Chapter 9. Modbus/TCP Client154 PACSystems* RX7i & RX3i TCP/IP Ethernet Communications User Manual GFK-2224QWrite Data to a Modbus/TCP Device (3004)The Write Data to a Modbus/TCP Device COMMREQ requests a data transfer from the PLC to a Modbus/TCPserver. The Write Data COMMREQ must reference an active Modbus/TCP channel previously established withthe Open Modbus/TCP Client Connection COMMREQ.Registers or Coils may be written to the remote Modbus/TCP device. The Modbus Function Code specifies thedata type. Valid Function Codes for the Write Data COMMREQ are presented in the following table:FunctionCode Description Modbus Server Memory Region Accessed Data UnitSizeMaximumData Units5 Write Single Coil Internal Bits or Physical coils Bit 16 Write Single Register Internal Registers or Physical OutputRegisters Register 115 Write Multiple Coils Internal Bits or Physical coils Bit 196816 Write MultipleRegistersInternal Registers or Physical OutputRegisters Register 123An Address Offset and Length specify the location in the Modbus/TCP device and the number of data units totransfer. The Address Offset is the offset from the Base Address for that memory region in the server. TheLength is the number of Registers or Coils to transfer.A PLC data area is the source for the data written to the Modbus/TCP device. The source of data can be any ofthe PLC data areas (see Local PLC Memory Type on page 150).Function Code 5, Write Single Coil, forces a Coil On or Off. To force a coil off, the value zero (0) is used as theCOMMREQ data value. If the PLC memory type is a bit type, the remote device coil is set to the same state asthe specified PLC memory location. If the PLC memory type is a byte or word type, a value of zero (0) is used toforce a coil off and a value of one (1) is used to force a coil on.Function Code 15, Write Multiple Coils, forces multiple Coils On or Off. If the PLC memory type is a bit type,remote device coils are set to the same state as the corresponding bits in the specified PLC memory location. Ifthe PLC memory type is byte or word type, the remote device coils follow the state of the packed bits containedin the byte or word memory. For example, if 16 coils are written to a PACSystems Modbus server starting at%Q1 from the client PLC memory at %R1 containing a value of 0x1111, the following remote server coils will beset %Q1, %Q5, %Q9 and %Q13 and the following remote server bits will be cleared: %Q2, %Q3, %Q4, %Q6,%Q7, %Q8, %Q10, %Q11, %Q12, %Q14, %Q15, %Q16.The COMMREQ Status Word (CRS) indicates the success or failure of the Write Data COMMREQ. If the COMMREQspecifies an invalid channel number or any other invalid field the COMMREQ fails and the CRS is set to a non-zero value to identify the failure. See the section “Status Data” later in this document for detailed CRS failurecodes.
