Siemens S7-1200 - Page 732

Communication processor and Modbus TCP
12.5 Modbus communication
S7-1200 Programmable controller
732 System Manual, 03/2014, A5E02486680-AG
MB_MODE and MB_DATA_ADDR parameters select the Modbus communication function
MB_DATA_ADDR assigns the starting Modbus address of the data to be accessed. The
MB_CLIENT instruction uses a MB_MODE input rather than a function code input.
The combination of MB_MODE and MB_DATA_ADDR values determine the function code
that is used in the actual Modbus message. The following table shows the correspondence
between parameter MB_MODE, Modbus function, and Modbus address range.
Table 12- 51 Modbus functions
MB_MODE
Modbus
function
Data length
Operation and data
MB_DATA_ADDR
0 01 1 to 2000 Read output bits:
1 to 2000 bits per request
1 to 9999
0 02 1 to 2000 Read input bits:
1 to 2000 bits per request
10001 to 19999
0 03 1 to 125 Read Holding registers:
1 to 125 words per request
40001 to 49999 or
400001 to 465535
0 04 1 to 125 Read input words:
1 to 125 words per request
30001 to 39999
1 05 1 Write one output bit:
One bit per request
1 to 9999
1 06 1 Write one holding register:
1 word per request
40001 to 49999 or
400001 to 465535
1 15 2 to 1968 Write multiple output bits:
2 to 1968 bits per request
1 to 9999
1 16 2 to 123 Write multiple holding registers:
2 to 123 words per request
40001 to 49999 or
400001 to 465535
2 15 1 to 1968 Write one or more output bits:
1 to 1968 bits per request
1 to 9999
2 16 1 to 123 Write one or more holding registers:
1 to 123 words per request
40001 to 49999 or
400001 to 465535
11 11 0 Read the server communication status word
and event counter. The status word
indicates busy (0 – not busy, 0xFFFF -
busy). The event counter is incremented for
each successful completion of a message.
Both the MB_DATA_ADDR and
MB_DATA_LEN parameters of MB_CLIENT
are ignored for this function.
80 08 1 Check server status using data diagnostic
code 0x0000 (Loopback test – server
echoes the request)
1 word per request