How to read internal memory address for s7-1200 with Modbus?

How to read internal memory address for s7-1200 with Modbus?

I obtain the necessary modbus addresses using the operations below.

a. IWx is at Modbus address 30,000 + x/2 + 1
b. QWx is at Modbus address 40,000 + x/2 +1
c. IBx.y is at Modbus address 10,000 + 8*x + y + 1
d. QBx.y is at Modbus address 8*x + y+ 1

However, I could not find the required calculation method for internal memory spaces such as MW10.

How can I do the calculation required for MW10 or similar internal memory space.

I also need to find this calculation method for timer and counter.

Thank you ...

Hello,

more infos are missing from your side. Some better info about your S7-1200 order number and used TIA version is required. Look to TIA system manual (your version) about your Modbus indtruction/block. There are also some special TAGs/instance block parameters which have another capabilty and can be configured with other functionality. On other side, you can map that MW memory to Holding Register and present to Master. Look, you ask some question but what is problem is, your question point to Slave settings (it offer data to Master) so I answered like this.

AsTeriks

How to read internal memory address for s7-1200 with Modbus?

I obtain the necessary modbus addresses using the operations below.

a. IWx is at Modbus address 30,000 + x/2 + 1
b. QWx is at Modbus address 40,000 + x/2 +1
c. IBx.y is at Modbus address 10,000 + 8*x + y + 1
d. QBx.y is at Modbus address 8*x + y+ 1

However, I could not find the required calculation method for internal memory spaces such as MW10.

How can I do the calculation required for MW10 or similar internal memory space.

I also need to find this calculation method for timer and counter.

Thank you ...

 

Hello.

I am expecting you are talking of setting the PLC as Modbus RTU slave or Modbus TCP server. There is an instruction linked to either of those that are well documented in the in-software help. (You do not explicitly say which Modbus or which role the PLC plays.)

The part that is linked to the 'register' access is something that the instruction configures. Normally a DB is linked there.

For the MB_Server instruction:

MB_HOLD_REG

Pointer to the Modbus holding register of the "MB_SERVER" instruction

MB_HOLD_REG must always reference a memory area that is larger than two bytes.

The holding register contains the values that may be accessed by a Modbus client using the Modbus functions 3 (read), 6 (write), 16 (multiple write) and 23 (reading and writing in one job).

As the holding register, use either a global data block with optimized access or the memory area of the bit memories.

 
Does these notes help you?

Hello there.

I am using MB-SERVER command with Modbus TCP. The version number of the command is V5.

Tia Portal version V15.

PLC model 6ES7-212-1BE40-0XB0

I changed the tag named HR_Start_Offset from the part in the picture, but it didn't work.

AsTeriks

Hello there.

I am using MB-SERVER command with Modbus TCP. The version number of the command is V5.

Tia Portal version V15.

PLC model 6ES7-212-1BE40-0XB0

I changed the tag named HR_Start_Offset from the part in the picture, but it didn't work.

Hello.

"it didn's work"   is a useless phrase as a diagnostic and fault finding. We are not in front of your application, which means we see what you allow us to see. The block has diagnostic feedback that can tell you if the communication link is there and if all is well / in error. Please follow documentation to find out what you have to qualify what does not work.

I follow with some guesswork.

As far as I know, the block data that you link to (you called it "40000") should live in a DB that is not optimized.

I observe furthermore that the instruction is linked to a DB that is marked 1 at the end. There should only be one server block for one port number. There should only be one process that uses the port 502 or whatever you decide to set.

Good luck.

Hello there.

My program prepared with Tia Portal V15 is attached. It's a simple program.

I use a program called "WinTR Scada" for ModbusTCP and PLC connection.

I can access Q with modbus numbers 1 and 2, and i with 10001 and 10002 numbers, and iW addresses with numbers 30001 and 30002 without any problem.

Address MW100 has been defined as the default value for the Modbus 40001 address. 100 addresses starting from MW100. I understand this information from PDF files.

With the Modbus program, I can read and write data from all the addresses I have specified.

The value of the MW100 address is constantly changing in the program.

However, the value read in the Modbus program for address 40001 and beyond is 0.

I want to be able to directly read the MW addresses with Tia V15, if this is possible.

I remember doing this before using Tia V13.

Thanks for your time.

Solved.

MB_HOLD_REG value was entered as P # M100.0 WORD 5 for MB_SERVER instruction.

Thanks everyone.

Hello,

yes, from your picture (sry, now only see your after time) is clear that system of parameter set is with optimized access probably so your solution can be also DB but with no optimized access and then is also enough set this DB as Holding Register parameter. In case you have memory buffer then it need have pointer full notation with also reserved amount of data type.

Hello dear AsTeriks!!!

Thank You very much for creating this topic and finding the solution espetially that You did it mostly by yourself !!! There were some useful recomendations given by other partisipants, of course, but they did not answer for Your simple question that for me was clearly understendable from the first sight.

I also needed to read/write only the global M memory and not a DB what I've done for many times before (and what is discribed thousand times in documentation or in the internet), however I did not find anywhere the right format of the pointer to read the M area more than 1 word and all my supposed options were not adopted by the Modbus_Slave instruction.

Now Looking at Your last message I have solved my problem just in a second! And what is funny for me is that the right format of the area pointer is really predictable   But now I understand why I did not find it by myself - when you in a hurry it is easy miss even obvious things, this is a clue for me for next time

Thank You a lot one more time!! Good Job   Good Luck!!!

Hello,

AutoGen_128103

Hello dear AsTeriks!!!

Thank You very much for creating this topic and finding the solution espetially that You did it mostly by yourself !!! There were some useful recomendations given by other partisipants, of course, but they did not answer for Your simple question that for me was clearly understendable from the first sight.

I also needed to read/write only the global M memory and not a DB what I've done for many times before (and what is discribed thousand times in documentation or in the internet), however I did not find anywhere the right format of the pointer to read the M area more than 1 word and all my supposed options were not adopted by the Modbus_Slave instruction.

Now Looking at Your last message I have solved my problem just in a second! And what is funny for me is that the right format of the area pointer is really predictable   But now I understand why I did not find it by myself - when you in a hurry it is easy miss even obvious things, this is a clue for me for next time

Thank You a lot one more time!! Good Job   Good Luck!!!

nice to report that but you can see clearly that this user isn't part of Community already. On other side as mentioned before, understanding of problematic is required here and good explanation of problem also, I agree therefore my answer inside my first post is that one he described on his solution post map Merker memeory to Holding register.