MODBUS/TCP

Modbus/TCP with Phoenix Contact controllers

Application note
8294_en_03 © PHOENIX CONTACT 2015-10-08

1 Description
This application note describes how Phoenix Contact con-
trollers receive and process I/O signals from I/O devices
using Modbus/TCP.
Startup of the Modbus/TCP client function and the Modbus/
TCP server function is described using a project creation
process with PC Worx as an example, see Section 5 and
Section 7.

Modbus/TCP client Modbus/TCP server support

Controller
support As of firmware version As of AX Software Suite version
ILC 131 ETH Yes 4.40 1.82 AddOn V1
ILC 151 ETH Yes 4.40 1.82 AddOn V1
ILC 171 ETH 2TX Yes 4.40 1.82 AddOn V1
ILC 191 ETH 2TX Yes 4.40 1.82 AddOn V1
ILC 131 ETH/XC Yes 4.40 1.82 AddOn V1
ILC 151 ETH/XC Yes 4.40 1.82 AddOn V1
ILC 191 ME/AN Yes 4.40 1.82 AddOn V1
ILC 191 ME/INC Yes 4.40 1.82 AddOn V1
ILC 151 GSM/GPRS Yes 4.40 1.82 AddOn V1
AXC 1050 Yes – –
AXC 1050 XC Yes – –
AXC 3050 Yes – –
PC WORX RT BASIC Yes – –
PC WORX SRT Yes – –

Make sure you always use the latest documentation.

It can be downloaded at phoenixcontact.net/products.

This application note is valid for all products listed under “Ordering data” on page 4.
 MODBUS/TCP

2 Table of contents
1 Description.................................................................................................................................. 1
2 Table of contents ........................................................................................................................ 2
3 Ordering data.............................................................................................................................. 4
4 Modbus/TCP .............................................................................................................................. 5
5 Configuring a controller as a Modbus/TCP client – example project ..................................................... 6
5.1 Cyclic communication:
sequence for creating the Modbus project ..................................................................................................... 6
5.1.1 Creating a new project ........................................................................................................................ 7
5.1.2 Specifying project information ............................................................................................................. 7
5.1.3 Checking/modifying IP settings for the controller ................................................................................ 7
5.1.4 Inserting a “Generic Modbus Device”.................................................................................................. 7
5.1.5 Modifying the settings for the “Generic Modbus Device”..................................................................... 8
5.1.6 Compiling after completing the bus topology ...................................................................................... 9
5.1.7 Creating the program .......................................................................................................................... 9
5.1.8 Compiling after creating the program .................................................................................................. 9
5.1.9 Creating process data and assigning Modbus function codes ............................................................ 9
5.1.10 Generating variables and assigning process data............................................................................... 9
5.1.11 Generating diagnostic and control variables and assigning process data ......................................... 11
5.1.12 Compiling a project ........................................................................................................................... 12
5.1.13 Configuring the Modbus/TCP server ................................................................................................. 12
5.1.14 Sending a project and performing a cold restart................................................................................ 12
5.2 Acyclic communication using the MB_ASYNC_RW function block .............................................................. 13
5.2.1 Old version of the function block ....................................................................................................... 13
5.2.2 New version of the function block...................................................................................................... 14
5.3 Error codes of the “Status” output (Error = TRUE) ........................................................................................ 15
5.4 Using the MBT_STATION_DIAG diagnostic structure ................................................................................. 16
5.5 Specifying the size of the ReadBuffer/WriteBuffer........................................................................................ 17

6 Operating lower-level Modbus/RTU devices via a gateway .......................................................18

7 Configuring controllers as Modbus/TCP servers........................................................................19
7.1 Modbus/TCP server in PC Worx – example project...................................................................................... 19
7.1.1 Creating a new project ...................................................................................................................... 19
7.1.2 Specifying project information ........................................................................................................... 19
7.1.3 Checking/modifying IP settings for the controller .............................................................................. 19
7.1.4 Inserting the Modbus/TCP server...................................................................................................... 19
7.1.5 Modifying the settings for the Modbus/TCP server............................................................................ 19
7.1.6 Compiling after completing the bus topology .................................................................................... 20
7.1.7 Creating the program ........................................................................................................................ 20
7.1.8 Compiling after creating the program ................................................................................................ 20
7.1.9 Creating process data and defining registers .................................................................................... 20
7.1.10 Generating variables and assigning process data............................................................................. 22
7.1.11 Generating diagnostic and control variables and assigning process data ......................................... 22
7.1.12 Defining the cyclic task for the update time of the Modbus registers ................................................. 24

8294_en_03 PHOENIX CONTACT 2 / 32

 MODBUS/TCP

7.1.13 Compiling a project ........................................................................................................................... 25

7.1.14 Sending a project and performing a cold restart................................................................................ 25

8 Configuring multi-controller projects – example project .............................................................26

8.1 Creating a new project.................................................................................................................................. 26
8.2 Specifying project information ...................................................................................................................... 26
8.3 Checking/modifying IP settings for the controller.......................................................................................... 26
8.4 Inserting a specific Modbus device .............................................................................................................. 26
8.5 Modifying the settings for the specific Modbus device.................................................................................. 27
8.6 Inserting the ILC 191 ME/AN controller ........................................................................................................ 27
8.7 Checking/modifying IP settings for the controller.......................................................................................... 27
8.8 Inserting the Modbus/TCP server ................................................................................................................. 27
8.9 Modifying the settings for the Modbus/TCP server ....................................................................................... 28
8.10 Inserting a “Generic Modbus Device” ........................................................................................................... 28
8.11 Modifying the settings for the “Generic Modbus Device” .............................................................................. 28
8.12 Compiling after completing the bus topology................................................................................................ 28
8.13 Creating the program.................................................................................................................................... 28
8.14 Compiling after creating the program ........................................................................................................... 28
8.15 Creating process data and assigning Modbus function codes ..................................................................... 28
8.16 Generating variables and assigning process data ........................................................................................ 28
8.17 Generating diagnostic and control variables and assigning process data .................................................... 28
8.18 Creating process data and defining registers ............................................................................................... 28
8.19 Generating variables and assigning process data ........................................................................................ 28
8.20 Generating diagnostic and control variables and assigning process data .................................................... 28
8.21 Defining the cyclic task for the update time of the Modbus registers ............................................................ 28
8.22 Compiling a project....................................................................................................................................... 29
8.23 Configuring the Modbus/TCP server ............................................................................................................ 29
8.24 Sending a project and performing a cold restart ........................................................................................... 29

9 Special considerations when reading and writing WORD arrays ......................................................... 29

9.1 General examples ........................................................................................................................................ 29
9.2 Concrete examples for the general examples in Section 9.1 ........................................................................ 30
9.2.1 Example 1:
Read access for the Modbus/TCP client ........................................................................................... 30
9.2.2 Example 2:
Write access for the Modbus/TCP client ........................................................................................... 31

8294_en_03 PHOENIX CONTACT 3 / 32

 MODBUS/TCP

3 Ordering data
Products
Description Type Order No. Pcs./Pkt.
Inline controller with Ethernet interface for coupling to other controllers and ILC 131 ETH 2700973 1
systems, with programming options according to IEC 61131-3, complete with
connector plug and marking field.
Inline controller with Ethernet interface for coupling to other controllers and ILC 151 ETH 2700974 1
systems, with programming options according to IEC 61131-3, complete with
connector plug and marking field.
Inline controller with Ethernet interface for coupling to other controllers and ILC 171 ETH 2TX 2700975 1
systems, with programming options according to IEC 61131-3, complete with
connector plug and marking field.
Inline controller with Ethernet interface for coupling to other controllers and ILC 191 ETH 2TX 2700976 1
systems, with programming options according to IEC 61131-3, complete with
connector plug and marking field.
Inline controller with Ethernet interface for coupling to other controllers and ILC 131 ETH/XC 2701034 1
systems, with programming options according to IEC 61131-3, complete with
connector plug and marking field.
Inline controller with Ethernet interface for coupling to other controllers and ILC 151 ETH/XC 2701141 1
systems, with programming options according to IEC 61131-3, complete with
connector plug and marking field.
Inline controller with integrated pulse/direction interface, RS-485/RS-422, an- ILC 191 ME/AN 2700074 1
alog inputs (0 ... 10 V), and analog outputs (0 ... 10 V), with programming op-
tions according to IEC 61131-3
Inline controller with integrated pulse/direction interface, RS-485/RS-422, fast ILC 191 ME/INC 2700075 1
counters, and incremental encoder inputs, with programming options accord-
ing to IEC 61131-3
Inline controller with Ethernet interface and GSM modem for coupling to other ILC 151 GSM/GPRS 2700977 1
controllers and systems, with programming options according to IEC 61131-
3, complete with connector plug and marking field
Axiocontrol for the direct control of Axioline I/Os. With 2 Ethernet interfaces AXC 1050 2700988 1
and programming options according to IEC 61131-3. Complete with connec-
tor plug and marking field.
Axiocontrol for the direct control of Axioline I/Os. With 2 Ethernet interfaces, AXC 1050/XC 2701295 1
extended temperature range, and programming options according to IEC
61131-3. Complete with connector plug and marking field.
Axiocontrol for the direct control of Axioline I/Os. With 3 Ethernet interfaces AXC 3050 2700989 1
and programming options according to IEC 61131-3. Complete with connec-
tor plug and marking field.
Software PLC PC WORX RT BASIC 2700291 1
Software PLC PC WORX SRT 2701680 1

