1678 Modbus TCP Protocol Guide
1678 Modbus TCP Protocol Guide
Wired+Wireless controllers and brains are licensed under one or more of the following patents: U.S. Patent No(s). 5282222,
RE37802, 6963617; Canadian Patent No. 2064975; European Patent No. 1142245; French Patent No. 1142245; British Patent
No. 1142245; Japanese Patent No. 2002535925A; German Patent No. 60011224.
Opto 22 FactoryFloor, groov, groov EPIC, groov RIO, mobile made simple, The Edge of Automation, Optomux, and Pamux
are registered trademarks of Opto 22. Generation 4, groov Server, ioControl, ioDisplay, ioManager, ioProject, ioUtilities,
mistic, Nvio, Nvio.net Web Portal, OptoConnect, OptoControl, OptoDataLink, OptoDisplay, OptoEMU, OptoEMU Sensor,
OptoEMU Server, OptoOPCServer, OptoScript, OptoServer, OptoTerminal, OptoUtilities, PAC Control, PAC Display, PAC
Manager, PAC Project, PAC Project Basic, PAC Project Professional, SNAP Ethernet I/O, SNAP I/O, SNAP OEM I/O, SNAP PAC
System, SNAP Simple I/O, SNAP Ultimate I/O, and Wired+Wireless are trademarks of Opto 22.
ActiveX, JScript, Microsoft, MS-DOS, VBScript, Visual Basic, Visual C++, Windows, and Windows Vista are either registered
trademarks or trademarks of Microsoft Corporation in the United States and other countries. Linux is a registered
trademark of Linus Torvalds. ARCNET is a registered trademark of Datapoint Corporation. Modbus is a registered trademark
of Schneider Electric, licensed to the Modbus Organization, Inc. Wiegand is a registered trademark of Sensor Engineering
Corporation. Allen-Bradley, CompactLogix, ControlLogix, MicroLogix, SLC, and RSLogix are either registered trademarks or
trademarks of Rockwell Automation. CIP and EtherNet/IP are trademarks of ODVA. Raspberry Pi is a trademark of the
Raspberry Pi Foundation. The registered trademark Ignition by Inductive Automation® is owned by Inductive Automation
and is registered in the United States and may be pending or registered in other countries. CODESYS® is a registered
trademark of 3S-Smart Software Solutions GmbH.
groov includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org)
All other brand or product names are trademarks or registered trademarks of their respective companies or organizations.
Opto 22
Your Edge in Automation.
Chapter 1: Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1
About Opto 22 Devices and Modbus/TCp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Opto 22 Devices as Modbus Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
Communication Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
Overview of Modbus Communication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Understanding Opto 22 and Modbus Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4
Function Codes Supported . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4
Report Slave ID Function Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4
Communication Packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
Exception Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Other Guides You May Need . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6
Specific Devices Described in This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
For Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1: Introduction
For PAC Control users: The Opto 22 devices function as Modbus/TCP slave devices and only support
configuring, reading, and writing of the local I/O and other data; they do not support directly reading PAC
Control strategy tags. If you want to be able to read PAC Control strategy tags, use the Modbus Integration Kit
for PAC Control.
In all these cases the Opto 22 device acts as the Modbus slave.
Communication Example
The diagram on the following page shows an example of how an Opto 22 system might communicate with a
Modbus system. This is just one example; many other configurations are possible.
In this example, the SNAP-PAC-S1 standalone controller runs a PAC Control strategy that monitors and controls
the I/O units and all the I/O channels on them. Simultaneously, the Modbus system can exchange data with
the Opto 22 system.
Because the two Ethernet network interfaces on the SNAP-PAC-S1 are independent interfaces with separate IP
addresses, the Opto 22 control network can be segmented from the computer network. This example shows
this type of segmentation, as the PC is attached to Ethernet switch #1 and the control network is on Ethernet
switch #2.
Because the Modbus/TCP hardware is also on switch #2, it can send data to and from every I/O unit shown. In
this example the Modbus/TCP software running on the PC, attached to switch #1, can access data only from
the controller; for instance, it might access data placed in the controller’s Scratch Pad by the PAC Control
strategy.
CAUTION: If you use PAC Control, be careful that Modbus writes to I/O channels don’t conflict with strategy logic.
If you are not using PAC Control, Modbus/TCP hardware or software on the same network segment as I/O
units can provide full control for I/O channels.
Ethernet switch #1
SNAP-PAC-S1
controller (runs a
PAC Control
strategy to control
Ethernet switch #2
all I/O units)
Modbus/TCP
master hardware
E2 I/O unit
Connecting. When opening a TCP/IP connection to the Opto 22 Ethernet-based slave device, you normally
use port 502. This is the default port; it can be changed for security reasons:
– For groov EPIC and groov RIO devices, through groov Manage. For more information, see either
form 2267 groov EPIC User’s Guide or form 2324 groov RIO User’s Guide.
– For SNAP devices, with PAC Manager. For more information, see form 1704, PAC Manager User’s
Guide, for more information.)
Opto 22 slave devices can handle a maximum of eight connections from Modbus masters. For SNAP
Ethernet-based controllers, this requires firmware R9.4B or higher. For E1 and E2, firmware R1.2a. Lower
firmware versions handle a maximum of two connections.
