1678 Modbus TCP Protocol Guide
1678 Modbus TCP Protocol Guide
1678 Modbus TCP Protocol Guide
Wired+Wireless controllers and brains are licensed under one or more of the following patents: U.S. Patent No(s). 5282222,
RE37802, 6963617; Canadian Patent No. 2064975; European Patent No. 1142245; French Patent No. 1142245; British Patent
No. 1142245; Japanese Patent No. 2002535925A; German Patent No. 60011224.
Opto 22 FactoryFloor, groov, groov EPIC, Optomux, and Pamux are registered trademarks of Opto 22. Generation 4, groov
Server, ioControl, ioDisplay, ioManager, ioProject, ioUtilities, mistic, Nvio, Nvio.net Web Portal, OptoConnect, OptoControl,
OptoDataLink, OptoDisplay, OptoEMU, OptoEMU Sensor, OptoEMU Server, OptoOPCServer, OptoScript, OptoServer,
OptoTerminal, OptoUtilities, PAC Control, PAC Display, PAC Manager, PAC Project, PAC Project Basic, PAC Project Professional,
SNAP Ethernet I/O, SNAP I/O, SNAP OEM I/O, SNAP PAC System, SNAP Simple I/O, SNAP Ultimate I/O, and Wired+Wireless
are trademarks of Opto 22.
ActiveX, JScript, Microsoft, MS-DOS, VBScript, Visual Basic, Visual C++, Windows, and Windows Vista are either registered
trademarks or trademarks of Microsoft Corporation in the United States and other countries. Linux is a registered
trademark of Linus Torvalds. ARCNET is a registered trademark of Datapoint Corporation. Modbus is a registered trademark
of Schneider Electric, licensed to the Modbus Organization, Inc. Wiegand is a registered trademark of Sensor Engineering
Corporation. Allen-Bradley, CompactLogix, ControlLogix, MicroLogix, SLC, and RSLogix are either registered trademarks or
trademarks of Rockwell Automation. CIP and EtherNet/IP are trademarks of ODVA. Raspberry Pi is a trademark of the
Raspberry Pi Foundation. The registered trademark Ignition by Inductive Automation® is owned by Inductive Automation
and is registered in the United States and may be pending or registered in other countries.
groov includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org)
All other brand or product names are trademarks or registered trademarks of their respective companies or organizations.
Opto 22
Automation Made Simple.
Chapter 1: Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1
About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Notes on Specific Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Other Guides You May Need . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
For Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
About Opto 22 Devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Opto 22 Devices as Modbus Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Communication Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Overview of Modbus Communication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Understanding Opto 22 and Modbus Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Function Codes Supported . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Report Slave ID Function Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Communication Packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Exception Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
1: Introduction
GRV-EPIC-PR1 SNAP-PAC-EB2-W
SNAP-PAC-R1 E1
SNAP-PAC-R1-B E2
SNAP-PAC-R1-FM G4EB2
SNAP-PAC-R1-W G4D32EB2
SNAP-PAC-R2 G4D32EB2-UPG
SNAP-PAC-R2-FM SNAP-B3000-ENET
SNAP-PAC-R2-W SNAP-ENET-RTC
SNAP-PAC-EB1 SNAP-ENET-S64
SNAP-PAC-EB1-FM SNAP-ENET-D64
SNAP-PAC-EB1-W SNAP-UP1-ADS
SNAP-PAC-EB2 SNAP-UP1-M64
SNAP-PAC-EB2-FM SNAP-UP1-D64
Standalone controllers:
SNAP-PAC-S1 SNAP-PAC-S2
SNAP-PAC-S1-FM SNAP-PAC-S2-W
SNAP-PAC-S1-W
OPTOEMU-SNR-3V OPTOEMU-SNR-DR1
OPTOEMU-SNR-DR2
The groov EPIC processor (GRV-EPIC-PR1) acts as a Modbus slave, and this guide covers how to use EPIC as
a Modbus slave. However, groov View running on the EPIC processor acts as a Modbus master; for instructions
on using Modbus/TCP devices with a groov View master, see the groov View User’s Guide.
For energy monitoring units, this guide is only a reference. Find primary information for Modbus
communication in form 1958, OptoEMU Sensor Communication Guide.
Contents
This guide includes the following:
Chapter 1: Introduction—(this chapter) Supported Modbus function codes, communication packet, and
exception codes, as well as details about this guide and Opto 22 Product Support.
Chapter 2: Configuring I/O for Modbus/TCP—How to configure and use input/output (I/O) channels and
channel features with Modbus/TCP.
Chapter 3: The Modbus Memory Map—Coils, inputs, input registers, and holding registers used by most
Opto 22 devices.
Chapter 4: Accessing Other Data—Ways to access data not included in coils, inputs, and registers.
FOR HELP
If you have problems using Modbus/TCP with Opto 22 products and cannot find the help you need in this
guide or on our website, contact Opto 22 Product Support.
Phone: 800-TEK-OPTO (800-835-6786 toll-free NOTE: Email messages and phone calls
in the U.S. and Canada) to Opto 22 Product Support are
951-695-3080 grouped together and answered in the
Monday through Friday, order received.
