105BCommunication processor
12.5 Modbus communication
S7-1200 Programmable controller
586
System Manual, 11/2011, A5E02486680-05
MB_MODE and MB_DATA_ADDR parameters select the Modbus communication function
MB_DATA_ADDR assigns the starting Modbus address of the data to be accessed. The
MB_CLIENT instruction uses a MB_MODE input rather than a function code input.
The combination of MB_MODE and MB_DATA_ADDR values determine the function code
that is used in the actual Modbus message. The following table shows the correspondence
between parameter MB_MODE, Modbus function, and Modbus address range.
Table 12- 51 Modbus functions
MB_MODE Modbus
function
Data length
Operation and data
MB_DATA_ADDR
0
01
1 to 2000
Read output bits:
1 to 2000 bits per request
1 to 9999
0
02
1 to 2000
Read input bits:
1 to 2000 bits per request
10001 to 19999
0
03
1 to 125
Read Holding registers:
1 to 125 words per request
40001 to 49999 or
400001 to 465535
0
04
1 to 125
Read input words:
1 to 125 words per request
30001 to 39999
1
05
1
Write one output bit:
One bit per request
1 to 9999
1
06
1
Write one holding register:
1 word per request
40001 to 49999 or
400001 to 465535
1
15
2 to 1968
Write multiple output bits:
2 to 1968 bits per request
1 to 9999
1
16
2 to 123
Write multiple holding registers:
2 to 123 words per request
40001 to 49999 or
400001 to 465535
2
15
1 to 1968
Write one or more output bits:
1 to 1968 bits per request
1 to 9999
2
16
1 to 123
Write one or more holding registers:
1 to 123 words per request
40001 to 49999 or
400001 to 465535
11
11
0
Read the server communication status word
and event counter. The status word
indicates busy (0 – not busy, 0xFFFF -
busy). The event counter is incremented for
each successful completion of a message.
Both the MB_DATA_ADDR and
MB_DATA_LEN parameters of MB_CLIENT
are ignored for this function.
80
08
1
Check server status using data diagnostic
code 0x0000 (Loopback test – server
echoes the request)
1 word per request
