Hi,

I am trying to set communication on Modbus RTU protocol with S7-1200 and CO measuring device. I am interested to read measured value of CO

The communication in this project works fine with other Modbus devices like frequency drive, etc. I am using MB_COMM_LOAD and MB_Master instructions

The CO measuring device has specific requirements to read data:

• Function Code - 0x03 or 0x04
• Starting Address - 0x3000 (12288 dec) for measured value (16-bits)

MB_Master description says that Function Code is located in MODE input could be '0' to read;  '1' to write and other diagnostics.

In table 12-69 (S7-1200 Programmer controller System Manual, page 643) we have:

That means that we could read only from 40001 (or 400001) register address for 0x03 function code

Is it possible to read register from different Modbus Address (like 12288) with function code 0x03 in S7-1200?

Thanks in advance for any help and Best Regards,

Piotr

Hi Kaulquappe,

Many thanks for you answer.

The description in the link you put described that what I know about. I am looking for the way to read register start from 0x3000 with the 0x03 modbus function code.

That range is still valid for Modbus protocol requirements: Modbus Application Protocol Specification V1.1b3 - from http://www.modbus.org/specs.php

Best Regards,

Piotr

Hi Kaulquappe,

That works!

I have put  412289 and communication is working well.

Many thanks for your help. I appreciate you professionalism

Best Regards,

Piotr

Hi sir

Mr HiKaulquappe,

 You can my help, why is 412289( 400001+12228), is not  52229( 40001+12228)

Many thannk

minhkhanhtdh

Hi sir

Mr HiKaulquappe,

 You can my help, why is 412289( 400001+12228), is not  52229( 40001+12228)

Many thannk

Do you mind if I contribute?

The original Modbus schema had  holding register addresses from 40,000. The upper limit was chosen to be at 49,999.

As communications between instruments became more feature rich, more address space was needed. The 'extended' range schema was realised. Siemens allows addresses between 400,000 to 465,535 which is 65,535+1 word addresses. The "65,535" is the highest number for an unsigned integer.

The address space would default to the original schema, unless the reserved address space exceeds the possible addressable space or is documented as using the 'extended' schema.

Is this helpful to you?

Hi minhkhanhtdh,

DATA_ADDR is combination of digits which contain Modbus Function and device Register Address

The first digit "4" means Modbus function <<see enclosure table>>. Rest of digits "12289" is a number/address of register we are going to read as first - Starting Address - 0x3000 (12288 dec) + offset 1 = 12289.

Finally we get: "412289" for DATA_ADDR

For some devices offset is not needed. In DATA_LEN you can put number of consecutive registers you would like to read. That could be DATA_LEN=1; then you read register (12289) just.

Modbus function table comes from "SIMATIC S7-1500/ET 200MP Automation system" 03/2018 edition pdf

Hope it helps,

Best Regards,

Piotr

Hi minhkhanhtdh,

DATA_ADDR is combination of digits which contain Modbus Function and device Register Address

The first digit "4" means 03 Modbus function (read hold register); MODE=0 <<see enclosure table>>. Rest of digits "12289" is a number/address of register we are going to read as first - Starting Address - 0x3000 (12288 dec) + offset 1 = 12289.

Finally we get: "412289" for DATA_ADDR

For some devices offset is not needed. In DATA_LEN you can put number of consecutive registers you would like to read. That could be DATA_LEN=1; then you read register (12289) just.

Modbus function table comes from "SIMATIC S7-1500/ET 200MP Automation system" 03/2018 edition pdf

Hope it helps,

Best Regards,

Piotr

@Duris_I

If the table mentioned above in 2015 is wrong please contact the authors of the publication directly