Definition of the MbusCmd Parameter

The parameter MbusCmd represents the Modbus command.

The parameter MbusCmd is comprised of an array of 4 registers as presented below:

Contents

Description

Description

MbusCmd[1]

Slave address

This word contains the address of the Modbus slave PLC.

The range of allowed addresses is from 0 to 248.

The address 0 is reserved for sending a Modbus message to several PLCs. This type of transmission is called broadcast mode.

The broadcast mode supports only Modbus function codes writing master PLC data to slave PLCs. It does not support Modbus function codes reading data of slave PLCs.

Address 248 is reserved for point-to-point communication when the slave address is not known. This address is not supported by all devices.

MbusCmd[2]

Modbus function code

The block OUT_IN_MBUS supports the following function codes:

  • 01 = reading of several output bits (0x)

  • 02 = reading of several input bits (1x)

  • 03 = reading of several output registers (4x)

  • 04 = reading of several input registers (3x)

  • 05 = writing of a single output bit (0x)

  • 06 = writing of a single output register (4x)

  • 15 = writing of several output bits (0x)

  • 16 = writing of several output registers (4x)

Note: When the slave PLC is of Premium type, all bits become %Ms and the registers become %MWs.

MbusCmd[3]

Data area of the slave PLC

For a read command, the data area of the slave PLC is the source of data. For a write command, the data area of the slave PLC is the destination of data.

For example:

  • To read the output bits 300 to 500 of a slave PLC, enter 300 in this field.

  • To write the data of a master PLC in register 100 of type 4x of a slave PLC, enter 100 in this field.

According to the type of Modbus command (read or write), the source and target data areas must match those in the array below.

MbusCmd[4]

Quantity

This register contains the quantity of data to write or to read in the slave PLC.

For example, enter 100 to read 100 output registers in the slave PLC or enter 32 to write 32 output bits in the slave PLC.

There is a size limit, that depends on the Modbus function code used and the transmission mode (RTU or ASCII). These MbusCmd[4] limit values are detailed in the array below. This size is not significant for function codes 5 and 6.

Note: The memory area is limited depending on the device and the slave parameters.

MbusCmd[3]

The array below presents the slave PLC data area for MbusCmd[3]. This data area depends on the Modbus function code used and the type of slave PLC:

Function Code

Data Area for Standard Modbus Devices

Data Area of a Premium PLC

01 (reading of several output bits (0x))

0x (source)

%M (source)

02 (reading of several input bits (1x))

1x (source)

%M (source)

03 (reading of several output registers (4x))

4x (source)

%MW (source)

04 (reading of several input registers (3x)

3x (source)

%MW (source)

05 (writing of a single output bit (0x))

0x (destination)

%M (destination)

06 (writing of a single output register (4x))

4x (destination)

%MW (destination)

15 (writing of several output bits (0x))

0x (destination)

%M (destination)

16 (writing of several output registers (4x)).

4x (destination)

%MW (destination)

MbusCmd[4]

The array below presents the limit value of MbusCmd[4]. This value depends on the Modbus function code used and the transmission mode:

Function Code

RTU Mode (8 Bits)

ASCII Mode (7 Bits)

01 (reading of several output bits (0x))

1000

500

02 (reading of several input bits (1x))

1000

500

03 (reading of several output registers (4x))

100

50

04 (reading of several input registers (3x)

100

50

05 (writing of a single output bit (0x))

1

1

06 (writing of a single output register (4x))

1

1

15 (writing of several output bits (0x))

1000

500

16 (writing of several output registers (4x)).

100

50