Siemens SIMATIC S7-1200 - Page 1258

Communication processor and Modbus TCP
13.8 Legacy Modbus TCP communication
S7-1200 Programmable controller
1258 System Manual, V4.2, 09/2016, A5E02486680-AK
Table 13- 136 Data types for the parameters
Parameter and type
Data type
Description
DISCONNECT IN Bool MB_SERVER attempts to make a "passive" connection with a partner device.
This means that the server is passively listening for a TCP connection request
from any requesting IP address.
If DISCONNECT = 0 and a connection does not exist, then a passive connec-
tion can be initiated.
If DISCONNECT = 1 and a connection exists, then a disconnect operation is
initiated. This allows your program to control when a connection is accepted.
Whenever this input is enabled, no other operation will be attempted.
CONNECT_ID IN UInt CONNECT_ID uniquely identifies each connection within the PLC. Each
unique instance of the MB_CLIENT or MB_SERVER instruction must contain a
unique CONNECT_ID parameter.
IP_PORT IN UInt Default value = 502: The IP port number that identifies the IP port that will be
monitored for a connection request from a Modbus client.
These TCP port numbers are not allowed for a MB_SERVER passive connec-
tion: 20, 21, 25, 80, 102, 123, 5001, 34962, 34963, and 34964.
MB_HOLD_REG IN_OUT Variant Pointer to the MB_SERVER Modbus holding register: The holding register
must either be a non-optimized global DB or a M memory address. This
memory area is used to hold the values a Modbus client is allowed to access
using Modbus register functions 3 (read), 6 (write), and 16 (write).
NDR OUT Bool New Data Ready: 0 = No new data, 1 = Indicates that new data has been
written by a Modbus client
DR OUT Bool Data Read: 0 = No data read, 1 = Indicates that data has been read by a
Modbus client.
ERROR OUT Bool The ERROR bit is TRUE for one scan, after MB_SERVER execution was
terminated with an error. The error code value at the STATUS parameter is
valid only during the single cycle where ERROR = TRUE.
STATUS
OUT
Word
Execution condition code
MB_SERVER allows incoming Modbus function codes (1, 2, 4, 5, and 15) to read or write
bits and words directly in the input process image and output process image of the S7-1200
CPU. For data transfer function codes (3, 6, and 16), the MB_HOLD_REG parameter must
be defined as a data type larger than a byte. The following table shows the mapping of
Modbus addresses to the process image in the CPU.
Table 13- 137 Mapping of Modbus addresses to the process image
Modbus functions
S7-1200
Codes
Function
Data area
Address range
Data area
CPU address
01
Read bits
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7
02
Read bits
Input
10001
To
18192
Input Process Image
I0.0 to I1023.7
04
Read words
Input
30001
To
30512
Input Process Image
IW0 to IW1022
05
Write bit
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7
15
Write bits
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7