MRX - Modbus Network Read

Topic: DMD0298

Help File Version: 2.10.0.636

MRX - Modbus Network Read

The Modbus Network Read (MRX) instruction is used to read data from a Modbus Server. The Modbus Server (Slave) can be either a Modbus/TCP server which communicates through the on-board Ethernet port, or a Modbus/RTU server which communicates over the on-board serial port, one of the serial POMs for the BRX CPUs, or one of the serial ports on a SERIO module.

This instruction will be using either an Ethernet port or a Serial port, which is a shared resource. The port's ability to concurrently handle multiple instructions is provided through the client device . The client device allows the port to process these concurrent requests without the need for interlocking logic in the ladder program. For example, DirectLOGIC PLCs use the 'Port Busy' SP relay in the ladder program to interlock all of the RX and WX communication requests that use same communication port. That interlocking logic is not required with this instruction because the client device that manages the port provides all of the required interlocking internally.

The MRX instruction uses Modbus/TCP protocol an Ethernet (Modbus/TCP) client device is selected, and uses Modbus/RTU protocol when a Serial (Modbus/RTU) client device is selected.

Note: If a single Do-more will be reading data from multiple Modbus/TCP Servers, the best performance will be had by creating a separate Modbus/TCP Client for each of the Modbus/TCP Servers. Use this link for more information on creating additional Modbus/TCP Client devices . Doing this will minimized the TCP overhead required to manage connections to multiple Modbus/TCP Servers. Any time you use the same Modbus/TCP Client for multiple IP Addresses you will see Info Message M240 similar to the following in the Output Window:

Element References:

Note: Use the F9 key or click the 'three dot box' at the right edge of the parameter field to open the Default Element Selection Tool (the Element Picker or the Element Browser) or use the Down-Arrow key (Auto-Complete) on any parameter field to see a complete list of the memory locations that are valid for that parameter of the instruction.

Device selects which Modbus Client device to use to execute the Modbus Read Data request.

Ethernet Client Devices selects one of the Modbus/TCP Client devices that has been configured to use the on-board Ethernet port. Selecting a Modbus/TCP Client that uses an Ethernet port also selects the use of Modbus/TCP protocol. The default configuration of a Do-more CPU has one built-in Modbus/TCP Client device named @IntModTCPClient.

Serial Port Client Devices selects one of the Modbus/RTU Clients that has been configured to use the on-board serial port, one of the serial POMs for a BRX CPU, or one of the serial ports on a SERIO or SERIO-4 module. Selecting a Modbus/RTU Client that uses a serial port also selects the use of Modbus/RTU protocol. The default configuration of a Do-more CPU does not have a built-in Modbus/RTU Client.

create device indicates that there are no Modbus Clients that have been configured to perform this instruction. For example, the CPU does not have an on-board Ethernet port, or the on-board serial port is NOT configured to be a Modbus Client. Selecting this entry will open the Create New Device dialog in the System Configuration so that a Modbus Client device can be created.

Modbus/TCP Addressing : if a Modbus/TCP Client is selected as the Device the following selections that specify the Ethernet network addressing will be enabled. If a Modbus/RTU Client is selected these options will be grayed out.

IP Address is the IP Address of the Modbus/TCP Server (Slave) to read the data from. This can be either a Fixed (static) IP Address or a Variable (dynamic) value.

Fixed Address is used if the IP Address is statically assigned to the Modbus/TCP Server (Slave). IP addresses are canonically represented in dot-decimal notation, consisting of four decimal numbers, each ranging from 0 to 255, separated by dots.

Variable IP Address is used if the IP Address resides in a memory location in the CPU. This allows the IP Address to be changed at runtime. This can be any readable DWord numeric location. Each octet of the IP Address is stored in one byte of the Variable Address location. In the example below the Initialize Data instruction will use the :UB operator to place the 4 octet values of IP Address 192.168.26.71 into the 4 Bytes of the DWord location D0 in the proper order.

The 'IP Address' format selection in a Data View can be used to see the IP Address stored in the DWord location in the traditional dot-decimal notation (000.000.000.000).