7 a.m. to 5 p.m. Pacific Time
Fax: 951-695-3017
Email: support@opto22.com
When calling for technical support, you can help us help you faster if you can provide the following
information to the Product Support engineer:
• A screen capture of the Help > About dialog box showing software product and version (available by
clicking Help > About in the application’s menu bar).
• Opto 22 hardware part numbers or models that you’re working with.
• Firmware version (available in PAC Manager by clicking Tools > Inspect).
• Specific error messages you saw.
• Version of your computer’s operating system.
Opto 22 Ethernet-based devices use a memory-mapped protocol (OptoMMP), which is based on the
IEEE 1394 standard. The coils, inputs, and registers described in Chapter 3: The Modbus Memory Map are
mapped to areas within the I/O processor’s memory map.
Although the most common use for communication between Modbus systems and Opto 22 systems is
sending and receiving I/O channel data on an I/O unit, you may also need to obtain other data, from either an
I/O unit or a controller. This other data, such as Scratch Pad data, exists in the I/O unit’s or controller’s memory
map and can be accessed by following the steps in Chapter 4: Accessing Other Data.
In all these cases the Opto 22 device acts as the Modbus slave.
Communication Example
The diagram on the following page shows an example of how an Opto 22 system might communicate with a
Modbus system. This is just one example; many other configurations are possible.
In this example, the SNAP-PAC-S1 standalone controller runs a PAC Control strategy that monitors and controls
the I/O units and all the I/O channels on them. Simultaneously, the Modbus system can exchange data with
the Opto 22 system.
Because the two Ethernet network interfaces on the SNAP-PAC-S1 are independent interfaces with separate IP
addresses, the Opto 22 control network can be segmented from the computer network. This example shows
this type of segmentation, as the PC is attached to Ethernet switch #1 and the control network is on Ethernet
switch #2.
Because the Modbus/TCP hardware is also on switch #2, it can send data to and from every I/O unit shown. In
this example the Modbus/TCP software running on the PC, attached to switch #1, can access data only from
the controller; for instance, it might access data placed in the controller’s Scratch Pad by the PAC Control
strategy.
CAUTION: If you use PAC Control, be careful that Modbus writes to I/O channels don’t conflict with strategy logic.
We recommend our free Modbus Integration Kit for PAC Control (part number PAC-INT-MB), available from the
Opto 22 website .
If you are not using PAC Control, Modbus/TCP hardware or software on the same network segment as I/O
units can provide full control for I/O channels.
Ethernet switch #1
SNAP-PAC-S1
controller (runs a
PAC Control
strategy to control
Ethernet switch #2
all I/O units) Modbus/TCP
hardware
E2 I/O unit
The following table shows Modbus function codes supported for I/O units. (Function codes for a specific I/O
unit depend on the analog/digital capabilities of the brain.)
Modbus Function
Definition Opto 22 Equivalent
Code (Hex)
01 Read coil status Read digital output
02 Read input status Read digital input
03 Read holding registers Read analog output
04 Read input registers Read analog input
05 Force single coil Turn on/off one digital output
06 Preset single register Write one analog output
0F Force multiple coils Turn on/off multiple digital outputs
10 Preset multiple registers Write multiple analog outputs
Report hardware and firmware revision levels
11 Report slave ID
(See below: “Report Slave ID Function Code” )
Function code 0x11, Report slave ID, returns data bytes as shown in the following table.
Bytes 1 and 2 are always in the formats shown. The 0x22 in byte 1 indicates an Opto 22 brain; 0xFF appears in
byte 2 because, since the brain is a slave, it is always running.
Byte 1 Byte 2 Bytes 3–6 Bytes 7–10 Bytes 11–14
Communication Packet
As the Modbus/TCP specification requires, Opto 22 devices use a Modbus packet inside a TCP/IP packet. The
Modbus checksum is not used; instead, the Ethernet TCP/IP link layer checksum guarantees data. The size of
the packet is limited to 256 bytes. The packet follows the standard Modbus/TCP format.
Note: You can read a maximum of 127 input or holding registers in one command 03 or 04.
Exception Errors
If an error occurs, standard Modbus exception codes are returned in the Modbus packet. The following table,
reprinted from the Modicon Modbus Protocol Reference Guide, shows the Modbus exception codes. If you need
more information, see the Modicon documentation.
Code Name Meaning
The function code received in the query is not an allowable action for
01 ILLEGAL FUNCTION
the slave.
ILLEGAL DATA The data address received in the query is not an allowable address for
02
ADDRESS the slave.
A value contained in the query data field is not an allowable value for
03 ILLEGAL DATA VALUE
the slave.
An unrecoverable error occurred while the slave was attempting to per-
04 SLAVE DEVICE FAILURE
form the requested action.
The slave has accepted the request and is processing it, but a long dura-
tion of time will be required to do so. This response is returned to prevent
05 ACKNOWLEDGE
a timeout error from occurring in the master. The master can next issue a
Poll Program Complete message to determine if processing is completed.
The slave is engaged in processing a long-duration program command.
06 SLAVE DEVICE BUSY
The master should retransmit the message later when the slave is free.
The slave cannot perform the program function received in the query. This
NEGATIVE code is returned for an unsuccessful programming request using function
07
ACKNOWLEDGE code 13 or 14 decimal. The master should request diagnostic or error
information from the slave.