Documentation
Description Type Order No. Pcs./Pkt.
“Installing and operating the ILC 131 ETH, ILC 151 ETH, ILC 171 ETH 2TX, UM EN ILC 1X1 – –
ILC 191 ETH 2TX, ILC 131 ETH/XC, and ILC 151 ETH/XC Inline controllers”
user manual
“Installing and operating the ILC 191 ME/AN and ILC 191 ME/INC Inline con- UM EN ILC 191 ME/X – –
trollers” user manual
“Installing, starting up, and operating the ILC 151 GSM/GPRS Inline control- UM EN ILC 151 GSM/GPRS – –
ler” user manual
“Installing and operating the AXC 1050 and AXC 1050 XC controllers” user UM EN AXC 1050 (XC) – –
manual
“Installing and operating the AXC 3050 controller” user manual UM EN AXC 3050 (/XC) – –
“Installing and operating the PC WORX RT BASIC software PLC with Value- UM EN PC WORX RT BASIC – –
line industrial PCs and PROFINET” user manual
“Installing and operating the PC WORX SRT software PLC” user manual UM EN PC WORX SRT – –
“PC Worx” quick start guide UM QS EN PC WORX – –

8294_en_03 PHOENIX CONTACT 4 / 32

 MODBUS/TCP

4 Modbus/TCP
Modbus/TCP is a communication protocol used to ex- – Acyclic communication
change process data between a client and a server in an Process data between the Modbus/TCP client and the
Ethernet network. Modbus/TCP server is exchanged as required. The
A Modbus/TCP client function is therefore integrated in “MB_ASYNC_RW” function block, which is used on the
Phoenix Contact controllers (see “Ordering data” on client side, is available in PC Worx for this (see
page 4). The I/O devices must include a Modbus/TCP Section 5.2).
server function. The TCP/IP connection is established, it is disconnect-
As of firmware Version 4.40, ILC 1X1 controllers can also be ed once the data has been transmitted, and is then re-
configured as Modbus/TCP servers (see Section 7). established in the event of a new communication
request. Connection establishment and connection
The TCP protocol (Transmission Control Protocol) or the abort are initiated automatically by the Modbus/TCP cli-
UDP protocol (User Datagram Protocol) can be used for ent.
data transmission. The Modbus protocol data to be trans-
mitted is embedded in the relevant protocol. The controller By default, port 502, which is reserved for Modbus/TCP, is
supports two methods of communication: used for communication.
– Cyclic communication The Modbus/TCP client initiates communication between
the Modbus/TCP client and server. The client sends a re-
Process data between the Modbus/TCP client and the
quest in the form of a Modbus/TCP function code (and data,
Modbus/TCP server is exchanged cyclically. This is
if necessary) to the Modbus/TCP server. After successful
triggered by the corresponding task in which the pro-
receipt of the request, the server sends a corresponding re-
cess data is defined.
sponse to the client which includes the requested data and
The Modbus/TCP client can maintain process data
status information or an error message. The data may con-
watchdogs of Modbus/TCP servers in a time period that
tain bit or word information.
can be defined. To do so, the Modbus/TCP client re-
peats all the write access operations to the relevant The device-internal organization of the data (Modbus mem-
Modbus/TCP server using the current data. ory addresses, etc.) and of the supported Modbus function
During cyclic communication, the established TCP/IP codes varies depending on the device and manufacturer.
connection between the client and server remains per- For more information, please refer to the documentation for
manently active. the relevant device.
For communication between the client and server, Modbus/
TCP provides various services for read and write access to
digital inputs and outputs and to registers.
The following table shows the supported Modbus function
codes:

Modbus function codes

Code No. Function code Description Method
FC01 Read Coils Read several internal bits or digital outputs Bit-by-bit
FC02 Read Discrete Inputs Read several digital inputs Bit-by-bit
FC03 Read Holding Registers Read several internal registers or output registers Word-by-word
FC04 Read Input Registers Read several input registers Word-by-word
1
FC05 Write Single Coil Write one internal bit or digital output Bit-by-bit
FC061 Write Single Register Write one internal register Word-by-word
FC15 Write Multiple Coils Write several internal bits or digital outputs Bit-by-bit
FC16 Write Multiple Registers Write several internal registers or output registers Word-by-word
FC23 Read/Write Multiple Read and write several internal registers or output registers si- Word-by-word
Registers multaneously
1
In the PC Worx bus configuration, only the Modbus/TCP server supports the Modbus function code.

8294_en_03 PHOENIX CONTACT 5 / 32

 MODBUS/TCP

5 Configuring a controller as a Mod-

bus/TCP client – example project Start

The following example project consists of the ILC 151 ETH OFFLINE
(controller) and the ILB ETH 24 DI16 DIO16-2TX (Inline Creating a new project
Block IO module for Ethernet with 16 digital inputs and 16
digital inputs or outputs).
A Modbus/TCP network is used exclusively in the example Specifying
project information
project.
For information on using a gateway to connect a Modbus/
TCP network to Modbus/RTU devices, please refer to Checking/modifying
Section 6. IP settings for the controller

5.1 Cyclic communication:

Inserting
sequence for creating the Modbus project „Generic Modbus device“

The complete sequence for creating the Modbus project in

PC Worx is shown in Figure 1. Checking/modifying settings
for the „Generic Modbus device“
For more detailed information on creating a proj-
ect, please refer to the UM QS EN PC WORX
quick start guide or the PC Worx online help. Compiling after completing
the bus topology
When creating the PC Worx project, most of the tasks are
performed offline (without a connection to the Modbus sys-
tem). Creating the program

Compiling after creating

the program

Creating process data

and assigning
Modbus function codes

Generating variables
and assigning process data

Generating diagnostic and

control variables and
assigning process data

Compiling the project

ONLINE
Configuring
the Modbus/TCP server

Sending a project and

performing a cold restart

Operation (end)
8294C001

Figure 1 Sequence for creating the Modbus project

8294_en_03 PHOENIX CONTACT 6 / 32

 MODBUS/TCP

5.1.4 Inserting a “Generic Modbus Device”

The sequence described here for creating a Mod- In the example, the ILB ETH 24 DI16 DIO16-2TX
bus project applies to projects based on cyclic Inline Block IO module for Ethernet is used as a
communication between the controller (here: Modbus/TCP server.
Modbus/TCP client) and any Modbus/TCP serv-
Specific settings are required for communication
er.
between the Modbus/TCP client and server.
Acyclic communication is explained in Section
These settings are made in PC Worx via the “Ge-
5.2 “Acyclic communication using the
neric Modbus Device”.
MB_ASYNC_RW function block” .
The “Generic Modbus Device” must be inserted in
the bus configuration so as to enable communica-
5.1.1 Creating a new project
tion between the Modbus/TCP client and server.
• Select the “New Project...” command from the “File”
menu. • Make sure you are in the bus configuration workspace.
• Select the controller and confirm your selection with • If the device catalog is hidden, show it by selecting the
“OK”. “View, Device Catalog” menu.
• Select the “File, Save Project As/Zip Project As...” com- • Open the “Phoenix Contact, Generic, Device” device
mand. catalog.
• Enter a unique and meaningful project name and save • Select the “Generic Modbus Device”.
the project.

5.1.2 Specifying project information

• Switch to the bus configuration workspace.
• Adapt the project information to your project.