Configuring. In most situations, configuring I/O is done by a different system; for example, groov Manage,
PAC Control, or PAC Manager.
Reading/Writing Data. For all coils, inputs, and registers listed in Chapter 4: The Modbus Memory Map,
use a slave ID (Unit ID) of 1 for the device.
Disconnecting. The Modbus/TCP master device should keep its connection to the Opto 22 slave device
open for the duration of the communication, rather than closing it after every transaction.
The following table shows Modbus function codes supported for I/O units. (Function codes for a specific I/O
unit depend on the analog/digital capabilities of the processor, controller, or brain.)
Modbus Function
Definition Opto 22 Equivalent
Code (Hex)
01 Read coil status Read digital output
02 Read input status Read digital input
03 Read holding registers Read analog output
04 Read input registers Read analog input
05 Force single coil Turn on/off one digital output
06 Preset single register Write one analog output
0F Force multiple coils Turn on/off multiple digital outputs
10 Preset multiple registers Write multiple analog outputs
Report hardware and firmware revision levels
11 Report slave ID
(See below: “Report Slave ID Function Code” )
Function code 0x11, Report slave ID, returns data bytes as shown in the following table.
Bytes 1 and 2 are always in the formats shown. The 0x22 in byte 1 indicates an Opto 22 brain; 0xFF appears in
byte 2 because, since the brain is a slave, it is always running.
Byte 1 Byte 2 Bytes 3–6 Bytes 7–10 Bytes 11–14
Communication Packet
As the Modbus/TCP specification requires, Opto 22 slave devices use the function code and data portion of a
Modbus packet inside a TCP/IP packet. The Modbus checksum is not used; instead, the Ethernet TCP/IP link
layer checksum guarantees data. The size of the packet is limited to 256 bytes. The packet follows the standard
Modbus/TCP format.
Note: You can read a maximum of 127 input or holding registers with function code 3 or 4.
Exception Errors
If an error occurs, standard Modbus exception codes are returned in the Modbus packet. The following table,
reprinted from the Modicon Modbus Protocol Reference Guide, shows the Modbus exception codes. If you need
more information, see the Modbus documentation at http://www.modbus.org/specs.php.
Code Name Meaning
The function code received in the query is not an allowable action for
01 ILLEGAL FUNCTION
the slave.
ILLEGAL DATA The data address received in the query is not an allowable address for
02
ADDRESS the slave.
A value contained in the query data field is not an allowable value for
03 ILLEGAL DATA VALUE
the slave.
An unrecoverable error occurred while the slave was attempting to per-
04 SLAVE DEVICE FAILURE
form the requested action.
The slave has accepted the request and is processing it, but a long dura-
tion of time will be required to do so. This response is returned to prevent
05 ACKNOWLEDGE
a timeout error from occurring in the master. The master can next issue a
Poll Program Complete message to determine if processing is completed.
The slave is engaged in processing a long-duration program command.
06 SLAVE DEVICE BUSY
The master should retransmit the message later when the slave is free.
The slave cannot perform the program function received in the query. This
NEGATIVE code is returned for an unsuccessful programming request using function
07
ACKNOWLEDGE code 13 or 14 decimal. The master should request diagnostic or error
information from the slave.
The slave attempted to read extended memory, but detected a parity error
MEMORY PARITY
08 in the memory. The master can retry the request, but service may be
ERROR
required on the slave device.
GRV-EPIC-PR1 GRV-EPIC-PR2
GRV-R7-MM1001-10 GRV-R7-MM2001-10
SNAP-PAC-S1 SNAP-PAC-S2
SNAP-PAC-S1-FMa SNAP-PAC-S2-Wa
SNAP-PAC-S1-Wa
* For energy monitoring units, this guide is only a reference. Find primary information for Modbus communi-
cation in form 1958, OptoEMU Sensor Communication Guide.
aObsolete Product, contact Opto 22 Pre-Sales engineers for more information.
Contents
This guide includes the following:
Chapter 1: Introduction—(this chapter) Supported Modbus function codes, communication packet, and
exception codes, as well as details about this guide and Opto 22 Product Support.
Chapter 2: Configuring I/O for Modbus/TCP—How to configure and use input/output (I/O) channels and
channel features with Modbus/TCP.
Chapter 3: Module and Channel Positions—Illustrations of module and channel positions on I/O units and
how they relate to coils, inputs, and registers in Modbus/TCP.
Chapter 4: The Modbus Memory Map—Coils, inputs, input registers, and holding registers used by most
Opto 22 devices.
Chapter 5: Accessing Other Data—Ways to access data not included in coils, inputs, and registers.
FOR HELP
If you have problems using Modbus/TCP with Opto 22 products and cannot find the help you need in this
guide or on our website, contact Opto 22 Product Support.
Phone: 800-TEK-OPTO (800-835-6786 toll-free NOTE: Email messages and phone calls
in the U.S. and Canada) to Opto 22 Product Support are
951-695-3080 grouped together and answered in the
Monday through Friday, order received.
7 a.m. to 5 p.m. Pacific Time
Fax: 951-695-3017
Email: support@opto22.com
When calling for technical support, you can help us help you faster if you provide the following information to
the Product Support engineer:
• A screen capture of the Help > About dialog box showing software product and version (available by
clicking Help > About in the application’s menu bar).
