You can read a post I ve written a while ago about AC500 communicating with WinCC flexible via Modbus TCP/IP. I thing I posted sample code too.
Basically what you do is define a global variable and use AT to specify the modbus address.
i.e.
M9_Ton_time AT %MW0.340: DINT:=5000;
M9_Toff_time AT %MW0.342: DINT:=5000;
The amount of modbus registers available depends on the CPU. If you want to have retentivity then you have to define that in the CPU properties and change your syntax
M9_Ton_time AT %RW0.340: DINT:=5000;
M9_Toff_time AT %RW0.342: DINT:=5000;
(5000 is the initial value)
Care must be taken to do the addressing correct.
In the AC500 MW are splitted in segments depending on the CPU memory capacity i.e. %MW0.100, %MW1.100 etc.
In the tags the address of %MW0.100 is %MW100.
For bit tags bits need to be extracted from the MW. So as per the manual the byte order is motorola and the byte addresses are 2n and 2n+1 of MWn. For example:
%MW100.0 in WinCC Flex is %MX0.201.0
%MW100.8 in WinCC Flex is %MX0.200.0
https://support.industry.siemens.co...xible-and-abb-ac500/98834/?page=0&pageSize=10