A practical engineering guide to configure Modbus TCP on the Mitsubishi MELSEC iQ-R series — quick setup, GX Works3 parameters, MODBUS Device Assignment, function codes, exception codes, float/endian handling, polling timing, and field troubleshooting
Quick Setup (5 Steps)
If you just need it working fast, here’s the short path:
| Step | Action |
|---|---|
| 1 | GX Works3 → Module Parameter → Required Settings: set IP address (e.g. 192.168.1.10) |
| 2 | Application Settings → MODBUS/TCP Setting → set to Use |
| 3 | Keep the default MODBUS Device Assignment (40001 → D0, Coil 1 → M0) |
| 4 | Convert → Write to PLC → Reset CPU → set to RUN |
| 5 | Test with Modbus Master Simulator |
That’s the entire base config. Read the rest if it doesn’t work or you need custom mapping.
💡 Slave vs Master — read this first:
- Slave (iQ-R answers SCADA): No ladder needed. The CPU handles responses internally. Just configure parameters.
- Master (iQ-R reads remote devices): Ladder logic required. Use Modbus FBs from the GX Works3 library or
GP.READ/GP.WRITE.This guide covers slave (the more common case). Master is mentioned briefly in Section 4.
Introduction
The MELSEC iQ-R is Mitsubishi’s flagship PLC platform — used widely in automotive, semiconductor, and high-end machine building across Asia, Europe, and North America. For Modbus TCP, the iQ-R offers two hardware paths: the RJ71EN71 Ethernet module, or the built-in Ethernet ports on the Ethernet-equipped CPUs (R04ENCPU through R120ENCPU).
This article is verified against the MELSEC iQ-R MODBUS and MODBUS/TCP Reference Manual (BCN-P5999-1060-B).
Table of Contents
1. iQ-R Hardware Options for Modbus TCP
The iQ-R provides Modbus TCP on two hardware paths:
| Hardware | When to Use |
|---|---|
| RnENCPU built-in Ethernet (R04ENCPU, R08ENCPU, R16ENCPU, R32ENCPU, R120ENCPU) | New projects, single PLC, simple system |
| RJ71EN71 Ethernet module | Multiple network segments, isolated Modbus traffic, or non-Ethernet CPU |
Both options have 2 Ethernet ports (P1, P2), support 1 Gbps, and are configured the same way in GX Works3. The steps below apply to both.
For serial Modbus (RTU/ASCII), use the RJ71C24 family. Same MODBUS slave logic, different transport.
2. iQ-R as Modbus TCP Slave: Overview
When the iQ-R acts as slave, a SCADA master, HMI, or another PLC connects on TCP port 502 and reads/writes data. The iQ-R handles slave responses internally — no ladder logic required.
The slave function uses MODBUS Device Assignment to map Modbus references (coils, discrete inputs, holding registers, input registers, file registers) to internal CPU device memory (M, X, Y, D, ZR).
Example: when a master reads holding register 40001, the iQ-R returns the value of D0 (default mapping).
3. Pre-Operational Procedure
- Mount the RJ71EN71 (or use built-in Ethernet on RnENCPU)
- Open GX Works3, create a project for your iQ-R CPU
- Configure module parameters
- Set IP address
- Enable MODBUS/TCP in Application Settings
- Configure MODBUS Device Assignment (default or custom)
- Download to CPU and reset
- Test with a Modbus master simulator
4. iQ-R as Modbus TCP Master (Brief)
For master function, you need ladder logic. Use Modbus function blocks from the GX Works3 library, or dedicated instructions like GP.READ and GP.WRITE. Refer to the MELSEC iQ-R Ethernet User’s Manual (Application) for master programming details.
The rest of this guide focuses on slave configuration.
5. Step 1: Configure Module Parameters in GX Works3
Open GX Works3 and navigate to module parameters:
| Hardware | GX Works3 Path |
|---|---|
| RJ71EN71 | Project Tree → Parameter → Module Information → 0000:RJ71EN71(E+E) |
| RnENCPU built-in | Project Tree → Parameter → CPU → Module Parameter → Ethernet Port |
Both lead to the same configuration screen with three sections:
- Required Settings — IP, communication mode
- Basic Settings — Connection Configuration
- Application Settings — where MODBUS/TCP lives
6. Step 2: Set IP Address and Network Settings
In Required Settings:
| Parameter | Example | Notes |
|---|---|---|
| IP Address | 192.168.1.10 | Match your network plan |
| Subnet Mask | 255.255.255.0 | Standard /24 |
| Default Gateway | 192.168.1.1 | If routing needed |
| Communication Speed | Auto-Negotiation | Default |
| Communication Mode | Online | Default |
⚠️ Each Ethernet port (P1, P2) has its own IP. They must be on different subnets unless using port redundancy.