Note: if the IP Address is Variable then the To Modbus Offset Address and the From Do-more Memory Address entries will most likely need to be assigned to Variable locations as well.

TCP Port Number - the port number of the Modbus/TCP Server (Slave) to read the data from. The default value of 502 is typically the correct number for Modbus protocol. This can be any constant value between 0 and 65535, or any readable numeric location containing a value in that range.

Unit ID (Slave ID) specifies the unique ID number of the Modbus Server to read the data from. This can be any constant value between 0 and 255, or any readable numeric location containing a value in that range. If this MRX instruction is configured to use a Modbus/RTU (Serial) Client the Unit ID uniquely identifies the Modbus Server on the serial network, otherwise the Unit ID is unused and should be left at the default value of 255. One notable exception is a Modbus Server that is a Modbus/TCP -to- Modbus/RTU gateway (such as our MB-Gateway). In this instance the Unit ID will uniquely identify the Modbus/RTU Server (Slave) on the serial network side of the gateway.

Function Code selects which of the following Modbus function codes to use:

1 - Read Coils
2 - Read Discrete Inputs
3 - Read Holding Registers
4 - Read Input Registers
7 - Read Exception Status

From Modbus Offset Address specifies the offset of the Modbus address where the data to read is currently stored in the Modbus server. This can be any constant value in the range of 1 to 65536. This value specifies the ONLY the OFFSET for the location in the Modbus server to read from. For example to read the value in Holding Register 40029 enter only the offset value 29; to read the status of the Discrete Input 10017 enter only the offset value 17.

Number of Elements is based on the Function Code selected, this selection specifies how many consecutive elements to read.

If Function Code 1 or 2 is selected this value specifies how many consecutive coils or discrete inputs to read. This can be any constant value from 1 to 2008, or any readable numeric location with a value in that range.

If Function Code 3 or 4 is selected this value specifies how many consecutive 16-bit unsigned registers to read. This can be any constant value from 1 to 125, or any readable location with a value in that range. Keep in mind that floating-point (real) and double-word values in Modbus are 32-bit values which have been stored in 2 consecutive 16-bit locations. This means you must read 2 consecutive Modbus registers for each floating point or double-word value and you should select a 32-bit location (like R0 or D0 respectively) for the To Do-more Memory Address below.

If Function Code 7 is selected this field will be grayed out with a fixed value of 1 because the Exception Status is always a single 16-bit unsigned register.

To Do-more Memory Address - specifies the beginning address of a range of bits or numeric locations in the CPU where the data that is read will be stored. This value must match the type expected by the Function Code. The built-in Modbus memory blocks MC / MI / MIR / MHR should not be used as the location to store data received by the MRX instruction because these memory locations are reserved for use by the Do-more CPU's Modbus Server (Slave) function. Refer to the Modbus Memory Blocks diagram in the Memory Configuration section of the System Configuration for more information.

If Function Code 1 or 2 is selected the To Do-more Memory Address value can be any writable bit location ( except for structure fields).

If Function Code 3 or 4 is selected the To Do-more Memory Address value can be any writable numeric location (except for structure fields). If the data being read is a floating point (real) or double-word value - which is stored in 2 successive 16-bit registers in the Modbus server - you should select a destination address that is a 32-bit register, like R0 or D0 respectively.

If Function Code 7 is selected the To Do-more Memory Address value can be any writable numeric location (except for structure fields).

Enable selects how this instruction will operate. Select from one of the following:

Select the Once on Leading Edge option to have this instruction run to completion exactly one time. Typically, this instruction will take more than one PLC scan to complete. Configured this way the instruction is said to be Edge Triggered Each time the input logic transitions from OFF to ON this instruction will execute. With each execution, this instruction will run to completion even if the input logic transitions to OFF before the instruction completes..
Select the Continuous on Power Flow at Interval option to have this instruction run repeatedly as long as the instruction has power flow. After the instruction has initially run, if the instruction still has power flow, the instruction will remain enabled and will wait the specified amount of time before running again. The following options select how much time (in milliseconds) to wait between successive runs. A value of 0ms means the instruction will re-run immediately.