The slave attempted to read extended memory, but detected a parity error
MEMORY PARITY
08 in the memory. The master can retry the request, but service may be
ERROR
required on the slave device.
INTRODUCTION
This chapter includes the following:
• Illustrations of module and channel positions on I/O units and how they relate to coils, inputs, and
registers in Modbus/TCP (below)
• I/O channel configuration required for communication with Modbus/TCP systems (page 17)
• channel features and how to use them with Modbus/TCP (page 28).
Ch: 23 0
Module position 2, discrete,
12 channels:
Ch: 11 0
Ch: 7 6 5 4 3 2 1 0
Points: 3 2 1 0
Points: 7 6 5 4 3 2 1 0
Points: 1 0
Module position 14, serial:
Ports: B A
The following examples show how SNAP module and channel numbers relate to Modbus coils, inputs, and
registers.
The following table shows the coils or inputs you would read or write to for channel states on SNAP 4-channel
digital modules.
NOTE: For high-density digital modules (digital modules with more than four channels), different coils and inputs are
used. See “Input Registers” on page 36 and “Holding Registers” on page 37. Also see “Notes for groov I/O and SNAP
High-Density Digital (HDD) Modules” on page 40.
SNAP Example 2: Reading/Writing Analog Channel Values to Input and Holding Registers
Analog channel values in input and holding registers are in the form of 32-bit floats. Because Modbus registers
contain only 16 bits, two consecutive registers are used to read or write the data for one channel. The
following table shows the input or holding registers you would use to read or write analog channel values,
depending upon the number of channels on the module (one, two, or four channels).
NOTE: Analog modules with more than four channels use different registers. See “Input Registers” on page 36 and
“Holding Registers” on page 37. Also see the table showing starting registers on page 40.
Reading/Writing Analog Channel Values to Input and Holding Registers (Modules with four channels
or less. Only the first eight modules are shown; the rack may hold up to 16.)
SNAP 4-Channel Analog I/O SNAP 2-Channel Analog I/O SNAP 1-Channel Analog I/O
Module Channel Registers Module Channel Registers Module Channel Registers
0 1-2 0 1-2 0 0 1-2
0
1 3-4 1 3-4 -- -- --
0
2 5-6 -- -- -- -- -- --
3 7-8 -- -- -- -- -- --
0 9-10 0 9-10 1 0 9-10
1
1 11-12 1 11-12 -- -- --
1
2 13-14 -- -- -- -- -- --
3 15-16 -- -- -- -- -- --
0 17-18 0 17-18 2 0 17-18
2
1 19-20 1 19-20 -- -- --
2
2 21-22 -- -- -- -- -- --
3 23-24 -- -- -- -- -- --
0 25-26 0 25-26 3 0 25-26
3
1 27-28 1 27-28 -- -- --
3
2 29-30 -- -- -- -- -- --
3 31-32 -- -- -- -- -- --
0 33-34 0 33-34 4 0 33-34
4
1 35-36 1 35-36 -- -- --
4
2 37-38 -- -- -- -- -- --
3 39-40 -- -- -- -- -- --
0 41-42 0 41-42 5 0 41-42
5
1 43-44 1 43-44 -- -- --
5
2 45-46 -- -- -- -- -- --
3 47-48 -- -- -- -- -- --
0 49-50 0 49-50 6 0 49-50
6
1 51-52 1 51-52 -- -- --
6
2 53-54 -- -- -- -- -- --
3 55-56 -- -- -- -- -- --
0 57-58 0 57-58 7 0 57-58
7
1 59-60 1 59-60 -- -- --
7
2 61-62 -- -- -- -- -- --
3 63-64 -- -- -- -- -- --
E1 with G4 modules.
Module position 0
E2 with G1 modules.
Module position 0
Module position 0
The following examples illustrate how E1 and E2 module and channel numbers relate to Modbus coils, inputs,
and registers. For complete coil, input, and register information, see Chapter 3: The Modbus Memory Map on
page 33.
The following table shows the coils or inputs you would read or write to for channel states on E1 digital
modules.
E1 Digital I/O E1 Digital I/O
Module/Channel Coil or Input Module/Channel Coil or Input
0 1 8 9
1 2 9 10
2 3 10 11
3 4 11 12
4 5 12 13
Channel values in input and holding registers are in the form of 32-bit floats. Because Modbus registers
contain only 16 bits, two consecutive registers are used to read or write the data for one channel. The
following table shows the input or holding registers you would use to read or write E2 analog channel values.
E2 Analog I/O E2 Analog I/O
Input or Holding Input or Holding
Module/Channel Module/Channel
Registers Registers
0 1-2 8 17-18
1 3-4 9 19-20
2 5-6 10 21-22
3 7-8 11 23-24
4 9-10 12 25-26
5 11-12 13 27-28
6 13-14 14 29-30
7 15-16 15 31-32
Each module has just one channel. You can mix input and output modules within the same group of four
channels.
Module position 0
The following table shows the coils or inputs you would read or write to for channel states on G4 modules.
G4 Digital I/O G4 Digital I/O
Module/Channel Coil or Input Module/Channel Coil or Input
0 1 16 17
1 2 17 18
2 3 18 19
3 4 19 20
4 5 20 21
5 6 21 22
6 7 22 23
7 8 23 24
8 9 24 25
9 10 25 26
10 11 26 27
11 12 27 28
12 13 28 29
13 14 29 30
14 15 30 31
15 16 31 32
Quad Pak modules have four input or four output channels per module, so the four channels in each group are
either inputs or outputs.
