Siemens S7-1200 - Page 737

Communication processor and Modbus TCP
12.5 Modbus communication
S7-1200 Programmable controller
System Manual, 03/2014, A5E02486680-AG
737
Parameter and type
Data type
Description
IP_PORT IN UInt Default value = 502: The IP port number that identifies the IP port that will be
monitored for a connection request from a Modbus client.
These TCP port numbers are not allowed for a MB_SERVER passive
connection: 20, 21, 25, 80, 102, 123, 5001, 34962, 34963, and 34964.
MB_HOLD_REG IN_OUT Variant Pointer to the MB_SERVER Modbus holding register: The holding register
must either be a standard global DB or a M memory address. This memory
area is used to hold the values a Modbus client is allowed to access using
Modbus register functions 3 (read), 6 (write), and 16 (write).
NDR OUT Bool New Data Ready: 0 = No new data, 1 = Indicates that new data has been
written by a Modbus client
DR OUT Bool Data Read: 0 = No data read, 1 = Indicates that data has been read by a
Modbus client.
ERROR OUT Bool The ERROR bit is TRUE for one scan, after MB_SERVER execution was
terminated with an error. The error code value at the STATUS parameter is
valid only during the single cycle where ERROR = TRUE.
STATUS
OUT
Word
Execution condition code
MB_SERVER allows incoming Modbus function codes (1, 2, 4, 5, and 15) to read or write
bits and words directly in the input process image and output process image of the S7-1200
CPU. For data transfer function codes (3, 6, and 16), the MB_HOLD_REG parameter must
be defined as a data type larger than a byte. The following table shows the mapping of
Modbus addresses to the process image in the CPU.
Table 12- 57 Mapping of Modbus addresses to the process image
Modbus functions
S7-1200
Codes Function Data area Address range Data area CPU address
01
Read bits
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7
02 Read bits Input 10001 To 18192 Input Process Image I0.0 to I1023.7
04
Read words
Input
30001
To
30512
Input Process Image
IW0 to IW1022
05
Write bit
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7
15
Write bits
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7
Incoming Modbus message function codes function codes (3, 6, and 16) read or write words
in a Modbus holding register which can be an M memory address range or a data block. The
type of holding register is specified by the MB_HOLD_REG parameter.
Note
MB_HOLD_REG parameter assignment
The Modbus Hol
ding Register can be in a standard global DB or an M memory address.
For A Modbus holding register in M memory, use the standard Any Pointer format. This is in
the format P#"Bit Address" "Data Type" "Length".
An example would be P#M1000.0 WORD
500