5.1.3 Checking/modifying IP settings for the control-

ler
The IP settings for the controller are made when the project
Figure 2 Selecting the “Generic Modbus Device”
is created.
Adapt these settings, if required. • Hold down the left mouse button and move the “Generic
• Switch to the bus configuration workspace. Modbus Device” to the “Bus Structure” window to the
• Select the controller node. right of the MODBUS_CLT icon1 until the “Insert in the
• In the “Device Details” window, switch to the “IP Set- lower level” icon appears.
tings” tab. • Move all other “Generic Modbus Devices” to below the
• Check the IP settings and modify them, if necessary. preceding “Generic Modbus Device” until the “Insert at
the same level” icon appears.
• Assign an IP address, if it has not yet been assigned.
For detailed information on assigning the IP address, Figure 3 shows the bus configuration with the inserted “Ge-
please refer to the UM QS EN PC WORX quick start neric Modbus Device”.
guide.

The IP address that is assigned here for the con-

troller is also implemented as the IP address for
the communication path via TCP/IP.

Figure 3 Generic Modbus Device inserted

1 If a 1X1 controller with firmware Version 4.40 or later is used, the

MODBUS icon is displayed instead of the MODBUS_CLT icon.

8294_en_03 PHOENIX CONTACT 7 / 32

 MODBUS/TCP

Station Name
“Hide Device” or “Deactivate Bus” can be select- This name is the unique identification for the Modbus/TCP
ed via the context menu for the device. server (here: ILB ETH 24 DI16 DIO16-2TX) in the network.
To show the device again or to activate the bus,
select the aforementioned settings from the con- MAC Address
text menu again. Enter the MAC address of the Modbus/TCP server (here:
ILB ETH 24 DI16 DIO16-2TX). It is printed on the respective
5.1.5 Modifying the settings for the “Generic Modbus device. It starts with “00.a0.45.” on Phoenix Contact de-
Device” vices.
Following insertion in the bus configuration, default values Entry of the MAC address is optional and is not absolutely
are set for each “Generic Modbus Device”. The settings can necessary.
be modified via the “Modbus-Settings” tab.
IP Address
The settings for the “Generic Modbus Device” are The IP address allows the Modbus/TCP server (here:
required for communication between the Mod- ILB ETH 24 DI16 DIO16-2TX) to be accessed during opera-
bus/TCP client and server. tion. PC Worx selects the address from the area that is set
• Make sure you are in the bus configuration workspace. on the project node.
• Select the “Generic Modbus Device” in the “Bus Struc-
Subnetmask
ture” window.
• Select the “Modbus-Settings” tab in the “Device Details” The subnet mask that was specified on the project node is
window. assigned to each Modbus/TCP server (here:
ILB ETH 24 DI16 DIO16-2TX). It can be modified specifi-
• Modify the Modbus settings according to your require-
cally for each individual device.
ments.
Protocol
Select the protocol (TCP or UDP) to be used for communi-
cation here.

Port
Select the port for communication here. By default, port 502,
which is reserved for Modbus/TCP, is used.

Swap Bytes
If required, the byte order for the entire communication with
the Modbus/TCP server can be swapped here, provided
that the Modbus/TCP server and the Modbus/TCP client
(here: ILC 151 ETH) operate using a different byte order.
Select “Yes” to reverse the byte order used on the client
side.
For information on the byte order, refer to Section 9.

Connection timeout / UDP timeout

This value specifies the minimum time required to identify a
connection interruption.
Figure 4 Modbus settings for the “Generic Modbus De- When using UDP, it is not possible to determine whether a
vice” connection interruption has occurred. Therefore, the last
package sent after UDP timeout is sent again.
The settings required for communication between the Mod- In addition, the value specifies the time within which a Mod-
bus/TCP client and server include: bus/TCP server needs to have responded to a Modbus/TCP
client request.

8294_en_03 PHOENIX CONTACT 8 / 32

 MODBUS/TCP

Reconnection interval • Select the desired data type.

When the TCP connection is interrupted (connection time- • Enter the number of bits or registers to be read or writ-
out) and the set time interval has elapsed, an attempt is ten.
made to establish a new TCP connection. • For the Modbus/TCP server, enter the memory area of
This setting is not relevant for communication via UDP. the process data item as the “Address” for which the se-
lected function code should be used.
Process Data Watchdog Trigger For the memory area of the process data item, please
refer to the documentation for the device being used as
The process data watchdog trigger specifies a time period the Modbus/TCP server.
during which the Modbus/TCP server must be accessed In the example, a 16-bit word should be read from an in-
again (write access) at the latest. ternal register. The Modbus function code FC03 is used
The time set here should be half the process data watchdog here. The value “1” is set as the address, since the
time set on the Modbus/TCP server. memory area for the process data item used to read an
The setting “0 ms” means that the watchdog is switched off. internal register word-by-word for the
ILB ETH 24 DI16 DIO16-2TX has the value “1” (see ter-
Unit ID minal-specific data sheet).
Address of the device in the Modbus/RTU network below • The “Data Direction” indicates whether the function ac-
the gateway. cesses a digital input/an internal register or a digital out-
Default value: 255 (operation without gateway) put/an output register. The data direction depends on
the selected function code and cannot be modified
5.1.6 Compiling after completing the bus topology manually.
• Select the “Build, Make” command.

5.1.7 Creating the program

• Create the program.
To program the example program, proceed as described in
the UM QS EN PC WORX quick start guide.
Figure 5 Creating process data and assigning Modbus
5.1.8 Compiling after creating the program
function codes
• Select the “Build, Make” command.

5.1.9 Creating process data and assigning Modbus

function codes In the “Modbus Register”, the function code FC23
is displayed in two rows (one row for the IN data
For the Modbus/TCP client (here: ILC 151 ETH), you must direction and one row for the OUT data direction).
specify which Modbus function codes of the Modbus/TCP When one row is deleted, the second row will also
client should be used to access specific register addresses be removed automatically.
of the Modbus/TCP server (here: ILB ETH 24 DI16 DIO16-
2TX). To do this, define specific process data and assign NOTE:
the data to the corresponding Modbus function codes.
When linking a process variable of Array [] of
• Make sure you are in the bus configuration workspace.
(D)WORD data type, the byte order may be re-
• Select the Generic Modbus Device in the “Bus Struc- versed. For further information, please refer to
ture” window. Section 9.
• Select the “Modbus Register” tab in the “Device Details”
window. 5.1.10 Generating variables and assigning process
• Right-click to open the context menu for the “Name” data
field. Process data and variables are assigned in the process
• Select the “Add” menu item. data assignment workspace.
• Specify a unique and meaningful name for the process • Switch to the process data assignment workspace to
data item in the “Name” field. assign the variables to the process data.
• Select the desired “Function Code”, see Table “Modbus
function codes” on page 5.

8294_en_03 PHOENIX CONTACT 9 / 32

 MODBUS/TCP

• Select the “Generic Modbus Device” in the top right win- • Variables are created when the program is created. Us-
dow. The standard configuration is then displayed in the ing drag and drop, link the selected variable to one of
top left window (“Symbols/Variables”). the variables displayed on the left-hand side.
• In the top left window (“Symbols/Variables”), select the If you would like to link further process data but no cor-
standard resource. responding variables have been created yet, select
• In the top right window, select the device for which you “Create Variable” in the context menu.
would like to link the process data to variables (in The created variable is displayed in the bottom left window.
Figure 6: “Generic Modbus Device”; the • Repeat this procedure for all inputs to be evaluated and
ILB ETH 24 DI16 DIO16-2TX module is used in the ex- for all outputs to be controlled.
ample). The result of process data assignment is shown in Figure 6.
• Select the process data item to be linked.

