Siemens S7-1200 System Manual page 760

Communication processor and Modbus TCP
12.5 Modbus communication
For example, after MB_SLAVE is placed in a LAD network, you can go to a previous network
and assign the HR_Start_Offset value. The value must be assigned prior to execution of
MB_SLAVE.
Extended_Addressing
The Extended_Addressing variable is accessed in a similar way as the HR_Start_Offset
reference discussed above except that the Extended_Addressing variable is a Boolean
value. The Boolean value must be written by an output coil and not a move box.
Modbus slave addressing can be configured to be either a single byte (which is the Modbus
standard) or double byte. Extended addressing is used to address more than 247 devices
within a single network. Selecting extended addressing allows you to address a maximum of
64000 addresses. A Modbus function 1 frame is shown below as an example.
Table 12- 80 Single-byte slave address (byte 0)
Function 1 Byte 0
Request Slave addr.
Valid Response Slave addr.
Error response Slave addr.
Table 12- 81 Double-byte slave address (byte 0 and byte 1)
Byte 0
Request
Valid Response
Error response
760
Byte 1 Byte 2
F code
F code
0x81
Byte 1 Byte 2
Slave address
Slave address
Slave address
Entering a Modbus slave variable using the
default DB name:
1. Set the cursor in the parameter field and
2. Select "MB_SLAVE_DB" from the drop-list.
3. Set the cursor at the right side of the DB
4. Select "MB_SLAVE_DB.HR_Start_Offset"
Byte 3
Start address
Length
E code
Byte 3
F code Start address
F code Length
0x81 E code
type an m character.
name (after the quote character) and enter
a period character.
from the drop list.
Byte 4 Byte 5
Length of coils
Coil data
Byte 4 Byte 5
Coil data
S7-1200 Programmable controller
System Manual, 03/2014, A5E02486680-AG
Byte 6
Length of coils