How To Connect NB HMI To S7-1200 Using Modbus TCP
This article explains how to connect a NB HMI to a S7-1200 using Modbus TCP.
1. Required Equipment
2. Modbus TCP Communication between NB HMI and S7-1200 PLC
The following example details the configuration of Modbus TCP communications for access to inputs, outputs and data blocks of the PLC from the HMI.
Programming the S7-1200 PLC as Modbus TCP Server
Configuring the Profinet port:
Programming MB_Server blocks:
Note: The access to the I/O data is independent of the Modbus holding register set in the MB_SERVER blocks, because this block allows that the Modbus functions (1,2,4,5 and 15) can read and write bits and words directly in the process image of the inputs and outputs of the S7-1200.
Memory area ‘M’ can be addressed by ANY pointer format: P # "bit address" "data type" "length" in the Modbus Holding Register parameter of the MB_Server block.
The MB_Server block with Modbus Holding Register addressing the global memory area ‘DB’ uses the data block called "MODBUS". The data block contains the following data:
Programming the NB HMI as Modbus TCP Client
When using the protocol Modbus TCP with the PLC as slave and the NB HMI as master, the network configuration is as follows:
Modbus Function codes supported by the NB HMI:
Add two PLC Modbus TCP Slaves and configure them with the IP address of the S7-1200.
Each slave (or server) must have the same port and station number (or ID) that is assigned in their corresponding MB_SERVER block.
Accessing PLC Data
The following steps describe how to access the PLC addresses from the NB HMI using variables in the ‘Variable Table’ in the programming software ‘NB-Designer’.
Note: The access to the inputs and outputs data of the PLC is independent of the holding register that is indicated in MB_Server block.
Accessing the PLC inputs at bit level
Set the parameter ‘Area’ to ‘1x’.
The input addresses are correlated; i.e. ‘Address’ 1 is the first input (I0.0), ‘Address’ 2 is the second input (I0.1), etc.
Accessing the PLC outputs at bit level
Set the parameter ‘Area’ to ‘0x’.
The output addresses are correlated; i.e. ‘Address’ 1 is the first output (Q0.0), ‘Address’ 2 is the second output (Q0.1), etc.
Accessing the PLC inputs at register level
To read the inputs at register level, set the parameters ‘Memory Type’ to Word and ‘Area’ to 3x.
Example of reading and writing inputs and outputs at but and register level:
Accessing the PLC registers
To access registers in read and write mode with size WORD or DWORD, set the parameter ‘Area’ to 4x.
Address 1 will point to the first word of the array established in the parameter MB_HOLD_REG of the corresponding MB_Server block.
The MB_Server block provides the possibility to access two different data types, the memory area M and data blocks DB.
The following NB-Designer programming example shows variables that communicate with both memory areas.
Register of memory address M: PLC ‘Area’ that is referred with DW2 and DW0.
Registers (word type) of data block DB3 called "MODBUS": PLC directions that are referred with DB3.DBW2 and DB3.DBW0.
Example of reading and writing registers at bit and register level:
To access the registers at DWORD data length, the level must be configured for the channels as follows:
While accessing memory areas at byte level, such as DB’s created from byte sized data structures, please keep note that the NB HMI works at Words level so it will be necessary to use two bytes of the PLC for writing / reading. NB components cannot access 8-bit variables in the S7 PLC.
MW1 and MW3 cannot be replaced because they have no equivalent.
3. Functions of the S7-1200 PLC as Modbus TCP Server
To perform Modbus TCP communication of the S7-1200 PLC as the server, the MB_SERVER block should be used. This block communicates as a Modbus TCP server via the PROFINET connector of the S7-1200 CPU.
The MB_SERVER block can accept a request to connect to a Modbus TCP client, receive a request from Modbus function and send a response.
Description and data types for MB_SERVER block parameters:
MB_SERVER allows incoming Modbus function codes (1, 2, 4, 5, and 15) to read or write bits and words directly in the input process image and output process image of the S7-1200 CPU as shown in the following table:
Incoming Modbus message function codes (3, 6, and 16) read or write words in a Modbus holding register which can be an M memory address range or a data block.
The register that is specified in the MB_HOLD_REG parameter must be defined as a data type more than one byte and must be located in a range of M memory addresses or in a DB data block.
For a Modbus holding register in memory M, use the standard pointer format ANY as follows:
ANY Format: P # "bit address" "data type" "length"
Note: The actual upper limit of DB addresses is determined by the maximum work memory limit and M memory limit of the respective model of the S7-1200.
Multiple Server Connections
The PLC can create multiple server connections, through which you can make multiple concurrent connections with multiple Modbus TCP Modbus clients or, as is the case with the NB HMI, establish multiple clients with the same equipment to share different memory areas.
Individual server connection must follow these rules:
In summary, the instance DB and the connection ID are paired and must be unique for each connection.
4. Example NB-Designer Project
The attachment: 'Connecting NB to S7-1200' is a example NB-Designer project containing the network configuration, addressing multiple registers in the S7-1200 PLC.