GE RX3i

Chapter 9. Modbus/TCP Client
154 PACSystems* RX7i & RX3i TCP/IP Ethernet Communications User Manual GFK-2224Q
Write Data to a Modbus/TCP Device (3004)
The Write Data to a Modbus/TCP Device COMMREQ requests a data transfer from the PLC to a Modbus/TCP
server. The Write Data COMMREQ must reference an active Modbus/TCP channel previously established with
the Open Modbus/TCP Client Connection COMMREQ.
Registers or Coils may be written to the remote Modbus/TCP device. The Modbus Function Code specifies the
data type. Valid Function Codes for the Write Data COMMREQ are presented in the following table:
Function
Code
Description Modbus Server Memory Region Accessed
Data Unit
Size
Maximum
Data Units
5 Write Single Coil Internal Bits or Physical coils Bit 1
6 Write Single Register
Internal Registers or Physical Output
Registers
Register 1
15 Write Multiple Coils Internal Bits or Physical coils Bit 1968
16
Write Multiple
Registers
Internal Registers or Physical Output
Registers
Register 123
An Address Offset and Length specify the location in the Modbus/TCP device and the number of data units to
transfer. The Address Offset is the offset from the Base Address for that memory region in the server. The
Length is the number of Registers or Coils to transfer.
A PLC data area is the source for the data written to the Modbus/TCP device. The source of data can be any of
the PLC data areas (see Local PLC Memory Type on page 150).
Function Code 5, Write Single Coil, forces a Coil On or Off. To force a coil off, the value zero (0) is used as the
COMMREQ data value. If the PLC memory type is a bit type, the remote device coil is set to the same state as
the specified PLC memory location. If the PLC memory type is a byte or word type, a value of zero (0) is used to
force a coil off and a value of one (1) is used to force a coil on.
Function Code 15, Write Multiple Coils, forces multiple Coils On or Off. If the PLC memory type is a bit type,
remote device coils are set to the same state as the corresponding bits in the specified PLC memory location. If
the PLC memory type is byte or word type, the remote device coils follow the state of the packed bits contained
in the byte or word memory. For example, if 16 coils are written to a PACSystems Modbus server starting at
%Q1 from the client PLC memory at %R1 containing a value of 0x1111, the following remote server coils will be
set %Q1, %Q5, %Q9 and %Q13 and the following remote server bits will be cleared: %Q2, %Q3, %Q4, %Q6,
%Q7, %Q8, %Q10, %Q11, %Q12, %Q14, %Q15, %Q16.
The COMMREQ Status Word (CRS) indicates the success or failure of the Write Data COMMREQ. If the COMMREQ
specifies an invalid channel number or any other invalid field the COMMREQ fails and the CRS is set to a non-
zero value to identify the failure. See the section “Status Data” later in this document for detailed CRS failure
codes.