The following table shows the coils or inputs you would read or write to for channel states on Quad Pak
modules.
Quad Pak Digital I/O Quad Pak Digital I/O
Module Channel Coil or Input Module Channel Coil or Input
0 1 16 17
1 2 17 18
0 4
2 3 18 19
3 4 19 20
4 5 20 21
5 6 21 22
1 5
6 7 22 23
7 8 23 24
8 9 24 25
9 0 25 26
2 6
0 11 26 27
11 12 27 28
12 13 28 29
13 14 29 30
3 7
14 15 30 31
15 16 31 32
• groov Manage—If you are not using PAC Control, configure channels in groov Manage, either on the
EPIC processor’s touchscreen or remotely from a computer or mobile device. Configurations are
automatically saved to flash memory.
• Modbus/TCP—If Modbus/TCP is the ONLY communication to the groov I/O unit, then follow the steps
in this section to configure I/O channels. Configurations are automatically saved.
The following table shows groov I/O modules and the module and channel types to use for configuration. If a
module offers more than one range, choose the range you want from the Description column and read across
to the Channel ID (hex) column to find the corresponding configuration value.
Channel ID (hex)
Module ID (hex)
Channels per
Default units
Low Scale
Full Scale
module
Part number Description
Channel ID (hex)
Module ID (hex)
Channels per
Default units
Low Scale
Full Scale
module
Part number Description
To configure I/O channels for Modbus/TCP, write the channel configuration data from the previous table to
holding registers 11271–13318. Since the data for this area of the Modbus map is in the form of 32-bit
integers, use two consecutive registers to write the data to one channel.
For example, look at the table starting on page 18. Suppose the module in position 0 on the rack is a
GRV-IV-24 and you want to use a range of ±10 V for the first two channels (channels 0 and 1). You find the
module’s range in the Description column and read across to see the configuration value to use, 0x60000017.
Now take a look at the Holding Registers section of the Modbus map on page 37. You will write to the
Configure Channels area, registers 11271–13318. Since it takes two registers per channel and you are
configuring the first two channels, you write the hex value 60000017 (for a -10 to +10 V input) as follows:
To this register: 11271 11272
Channel 0
Write this value: 6000 0017
To this register: 11273 11274
Channel 1
Write this value: 6000 0017
Word swapped. The registers and values shown in the table are correct if your groov I/O unit is using the
default Big Endian format. However, if you have configured the I/O unit in groov Manage to be Big Endian
Word Swapped, you would reverse the registers for each channel. For example, for channel 0 you would write
0017 to register 11271 and 6000 to register 11272.
All SNAP analog/digital I/O units recognize analog, serial, and high-density digital modules on the rack.
Positions on the rack that don’t contain modules the I/O unit recognizes are assumed to contain digital input
modules. If the individual channel types on the module differ from the default type for that module, you must
configure the channels using the tables below.
The following tables show SNAP I/O modules that can be used with Ethernet-based I/O units and
Modbus/TCP (some older I/O units cannot use all of these modules; see the module’s data sheet for
compatibility). Default channel types are shaded. If a channel differs from the default, use the value in the
Channel Type (Hex) column to configure the channel. For examples of channel configuration, see page 28,
following the tables.
Digital Inputs and Outputs
Channel Type Channel Type Module Type
Module & Description
(Dec) (Hex) (Hex)
4-channel digital input module* 256 100 00
4-channel digital output module* 384 180 00
* High-density digital modules are automatically recognized; channels do not require configura-
tion.
Analog Inputs
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Analog Outputs
Module Type (Hex)
Default Unit of
Measurement
Underrange
Overrange
Low scale
Full scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low scale
Full scale
Part Number &
Description
To configure I/O channels for Modbus/TCP, write the channel configuration data from the previous table to
holding registers 11271–13318. Since the data for this area of the Modbus map is in the form of 32-bit
integers, use two consecutive registers to write the data to one channel.
For example, look at the tables starting on page 20. If the module in position 0 on the rack is a SNAP-AIV with
a -5 to +5 V input, it is not the default for that module. Therefore you must configure its channels. Now take a
look at the Holding Registers section of the Modbus map on page 37. You will write to the Configure Channels
area, registers 11271–13318. Since it takes two registers per channel and the analog module has two
channels, you write the hex value 0B (for a -5 to +5 V analog input) to the first four registers, 11271–11274.
As another example, suppose the module in position 1 on the rack is a 4-channel digital output module. Since
the default is a 4-channel digital input module, you must configure its channels. You write the hex value 180
(for a 4-channel digital output module) to the registers for module 1.
The following features are discussed in this chapter. See the referenced pages for more information on using
them in your application.
See
Feature Description
For EPIC For SNAP For E1/E2
Channel (digital inputs and outputs)—A digital channel is either on or off. You can read the
page 40 page 11 page 14
States current state of a digital input or write an on/off state to a digital output.
Channel (analog inputs and outputs)—An analog channel has a range of values. You can
page 39 page 12 page 15
Values read the current value of an analog input or write a value to an analog output.