Figure 6 All used process data assigned to variables

8294_en_03 PHOENIX CONTACT 10 / 32

 MODBUS/TCP

5.1.11 Generating diagnostic and control variables Parameter Description

and assigning process data
InternalError1 Used internally by
In the IEC programming workspace, the diagnos- Phoenix Contact
tic and control structure is declared in the project InternalError2 Used internally by
tree window under “Data Types, sys_flag_types”. Phoenix Contact
ExceptionCounter Number of exception codes
PC Worx provides a diagnostic and control structure for received (Modbus exception
each “Generic Modbus Device”, allowing the connection codes)
status, connection statistics, and connection interruptions to
DiagReserved1 Reserved
be read.
DiagReserved2 Reserved
PC Worx provides the following diagnostic and control
structure: UnitID Address of the device in the
Modbus/RTU network below
– “STATION_DIAG” diagnostic structure
the gateway.
Default value: 255 (operation
Parameter Description without gateway)
Status Status of the communication DiagReserved3 Reserved
connection to the
Modbus/TCP server
– “STATION_CONTROL” control structure
(bit 0 = 1: communication
connection is OK, bit 1 = 1: an
exception has occurred) Parameter Description
IP IP address of the ctrlStatistics All parameters of the diagnos-
Modbus/TCP server in the tic structure are reset with a
bus configuration rising edge at bit 0.
OfflineCounter Number of times the Modbus/ ControlReserved1 Reserved
TCP server was offline ControlReserved2 Reserved
NetCycleAvg Average response time of the ControlReserved3 Reserved
Modbus/TCP server In order to use the diagnostic and control structure, create a
NetCycleMin Minimum response time of the diagnostic variable and a control variable.
Modbus/TCP server • Switch to the IEC programming workspace.
NetCycleMax Maximum response time of • Double-click on “Global_Variables” in the project tree
the Modbus/TCP server window.
NetInCycleAvg Average response time of the The global variables of the standard resource are displayed.
Modbus/TCP server in the
• Insert a new variable via the context menu which should
case of read access
be used as the control variable.
NetInCycleMin Minimum response time of the
• Select the MBT_STATION_CONTROL type for the
Modbus/TCP server in the
control variable.
case of read access
• Insert another new variable via the context menu which
NetInCycleMax Maximum response time of
should be used as the diagnostic variable.
the Modbus/TCP server in the
case of read access • Select the MBT_STATION_DIAG type for the diagnos-
tic variable.
NetOutCycleAvg Average response time of the
Modbus/TCP server in the
case of write access
NetOutCycleMin Minimum response time of the
Modbus/TCP server in the
case of write access
NetOutCycleMax Maximum response time of
the Modbus/TCP server in the
case of write access

8294_en_03 PHOENIX CONTACT 11 / 32

 MODBUS/TCP

Figure 7 Diagnostic and control variables generated

• Switch to the process data assignment workspace to The result of process data assignment is shown in Figure 8.
assign the process data to the control and diagnostic
variables, as described in Section 5.1.10 on page 9.

Figure 8 Process data assigned to the diagnostic and control variables

5.1.12 Compiling a project

• Select the “Build, Make” command.

5.1.13 Configuring the Modbus/TCP server

• Perform all of the required configurations (e.g., setting
the IP address and process data watchdog) directly on
the Modbus/TCP server (here:
ILB ETH 24 DI16 DIO16-2TX).
For information on how to configure and start up the device,
please refer to the corresponding documentation.

5.1.14 Sending a project and performing a cold restart

• Open the “Project Control Dialog”.
• Activate the “Include Bootproject” check box in the
“Project” area.
• Click on “Download” in the area on the left.

8294_en_03 PHOENIX CONTACT 12 / 32

 MODBUS/TCP

5.2 Acyclic communication using the • In the “MBT_STATION_DIAG” structure, replace the
MB_ASYNC_RW function block “IP:DWORD;” data type with the “Handle:DWORD;”
data type.
The MB_ASYNC_RW function block is used for acyclic
communication between the controller (Modbus/TCP client) • In the “MBT_STATION_DIAG” structure, replace the
and the Modbus/TCP server. “UnitID:BYTE;” data type with the “StationNum-
ber:BYTE;” data type.
The old function block can now be used.
The MB_ASYNC_RW function block is available
in two different versions. The two versions differ
with respect to the “ServerID” input and the “IP” For further information on the function block,
and “UnitID” inputs. The function block either has please refer to the online help for PC Worx.
the “ServerID” input (old block) or the “IP” and
“UnitID” inputs (new block). The new function
block (see Figure 9) is supported by the following
devices:
– ILC 1x1 ≥ firmware 4.20
– AXC 1050 (XC) ≥ firmware 2.10
– AXC 3050 ≥ firmware 5.50
All other controllers (see “Ordering data” on
page 4) support the old block (“ServerID” input).

5.2.1 Old version of the function block

When the function block is inserted in the variable work-
sheet for the first time, the new function block is used by de-
fault.
If you are using a controller that supports the old function
block, proceed as follows to display the old block in the vari-
able worksheet:
• Insert the new block in the variable worksheet.
• In the project tree window, right-click to open the con-
text menu for “Logical POUs”.
• Select the “Properties” menu item.
• In the “Change of POU/POUs properties:” dialog that
opens, select the “PLC/Processor” tab.
• Select the “eCLR” entry from the drop-down list as the
“PLC type”.
• Select the controller used with the corresponding firm-
ware version from the drop-down list as the “Processor
type”.
• Confirm your settings by clicking “OK”.
• In the variable worksheet, right-click to open the context
menu for the function block.
• Select the “Update FB/FU” entry.
Following the update, the old block (“ServerID” input) is dis-
played.
In order to use the old function block, some data types need
to be adapted in the predefined data structures:
• Double-click on “sys_flag_types” in the project tree win-
dow.

8294_en_03 PHOENIX CONTACT 13 / 32

 MODBUS/TCP

5.2.2 New version of the function block

Figure 9 MB_ASYNC_RW function block

Input and output parameters of the function block

Name Data type Description
Request BOOL The input parameters are checked and the function block is activated with a
positive edge at this input.
After the function code has been executed successfully, the block is deacti-
vated and can only be activated by a new positive edge.
IP DWORD IP address of the “Generic Modbus Device” in the bus configuration.

Recommended:
Use the IP address from the previously created diagnostic struc-
ture (see Section 5.4). This ensures that the current settings
from the bus configuration are always used.
Alternatively, the IP address can be entered directly.

When operating Modbus/RTU devices, the IP address of the

corresponding gateway must be used.
UnitID BYTE UnitID of the Modbus/RTU device (Modbus/RTU slave) in the bus configura-
tion.

Recommended:
Use the UnitID from the previously created diagnostic structure
(see Section 5.4). This ensures that the current settings from the
bus configuration are always used.
Alternatively, the UnitID can be entered directly.

FC BYTE Modbus function code (see Table “Modbus function codes” on page 5)
ReadStartAddr WORD Start address of the memory from which data should be read.
WriteStartAddr WORD Start address from which data should be written to the memory.
MaxReadCount INT Number of bits or registers to be read.
WriteCount INT Number of bits or registers to be written.

8294_en_03 PHOENIX CONTACT 14 / 32

 MODBUS/TCP

Input and output parameters of the function block

Name Data type Description
Done BOOL TRUE: The block has been executed successfully and acyclic communi-
cation has taken place.
FALSE: The function block is still being executed or has not been execut-
ed.
Error BOOL TRUE: An error has occurred. Details are provided by the “Status” out-
put.
FALSE: No error has occurred.

“Error” indicates an error as long as the “Request” input is active.

Status DWORD In the event of an error (Error = TRUE), the “Status” output contains an error
code. The possible error codes are shown in Table “Error codes of the “Sta-
tus” output” on page 15.
ReadByteCount INT Number or read bits/registers
WrittenByteCount INT Number of written bits/registers
ReadBuffer BYTE Buffer (250 bytes, maximum) in which the read bits/registers are stored (de-
WORD pending on the function code used).
DWORD
ARRAY OF BYTE, To define the size of the buffer, see Section 5.5 “Specifying the
ARRAY OF WORD size of the ReadBuffer/WriteBuffer” .
ARRAY OF DWORD
WriteBuffer BYTE Buffer (250 bytes, maximum) for the written bits/registers (depending on the
WORD function code used).
DWORD
ARRAY OF BYTE, To define the size of the buffer, see Section 5.5 “Specifying the
ARRAY OF WORD size of the ReadBuffer/WriteBuffer” .
ARRAY OF DWORD

5.3 Error codes of the “Status” output (Error = TRUE)

Error codes of the “Status” output

Value Meaning
0x0101 0000 Unsupported/unknown Modbus function
0x0102 0000 The value for MaxReadCount is outside the permissible range.
0x0103 0000 The value for WriteCount is outside the permissible range.
0x0104 0000 Wrong data type for ReadBuffer.
0x0105 0000 The elements of the ReadBuffer array are not of type WORD, DWORD or BYTE.
0x0106 0000 Wrong data type for WriteBuffer.
0x0107 0000 The elements of the WriteBuffer array are not of type WORD, DWORD or BYTE.
0x0108 0000 ReadBuffer is too small. Reduce the number of elements for MaxReadCount or increase the
ReadBuffer size.
0x0109 0000 WriteBuffer is too small. Reduce the number of elements for WriteCount or increase the
WriteBuffer size.
0x010A 0000 ReadBuffer is too large.

To define the size of the buffer, see Section 5.5 “Specifying the
size of the ReadBuffer/WriteBuffer” .

8294_en_03 PHOENIX CONTACT 15 / 32

 MODBUS/TCP

Error codes of the “Status” output

Value Meaning
0x010B 0000 WriteBuffer is too large.