Constant means the interval time is a fixed value specified as Hours / Minutes / Seconds / Milliseconds.
Variable means this can be any writable numeric location that contains a value between 0 and 2,147,483,647.

The On Success and On Error parameters specify what action to perform when this instruction completes. You do not have to use the same type of selection for both On Success and On Error.

If the Set Bit selection is used for either On Success or On Error, the specified BIT location will be SET OFF when the instruction is first enabled and will remain OFF until the instruction completes. Once complete, the appropriate Success or Error bit location ON. The specified Bit location is enabled with a SET (Latch) operation meaning that it will remain ON even if the input logic for the instruction goes OFF.

If the JMP to Stage selection is used for either On Success or On Error the target Stage must be in the same Program code-block as this instruction, you cannot specify a target Stage that exists in a different Program code-block. When the operation finishes, the target Stage will be enabled the same way as a standalone Jump to Stage (JMP) instruction would do it. The JMP to Stage option will only be available if this instruction is placed in a Program code-block.

On Success selects which of the following actions to perform if the operation is successful:

Enable SET Bit then specify any writable bit location.
Enable JMP to Stage then specify any Stage number from S0 to S127 in the current Program code-block.

On Error selects which of the following actions to perform if the operation is unsuccessful:

Enable SET Bit then specify writable bit location.
Enable JMP to Stage then specify any Stage number from S0 to S127 in the current Program code-block.

If either the On Success or On Error selections are set to JMP to Stage, Automatically create the SG box for any NEW stage number will be enabled which will automatically create any target stage that does not already exist.

Below this rung will create the new target stage on a new rung following this instruction.
At end of code-block will create the new target stage as the last rung of this Program.

Note: if the Enable selection is Continuous on Power Flow at Interval, the On Success & On Error actions will be processed at the completion of every MRX instruction during the time interval. So it is recommended the you use Set Bit instead of Jump to Stage for this configuration.

Exception Response : enable this selection then enter a memory location to store the Modbus Exception Response for this instruction. This can be any writable numeric location.

Except for broadcast messages, when the MRX instruction sends a query to a Modbus server it expects a normal response. One of four possible events can occur from the query:

If the server receives the query without a communication error, and can handle the query normally, it returns a normal response.
If the server does not receive the query due to a communication error, no response is returned. The MRX instruction will eventually process a timeout condition for the query.

Note: the timeout value is defined in the Modbus TCP Client or the Modbus/RTU Client.
If the server receives the query, but detects a communication error (parity, LRC, or CRC), no response is returned. The MRX instruction will eventually process a timeout condition for the query.

Note: the timeout value is defined in the Modbus TCP Client or the Modbus/RTU Client.
If the server receives the query without a communication error, but cannot handle it (for example, if the request is to read a non-existent coil or register), the server will return an exception response informing the MRX instruction of the nature of the error. This exception response value from the server can optionally be stored in a memory location.

List of Modbus Exception Response Codes.

Status Display:

The red triangle in the upper left corner of the status display indicates this is a Fully Asynchronous instruction.

Because Modbus protocol always works with Unsigned Word (16-bit) data, this instruction will display the range specified in the To Do-more Memory Address field in an additional field - called Do-more Range - with the appropriate cast operators any time the entered element is NOT an Unsigned Word type. For example, If the MRX is reading two Holding Registers and placing them in D0, the Do-more Range field will display D0:UW0 - D0:UW1, which means that the first Holding Register value is located in Word 0 of D0, and the second Holding Register value is located in Word 1 of D0.

In the example above the specified range is N0 - N19, the N range contains Signed Word values, so the :U cast operator is added to the display in the Do-more Range field as N0:U - N19:U. For more information on casting, refer to the help topic on Casting.

Example 1 of 2:

Description of a Typical Modbus Network Read (MRX) Stage Diagram:

This is a stage diagram showing a typical sequence that monitors a 3rd-party Modbus TCP slave and reads up a new recipe whenever it becomes available.

