### Modbus (RTU)

#### IEC Equipment variable address range for Modbus (RTU)

The following table lists the equipment variable address range if you have selected the IEC61131 Syntax check box.

Variable | Bit Address | Word Address | Details
--- | --- | --- | ---
Input
%Ii | i = 0-255 | -- | Read-only, represents inputs. Range: 0 to 255 For input addresses, such as %Ii.i.i, %IWi.i.i, or %IWi.i.i:Xj, with a minimum of two and a maximum of six segments. Each segment identifies a physical rack, module, channel, and any other devices as necessary, for the associated I/O. When defining bits in a word address, j is a bit index with the following convention: 0 for the least significant bit and 15 for the most significant bit.
%IWi:Xj | i = 0-255 j = 0-15 | --
%IWi | -- | i = 0-255
Constant
%KWi:Xj | i = 0 to 65535 j = 0-15 | -- | Read-only, represents contstants. j is a bit index with the folllowing convention: 0 for the least significant bit and 15 for the most significant bit.
%KWi | -- | i = 0 to 65535 | Read-only, represents contstants.
Memory
%MDi | -- | i=0 to 65534 | Read/Write access. To fit with equipment variable coding, the most significant byte could be chosen by the software.
%MFi | -- | i=0 to 65534
%Mi | i = 0 to 65535 | -- | Read/Write access.
%MWi:Xj | i = 0 to 65535 j = 0 to 15 | -- | Read/Write access. j is a bit index with the following convention: 0 for the least significant bit and 15 for the most significant bit.
%MWi | -- | i=0 to 65535 | Read/Write access.
Output
%Qi | i = 0-255 | -- | Read-only, represents outputs. Range: 0 to 255. For output addresses, such as %Qi.i.i, %QWi.i.i, or %QWi.i.i:Xj, with a minimum of two and a maximum of six segments. Each segment identifies a physical rack, module, channel, and any other devices as necessary, for the associated I/O. When defining bits in a word address, j is a bit index with the following convention: 0 for the least significant bit and 15 for the most significant bit.
%QWi:Xj | i = 0-255 j = 0-15 | --
%QWi | -- | i = 0-255
System
%Si | i = 0 to 999 | -- | Read/Write, depending on the bit/word number. j is a bit index with the folllowing convention: 0 for the least significant bit and 15 for the most significant bit.
%SWi:Xj | i = 0 to 999 j = 0-15 | --
%SWi | -- | i = 0 to 999

NOTE

- When you write to %IWi:Xj or %QWi:Xj variables, the Display reads the entire word, sets the defined bit, then returns the new word value to the External Device. If the ladder program writes data to this word address during the bit read/write process, the resulting data may be incorrect.

- %I, %K, %Q, and %S variables (and their W variants) are not supported for XBT G target machines.

- When the [Base Address] check box is selected for a 8-bit data type array or structure, and a %MW or %KW address is specified as the device address, the bottom byte and top byte of consecutive addresses is allocated to each element.
  Example: BYTE type array Var1
  Var1[0]...%MW1:X0
  Var1[1]...%MW1:X8
  Var1[2]...%MW2:X0

#### IEC61131 Syntax Address Mapping

Address mapping in BLUE is as follows. %MD and %MF use two sequential words form the specified address. The %KW, %KD, and %KF are mapped similarly.

#### Non IEC Equipment variable address range for Modbus (RTU)

The following table lists the equipment variable address range if you haven’t selected the IEC61131 Syntax check box.

Variable | Bit Address | Word Address | Note
--- | --- | --- | ---
Coils (C) | 00001-65536 | -- | Read/Write access.
Discrete Inputs | 10001-165536 | -- | Read-only
Single word Input Registers | 30001,0-365536,15 | 30001-365536 | Read-only
Single word Holding Registers | 40001,0-465536,15 | 40001-465536 | Read/Write access. When you write to one of these bit addresses, the Display reads the entire word address, sets the defined bit, then returns the new word address to the External Device. If the ladder program writes data to this word address during the bit read/write process, the resulting data may be incorrect.
Double word Input Registers | 30001,0-365536,15 | 30001-365535 | Read-only To fit with equipment variable coding, the most significant byte could be chosen by the software.
Double word Holding Registers | 40001,0-465536,15 | 40001-465535 | Read/Write access. To fit with equipment variable coding, the most significant byte could be chosen by the software.

#### Supported Function Code

Below is the list of Supported Function Code.

Function Code (Hex) | Description
--- | ---
FC01 (0x01) | Reads the ON/OFF status of coils (0X references) in the slave.
FC02 (0x02) | Reads the ON/OFF status of discrete inputs (1X references) in the slave.
FC03 (0x03) | Reads the binary content of holding registers (4X references) in the slave.
FC04 (0x04) | Reads the binary content of input registers (3X references) in the slave.
FC05 (0x05) | Forces a single coil (0X references) to either ON or OFF
FC06 (0x06) | Presets a value into a single holding register (4X references).
FC15 (0x0F) | Forces each coil (0X references) in a sequence of coils to either ON or OFF.
FC16 (0x10) | Presets values into a sequence of holding registers (4X references).

NOTE

- FC15 / FC16 will be used for writing. In case if the connected controller do not support these function codes, then FC05 / FC06 will be used.