specification by Texas Instruments
No ratings yet
UART - Specification by Texas Instruments
51 pages
Guard-Locking Proximity Inputs Safety Relay: User Manual
No ratings yet
Guard-Locking Proximity Inputs Safety Relay: User Manual
66 pages
Masterpact MTZ: Modbus Communication Guide
No ratings yet
Masterpact MTZ: Modbus Communication Guide
268 pages
002 2 Rev D
No ratings yet
002 2 Rev D
324 pages
45manual M238-Program PDF
No ratings yet
45manual M238-Program PDF
230 pages
Cisco - I AS MPLS PDF
No ratings yet
Cisco - I AS MPLS PDF
70 pages
CPX-FB14 2014-11d 526410g1 PDF
No ratings yet
CPX-FB14 2014-11d 526410g1 PDF
182 pages
Foundation Fieldbus Manual (Allen Bradley)
100% (1)
Foundation Fieldbus Manual (Allen Bradley)
184 pages
Compact NSX PDF
No ratings yet
Compact NSX PDF
228 pages
Modulos Analogos
No ratings yet
Modulos Analogos
168 pages
Interface Description Modbus
No ratings yet
Interface Description Modbus
120 pages
2009 Modbus Int Kit For PAC Control Users Guide
No ratings yet
2009 Modbus Int Kit For PAC Control Users Guide
46 pages
M221 Programming Guide - EIO0000001360.03 PDF
No ratings yet
M221 Programming Guide - EIO0000001360.03 PDF
180 pages
Modicon TSX Momentum Manual Modbus Plus Nef
No ratings yet
Modicon TSX Momentum Manual Modbus Plus Nef
18 pages
M238 Programming Guide
No ratings yet
M238 Programming Guide
226 pages
Altivar Process 900: Modbus SL Manual
No ratings yet
Altivar Process 900: Modbus SL Manual
118 pages
IoT Architecture & Protocols Syllabus
No ratings yet
IoT Architecture & Protocols Syllabus
2 pages
45manual m238 Program
No ratings yet
45manual m238 Program
230 pages
ATV32 Modbus Manual S1A28698 02
No ratings yet
ATV32 Modbus Manual S1A28698 02
65 pages
Modicon M221 Logic Controller Programming Guide en
No ratings yet
Modicon M221 Logic Controller Programming Guide en
238 pages
Lexium 32M - Ethernet TCP - IP Modbus
No ratings yet
Lexium 32M - Ethernet TCP - IP Modbus
75 pages
Digital I/O For Raspberry Pi Selection Guide: Form 2208
No ratings yet
Digital I/O For Raspberry Pi Selection Guide: Form 2208
62 pages
M221 Programming Guide
No ratings yet
M221 Programming Guide
182 pages
Manual Modbus para Atv32 Variador de Frecuencia
No ratings yet
Manual Modbus para Atv32 Variador de Frecuencia
65 pages
M238 Programming Guide
No ratings yet
M238 Programming Guide
256 pages
ATV32 Modbus TCP EtherNet IP Manual S1A28701 02
No ratings yet
ATV32 Modbus TCP EtherNet IP Manual S1A28701 02
146 pages
Altivar Machine 320: Variable Speed Drives For Synchronous and Asynchronous Motors Modbus Serial Link Manual
No ratings yet
Altivar Machine 320: Variable Speed Drives For Synchronous and Asynchronous Motors Modbus Serial Link Manual
84 pages
Popis Rozhraní
No ratings yet
Popis Rozhraní
36 pages
HPCN Chapter 1 Packet Switched Network HPCN Forouza
100% (1)
HPCN Chapter 1 Packet Switched Network HPCN Forouza
109 pages
CMB Io-7
No ratings yet
CMB Io-7
74 pages
1678 Modbus TCP Protocol Guide
No ratings yet
1678 Modbus TCP Protocol Guide
56 pages
SmartFusion Modbus TCP Demo Using LwIP and FreeRTOS UG
No ratings yet
SmartFusion Modbus TCP Demo Using LwIP and FreeRTOS UG
24 pages
Zutejupipobuzupiwulonale
No ratings yet
Zutejupipobuzupiwulonale
4 pages
FTM Parameters RU30
No ratings yet
FTM Parameters RU30
508 pages
Modbus To Ethernet Bridge User's Guide 174CEV30020
No ratings yet
Modbus To Ethernet Bridge User's Guide 174CEV30020
80 pages
Manoharbhai Patel Institute of Engineering Technology, Gondia
No ratings yet
Manoharbhai Patel Institute of Engineering Technology, Gondia
18 pages
Inter VRF prv2
No ratings yet
Inter VRF prv2
29 pages
Wireless Body Area Networks (WBAN) : Viswavardhanreddy K
No ratings yet
Wireless Body Area Networks (WBAN) : Viswavardhanreddy K
87 pages
Manual-balanceo-De-carga PCC Router Neutro 3 ADSL
No ratings yet
Manual-balanceo-De-carga PCC Router Neutro 3 ADSL
3 pages
Network Track of Huawei ICT Skill Competition Preliminary Stage Overview Competition Stage Exam Type Duration Total Score
No ratings yet
Network Track of Huawei ICT Skill Competition Preliminary Stage Overview Competition Stage Exam Type Duration Total Score
3 pages
Computer Networks Assignment: Network Design Proposal
No ratings yet
Computer Networks Assignment: Network Design Proposal
14 pages
6.7.12 Packet Tracer - Configure Cisco Devices For Syslog, NTP, and SSH Operations - ILM
No ratings yet
6.7.12 Packet Tracer - Configure Cisco Devices For Syslog, NTP, and SSH Operations - ILM
4 pages
DCI-MCQ Mock Questions: Load Balancing An Internet Proxies URL Filtering
No ratings yet
DCI-MCQ Mock Questions: Load Balancing An Internet Proxies URL Filtering
17 pages
Prepared By: Sanjay Singhal
No ratings yet
Prepared By: Sanjay Singhal
16 pages
ILO Federation - 4AA5-4727ENW
No ratings yet
ILO Federation - 4AA5-4727ENW
9 pages
DS Quiz
No ratings yet
DS Quiz
19 pages
Types of Networking Topology
No ratings yet
Types of Networking Topology
6 pages
Simulation and Realization of Baseband Pulse Shaping Filter For BPSK Modulator
No ratings yet
Simulation and Realization of Baseband Pulse Shaping Filter For BPSK Modulator
4 pages
CWT JSON-MQTT Protocol
No ratings yet
CWT JSON-MQTT Protocol
9 pages
GATEWAY
No ratings yet
GATEWAY
9 pages
A Survey On Power - Efficient Forward Error Correction Scheme For Wireless Sensor Networks
No ratings yet
A Survey On Power - Efficient Forward Error Correction Scheme For Wireless Sensor Networks
7 pages
Research Article: Review On The Detection of Sinkhole Attack in WSN Rupali Prajapati and Rajni Dubey
No ratings yet
Research Article: Review On The Detection of Sinkhole Attack in WSN Rupali Prajapati and Rajni Dubey
5 pages
Test Executedfg
No ratings yet
Test Executedfg
4 pages
FSK Modulation
No ratings yet
FSK Modulation
2 pages
30 Brochure RPV311
No ratings yet
30 Brochure RPV311
2 pages
Copper (RJ-45) SFP: Technical Specifications
No ratings yet
Copper (RJ-45) SFP: Technical Specifications
1 page