• Opto 22 hardware part numbers or models that you’re working with.
• Firmware version:
– For groov EPIC processors and groov RIO modules: available in groov Manage by clicking Info and
Help > About.
– For SNAP controllers and brains: available in PAC Manager by clicking Tools > Inspect.
• Specific error messages you received.
• Version of your computer’s operating system.
• For PAC Control, PAC Display, OptoOPCServer, or PAC Manager, you may be requested to provide
additional information, such as log or dump files. You can find these files in a support files sub-folder:
a. On your Windows Desktop, double-click the PAC Project 10.5 folder.
b. Double-click Support Files.
c. Double-click on the appropriate shortcut to open the sub-folder containing the requested files.
Note: PAC Control, PAC Display, OptoOPCServer, and PAC Manager create appropriate sub-folders when they
create diagnostic log or dump files. If they have not created these files, the sub-folder may not exist; in this case,
the shortcut will not work.
INTRODUCTION
This chapter includes the following:
• I/O channel configuration required for communication with Modbus/TCP systems (page 9)
• channel features and how to use them with Modbus/TCP (page 23).
The following table shows groov I/O modules and the module and channel types to use for configuration. If a
module offers more than one range, choose the range you want from the Description column and read across
to the Channel ID (hex) column to find the corresponding configuration value.
per module
Channel ID
Applies To
Low Scale
Module ID
Full Scale
Channels
Default
Units
(hex)
(hex)
Part number Description
per module
Channel ID
Applies To
Low Scale
Module ID
Full Scale
Channels
Default
Units
(hex)
(hex)
Part number Description
per module
Channel ID
Applies To
Low Scale
Module ID
Full Scale
Channels
Default
Units
(hex)
(hex)
Part number Description
per module
Channel ID
Applies To
Low Scale
Module ID
Full Scale
Channels
Default
Units
(hex)
(hex)
Part number Description
per module
Channel ID
Applies To
Low Scale
Module ID
Full Scale
Channels
Default
Units
(hex)
(hex)
Part number Description
To configure I/O channels for Modbus/TCP, write the channel configuration data from the previous table to
holding registers 11271–13318. Since the data for this area of the Modbus map is in the form of 32-bit
integers, use two consecutive registers to write the data to one channel.
For example, look at the table starting on page 10. Suppose the module in position 0 on the rack is a
GRV-IV-24 and you want to use a range of ±10 V for the first two channels (channels 0 and 1). You find the
module’s range in the Description column and read across to see the configuration value to use, 0x60000017.
Now take a look at the Holding Registers section of the Modbus map on page 43. You will write to the
Configure Channels area, registers 11271–13318. Since it takes two registers per channel and you are
configuring the first two channels, you write the hex value 60000017 (for a -10 to +10 V input) as follows:
To this register: 11271 11272
Channel 0
Write this value: 6000 0017
To this register: 11273 11274
Channel 1
Write this value: 6000 0017
Word swapped. The registers and values shown in the table are correct if your groov I/O unit is using the
default Big Endian format. However, if you have configured the I/O unit in groov Manage to be Big Endian
Word Swapped, you would reverse the registers for each channel. For example, for channel 0 you would write
0017 to register 11271 and 6000 to register 11272.
controller must have PAC firmware R9.5a (or higher) to use this simplified configuration method. If you are not using
these firmware and software versions (or if you prefer to use the previous method to reconfigure existing E1s or E2s),
see I/O Configuration for E1 an E2 Brain Boards (form 1576).
All SNAP analog/digital I/O units recognize analog, serial, and high-density digital modules on the rack.
Positions on the rack that don’t contain modules the I/O unit recognizes are assumed to contain digital input
modules. If the individual channel types on the module differ from the default type for that module, you must
configure the channels using the tables below.
The following tables show SNAP I/O modules that can be used with Ethernet-based I/O units and
Modbus/TCP (some older I/O units cannot use all of these modules; see the module’s data sheet for
compatibility). Default channel types are shaded. If a channel differs from the default, use the value in the
Channel Type (Hex) column to configure the channel. For examples of channel configuration, see page 22,
following the tables.
Digital Inputs and Outputs
Channel Type Channel Type Module Type
Module & Description
(Dec) (Hex) (Hex)
4-channel digital input module* 256 100 00
4-channel digital output module* 384 180 00
* High-density digital modules are automatically recognized; channels do not require configura-
tion.
Analog Inputs
Channels per Module
Channel Type (Dec)
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Default Unit of
Measurement
Underrange
Overrange
Low Scale
Full Scale
Part Number &
Description
Analog Outputs
Default Unit of
Measurement
Underrange
Overrange
Low scale
Full scale
Part Number &
Description
To configure I/O channels for Modbus/TCP, write the channel configuration data from the previous table to
holding registers 11271–13318. Since the data for this area of the Modbus map is in the form of 32-bit
integers, use two consecutive registers to write the data to one channel.
For example, look at the tables starting on page 15. If the module in position 0 on the rack is a SNAP-AIV with
a -5 to +5 V input, it is not the default for that module. Therefore you must configure its channels. Now take a
look at the Holding Registers section of the Modbus map on page 43. You will write to the Configure Channels
area, registers 11271–13318. Since it takes two registers per channel and the analog module has two
channels, you write the hex value 0B (for a -5 to +5 V analog input) to the first four registers, 11271–11274.
