KnowForgeModbus (TCP/UDP/Serial)
qianmoQ· 更新于 2026-09-30· 阅读 68 分钟· 0 次阅读Modbus is a request/response protocol originally published by Modicon in 1979 and now a de facto standard for industrial devices of every kind, from PLCs to sensors and energy meters. PLC4X speaks it in three variants: Modbus TCP (modbus-tcp), Modbus RTU (modbus-rtu) and Modbus ASCII (modbus-ascii) - RTU and ASCII being the two wire formats of "Modbus Serial", which despite the name can also be run over TCP or UDP.
Modbus is the most widely used driver in PLC4X, with implementations in C, Go, Java and Python.
Supported Operations
| Name | Value | Description |
|---|---|---|
read | ||
write | ||
subscribe | Java only, polling-emulated. Modbus has no push mechanism, so a subscription is a periodic read underneath, not a device-initiated notification. The Go driver does not subscribe. |
Connection String
Each Modbus variant has its own connection string, sharing the same layout:
{modbus-tcp|modbus-rtu|modbus-ascii}:{transport}://{ip-address-or-device}:{port}?{options}The transport, port and option fields are optional.
Modbus TCP defaults to the tcp transport:
modbus-tcp:tcp://127.0.0.1:502Modbus RTU and Modbus ASCII default to the serial transport, addressing a serial device instead of a host and port:
modbus-rtu:serial:///dev/ttyUSB0All three variants can also be run over tcp or udp - useful for talking to a serial-to-IP gateway or a simulator - by naming that transport explicitly, for example modbus-rtu:tcp://127.0.0.1:5020.
Connection String Options
Modbus TCP
Name
Type
Default Value
Required
Description
Name
Modbus TCP
Code
modbus-tcp
Maven Dependency
<dependency>
<groupId>org.apache.plc4x</groupId>
<artifactId>plc4j-driver-modbus</artifactId>
<version>1.0.0</version>
</dependency>Default Transport
tcp
Supported Transports
tcptlstls-pskudp
Config options:
request-timeout-ms
INT
5000
Default timeout for all types of requests.
default-unit-identifier
INT
1
Unit-identifier or slave-id that identifies the target PLC (On RS485 multiple Modbus Devices can be listening). Defaults to 1.
ping-address
STRING
4x00001:BOOL
Simple address, that the driver will use to check, if the connection to a given device is active (Defaults to reading holding-register 1).
default-payload-byte-order
STRING
BIG_ENDIAN
Default encoding used for transporting register values (Defaults to BIG_ENDIAN).
Allowed values are:
- BIG_ENDIAN
- LITTLE_ENDIAN
- BIG_ENDIAN_BYTE_SWAP
- LITTLE_ENDIAN_BYTE_SWAP
Since: 0.13.0
max-coils-per-request
INT
2000
Maximum number of coils addressable in one request (Defaults to 2000)
Since: 0.13.0
max-registers-per-request
INT
125
Maximum number of registers addressable in one request (Defaults to 125)
Since: 0.13.0
Transport config options:
tcp
tcp.connect-timeout-ms
INT
5000
Connection timeout in milliseconds.
tcp.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
tcp.write-timeout-ms
INT
0
Socket write timeout in milliseconds. 0 means no timeout.
tcp.no-delay
BOOLEAN
true
Enable TCP_NODELAY (disable Nagle’s algorithm).
tcp.keep-alive
BOOLEAN
false
Enable SO_KEEPALIVE.
tcp.send-buffer-size
INT
81920
Send buffer size in bytes. 0 uses system default.
tcp.receive-buffer-size
INT
81920
Receive buffer size in bytes. 0 uses system default.
tcp.local-address
STRING
Local address to bind to (optional). If not set, uses default.
tcp.local-port
INT
0
Local port to bind to (optional). 0 uses ephemeral port.
tls
tls.verify
BOOLEAN
true
tls.ignore-common-name
BOOLEAN
false
Accept a server certificate issued for a different host than the one connected to
tls.trust-store
STRING
Key store of certificates to trust, instead of the JVM’s public authorities
tls.trust-store-password
STRING
Password of the trust store named by tls.trust-store
tls.trust-store-type
STRING
PKCS12
Type of the trust store named by tls.trust-store
tls.version
STRING
TLS protocol version (e.g., 'TLSv1.2', 'TLSv1.3'). If not set, uses TLS 1.3 with fallback to TLS 1.2.