(digital inputs)—When the value of a digital input channel changes from off to on, an
on-latch is automatically set. While the value of the channel may return to off, the
Latches on-latch remains set, as a record of the change, until you clear it. Similarly, an page 40 page 29 page 31
off-latch is set when the value of a digital channel changes from on to off, and it
remains set until cleared.
(digital inputs)—A counter keeps track of the number of times a digital input changes
from off to on. The count accumulates until it reaches the maximum count available
in the I/O unit or until you reset the counter to zero. For example, to count the num-
Counters ber of widgets produced per shift, you would clear the counter at the start of each page 40 page 29 page 31
shift and read it at the end of each shift.
The speed of the counter depends upon the I/O processor’s capabilities and the
speed of the module used.
(analog channels)—Analog input and output channels can be scaled as needed. For
Scaling page 39 page 30 page 32
example, you can scale a -5 V to +5 V input channel to reflect 0% to 100%
(analog inputs)—Minimum and maximum values are sometimes called peaks and
Minimum & valleys. You can read these values at any time, for example, to record minimum and
maximum maximum temperatures. You can also reset min/max values. For example, if you page 39 page 31 page 32
values want to record the maximum temperature at channel 2 in each 24-hour period, you
must reset the values after they are read each day.
(analog inputs) Offset and gain calculations are used to calibrate analog channels. If
Offset and a -50 mV to +50 mV input receives signals that are slightly off (not exactly -50 mV at
page 39 page 31 page 32
gain the lowest channel, for example), the offset and gain can be calculated so that val-
ues will appear accurately when read.
Latches
Latches are a channel feature automatically available on SNAP Ethernet-based I/O units; they do not require
configuration. To use latches, see the Modbus memory maps beginning on page 33.
Counting is available on groov digital I/O except for modules with an S in the part number, which provide
on/off status only.
Counters must be configured using holding registers 13319–15366. Because the data is in the form of a 32-bit
integer, use two consecutive registers for each channel. For example, to configure module 0, channel 0 as a
counter, you would write the following:
To these registers: 13319 13320
Write this: 0 1
To read counters on groov I/O, read input registers 513–2560 (or read and clear counters using input registers
2561–4608). Read two consecutive registers per channel. See “Notes for groov I/O and SNAP High-Density
Digital (HDD) Modules” on page 40
High-Speed Counters. Analog/digital SNAP I/O units with high-speed capability (such as SNAP-PAC-R1
and SNAP-PAC-EB1 I/O units) support high-speed counters on any 4-channel digital input; the actual counter
speed depends on the module. Digital-only and analog/simple digital I/O units (such as SNAP-PAC-R2 and
SNAP-PAC-EB2 I/O units) do not support high-speed counters. High-speed counters require configuration. See
below, “Using Counters .”
Other Counters. Channels on SNAP high-density digital modules automatically provide counting. These
counters are not high speed; see the module’s data sheet for specific information.
Using Counters . High-speed counters on SNAP 4-channel modules involve two steps: configure the
counter and read data. Counters on SNAP high-density digital modules do not need configuration for
Modbus/TCP.
• To configure a high-speed counter, write to holding registers 13319–15366. Remember that you use two
consecutive registers for each channel, since the data is in the form of a 32-bit integer. For example, to
configure module 0, channel 0 as a counter, you would write the following:
To these registers: 13319 13320
Write this: 0 1
• To read high-speed counter data, read input registers 385–512. Read two consecutive registers per
channel.
• To clear a high-speed counter, write to coils 257–320. For example, to clear the counter on module 0,
channel 0, you would write a 1 to coil 257.
• To read counters on high-density digital modules, read input registers 513–2560 (or read and clear
counters using input registers 2561–4608). Read two consecutive registers per channel.
Scaling
To scale an analog channel, write the low-scale value to holding registers 7175–9222 and the high-scale value
to holding registers 9223–11270. Write to two consecutive registers for each channel you are scaling.
Minimum and maximum values are analog channel features. The I/O unit automatically keeps track of
minimum and maximum values; they do not require configuration. You can read the values at any time, for
example to record minimum and maximum temperatures. You can also clear them.
• To read min/max values, read input registers 6657–10752. Read two consecutive registers per channel.
• To clear min/max values, write 1 bits to coils 3585–5632.
Offset and gain are also analog channel features on groov I/O and SNAP I/O units. Setting offset and gain for
analog input channels is important to make sure that values appear accurately when read. If a -50 mV to +50
mV input receives signals that are slightly off (not exactly -50 mV at the lowest channel, for example), you can
set offset and gain to adjust them.
Calculate offset first, and then calculate gain. The offset must be calculated at the channel’s low scale, and the
gain must be calculated at the channel’s high scale.
Once you have calculated offset and gain values, write them to the I/O unit. To set offset, write to holding
registers 3079–5126, using two consecutive registers per channel. To set gain, write to holding registers 5127–
7174. See
Latches
Latches are a digital channel feature available on E1 brain boards. They do not require configuration. Read and
clear latches as shown in the following table and the Modbus memory map beginning on page 33.
To do this Use these coils/inputs
Read the on-latch state Read inputs 65–80
Read the off-latch state Read inputs 129–144
Clear on-latches Write to coils 129–144
Clear off-latches Write to coils 193–208
Counters
Using counters involves three steps: configure the counter (holding registers 769-800), activate the counter
(coils 65-80), and read data (input registers 385-416). See the Modbus memory map beginning on page 33 to
find the coils and registers mentioned.