As another example, suppose the module in position 1 on the rack is a 4-channel digital output module. Since
the default is a 4-channel digital input module, you must configure its channels. You write the hex value 180
(for a 4-channel digital output module) to the registers for module 1.
For example, suppose the module in position 0 on the rack is a 4-channel digital output module. To configure
its channels, write a 1 to coils 193–196. See the Modbus memory map on page 40. (Be sure you are looking in
the column for these digital-only I/O units.)
NOTE: SNAP digital-only I/O units support 4-channel digital modules only; they do not support high-density digital
modules.
Latches
Latches are a channel feature automatically available on SNAP Ethernet-based I/O units; they do not require
configuration. To use latches, see the Modbus memory maps beginning on page 39.
Counting is available on groov digital I/O except for modules with an S in the part number, which provide
on/off status only.
Counters must be configured using holding registers 13319–15366. Because the data is in the form of a 32-bit
integer, use two consecutive registers for each channel. For example, to configure module 0, channel 0 as a
counter, you would write the following:
To these registers: 13319 13320
Write this: 0 1
To read counters on groov I/O, read input registers 513–2560 (or read and clear counters using input registers
2561–4608). Read two consecutive registers per channel. See “Notes for groov I/O and SNAP High-Density
Digital (HDD) Modules” on page 46
High-Speed Counters. Analog/digital SNAP I/O units with high-speed capability (such as SNAP-PAC-R1
and SNAP-PAC-EB1 I/O units) support high-speed counters on any 4-channel digital input; the actual counter
speed depends on the module. Digital-only and analog/simple digital I/O units (such as SNAP-PAC-R2 and
SNAP-PAC-EB2 I/O units) do not support high-speed counters. High-speed counters require configuration. See
below, “Using Counters .”
Other Counters. Channels on SNAP high-density digital modules automatically provide counting. These
counters are not high speed; see the module’s data sheet for specific information.
Using Counters . High-speed counters on SNAP 4-channel modules involve two steps: configure the
counter and read data. Counters on SNAP high-density digital modules do not need configuration for
Modbus/TCP.
• To configure a high-speed counter, write to holding registers 13319–15366. Remember that you use two
consecutive registers for each channel, since the data is in the form of a 32-bit integer. For example, to
configure module 0, channel 0 as a counter, you would write the following:
To these registers: 13319 13320
Write this: 0 1
• To read high-speed counter data, read input registers 385–512. Read two consecutive registers per
channel.
• To clear a high-speed counter, write to coils 257–320. For example, to clear the counter on module 0,
channel 0, you would write a 1 to coil 257.
• To read counters on high-density digital modules, read input registers 513–2560 (or read and clear
counters using input registers 2561–4608). Read two consecutive registers per channel.
Analog channel features generally require that you read or write to two consecutive registers for each channel,
since the data is in the form of a 32-bit IEEE float. Data is in Big Endian format. You can change the word order
if you wish:
• For groov I/O, change it in groov Manage (Home > I/O > I/O Unit Configuration and Tools >
Configuration).
• For SNAP I/O, you can change it using the Modbus memory map (see Holding Register 1029 on page 44).
If you change word order, be sure to store configuration information to flash (Holding Register 1026) so it
will be saved when the I/O unit is turned off.
See “Notes for All Analog Modules” on page 45 for more information on reading and writing to analog I/O
features.
Scaling
To scale an analog channel, write the low-scale value to holding registers 7175–9222 and the high-scale value
to holding registers 9223–11270. Write to two consecutive registers for each channel you are scaling.
Minimum and maximum values are analog channel features. The I/O unit automatically keeps track of
minimum and maximum values; they do not require configuration. You can read the values at any time, for
example to record minimum and maximum temperatures. You can also clear them.
• To read min/max values, read input registers 6657–10752. Read two consecutive registers per channel.
• To clear min/max values, write 1 bits to coils 3585–5632.
Offset and gain are also analog channel features on groov I/O and SNAP I/O units. Setting offset and gain for
analog input channels is important to make sure that values appear accurately when read. If a -50 mV to +50
mV input receives signals that are slightly off (not exactly -50 mV at the lowest channel, for example), you can
set offset and gain to adjust them.
Calculate offset first, and then calculate gain. The offset must be calculated at the channel’s low scale, and the
gain must be calculated at the channel’s high scale.
Once you have calculated offset and gain values, write them to the I/O unit. To set offset, write to holding
registers 3079–5126, using two consecutive registers per channel. To set gain, write to holding registers 5127–
7174. See
Latches
Latches are a digital channel feature available on E1 brain boards. They do not require configuration. Read and
clear latches as shown in the following table and the Modbus memory map beginning on page 39.
To do this Use these coils/inputs
Read the on-latch state Read inputs 65–80
Read the off-latch state Read inputs 129–144
Clear on-latches Write to coils 129–144
Clear off-latches Write to coils 193–208
Counters
Using counters involves three steps: configure the counter (holding registers 769-800), activate the counter
(coils 65-80), and read data (input registers 385-416). See the Modbus memory map beginning on page 39 to
find the coils and registers mentioned.