To define the size of the buffer, see Section 5.5 “Specifying the
size of the ReadBuffer/WriteBuffer” .
0x0201 0000 Unknown server ID (not configured)
0x0202 xxxx Modbus protocol error code

For detailed information on the error codes of the Modbus/TCP protocol, please
refer to the “MODBUS APPLICATION PROTOCOL SPECIFICATION” docu-
ment.
Current document versions can be found at modbus org
0x0203 0016 Timeout when receiving the response from the Modbus/TCP server.
0x0203 0019 The connection was terminated by the Modbus/TCP server.
0x0203 001F The request was not sent. The Modbus/TCP server is not accessible.
0x0301 0000 Timeout when receiving the response from the Modbus stack. The Modbus/TCP server is
not accessible.

5.4 Using the MBT_STATION_DIAG diagnostic

structure

More detailed information on function block dia-

gram (FBD) programming can be found in the
UM QS EN PC WORX quick start guide.
• Double-click on the “IP” input parameter of the function
block to specify the variable properties.
• In the “Variable Properties” window, select the name of
the previously created diagnostic structure (here:
“MB_DIAG”).

Figure 11 Creating the MB_DIAG.IP variable (2)

Figure 10 Creating the MB_DIAG.IP variable (1)

• Put a period after the selected name and select the “IP”
entry from the list that appears.

Figure 12 Creating the MB_DIAG.IP variable (3)

8294_en_03 PHOENIX CONTACT 16 / 32

 MODBUS/TCP

• Confirm your entries with “OK”.

The IP address of the “MB_DIAG” diagnostic structure has
now been assigned to the “IP” input parameter of the func-
tion block (see Figure 13).

Figure 14 Creating data types

• Once you have defined the data types, select the “Build,
Make” command.
Once compiled, the data types can be used in the variable
worksheet. In Figure 15, the previously created
“MODBUS_BUFFER_BSP1” data type is used for the
“ReadBuffer” input/output parameter.
• Double-click on the “ReadBuffer” input parameter in the
MB_ASYNC_RW_1 function block.
• In the “Variable Properties” window, enter a name for
the variable (in the example: “Read_Buffer_1”).
Figure 13 MB_DIAG.IP variable as “IP” in the function • In the “Data Type” list, select the previously created
block data type you wish to use (in the example:
“MODBUS_BUFFER_BSP1”).
• Create the MB_DIAG.UnitID variable for the “UnitID” in-
put parameter. Proceed as described above for the
MB_DIAG.IP variable.

5.5 Specifying the size of the ReadBuffer/WriteBuf-

fer
The size of the “ReadBuffer” and “WriteBuffer” parameters
can be specified individually by defining the corresponding
data types (here: “ReadBuffer” of ARRAY OF BYTE data
type, “WriteBuffer” of ARRAY OF WORD data type).

The maximum size of ReadBuffer and WriteBuf-

fer is 250 bytes each. The parameters may be of
BYTE, WORD or DWORD data type, or an array
of these data types.
• Double-click on “sys_flag_types” in the project tree win- Figure 15 Creating a variable
dow.
• Define the desired data types and their size as shown in • Confirm your entries with “OK”.
Figure 14.
The “Read_Buffer_1” variable has now been assigned to
the “ReadBuffer” input/output parameter.

8294_en_03 PHOENIX CONTACT 17 / 32

 MODBUS/TCP

Figure 17 shows two Modbus/TCP devices as an example.

Device “# 1 Generic Modbus Device” is a Modbus/TCP
server, device “# 2 Generic Modbus Device (Gateway)” is a
gateway for switching from Modbus/TCP to Modbus/RTU.
In the Modbus/TCP network, the gateway acts as the Mod-
bus/TCP server, and in the Modbus/RTU network, it acts as
the Modbus/RTU master. The individual Modbus/RTU de-
vices (# 3 Generic Modbus Device (RTU), etc.) represent
the Modbus/RTU slaves and are addressed via their UnitID.

Figure 16 “Read_Buffer_1” variable as “ReadBuffer” in

the function block

For further information on user-defined data types

and their use, please refer to the PC Worx online
help.

6 Operating lower-level Modbus/RTU

Figure 18 Settings of a Modbus/RTU device
devices via a gateway
The MB_ASYNC_RW function block is used for acyclic
This function is available as of communication with the Modbus/RTU devices, see
AUTOMATIONWORX Software Suite Section 5.2.
Version 1.81 AddOn V1.

Lower-level Modbus/RTU devices can be

operated via a gateway. In order to do this, all Modbus/TCP
and Modbus/RTU devices as well as the gateway must be
displayed in the “Bus Structure” window in PC Worx (see
Figure 17).

Figure 17 Bus configuration with Modbus/TCP devices

and lower-level Modbus/RTU devices

8294_en_03 PHOENIX CONTACT 18 / 32

 MODBUS/TCP

7 Configuring controllers as Mod- • Open the “Phoenix Contact, Generic, Server” device
catalog.
bus/TCP servers
• Insert the controller as the generic Modbus/TCP server
As of firmware Version 4.40, ILC 1X1 controllers by selecting “Modbus Server”.
can also be configured as Modbus/TCP servers.
This function is available as of
AUTOMATIONWORX Software Suite Version
1.82 AddOn V1.

Communication connections to Modbus/TCP clients

Each individual ILC 1X1 controller supports a different num-
ber of communication connections to Modbus/TCP clients:

Controller Max. number of communication

connections to Modbus/TCP cli- Figure 19 Selecting “Modbus Server”
ents
ILC 131 ETH • Hold down the left mouse button and move the “Mod-
4
ILC 131 ETH/XC bus Server” to the “Bus Structure” window to the right of
ILC 151 ETH the MODBUS icon until the “Insert in the lower level”
6 icon appears.
ILC 151 ETH/XC
ILC 171 ETH 2TX 8 Figure 20 shows the bus configuration with the inserted
ILC 191 ETH 2TX Modbus/TCP server.
ILC 191 ME/AN 8
ILC 191 ME/INC

7.1 Modbus/TCP server in PC Worx – example proj-

ect
The procedure for creating a Modbus project with a control-
ler as the Modbus/TCP server is essentially identical to the
procedure described in Section 5.1 for creating a Modbus
project with a controller as the Modbus/TCP client.
Only the differences between the procedures are described
in more detail in this section.
Where the procedures are identical, reference is made to Figure 20 “Modbus Server” inserted
Section 5.1.

7.1.1 Creating a new project

Only one controller can be inserted as the gener-
See Section 5.1.1
ic “Modbus Server”.
The IP settings for the inserted
7.1.2 Specifying project information
Modbus/TCP server match the IP settings that
See Section 5.1.2 were previously made for the controller.

7.1.3 Checking/modifying IP settings for the control- 7.1.5 Modifying the settings for the Modbus/TCP
ler server
See Section 5.1.3 Following insertion in the bus configuration, default values
are set for the Modbus/TCP server. The settings can be
7.1.4 Inserting the Modbus/TCP server modified via the “Modbus-Settings” tab.
• Make sure you are in the bus configuration workspace. • Make sure you are in the bus configuration workspace.
• If the device catalog is hidden, show it by selecting the • Select the “Modbus Server” in the “Bus Structure” win-
“View, Device Catalog” menu. dow.

8294_en_03 PHOENIX CONTACT 19 / 32

 MODBUS/TCP

• Select the “Modbus-Settings” tab in the “Device Details” – “Inputs keep the last value”
window. Inputs retain their last value.
• Modify the Modbus settings according to your require- – “Inputs perform write accesses”
ments. Inputs are updated. The state of the process data
watchdog is displayed in the “NODE_STATUS_255” di-
agnostic structure under “Flags”. If the watchdog has
been triggered, the corresponding flag is set. In this
case, you need to decide what should be done with the
values of the inputs and a corresponding algorithm
must be programmed.

Port
TCP/UDP port via which communication with the Modbus
client takes place.
Port 502 is used by default.