To do this Use these coils/registers
Write to holding registers 769–800. Remember that you use two consecutive reg-
isters for each channel, since the data is in the form of a 32-bit integer but the
registers are 16 bits each. For example, to configure channel #1 as a counter, you
Configure a counter would write 01 to registers 769-770.
To these registers: 769 770
Write this: 0 1
Write to coils 65-80. For example, to activate the counter for channel #1, you
Activate a counter
would write to coil number 65.
Read counter data Read input registers 385–416. Read two consecutive registers per channel.
Write to coils 257–272. For example, to clear the counter on channel #1, you
Clear a counter
would write a 1 to coil 257.
Configuration of E1 and E2 brain boards is simplified in E1/E2 firmware R1.2a (and higher) and in PAC Project
9.5000 (and higher). Also, if a SNAP PAC controller communicates with the E1 or E2, the controller must have
PAC firmware R9.5a (or higher) to use the simplified configuration method.
If you are not using these firmware and software versions, you must scale analog channels when you
configure I/O. For details, see Opto 22 form 1576, I/O Configuration for E1 and E2 Brain Boards.
Minimum and maximum values (also called peaks and valleys) are automatically tracked on the E2 and do not
require configuration. For example, you can read the values at any time to record minimum and maximum
pressures. You can also clear them.
NOTE: The E2 does not maintain minimum and maximum values for temperature.
• To read min/max values, read input registers 129–160 (min) and 257–288 (max). Read two consecutive
registers per channel.
• To clear min/max values, write 1 bits to coils 321–336 (min) and 385–400 (max).
You can monitor current values for offset and gain using holding registers 129–160 and 257–288. To perform
calibration on analog channels, use PAC Manager. See the PAC Manager User’s Guide.
As mentioned, the configuration method for E2 I/O units was simplified in E2 firmware R1.2a and PAC Project
R9.5. With the new method, you can configure E2s in PAC Control and PAC Manager just as you would other
I/O units, and configure their channels as G1 modules rather than similar SNAP modules.
This change makes a difference in how the E2 I/O unit reports counts. Modules configured directly as G1
modules (the new method) will report counts as G1 counts (0 to +4095 nominal range). Modules configured
under the old method will report counts as SNAP counts (0 to +25000, or -25000 to +25000).
INTRODUCTION
The following tables show the coils, inputs, input registers, and holding registers that apply to Opto 22 devices
supporting Modbus/TCP. We call these the Modbus memory map.
New areas have been added to the Modbus memory map to accommodate new higher-density digital and
analog modules, including groov I/O modules. As a result, the functions of some coil, input, and register
numbers have been duplicated in larger areas. In the following tables, the older numbers are shown in
brackets. These older numbers can still be used for backward compatibility, but we recommend using the
referenced larger areas for new development.
NOTE: Because digital counters and module configuration require more than one bit, they are handled in input and
holding registers.
COILS NUMBER
For SNAP 4-channel digital I/O modules: For these modules, up to 64 channels are available on the largest
SNAP I/O rack; therefore, digital coils contain 64 numbers. Each number contains the data for one channel.
Data is either 0 or 1.
For digital and analog I/O on E1 and E2 I/O units: These racks contain up to 16 channels, so coils contain
16 numbers, each with the data for one channel. Data is either 0 or 1.
For groov I/O, SNAP high-density digital I/O, and SNAP analog minimum/maximum: Coils contain
512 numbers, with an extra 512 coils reserved. See “Notes for groov I/O and SNAP High-Density Digital (HDD)
Modules” on page 40 and “Notes for All Analog Modules” on page 39.
The Coils table begins on the following page.
Coil Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
Coil Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
INPUTS
SNAP 4-channel digital input modules: inputs contain 64 numbers, each with the data for one channel.
Data is either 0 or 1.
I/O modules for E1 and E2 I/O units: inputs contain 16 numbers, each with the data for one channel. Data is
either 0 or 1.
groov I/O and SNAP high-density digital input modules: inputs contain 512 numbers, with an extra 512
numbers reserved. See “Notes for groov I/O and SNAP High-Density Digital (HDD) Modules” on page 40.
Input Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
Read 4-channel Digital Inputs -- 1–64 1–64 1–64 1–16 -- 1 = On, 0 = Off
Read State of On-latches (4-channel digital
-- 65–128 65–128 65–128 65–80 -- 1 = On, 0 = Off
modules)
Read State of Off-latches (4-channel digital 129–
-- 129–192 129–192 129–144 -- 1 = On, 0 = Off
modules) 192
Read Counter Active State (4-channel digital 1 = Active, 0 =
-- 193–256 -- -- 193–208 --
modules) Inactive
Read digital modules with more than 4 chan-
513–1536 513–1536 513–1536 -- -- -- 1 = On, 0 = Off
nels
Input Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
INPUT REGISTERS
Input register data is in 32-bit floats or 32-bit integers. Because Modbus registers contain only 16 bits, you
must use two consecutive registers to read the data for one channel, starting with an odd-numbered register.
This table includes registers for all analog modules, regardless of the number of channels they have. For help
in working with analog modules, see “Notes for All Analog Modules” on page 39.
