Net s7-1200 Modbus TCP en PDF
Net s7-1200 Modbus TCP en PDF
http://support.automation.siemens.com/WW/view/en/83130159
This entry is from the Siemens Industry Online Support. The general terms of use
(http://www.siemens.com/terms_of_use) apply.
Caution
The functions and solutions described in this article confine themselves to the
realization of the automation task predominantly. Please take into account
furthermore that corresponding protective measures have to be taken up in the
context of Industrial Security when connecting your equipment to other parts of the
plant, the enterprise network or the Internet. Further information can be found
under the Content-ID 50203404.
http://support.automation.siemens.com/WW/view/en/50203404
Siemens AG 2015 All rights reserved
Copyright
Table of contents
1 Introduction ........................................................................................................ 4
2 Modbus TCP Client User Program ................................................................... 5
2.1 FC1 "Read_HoldingRegister" ............................................................... 5
2.2 FC4 "Write_HoldingRegister" ............................................................... 7
2.3 Input and Output Parameters of the "MB_CLIENT" Instruction ........... 9
2.4 Parameters MB_MODE and MB_DATA_ADDR ................................ 10
3 Modbus TCP Server User Program ................................................................ 12
3.1 FC1 "Read_HoldingRegister" ............................................................. 12
3.2 FC4 "Write_HoldingRegister" ............................................................. 13
3.3 Input and Output Parameters of the "MB_SERVER" Instruction ....... 15
4 How to Use the Sample Program ................................................................... 17
4.1 How to Use the User Program in the Modbus TCP Client ................. 17
4.2 How to Use the User Program in the Modbus TCP- Server .............. 19
Siemens AG 2015 All rights reserved
Copyright
1 Introduction
Modbus TCP communication between two S7-1200 CPUs is presented. The
instructions "MB_CLIENT" and "MB_SERVER" are called and parameterized in the
user program of the S7-1200 CPU.
The "MB_CLIENT" instruction communicates as Modbus TCP client over the
PROFINET connection of the S7-1200 You do not need any additional hardware to
use the instruction. You use the "MB_CLIENT" instruction to establish a connection
between the client and the server, send requests and receive responses, and
control the connection disconnection of the Modbus TCP server.
The "MB_SERVER" instruction communicates as Modbus TCP server over the
PROFINET connection of the S7-1200 You do not need any additional hardware to
use the instruction. The "MB_SERVER" instruction processes connection requests
of a Modbus TCP client, receives requests from Modbus functions and sends
response messages.
In this example 2 Modbus functions are presented. For each Modbus function a
Modbus TCP connection is established over a Modbus block pair (MB_CLIENT
and MB_SERVER).
Figure 1-1 shows an overview of the Modbus functions presented in this example
and the Modbus block pair assignment.
Siemens AG 2015 All rights reserved
Figure 1-1
Modbus Function: 03
Read holding register
Read_ Read_
MB_ MB_
Holding Holding
register CLIENT SERVER register
MAIN MAIN
[OB 1] [OB 1]
Copyright
Modbus Function: 16
Write to multiple
Write_ holding registers Write_
MB_ MB_
Holding Holding
Register CLIENT SERVER Register
Figure 2-1 shows the call and parameters of the "MB_CLIENT" instruction in FC1.
Figure 2-1
Siemens AG 2015 All rights reserved
Copyright
Note Section 2.3 Input and Output Parameters of the "MB_CLIENT" Instruction gives
an overview and description of the input and output parameters of the
"MB_CLIENT" instruction.
Receive buffer
At parameter MB_DATA_PTR you specify the buffer for the data received from the
Modbus TCP server. The data read from the holding register is stored in DB1
“RD_HoldingRegister” starting with address 0.
Table 2-2
Variable name Data type Address in DB1
Read_HoldingRegister Array [0..4] of Word 0.0
Error evaluation
If the "MB_CLIENT" instruction terminates with an error in FC1, the error code of
the STATUS parameter is stored in variable “ID1_MB_CLIENT_STATUS_SAVE” of
DB7 “DATA” for error evaluation.
Figure 2-2
5 data words are written to the holding register of the Modbus TCP server. For this
you set the input parameters MB_MODE, MB_DATA_ADDR and MB_DATA_LEN
as follows:
MB_MODE = 1
MB_DATA_ADDR = 40001
MB_DATA_LEN = 5
Copyright
Figure 2-3 shows the call and parameters of the "MB_CLIENT" instruction in FC4.
Figure 2-3
Siemens AG 2015 All rights reserved
Copyright
Note Section 2.3 Input and Output Parameters of the "MB_CLIENT" Instruction gives
an overview and description of the input and output parameters of the
"MB_CLIENT" instruction.
Send buffer
At parameter MB_DATA_PTR you specify the buffer for the data to be sent to the
Modbus TCP server. The data to be written to the holding register is stored in DB8
“WR_HoldingRegister” starting with address 0.
Table 2-3
Variable name Data type Address in DB1
Write_HoldingRegister Array [0..4] of Word 0.0
Error evaluation
If the "MB_CLIENT" instruction terminates with an error in FC4, the error code of
the STATUS parameter is stored in variable “ID4_MB_CLIENT_STATUS_SAVE” of
DB7 “DATA” for error evaluation.
Figure 2-4
Output parameters
Siemens AG 2015 All rights reserved
Table 2-6 shows the relationship between the MB_MODE parameter of the
Modbus function used in this example and the address area.
