FX5U Modbus TCP Client Setup in GX Works 3: Fixing Error 2822H

1. Overview

The MELSEC iQ-F FX5U series provides built-in 100 Mbps Ethernet on every CPU variant (FX5U-32M, FX5U-64M, FX5U-80M) plus the FX5UC compact variants when paired with an FX5-ENET or FX5-ENET/IP module. Modbus TCP client functionality is delivered through the Predefined Protocol Support function documented in Section 6 of the FX5 User's Manual (Ethernet Communication) – JY997D56201 and the Modbus-specific reference MELSEC iQ-F FX5 User's Manual (MODBUS Communication) – JY997D56101H.

Unlike SLMP or MC protocol exchanges, the Predefined Protocol block lets the FX5U dispatch native Modbus function codes (FC03, FC06, FC10, FC17, etc.) directly from structured ladder or ST without manual byte parsing of the Application Data Unit (ADU). This makes integration with non-Mitsubishi Modbus TCP servers practical in a single CPU scan.

2. Prerequisites

3. Network Topology

The reference deployment places the FX5U as the TCP active opener (client) initiating the connection to a fixed remote Modbus TCP server. Switched Ethernet is assumed; a router or NAT is not used because the FX5U does not support outbound NAT traversal for the Predefined Protocol block.

4. GX Works 3 Project and Module Configuration

1. Launch GX Works 3 and create a new project. Select Series = MELSEC iQ-F, CPU Type = FX5U, and match the actual CPU model (e.g., FX5U-64MT/DSS). Choose Program Language = Ladder or Structured Text.
2. Open Navigation → Parameter → FX5UCPU → Module Parameter → Ethernet Port.
3. Set the IP Address field for CH1 (e.g., 192.168.0.10) and Subnet Mask (255.255.255.0). Leave Default Gateway blank if no router is used.
4. Confirm Communication Speed is set to Auto-Negotiation (100 Mbps / Full Duplex will autonegotiate on most managed switches).

5. Ethernet Port Parameter Configuration – The Active Connection Fix

This is the decisive step that resolves error 2822H. In GX Works 3:

1. Navigate to Parameter → FX5UCPU → Module Parameter → Ethernet Port → Basic Settings → Own Node Settings.
2. Expand Application Settings → Predefined Protocol Settings (or, depending on GX Works 3 build, Ethernet Port Parameter Configuration).
3. Select the row for the protocol set assigned to your target server. Under Protocol Type choose TCP, not UDP.
4. Under Connection Type select Active Connection Module. Do not select UDP Connection Module – that option is for datagram services and produces fault 2822H on parameter validation when a Modbus ADU stream is bound to it.
5. Set Destination IP Address = 192.168.0.81, Destination Port No. = 502 (decimal), and Source Port No. = any unused port (e.g., 1282 or a calculated free port from the IANA dynamic range).
6. Click Apply. If the validator still raises 2822H, the most likely cause is a residual entry in Passive Connection Module or UDP Connection Module on the same connection number – delete the obsolete rows first.

6. Predefined Protocol Support Function – Protocol Library

Register the Modbus TCP protocol set in the protocol library before the Predefined Protocol block can be called from ladder:

1. Open Tool → Protocol Library → Predefined Protocol Library from the menu bar.
2. Select Add and choose Modbus/TCP Master from the vendor-supplied library. GX Works 3 ships M+CPU_PreDefModbusMaster_Vxxx.zip; if absent, download from the Mitsubishi FA site.
3. Define one or more Protocol Entries – each entry maps to one Modbus function code. Typical set:
   • Entry 1: FC03 (Read Holding Registers), variable-length, payload up to 125 registers
   • Entry 2: FC06 (Write Single Register)
   • Entry 3: FC10h (Write Multiple Registers), payload up to 123 registers
   • Entry 4: FC17h (Read/Write Multiple Registers), payload up to 121 read + 121 write registers
4. Bind each entry to the connection number configured in Section 5.

