Modbus address arrays

Modbus defines access functions for different data arrays. These data arrays are declared as variables in a TwinCAT PLC program, e.g. as word arrays, and transferred to the Modbus slave function block as input parameters. Each array has a different Modbus start address, so that the arrays can be distinguished unambiguously. This offset has to be taken account of for addressing.

Inputs

The Inputs data array usually describes the physical input data with read-only access. They can be digital inputs (bit) or analog inputs (word). The PLC programmer can decide whether or not to grant the communication partner direct access to the physical inputs. It is also possible to define an input array for Modbus communication that is not identical with the physical inputs:

Definition of the Modbus input data as direct image of the physical inputs. Start and size of the data array can be specified freely. They are limited by the actual size of the input process image of the controller used.
VAR Inputs AT%IW0 : ARRAY[0..255] OF WORD; END_VAR
Definition of the Modbus input data as a separate Modbus data array independent of the physical inputs
VAR Inputs : ARRAY[0..255] OF WORD; END_VAR

Access to the Input array via a Modbus master is possible with the following Modbus functions:

 2 : Read input status 
    4 : Read Input Registers

Addressing

The Input array is addressed with a 0 offset, i.e. address 0 as transferred in the telegram addresses the first element in the input data array.

Examples:

PLC variable	Access type	Address in the Modbus telegram	Address in the end device (device-dependant)
Inputs[0]	Word	16#0	30001
Inputs[1]	Word	16#1	30002
Inputs[0], Bit 0	Bit	16#0	10001
Inputs[1], Bit 14	Bit	16#1E	1001F

Outputs

The Outputs data array usually describes the physical output data with read and write access. Outputs can be digital outputs (coils) or analog outputs (output registers). Like for the Inputs, the array can be declared as a physical output variable or as a simple variable.

Definition of the Modbus output data as direct image of the physical outputs. Start and size of the data array can be specified freely. They are limited by the actual size of the output process image of the controller used.
VAR Outputs AT%QW0 : ARRAY[0..255] OF WORD; END_VAR
Definition of the Modbus output data as a separate Modbus data array independent of the physical outputs
VAR Outputs : ARRAY[0..255] OF WORD; END_VAR

Access to the Output array via a Modbus master is possible with the following Modbus functions:

 1 : Read Coil Status 
     3 : Read Holding Registers
     5 : Force Single Coil
     6 : Preset Single Register
    15 : Force Multiple Coils
    16 : Preset Multiple Registers

Addressing

The Output array is addressed with a 16#800 offset, i.e. address 16#800 as transferred in the telegram addresses the first element in the output data array.

Examples:

PLC variable	Access type	Address in the Modbus telegram	Address in the end device (device-dependant)
Outputs[0]	Word	16#800	40801
Outputs[1]	Word	16#801	40802
Outputs[0], Bit 0	Bit	16#800	00801
Outputs[1], Bit 14	Bit	16#81E	0081F

Memory

The Memory data array describes a PLC variable array without physical I/O assignment.

Definition of the Modbus memory data as PLC flags. Start and size of the data array can be specified freely.
VAR Memory AT%MW0 : ARRAY[0..255] OF WORD; END_VAR
Definition of the Modbus memory data as variable without flag address
VAR Memory : ARRAY[0..255] OF WORD; END_VAR

Access to the Memory array via a Modbus master is possible with the following Modbus functions:

 3 : Read Holding Registers 
     6 : Preset Single Register
    16 : Preset Multiple Registers

Addressing

The Memory array is addressed with a 16#4000 offset, i.e. address 16#4000 as transferred in the telegram addresses the first word in the output data array.

Examples:

PLC variable	Access type	Address in the Modbus telegram	Address in the end device (device-dependant)
Memory[0]	Word	16#4000	44001
Memory[1]	Word	16#4001	44002