Hi.

I have a problem with the mb_server block in TIA-portal. Attached there is a screenshot of my program. See references in bracket

I have two PLC’s, one with a mb_server block [2] and another with the mb_client [1] block. My goal is use the client block for writing data to the server.

When I use mode 0, to read data from the server, I can see that the value in the buffer of the server get transferred to the buffer of the client [8]. For some strange reason when I change to mode 2 [3] [4] for writing data to the server I get the error code 16#8383. [6] I have exactly the same setup, e.g. mb_data_addr, mb_data_len, etc. [7], so to me this is a mystery!

16#8383: “Error reading or writing data or access outside the address area of MB_DATA_PTR. The error can occur locally as well as with the instruction "MB_SERVER".

I tried use a modbus program on my PC, but I get the same result. Function code 3 (read) works, but when I use function code 16 (write), I get the same error.

My hardware: CPU 1212C AC/DC/RLY (client) and CPU 1212C DC/DC/DC (server).
TIA-portal: v13 sp1 upd9.

I tried updated the firmware to 4.2.0 on both PLC’s, but I get the same error.

Help is highly appreciated.

Hello,

If both PLCs  are S71200 then why are you going with Modbus TCP communication protocol.

Simply without any communication instructions you can exchange the data between two PN PLC via I-Device functionality of Profinet, which is real time .

You can do the S7 communication with the help of GET/PUT instruction . You need to write instruction either 1st or 2nd PLC only.

Open user communication is also another option by Using TCON,TSEND,TRCV and TDISCON block for exchanging more that 1KByte data.

Any way if you are  going with Modbus TCP prtocol then i hate to use TCON_IP_V4 data block.

Better way  to generate Connection DB  by using TCON block, no mistake. After that see the size of connection DB which you have created via TCON_IP_V4 and via TCON block.

See the attached video for doing Modbus TCP communication between two S71200 PLC.

Whenever you are changing mode either 0 or 1 (read/Write) then you need to reinitialize the DB.

If you feel this post is useful then don't forget to rate it.

Hi DJ_1.

Thank you for your quick replay.

While I am testing, I am using a 2nd PLC as the client, but when the project is finish there will be a SCADA-server that will communicate with the 1st PLC. So unfortunately, I am stuck with modbus tcp, but else I agree it’s a good suggestion to use GET/PUT.

I see that the static tag «connected» is true both on mb_client and on mb_server, so I am sure there is no problem with the connection. Also, I can read (mode 0), so that also indicate that the connection is okay. My problem is related to wring to another device by using mode 2, (function code 16).

I looked at the attached example project, but the example use mode 0, so unfortunately it didn’t help me. The same apply to the video.

I tried change the default value of mode to 2, and then restart the PLC, but I get the same error, 16#8383.

As I wrote in my previous post, I tried use a computer software for writing to the PLC, but same error. To me this indicate that the problem is located on the 1st PLC, (mb_server).

Thank you anyway for your replay. Please, do you have any other suggestions? Tanks in advance.

Hello,

Mode value either 0 (means read)  or 1(write). Internally it Will take care the function code as per client.

In my project backup, instead of mode value as 0   make it 1. So you can write value in client PLC

I have sent you project backup only to see my connection db  and your connection db. If you use my way then it will be optimzation of code.

Don't make mode as 2. 

My suggestion would be , use modscan (standard modbus simulation software, freely available for testing)as modbus TCP client and S71200 as Modbus TCP server.

If you feel this post is useful then don't forget to rate.

Hi.

For other people that is reading this forum, I will like to mention that is not necessary to reinitialize mb_client if the mode is changed during runtime.

I found the solution to my problem. It turns out that if a data block (not optimized) is used to store the holding registers, it's only possible to read to the holding registers. If I tried to write, then I got the error code 16#8383. In contrast if the bit memory is used for the holding register for mb_server is possible to both read and write. (e.g. mb_hold_reg := P#M100.0 word 60). Since this isn't mention in the help file I suspect it may be a bug in the firmware.

I am not sure if agree that the connection db you describe is more optimization of code, I believe is just two ways of solving the problem. Anyway, thanks for taking your time to help me.

Cheers :)

Hi. Just want to write something I discover, in case you or other people is stumbling over the same problem. This is what I discover:

If a global DB should be used for the holding register then the mb_hold_reg parameter should refer to a array of words or bytes inside DB. If done so, then both modbus write and read function codes will work. If the parameter only refer to the db, then only "read" will work. Eg:

mb_hold_reg := "Your_global_db".array_of_bytes
mb_hold_reg := "Your_global_db".array_of_words

The problem will be solved passing pointer i this way :

P#DB100.DBX0.0 BYTE 84    LIKE PARAMETER OF MB_HOLD_REG

In this way , i can read/write every data type present in the DB non necessary to use Array of words !

 I verified this on my C# nmodbus libraray communicating with siemens 1212c plc, it works!  Prieviously, I use db name, just change it to P#DB100.DBX0.0 BYTE 84, I haven't try M memory, should be work too.

Cheers guys, it helps me a lot!!! I think this is simens bugs.... that we suffer....

AutoGen_71745

The problem will be solved passing pointer i this way :

P#DB100.DBX0.0 BYTE 84    LIKE PARAMETER OF MB_HOLD_REG

In this way , i can read/write every data type present in the DB non necessary to use Array of words !