1. 2. 3.

1. 2. 3.

1.

2.

3.

1.

2.

TIA Portal V13 - S7-1200 PLC Modbus TCP Server & Modbus TCP Client

Needs revision

This page contains information about how to configure a Modbus TCP/IP Server on S7-1200 PLCs. It provides a description of the required settings and instruction. It also shows how to configure and read/write data using a Modbus Client.

Using TIA Portal V13 we are going to:

Configure the PLC in order to set up a Modbus TCP/IP server.Develop a small application software for the PLC to allow data exchange using Modbus TCP/IP.Test the application software using a Modbus TCP/IP client. 

Prerequisites:

Windows PC with TIA Portal V13 and its updates .installedAn S7-1200 PLC or the PLC Simulator installed (might not work with the Modbus Client)Modbus Client (e.g. )CAS Modbus Scanner

Update: you can find for download, usage and tests the TIA Portal V13 project similar to the one presented in the step-by-step guide. The Heresoftware can be extracted using TIA portal retrieve option from it's menu.

Note: If you are planning to use it on a physical PLC make sure to change the PLC in the project with the one available in your test-bench.

You can change the PLC by right clicking on the PLC in the (see step 9) and select .network view Change device

This is a step-by-step guide which shows how to set up the Modbus Server on S7-1200 device and how to read data from it using a Modbus Client.

Every application has to process information and prepare the date to be read or process received data.

Step-by-step guide:

S7-1200 :: Create a project, insert and configure a PLC

Open TIA Portal V13 

Create a new project in desired working folder

Switch working environment to Project view

S7-1200 :: Software application for Modbus TCP IP server

Expand in Project explorerPLC section

Add a new data block with variables for Modbus software configuration.

PLC Simulator and Modbus Client

If you are using PLC Simulator, in order to have a solid test-bench it would be good to have a second PC/notebook to run the Modbus Client.

3.

4.

5.

6.

7.

2.

a.

b.

c.

d.

3. a.

b.

c.

d.

i. ii.

Open Devices & networks from project explorer

Slide out the  from the right side of the Hardware Catalog Devices & Networks

Every Siemens equipment has its own . catalog numberIdentify on the equipment (e.g. PLC, HMI) its catalog number for correct software development ( e.g. Siemens Catalog numbers example  )6ES7-215-1HG40-0XB0

Search for equipment catalog number in the catalog menu and make sure you select the (you might right firmware version bric

if not properly selected):k the device

Double click on: (the following window Add new block shall appear)

On left side select  and complete the Data Block information as can be observed in the above image. (Default data block settings should work also. This approach is preferred in order to have a better organized application software) Click OK and a new Data Block with the introduced name shall be created in section and program blocksopen in the main editor.If not opened, open the previously created Data Block from program blocks and define the following variables as can be observed in the following image. These variables are required for software configuration of Modbus TCP/IP driver.

Add a new function block and load Modbus variables with data.Double click on:  (the following window Add new block shall appear)

On left side select  and complete the Function information as can be observed in the above image. Programming language shall be Ladder.Click OK and a new with the introduced Functionname shall be created in   section and program blocksopen in the main editor.In the first network initialize the defined Modbus variables as can be observed in the following image:

Make use of autocomplete features

7.

8.

9.

a.

10. a.

b.

3.

d.

ii.

iii.

iv. v.

e.

i.

ii.

f.

i.

ii.

Double click on the device or drag and drop it under  Network or  work spaces / tab. view  Device view  Wait........ 

Prepare for configuration of the introduced PLC from either Netor  work spaces / tabwork view  Device view 

Select the device and make sure tab is Propertiesselected

Minimum configuration requirementsConfigure the Ethernet address (this IP address must by in the same class as for other equipments: Baxter, HMI, OPC server, etc)Supplementary you can add a new subnet

"Local~Profinet_interface_1" - is the variable which holds the hardware address of the Ethernet Port. Depending on the PLC you have it might not be 64 (autocomplete should introduce the right hardware address)2 - is the reference to this connection. If several instances of Modbus server functionality are required they need uniquely identifiable references.11 - is the reference for Modbus TCP.We use a passive connection type.

Add the second network and initialize a second set of Modbus variables as can be observed in the following image:

These variables are used to allow connection establishment for host with a specific IPInitializing them with value of (e.g. IP host: 00.0.0.0) means that hosts regardless there IP are allowed to query or send data from and to PLC.

Add the third network and initialize another set of Modbus variables as can be observed in the following image:

These variables are used to configure the remote and local ports used to exchanged data over TCP/IP protocol.

10.

c.

d.

e.

f.

11. a.

3.

f.

ii.

iii.

g.

i.

ii.

1. 2.

3.

4.

Enable web server access

Suplimentar se va configura si un user cu drepturi de administrator:

Startup settings

System and clock bits (Clock bites starting from memory byte MB201 and System bytes starting from memory byte MB202 )

Time of day

Compile hardware configuration from Project tree:Right click on the PLC from the Project tree and compile hardware configuration. Errors shall not be found.

Remote port = - means accepting 0connection from partner regardless port numberLocal port = - is the port at which PLC 502listens for connection requests.

Add a new network, slide-out the instructions panel from the right side of the TIA portal environment, search for MB_Server instruction and drag and drop it in the created network. Configure it as in the image bellow

After you drop it in the created network the instruction which requires an Data Block instance for usage will ask for a name and number. Use: MB_SERVER_DB150 and number of Data Block 150. This block shall be created in system blocks section and should be read-only protected.

