S7-1200 Modbus TCP access by 3rd Party Master

Hello all,
I am trying to access an S7 system (TIA v13, which is what we use) that was developed by a 3rd party for use with 3rd party devices via Modbus TCP.


They set it up to be compliant with Modbus TCP and describe the address space as follows:

1. Coils (M100.0, etc) (Two Words of bits, or 2 bytes of bits) - Read: Addresses 40001, 40002, 40044
2. Coils (M100.0, etc) (Two Words of bits, or 2 bytes of bits) - Write: Address 40019
3. Holding Registers (MDXXX) (32 Bit words across two DWord addresses) - Read 40003-40018
4. Holding Registers (MDXXX) (32 Bit words across two DWord addresses) - Write 40020-40043, 40045-40050

When I try to access these I can read the first Address and get what I know to be correct responses, bit-wise. When reading the Bits from the first address (40001), wireshark shows I'm using Function Code 02, and again, I get the expected result.


I can also get one holding register address (40019) to give me information that seems reasonable (matches the TIA Portal watch list). Wireshark reports that I am using Function Code 03 and I get the expected result.


I can read anything I want, but the data doesn't match. It seems as though I'm pulling from the wrong addresses somehow?


I can't seem to write to any address at all, although I've only tried to write to the coil bits (not holding registers). Attempts to write were using Function Code 05.


I assume that I am doing something incorrectly with the addressing (or possibly the contractor, but I'm the novice so I'm sure it's my fault).


Thanks,
Matt

Hi Matt
The addresses look correct. One possible answer is that the order of bytes coming from the unit is reversed. Allot of software will give you an option for reversing the LSB and MSB of the words being returned.

Here is some background information on Modbus TCP:
http://www.simplymodbus.ca/TCP.htm
https://www.rtaautomation.com/technologies/modbus-tcpip/

You may want to test your communications with another software package to verify the operation. I would use AdvancedHMI. This is a free package that is discussed regularly here in this forum.
https://sourceforge.net/projects/advancedhmi/
Here is a post that will show you the installation of AdvancedHMI:
http://accautomation.ca/create-a-plc-with-hmi-training-and-learning-environment-free/
I hope this helps you out.
Regards,