Chapter 6 Applied Instructions 
6-519 
API 
Instruction code  Operand  Function 
2205    EMDRW  P 
S
1
, S
2
, S
3
, S, n 
Reading/Writing the Modbus TCP 
data 
Device
X  Y  M  S  T  C  HC  D  L  SM  SR  E  PR  K  16#  “$”  DF 
  Pulse instruction  16-bit instruction (11 steps)
32-bit instruction
  AH500  AH500  - 
Symbol: 
S
1
:
Unit address  Word 
S
2
:
Function code  Word 
S
3
:
Device address  Word 
S 
:
Register involved in the 
reading/writing of the data 
Bit/Word 
n 
:
Data length  Word 
Explanation: 
1.  Before using the instruction, users have to accomplish the following setting in ISPSoft. 
  PLC Parameter Setting→Ethernet-Basic→Setting the IP addres and the netmask 
address 
2.  Setting S
1
 : 
S
1
 
Station address 
The station address should be within the range between 
0 and 255. 
S
1
+1 
Remote IP address 
(high word) 
Example: The remote IP address is 172.16.144.230. 
S
1
+1=16#AC10 
S
1
+2=16#90E6 
S
1
+2 
Remote IP address 
(low word) 
S
1
+3 
Whether to close the 
connection 
0: The connection is closed after the execution of the 
instruction is complete. 
1: The connection is persistent. (The closing of the 
connection depends on the setting of the TCP 
keepalive timer.) 
S
2
: Function code 
For example: 
1 (16#01): The AH500 series PLC reads the data from several bit devices which are not 
discrete input devices. 
2 (16#02): The AH500 series PLC reads the data from several bit devices which are discrete 
input devices. 
3 (16#03): The AH500 series PLC reads the data from several word devices which are not 
input registers.   
4 (16#04): The AH500 series PLC reads the data from several word devices which are input 
registers.