7.1.6 Compiling after completing the bus topology

Figure 21 Modbus settings for the Modbus/TCP server
• Select the “Build, Make” command.
The Modbus settings for the Modbus/TCP server include:
7.1.7 Creating the program
Process Data Watchdog Trigger • Create the program.
The process data watchdog trigger specifies a time period To program the example program, proceed as described in
during which the Modbus/TCP server must be accessed the UM QS EN PC WORX quick start guide.
again (write access) at the latest.
The time set here should be double the process data watch- 7.1.8 Compiling after creating the program
dog time set on the Modbus/TCP client (see Section 5.1.5). • Select the “Build, Make” command.
The time starts running after the first write access operation
performed by the Modbus/TCP client. 7.1.9 Creating process data and defining registers
The setting “0 ms” means that the process data watchdog is
switched off. For successful communication between
Modbus/TCP client(s) and the Modbus/TCP server, regis-
Process Data Watchdog Trigger register ters must be defined for write and read access on both the
client and server side. The corresponding process data
Register address (default value: 1000) must be created for this.
A write access operation by the Modbus/TCP client to bit 0 In addition, Modbus function codes for write and read ac-
of this register address resets the process data watchdog cess must also be specified for the Modbus/TCP client, see
with a rising edge. Section 5.1.9.
The process data watchdog cannot be reset by the Modbus/ Proceed as follows to create the process data and to define
TCP server. the registers on the server side:
In the case of read access operations to this register ad- • Make sure you are in the bus configuration workspace.
dress, the current state of the process data watchdog • Select the “Modbus Server” in the “Bus Structure” win-
(bit 1 = 0: watchdog not triggered, bit 1 = 1: watchdog trig- dow.
gered) is read.
• Select the “Modbus Register” tab in the “Device Details”
Process Data Watchdog Trigger behavior window.
• Right-click to open the context menu for the “Name”
In the event that the process data watchdog has been trig- field.
gered, substitute value behavior can be set for the Modbus/
• Select the “Add” menu item.
TCP server. The following settings can be made:
• Specify a unique and meaningful name for the process
– “Set inputs to 0” (default setting)
data item in the “Name” field.
Inputs are set to zero.
• Select the desired data type.
• Specify the number of registers.

8294_en_03 PHOENIX CONTACT 20 / 32

 MODBUS/TCP

• Select the desired data direction.

Please note: NOTE:

When linking a process variable of Array [] of
– Data direction “IN”:
(D)WORD data type, the byte order may be re-
Registers are created to which a Modbus/TCP client versed. For further information, please refer to
has both read and write access: Section 9.
These types of registers are represented as input vari-
ables in PC Worx. Example:
– Data direction “OUT”: Figure 24 shows register definitions on the server and client
Registers are created to which a Modbus/TCP client side that are not coordinated.
only has read access:
These types of registers are represented as output vari-
ables in PC Worx.

Controller (Server)

WORD Read
OUT
Input Registers FC04
0000hex ... ffffhex

WORD Read/Write
PLC IN
Holding Registers FC03/FC16/FC06/FC23
Client(s)
0000hex ... ffffhex
runtime
(eCLR) BIT
Discrete Inputs Read
OUT FC02
0000hex ... ffffhex

BIT Read/Write
IN Coils FC01/FC05/FC15
0000hex ... ffffhex

Figure 22 Data direction for internal and external Mod-

bus/TCP server communication (ILC 1X1 as of Figure 24 Register definitions that are not coordinated
FW 4.40)
A WORD array with a length of 5 has been created for the
register on the server side (see Figure 25).
In the PC Worx bus configuration, only the Mod-
bus/TCP server supports Modbus function codes
FC05 and FC06.

Figure 25 Data type of the defined register for the Mod-

bus server in the process data assignment
workspace

A process variable of Array [0 ... 4] of WORD data type must

be created and linked to the Word_Array_Register_Read
process data item (see Section 7.1.10).
Figure 23 Creating process data and defining registers

If one of the controllers listed in the “Ordering data” on

page 4 is used as a Modbus/TCP client and an ILC 1X1 con-
troller with firmware Version ≥ 4.40 is used as the Modbus/
TCP server, the following should be noted:
If the data types of the defined registers on the client and
server side are not coordinated, the byte order is reversed
when reading or writing registers.

8294_en_03 PHOENIX CONTACT 21 / 32

 MODBUS/TCP

A simple, single WORD data type (not an array) has been

created for the register on the client side (see Figure 26).
Please note:
The selected data type of the process variable on
the server side must match the data type on the
client side (WORD array  WORD array or
WORD  WORD).
If not, the byte order is reversed.
Figure 26 Data type of the defined register for the Mod-
Figure 29 shows the byte order in the process variable for
bus client in the process data assignment
the client when the register definitions are coordinated.
workspace
PxC Client Modbus/TCP Frame PxC Server
A process variable of WORD data type must be created and WORD 0 Byte 1 Byte 0 WORD 0 Byte 0 Byte 1 Byte 1 Byte 0 WORD 0
linked to the Read_Register process data item (see WORD 1 Byte 3 Byte 2 WORD 1 Byte 2 Byte 3 Byte 3 Byte 2 WORD 1

Section 7.1.10). Byte 5 Byte 4 WORD 2

Byte 7 Byte 6 WORD 3
If the function code defined for the client is now executed, WORD 4
Byte 9 Byte 8
the first element of the WORD array is read by the server
and copied to the process variable defined for the client in Figure 29 Byte order in the client process variable for co-
the reverse byte order (see Figure 27). ordinated process variable linking when using
the WORD array data type on both sides
PxC Client Modbus/TCP Frame PxC Server

WORD 0 Byte 0 Byte 1 WORD 0 Byte 0 Byte 1 Byte 1 Byte 0 WORD 0

7.1.10 Generating variables and assigning process
Byte 3 Byte 2 WORD 1

Byte 5 Byte 4 WORD 2

data
Byte 7 Byte 6 WORD 3
• Assign the created process data to the corresponding
Byte 9 Byte 8 WORD 4
variables.
Figure 27 Reverse byte order in the client process vari- • If corresponding variables have not been created yet,
able generate them.
For information on assigning process data to variables and
In order to avoid a reversed byte order, a WORD array must generating variables, please refer to Section 5.1.10.
be defined on both the client side and the server side when
using arrays. 7.1.11 Generating diagnostic and control variables
In order to do this in the example, a minimum value of “2” and assigning process data
must be entered under “Number” on the “Modbus Register”
tab on the client side and on the server side, see Figure 28. In the IEC programming workspace, the diagnos-
tic and control structure is declared in the project
tree window under “Data Types, sys_flag_types”.

PC Worx provides the following diagnostic and control

structures for the Modbus server:
– “MBS_SERVER_STATUS” diagnostic structure:

Parameter Description
AcceptCnt Number of existing and cur-
rently established connec-
tions
AcceptErrorCnt Number of errors during con-
nection establishment
Figure 28 Register definitions that are coordinated ReceiveErrorCnt Number of errors when re-
ceiving requests
ModbusRequesCnt Number of requests received
ModbusExceptionCnt Number of exceptions sent
SocketErrorCode Error code of the socket error

8294_en_03 PHOENIX CONTACT 22 / 32

 MODBUS/TCP

Parameter Description • Switch to the IEC programming workspace.

ConnectedClients Number of Modbus clients • Double-click on “Global_Variables” in the project tree
currently connected window.
LastExceptionRegister Register in which the last ex- The global variables of the standard resource are displayed.
ception occurred • Insert a new variable via the context menu which should
LastExceptionRegLength Length of the register in which be used as the diagnostic variable for the
the last exception occurred “SERVER_STATUS” structure.
LastExceptionNode Server instance (node) where • Select the MBS_SERVER_STATUS type for the diag-
the last exception occurred nostic variable.
LastExceptionFunction Function field of the request • Insert another variable via the context menu which
for which the last exception should be used as the diagnostic variable for the
occurred “MBS_NODE_STATUS” structure.
LastExceptionCode Modbus exception code of • Select the MBS_NODE_STATUS type for the diagnos-
the last exception that oc- tic variable.
curred • Insert another new variable via the context menu which
align Used for alignment should be used as the control variable for the
“SERVER_CONTROL” structure.
• Select the MBS_SERVER_CONTROL type for the di-
An ILC 1X1 controller operated as the Modbus/
agnostic variable.
TCP server has one server instance (node). The
server instance has the UnitID 255.
The UnitID can be freely selected in the Modbus/
TCP client request in order to access specific reg-
isters of the Modbus/TCP server.
– “MBS_NODE_STATUS” diagnostic structure:

Parameter Description
ModbusRequestCnt Number of requests received
for this server instance (node)
ModbusExceptionCnt Number of exceptions sent for
this server instance (node)
Flags If the process data watchdog
has been triggered, the flag
for this server instance (node)
is set (bit 0 = 1).
reserved Reserved

– “MBS_SERVER_CONTROL” control structure:

Parameter Description
Flags All parameters of the diagnos-
tic structures are reset with a
rising edge at bit 0.
reserved1 Reserved
reserved2 Reserved
reserved3 Reserved

In order to use the diagnostic and control structures, create

two diagnostic variables and one control variable.

