Modbus TCP Explicit Message Example: Read Holding Registers
(Original Document)
About us
Overview
The following example shows you how to use the SEND_REQ function block to configure a Modbus Read Holding Registers explicit message that will read five (5) registers from a remote device at IP address 192.168.1.6, starting at register address 10 in the remote device.
NOTE: This request is simpler in its configuration than, for example, the generic Modbus read registers request. The ReqCode setting specifies the function, so no additional Modbus function code is required.
Implementing the SEND_REQ Function Block
To implement the SEND_REQ function block, you need to create and assign variables for the following blocks:
Configuring the Address Variable
The Address variable identifies the explicit message originating device—-in this example, the TSX ETC 101 communication module—and the target device. Note that the Address variable does not include the Xway address elements {Network.Station} because we are not bridging through another PLC station. Use the ADDR function to convert the following character string to an address:
ADDR(‘0.3.0’), where:
Configuring the ReqCode Variable
The ReqCode variable identifies the function type for the SEND_REQ function block—in this case, a Read Holding Registers Modbus request:
Variable
Description
Value (hex)
ReqCode
Read Holding Registers Modbus request
16#0051
Configuring the ManagParam Variable
The ManagParam[3] setting defines the length of the DataToSend variable for the SEND_REQ function block. In this example, 8 bytes of data will be sent:
Variable
Description
Value (hex)
ManagParam[3]
Length of the DataToSend variable
16#0008
Configuring the DataToSend Variable
The DataToSend variable identifies the generic Modbus request:
Variable
Description
Value (hex)
DataToSend[0]
First two octets of the target device IP address (192.168.1.6):
  • High byte = byte 4: 16#C0 (192 decimal))
  • Low byte = byte 3: 16#A8 (168 decimal)
16#C0A8
DataToSend[1]
Last two octets of the target device IP address (192.168.1.6):
  • High byte = byte 2: 16#01 (1 decimal)
  • Low byte = byte 1: 16#06 (6 decimal)
16#0106
DataToSend[2]
  • High byte = the most significant byte (MSB) of the starting read address: 16#00 (0 decimal)
  • Low byte = the least significant byte (LSB) of the starting read address: 16#0A (10 decimal)
16#000A
DataToSend[3]
  • High byte = the most significant bye (MSB) of the Quantity of registers to read: 16#00 for this type of request
  • Low byte =the least significant bye (LSB) of the Quantity of registers to read: 16#05 (5 decimal)
16#0005