105BCommunication processor
12.5 Modbus communication
S7-1200 Programmable controller
582
System Manual, 11/2011, A5E02486680-05
Table 12- 46 Write data functions: Write remote I/O and modify program data
Modbus function code
Write slave (server) functions - standard addressing
05
Write one output bit: 1 bit per request
06
Write one holding register: 1 word per request
15
Write one or more output bits: 1 to 1968 bits per request
16
Write one or more holding registers: 1 to 123 words per request
●
Modbus function codes 08 and 11 provide slave device communication diagnostic
information.
●
Modbus function code 0 broadcasts a message to all slaves (with no slave response).
The broadcast function is not available for Modbus TCP, because communication is
connection based.
Table 12- 47 Modbus network station addresses
Station
Address
Standard station address
1 to 247
RTU station
Extended station address
1 to 65535
TCP station
Station address
IP address and port number
Modbus memory addresses
The actual number of Modbus memory addresses available depends on the CPU model,
how much work memory exists, and how much CPU memory is used by other program data.
The table below gives the nominal value of the address range.
Table 12- 48 Modbus memory addresses
Station
Address range
Standard memory address
10K
RTU station
Extended memory address
64K
TCP station
Standard memory address
10K
Modbus RTU communication
Modbus RTU (Remote Terminal Unit) is a standard network communication protocol that
uses the RS232 or RS485 electrical connection for serial data transfer between Modbus
network devices. You can add PtP (Point to Point) network ports to a CPU with a RS232 or
RS485 CM or a RS485 CB.
Modbus RTU uses a master/slave network where all communications are initiated by a
single Master device and slaves can only respond to a master’s request. The master sends a
request to one slave address and only that slave address responds to the command.