8294_en_03 PHOENIX CONTACT 23 / 32

 MODBUS/TCP

Figure 30 Generating diagnostic and control variables

• Switch to the process data assignment workspace to The result of process data assignment is shown in
assign the process data to the control and diagnostic Figure 31.
variables, as described in Section 5.1.10 on page 9.

Figure 31 Process data assigned to the diagnostic and control variables

7.1.12 Defining the cyclic task for the update time of • Create a cyclic task and specify an appropriate cycle
the Modbus registers time (“Interval” in the “Task Settings” window; recom-
mended setting: > 10 ms).
The Modbus registers are updated with the standard task
For information on creating a task, please refer to the
(STD_TASK) by default. The standard task runs with the
UM QS EN PC WORX quick start guide or the PC Worx
fastest possible cycle, where the cycle time is often 4 ms.
online help.
This results in a high CPU load. In order to reduce the CPU
load, a cyclic task can be defined with a cycle time that is • In the “Bus Structure” window, select the standard re-
greater than the standard task cycle time. Since the Modbus source and in the “Device Details” window select the cy-
registers are updated within a longer cycle time, the load on clic task created previously for “I/O Update by Task”
the CPU is lower and more resources are available for the (see Figure 32).
PC Worx project.

8294_en_03 PHOENIX CONTACT 24 / 32

 MODBUS/TCP

Figure 32 Selecting the cyclic task for “I/O Update by Task”

7.1.13 Compiling a project

• Select the “Build, Make” command.

7.1.14 Sending a project and performing a cold restart

See Section 5.1.14

8294_en_03 PHOENIX CONTACT 25 / 32

 MODBUS/TCP

8 Configuring multi-controller proj- 8.4 Inserting a specific Modbus device

ects – example project In the example, the ILC 191 ME/AN controller is
used as the Modbus/TCP server.
As of firmware Version 4.40, ILC 1X1 controllers
Specific settings are required for communication
can also be configured as Modbus/TCP servers.
between the Modbus/TCP client (here:
This function is available as of
ILC 131 ETH) and server. These settings are
AUTOMATIONWORX Software Suite Version
made in PC Worx via the specific Modbus device
1.82 AddOn V1.
of the controller used as the Modbus/TCP server.
In multi-controller projects, controllers can either be oper- The specific Modbus device of the
ated as Modbus/TCP clients, as Modbus/TCP servers or si- controller used as the Modbus/TCP server must
multaneously as Modbus/TCP clients and Modbus/TCP be inserted in the bus configuration so as to en-
servers. able communication between the Modbus/TCP
The bus configuration of a multi-controller project can be client and server.
mapped in one PC Worx project. • Make sure you are in the bus configuration workspace.
Figure 33 shows a typical client/server structure. • If the device catalog is hidden, show it by selecting the
ILC 131 ETH ILC 191 ME/AN EEM-MA600 “View, Device Catalog” menu.
• Open the “Phoenix Contact, ILC1xx, PLC” device cata-
Modbus/TCP Modbus/TCP
log.
• Select the specific Modbus device for the ILC 191 ME/
AN controller (“ILC 191 ME/AN (Modbus Device)”).
Client Server/Client Server

Figure 33 Typical client/server structure

In the example, the controller on the left

is operated as a Modbus/TCP client. The controller in the
middle is simultaneously operated as a Modbus/TCP server
(in relation to the controller on the left) and as a Modbus/
TCP client (in relation to the energy meter on the right).
The step-by-step procedure for creating the example as a
PC Worx project is described below.
The procedure for creating a multi-controller project is gen-
erally identical to the procedures described in Sections 5.1 Figure 34 Selecting the specific Modbus device “ILC 191
and 7.1. ME/AN (Modbus Device)”
Only the differences between the procedures are described
in more detail in this section. • Hold down the left mouse button and move the specific
Where the procedures are identical, reference is made to Modbus device “ILC 191 ME/AN (Modbus Device)” to
the relevant section. the “Bus Structure” window to the right of the MODBUS
icon until the “Insert in the lower level” icon appears.
8.1 Creating a new project
• Create a new project and select the ILC 131 ETH as the
controller, see Section 5.1.1.

8.2 Specifying project information

See Section 5.1.2

8.3 Checking/modifying IP settings for the control-

ler
See Section 5.1.3

8294_en_03 PHOENIX CONTACT 26 / 32

 MODBUS/TCP

Figure 35 shows the bus configuration with the inserted spe-

cific Modbus device.

Figure 35 Specific Modbus device “ILC 191 ME/AN

(Modbus Device)” inserted
Figure 36 Inserted ILC 191 ME/AN controller
8.5 Modifying the settings for the specific Modbus
device 8.7 Checking/modifying IP settings for the control-
ler
Following insertion in the bus configuration, default values
are set for each “Generic Modbus Device”. The settings can See Section 5.1.3
be modified via the “Modbus-Settings” tab.
8.8 Inserting the Modbus/TCP server
The settings for the specific Modbus device are In the example, the ILC 191 ME/AN controller should act as
required for communication between the Mod- the Modbus/TCP server in relation to the ILC 131 ETH.
bus/TCP client (here: ILC 131 ETH) and the Mod- You must therefore insert the controller as the generic Mod-
bus/TCP server (here: ILC 191 ME/AN). bus/TCP server, see Section 7.1.4.
• Make sure you are in the bus configuration workspace. Figure 37 shows the bus configuration with the inserted ge-
• Select the specific Modbus device “ILC 191 ME/AN neric Modbus/TCP server.
(Modbus Device)” in the “Bus Structure” window.
• Select the “Modbus-Settings” tab in the “Device Details”
window.
• Modify the Modbus settings according to your require-
ments.
For information on the Modbus settings, please refer to Sec-
tion 5.1.5.

8.6 Inserting the ILC 191 ME/AN controller

Once you have inserted the specific Modbus device “ILC
191 ME/AN (Modbus Device)”, you must insert the
ILC 191 ME/AN controller.
• Make sure you are in the bus configuration workspace.
• If the device catalog is hidden, show it by selecting the
“View, Device Catalog” menu. Figure 37 “Modbus Server” inserted
• Open the “Phoenix Contact, ILC1xx, PLC” device cata-
log.
• Select the “ILC 191 ME/AN Rev. >= 00/4.40” controller. Only one controller can be inserted as the gener-
• Hold down the left mouse button and move the “ILC 191 ic “Modbus Server”.
ME/AN Rev. >= 00/4.40” controller to the “Bus Struc- The IP settings for the inserted
ture” window. Modbus/TCP server match the IP settings that
were previously made for the controller.
Figure 36 shows the bus configuration with the inserted
ILC 191 ME/AN controller.

8294_en_03 PHOENIX CONTACT 27 / 32

 MODBUS/TCP

8.9 Modifying the settings for the Modbus/TCP 8.14 Compiling after creating the program
server
• Select the “Build, Make” command.
See Section 7.1.5
8.15 Creating process data and assigning Modbus
8.10 Inserting a “Generic Modbus Device” function codes

In the example, the ILC 191 ME/AN controller • Create the necessary process data for the specific
should simultaneously be operated as a Modbus/ Modbus device of the ILC 191 ME/AN controller and for
TCP server (in relation to the ILC 131 ETH con- the “Generic Modbus Device” and assign it to the corre-
troller) and sponding Modbus function codes.
as a Modbus/TCP client (in relation to the Proceed as described in Section 5.1.9.
EEM-MA400 energy meter) (see Figure 33).
8.16 Generating variables and assigning process
Specific settings are required for communication data
between the ILC 191 ME/AN controller and the
EEM-MA400 energy meter. • Generate variables for the specific Modbus device of
These settings are made in PC Worx via the “Ge- the ILC 191 ME/AN controller and for the “Generic
neric Modbus Device”. Modbus Device” and assign the corresponding process
data to the variables.
• To insert the “Generic Modbus Device”, proceed as de- Proceed as described in Section 5.1.10.
scribed in Section 5.1.4.
Figure 38 shows the bus configuration with the inserted 8.17 Generating diagnostic and control variables
“Generic Modbus Device”. and assigning process data
• Generate diagnostic and control variables for the spe-
cific Modbus device of the ILC 191 ME/AN controller
and for the “Generic Modbus Device” and assign the
corresponding process data to the variables.
Proceed as described in Section 5.1.11.

8.18 Creating process data and defining registers

• Create process data for the ILC 191 ME/AN controller
and define the required registers.
Proceed as described in Section 7.1.9.