For high-density digital modules, see “Notes for groov I/O and SNAP High-Density Digital (HDD) Modules”
on page 40.
Input Register Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
HOLDING REGISTERS
Most of this data is also in the form of 32-bit integers or 32-bit floats. For these formats, you must use two
consecutive registers to read or write the data for one channel, starting with an odd-numbered register.
This table includes registers for all analog modules, regardless of the number of channels they have. For help
in working with analog modules, see “Notes for All Analog Modules” on page 39.
Holding Register Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-UP1-ADS
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-UP1-ADS
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
Input and holding registers contain 64 registers for each module (since the data for each channel requires
two registers). For example, on a 32-channel analog module in position 0:
Register 4609 4611 4613 4615 4617 4619 4621 4623 4657 4659 4661 4663 4665 4667 4669 4671
4610 4612 4614 4616 4618 4620 4622 4624 4658 4660 4662 4664 4666 4668 4670 4672
Channel 1 2 3 4 5 6 7 8 25 26 27 28 29 30 31 32
Read/Write Output
Clear Max Value
Calculate Offset
Read Max Value
Clear Min Value
Config Channel
Read Min Value
Config Feature
Calculate Gain
0 3585 4609 4609 6657 8705 1031 3079 5127 7175 9223 11271 13319
1 3617 4641 4737 6785 8833 1159 3207 5255 7303 9351 11399 13447
2 3649 4673 4865 6913 8961 1287 3335 5383 7431 9479 11527 13575
3 3681 4705 4993 7041 9089 1415 3463 5511 7559 9607 11655 13703
4 3713 4737 5121 7169 9217 1543 3591 5639 7687 9735 11783 13831
5 3745 4769 5249 7297 9345 1671 3719 5767 7815 9863 11911 13959
6 3777 4801 5377 7425 9473 1799 3847 5895 7943 9991 12039 14087
7 3809 4833 5505 7553 9601 1927 3975 6023 8071 10119 12167 14215
8 3841 4865 5633 7681 9729 2055 4103 6151 8199 10247 12295 14343
9 3873 4897 5761 7809 9857 2183 4231 6279 8327 10375 12423 14471
10 3905 4929 5889 7937 9985 2311 4359 6407 8455 10503 12551 14599
11 3937 4961 6017 8065 10113 2439 4487 6535 8583 10631 12679 14727
12 3969 4993 6145 8193 10241 2567 4615 6663 8711 10759 12807 14855
13 4001 5025 6273 8321 10369 2695 4743 6791 8839 10887 12935 14983
14 4033 5057 6401 8449 10497 2823 4871 6919 8967 11015 13063 15111
15 4065 5089 6529 8577 10625 2951 4999 7047 9095 11143 13191 15239
NOTES FOR groov I/O AND SNAP HIGH-DENSITY DIGITAL (HDD) MODULES
groov I/O and SNAP high-density digital I/O modules contain more than 4 channels per module. They are
handled differently in the Modbus memory map because additional registers are reserved.
Coils and inputs contain 32 numbers for each module, with an additional 32 reserved. Data for each number
is either 0 or 1. Numbers and corresponding channels for a 32-channel HDD module in position 0 are shown
below as an example:
Coil/Input 513 514 515 516 517 518 519 520 537 538 539 540 541 542 543 544
Channel 1 2 3 4 5 6 7 8 25 26 27 28 29 30 31 32
Coils or inputs from 545–576 are reserved, and then Module 1 starts at 577. On a 16-channel HDD module,
module 0 would use coils or inputs 513–528; numbers 529–576 are reserved; and module 1 would still start at
577. See “groov I/O and High-Density Digital Module Register Table” on page 40 for additional module starting
numbers.
Registers contain 64 numbers for each module (since the data for each channel requires two registers), and
an additional 64 registers are reserved. For example, on a 32-channel module in position 0:
Register 513 515 517 519 521 523 525 527 561 563 565 567 569 571 573 575
514 516 518 520 522 524 526 528 562 564 566 568 570 572 574 576
Channel 1 2 3 4 5 6 7 8 25 26 27 28 29 30 31 32
Registers 577–640 are reserved, and then module 1 starts at 641. See the table below for additional modules.
INTRODUCTION
In most cases, communication between Modbus/TCP and Opto 22 systems uses the Modbus memory map
detailed in Chapter 3, which was designed to make communication easier. Always look in Chapter 3 first to see
if the data you want is available there.
However, if you need to read and write data in additional areas of the device’s memory map not covered in
Chapter 3: The Modbus Memory Map, you can do so with any of the following controllers or I/O units:
GRV-EPIC-PR1 OPTOEMU-SNR-3V
SNAP-PAC-S1 OPTOEMU-SNR-DR1
SNAP-PAC-R1 OPTOEMU-SNR-DR2
SNAP-PAC-R1-B SNAP-B3000-ENET
SNAP-PAC-R2 SNAP-ENET-S64
SNAP-PAC-EB1 SNAP-UP1-M64
SNAP-PAC-EB2 SNAP-UP1-ADS
NOTE: Digital-only I/O units and E1 and E2 I/O units do not support this advanced Modbus programming.