To do this Use these coils/registers
Write to holding registers 769–800. Remember that you use two consecutive reg-
isters for each channel, since the data is in the form of a 32-bit integer but the
registers are 16 bits each. For example, to configure channel #1 as a counter, you
Configure a counter would write 01 to registers 769-770.
To these registers: 769 770
Write this: 0 1
Write to coils 65-80. For example, to activate the counter for channel #1, you
Activate a counter
would write to coil number 65.
Read counter data Read input registers 385–416. Read two consecutive registers per channel.
Write to coils 257–272. For example, to clear the counter on channel #1, you
Clear a counter
would write a 1 to coil 257.
Configuration of E1 and E2 brain boards is simplified in E1/E2 firmware R1.2a (and higher) and in PAC Project
9.5000 (and higher). Also, if a SNAP PAC controller communicates with the E1 or E2, the controller must have
PAC firmware R9.5a (or higher) to use the simplified configuration method.
If you are not using these firmware and software versions, you must scale analog channels when you
configure I/O. For details, see Opto 22 form 1576, I/O Configuration for E1 and E2 Brain Boards.
Minimum and maximum values (also called peaks and valleys) are automatically tracked on the E2 and do not
require configuration. For example, you can read the values at any time to record minimum and maximum
pressures. You can also clear them.
NOTE: The E2 does not maintain minimum and maximum values for temperature.
• To read min/max values, read input registers 129–160 (min) and 257–288 (max). Read two consecutive
registers per channel.
• To clear min/max values, write 1 bits to coils 321–336 (min) and 385–400 (max).
You can monitor current values for offset and gain using holding registers 129–160 and 257–288. To perform
calibration on analog channels, use PAC Manager. See the PAC Manager User’s Guide.
As mentioned, the configuration method for E2 I/O units was simplified in E2 firmware R1.2a and PAC Project
R9.5. With the new method, you can configure E2s in PAC Control and PAC Manager just as you would other
I/O units, and configure their channels as G1 modules rather than similar SNAP modules.
This change makes a difference in how the E2 I/O unit reports counts. Modules configured directly as G1
modules (the new method) will report counts as G1 counts (0 to +4095 nominal range). Modules configured
under the old method will report counts as SNAP counts (0 to +25000, or -25000 to +25000).
INTRODUCTION
This chapter includes the illustrations of module and channel positions on I/O units and how they relate to
coils, inputs, and registers in Modbus/TCP.
Ch: 23 0
Module position 2, discrete,
12 channels:
Ch: 11 0
Ch: 7 6 5 4 3 2 1 0
Channels: 3 2 1 0
Channels
7 6 5 4 3 2 1 0
:
Channels: 1 0
Module position 14, serial:
Ports: B A
The following examples show how SNAP module and channel numbers relate to Modbus coils, inputs, and
registers.
The following table shows the coils or inputs you would read or write to for channel states on SNAP 4-channel
digital modules.
NOTE: For high-density digital modules (digital modules with more than four channels), different coils and inputs are
used. See “Input Registers” on page 42 and “Holding Registers” on page 43. Also see “Notes for groov I/O and SNAP
High-Density Digital (HDD) Modules” on page 46.
SNAP Example 2: Reading/Writing Analog Channel Values to Input and Holding Registers
Analog channel values in input and holding registers are in the form of 32-bit floats. Because Modbus registers
contain only 16 bits, two consecutive registers are used to read or write the data for one channel. The
following table shows the input or holding registers you would use to read or write analog channel values,
depending upon the number of channels on the module (one, two, or four channels).
NOTE: Analog modules with more than four channels use different registers. See “Input Registers” on page 42 and
“Holding Registers” on page 43. Also see the table showing starting registers on page 46.
Reading/Writing Analog Channel Values to Input and Holding Registers (Modules with four channels
or less. Only the first eight modules are shown; the rack may hold up to 16.)
SNAP 4-Channel Analog I/O SNAP 2-Channel Analog I/O SNAP 1-Channel Analog I/O
Module Channel Registers Module Channel Registers Module Channel Registers
0 1-2 0 1-2 0 0 1-2
0
1 3-4 1 3-4 -- -- --
0
2 5-6 -- -- -- -- -- --
3 7-8 -- -- -- -- -- --
0 9-10 0 9-10 1 0 9-10
1
1 11-12 1 11-12 -- -- --
1
2 13-14 -- -- -- -- -- --
3 15-16 -- -- -- -- -- --
0 17-18 0 17-18 2 0 17-18
2
1 19-20 1 19-20 -- -- --
2
2 21-22 -- -- -- -- -- --
3 23-24 -- -- -- -- -- --
0 25-26 0 25-26 3 0 25-26
3
1 27-28 1 27-28 -- -- --
3
2 29-30 -- -- -- -- -- --
3 31-32 -- -- -- -- -- --
0 33-34 0 33-34 4 0 33-34
4
1 35-36 1 35-36 -- -- --
4
2 37-38 -- -- -- -- -- --
3 39-40 -- -- -- -- -- --
0 41-42 0 41-42 5 0 41-42
5
1 43-44 1 43-44 -- -- --
5
2 45-46 -- -- -- -- -- --
3 47-48 -- -- -- -- -- --
0 49-50 0 49-50 6 0 49-50
6
1 51-52 1 51-52 -- -- --
6
2 53-54 -- -- -- -- -- --
3 55-56 -- -- -- -- -- --
0 57-58 0 57-58 7 0 57-58
7
1 59-60 1 59-60 -- -- --
7
2 61-62 -- -- -- -- -- --
3 63-64 -- -- -- -- -- --
E1 with G4 modules.
