Which Modbus function codes does the zenon Process Gateway answer?
With the Modbus Slave driver, the zenon 7.0 Process Gateway serves two function codes: 03 Read Multiple Registers and 16 Write Multiple Registers. The configuration offers only a holding register offset because the gateway has no input register, discrete input, or coil table. A master that needs process values from zenon must read them as holding registers.
| Function code | Modbus name | Data table / width | Process Gateway (Modbus Slave) |
|---|---|---|---|
01 |
Read Coils | 0xxxx, 1 bit | Not served |
02 |
Read Discrete Inputs | 1xxxx, 1 bit | Not served |
03 |
Read Holding Registers | 4xxxx, 16 bit | Served |
04 |
Read Input Registers | 3xxxx, 16 bit | Not served |
05 / 15
|
Write Single / Multiple Coils | 0xxxx, 1 bit | Not served |
06 |
Write Single Register | 4xxxx, 16 bit | Not served |
16 |
Write Multiple Registers | 4xxxx, 16 bit | Served |
Two different requirements hide behind "read input register (function 02h)". Function 02h reads discrete inputs, which are single bits. Input registers are 16-bit words read with . The gateway serves neither code, but the remap differs. Input registers move one-to-one into holding registers. Discrete inputs must be packed into register bits. Decide which one the master actually polls before you change anything.
Where does an FC02 or FC04 request stop on its way to zenon?
The master (a DCS, PLC, or second SCADA) builds a PDU. The PDU crosses the physical link to the zenon runtime host and reaches the Process Gateway Modbus Slave module. That module dispatches on function code and then reads the mapped zenon variables. An unsupported code stops at the dispatch step. The link and addressing are already working at that point.
| Hop | What to check | Symptom when this hop fails |
|---|---|---|
| Physical link (Ethernet or serial) | Link LEDs, cabling, IP/subnet or baud/parity | Timeout, no reply at all |
| Transport / port | Gateway listening port, firewall on the runtime host | Connection refused or timeout |
| Slave/unit ID | Unit ID configured in master vs gateway | No reply or ignored frames |
| Function code dispatch | Code in the request vs 03/16
|
Exception reply, Illegal Function |
| Register range | Start address + quantity vs mapped block | Exception reply, Illegal Data Address |
A compliant Modbus slave answers an unsupported code with the function code's high bit set, so for FC02 or for FC04, followed by exception code (Illegal Function). Depending on the master, this appears as "illegal function", a generic communication error, or bad-quality tags. A packet capture on the master's interface separates the cases. If the capture shows no reply, work the physical and transport hops. If it shows an exception frame, the path is healthy and only the function code is wrong.
Should you reconfigure the master or translate the request in between?
| Criterion | A: Master polls FC03 / writes FC16 | B: Intermediate translator | C: Newer zenon release |
|---|---|---|---|
| Extra hardware | None | PLC or protocol converter | None |
| Added hops / latency | None | One extra poll cycle | None |
| Failure points | Unchanged | One more device and config | Upgrade risk |
| When it fits | Master's function code is configurable per point | Master is locked to FC02/FC04 | Help for the installed version lists more codes |
Option B works by acting as a slave toward the master on FC02/FC04 and as a master toward zenon on FC03. Choose it only when the master's function code is fixed. For option C, check the Process Gateway section of the online help for the version you plan to run. The FC03/FC16 limit comes from the zenon 7.0 documentation.
Use option A. Nearly every Modbus master can poll holding registers, and this path adds nothing between the master and zenon.
How do you remap input data into the holding register block?
- List every point the master currently expects from FC04 or FC02, with its data type, scaling, and whether it is read-only.
- In the Process Gateway Modbus Slave configuration, set the holding register offset. Assign the zenon variables to consecutive registers.
- Keep read-only process values in one contiguous block. Put master-written setpoints in a separate block so a stray FC16 cannot overwrite measurements.
- For former discrete inputs, create a 16-bit integer variable in the zenon project whose bits carry up to 16 states. Map that variable to one holding register, and have the master extract the bits with a mask.
- For 32-bit integers or floats, reserve two consecutive registers. Set the master's word order to match what zenon transmits.
- On the master, change each point's function code to
03. Recompute the addresses: reference 40001 is PDU address 0, so subtract one when the master takes raw addresses. - Split polls so no single FC03 request asks for more than 125 registers, the Modbus protocol limit.
- Configure master writes as Write Multiple Registers (
16), even for a single register. Many masters default to06for single writes.
What breaks after moving to holding registers?
| Symptom at master | Cause | Correction |
|---|---|---|
| Every value shifted by one position | 1-based reference vs 0-based PDU address mismatch against the configured offset | Align the master's addressing mode with the gateway offset |
| Reads work, single writes return exception | Master uses FC06 | Force FC16 for all register writes |
| Floats read as huge or tiny numbers | Word order swapped | Change word swap on the master side |
| Illegal Data Address on a block read | Request extends past the mapped range | Trim the quantity or extend the mapping |
| Illegal Data Value on a large poll | Quantity above 125 registers | Split into smaller requests |
| Measured values overwritten | Data that was read-only under FC04 is now writable through FC16 | Mark those points read-only in the master; keep separate blocks |
| Wrong boolean states | Bit numbering (LSB vs MSB first) differs | Test with a single set bit and adjust the mask |
How do you confirm the master reads the right values?
- Confirm the link: the master connects to the gateway and receives replies without timeouts.
- Capture traffic and check that requests carry function code
03. Normal responses echo with a byte count of twice the requested quantity, and no exception frames appear. - Set a known integer in zenon, such as 1234, and read the same value at the mapped register on the master.
- Set exactly one bit in the packed status word and confirm the master decodes the matching boolean.
- Write a known float such as 1.0 and confirm the master shows 1.0, not a swapped-word value.
- Write a setpoint from the master with FC16, confirm zenon receives it, and confirm the read-only block did not change.
- Run the master through several poll cycles and confirm its communication error counters stay flat and all remapped tags report good quality.
FAQ
What happens if a Modbus master sends FC04 to the zenon Process Gateway?
The Modbus Slave driver serves only FC03 and FC16, so the request is rejected. A compliant slave returns function code with exception (Illegal Function). Repoint the master to FC03 on the holding register block.
What happens if the master writes one register with FC06?
FC06 is not served, so the write fails with an exception. Configure the master to use FC16 Write Multiple Registers with a quantity of 1.
What happens if one FC03 poll requests more than 125 registers?
The Modbus protocol caps FC03 at 125 registers per request, so the slave rejects oversized requests with exception (Illegal Data Value). Split the poll into blocks of 125 registers or fewer.
What happens if the holding register offset is off by one?
Every value lands one register away from where the master expects it, so a float can read as garbage and a status word can show the neighbouring value. Check whether the master uses 1-based references (40001) or 0-based PDU addresses, and align it with the gateway offset.
Can the zenon Process Gateway serve discrete inputs over FC02?
Not with the Modbus Slave driver in zenon 7.0. Pack up to 16 booleans into a 16-bit integer variable, map it to a holding register, read it with FC03, and mask the bits on the master.