tls.keystore
STRING
Path to keystore (PKCS12/JKS) containing the client certificate and private key for mutual TLS.
tls.keystore-password
STRING
Password for the client keystore.
tls.keystore-type
STRING
Keystore type (e.g., 'PKCS12', 'JKS'). Defaults to PKCS12.
tls.log-session-keys
BOOLEAN
false
Log TLS session keys to the audit log in SSLKEYLOGFILE format for Wireshark decryption.
tls.connect-timeout-ms
INT
5000
Connection timeout in milliseconds.
tls.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
tls.write-timeout-ms
INT
0
Socket write timeout in milliseconds. 0 means no timeout.
tls.no-delay
BOOLEAN
true
Enable TCP_NODELAY (disable Nagle’s algorithm).
tls.keep-alive
BOOLEAN
false
Enable SO_KEEPALIVE.
tls.send-buffer-size
INT
81920
Send buffer size in bytes. 0 uses system default.
tls.receive-buffer-size
INT
81920
Receive buffer size in bytes. 0 uses system default.
tls.local-address
STRING
Local address to bind to (optional). If not set, uses default.
tls.local-port
INT
0
Local port to bind to (optional). 0 uses ephemeral port.
tls-psk
tls-psk.psk-identity
STRING
PSK identity string for TLS-PSK authentication. Must be used together with psk-key.
tls-psk.psk-key
STRING
PSK key as hexadecimal string for TLS-PSK authentication. Must be used together with psk-identity.
tls-psk.log-session-keys
BOOLEAN
false
Log TLS session keys to the audit log in SSLKEYLOGFILE format for Wireshark decryption.
tls-psk.connect-timeout-ms
INT
5000
Connection timeout in milliseconds.
tls-psk.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
tls-psk.write-timeout-ms
INT
0
Socket write timeout in milliseconds. 0 means no timeout.
tls-psk.no-delay
BOOLEAN
true
Enable TCP_NODELAY (disable Nagle’s algorithm).
tls-psk.keep-alive
BOOLEAN
false
Enable SO_KEEPALIVE.
tls-psk.send-buffer-size
INT
81920
Send buffer size in bytes. 0 uses system default.
tls-psk.receive-buffer-size
INT
81920
Receive buffer size in bytes. 0 uses system default.
tls-psk.local-address
STRING
Local address to bind to (optional). If not set, uses default.
tls-psk.local-port
INT
0
Local port to bind to (optional). 0 uses ephemeral port.
udp
udp.local-address
STRING
Local address to bind to. If not set, binds to all interfaces.
udp.local-port
INT
0
Local port to bind to. 0 uses ephemeral port.
udp.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
udp.max-packet-size
INT
65507
Maximum UDP packet size in bytes.
udp.send-buffer-size
INT
0
Send buffer size in bytes. 0 uses system default.
udp.receive-buffer-size
INT
0
Receive buffer size in bytes. 0 uses system default.
udp.broadcast
BOOLEAN
false
Enable SO_BROADCAST for sending broadcast packets.
udp.reuse-address
BOOLEAN
false
Enable SO_REUSEADDR to allow multiple bindings to the same address/port.
udp.share-socket
BOOLEAN
false
Share the underlying UDP socket across multiple transport instances. When true, instances with the same localAddress:localPort will share a socket. This is useful for protocols where multiple logical connections share one UDP port.
udp.multicast-ttl
INT
1
Time-to-live for multicast packets (1-255).
Modbus RTU
Name
Type
Default Value
Required
Description
Name
Modbus RTU
Code
modbus-rtu
Maven Dependency
<dependency>
<groupId>org.apache.plc4x</groupId>
<artifactId>plc4j-driver-modbus</artifactId>
<version>1.0.0</version>
</dependency>Default Transport
serial
Supported Transports
serialtcptlstls-pskudp
Config options:
request-timeout-ms
INT
5000
Default timeout for all types of requests. The timeout covers the full time from submission including queueing; queued requests whose remaining budget falls below a small dispatch margin (at most a quarter of the timeout, capped at 50 ms) fail fast instead of being sent.
default-unit-identifier
INT
1
Unit-identifier or slave-id that identifies the target PLC (On RS485 multiple Modbus Devices can be listening). Defaults to 1.
ping-address
STRING
4x00001:BOOL
Simple address, that the driver will use to check, if the connection to a given device is active (Defaults to reading holding-register 1).
default-payload-byte-order
STRING
BIG_ENDIAN
Default encoding used for transporting register values (Defaults to BIG_ENDIAN).
