Write Mutiple Registers (Code = 0x10)
Return to Introduction  Previous page  Next page

The function code 0x10 (Write Multiple Registers) allow to write informations, randomly, into the main PLC table

 

The PLC module acts like SERVER and the request should be prepared by a host system working as CLIENT. The PLC table is 16-bits word aligned array of general purpose data registers. The register address is in the range from zero to the maximum number of registers of your PLC (See specific technical data). For example, if my PLC has 1000 words, my address range is from 0 to 999

 

The fields related with the request are listed here

 

 

Field

Lenght

Description

Start Address

2 Bytes

This field keeps the "first location address" that will be written to the PLC table. The field represent a 16bits-aligned entity and can span from 0 to the maximum table size

Quantity of Registers

2 Bytes

This is number of registers that will be written starting from the first specified address

Data

(Quantity of Registers) * 2 Bytes

Data to be written. 16bits aligned entity

 

 

Sample UDP Packet Session (Request/Response)

Writing 4 registers starting from address 0x240

 

 

REQUEST (SENT BY CLIENT SYSTEM)

 

Fields

Mnemonic

Description

Lenght

Sample Data

Sent bytes and order

 

MBAP

Transaction Identifier

2 Bytes

0x2356

23H 56H

Protocol Identifier

2 Bytes

0x0000

00H 00H

Lenght

2 Bytes

0x0006

00H 06H

Unit Identifier

1 Byte

0x05

05H

 

MODBUS

Request

 

FC

Function Code

1 Byte

0x10

10H

 

Start Address

2 Bytes

0x0240

02H 40H

 

Quantity of Registers

2 Bytes

0x0004

00H 04H

Data#0

2 Bytes

0x1234

12H 34H

Data#1

2 Bytes

0x5678

56H 78H

Data#2

2 Bytes

0x9ABC

9AH BCH

Data#3

2 Bytes

0xDEF0

DEH F0H

 

 

 

 

 

RESPONSE (SENT BY SERVER PLC)

 

Fields

Mnemonic

Description

Lenght

Sample Data

Sent bytes and order

 

MBAP

Transaction Identifier

2 Bytes

0x2356

23H 56H

Protocol Identifier

2 Bytes

0x0000

00H 00H

Lenght

2 Bytes

0x0006

00H 06H

Unit Identifier

1 Byte

0x05

05H

 

MODBUS

Response

FC

Function Code

1 Byte

0x10

10H

 

Start Address(

2 Bytes

0x0240

02H 40H

 

Quantity of Registers

2 Bytes

0x0004

00H 04H

 

 

Note:  Data to write is sent using Big Endian notation (MSB byte first)