L9_XMIT Modbus Functions
(Original Document)
About us
At a Glance
The L9_XMIT function block supports the following Modbus function codes:.
For Modbus messages, the MSG_OUT array has to contain the Modbus definition table. The Modbus definition table for Modbus function code: 01, 02, 03, 04, 05, 06, 15 and 16 is five words long and you must set L9_XMIT_SET.MessageLen to 5 for successful L9_XMIT operation. The Modbus definition table is shown in the table below.
Modbus Function Codes 01...06
For Modbus messages, the MSG_OUT array has to contain the Modbus definition table. The Modbus definition table for Modbus function code: 01, 02, 03, 04, 05, 06, 15 and 16 is five words long and you must set L9_XMIT_SET.MessageLen to 5 for successful L9_XMIT operation. The Modbus definition table is shown in the table below
Modbus Definition Table Function Codes (01...06, 15 and 16):
Content
Description
Modbus function code (MSG_OUT[1])
L9_XMIT supports the following function codes:
01 = Read multiple coils (memory bits, %M)
02 = Read multiple discrete inputs (%I)
03 = Read multiple memory words (%MW)
04= Read multiple input words (%IW)
05 = Write single coil (memory bits, %M)
06 = Write single memory word (%MW)
15 = Write multiple coils (memory bits, %M)
16 = Write multiple memory words (%MW)
Quantity (MSG_OUT[2])
Enter the amount of data you want written to the slave PLC or read from the slave PLC. For example, enter 100 to read 100 memory words from the slave PLC or enter 32 to write 32 coils (memory bits, %M) to a slave PLC. There is a size limitation on quantity that is dependent on the PLC model. Refer to Appendix A for complete details on limits.
Slave PLC address (MSG_OUT[3])
Enter the slave Modbus PLC address. Typically the Modbus address range is 1...247. To send a Modbus message to multiple PLCs, enter 0 for the slave PLC address. This is referred to as Broadcast Mode. Broadcast Mode only supports Modbus function codes that writes data from the master PLC to slave PLCs. Broadcast Mode does NOT support Modbus function codes that read data from slave PLCs.
Slave PLC data area (MSG_OUT[4])
For a read command, the slave PLC data area is the source of the data. For a write command, the slave PLC data area is the destination for the data. For example, when you want to read coils (memory bits) %M300...500 (00300...00500) from a slave PLC, enter 300 in this field. When you want to write data from a master PLC and place it into memory word %MW100 (40100) of a slave PLC, enter 100 in this field. Depending on the type of Modbus command (write or read), the source and destination data areas must be as defined in the Source and Destination Data Areas table below.
Master PLC data area (MSG_OUT[5])
For a read command, the master PLC data area is the destination for the data returned by the slave. For a write command, the master PLC data area is the source of the data. For example, when you want to write coils (memory bits) %M16...32 (00016...00032) located in the master PLC to a slave PLC, enter 16 in the field. When you want to read input words %IW1...100 (30001...30100) from a slave PLC and place the data into the master PLC data area %MW100...199 (40100...40199), enter 100 in this field. Depending on the type of Modbus command (write or read), the source and destination data areas must be as defined in the Source and Destination Data Areas table below.
Source and Destination Data Areas for Function Codes (01...06, 15 and 16)
Function Code
Master PLC Data Area
Slave PLC Data Area
03 (Read multiple %MW/4x)
%MW (destination)
%MW (source)
04 (Read multiple %IW/3x)
%MW (destination)
%IW (source)
01 (Read multiple %M/0x)
%M (destination)
%M (source)
02 (Read multiple %I/1x)
%M (destination)
%I (source)
16 (Write multiple %MW/4x)
%MW (source)
%MW (destination)
15 (Write multiple %M/0x)
%M (source)
%M (destination)
05 (Write single %M/0x)
%M (source)
%M (destination)
06 (Write single %MW/4x)
%MW (source)
%MW (destination)
When you want to send 20 Modbus messages out of the PLC, you must transfer 20 Modbus definition tables one after another into MSG_OUT after each successful operation of L9_XMIT, or you may program 20 separate L9_XMIT function blocks and then activate them one at a time through user logic.
Modbus Function Code (08)
The Modbus definition table for Modbus function code: 08 is five words long and you must set L9_XMIT_SET.MessageLen to 5 for For Modbus messages, the MSG_OUT array has to contain the Modbus definition successful L9_XMIT operation. The Modbus definition table is shown in the table below.