7. Ladder-Side Invocation Example

Use the SP.ECPRTCL instruction to dispatch the protocol entries. A minimal ST example (compatible with FX5U Ver. 1.060+) that issues FC17 (Read/Write Multiple Registers) every 100 ms:

// Inputs
VAR
    bStart        : BOOL;          // Start trigger
    wChannel      : WORD := 1;     // Connection number 1
    wProtocolNo   : WORD := 4;     // Protocol entry 4 = FC17
    wReadAddr     : WORD := 16#0000; // Modbus address 0
    wReadQty      : WORD := 8;     // Read 8 holding regs
    wWriteAddr    : WORD := 16#0100; // Write start 256
    wWriteQty     : WORD := 8;     // Write 8 regs
    wUnitID       : WORD := 1;     // Modbus Unit ID 1
    wDone         : WORD;
    wError        : WORD;
END_VAR

IF bStart THEN
    SP_ECPRTCL(
        i_ConnNo      := wChannel,
        i_ProtocolNo  := wProtocolNo,
        i_UnitId      := wUnitID,
        i_ReadAddr    := wReadAddr,
        i_ReadQty     := wReadQty,
        i_WriteAddr   := wWriteAddr,
        i_WriteQty    := wWriteQty,
        o_Done        => wDone,
        o_Error       => wError
    );
END_IF;

The Predefined Protocol block handles the MBAP header construction (Transaction ID, Protocol ID 0, Length, Unit ID) and the FC17 PDU assembly automatically. Bind the resulting registers into device memory ranges D1000..D1015 for read and D2000..D2015 for write.

8. Error Code Reference

9. Diagnostic Workflow

1. From GX Works 3, select Online → Ethernet Diagnosis. Confirm the connection row shows Status = Connected and System = Active Open Complete.
2. If Status remains Disconnected, open Module Diagnostic on the Ethernet port and check Open Error Log. Look for 2822H entries – they indicate the parameter validator rejected the active open attempt.
3. Use Device Memory Monitor on the binding area (D1000..D1015). Each FC03 / FC17 read should populate the read window within the configured timeout (default 3 s; configurable in Predefined Protocol Settings → Communication Timeout).
4. Capture a packet trace with Wireshark on a SPAN port of the managed switch. Filter for tcp.port == 502. Verify the FX5U issues a proper SYN to 192.168.0.81:502 and that the server responds with SYN-ACK; an immediate RST indicates the server is not bound to port 502 or is on a different VLAN.
5. Force a single FC03 read with Protocol Execution Tool (bundled in the protocol library) to isolate ladder logic faults from parameter faults.

10. Verification Procedure

1. Write a single test register (FC06) to holding register 0x0000 with value 16#0001. Confirm the server registers the write.
2. Read register 0x0000 (FC03, qty=1) and verify the response value equals 16#0001.
3. Run FC17 with qty=8 read from 0x0000 and qty=8 write to 0x0100, looped 100 times. Confirm zero SP_ECPRTCL errors and zero C4xx runtime faults.
4. Power-cycle the FX5U and confirm the active connection re-establishes within the configured Reconnect Interval (default 2 s) without manual intervention.

11. Troubleshooting Matrix

12. Field Notes and Best Practices

• Always ping the target server from a laptop on the same subnet before commissioning the FX5U. Many 2822H-style faults are downstream of a simple Layer 3 mismatch.
• Reserve source port 1282 or higher; ports below 1024 on the FX5U side may conflict with system services on the CPU. The IANA dynamic range (49152..65535) is recommended for greenfield designs.
• For mixed-vendor deployments (e.g., FX5U ↔ Schneider M340 ↔ Wago 750), maintain a connection number map – each Modbus target gets its own connection number 1..8 on CH1.
• Document the protocol number ↔ function code mapping inside the GX Works 3 project header comments. This prevents future maintenance engineers from confusing FC03 (Read Holding) with FC04 (Read Input) when adding new entries.
• When using FX5-ENET (separate module), the second channel is configured independently under FX5-ENET in Navigation. Active Connection Module must be re-selected on each module's parameter page.
• For safety or SIL-rated I/O (e.g., Crevis S-IO), confirm the Predefined Protocol block does not collide with the CC-Link IE Field Basic slot the safety device is bound to. Separate channels are recommended for safety vs. standard Modbus TCP traffic.
• Always update both CPU firmware and GX Works 3 to the latest matched versions before commissioning; cross-version mismatches are a common source of intermittent C4xx faults that disappear after a coordinated update.