How to acquire data via Modbus TCP/IP

Configure a controller to read data via Modbus TCP/IP

Configuration with GI.bench

  1. Read controller into project window (Configuration > Read) or open existing project (Configuration > Open)
  2. Double-click the controller to open the controller settings
    1. In the network section, change the Client count to 1.
    2. Set Type to ModbusTCPIP class 0 master. Enter the IP address and port number of the Modbus slave device. Click OK when complete.

Configuration with test.commander

    In test.commander the data port protocol (default Port = 10000) of the controller has to be set to Modbus TCP/IP class 0 or Modbus (WORD swapped) TCP/IP class 0.

    Command Description

    A Modbus TCP/IP class 0 server has been implemented. This means that the following commands are supported:

    • Read multiple registers (Read holding registers FC=0x03 / Read input registers FC=0x04)
    • Write multiple registers (FC=0x10)
    • Write single register (FC=0x06)

    Also, the following definitions have to be considered:

    • Protocol Identifier (must be 0x00)
    • Unit Identifier (must be 0x01)
    • Modbus Register Offset (dec 999 → \x03\xE7)

    The ModbusRegisterOffset and the ModbusRegisterCount for each variable in the controller can be shown in test.commander.

    The register information can also be found for each test.commander project in the *.CSV file, which is located beside the project files in the project directory.

    Frame Description

    Request, master (client) → slave (server), function 03 (Hex)

    Transaction Identifier Protocol Identifier No. Data Bytes Unit Ident. Func. Data
                    Register Offset Register Count
    0x00 0x00 0x00 0x00 0x00 0x06 0x01 0x03 HB LB HB LB

    Response, slave (server) → master (client)

    Transaction Identifier Protocol Identifier Number Databytes Unit Ident. Func. Data
                    No.  Data bytes Info
    0x00 0x00 0x00 0x00 0x00 n+3 0x01 0x03 n  
    • The response can contain max. 255 data bytes (number of bytes max. 0xFF - 1-byte information) which means, the register count in the request is max. 0x7F (each register contains 2 data bytes)
    • Take care that the device ID (unit identifier) of the Modbus client is set to 1


    Read Timestamp:


    00 00 00 00 00 06 01 03 03 E7 00 04

    Register count = 4 → 8 data bytes


    00 00 00 00 00 0B 01 03 08 40 E1 D5 C0 0E EF A9 26

    8 data bytes: 40 E1 D5 C0 0E EF A9 26


    To test the Modbus TCP/IP communication, the following tools can be used:

    For example - reading the timestamp in ModScan: