S7-1200 as Modbus TCP client

Hi All,
As said in subject, I tried this setup. S7-1200 as client and a power meter a server





The first attachment ("S7-122.png") is my first test. I tried reading register 51078 using S7-1200 and get a status error of "8189" which is an invalid data used in MB_DATA_ADDR. Upon reading the manual, I see that only these ranges are allowed:

• holding register = 40001 to 49999
• extended holding register = 400001 to 465535

I guess the problem is that the power meter is using an address of 5xxxx for its registers. Is there any workaround to read these registers? Btw, in my screenshot, I got no error reading register 51078 using Modbus poll



Another test (2nd attachment, "5142015 (network2) - 40001.jpg") to see if there is any packet sent/received to/from the power meter.
I tried reading data from register 40001 (using S7-1200) but I can't see any query from wireshark. I also tried reading data from register 40001 (using modbuspoll) and I can see both the query/response to/from the power meter.
My question is why can't wireshark sniff any Modbus/TCP packet from the PLC even though I'm getting 'DONE' in the status of the ModbusClient block. Are there still problems in my parameters? I've added a counter for the number of reading job done (11403) and the number of errors (0).





Setup for testing #2:

• S7-1200 CPU1212C fw4.0: 192.168.1.50
• Power Meter: 192.168.1.10
• PC: 192.168.1.100
• TIA 13 (without any SP)

Regards,
wantutri

First of all client is master so you should use modbus slave to simulate meter not modbus poll wich is modbus master not slave.

You didn't say what meter you want use.
I think 51078 address is physical memory address.
Modbus address would be 451079, because for physical addres 0 you would need to use 400001 modbus address in

marcius said:

First of all client is master so you should use modbus slave to simulate meter not modbus poll wich is modbus master not slave.

You didn't say what meter you want use.
I think 51078 address is physical memory address.
Modbus address would be 451079, because for physical addres 0 you would need to use 400001 modbus address in

Click to expand...

I'm also connected to the power meter, the IP addresses used are as shown above (setup). I just first used Modbus poll (as client) to know if I can read some holding registers from the power meter (as server). After confirming it is working, I then tried using the S7-1200 (as client) to read the same registers. My screenshots show the results of my testing

The meter was EEM-MA600 from phoenix contact.
I already tried adding "4" at the beginning so it was like I was reading "451078" and a get an "invalid MB_DATA_ADDR". I will try to read "451079" and will post the result later

Regards,
wantutri

Hi marcius,

Thanks! I didn't realize that I used a wrong offset, I just simply put 4
I can read the registers now though I still can't see any packets from wireshark. Anyway, as long as it's working, I'm good.

Regards,
wantutri

You will not see packets of plc and power meter if you connecting pc to switch.
You need an old hub(hard to come by) wich forwards all received packets to all ports or switch with port mirroring capability.
Than you mirror all ports to one and when connected with pc to that mirrored port you will be able to monitor traffic.

Facing problem in extended modbus address

Hi wantutri,

I am facing the same problem. So please can you tell me what will be the offset in this case

Regards,
Ankur

ankurgarg08 said:

Hi wantutri,

I am facing the same problem. So please can you tell me what will be the offset in this case

Regards,
Ankur

Click to expand...

Offset is +1 as above, other than that be a little more specific !!

Hi wantutri

Thanx for the reply. I want to read value from 55296 modbus address. So what will be the value of offset and mb_data_addr.

ankurgarg08 said:

Hi wantutri

Thanx for the reply. I want to read value from 55296 modbus address. So what will be the value of offset and mb_data_addr.

Click to expand...

It depends what your slave is, it could be 455296 or 455297, try reading it with ModPoll or similar to confirm.

Actully the current situation is this that a SCADA is getting some values from PLC over modbus TCP and i also want to read the same values from that PLC to my PLC(s7-1200). I got a list of modbus addresses(55296-55330) from client.

ankurgarg08 said:

Actully the current situation is this that a SCADA is getting some values from PLC over modbus TCP and i also want to read the same values from that PLC to my PLC(s7-1200). I got a list of modbus addresses(55296-55330) from client.

Click to expand...

If there is an offset its generally always +1