Modbus TCP Explicit Message Example: Read Registers
(Original Document)
About us
Overview
The following example shows you how to use the SEND_REQ function block to send a generic explicit message that will read five (5) registers from a remote device at IP address 192.168.1.6, beginning at register address 10 in the remote device.
Implementing the SEND_REQ Function Block
To implement the SEND_REQ function block, you need to create and assign variables for the following blocks:
Configuring the Address Variable
The Address variable identifies the explicit message originating device—-in this example, the TSX ETC 101 communication module—and the target device. Note that the Address variable does not include the Xway address elements {Network.Station} because we are not bridging through another PLC station. Use the ADDR function to convert the following character string to an address:
ADDR(‘0.3.0’), where:
Configuring the ReqCode Variable
The ReqCode variable identifies the function type for the SEND_REQ function block—in this case, a generic Modbus request:
Variable
Description
Value (hex)
ReqCode
Code identifies a generic Modbus request
16#0050
Configuring the ManagParam Variable
The ManagParam[3] setting defines the length of the DataToSend variable for the SEND_REQ function block. In this example, 9 bytes of data will be sent:
Variable
Description
Value (hex)
ManagParam[3]
Length of the DataToSend variable
16#0009
Configuring the DataToSend Variable
The DataToSend variable identifies the generic Modbus request:
Variable
Description
Value (hex)
DataToSend[0]
First two octets of the target device IP address (192.168.1.6):
  • High byte = byte 4: 16#C0 (192 decimal))
  • Low byte = byte 3: 16#A8 (168 decimal)
16#C0A8
DataToSend[1]
Last two octets of the target device IP address (192.168.1.6):
  • High byte = byte 2: 16#01 (1 decimal)
  • Low byte = byte 1: 16#06 (6 decimal)
16#0106
DataToSend[2]
  • High byte = Modbus function code: 16#03 (3 decimal)
  • Low byte = the most significant byte (MSB) of the starting read address: 16#00 (0 decimal)
16#0300
DataToSend[3]
  • High byte = the least significant byte (LSB) of the starting read address: 16#0A (10 decimal)
  • Low byte = Quantity of registers to read (MSB): 16#00 (0 decimal)
16#0A00
DataToSend[4]
  • High byte = unused (padding)1: 16#00 (0 decimal)
  • Low byte =Quantity of registers to read (LSB): 16#05 (5 decimal)
16#0005
1. When the generic Modbus request contains an odd number of bytes, the last byte of the request is swapped.