Allowed values are:
- BIG_ENDIAN
- LITTLE_ENDIAN
- BIG_ENDIAN_BYTE_SWAP
- LITTLE_ENDIAN_BYTE_SWAP
Since: 0.13.0
max-coils-per-request
INT
2000
Maximum number of coils addressable in one request (Defaults to 2000)
Since: 0.13.0
max-registers-per-request
INT
125
Maximum number of registers addressable in one request (Defaults to 125)
Since: 0.13.0
Transport config options:
serial
serial.baud-rate
INT
9600
Baud rate (bits per second)
serial.data-bits
INT
8
Number of data bits (5, 6, 7, or 8)
serial.stop-bits
INT
1
Number of stop bits (1 or 2)
serial.parity
STRING
none
Parity: none, odd, even, mark, space (case-insensitive)
serial.flow-control
STRING
none
Flow control: none, rts-cts, xon-xoff (case-insensitive)
serial.read-timeout-ms
INT
1000
Read timeout in milliseconds. 0 means blocking read.
serial.write-timeout-ms
INT
1000
Write timeout in milliseconds.
serial.dtr
BOOLEAN
false
Enable DTR (Data Terminal Ready) signal
serial.rts
BOOLEAN
false
Enable RTS (Request To Send) signal
serial.reuse-port
BOOLEAN
false
Reuse the underlying serial port across multiple transport instances. When true, instances with the same port will share a connection. This is useful for protocols where multiple logical connections share one serial port. Connections sharing a port must target distinct unit ids; Modbus RTU responses carry no transaction ids, so same-unit traffic from multiple connections cannot be told apart.
serial.interframe-delay
INT
0
Interframe delay in milliseconds for protocols that need spacing between messages. Applies to shared and dedicated ports; the gap is measured from the last write or received data.
tcp
tcp.connect-timeout-ms
INT
5000
Connection timeout in milliseconds.
tcp.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
tcp.write-timeout-ms
INT
0
Socket write timeout in milliseconds. 0 means no timeout.
tcp.no-delay
BOOLEAN
true
Enable TCP_NODELAY (disable Nagle’s algorithm).
tcp.keep-alive
BOOLEAN
false
Enable SO_KEEPALIVE.
tcp.send-buffer-size
INT
81920
Send buffer size in bytes. 0 uses system default.
tcp.receive-buffer-size
INT
81920
Receive buffer size in bytes. 0 uses system default.
tcp.local-address
STRING
Local address to bind to (optional). If not set, uses default.
tcp.local-port
INT
0
Local port to bind to (optional). 0 uses ephemeral port.
tls
tls.verify
BOOLEAN
true
tls.ignore-common-name
BOOLEAN
false
Accept a server certificate issued for a different host than the one connected to
tls.trust-store
STRING
Key store of certificates to trust, instead of the JVM’s public authorities
tls.trust-store-password
STRING
Password of the trust store named by tls.trust-store
tls.trust-store-type
STRING
PKCS12
Type of the trust store named by tls.trust-store
tls.version
STRING
TLS protocol version (e.g., 'TLSv1.2', 'TLSv1.3'). If not set, uses TLS 1.3 with fallback to TLS 1.2.
tls.keystore
STRING
Path to keystore (PKCS12/JKS) containing the client certificate and private key for mutual TLS.
tls.keystore-password
STRING
Password for the client keystore.
tls.keystore-type
STRING
Keystore type (e.g., 'PKCS12', 'JKS'). Defaults to PKCS12.
tls.log-session-keys
BOOLEAN
false
Log TLS session keys to the audit log in SSLKEYLOGFILE format for Wireshark decryption.
tls.connect-timeout-ms
INT
5000
Connection timeout in milliseconds.
tls.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
tls.write-timeout-ms
INT
0
Socket write timeout in milliseconds. 0 means no timeout.
tls.no-delay
BOOLEAN
true
Enable TCP_NODELAY (disable Nagle’s algorithm).
tls.keep-alive
BOOLEAN
false
Enable SO_KEEPALIVE.
tls.send-buffer-size
INT
81920
Send buffer size in bytes. 0 uses system default.
tls.receive-buffer-size
INT
81920
Receive buffer size in bytes. 0 uses system default.
tls.local-address
STRING
Local address to bind to (optional). If not set, uses default.
