Industrial Fieldbus Modbus-IDA / IEC 61158
Modbus TCP & Modbus RTU Industrial PLC Protocol
Modbus TCP/RTU allows Programmable Logic Controllers (PLCs) and Supervisory Control and Data Acquisition (SCADA) systems to trigger RFID readers when photocells detect cartons, read tag counts from holding registers, and actuate pneumatic diverters.
Layer / Stack
Fieldbus / Industrial Ethernet (TCP 502 / RS485)
Default Port / Freq
TCP Port 502 (TCP) | 9600-115200 Baud (RTU)
Throughput / Speed
Deterministic 5ms cycle time on industrial Ethernet networks
Standard Body
Modbus-IDA
Core Protocol Architecture & Specifications
- ✓ Holding Registers (40001+) for tag counts, reader status codes, and transmit power (dBm)
- ✓ Coil Outputs (00001+) for triggering stack light red/green/amber LEDs, buzzers, and pneumatic diverters
- ✓ Discrete Inputs (10001+) for photocell photo-eye triggers, limit switches, and safety light curtains
- ✓ Direct integration with Siemens S7-1200/1500, Allen-Bradley ControlLogix, and Omron PLCs
- ✓ Galvanically isolated 24V DC industrial GPIO wiring compatibility
Modbus TCP PLC Register Map for Industrial RFID Gate
csharp // Modbus TCP Industrial Register Layout (Port 502)
public enum ModbusRfidMap : ushort
{
// Coils (Read/Write 0x)
TriggerReadStart = 0x0001, // PLC sets 1 to begin RF interrogation
GreenStackLight = 0x0002, // Set 1 on successful ERP match
RedStackLightBuzzer = 0x0003, // Set 1 on barcode mismatch / ghost tag
PneumaticDiverter = 0x0004, // Set 1 to push bad carton to reject lane
// Discrete Inputs (Read-Only 1x)
PhotoEyeSensorEntry = 0x0001, // High when carton cuts entry laser beam
PhotoEyeSensorExit = 0x0002, // High when carton clears gate
// Input Registers (Read-Only 3x)
LastReadTagCount = 30001, // Total tags decoded during last trigger cycle
ReaderTemperatureC = 30002, // Ambient board temperature
// Holding Registers (Read/Write 4x)
RfTransmitPowerDbm = 40001, // Transmit power (100 to 300 = 10.0 to 30.0 dBm)
FilterDwellTimeMs = 40002 // Minimum required tag RSSI persistence (ms)
}Verified Hardware Implementations
Our engineering team has thoroughly tested and validated Modbus TCP / RTU across the following reader models, embedded modules, and smart transponders:
Zebra FX9600 Industrial GPIO Advantech ADAM I/O Modules Siemens SIMATIC RF Readers Phoenix Contact Modbus Gateways
Target Deployments
- Conveyor carton divert routing
- Automated packaging verification
- Manufacturing pallet assembly line tracking
- Robotic cell access interlocks
Deploy with OpenRFID
Integrate Modbus TCP / RTU into your ERP, warehouse software, or custom mobile app with pre-built C# / C++ drivers.
Frequently Asked Questions (Modbus TCP / RTU)
Engineering insights on Modbus-IDA / IEC 61158 implementation challenges
Why connect RFID readers via Modbus rather than standard REST APIs in factories?
PLCs operate on deterministic microsecond scan cycles (5–10ms). REST APIs introduce non-deterministic TCP socket latency. Modbus gives the PLC direct hardware control to stop the conveyor immediately if a tag is missing.
How are 96-bit and 128-bit RFID EPC hexadecimal strings mapped into standard 16-bit Modbus Holding Registers?
A 96-bit EPC (12 bytes) is partitioned across 6 contiguous 16-bit Modbus Holding Registers (Registers 40001 through 40006) using Big-Endian word swapping, allowing Siemens S7, Rockwell ControlLogix, and Schneider PLCs to read tag values via standard function code 03 (Read Holding Registers).
What is the typical polling cycle latency when connecting multiple RFID stations over RS485 Modbus RTU?
At 115,200 baud, polling an individual reader station takes 15 to 25ms. For time-critical high-speed sorting conveyors (>2 meters/sec), Modbus TCP over Gigabit Ethernet is strongly recommended over RS485 RTU to ensure sub-5ms tag capture handshakes.
Can the PLC trigger RFID reader inventory scans directly through Modbus register writes?
Yes. Writing a control bit (e.g., bit 0 of register 40000) from the PLC triggers the reader's inventory sequence, while reader status bits (Tag Detected, Read Error, RF Active) are mapped to discrete Modbus inputs.