Modbus/Tcp; Webrelay Function Code Summary; Plc Device Addressing - ControlByWeb WebRelay X-WR-1R12-1I5-5 User Manual

WebRelay Users Manual

5.3 Modbus/TCP

The WebRelay can be controlled and monitored using Modbus/TCP protocol. This provides a standard
means of using the WebRelay with devices and software from other manufacturers. This section is not a
tutorial on Modbus and it is assumed that the reader is already familiar with Modbus. Detailed Modbus
information can be found at http://www.modbus.org.
Note: Modbus communications are disabled whenever the Control Password is enabled. This is
because Modbus/TCP does not provide a mechanism for password protection. Make sure the Control
Password is disabled (default) and Modbus functionality is enabled on the Advanced Network. The
automatic reboot functions are not available through Modbus.
The WebRelay functions as a Modbus slave. Host devices, such as PLCs, open a connection with the X-
WebRelay on port 502 (configurable under Advanced Network tab) and then send requests to read the
state of the relay, read the input, or change the relay. When the WebRelay receives a command, it will
perform the desired function and return a response.
The following sections provide an overview and explanation of Modbus operation.

5.3.1 WebRelay Function Code Summary

The WebRelay supports the following function codes:
Code Name
Read Coils
Read Discrete Inputs
Write Single Coil
Write Multiple Registers 16
Multiple commands may be sent without closing and re-opening the connection, but if no data is
transferred for 50 seconds, the connection will time out and close. To keep the connection open, a read
request can be sent periodically.
The WebRelay has two TCP sockets available for Modbus/TCP. This allows two connections to be open
at one time. Requests for more than two open connections will be rejected.
When errors occur, an error code is returned. Most Modbus client software will interpret this code in a
human readable form. The code is comprised of the original function code plus 0x80. For example, an
error during the read coils function 0x01 would return 0x81. Each error has a qualifying exception
number. The following are the possible exception codes and their meanings:
0x01 - Function code not supported (also when Modbus is disabled in the setup pages).
0x02 - Incorrect starting address/quantity of output combination.

5.3.2 PLC Device Addressing

There are generally two schemes for accessing Modbus devices, The first is by specifying the Modbus
function code, memory type, and address. The second, sometimes called PLC addressing, requires only
the address.
Modbus protocol uses four different address ranges for discrete inputs, coils, input registers, and holding
registers. The function code determines the address range of the message. The following are common
function codes and their respective address ranges.
Xytronix Research & Design, Inc.
Modbus WebRelay Feature
Function
01 Relay state
02 Input status
05 Change relay state
Pulse the relay
WebRelay Start Address
Hexadecimal Decimal
0x0000 0
0x0000 0
0x0000 0
0x0000 0
Page 63