tls.local-port
INT
0
Local port to bind to (optional). 0 uses ephemeral port.
tls-psk
tls-psk.psk-identity
STRING
PSK identity string for TLS-PSK authentication. Must be used together with psk-key.
tls-psk.psk-key
STRING
PSK key as hexadecimal string for TLS-PSK authentication. Must be used together with psk-identity.
tls-psk.log-session-keys
BOOLEAN
false
Log TLS session keys to the audit log in SSLKEYLOGFILE format for Wireshark decryption.
tls-psk.connect-timeout-ms
INT
5000
Connection timeout in milliseconds.
tls-psk.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
tls-psk.write-timeout-ms
INT
0
Socket write timeout in milliseconds. 0 means no timeout.
tls-psk.no-delay
BOOLEAN
true
Enable TCP_NODELAY (disable Nagle’s algorithm).
tls-psk.keep-alive
BOOLEAN
false
Enable SO_KEEPALIVE.
tls-psk.send-buffer-size
INT
81920
Send buffer size in bytes. 0 uses system default.
tls-psk.receive-buffer-size
INT
81920
Receive buffer size in bytes. 0 uses system default.
tls-psk.local-address
STRING
Local address to bind to (optional). If not set, uses default.
tls-psk.local-port
INT
0
Local port to bind to (optional). 0 uses ephemeral port.
udp
udp.local-address
STRING
Local address to bind to. If not set, binds to all interfaces.
udp.local-port
INT
0
Local port to bind to. 0 uses ephemeral port.
udp.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
udp.max-packet-size
INT
65507
Maximum UDP packet size in bytes.
udp.send-buffer-size
INT
0
Send buffer size in bytes. 0 uses system default.
udp.receive-buffer-size
INT
0
Receive buffer size in bytes. 0 uses system default.
udp.broadcast
BOOLEAN
false
Enable SO_BROADCAST for sending broadcast packets.
udp.reuse-address
BOOLEAN
false
Enable SO_REUSEADDR to allow multiple bindings to the same address/port.
udp.share-socket
BOOLEAN
false
Share the underlying UDP socket across multiple transport instances. When true, instances with the same localAddress:localPort will share a socket. This is useful for protocols where multiple logical connections share one UDP port.
udp.multicast-ttl
INT
1
Time-to-live for multicast packets (1-255).
Modbus ASCII
Name
Type
Default Value
Required
Description
Name
Modbus ASCII
Code
modbus-ascii
Maven Dependency
<dependency>
<groupId>org.apache.plc4x</groupId>
<artifactId>plc4j-driver-modbus</artifactId>
<version>1.0.0</version>
</dependency>Default Transport
serial
Supported Transports
serialtcptlstls-pskudp
Config options:
request-timeout-ms
INT
5000
Default timeout for all types of requests. The timeout covers the full time from submission including queueing; queued requests whose remaining budget falls below a small dispatch margin (at most a quarter of the timeout, capped at 50 ms) fail fast instead of being sent.
default-unit-identifier
INT
1
Unit-identifier or slave-id that identifies the target PLC (On RS485 multiple Modbus Devices can be listening). Defaults to 1.
ping-address
STRING
4x00001:BOOL
Simple address, that the driver will use to check, if the connection to a given device is active (Defaults to reading holding-register 1).
default-payload-byte-order
STRING
BIG_ENDIAN
Default encoding used for transporting register values (Defaults to BIG_ENDIAN).
Allowed values are:
- BIG_ENDIAN
- LITTLE_ENDIAN
- BIG_ENDIAN_BYTE_SWAP
- LITTLE_ENDIAN_BYTE_SWAP
Since: 0.13.0
max-coils-per-request
INT
2000
Maximum number of coils addressable in one request (Defaults to 2000)
Since: 0.13.0
max-registers-per-request
INT
125
Maximum number of registers addressable in one request (Defaults to 125)
Since: 0.13.0
Transport config options:
serial
serial.baud-rate
INT
9600
Baud rate (bits per second)
serial.data-bits
INT
8
Number of data bits (5, 6, 7, or 8)
serial.stop-bits
INT
1
Number of stop bits (1 or 2)
serial.parity
STRING
none
Parity: none, odd, even, mark, space (case-insensitive)
serial.flow-control
STRING
none
Flow control: none, rts-cts, xon-xoff (case-insensitive)
serial.read-timeout-ms
INT
1000
Read timeout in milliseconds. 0 means blocking read.
