Simatic S7 1200 as TCP IP MODBUS Server

[Music] lower in this video I'm going to demonstrate tcp/ip what was communication and for that I'm going to use this set up this is my laptop it acts as a mod was client modscan software is installed on it for raising the Curie's on the spirits and this is somatic s 1,700 PLC it's a marker server and response to this supplier according to the queue is raised terrifying evil is connected between the Ethernet port of this mod was server and my laptop IP address is 192 dot 168 of 0.5 or the client and one ninety two dot one sixty eight dot zero dot one or this PNC or the server so when you establish the communication between this Markus client and the server we are going to see these commands this pod was commenced so let's get started [Music] as a server this is a DI import on software this is used to configure and program the somatic s700 CPU family as well as KTB touchscreen family program is the program is already open maybe even as a tcp/ip server ok let's add a controller we have this model available as a setup this is the main program its run in cyclic mode this is the MP separate monitor separates the instruction to configure the CPU has more per server it is under the communication section right and drag it and drop on the working area is that the inputs and these are waiting for some outputs of the glass in first we need to configure the IP addresses holding registers and output for it was information about the server like if there is a error what is the status you will get only the information in detail into the system and Olaf estimate lol PLC this is the system manual so please refer this manual for more detail you go back over this instruction block and we will configure the inputs and outputs for this block let's add a block / later bro plus you think first input is disconnect it is believed start by Lewis phones because we don't want this properly disconnected at the beginning of the controller they connect the interface this is the but and one 14-0 local for kids by order this is the this is the port commonly used for more bus it will go back you see what else he is pending this is in real holding registers if you holding registers fully register address start from four thousand one up to fifty thousand whatever position as we are specifying here we are not specifying straightly with the Marcus address but we are specifying the registers inside the a somatic a 700 but whatever with address we are providing the starting address is corresponds to four thousand forty thousand one let's configure these holding registers [Music] different hundred so theta zero here theta zero is comes then corresponding address what was at respirator 0 is put in terms of wealth responding purpose catalyst for the Taiwanese 40,000 to in this way this address we keep incrementing or all these registers oh yeah [Music] let's continue would be our India immigrant status in this way our configuration it's completely complicated yeah we haven't figured this CPU or this PLC has multiple server and we specified the connector we specify the IP address of the client or connection [Music] you know this download this program into the PNC the PNC please will see the commands from the function one approve the function six the function one is real coil status over here gives us the simple memory Mian for the Modbus address is from respond to it when I do you 0.03 or say one of the CPU addresses or the PLC addresses or the Modbus address from point over thousand we go here we can say this is the model for soil address and this is corresponding CPU and listen now to read this unless we are going to use more versus can this is a simulator to simulate as a client this is a tool is excuse to troubleshoot what was problems as well we are going to use the same one and we are using it as a mortise climb it's innate connection time removed tcp/ip server and the IP address of the server is 193 once we okay we have seen that this raid demand has gone it means communication hands has been established now we are we are taking the first function 1 status let's take the first 50 this is the start address and the length is 50 means we can see it is status from from the coil number 1 up to coil number 50 check that but will loop will force the corresponding PLC please see and whatever huge erode r0q 0.6 our actual physical outputs of the PLC so we cannot use them to really by forcing them or by simulating thing that's why we are not using Q 0.06 these are also of the PLC but they are not actually using any present or there is no any additional we can straightly force them or change their values and we'll see that responding what was it if we go here I think this this is the file entries so let's take me to and we'll see that the file number 19 reacts accordingly or after status accordingly and we can see on our 0:19 this one this one is zero we modify one you can see that the final number 19 is modified as one zero can see that file but my intent is modified at zero 2.3 which is the final number 20 will modify it true can feel then while number 20 is modifier one in this way we have seen the function 1 function 1 which means the while status of the PLC this Morse can not only use this not only give us the status but it gives us the Curie and responds find information this my information is useful for troubleshooting how next section will see the another function read input status function [Music] in this section we are going to say the function number tool which release they import status what was L result inputs starts for paint was it worth of group in 2000 I am responding piece from systemic s7 PLC's are we see here responding bits and for the world to they have provided much larger pins 18001 metal and corresponding visa is 0.02 I 1000 23.7 so these are the inputs our PLC has a 0.0 0.7 actual physical inputs and reached are the only input image memory is they are available for us but they are actually not physically present let's change this table ooh 0 0 1 the function to this is the Modbus address and this is responding semantics as 17 playfield this first they were our actual physical input so we are going to force them the middle force of this bully maybe religious let's force I 2-1 corresponding address is 1080 before I didn't like the main theta so now and of course I do - when - when responding and resistance in him we look at the 10,080 minutes here oh and if we look at the I - - but it is also possible it's more requires one let's check here I in 2018 is one in getting people to 18 explain children this baby has a fortune to as well which states they could find now in next section we say the function three function three is reading holding resistors [Music] Jeffrey really whole unit is personal business has Modbus address porting frozen world problem and it's holding register for 16 bits or instead putting register is when one has one word linked now if we go into the semantics PLC fully registers are the one which we specify this is quite here the starting register is the one which four throws at 40,000 won corresponding what was addressed theta we have specified these as of holding registers area of theta zero and theta 0 has corresponding mod was