105BCommunication processor
12.5 Modbus communication
S7-1200 Programmable controller
System Manual, 11/2011, A5E02486680-05
591
MB_SERVER allows incoming Modbus function codes (1, 2, 4, 5, and 15) to read or write
bits and words directly in the input process image and output process image of the S7-1200
CPU. For data transfer function codes (3, 6, and 16), the MB_HOLD_REG parameter must
be defined as a data type larger than a byte. The following table shows the mapping of
Modbus addresses to the process image in the CPU.
Table 12- 57 Mapping of Modbus addresses to the process image
Modbus functions
S7-1200
Codes Function
Data area
Address range
Data area
CPU address
01
Read bits
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7
02
Read bits
Input
10001
To
18192 Input Process Image
I0.0 to I1023.7
04
Read words Input
30001
To
30512 Input Process Image
IW0 to IW1022
05
Write bit
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7
15
Write bits
Output
1
To
8192
Output Process Image
Q0.0 to Q1023.7
Incoming Modbus message function codes function codes (3, 6, and 16) read or write words
in a Modbus holding register which can be an M memory address range or a data block. The
type of holding register is specified by the MB_HOLD_REG parameter.
Note
MB_HOLD_REG parameter assignment
The Modbus Holding Register can be in a standard global DB or a M memory address.
For A Modbus holding register in M memory, use the standard Any Pointer format. This is in
the format P#"Bit Address" "Data Type" "Length". An example would be P#M1000.0 WORD
500
The following table shows examples of Modbus address to holding register mapping used for
Modbus function codes 03 (read words), 06 (write word), and 16 (write words). The actual
upper limit of DB addresses is determined by the maximum work memory limit and M
memory limit, for each CPU model.
Table 12- 58 Mapping examples of Modbus address to CPU memory address
MB_HOLD_REG parameter examples
Modbus Address
P#M100.0 Word 5
P#DB10.DBx0.0 Word 5
"Recipe".ingredient
40001
MW100
DB10.DBW0
"Recipe".ingredient[1]
40002
MW102
DB10.DBW2
"Recipe".ingredient[2]
40003
MW104
DB10.DBW4
"Recipe".ingredient[3]
40004
MW106
DB10.DBW6
"Recipe".ingredient[4]
40005
MW108
DB10.DBW8
"Recipe".ingredient[5]
Multiple server connections
Multiple server connections may be created. This permits a single PLC to establish
concurrent connections to multiple Modbus TCP clients.