7. Step 3: Enable MODBUS/TCP Function
In Application Settings → MODBUS/TCP Setting:
| Parameter | Setting |
|---|---|
| To Use or Not to Use MODBUS/TCP | Use |
| Local Station Port No. (TCP) | 502 (default — keep unless you have a specific reason) |
After this, the iQ-R listens on the configured port every time the CPU enters RUN mode.
8. Step 4: Configure MODBUS Device Assignment
This step maps Modbus reference numbers to internal iQ-R devices.
Default Assignment
For most projects, the defaults are sufficient:
| Modbus Reference | iQ-R Device | Quantity | Function Codes |
|---|---|---|---|
| Coils (0xxxx) | M0 onwards | Up to 64K | FC 01, 05, 0F |
| Discrete Inputs (1xxxx) | X0 onwards | Up to 64K | FC 02 |
| Input Registers (3xxxx) | D0 onwards | Up to 64K | FC 04 |
| Holding Registers (4xxxx) | D0 onwards | Up to 64K | FC 03, 06, 10 |
| Extended File Registers (6xxxx) | ZR0 onwards | Up to file register size | FC 14, 15 |
💡 3xxxx and 4xxxx point to the same D registers by default, but they are accessed with different function codes (FC 04 for Input Registers, FC 03 for Holding Registers). Some SCADA systems treat 3xxxx as read-only and 4xxxx as read/write — useful for protecting parts of memory at the master side.
Custom Assignment
Override defaults by configuring MODBUS Device Assignment Parameter. Up to 16 ranges per Modbus reference type. Each entry has:
- Device Code (M, X, Y, D, ZR, B, W, etc.)
- Head Device Number (e.g., D100)
- Head MODBUS Reference Number (e.g., 40001)
- Assignment Points (e.g., 200 registers)
Example: Map holding registers 40001–40200 to D100–D299 instead of D0–D199.
9. Real Example: SCADA Reading Temperature, Writing Setpoint
A practical scenario — a SCADA system needs to read a tank temperature and write a setpoint to an iQ-R PLC controlling a heater.
Internal Logic in the iQ-R (Ladder)
D0 = Tank temperature (read from analog input, scaled to °C × 10)
D9 = Heater setpoint (used by PID block)
M10 = Heater enable (used by output coil)Default MODBUS Device Assignment Maps:
| SCADA Sees | iQ-R Internal | Direction | What It Means |
|---|---|---|---|
| Holding Register 40001 | D0 | Read | Tank temperature × 10 (e.g., 754 = 75.4 °C) |
| Holding Register 40010 | D9 | Write | Heater setpoint × 10 |
| Coil 11 | M10 | Read/Write | Heater ON/OFF |
What the SCADA Does:
- Polls FC 03 (Read Holding Registers), starts at PDU address 0, count = 1 → reads D0
- Sends FC 06 (Write Single Register), PDU address 9, value = 800 → writes 800 to D9 (setpoint = 80.0 °C)
- Sends FC 05 (Write Single Coil), PDU address 10, value = FF00H → turns M10 ON
That’s it. The iQ-R ladder uses D0, D9, M10 as it normally would — Modbus access is transparent to the program.
10. 32-bit Values, Float, and Byte Order
Most field issues with Modbus come from this section. Read it carefully.
Modbus registers are 16 bits. To transmit a 32-bit value (DINT, REAL/float), the iQ-R uses two consecutive registers. The order in which those registers are arranged is where most integration problems happen.
The Problem
There are two layers of byte order to align:
| Layer | What It Means | Common Variants |
|---|---|---|
| Word order | Which register holds the high word vs the low word | Big-endian word (high first) vs little-endian word (low first) |
| Byte order | Within each register, which byte comes first | Big-endian byte (high first) vs little-endian byte (low first) |
The combination gives four possible formats: ABCD, CDAB, BADC, DCBA.
What iQ-R Does
The iQ-R stores 32-bit values in two consecutive D registers using its native MELSEC format (low word in lower address). When a Modbus master reads them, the master must interpret the byte/word order correctly to reconstruct the float.
Practical Rule
If the SCADA shows nonsense values for a float (very large numbers, NaN, or wrong magnitude), it’s almost always a word/byte order mismatch. Try the other 3 combinations in the SCADA driver settings — one of them will be correct.
| Master Setting | Result |
|---|---|
| Word swap OFF, Byte swap OFF | ABCD |
| Word swap ON, Byte swap OFF | CDAB (most common with iQ-R) |
| Word swap OFF, Byte swap ON | BADC |
| Word swap ON, Byte swap ON | DCBA |
💡 Tip: Test with a known float value first. Write a recognizable number (e.g., 123.456) into a known register pair from the iQ-R side, then check what the SCADA reads. Adjust word/byte swap until the values match.