Table 2-6
MB_MODE Modbus function Data length Function and MB_DATA_ADDR
data type
0 03 1 to 125 Read holding 40001 to 49999
register
1 to 125
WORDs per
call
1 16 2 to 123 Write to 40001 to 49999
multiple
holding
registers
2 to 123
WORDs per
call
Siemens AG 2015 All rights reserved
Copyright
Figure 3-1 shows the call and parameters of the "MB_SERVER" instruction in FC1.
Figure 3-1
Copyright
Note Section 3.3 Input and Output Parameters of the "MB_SERVER" Instruction gives
an overview and description of the input and output parameters of the
"MB_SERVER" instruction.
MB_HOLD_REG parameter
The MB_HOLD_REG parameter is a pointer to a data buffer for storing the data
that is read from or is to be written to the Modbus server. You can use a global
data block or a marker as memory area. The table below shows how the Modbus
addresses are mapped to the holding register for the Modbus function 3 (read
WORD).
Table 3-2
Modbus address Absolute Symbolic name
address
40001 DB1.DBW0 "HoldingRegister".Read_HoldingRegister[0]
40002 DB1.DBW2 "HoldingRegister".Read_HoldingRegister[1]
40003 DB1.DBW4 "HoldingRegister".Read_HoldingRegister[2]
40004 DB1.DBW6 "HoldingRegister".Read_HoldingRegister[3]
40005 DB1.DBW8 "HoldingRegister".Read_HoldingRegister[4]
Error evaluation
If the "MB_SERVER" instruction terminates with an error in FC1, the error code of
the STATUS parameter is stored in variable “ID1_MB_SERVER_STATUS_SAVE”
of DB7 “DATA” for error evaluation.
Siemens AG 2015 All rights reserved
Figure 3-2
Copyright
Figure 3-3 shows the call and parameters of the "MB_SERVER" instruction in FC4.
Figure 3-3
Siemens AG 2015 All rights reserved
Note Section 3.3 Input and Output Parameters of the "MB_SERVER" Instruction gives
an overview and description of the input and output parameters of the
"MB_SERVER" instruction.
MB_HOLD_REG parameter
The MB_HOLD_REG parameter is a pointer to a data buffer for storing the data
that is read from or is to be written to the Modbus server. You can use a global
Copyright
data block or a marker as memory area. The table below shows how the Modbus
addresses are mapped to the holding register for the Modbus function 16 (write
multiple WORDs).
Table 3-3
Modbus address Absolute Symbolic name
address
40001 DB1.DBW10 "HoldingRegister".Write_HoldingRegister[0]
40002 DB1.DBW12 "HoldingRegister".Write_HoldingRegister[1]
40003 DB1.DBW14 "HoldingRegister".Write_HoldingRegister[2]
40004 DB1.DBW16 "HoldingRegister".Write_HoldingRegister[3]
40005 DB1.DBW18 "HoldingRegister".Write_HoldingRegister[4]
Error evaluation
If the "MB_SERVER" instruction terminates with an error in FC4, the error code of
the STATUS parameter is stored in variable “ID4_MB_SERVER_STATUS_SAVE”
of DB7 “DATA” for error evaluation.
Figure 3-4
Output parameters
The "MB_SERVER" instruction has the following output parameters.
Table 3-5
Output parameters Data type Description
NDR BOOLEAN New Data Read
0: No new data.
1: New data written by the Modbus client
DR BOOLEAN Data Read
0: No new data read.
1: Data read by the Modbus client
ERROR If an error occurs while the "MB_SERVER"
instruction is being called, the output at the
ERROR parameter is set to "1". Detailed
information about the cause of error is displayed
at the STATUS parameter.
STATUS WORD Detailed Status information of the instruction.
Siemens AG 2015 All rights reserved
Copyright
Figure 4-2
Siemens AG 2015 All rights reserved
Read values from the holding register of the Modbus server and write values to the
holding register of the Modbus server
When the online connection to the CPU 1217C has been established successfully
you click the "Monitor All" button in the "Watchtable_CPU1217C" monitoring table.
The current values are displayed in the "Monitor value" column.
Figure 4-3
Copyright
1. Set the marker M1.0 "REQ_ID1" to the value "1" to execute the job to read
from the holding register. For this you enter the modify value "TRUE" for the
marker M1.0 "REQ_ID1".
2. Set the marker M1.3 "REQ_ID4" to the value "1" to execute the job to write to
the holding register. For this you enter the modify value "TRUE" for the marker
M1.3 "REQ_ID4".
3. In the CPU 1217C (Modbus client), the values to be written are stored in the
DB8 "WR_HoldingRegister". In the "Modify value" column you enter the values
that the Modbus client writes to the holding register of the Modbus server.
4. Click the "Modify all enabled values "once and immediately"" button to set the
entered modify values as the current values.
5. In the CPU 1217C the read values are stored in the
DB1 “RD_HoldingRegister". The read values are displayed in the "Monitor
value" column.
Figure 4-4
Siemens AG 2015 All rights reserved
5
Copyright
Figure 4-5
Siemens AG 2015 All rights reserved
When the online connection to the CPU 1211C has been established successfully
you click the "Monitor All" button in the "Watchtable_CPU1211C" monitoring table.
The current values are displayed in the "Monitor value" column.
Figure 4-7
1. In the CPU 1211C (Modbus server), all the data to be read is stored in the
DB1starting with address 0. In the "Modify value" column you enter the values
thatthe Modbus client reads from the holding register of the Modbus server.
2. Click the "Modify all enabled values "once and immediately"" button to set the
entered modify values as the current values.
Siemens AG 2015 All rights reserved
3. In the CPU 1211C (Modbus server), all the written data is stored in the DB1
starting with address 10. The written values are displayed in the "Monitor
value" column.
Figure 4-8
Copyright