KB Controls is reader-supported. When you buy through links on our site, we may earn an affiliate commission. Read more in our disclaimer
Advantages, Disadvantages, and an Application Example of Modbus/TCP Communication in TIA Portal.
Communication between PLCs is a common requirement in automation projects.
In modern PLCs, there are so many options for communication available that it can be hard to decide which one to use. Each communication option has advantages and disadvantages, as well as a unique way of working.
In this article, I’ll provide a quick start guide for configuring Modbus/TCP between two S7 PLCs. It will demonstrate how to configure an S7 PLC as a Modbus Server or Client in TIA Portal.
In the next sections, I will;
Modbus/TCP communication can be routed over Ethernet which means that its possible for two devices on different subnets to communicate. This is a huge advantage over protocols like S7 Communication, where packets can be routed between subnets.
The Modbus/TCP communication protocol has a defined communication timeout that occurs between a client and server. This means that if the communication between two devices breaks down, we get an error to alert us that something has gone wrong.
Since Modbus/TCP is a relatively modern protocol, it can work with Optimized Data Blocks in TIA Portal. This makes it ideal for new projects that are taking advantage of the technological innovations in the S7-1200 and S7-1500 controllers.
For legacy systems, Modbus/TCP can also be used with Unoptimized Data Blocks.
Modbus/TCP is a communication protocol that is supported by most industrial devices. This means that the communication protocol is not tied to the hardware of a specific vendor (like S7 Communication). For this reason, Modbus/TCP is an ideal communication protocol for communicating between devices made by different manufacturers.
Modbus/TCP does not provide the option to use security or encryption when communicating between devices. This creates a potential security vulnerability in an automation system.
Unlike S7 Communication, which is a single sided communication mechanism, for two devices to communicate via Modbus/TCP, both devices must be programmed. In TIA Portal, that means that the sending PLC must be programmed with an instance of the MB_CLIENT instruction and the receiving PLC must be programmed with an instance of the MB_SERVER instruction.
Based on these advantages and disadvantages, we can see that it makes sense to use the Modbus/TCP communication protocol when;
To demonstrate how to configure Modbus/TCP communication between two S7-1500 PLCs, I have created a new TIA Portal project and added two PLCs to the project.
As I mentioned previously, Modbus/TCP is a dual sided communication protocol. That means that we have to program both the sending and receiving PLC. Let's start by configuring the sending PLC, PLC_1.
In OB1, I add a call to the MB_CLIENT instruction, which is found in the Instructions toolbox under Communications > Others > MODBUS TCP. In this folder, you also see a MODBUS TCP Redundancy folder. These instructions are a cost option and are not provided for free by Siemens.
After creating an instance data block for the call to MB_CLIENT, I can start parameterizing the block.
The REQ pin tells the Modbus client to poll the data exchanged with the Modbus server. If the REQ pin is permanently high, then the client will poll the server at a rate that is pre-defined by the instruction. In this example, I have set the REQ pin to True so that the client is continuously polling the server.
The DISCONNECT pin forces the client to disconnect from the server. In this example, I have set the DISCONNECT pin to False.
The MB_MODE pin defines the mode of the Modbus request from the client. You can use the value 0 to select read mode and the value 1 to select write mode. Here I use a constant with the value of 1 to indicate that we want to use the Modbus client to make a write request to the server.
The MB_DATA_ADDR pin is a reference to the holding register that will be used in the communication between the client and server. In an S7 PLC, the holding registers are located at the addresses 40,001 to 49,999. In this example, I will use the first holding register located at address 40,0001.
The MB_DATA_LEN pin defines the length of the data to write to the server. This length is expressed in holding registers. One holding register is two bytes. In this example, I am writing 2 holding registers, which is 8 bytes of information.
The MB_DATA_PTR pin is a pointer to the data that we want to write from the client to the server. In this example, I have enabled the Clock Byte in the hardware configuration of the PLC at Memory Byte 0 and I have created a pointer to this location.
The CONNECT pin is interconnected with an instance of the UDT TCON_IP_v4, which contains all of the connection information to connect to the other PLC. In this example, I have created a new DB to store this information and interconnected the member with the instruction.
The configuration of the CONNECT pin is shown below.
In PLC_2, I create an instance of the MB_SERVER Instruction.
On this block, we have a few pins to parameterize.
Once again, a DISCONNECT pin is available to force a disconnection of communication between the client and server. I have connected the value False to this input.
Next, the MB_HOLD_REG pin is a pointer to the location where the data received from the client will be written to. In this example, I have created a DB to store the data and connected the member of the DB to the pin.
Finally, we have a CONNECT pin which contains the information to connect with the other PLC. Once again, I have interconnected a member of type TCON_IP_v4 from a new DB called DB_Connection.
The Configuration of the CONNECT pin is shown below:
With both the Modbus client and server configured, we can download to the PLCs and Go Online with both PLCs to see if the communication is working as expected.
In both PLCs, you should see that the connection has been established and that the value at the status pins of the MB_CLIENT and MB_SERVER blocks are updating to provide diagnostic information about the communication. The value 16#7006 indicates that data is being sent and 16#7007 indicates that data is being received.
If you were to break the connection between the PLCs, the status pin would update to give an indication of the error that was detected.
In this post, we learned how to use Modbus/TCP to communicate data between two S7 PLCs.
If you encounter Modbus/TCP in the wild, it will most likely be in an application where you are programming the communication between an S7 PLC and another device from another manufacturer. In that case, you would configure the PLC as a Modbus client, server, or both depending on the application's requirements.
This course introduces you to the S7 series of PLCs and the STEP 7 programming environment for S7 PLCs. It is an ideal first step for anyone who wants to become a controls or automation engineer or an industrial technician that wants to improve their knowledge of PLC hardware and programming.
In this tutorial, I provide you with a complete, step by step guide for integrating SINAMICS drives in TIA Portal projects including how to commission the standard and safety features of SINAMICS drives in Startdrive, how to integrate and control SINAMICS drives in your TIA Portal projects using standard telegrams and blocks, and how to control and visualize the status of SINAMICS drives in a WinCC HMI application.
In this post, we learn how to use OPC UA to communicate between two PLCs by setting up an S7-1500 as an OPC UA Server with a dedicated server interface and user authentication.