Chapter 9. Modbus/TCP Client148 PACSystems* RX7i & RX3i TCP/IP Ethernet Communications User Manual GFK-2224QRead Data from a Modbus/TCP Device (3003)The Read Data from a Modbus/TCP Device COMMREQ requests a data transfer from a Modbus/TCP device tothe PLC. The Read Data COMMREQ must reference an active Modbus/TCP channel previously established withthe Open Modbus/TCP Client Connection COMMREQ.Registers, Coils or Exception Status data may be read from the remote Modbus/TCP device. The ModbusFunction Code specifies the data type. Valid Function Codes for the Read Data COMMREQ are presented in thefollowing table.FunctionCode DescriptionModbus Server MemoryRegion Accessed Data Unit Size Maximum Data Units1 Read Coils Internal Bits or Physical coils Bit 20002 Read Input Discretes Physical Discrete Inputs Bit 20003 Read MultipleRegistersInternal Registers or PhysicalOutput RegistersRegister(16-bit Word)1254 Read Input Registers Physical Input Registers Register(16-bit Word)1257 Read Exception Status Server Exception Memory Byte Not Applicable24 Read FIFO Queue Internal Registers or PhysicalOutput RegistersRegister(16-bit Word)32The table above describes the general Modbus server memory areas. The actual memory accessed isdependent on how the server maps the Modbus memory regions to the server’s local memory.An Address and Length specify the location of the data in the remote device and the number of data units totransfer. The Length is the number of Registers or Coils to transfer. Modbus Function Code 7, Read ExceptionStatus does not require the address as the remote device retrieves the exception status from an internallocation.When transferring data between server bit or coil memory to PLC bit memory, only the number of bits specifiedis transferred. For example, if the COMMREQ requests to read 9 coils from the Remote Device and requests toput the data at %M00001 in the Local PLC (using a bit type memory type), %M00001 through %M00009 will beupdated with the data from the Remote Device and %M00010 through %M00016 will be unaffected. However,if server bit or coil memory is transferred to PLC byte or word memory, the following rules apply:1. Transferring discrete data from the Remote Device to Local PLC Word (16-bit) memory: If the number ofrequested coils is not a multiple of 16, the data is padded with 0s to a 16-bit boundary. For example if theCOMMREQ requests reading 17 coils from the Remote Device and requests to place this data at %R00010,%R00010 (all 16 bits) and bit 0 of %R00011 will be updated with values from the Remote Device and bits 1through 15 of %R00011 will be set to 0.2. Transferring discrete data from the Remote Device to Local PLC byte memory (using byte type memorytype): If the number of requested coils is not on an 8-bit boundary, the data is padded with 0s to an 8-bitboundary. For example if the COMMREQ requests 9 coils from the Remote Device and requests to placethis data at %M00001, %M00001 through %M00009 will be updated with values from the Remote Deviceand %M00010 through %M00016 will be set to 0.Data returned from the remote device is stored in the PLC data area specified in the Read Modbus/TCP DeviceCOMMREQ. Data can be stored in any of the PLC data areas. Refer to Local PLC Memory Type on page 150 forthe list of data areas and identification codes for the PLC. Note that the first item referred to in each data areais item 1 (not item 0).The COMMREQ Status Word (CRS) indicates the success or failure of the Read Data COMMREQ. If the COMMREQrequests an invalid channel number or any other field is invalid the COMMREQ fails and the CRS is set to a non-
