Siemens SIMATIC S7-1200 - Page 1181

Communication processor and Modbus TCP
13.5 Modbus communication
S7-1200 Programmable controller
System Manual, V4.2, 09/2016, A5E02486680-AK
1181
●
RemoteAddress
: There are two options.
– Use 0.0.0.0 and MB_CLIENT will respond to a Modbus request from any TCP client
– Enter the IP address of a target Modbus TCP client and MB_CLIENT only responds to
a request originating from this client's IP address. For example, enter 192.168.2.241,
as in the previous image.
●
RemotePort
: This value must be 0, for an MB_SERVER connection.
●
LocalPort
: The default is 502. This number is the IP port number of the Modbus client that
MB_SERVER attempts to connect and communicate with. Some third-party Modbus
clients require another port number.
Modbus and process image addresses
MB_SERVER allows incoming Modbus function codes (1, 2, 4, 5, and 15) to read/write
bits/words directly in the input/output process image. For data transfer function codes (3, 6,
and 16), the MB_HOLD_REG parameter must be defined as a data type larger than a byte.
The following table shows the mapping of Modbus addresses to the process image in the
CPU.
Table 13- 64 Mapping of Modbus addresses to the process image
Modbus functions
S7-1200
Codes
Function
Data area
Address range
Data area
CPU address
01 Read bits Output 1 To 8192 Output Process Image Q0.0 to Q1023.7
02
Read bits
Input
10001
To
18192
Input Process Image
I0.0 to I1023.7
04 Read words Input 30001 To 30512 Input Process Image IW0 to IW1022
05
Write bit
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7
15
Write bits
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7
Incoming Modbus message function codes function codes (3, 6, and 16) read/write words in
a Modbus holding register, which can be in M memory or a data block. The type of holding
register is specified by the MB_HOLD_REG parameter.
Note
MB_HOLD_REG parameter assignment
Modbus holding registers defined as arrays of word, integer, wide character, unsigned
integer, byte, short integer, unsigned short integer, character, double word, double integer,
unsigned double integer, or real
can be placed in any memory area.
Modbus holding registers defined as structures must be placed in non
-optimized DBs.
For a Modbus holding register in M memory, use the Any Pointer format. This is in the format
P#"Bit Address" "Data Type" "Length". An exa
mple would be P#M1000.0 WORD 500