Dear all

I am an experienced programmer (including MODBUS) but I am a novice with Simatic.

I have S7-1200 with CB 1241 module which is slave, with third-party device as master.

There should be read a few WORD, DWORD and FLOAT32 (Real). The connection is established and working without errors.

I have carefully read all these good manuals:

how do you establish a MODBUS-RTU communication with STEP 7 (TIA Portal) for the SIMATIC S7-1200?

MODBUS GENERAL DESCRIPTION.pdf from smiffy

I succeded most of that, but I have a problem to read and force coil. Whatever I do, I don't see a change in Simatic (when write from master) or I read only 0 (when read).

I use a DB with array of DInt as a parameter for MB_HOLD_REG of MB_SLAVE to read and write WORDs and REALs.

I am able to view and save raw communication from third-party device and it corresponds to my result (sending 0xFF00, code 05 and receiving 0x0000, code 01), i.e. there is no disagreement between raw data and what I see in SImatic.

My questions are: does MODBUS coils share the same memory or not?

Does register address 10 for "Read coil status" (code 01) means the address offset 1.2?

Thank you in advance

Hello,

Modbus Coils and Inputs are bools.
Where Modbus Holding registers and Input registers are organized in 16 bit words.

The S7-1200 mapping is described in the system manual. See screenshot.

When reading the status of one or multiple coils (Modbus function code FC01),
When writing to a single coil  ( FC05), or multiple coils (FC15),
you access the process image of the outputs of the PLC.
Means real outputs of the PLC if you access addresses matching real outputs.

If you read inputs (FC02), you access the process image of the PLC.
Means real inputs of the PLC if you access addresses matching real inputs.

If you read Inputs with FC04, you access the Input registers which are also mapped in the Input words of the process image, but you read at least 16 bits at a time (1 word).

In other words, Coils and Inputs are never located in Datablocs.
only Holding registers can be, and you specify the location of the holding registers at the parameter "MB_HOLD_REG" of the block.

Hello jklm,

thank you very much! I have finally understood how it works in Simatic.

The ambiguity for me was the sentence in the same paragraph: "Modbus communication function codes (1, 2, 4, 5, and 15) can read and write bits and words directly in the input process image and output process image of the CPU." I am working with devices where coils and inputs are not strictly tied with I/O area, so there is missing can only, because it can not access other memory than I/O image.

Just a small correction: in the new version of manual (01/2015) table referenced is "Table 13- 79 Mapping of Modbus addresses to the process image".

New question published by jhon benil is split to a separate thread with the subject s7 1200 and cb1241, communicatin with third party microcontroller.

Best regards
Min_Moderator

New question published by maratha is split to a separate thread with the subject S7-1200 MODBUS, transfer the I/Os status to the master PLC.

Best regards
Min_Moderator