8.19 Generating variables and assigning process

data
• Generate variables for the ILC 191 ME/AN controller
and assign the corresponding process data to the vari-
Figure 38 “Generic Modbus Device” inserted ables.
Proceed as described in Section 7.1.10.
8.11 Modifying the settings for the “Generic Modbus
Device” 8.20 Generating diagnostic and control variables
and assigning process data
See Section 5.1.5
• Generate diagnostic and control variables for the
The bus topology for the example project is now complete. ILC 191 ME/AN controller and assign the correspond-
ing process data to the variables.
8.12 Compiling after completing the bus topology
Proceed as described in Section 7.1.11.
• Select the “Build, Make” command.
8.21 Defining the cyclic task for the update time of
8.13 Creating the program the Modbus registers
• Create the program. • Create a cyclic task for the ILC 191 ME/AN controller.
To program the example program, proceed as described in Proceed as described in Section 7.1.12.
the UM QS EN PC WORX quick start guide.

8294_en_03 PHOENIX CONTACT 28 / 32

 MODBUS/TCP

8.22 Compiling a project 9 Special considerations when read-

• Select the “Build, Make” command. ing and writing WORD arrays
8.23 Configuring the Modbus/TCP server If you use one of the controllers listed in the “Ordering data”
on page 4 as the Modbus/TCP client and a device from an-
• Perform all of the required configurations (e.g., setting other manufacturer as the Modbus/TCP server (or an
the IP address and process data watchdog) directly on ILC 1X1 controller as the Modbus/TCP server and a device
the Modbus/TCP server (here: EEM-MA600 energy from another manufacturer as the Modbus/TCP client), the
meter). byte order for reading/writing is reversed if WORD arrays
For information on how to configure and start up the device, are used (“Swap Bytes” setting equals “no”, see
please refer to the corresponding documentation. Section 5.1.5).

8.24 Sending a project and performing a cold restart 9.1 General examples
See Section 5.1.14 The examples below show how the transmitted data of the
Modbus/TCP frame is mapped in the process variables of
the PC Worx project.

Example 1
Process variable of WORD data type, “Swap Bytes” setting
equals “no”.

PxC Client/Server Modbus/TCP Frame

WORD 0 Byte 1 Byte 0 Byte 1 Byte 0 WORD 0

Figure 39 Process variable of WORD data type

Example 2
Process variable of Array [0 ... 1] of WORD data type,
“Swap Bytes” setting equals “no”.

PxC Client/Server Modbus/TCP Frame

WORD 0 Byte 0 Byte 1 Byte 1 Byte 0 WORD 0

WORD 1 Byte 2 Byte 3 Byte 3 Byte 2 WORD 1

Figure 40 Process variable of Array [0 ... 1] of WORD

data type

Example 3
Process variable of WORD data type, “Swap Bytes” setting
equals “yes”.

PxC Client/Server Modbus/TCP Frame

WORD 0 Byte 0 Byte 1 Byte 1 Byte 0 WORD 0

Figure 41 Process variable of WORD data type

8294_en_03 PHOENIX CONTACT 29 / 32

 MODBUS/TCP

Example 4 Modbus/TCP client and one of the controllers listed in the

“Ordering data” on page 4 is used as the Modbus/TCP
Process variable of Array [0 ... 1] of WORD data type,
server.
“Swap Bytes” setting equals “yes”.

PxC Client/Server Modbus/TCP Frame 9.2.1 Example 1:

Read access for the Modbus/TCP client
WORD 0 Byte 1 Byte 0 Byte 1 Byte 0 WORD 0
WORD 1 Byte 3 Byte 2 Byte 3 Byte 2 WORD 1 The Modbus/TCP client should read up to four words of the
Modbus/TCP server, starting with the address 0.
The read data is linked to various data types in PC Worx.
Figure 42 Process variable of Array [0 ... 1] of WORD
data type Configuration in PC Worx

Example 5 Figure 45 shows the configuration and Modbus function

codes used in PC Worx.
Process variable of DWORD data type, “Swap Bytes” set-
ting equals “no”.

PxC Client/Server Modbus/TCP Frame

Byte 1 Byte 0 WORD 0

DWORD 0 Byte 1 Byte 0 Byte 3 Byte 2
Byte 3 Byte 2 WORD 1

Figure 45 Configuration and Modbus function codes

Figure 43 Process variable of DWORD data type used for the Modbus registers

Example 6 Figure 46 shows the declaration of the corresponding re-

Process variable of Array [0 ... 1] of DWORD data type, quired process variables.
“Swap Bytes” setting equals “no”.

PxC Client/Server Modbus/TCP Frame

DWORD 0 Byte 2 Byte 3 Byte 0 Byte 1 Byte 1 Byte 0 WORD 0

DWORD 1 Byte 6 Byte 7 Byte 4 Byte 5 Byte 3 Byte 2 WORD 1

Byte 5 Byte 4 WORD 2

Byte 7 Byte 6 WORD 3
Figure 46 Declaration of the required process variables

Figure 47 shows how the “MB_Word” and “MB_2DWord”

Figure 44 Process variable of Array [0 ... 1] of DWORD
data types must be defined.
data type

9.2 Concrete examples for the general examples in

Section 9.1
The following concrete examples from PC Worx show the
linking of the data of a Modbus/TCP telegram (Modbus/TCP Figure 47 Definition of the “MB_2Word” and
frame) to the possible process variables and their data types “MB_2DWord” data types
in PC Worx.
In the examples, one of the controllers listed in the “Ordering Figure 48 shows the linking of the process variables to the
data” on page 4 is used as the Modbus/TCP client and a de- Modbus registers in the process data assignment work-
vice from another manufacturer is used as the Modbus/TCP space.
server. It is always the Modbus/TCP telegram that is taken
into consideration and not the Modbus/TCP server, as the
byte order can differ from Modbus/TCP server to
Modbus/TCP server.
The byte order shown in the examples when linking the data
of a Modbus/TCP telegram to the possible process vari- Figure 48 Linking of the process variables to the Modbus
ables and their data types in PC Worx also applies when a registers
device from another manufacturer is used as the

8294_en_03 PHOENIX CONTACT 30 / 32

 MODBUS/TCP

Online values during operation 9.2.2 Example 2:

Write access for the Modbus/TCP client
Figure 49 shows the online values during operation. The
Modbus/TCP telegram for the last configured Modbus reg- The Modbus/TCP client writes to the
ister (Array [0 ... 3] of WORD, see Figure 45) is shown. The Modbus/TCP server. Up to four words should be written in
byte order for the three other Modbus registers in the exam- the Modbus/TCP telegram.
ple is identical to the byte order in Figure 49.
Configuration in PC Worx
① Figure 50 shows the Modbus registers and the Modbus
function codes used in PC Worx.

Figure 50 Configuration and Modbus function codes

used

Figure 51 shows the declaration of the corresponding re-

quired process variables.

Figure 51 Declaration of the required process variables

Figure 52 shows how the “MB_Word” and “MB_2DWord”

data types must be defined.

③
Figure 52 Definition of the “MB_2Word” and
“MB_2DWord” data types

Figure 53 shows the linking of the process variables to the

Modbus registers in the process data assignment work-
space.

Figure 49 Online values during operation

Key:
1. Modbus/TCP telegram in the Wireshark software (soft- Figure 53 Linking of the process variables to the Modbus
ware for analyzing data traffic in the network) function codes
2. Linked process variables in the Watch window in
PC Worx when the “Swap Bytes” setting equals “no”
3. Linked process variables in the Watch window in
PC Worx when the “Swap Bytes” setting equals “yes”

8294_en_03 PHOENIX CONTACT 31 / 32

 MODBUS/TCP

Online values during operation Figure 55 shows the online values during operation when
the “Swap Bytes” setting equals “yes”.
Figure 54 shows the online values during operation when
the “Swap Bytes” setting equals “no”.

①
①

②
②

Figure 55 Online values during operation, “Swap Bytes”

setting equals “yes”
Figure 54 Online values during operation, “Swap Bytes”
setting equals “no”
Key:
Key: 1. Fixed values that are written to the various process vari-
ables in PC Worx.
1. Fixed values that are written to the various process vari-
ables in PC Worx. 2. Fixed values from PC Worx, how they are written in the
Modbus/TCP telegram, shown in the Wireshark soft-
2. Fixed values from PC Worx, how they are written in the
ware.
Modbus/TCP telegram, shown in the Wireshark soft-
ware.

8294_en_03 PHOENIX CONTACT GmbH & Co. KG • Flachsmarktstraße 8 • 32825 Blomberg • Germany 32 / 32
phoenixcontact.com