105BCommunication processor
12.5 Modbus communication
S7-1200 Programmable controller
System Manual, 11/2011, A5E02486680-05
605
The MB_MASTER instruction uses a MODE input rather than a Function Code input. The
combination of MODE and Modbus address determine the Function Code that is used in the
actual Modbus message. The following table shows the correspondence between parameter
MODE, Modbus function code, and Modbus address range.
Table 12- 69 Modbus functions
MODE
Modbus
Function
Data length
Operation and data
Modbus
Address
0
01
1 to 2000
1 to 1992
1
Read output bits:
1 to (1992 or 2000) bits per request
1 to 9999
0
02
1 to 2000
1 to 1992
1
Read input bits:
1 to (1992 or 2000) bits per request
10001 to 19999
0
03
1 to 125
1 to 124
1
Read Holding registers:
1 to (124 or 125) words per request
40001 to 49999 or
400001 to 465535
0
04
1 to 125
1 to 124
1
Read input words:
1 to (124 or 125) words per request
30001 to 39999
1
05
1
Write one output bit:
One bit per request
1 to 9999
1
06
1
Write one holding register:
1 word per request
40001 to 49999 or
400001 to 465535
1
15
2 to 1968
2 to 1960
1
Write multiple output bits:
2 to (1960 or 1968) bits per request
1 to 9999
1
16
2 to 123
2 to 122
1
Write multiple holding registers:
2 to (122 or 123) words per request
40001 to 49999 or
400001 to 465535
2
15
1 to 1968
2 to 1960
1
Write one or more output bits:
1 to (1960 or 1968) bits per request
1 to 9999
2
16
1 to 123
1 to 122
1
Write one or more holding registers:
1 to (122 or 123) words per request
40001 to 49999 or
400001 to 465535
11
11
0
Read the slave communication status word and event
counter. The status word indicates busy (0 – not busy,
0xFFFF - busy). The event counter is incremented for
each successful completion of a message.
Both the DATA_ADDR and DATA_LEN operands of
MB_MASTER are ignored for this function.
80
08
1
Check slave status using data diagnostic code 0x0000
(Loopback test – slave echoes the request)
1 word per request
81
08
1
Reset slave event counter using data diagnostic code
0x000A
1 word per request
3 to 10,
12 to 79,
82 to 255
Reserved
1
For "Extended Addressing" mode the maximum data lengths are reduced by 1 byte or 1 word depending upon the data
type used by the function.