Modbus Definition Table Function Codes (08):
Content
Description
Modbus function code (MSG_OUT[1])
L9_XMIT supports the following function code: 08 = Diagnostics
Diagnostics (MSG_OUT[2])
Enter the diagnostics subfunction code decimal value in this field to perform the specific diagnostics function desired. The following diagnostic subfunctions are supported:
Code Description
00 Return query data
01 Restart comm option
02 Return diagnostic word
03 Change ASCII input delimiter
04 Force listen only mode
05...09 Reserved
10 Clear counters (& diagnostics words in 384, 484)
11 Return bus messages count
12 Return bus comm detected error count
13 Return bus exception detected error count
14...15 Not supported
16 Return slave NAK count
17 Return slave busy count
18 Return bus Char overrun count
19...21 Not supported
Slave PLC address (MSG_OUT[3])
Enter the slave Modbus PLC address. Typically the Modbus address range is 1...247. Function code 8 does NOT support Broadcast Mode (Address 0)
Diagnostics function data field content (MSG_OUT[4])
Enter the decimal value needed for the data area of the specific diagnostic subfunction. For subfunctions 02, 04, 10, 11, 12, 13, 16, 17 and 18 this value is automatically set to zero. For subfunctions 00, 01, and 03 enter the desired data field value. For more details, refer to Modicon Modbus Protocol Reference Guide (PI-MBUS-300).
Master PLC data area (MSG_OUT[5])
For all subfunctions, the master PLC data area is the destination for the data returned by the slave. Specify a %MW that marks the beginning of the data area where the returned data is placed. For example, to place the data into the master PLC data area starting at %MW100 (40100), enter 100 in this field. Subfunction 04 does NOT return a response. For more details, refer to Modicon Modbus Protocol Reference Guide (PI-MBUS-300).
Modbus Function Codes (20, 21)
For Modbus messages, the MSG_OUT array has to contain the Modbus definition table. The Modbus definition table for Modbus function codes: 20 and 21 is six words long and you must set L9_XMIT_SET.MessageLen to 6 for successful L9_XMIT operation. The Modbus definition table is shown in the table below.
Modbus Definition Table Function Codes (20, 21):
Content
Description
Modbus function code (MSG_OUT[1])
L9_XMIT supports the following function codes: 20 = Read general reference (6x, extended memory) 21 = Write general reference (6x, extended memory)
Quantity (MSG_OUT[2])
Enter the amount of data you want written to the slave PLC or read from the slave PLC. For example, enter 100 to read 100 memory words from the slave PLC or enter 32 to write 32 coils (memory bits) to a slave PLC. There is a size limitation on quantity that is dependent on the PLC model. Refer to Appendix A for complete details on limits.
Slave PLC address (MSG_OUT[3])
Enter the slave Modbus PLC address. Typically the Modbus address range is 1...247. Function code 20 and 21 do NOT support Broadcast Mode (Address 0).
Slave PLC data area (MSG_OUT[4])
For a read command, the slave PLC data area is the source of the data. For a write command, the slave PLC data area is the destination for the data. For example, when you want to read extended memory words (600300...600399) from a slave PLC, enter 300 in this field. When you want to write data from a master PLC and place it into extended memory word (600100) of a slave PLC, enter 100 in this field. Depending on the type of Modbus command (write or read), the source and destination data areas must be as defined in the Source and Destination Data Areas table below. The lowest extended memory word is addressed as word "zero" (600000). The lowest memory word is addressed as word "one" %MW1 (400001).
Master PLC data area (MSG_OUT[5])
For a read command, the master PLC data area is the destination for the data returned by the slave. For a write command, the master PLC data area is the source of the data. For example, when you want to write memory words %MW16...32 (40016...40032) located in the master PLC to extended memory words (6x) in a slave PLC, enter 16 in the field. When you want to read extended memory words (600001...600100) from a slave PLC and place the data into the master PLC data area %MW100...199 (40100...40199), enter 100 in this field. Depending on the type of Modbus command (write or read), the source and destination data areas must be as defined in the Source and Destination Data Areas table below. The lowest extended memory word is addressed as word "zero" (600000). The lowest memory word is addressed as word "one" %MW1(400001).
File number (MSG_OUT[6])
Enter the file number for the extended memory words (6x) to be written to or read from. (1...10) depending on the size of the extended memory data area. 600001 is 60001 file 1 and 690001 is 60001 file 10 as viewed by the Reference Data Editor.
Source and Destination Data Areas for Function Codes (20, 21)
Function Code
Master PLC Data Area
Slave PLC Data Area
20 (Read general reference 6x)
%MW (destination)
6x (source)
21 (Write general reference 6x)
%MW (source)
6x (destination)
When you want to send 20 Modbus messages out of the PLC, you must transfer 20 Modbus definition tables one after another into MSG_OUT after each successful operation of L9_XMIT, or you may program 20 separate L9_XMIT function blocks and then activate them one at a time through user logic.