Afterwards, we configure the MB_Server as follows:

Never disconnectWe provide a pointer type path for where Modbus data can be found. ( P#DB152.DBX0.0 WORD 10 ). WORD 10 means that the server exchanges 10 words(16 bits) of data which in Modbus addresses translates to 40001 to 40011 holding registers.Note: DB152 where Modbus data can be found was not created yet.Select the connection type to passive (as previously configured).

11. a.

12.

3.

g.

4.

a. b.

c.

d.

e.

5.

Continue with the application software development on the right side of the page

Add a new data block (see step 2) with data exchanged over Modbus. Name of Data Block shall be: DB152_MODBUS_DATAand data block number: .152

After data block is created, close it. Select it in section and right click on program blocksit and select Properties

the property and Uncheck optimized block access click OK.

 Open it again and define the following variables:

4000x is a terminology specific to Modbus communication protocol and it refers to a holding register. A holding register is a data of type word.

Open  function if not open and add a FC150_Communicationnew network. We will create a small logic to identify the number of communication queries and errors. This network has no influence in the communication itself but is useful for diagnose.

5.

6.

7.

1.

a. b.

Make sure to call in Main FC150_CommunicationOrganizational Block ( ) which is called by PLC operating OB1system every PLC cycle. Open OB1 and in a network call FC150_Communication:

In project tree, right click on PLC_1 and select . If Compile Alleverything was done as described no errors shall appear.

Note: Exchanged holding registers which can be found in DB152_MODBUS_DATA is all 0 right now.

CAS Modbus Scanner :: Configuration

After   was downloaded, the communication connection configuration needs to be done:CAS Modbus Scanner

Add a task and a connection parameters. We are interested in TCP connection configuration options.

 

Make sure to configure the IP address in the same IP range with the PLC

Insert the Port number as set in the PLC Modbus Connection variables.Configure a Timeout.

c.

2. a. b.

3. a.

b. c.

i. d. e.

Click Add TCP Connection

Having the new connection selected, press on Add Device button:Slave ID it is not important since we are IP based (this is important for Modbus RTU).Still, Matrikon likes it to be the number of the Modbus Instance inside PLC Modbus Driver.

Having the new device selected, press the Add Request or Add Write buttons, in order to read or write to a specific Modbus address:Since S7-1200 is not a Modbus native device, it is better to use and encode information in holding registers, therefore make sure that the selected Modbus Function for read is 03 = Read Holding registers and for write is 10 = Force Multiple RegistersInsert the offsetMake sure the length of the holding register (or the offset + length ) which need to be read/write is not greater than:

configured in S7-1200 application software: please see points   and 3.g.ii.2 4.dIf you use a write function insert also the write valueRead holding registers

3.

f.

4. 5.

a. b. c.

1. a. b.

2. 3.

a. i. ii. iii.

Write holding registers

After you finish introducing the required requests and writes press OK of the window.Select the required request or write function and press Poll to get or write the data.

If you need to write or read periodically use the Auto refresh option.watch the result of write/read requests on the output console.Note: If software was not downloaded into PLC the output console might show some errors or timeout error.

S7-1200 :: Download to PLC start PLC Simulation environmentor

Download application software to PLC 

Before downloading the application software into PLC make sure you have compiled the application software:Right click on PLC in project tree and select Compile -> Hardware (rebuild all)Right click on PLC in project tree and select Compile -> Software (rebuild all blocks)

Make sure you have power on the PLC and connected to a Ethernet network.In my experience with S7-1200 they have some hangs if software is tried to be fully downloaded (hardware configuration + application software). Therefore:

Right click on PLC in project tree and select Download to device -> Hardware configurationThe extended download to device windows shall pop-up.Select the interface used to connect to the PLC. This is usually the network card or wireless adapterPress button...and if you have connection with the device by means of router/switch it should appear in the list Searchbellow

3.

a.

iv.

v.

vi. b.

i. 4.

5. a.

Press buttonLoad

If everything went fine while downloading the hardware configuration you should see the next image:

Pressing the  button shall start the PLC (still we don't have the application software)Finish Right click on PLC in project tree and select Download to device -> Software

Basically previous steps: from point a should repeat.i to vGo online ! by pressing the Go Online Button:

When your online you shall be able to monitor data or the application software:Observe the project tree in order to see if everything went fine (green indicators)

5.

b.

1. 2. 3.

a. b.

4. a.

5. a. b.

6. a.

Open the data block used to exchange data with other Modbus devices and monitor it

Modbus TCP/IP :: Read / Write to and from PLC

If PLC software was successfully downloaded into the PLC it's time exchange data with the PLC using Modbus TCP communication protocol:

Open the Modbus Client that we have configured.Make sure that IP addresses are right.From the CAS Modbus Scanner :: Configuration topic we added a new read request. Therefore we have:

A write request to the Holding Register 40001A read request for the Holding Registers 40001 and 40002

Select the write request and press the button:PollYou shall be able to observe that the address 40001 was written with hexadecimal value 0x0024 which is 36 in decimal. 

Before reading the 2 holding registers let's modify the value of 40002 register:Right click on 40002 variable within DB152_MODBUS_DATA data block and select modify operand.Write the value and select also the data type (I used 101 in decimal)

Select the read request and press the button:PollYou shall be able to observe in CAS Modbus Scanner the read value from the PLC

 

PLC Simulator

Note: If you run the application software in PLC Simulator and try to use the Modbus Scanner to read/write data to PLC Simulator might not work.