Module position 0
E2 with G1 modules.
Module position 0
Module position 0
The following examples illustrate how E1 and E2 module and channel numbers relate to Modbus coils, inputs,
and registers. For complete coil, input, and register information, see Chapter 4: The Modbus Memory Map on
page 39.
The following table shows the coils or inputs you would read or write to for channel states on E1 digital
modules.
E1 Digital I/O E1 Digital I/O
Module/Channel Coil or Input Module/Channel Coil or Input
0 1 8 9
1 2 9 10
2 3 10 11
3 4 11 12
4 5 12 13
Channel values in input and holding registers are in the form of 32-bit floats. Because Modbus registers
contain only 16 bits, two consecutive registers are used to read or write the data for one channel. The
following table shows the input or holding registers you would use to read or write E2 analog channel values.
E2 Analog I/O E2 Analog I/O
Input or Holding Input or Holding
Module/Channel Module/Channel
Registers Registers
0 1-2 8 17-18
1 3-4 9 19-20
2 5-6 10 21-22
3 7-8 11 23-24
4 9-10 12 25-26
5 11-12 13 27-28
6 13-14 14 29-30
7 15-16 15 31-32
Each module has just one channel. You can mix input and output modules within the same group of four
channels.
Module position 0
The following table shows the coils or inputs you would read or write to for channel states on G4 modules.
G4 Digital I/O G4 Digital I/O
Module/Channel Coil or Input Module/Channel Coil or Input
0 1 16 17
1 2 17 18
2 3 18 19
3 4 19 20
4 5 20 21
5 6 21 22
6 7 22 23
7 8 23 24
8 9 24 25
9 10 25 26
10 11 26 27
11 12 27 28
12 13 28 29
13 14 29 30
14 15 30 31
15 16 31 32
Quad Pak modules have four input or four output channels per module, so the four channels in each group are
either inputs or outputs.
The following table shows the coils or inputs you would read or write to for channel states on Quad Pak
modules.
Quad Pak Digital I/O Quad Pak Digital I/O
Module Channel Coil or Input Module Channel Coil or Input
0 1 16 17
1 2 17 18
0 4
2 3 18 19
3 4 19 20
4 5 20 21
5 6 21 22
1 5
6 7 22 23
7 8 23 24
8 9 24 25
9 0 25 26
2 6
0 11 26 27
11 12 27 28
12 13 28 29
13 14 29 30
3 7
14 15 30 31
15 16 31 32
INTRODUCTION
The following tables show the coils, inputs, input registers, and holding registers that apply to Opto 22 devices
supporting Modbus/TCP. We call these the Modbus memory map.
New areas have been added to the Modbus memory map to accommodate new higher-density digital and
analog modules, including groov I/O modules. As a result, the functions of some coil, input, and register
numbers have been duplicated in larger areas. In the following tables, the older numbers are shown in
brackets. These older numbers can still be used for backward compatibility, but we recommend using the
referenced larger areas for new development.
NOTE: Because digital counters and module configuration require more than one bit, they are handled in input and
holding registers.
Coil Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
Coil Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
INPUTS
SNAP 4-channel digital input modules: inputs contain 64 numbers, each with the data for one channel.
Data is either 0 or 1.
I/O modules for E1 and E2 I/O units: inputs contain 16 numbers, each with the data for one channel. Data is
either 0 or 1.
groov I/O and SNAP high-density digital input modules: inputs contain 512 numbers, with an extra 512
numbers reserved. See “Notes for groov I/O and SNAP High-Density Digital (HDD) Modules” on page 46.
Input Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
Read 4-channel Digital Inputs -- 1–64 1–64 1–64 1–16 -- 1 = On, 0 = Off
Read State of On-latches (4-channel digital
-- 65–128 65–128 65–128 65–80 -- 1 = On, 0 = Off
modules)
Read State of Off-latches (4-channel digital 129–
-- 129–192 129–192 129–144 -- 1 = On, 0 = Off
modules) 192
Read Counter Active State (4-channel digital 1 = Active, 0 =
-- 193–256 -- -- 193–208 --
modules) Inactive
Read digital modules with more than 4 chan-
513–1536 513–1536 513–1536 -- -- -- 1 = On, 0 = Off
nels
Input Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
INPUT REGISTERS
Input register data is in 32-bit floats or 32-bit integers. Because Modbus registers contain only 16 bits, you
must use two consecutive registers to read the data for one channel, starting with an odd-numbered register.
This table includes registers for all analog modules, regardless of the number of channels they have. For help
in working with analog modules, see “Notes for All Analog Modules” on page 45.
For high-density digital modules, see “Notes for groov I/O and SNAP High-Density Digital (HDD) Modules”
on page 46.