serial.write-timeout-ms
INT
1000
Write timeout in milliseconds.
serial.dtr
BOOLEAN
false
Enable DTR (Data Terminal Ready) signal
serial.rts
BOOLEAN
false
Enable RTS (Request To Send) signal
serial.reuse-port
BOOLEAN
false
Reuse the underlying serial port across multiple transport instances. When true, instances with the same port will share a connection. This is useful for protocols where multiple logical connections share one serial port. Connections sharing a port must target distinct unit ids; Modbus RTU responses carry no transaction ids, so same-unit traffic from multiple connections cannot be told apart.
serial.interframe-delay
INT
0
Interframe delay in milliseconds for protocols that need spacing between messages. Applies to shared and dedicated ports; the gap is measured from the last write or received data.
tcp
tcp.connect-timeout-ms
INT
5000
Connection timeout in milliseconds.
tcp.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
tcp.write-timeout-ms
INT
0
Socket write timeout in milliseconds. 0 means no timeout.
tcp.no-delay
BOOLEAN
true
Enable TCP_NODELAY (disable Nagle’s algorithm).
tcp.keep-alive
BOOLEAN
false
Enable SO_KEEPALIVE.
tcp.send-buffer-size
INT
81920
Send buffer size in bytes. 0 uses system default.
tcp.receive-buffer-size
INT
81920
Receive buffer size in bytes. 0 uses system default.
tcp.local-address
STRING
Local address to bind to (optional). If not set, uses default.
tcp.local-port
INT
0
Local port to bind to (optional). 0 uses ephemeral port.
tls
tls.verify
BOOLEAN
true
tls.ignore-common-name
BOOLEAN
false
Accept a server certificate issued for a different host than the one connected to
tls.trust-store
STRING
Key store of certificates to trust, instead of the JVM’s public authorities
tls.trust-store-password
STRING
Password of the trust store named by tls.trust-store
tls.trust-store-type
STRING
PKCS12
Type of the trust store named by tls.trust-store
tls.version
STRING
TLS protocol version (e.g., 'TLSv1.2', 'TLSv1.3'). If not set, uses TLS 1.3 with fallback to TLS 1.2.
tls.keystore
STRING
Path to keystore (PKCS12/JKS) containing the client certificate and private key for mutual TLS.
tls.keystore-password
STRING
Password for the client keystore.
tls.keystore-type
STRING
Keystore type (e.g., 'PKCS12', 'JKS'). Defaults to PKCS12.
tls.log-session-keys
BOOLEAN
false
Log TLS session keys to the audit log in SSLKEYLOGFILE format for Wireshark decryption.
tls.connect-timeout-ms
INT
5000
Connection timeout in milliseconds.
tls.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
tls.write-timeout-ms
INT
0
Socket write timeout in milliseconds. 0 means no timeout.
tls.no-delay
BOOLEAN
true
Enable TCP_NODELAY (disable Nagle’s algorithm).
tls.keep-alive
BOOLEAN
false
Enable SO_KEEPALIVE.
tls.send-buffer-size
INT
81920
Send buffer size in bytes. 0 uses system default.
tls.receive-buffer-size
INT
81920
Receive buffer size in bytes. 0 uses system default.
tls.local-address
STRING
Local address to bind to (optional). If not set, uses default.
tls.local-port
INT
0
Local port to bind to (optional). 0 uses ephemeral port.
tls-psk
tls-psk.psk-identity
STRING
PSK identity string for TLS-PSK authentication. Must be used together with psk-key.
tls-psk.psk-key
STRING
PSK key as hexadecimal string for TLS-PSK authentication. Must be used together with psk-identity.
tls-psk.log-session-keys
BOOLEAN
false
Log TLS session keys to the audit log in SSLKEYLOGFILE format for Wireshark decryption.
tls-psk.connect-timeout-ms
INT
5000
Connection timeout in milliseconds.
tls-psk.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
tls-psk.write-timeout-ms
INT
0
Socket write timeout in milliseconds. 0 means no timeout.
tls-psk.no-delay
BOOLEAN
true
Enable TCP_NODELAY (disable Nagle’s algorithm).
tls-psk.keep-alive
BOOLEAN
false
Enable SO_KEEPALIVE.
tls-psk.send-buffer-size
INT
81920
Send buffer size in bytes. 0 uses system default.
tls-psk.receive-buffer-size
INT
81920
Receive buffer size in bytes. 0 uses system default.
