Introduction

This article explains how to connect a NB HMI to a S7-1200 using Modbus TCP.

Content

• Required Equipment
• Modbus TCP Communication between NB HMI and S7-1200 PLC
• Functions of the S7-1200 PLC as Modbus TCP Server
• Example NB-Designer Project

1. Required Equipment

• NB HMI -TW01B Model
• Simatic S7-1200 (with firmware v2.1 or higher)

2. Modbus TCP Communication between NB HMI and S7-1200 PLC

The following example details the configuration of Modbus TCP communications for access to inputs, outputs and data blocks of the PLC from the HMI.

Programming the S7-1200 PLC as Modbus TCP Server

Configuring the Profinet port:

Programming MB_Server blocks:
Create multiple MB_Server blocks with an ID (CONNECT_ID) and a virtual port number (IP_Port). Each data block defines a different block of data to be shared between the configured devices. The MB_Server block can be found at ‘Instructions’ -> ‘Communication’.

Note: The access to the I/O data is independent of the Modbus holding register set in the MB_SERVER blocks, because this block allows that the Modbus functions (1,2,4,5 and 15) can read and write bits and words directly in the process image of the inputs and outputs of the S7-1200.

Memory area ‘M’ can be addressed by ANY pointer format: P # "bit address" "data type" "length" in the Modbus Holding Register parameter of the MB_Server block.

The MB_Server block with Modbus Holding Register addressing the global memory area ‘DB’ uses the data block called "MODBUS". The data block contains the following data:

Programming the NB HMI as Modbus TCP Client

When using the protocol Modbus TCP with the PLC as slave and the NB HMI as master, the network configuration is as follows:

Modbus Function codes supported by the NB HMI:

Network Configuration

Add two PLC Modbus TCP Slaves and configure them with the IP address of the S7-1200.

Each slave (or server) must have the same port and station number (or ID) that is assigned in their corresponding MB_SERVER block.

Accessing PLC Data

The following steps describe how to access the PLC addresses from the NB HMI using variables in the ‘Variable Table’ in the programming software ‘NB-Designer’.

Note: The access to the inputs and outputs data of the PLC is independent of the holding register that is indicated in MB_Server block.

Accessing the PLC inputs at bit level

Set the parameter ‘Area’ to ‘1x’.

The input addresses are correlated; i.e. ‘Address’ 1 is the first input (I0.0), ‘Address’ 2 is the second input (I0.1), etc.

Accessing the PLC outputs at bit level

Set the parameter ‘Area’ to ‘0x’.

The output addresses are correlated; i.e. ‘Address’ 1 is the first output (Q0.0), ‘Address’ 2 is the second output (Q0.1), etc.

Accessing the PLC inputs at register level

To read the inputs at register level, set the parameters ‘Memory Type’ to Word and ‘Area’ to 3x.

Example of reading and writing inputs and outputs at but and register level:

Accessing the PLC registers

To access registers in read and write mode with size WORD or DWORD, set the parameter ‘Area’ to 4x.

Address 1 will point to the first word of the array established in the parameter MB_HOLD_REG of the corresponding MB_Server block.

The MB_Server block provides the possibility to access two different data types, the memory area M and data blocks DB.

The following NB-Designer programming example shows variables that communicate with both memory areas.

Register of memory address M: PLC ‘Area’ that is referred with DW2 and DW0.

Registers (word type) of data block DB3 called "MODBUS": PLC directions that are referred with DB3.DBW2 and DB3.DBW0.

Example of reading and writing registers at bit and register level:

To access the registers at DWORD data length, the level must be configured for the channels as follows:

While accessing memory areas at byte level, such as DB’s created from byte sized data structures, please keep note that the NB HMI works at Words level so it will be necessary to use two bytes of the PLC for writing / reading. NB components cannot access 8-bit variables in the S7 PLC.

Note: Please note the equivalence between the word allocation of the NB and S7-1200. For example, when replacing words of Word size in the S7-1200, MW0 to MW5 with the NB equivalent Word size will obtain the following relation: MW0, MW2 and MW4 are replaced by addresses 1, 2 and 3.

MW1 and MW3 cannot be replaced because they have no equivalent.

3. Functions of the S7-1200 PLC as Modbus TCP Server

To perform Modbus TCP communication of the S7-1200 PLC as the server, the MB_SERVER block should be used. This block communicates as a Modbus TCP server via the PROFINET connector of the S7-1200 CPU.

The MB_SERVER block can accept a request to connect to a Modbus TCP client, receive a request from Modbus function and send a response.

Description and data types for MB_SERVER block parameters:

MB_SERVER allows incoming Modbus function codes (1, 2, 4, 5, and 15) to read or write bits and words directly in the input process image and output process image of the S7-1200 CPU as shown in the following table:

Incoming Modbus message function codes (3, 6, and 16) read or write words in a Modbus holding register which can be an M memory address range or a data block.

The register that is specified in the MB_HOLD_REG parameter must be defined as a data type more than one byte and must be located in a range of M memory addresses or in a DB data block.

For a Modbus holding register in memory M, use the standard pointer format ANY as follows:

ANY Format: P # "bit address" "data type" "length"
Example: P # M0.0 WORD 1000

Note: The actual upper limit of DB addresses is determined by the maximum work memory limit and M memory limit of the respective model of the S7-1200.

Multiple Server Connections

The PLC can create multiple server connections, through which you can make multiple concurrent connections with multiple Modbus TCP Modbus clients or, as is the case with the NB HMI, establish multiple clients with the same equipment to share different memory areas.

Individual server connection must follow these rules:

• Each MB_SERVER connection must use a distinct instance DB.
• Each MB_SERVER connection must be established with a unique IP port number. Only 1 connection per port is supported.
• Each MB_SERVER connection must use a unique connection ID.
• The MB_SERVER must be called individually for each connection (with its respective instance DB).

In summary, the instance DB and the connection ID are paired and must be unique for each connection.

4. Example NB-Designer Project

The attachment: 'Connecting NB to S7-1200' is a example NB-Designer project containing the network configuration, addressing multiple registers in the S7-1200 PLC.