Writing to a Holding Register with X20 PLC as Modbus TCP Slave

Hello everyone,

When we configure our PLC as a Modbus TCP Slave in dynamic channel mode, when we setup a Holding Register, it is only defined as an Input IO Channel as such we cannot write to the Holding Registers.

However, if we were to use Fixed Buffer mode, while we can use the mbSlWordPut() FB to write to a Holding Register. But problem is I cannot set the Address Range of the Holding Register to what our customer needs. Which is from 40001 to 49999. Apparently, our Holding Register range is from 0x6000 - 0x9FFF which is 24576 to 40959.

Are there any ways I can work around either problem?


1 Like

Unfortunately, IO mapping is strictly unidirectional (input OR output, never both). There’s no workaround for this.

As the Modbus slave device, the AR PLC should be dictating the registers for communication. It’s the role of the Modbus master device to adapt accordingly and manipulate the correct registers. There’s no workaround on the slave side for this Modbus master limitation.

Based on your requirements, I’d recommend looking at the Mbus_tcp library for Modbus slave functionality. This library is much more dynamic than the built-in configuration.
GitHub - br-automation-com/modbusTCP-Automation-Studio: modbusTCP library for Automation Studio


Hi Austin,

Thanks for the suggestion.

I have an idea to work around the writing issue now. The idea is that I can create a MBTCP Master application locally accessing the same IF of the MBTCP Slave. This MBTCP Master then will help me write into the MBTCP Slave’s Holding Register via FC06 so that I don’ t technically need to write to an Input IO Mapping. It technically does the same job of “putting” a new value into the Holding Register.

With your suggested library I can get more flexibility of not needing the IO channels configuration (modification would require MpIO or AsIOMMan) I’ll have a look at it maybe it’s a more elegant way to do it thanks.


1 Like

I ran into the same issue a couple weeks ago and it is actually unsatisfying that I cannot change register addresses as I want when my PLC has the server/slave role.

Hi Michael,
I’ve tried the library that was suggested by Austin, the library is an application layer MBTCP implementation directly interacting with TCP/IP packets hence would not have the limitations that we are facing which is due to the built in MBTCP driver and you can directly influence the MB Registers since they now are simply memory chunks that are specified by you when initializing the function block.

It had helped my case hopefully it would for your case too. :slight_smile:

1 Like

Thanks Samuel, my colleague has already tested the library and he said it is working fine.
I am wondering why such a library gets not officially included into the AS and why AS only has the library included with all the limitations mentioned above.