Here is a tutorial to use Beckhoff TwinCAT TF6250 to configure a Modbus TCP Client and access a Modbus TCP Server with Siemens.Let’s Start!

Manual

https://download.beckhoff.com/download/document/automation/twincat3/TF6250_TC3_Modbus_TCP_EN.pdf

Installation

Please access this link to download the installation file.

https://www.beckhoff.com/en-en/products/automation/twincat/tfxxxx-twincat-3-functions/tf6xxx-tc3-connectivity/tf6250.html

Open the Software and Tools tab.

Download the exe file.

Choose English and OK.

Next>.

Agree the License and Next>.

Enter the information and Next>.

Choose Complete and Next>.

Next>.

Please wait a minute..

Press Install to start the installation.

Done!

Function Blocks

Here is the Function Block that I used in this Tutorial.

FB_MBREADREGS

Here is the Function Code 3 to read the register,from 1-128.

VAR_INPUT

sIPAddr
- STRING(15)
- The IP of Modbus TCP Server
nTCPPort
- UINT
- The Port of Modbus TCP Server
nUnitID
- WORD
- The device number of Serial sub-network.
nQuantity
- WORD
- Number of registers that you would like to read.
nMBAddr
- WORD
- The Memory Offset of the register.
cbLength
- UDINT
- The Data size of your buffer variables, you can figure it with SIZEOF().
pDestAddr
- POINTER OF BYTE
- The Pointer address of your buffer variables, you can figure it with ADR().
bExecute
- BOOL
- Run the Function Block with a Positive edge.
tTimeout
- TIME
- The Timeout Setting.

VAR_OUTPUT

bBUSY
- BOOL
- Function Block is running
bError
- BOOL
- Error happens while Function Block is running.
nErrId
- UDINT
- The Error ID.
cbRead
- UDINT
- Number of Bytes that you read from server

FB_MBWriteRegs

Here is the Function Code 16 to write the register,from 1-128.

VAR_INPUT

sIPAddr
- STRING(15)
- The IP of Modbus TCP Server
nTCPPort
- UINT
- The Port of Modbus TCP Server
nUnitID
- WORD
- The device number of Serial sub-network.
nQuantity
- WORD
- Number of registers that you would like to write.
nMBAddr
- WORD
- The Memory Offset of the register.
cbLength
- UDINT
- The Data size of your buffer variables, you can figure it with SIZEOF().
pSrcAddr
- POINTER OF BYTE
- The Pointer address of your buffer variables, you can figure it with ADR().
bExecute
- BOOL
- Run the Function Block with a Positive edge.
tTimeout
- TIME
- The Timeout Setting.

VAR_OUTPUT

bBUSY
- BOOL
- Function Blockはいま実行してる
bError
- BOOL
- Function Blockがエラーがあります
nErrId
- UDINT
- Function BlockがエラーあるときのError番号

TwinCAT Side

License

Create a TwinCAT Project and click the License.

Search TF6250 in the Manage License tab>Add a Checkbox in the Add License field.

Now we can import the Modbus TCP/IP(Tc2_ModbusSrv) library in your project,

DUT

Then we will create some DUT in your project.(It is not a must step)

DUT_MB is a DUT for the MB Function Block process.

bExecute/bBusy/bError/nErrId are defined inside.

TYPE DUT_MB :
STRUCT

bExecute :BOOL;
bBusy :BOOL;
bError :BOOL;
nErrId :UDINT;

END_STRUCT
END_TYPE

DUT_MBReads is a DUT that extends from DUT_MBRead.

cbRead is defined and it is used for the FB_MBREADREGS.

TYPE DUT_MBReads EXTENDS DUT_MB :
STRUCT
cbRead:UDINT;

END_STRUCT
END_TYPE

MAIN

Now we can create the program.

Interface

PROGRAM MAIN
VAR
//Function16
_MBWriteRegs :FB_MBWriteRegs;
MBWriteRegs :DUT_MB;
ar2 :ARRAY[0..99] OF INT;

//Function3
_MBReadRegs :FB_MBReadRegs;
MBReadRegs :DUT_MBReads;
ar1 :ARRAY[0..99] OF INT;

sIPAddr:STRING(15):=’192.168.000.001′;

END_VAR

Program

Inside the program, we will call the FB_MBWriteRegs and FB_MBReadRegs to access the register to Modbus TCP Server.

//Write the Regs to Modbus Server Function16
_MBWriteRegs(
sIPAddr:=sIPAddr //Is a string containing the IP address of the target device
,nTCPPort:=MODBUS_TCP_PORT //Port number of the target device
,nUnitID:=255 //Identification number of a serial sub-network device, 16$FF if TCP/IP is used
,nQuantity:=2 //Number of output registers (data words) to be write. The value of nQuantity must be > 0
,nMBAddr:=0 //Start address of the output registers to be write (word offset)
,cbLength:=SIZEOF(ar2) //Contains the max. byte size of the source buffer. T
,pSrcAddr:= ADR(ar2) //Contains the address of the source buffer containing the data to be written
,bExecute:=MBWriteRegs.bExecute //The function block is activated by a rising edge at this input.
,tTimeout:=T#1S //States the length of the timeout that may not be exceeded by execution of the ADS command
,bBusy=>MBWriteRegs.bBusy //When the function block is activated this output is set
,bError=>MBWriteRegs.bError //If an ADS error should occur during the transfer of the command
,nErrId=>MBWriteRegs.nErrId //Supplies the ADS error number when the bError output is set
);

//Read the Regs from Modbus Server Function3
_MBReadRegs(
sIPAddr:=sIPAddr //Is a string containing the IP address of the target device
,nTCPPort:=MODBUS_TCP_PORT //Port number of the target device
,nUnitID:=255 //Identification number of a serial sub-network device, 16$FF if TCP/IP is used
,nQuantity:=10 //Number of output registers (data words) to be read. The value of nQuantity must be > 0
,nMBAddr:=0 //Start address of the output registers to be read (word offset)
,cbLength:=SIZEOF(ar1) //Contains the max. byte size of the destination buffer.
,pDestAddr:=ADR(ar1) //Contains the address of the destination buffer into which the data are to be read
,bExecute:=MBReadRegs.bExecute //The function block is activated by a rising edge at this input
,tTimeout:=T#1S //States the length of the timeout that may not be exceeded by execution of the ADS command
,bBusy=>MBReadRegs.bBusy //When the function block is activated this output is set
,bError=>MBReadRegs.bError //True if If an ADS error should occur during the transfer of the command
,nErrId=>MBReadRegs.nErrId //Supplies the ADS error number when the bError output is set.
,cbRead=>MBReadRegs.cbRead //Contains the number of bytes currently read.
);

Siemens Side

S7-1500 is used in this tutorial.

Interface

Program

Result

We will write some values from Register 0-9.

Create bExecute = True to send a request to Siemens Side, And you can see nErrId=0 and cbRead=20 Bytes(10 Words), it means 10 words are read with this function block.