NEW
Start learning Siemens PLC
programming for free! Get Started now.
TABLE OF CONTENTS
Prerequisites
Setting up a new project in Tia Portal
Configuring the Modbus server
Configuring PLCSIM Advanced 4.0
Configuring the Modbus Poll software
Reading PLC data from Modbus Poll
Writing data from Modbus Poll into the PLC
Configuring the Modbus client
Configuring Modbus slave to read data from
the PLC
Writing data from the PLC to Modbus slave
Conclusion
TUTORIALS / CONFIGURING MODBUS TCP
COMMUNICATIONS IN SIEMENS TIA PORTAL
INTERMEDIATE
Configuring
Modbus TCP
Communications
in Siemens TIA
Portal
PLC PROGRAMMING SIEMENS
INDUSTRIAL NETWORKING TIA PORTAL MODBUS
S7-PLCSIM ADVANCED
By Victory Edema
Introduction
In factory automation, there exists a number
of industrial protocols used for
communication and transmitting data. One
such protocol is the Modbus TCP. Modbus
TCP is a very simple-to-understand and
easy-to-implement industrial protocol.
In this tutorial we'll cover how to configure a
Siemens S71500 PLC as both a Modbus
Client and Modbus server, we will learn how
to read and write data over the Modbus
network, and how to use PLCSIM Advanced
for advanced simulation functions in TIA
Portal.
If this is the first time you are coming across
the Modbus protocol, you should first read
this introductory tutorial.
Prerequisites
In order to follow along with this tutorial, you
will need:
An installation of Tia Portal. In this
tutorial, we will be using Tia Portal
V16.
An installation of PLCSIM Advanced-
V4.0.
An installation of Modbus Poll (a
simulation software that serves as a
Modbus client)
An installation of Modbus Slave (a
simulation software that serves as a
Modbus server)
Setting up a new
project in Tia Portal
Let us start by creating a new project
Once it is opened, add a new device. Here
we have chosen the part number 6ES7 513-
1AL02-0AB0
Next, we set the ethernet address of the PLC
to be 192.168.0.10 by double-clicking on the
ethernet port.
Opening Program blocks and navigating to
OB1 (Main) takes us to the programming
area.
Configuring the
Modbus server
Under the communications tab, click others.
Select Modbus TCP and pick MB_SERVER.
When a call option dialog box prompts
select “OK”.
The programming area should look like this.
This is a description of the parameters
DISCONNECT - With this parameter, you
control the establishment and termination of
the connection to the Modbus server.
MB_HOLD_REG – This is a pointer to the
Modbus holding register of the
"MB_SERVER" instruction. This is a data
block that contains the holding registers
that will be accessed by a Modbus client
using the Modbus functions.
CONNECT – This is a pointer to the structure
of the connection description. The
parameter has the data type TCON_IPV4;
this Includes all address parameters that are
required for establishing a programmed
connection in Siemens. The default address
is 0.0.0.0 (any IP address), but you can enter
a specific IP address so that the server only
responds to requests from this address.
NDR – New Data Ready. 0 no new data and 1
new data written by the Modbus client.
DR – Data Read. 0: No data read and 1: Data
read by the Modbus client
ERROR – If an error occurs during the call of
the "MB_SERVER" instruction, the output of
the ERROR parameter is set to "1". Detailed
information about the cause of the problem
is indicated by the STATUS parameter.
STATUS - Detailed status information of the
instruction.
Create a new Data Block that will contain the
Modbus configuration parameters and
configure it as follows.
Siemens Modbus communication default
port is 502, this can be changed if needed.
The interface ID, 64 is the HW-identifier of
IE-interface submodule. This can be gotten
in the hardware configuration window under
system constant as shown below. Compile
the data block afterward.
Create a new Data Block that will contain the
Modbus data.
On the project tree, right-click on the
Modbus Data DB and select properties then
uncheck the optimize block access under
the attributes pane. This will enable you to
use absolute addressing for this data block.
Finally, compile the data block and you will
have something like this. You will notice that
the offset pane has been added to the data
block.
Configure your main block like this including
all the parameters.
The address structure P#DB3.DBX0.0 BYTE
22 is Siemens's absolute addressing
method. Here,
DB3 is the data block number of MODBUS
DATA.
DBX0.0 means that the starting data offset
in DB3 0.0
BYTE 62 dictates the endpoint of our data
which has the offset number 62.0
Configuring PLCSIM
Advanced 4.0
After launching PLCSIM advanced, click the
button that slides to PLCSIM Virtual Eth.
Adapter. This will create a virtual ethernet
adapter on your workstation.
Now select Start Virtual S7-1500 PLC and
configure as shown in next image. The IP
address is the same as that of the PLC
device we created. Note PLCSIM advanced
will not work for S71200 PLC family.
Click on start to begin the simulation. Your
simulation screen should look like this.
Go over to Tia Portal and download the
program into the simulator. Head over to the
project name under the project tree and
select properties, then under protect tick the
support simulation during block compilation.
In the extend to download screen, select
Siemens PLCSIM Virtual Adapter as the
PG/PC interface then search.
After the PLC device is located load the
program. If an assigned IP address screen
pops up, select yes to continue.
Go online with the PLC and select run in the
PLCSIM advanced software.
Configuring the
Modbus Poll
software
Launch the Modbus poll software and click
on the connect tab.
Under connection select Modbus TCP/IP
and enter the IP address of the PLC in the IP
address column.
Next, select OK to start the Modbus poll
connection.
This shows we have an active Modbus TCP
connection.
Reading PLC data
from Modbus Poll
For Modbus devices, the number of registers
in the Server/Slave must be always more
than or equal to the number of registers to
be read in the Client/Master else an error
will be produced.
For Siemens PLCs, the Discrete Input
register is the Digital Input (DI) of the PLC,
the Coil register is the Digital output (DO) of
the PLC. The Input register is the physical
Analog input to the PLC (AI). This means
that it is only the Holding register that gives
us much flexibility for any type of data in
Siemens.
For this tutorial, we will be reading and
writing to holding registers.
On TIA Portal, navigate to the Modbus Data
register and put in some random values in
both the arrays of Integers and arrays of
Reals on monitor mode.
We have 11 registers of Integer and 11
registers of Real (beginning from 0 to 10).
This gives a total of 33 Integer registers
knowing that two integers (16 Bit) make up a
Real (32 Bit).
Following the rule that the data read by the
client must not be more than the server data,
we will be reading 32 Holding registers data.
On the Modbus Poll simulator, navigate to
Setup and select Read Holding Registers
under function.
In the place of quantity put 31 and select ok.