11. Polling Timing and Connection Behavior
| Parameter | Recommended | Notes |
|---|---|---|
| Typical scan / poll interval | 100–500 ms | Match your SCADA’s needs, not faster |
| Minimum recommended | ≥ 50 ms | Below this, the iQ-R may return Exception 06 (busy) |
| Maximum concurrent TCP connections | 64 | Hard limit — additional masters will be rejected |
| Modbus TCP timeout (master side) | 1–3 seconds | Industry standard |
Why Aggressive Polling Hurts
A SCADA polling at 10 ms intervals against a single iQ-R will:
- Generate Exception 06 (Slave Busy) responses
- Saturate one of the 64 connection slots
- Increase network congestion
- Reduce CPU scan time available for actual control logic
If you need fast updates, increase the registers per request instead of decreasing the interval. One FC 03 read of 100 registers at 200 ms is far more efficient than 100 single-register reads at 10 ms.
12. Step 5: Download and Test
- Convert/Compile: F4 or Convert → Rebuild All
- Write to PLC: Online → Write to PLC → Parameter + Program → Execute
- Reset the CPU: power cycle or use the reset switch
- Set CPU to RUN: RUN/STOP switch or Online → Operation of PLC → Remote RUN
Test with Modbus Master Simulator
The article Top Free Modbus Troubleshooting Tools highlights a set of free tools used to diagnose and test Modbus RTU and TCP networks. It covers master simulators, slave simulators, and sniffers that help engineers validate communication, read/write registers, and monitor traffic. These tools are essential for quick troubleshooting, pre-commissioning checks, and isolating issues between devices, network, and SCADA systems.
13. Supported Modbus Function Codes
Verified against the BCN-P5999-1060-B reference manual:
| FC (Hex) | Name | Description |
|---|---|---|
| 01H | Read Coils | Read 1–2000 coil statuses |
| 02H | Read Discrete Inputs | Read 1–2000 input statuses |
| 03H | Read Holding Registers | Read 1–125 holding registers |
| 04H | Read Input Registers | Read 1–125 input registers |
| 05H | Write Single Coil | Write ON/OFF to one coil |
| 06H | Write Single Register | Write to one holding register |
| 07H | Read Exception Status | 8-bit exception status (serial only) |
| 08H | Diagnostics | Various sub-functions (serial only) |
| 0BH | Get Communications Event Counter | (serial only) |
| 0CH | Get Communications Event Log | (serial only) |
| 0FH | Write Multiple Coils | Write 1–1968 coils |
| 10H | Write Multiple Registers | Write 1–123 holding registers |
| 11H | Report Slave ID | Read slave identification |
| 14H (SC: 06H) | Read File Record | Read extended file registers |
| 15H (SC: 06H) | Write File Record | Write extended file registers |
| 16H | Mask Write Register | AND/OR mask write |
| 17H | Read/Write Multiple Registers | Read and write in one transaction |
💡 Function codes 07H, 08H, 0BH, 0CH are MODBUS Serial only. They do not work over Ethernet.
14. iQ-R Memory Mapping for Modbus
The iQ-R follows the standard rule: the master sends (device number – 1) in the request PDU.
| Master Sees | PDU Address | iQ-R Device (default) |
|---|---|---|
| Coil 1 | 0 (0000H) | M0 |
| Coil 100 | 99 (0063H) | M99 |
| Holding Register 40001 | 0 (0000H) | D0 |
| Holding Register 40100 | 99 (0063H) | D99 |
| Input Register 30001 | 0 (0000H) | D0 (read-only access via FC 04) |
| Discrete Input 10001 | 0 (0000H) | X0 |
⚠️ Off-by-one is the #1 source of Exception 02. If the master uses 1-based reference numbers and you mapped to D0, the master must send PDU 0 (subtracting 1). Most master tools handle this automatically — but always verify.