tls-psk.local-address
STRING
Local address to bind to (optional). If not set, uses default.
tls-psk.local-port
INT
0
Local port to bind to (optional). 0 uses ephemeral port.
udp
udp.local-address
STRING
Local address to bind to. If not set, binds to all interfaces.
udp.local-port
INT
0
Local port to bind to. 0 uses ephemeral port.
udp.read-timeout-ms
INT
0
Socket read timeout in milliseconds. 0 means no timeout.
udp.max-packet-size
INT
65507
Maximum UDP packet size in bytes.
udp.send-buffer-size
INT
0
Send buffer size in bytes. 0 uses system default.
udp.receive-buffer-size
INT
0
Receive buffer size in bytes. 0 uses system default.
udp.broadcast
BOOLEAN
false
Enable SO_BROADCAST for sending broadcast packets.
udp.reuse-address
BOOLEAN
false
Enable SO_REUSEADDR to allow multiple bindings to the same address/port.
udp.share-socket
BOOLEAN
false
Share the underlying UDP socket across multiple transport instances. When true, instances with the same localAddress:localPort will share a socket. This is useful for protocols where multiple logical connections share one UDP port.
udp.multicast-ttl
INT
1
Time-to-live for multicast packets (1-255).
Tag Addresses
Addressing is implemented in C, Go, Java and Python. See the protocol support matrix for what each implementation does.
General Format
In general all Modbus addresses have this format:
{memory-Area}{start-address}[{selection}]:{data-type}{name-value-tag-options}If the selection is omitted, a single element is read. The selection in brackets is the shared array notation - a single index, an inclusive range, and optionally the array’s declared lower bound. See Addressing arrays for the full set of forms and what this driver can express.
If the data-type part is omitted, it defaults to BOOL for Coils and Discrete Inputs and INT for input, holding and extended registers. If the name-value-tag-options part is omitted, simply no configuration fine-tuning is applied.
Additionally address can contain tag configuration:
{unit-id: 123}Specifying this value overrides value of default-unit-identifier parameter specified at the connection string.
{byte-order: 'LITTLE_ENDIAN'}With this, can the default byte-order be overridden on a per-tag basis. If not provided the default-payload-byte-order from the connection string is used, or BIG_ENDIAN, if this is also not provided.
Java caps the plc4x-style address (coil:, discrete-input:, input-register:, holding-register:, extended-register:) at 9 digits; Go’s pattern is unbounded, so for example coil:1234567890 is accepted by Go and rejected by Java. This page documents the Java syntax - see the modbus entry in the Java/Go address divergence report for this restructure. |
|---|
Memory Areas
There are a number of memory areas defined in the Modbus specification.
- Discrete Input Area
- Coil Area
- Input Register Area
- Holding Register
- Extended Register Area
| Name | Memory Area Aliases | Description | Bit-Size | Permissions | Starting Address |
|---|---|---|---|---|---|
| Discrete Input | discrete-input: or 1 or 1x | Boolean input value, usually representing a binary input to the PLC | 1 | Read Only | 1 |
| Coil | coil: or 0 or 0x | Boolean value, usually representing a binary output from the PLC | 1 | Read/Write | 1 |
| Input Register | input-register: or 3 or 3x | Short input value, usually representing an analog input to the PLC | 16 | Read Only | 1 |
| Holding Register | holding-register: or 4 or 4x | Short value, usually representing an analog output from the PLC | 16 | Read/Write | 1 |
| Extended Register | extended-register: or 6 or 6x | Short value, | 16 | Read/Write | 0 |
Initially the Modbus format allowed up to 10000 address to be specified or the discrete inputs, coils, input registers and holding registers. Later on, this was expanded to allow up 65536 address within each memory area (except the extended register area). When using the long address format i.e. input-registers:1 the addresses between 1 and 65535 are able to be specified. When using the shorter versions there are two formats available i.e. 30001 and 300001. With the shorter format 3XXXX being limited to between 30001 and 39999, while the longer format 3XXXXX being limited to between 300001 and 365535. These memory areas all start at address 1.
Addresses are 1-based, the wire is 0-based
This is a Modbus speciality worth spelling out, because it is a frequent source of off-by-one confusion: the Modbus specification and virtually all device documentation number the registers and coils starting at 1, but the address actually transmitted in the request is that number minus one.