at least 40,000 so whatever we write here whatever will be will be here that client will have in the 40,000 one place see now putting resistance and spoil let's see what Stephen currently all these registers are from data register children put into adjuster file there are actual values at 0 and we can see the holding registers from booth on the one who the footage is turned from four thousand five let's make it yeah we have taken six registers in the first ever watch table only have zero thank you now let's posting values you see them in these values right whistles in the corresponding registers see here 10 is 1 2 3 4 5 6 here also 6 we change [Music] ride it again all these values will be the same today right it's corresponding register so you can say that is first registered beta zero four thousand five one eight a one health one two three one so all of these are copying it is responding on you sisters next section we'll see the next function really input registers [Music] in this section here for you to say really input registers check number four number four they C equal to corresponding input register addresses or the semantics here somatic AC or 300 PLC refer this system and you'll get this information we can see that the inputs the converse at least is from three thousand point next you know Morissette raised thirty thousand founded sorry this is what 2001 this is 3401 and this is thirty thousand five hundred fourteen memory addresses iw0 and iw when these are the input image memory address and uses on this medication we know that our physical inputs are getting covered in w0 but next makes input addresses are also input image memory but they don't have any actual physical resource to our setup we have only one symbol which has only in physical input so in these registers these values are coming into the board bus catalyst into their corresponding more entries you see there and we have here table this is the waterside race and this is the corresponding input image memory of the somatic let's go here and let's see four point five four six input is currently this input email me please how the values of zeros and you will put the values that will be getting reflected here so let's I want this because this actually puts its we can see that is responding what was Henry's and we'll see that all of here also in their corresponding respond if you Marcus addresses at the client the client is raising the Furies to read this importance and our server is responding and sending these values can see here it's this white color objection is raising the Curie's and the black is the response from the thank you very suppose from our controller and here we'll get how he'll get the number of poles and how many valid responses we have received here this is the function for and they say there are other functions [Music] so far we have seen these first four functions on this postpones / first four functions are read-only now you can see the force single coil and precinct single register functions function of Phi M six these functions change the data from client to the server and royalty data into the server what they mean interview mods can as much Ken does not support this function we can spin what was a scanner things so this is the mobile scanner this works of BBS I just want again from first step yes it's first and connection we would like to add this connection here we need to specify device now we know that our device has a slim ideal what a nice device and this device will add this function upper funnel will add function number 5 force signal boil here we can force the phase from the range of 1 to 10,000 here we can see that Rachel what do you think thousand for the coil and corresponding a trace of this emitting is they won't benefit PLC is from Q dot 0 dot you know and let's first of all by the starting address is 1 and plate this one because we are only able to for single time we need to provide value between 0 or 1 for the positives all right over and add this command we will one more command for sale with where we will in turn this off now we know that we have a little coil and this one and while atlas when is corresponds to Q 0 or 0 so whenever we say in this command Q 0 to 0 output will turn on and whenever we say let's see I am saving these commands I seen this right single coil 1 and value 1 now I come on which will write 0 nu into the number 1 this is the term I will write from the client into the server in this way we can write data from the PC or from your scanner software or whatever hm I already think this is the function number 6 now we will see the function number 7 we see function number 6 the function of F six not seven F sees it receives the single resistor [Music] let's see how function number six which precedes the single register or write the data from client to server into the single register and here we have the register addresses theta zero is response to the 14,000 well let's ask the device take course single resistor take the dummy let's take the register number three then this becomes four forty thousand three three it's supposed to okay and we are fighting the value and we see it sticks a me example this is single resistor we take the same because in the end is zero zero three three theta 2 as this value when we this command one battery will be pool 1 1 3 is moved I mean we we can say in this data see that's one two one two so here we are getting the value from the client server or from the PC into the PUC register using function of four six this is the response also you are getting proper shooting or something now let's see the next function [Music] now let's see the next function the function is to force multiple points here we are forcing a single boy at a time using the post multiple files we can use we can force multiple coils in single command this the cast device right and select the force by different points this link is enable starting address is one of the point and please make length we have six in person so make six outputs makes business let's make the length six or the output then six all the six twice here we are writing zero to all the six points okay yeah interview see now you will see all the lights on the LED lights of the output from Q 0.0 0.5 same discover see all this horny when I seen this come on they all will be turned off in single come on this is a forcing [Music] yeah okay go back here and we already this registers here register zero that's possible putting holiness so if we put the command here first final registers we have why do you want to value let's see what happens here you can see on the first pile registers has values one who but it is in single pride come on we have a saint we have sanely there are no multiple input registers now we'll same Dana one two three who's all these fire registers in single command one two three so using this function you can write the rate I'm vertical looking for resistors [Music] you [Music] you

Channel: S Sqaure Control S Square Training

Views: 9,477

Keywords: TCP-IP MODBUS, MODBUS, SIMATIC S7-1200 PLC, MODSCAN, MODBUS SERVER, MODBUS Client, MODBUS Function, COIL, input registers, holding registers

Id: PTzNhkmw7tM

Length: 63min 25sec (3805 seconds)

Published: Mon Nov 05 2018