15. Exception Codes
When the iQ-R can’t fulfill a request, it returns the function code OR’d with 0x80 (e.g., 0x83 instead of 0x03), followed by an exception code:
| Code | Name | Cause | Action |
|---|---|---|---|
| 01H | Function code error | Unsupported function code | Verify FC list (Section 13). Use a different FC. |
| 02H | Device address error | Modbus address out of assigned range | Check MODBUS Device Assignment. Verify register is within mapped range. |
| 03H | Data error | Malformed PDU | Check quantity (FC 03/04 max 125, FC 16 max 123). |
| 04H | Processing failure | Internal error during request processing | Check iQ-R diagnostics for hardware/config issue. |
| 06H | Slave busy | iQ-R processing other requests | Retry. Reduce poll rate or concurrent connections. |
For the full reference including gateway exception codes (0AH, 0BH), see: Modbus Exception Codes Explained
16. Diagnostic Counters and Communication Event Log
The iQ-R maintains diagnostic counters in buffer memory:
| Counter | Description | Buffer Memory (CH1 / CH2) |
|---|---|---|
| Bus message count | Messages detected on the line | Un\G32512 / Un\G32576 |
| Bus communication error count | CRC/LRC errors, overruns, short frames | Un\G32513 / Un\G32577 |
| Exception error count | Exception responses generated | Un\G32522 / Un\G32586 |
| Slave message count | Messages addressed to this iQ-R | Un\G32518 / Un\G32582 |
| Character overrun count | Requests exceeding upper limit | Un\G32514 / Un\G32578 |
Counters reach FFFFH and stop. Clear them by:
- Power cycle or reset the CPU
- FC 08H sub-function 01H (Restart Communications) — serial only
- FC 08H sub-function 0AH (Clear Counters) — serial only
- Write 0 to the buffer memory address from a sequence program
Communications Event Log
The iQ-R keeps a 64-entry event log (Un\G32544–Un\G32575 for CH1, Un\G32608–Un\G32639 for CH2). When full, the oldest entry is overwritten. Each entry records:
- Communication errors
- Bus character overrun
- Listen-only mode entry/exit
- Broadcast message reception
- Message error (exception 01–03)
- Processing interruption (exception 04)
17. Field Troubleshooting: Common Failure Patterns
When you’re on site and Modbus TCP isn’t working, this is what to check first:
Pattern 1: SCADA shows “no response” or timeout
Likely causes:
- iQ-R CPU is in STOP mode → set to RUN
- Modbus TCP not enabled → verify Application Settings was downloaded
- IP unreachable → ping from the SCADA server first
Quick checks:
bash
ping 192.168.1.10
nc -zv 192.168.1.10 502Pattern 2: Master gets Exception 02 (Illegal Data Address)
Likely causes:
- Off-by-one error — master sending 40001 but expecting iQ-R to interpret it as PDU 1 (should be PDU 0)
- Address outside assigned range — master requested register 40500 but only 200 registers were assigned
- Wrong device mapping — register maps to a device that doesn’t exist (e.g., D99999)
Action: Open MODBUS Device Assignment in GX Works3, verify the address is within the configured range.
Pattern 3: Exception 03 (Illegal Data Value)
Likely causes:
- Master tried to read >125 registers in one FC 03/04 request
- Master tried to write >123 registers in one FC 16 request
- Master sent malformed PDU (byte count mismatch)
Action: Split the request into smaller blocks.
Pattern 4: Intermittent connection drops or Exception 06
Likely causes:
- >64 concurrent connections — iQ-R rejects new requests
- Polling too aggressive (<50 ms) — iQ-R returns busy
- Network congestion — switch overload, broadcast storms
Action: Increase poll interval. Reduce master concurrency. Check connection count in iQ-R diagnostics.
Pattern 5: Float values look like garbage (huge numbers, NaN)
Likely causes:
- Word/byte order mismatch — see Section 10
- SCADA expects ABCD format, iQ-R provides CDAB (or vice versa)
Action: Try toggling word swap and byte swap options in the SCADA driver. Test with a known recognizable value (e.g., 123.456) until the SCADA matches.
Pattern 6: Some registers read OK, others return wrong values
Likely causes:
- Custom MODBUS Device Assignment with overlapping or mis-aligned ranges
- Master and iQ-R using different data type interpretation (signed vs unsigned)
Action: Verify the assignment in GX Works3. Check the master’s data type settings.
Pattern 7: Works in test, fails in production
Likely causes:
- Firewall blocking the port between SCADA VLAN and PLC VLAN
- NAT or port forwarding breaking session continuity
- Multiple masters fighting for the same connection slot
Action: Open Wireshark on the SCADA side. Filter tcp port 502. Look for retransmissions, RST flags, or no SYN-ACK.
For Wireshark-based diagnosis, see: Wireshark for Modbus TCP
Summary
The MELSEC iQ-R supports Modbus TCP through the RJ71EN71 module or built-in Ethernet on RnENCPU. Configuration in GX Works3: enable MODBUS/TCP, set IP, configure MODBUS Device Assignment.
The key things to remember:
- Slave function needs no ladder logic — the iQ-R handles responses internally
- MODBUS Device Assignment maps Modbus references to M, X, D, ZR
- 17 standard function codes supported; 07H, 08H, 0BH, 0CH are serial-only
- Exception codes returned: 01, 02, 03, 04, 06
- Off-by-one is the #1 cause of Exception 02
- Float/32-bit values require matching word and byte order between iQ-R and SCADA — this causes 50% of integration issues
- Up to 64 concurrent connections; poll at 100–500 ms (not under 50 ms)
- Diagnostic counters and a 64-entry event log are accessible via buffer memory