Input Register Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
HOLDING REGISTERS
Most of this data is also in the form of 32-bit integers or 32-bit floats. For these formats, you must use two
consecutive registers to read or write the data for one channel, starting with an odd-numbered register.
This table includes registers for all analog modules, regardless of the number of channels they have. For help
in working with analog modules, see “Notes for All Analog Modules” on page 45.
Holding Register Numbers
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-UP1-ADS
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
SNAP-B3000-ENET
SNAP-ENET-D64
SNAP-ENET-S64
SNAP-PAC-R1-B
SNAP-UP1-ADS
SNAP-PAC-EB1
SNAP-PAC-EB2
SNAP-UP1-M64
SNAP-UP1-D64
GRV-EPIC-PR1
SNAP-PAC-R1
SNAP-PAC-R2
Action Notes
E1 E2
Input and holding registers contain 64 registers for each module (since the data for each channel requires
two registers). For example, on a 32-channel analog module in position 0:
Register 4609 4611 4613 4615 4617 4619 4621 4623 4657 4659 4661 4663 4665 4667 4669 4671
4610 4612 4614 4616 4618 4620 4622 4624 4658 4660 4662 4664 4666 4668 4670 4672
Channel 1 2 3 4 5 6 7 8 25 26 27 28 29 30 31 32
Read/Write Output
Clear Max Value
Calculate Offset
Read Max Value
Config Channel
Clear Min Value
Config Feature
Set High Scale
Calculate Gain
0 3585 4609 4609 6657 8705 1031 3079 5127 7175 9223 11271 13319
1 3617 4641 4737 6785 8833 1159 3207 5255 7303 9351 11399 13447
2 3649 4673 4865 6913 8961 1287 3335 5383 7431 9479 11527 13575
3 3681 4705 4993 7041 9089 1415 3463 5511 7559 9607 11655 13703
4 3713 4737 5121 7169 9217 1543 3591 5639 7687 9735 11783 13831
5 3745 4769 5249 7297 9345 1671 3719 5767 7815 9863 11911 13959
6 3777 4801 5377 7425 9473 1799 3847 5895 7943 9991 12039 14087
7 3809 4833 5505 7553 9601 1927 3975 6023 8071 10119 12167 14215
8 3841 4865 5633 7681 9729 2055 4103 6151 8199 10247 12295 14343
9 3873 4897 5761 7809 9857 2183 4231 6279 8327 10375 12423 14471
10 3905 4929 5889 7937 9985 2311 4359 6407 8455 10503 12551 14599
11 3937 4961 6017 8065 10113 2439 4487 6535 8583 10631 12679 14727
12 3969 4993 6145 8193 10241 2567 4615 6663 8711 10759 12807 14855
13 4001 5025 6273 8321 10369 2695 4743 6791 8839 10887 12935 14983
14 4033 5057 6401 8449 10497 2823 4871 6919 8967 11015 13063 15111
15 4065 5089 6529 8577 10625 2951 4999 7047 9095 11143 13191 15239
NOTES FOR groov I/O AND SNAP HIGH-DENSITY DIGITAL (HDD) MODULES
groov I/O and SNAP high-density digital I/O modules contain more than 4 channels per module. They are
handled differently in the Modbus memory map because additional registers are reserved.
Coils and inputs contain 32 numbers for each module, with an additional 32 reserved. Data for each number
is either 0 or 1. Numbers and corresponding channels for a 32-channel HDD module in position 0 are shown
below as an example:
Coil/Input 513 514 515 516 517 518 519 520 537 538 539 540 541 542 543 544
Channel 1 2 3 4 5 6 7 8 25 26 27 28 29 30 31 32
Coils or inputs from 545–576 are reserved, and then Module 1 starts at 577. On a 16-channel HDD module,
module 0 would use coils or inputs 513–528; numbers 529–576 are reserved; and module 1 would still start at
577. See “groov I/O and High-Density Digital Module Register Table” on page 46 for additional module starting
numbers.
Registers contain 64 numbers for each module (since the data for each channel requires two registers), and
an additional 64 registers are reserved. For example, on a 32-channel module in position 0:
Register 513 515 517 519 521 523 525 527 561 563 565 567 569 571 573 575
514 516 518 520 522 524 526 528 562 564 566 568 570 572 574 576
Channel 1 2 3 4 5 6 7 8 25 26 27 28 29 30 31 32
Registers 577–640 are reserved, and then module 1 starts at 641. See the table below for additional modules.
INTRODUCTION
In most cases, communication between Modbus/TCP and Opto 22 systems uses the Modbus memory map
detailed in Chapter 3, which was designed to make communication easier. Always look in Chapter 3 first to see
if the data you want is available there.
However, if you need to read and write data in additional areas of the device’s memory map not covered in
Chapter 4: The Modbus Memory Map, you can do so with any of the following controllers or I/O units:
GRV-EPIC-PR1 OPTOEMU-SNR-3V
SNAP-PAC-S1 OPTOEMU-SNR-DR1
SNAP-PAC-R1 OPTOEMU-SNR-DR2
SNAP-PAC-R1-B SNAP-B3000-ENET
SNAP-PAC-R2 SNAP-ENET-S64
SNAP-PAC-EB1 SNAP-UP1-M64
SNAP-PAC-EB2 SNAP-UP1-ADS
NOTE: Digital-only I/O units and E1 and E2 I/O units do not support this advanced Modbus programming.