Initially the NewRec (New Recipe) stage monitors a bit from the slave. When this bit comes ON, RecipeRdy (Recipe Ready) causes the transition to the RDRec stage.

The RDRec (Read Recipe) reads the new recipe from the slave. When this completes, RecipeRD (Recipe Read) causes the transition to the RSTRec stage.

The RSTRec (Reset Recipe) writes a bit to the slave to inform it the recipe has been read successfully. When this write is complete, RecipeRST (Recipe Reset) causes a transition to the RSTMon stage.

The RSTMon (Reset Monitor) stage monitors a bit from the slave to confirm the slave heard the reset. When this bit comes ON, MonRST (Monitor Reset) causes a transition back to the NewRec stage to repeat the process and wait for the next new recipe.

Description of a Typical Modbus Network Read (MRX) Stage Ladder:

This is a ladder program that is equivalent to the above stage diagram. It utilizes both the Modbus Network Read (MRX) and Modbus Network Write (MWX) instructions to monitor a 3rd-party Modbus TCP slave and read up a new recipe whenever it becomes available.

A summary of the master / slave interaction is as follows:

The master monitors Modbus Input bit 1.
The slave formulates a new recipe and stores it in Modbus Input Register range 1-16.
The slave sets Modbus Input bit 1 ON when the recipe is ready and begins to monitor his own Modbus Coil 1 to know when the master has read the new recipe up.
The master sees Modbus Input bit 1 turn ON and reads up the new recipe from Modbus Input Register range 1-16 and stores it in his memory range RecipeVar1-RecipeVar16.
The master then sets the slave's Modbus Coil 1 to inform the slave he has read up the new recipe and begins to monitor Modbus Input bit 2 to know the slave heard him.
The slave sees his Modbus Coil 1 turn ON and turns ON his Modbus Input bit 2 to inform the master he is now formulating the next recipe.
The master sees Modbus Input bit 2 come ON and can now repeat the cycle (return to step 1 above).

NewRecipe is the initial stage. The MRX instruction is set to execute "Continuous at Interval 0.100s" to read a particular Modbus Input from the slave. This is the bit the slave will set when a new recipe has been stored and is ready for the Do-more PLC to read it up. The MRX reads this bit and stores it in RecipeReady bit. Upon the successful completion of each read the ReadSuccess1 bit will come ON. When there has been a successful read and the RecipeReady bit is ON, Rung 3 resets the RecipeReady bit back OFF (in preparation for the next cycle) and transitions to the ReadRecipe stage. If any one of these reads fails, the MRX instruction will transition to the ErrorStage where the error can be assessed (e.g. evaluation of the Exception Response, Exception1 value).

The ReadRecipe stage executes the MRX instruction once to read up the new recipe from Modbus Input Registers 1-16 and stores them in Do-more memory range RecipeVar1-RecipeVar16. Upon a successful read, the MRX transitions to the ResetRecipe stage. If the read failed, the MRX instruction will transition to the ErrorStage where the error can be assessed (e.g. evaluation of the Exception Response, Exception2 value).

The ResetRecipe stage executes the MWX instruction once to write to a single Modbus Coil to inform the slave the new recipe has been read up successfully. Upon a successful read, the MWX transitions to the ResetMonitor stage. If the write failed, the MWX instruction will transition to the ErrorStage where the error can be assessed (e.g. evaluation of the Exception Response, Exception3 value).

The ResetMonitor stage monitors a feedback bit from the slave that the slave should use to inform the Do-more PLC that it "heard" the recipe read was successful and that the slave can now make preparations for the next recipe. The MRX reads this bit (Modbus Input 2) and stores it in MonitorReset bit. Upon the successful completion of each read the ReadSuccess2 bit will come ON. When there has been a successful read and the MonitorReset bit is ON, Rung 10 resets the MonitorReset bit back OFF (in preparation for the next cycle) and transitions back to the initial NextRecipe stage. If any one of these reads fails, the MRX instruction will transition to the ErrorStage where the error can be assessed (e.g. evaluation of the Exception Response, Exception4 value).

The ErrorStage should have code in it (not shown here) that evaluates the various errors that can occur in this example.