Accessible Data
All of the Opto 22 device’s regular OptoMMP memory map addresses in the range F000 0000 to F1EB FFFE are
directly available for reading and writing. The available addresses vary based on the device you’re using.
Addresses outside that range (or scattered addresses) may be indirectly accessed in one contiguous chunk by
using the Custom Data Access Area (F0D6 0000 to F0D6 0FFC) and Custom Configuration Area (F0D5 0000 to
F0D5 0FFC) to map selected addresses into one area that is available for Modbus reads and writes.
The complete OptoMMP memory map is in an appendix in Opto 22 form 1465, OptoMMP Protocol Guide. This
guide is available on our website, www.opto22.com. You’ll need the protocol guide to determine the
addresses available for your device and to find specific addresses, data types, and data length. For some
addresses you’ll also need this guide to interpret the data you receive (for example, a firmware version) or to
know what data to send.
You can also use the Modbus Calculator in PAC Manager to convert memory map addresses to their
corresponding Modbus values.
When you’re working with the memory map addresses in the OptoMMP Protocol Guide, remember that they
refer to Opto 22 input/output channels, which are zero-based. That is, the first module position is position 0,
and the first channel on any module is channel 0.
For Opto 22 devices except groov EPIC, you can use PAC Manager’s Inspect window to find a memory map
address. (PAC Manager does not work with groov EPIC.) The Opto 22 device must be accessible from your PC
in order to use this method.
To start PAC Manager:
• In Windows 7, click the Windows Start button, and then click All Programs > Opto 22 > PAC Project 10 >
PAC Manager 10.
• In Windows 10, click the Windows Start button and type Opto 22 > PAC Manager 10.
2. Type the device’s name or IP address in the Device Name field. Then click the button on the left side of
the window that corresponds to the memory map address you need to find.
For example, to find the memory map address for the device’s firmware version, click Status Read.
You need to know only the last eight digits of the memory map address, in this case, F030001C.
2. To convert an I/O unit memory map address to a Modbus Unit ID and Register Address, type the last
eight digits of the I/O unit’s memory map address in the MemMap Address field.
Make sure there are no spaces in the address (for example, type F0300020).
3. Click the right-arrow icon .
The equivalent Modbus Unit ID and Register appear.
NOTE: The Modbus unit ID and registers are decimal.
For example, suppose you want to read the status of Scratch Pad bits. You can determine the memory map
address in one of two ways:
• Look in the OptoMMP Protocol Guide, find Scratch Pad addresses, and locate the address for the current
state of Scratch Pad bits.
• (For all devices except groov I/O) Use the PAC Manager Inspect window to find the address you want and
copy it.
Either way, you determine that the memory map address is F0D80000. Using PAC Manager, you convert the
MemMap address F0D80000 to a Unit ID of 110 and a Register Number of 0.
See the OptoMMP Protocol Guide to interpret the data you read.
As another example, suppose you want to send a powerup clear (PUC) to the Opto 22 device. This operation
code is in the Status Write area of the I/O unit’s memory map address. To determine the address and format of
the data to write in order to send a PUC, check the Status Write area in the OptoMMP Protocol Guide.
From the memory map appendix, you determine that the memory map address for an operation code is
F0380000, and the specific data you must write to send a PUC is 0x00000001. Using the Modbus conversion
tool in PAC Manager, you find that address F0380000 equals a Unit ID of 30 and a Register Number of 0.
A C
analog channel calibrating analog input channels, 29
channel types, inputs, 21 channel types, groov, 18
channel types, outputs, 27 channel types, SNAP, 20
gain, definition, 29 coils, 33
maximum value, definition, 29 communication overview, 5
minimum value, definition, 29 communication packet format, 7
offset, definition, 29 configuring I/O channel
on E2 groov analog/digital, 17
counts, 40 SNAP analog/digital, 20
features, 32 SNAP digital-only, 28
gain, 32 control strategy and Modbus, 4
minimum/maximum values, 32 counter
offset, 32 definition, 29
reading and writing value, 15 E1 digital channel, 31
scaling, 32 groov I/O digital channel, 29
on groov I/O, 39 SNAP digital channel, 29
configuration example, 19
features, 30
gain, 31 D
minimum/maximum values, 31 data, Modbus float format, 30, 32
offset, 31 digital channel
reading and writing value, 39 counter, definition, 29
scaling, 30 latch, definition, 29
on SNAP, 39 on E1
configuration example, 28 counters, 31
features, 30 features, 31
gain, 31 latches, 31
minimum/maximum values, 31 reading and writing value, 14
offset, 31 on groov I/O, 40
reading and writing value, 12 configuration example, 19
scaling, 30 counters, 29
analog point features, 29
scaling, definition, 29 latches, 29
value, definition, 29 reading and writing value, 40
on SNAP
configuration example, 28
counters, 29
P
PAC Control, 4 V
PAC Manager, 44 valley, 29
peak, 29 value of analog point, definition, 29
product support, 3
W
Q writing
Quad Pak, 14 E1 digital channels, 14
Quad Pak I/O, 15 E2 analog channels, 15
groov I/O analog modules, 39
groov I/O discrete modules, 40
R SNAP analog channels, 12
reading SNAP analog modules, 39
E1 digital channels, 14 SNAP digital channels, 11
E2 analog channels, 15 SNAP high-density digital modules, 40