Accessible Data
All of the Opto 22 device’s regular OptoMMP memory map addresses in the range F000 0000 to F1EB FFFE are
directly available for reading and writing. The available addresses vary based on the device you’re using.
Addresses outside that range (or scattered addresses) may be indirectly accessed in one contiguous chunk by
using the Custom Data Access Area (F0D6 0000 to F0D6 0FFC) and Custom Configuration Area (F0D5 0000 to
F0D5 0FFC) to map selected addresses into one area that is available for Modbus reads and writes.
The complete OptoMMP memory map is in an appendix in Opto 22 form 1465, OptoMMP Protocol Guide. This
guide is available on our website, www.opto22.com. You’ll need the protocol guide to determine the
addresses available for your device and to find specific addresses, data types, and data length. For some
addresses you’ll also need this guide to interpret the data you receive (for example, a firmware version) or to
know what data to send.
You can also use the Modbus Calculator in PAC Manager to convert memory map addresses to their
corresponding Modbus values.
When you’re working with the memory map addresses in the OptoMMP Protocol Guide, remember that they
refer to Opto 22 input/output channels, which are zero-based. That is, the first module position is position 0,
and the first channel on any module is channel 0.
For Opto 22 devices except groov EPIC, you can use PAC Manager’s Inspect window to find a memory map
address. (PAC Manager does not work with groov EPIC.) The Opto 22 device must be accessible from your PC
in order to use this method.
To start PAC Manager:
Click the Windows Search button and type PAC Manager 10.
2. Type the device’s name or IP address in the Device Name field. Then click the button on the left side of
the window that corresponds to the memory map address you need to find.
For example, to find the memory map address for the device’s firmware version, click Status Read.
You need to know only the last eight digits of the memory map address, in this case, F030001C.
2. To convert an I/O unit memory map address to a Modbus Unit ID and Register Address, type the last
eight digits of the I/O unit’s memory map address in the MemMap Address field.
Make sure there are no spaces in the address (for example, type F0300020).
3. Click the right-arrow icon .
The equivalent Modbus Unit ID and Register appear.
NOTE: The Modbus unit ID and registers are decimal.
For example, suppose you want to read the status of Scratch Pad bits. You can determine the memory map
address in one of two ways:
• Look in the OptoMMP Protocol Guide, find Scratch Pad addresses, and locate the address for the current
state of Scratch Pad bits.
• (For all devices except groov I/O) Use the PAC Manager Inspect window to find the address you want and
copy it.
Either way, you determine that the memory map address is F0D80000. Using PAC Manager, you convert the
MemMap address F0D80000 to a Unit ID of 110 and a Register Number of 0.
See the OptoMMP Protocol Guide to interpret the data you read.
As another example, suppose you want to send a powerup clear (PUC) to the Opto 22 device. This operation
code is in the Status Write area of the I/O unit’s memory map address. To determine the address and format of
the data to write in order to send a PUC, check the Status Write area in the OptoMMP Protocol Guide.
From the memory map appendix, you determine that the memory map address for an operation code is
F0380000, and the specific data you must write to send a PUC is 0x00000001. Using the Modbus conversion
tool in PAC Manager, you find that address F0380000 equals a Unit ID of 30 and a Register Number of 0.
A C
analog channel calibrating analog input channels, 23
channel types, inputs, 15 channel types, groov, 10
channel types, outputs, 22 channel types, SNAP, 15
gain, definition, 23 coils, 39
maximum value, definition, 23 communication overview, 3
minimum value, definition, 23 communication packet format, 5
offset, definition, 23 configuring I/O channel
on E2 groov analog/digital, 9
counts, 46 SNAP analog/digital, 14
features, 26 SNAP digital-only, 22
gain, 26 control strategy and Modbus, 2
minimum/maximum values, 26 counter
offset, 26 definition, 23
reading and writing value, 35 E1 digital channel, 26
scaling, 26 groov I/O digital channel, 24
on groov I/O, 45 SNAP digital channel, 24
configuration example, 14
features, 24
gain, 25 D
minimum/maximum values, 25 data, Modbus float format, 25, 26
offset, 25 digital channel
reading and writing value, 45 counter, definition, 23
scaling, 25 latch, definition, 23
on SNAP, 45 on E1
configuration example, 22 counters, 26
features, 24 features, 25
gain, 25 latches, 25
minimum/maximum values, 25 reading and writing value, 34
offset, 25 on groov I/O, 46
reading and writing value, 32 configuration example, 14
scaling, 25 counters, 24
analog point features, 23
scaling, definition, 23 latches, 24
value, definition, 23 reading and writing value, 46
on SNAP
configuration example, 22
counters, 24
P
PAC Control, 2 V
PAC Manager, 50 valley, 23
peak, 23 value of analog point, definition, 23
product support, 8
W
Q writing
Quad Pak, 34 E1 digital channels, 34
Quad Pak I/O, 35 E2 analog channels, 35
groov I/O analog modules, 45
groov I/O discrete modules, 46
R SNAP analog channels, 32
reading SNAP analog modules, 45
E1 digital channels, 34 SNAP digital channels, 31
E2 analog channels, 35 SNAP high-density digital modules, 46