PLC4X follows the documentation convention - you write the address exactly as the device’s manual lists it, and the driver decrements it on the way to the wire:
| Tag address | Address on the wire | Meaning |
|---|---|---|
coil:1 | 0 | the first coil |
holding-register:1 | 0 | the first holding register |
holding-register:100 | 99 | the 100th holding register |
So a device manual documenting "holding register 40001" is addressed as holding-register:1 (or 4x00001), and the request that leaves PLC4X carries address 0.
The extended register area is the exception - it is genuinely 0-based in the specification, so no decrement is applied there and its lowest usable tag address is extended-register:1 (which is also address 1 on the wire). extended-register:0 is rejected. |
|---|
For the extended register area the addresses 0-99999 are able to be specified. These registers are mapped to file records with a length of 10000. Address 600000 corresponds to the first address in file record 0. Address 610000 is then the first address in the second file record and so on. It is noted that there is generally only 10 file records (600000 thru to 699999) however the spec allows for 65536 file records. Using the extended-register: format you are able to reference all of these, if the shorter format is used then it is limited to 699999. Unlike the other memory areas this one is 0-based in the specification, so its addresses are passed through unchanged; the lowest usable tag address is nevertheless extended-register:1.
Data Types
The following data types are supported
- BOOL (boolean)
- SINT (int 8)
- USINT (uint 8)
- BYTE (uint 8)
- INT (int 16)
- UINT (uint 16)
- WORD (uint 16)
- DINT (int 32)
- UDINT (uint 32)
- DWORD (uint 32)
- LINT (int 64)
- ULINT (uint 64)
- LWORD (uint 64)
- REAL (float)
- LREAL (double)
- CHAR (char)
- WCHAR (2 byte char)
- STRING (utf-8)
- WSTRING (utf-16)
- TIME (duration, milliseconds)
- LTIME (duration, nanoseconds)
- DATE (date)
- LDATE (date)
- TIME_OF_DAY (time of day)
- LTIME_OF_DAY (time of day)
- DATE_AND_TIME (date and time)
- LDATE_AND_TIME (date and time)
Coils and discrete inputs hold a single bit each and therefore support only BOOL. A coil or discrete-input tag declared with any other data type is accepted by the address parser, but the read returns the response code UNSUPPORTED. |
|---|
Reading an array of coils returns all of its elements: coil:1[0..7]:BOOL yields a list of 8 values.
Examples
To read 10 holding registers starting at address 20 and parse as Unsigned Integers the following examples are all valid.
- holding-register:20[0..9]:UINT
- 400020[0..9]:UINT
- 4x00020[0..9]:UINT
- 40020[0..9]:UINT
- 4x0020[0..9]:UINT
To read 1 holding register at address 5678 the following examples are valid.
- holding-register:5678
- 405678
- 4x05678
- 45678
- 4x5678
To read 1 holding register of unit 10 at address 5678 the following examples are valid.
- holding-register:5678{unit-id: 10}
- 405678{unit-id: 10}
- 4x05678{unit-id: 10}
- 45678{unit-id: 10}
- 4x5678{unit-id: 10}
To read 10 extended registers starting at address 50 the following examples are valid.
- extended-register:50[0..9]
- 600050[0..9]
- 6x00050[0..9]
- 60050[0..9]
- 6x0050[0..9]
This corresponds to addresses 50-59 in file record 1.
To read 10 extended registers starting at address 9995 the following examples are valid.
- extended-register:9995[0..9]
- 609995[0..9]
- 6x09995[0..9]
- 69995[0..9]
- 6x9995[0..9]
This corresponds to addresses 9995-9999 in file record 1 and addresses 0-5 in file record 2. Note that this request is split into 2 sub requests in the Modbus protocol.
Notes and Tips
Most memory areas start at address 1, except for the extended register area which starts at 0. These are both mapped to 0x0000 when it is sent in the Modbus protocol.
The input, holding and extended registers consist of 16-bit registers while the discrete input and coil areas consist of bits.
The following Modbus function codes are supported:-
- 0x01 (Read Coils)
- 0x02 (Read Discrete Inputs)
- 0x03 (Read Holding Registers)
- 0x04 (Read Input Registers)
- 0x05 (Write Single Coil)
- 0x06 (Write Single Register)
- 0x0F (Write Multiple Coils)
- 0x10 (Write Multiple Registers)
- 0x14 (Read File Record)(Extended Register Read)
- 0x15 (Write File Record)(Extended Register Write)
评论
登录后参与评论