Blog

Modbus Communication Between a Siemens and Allen Bradley PLC

Overview

In this post we will review how to setup a Modbus TCP connection between a Siemens PLC and an Allen Bradley PLC. While other means of communication exist (EtherNet/IP, Sierial, or using a gateway adapter) Modbus TCP has the advantage of requiring no special hardware and being a sudo-natively supported protocol by both platforms. For the purposes of this example, we will be using a S7-1516 as our Siemens PLC and a L27ERM as our Allen Bradley PLC.

Physical Connections:

Modbus TCP communicates over a standard CAT-6 cable and will connect to both PLCs through their respective RJ45 ports. Most higher-end Siemens PLCs will have two separate interfaces with separate IP addresses. Either port can be used as long as the IP addresses of both PLCs lie within the same subnet. For this example, we will have the network configuration illustrated below. As indicated in the illustration below, your Modbus network can also contain other field devices and does not need to be independent of your subsystems. The standard length limitation of 100 meters for copper and 100 kilometers for fiber optic apply.

Siemens TIA Configuration

Getting Started:

If you have previous experience setting up a device connection in TIA then this process may seem odd at first. Unlike a normal ProfiNet connection, Modbus communication is handled inside the program block with several unique instructions. These instructions can be located by opening the instructions tab and navigating to Communication/Others/MODBUS TCP. Here you will see two instructions:

  • MB_Client (Used if the Siemens PLC is the Client)
  • MB_Server (Used if the Siemens PLC is the Server)

For this example, the Siemens PLC will take the role of Server, and the Allen Bradley PLC will be a single client. Below are instructions on how to create the necessary tags and blocks.

  1. We can begin by creating a new function block (fbModbus in this example) and dragging in the instruction MB_Server.
  2. After adding the instruction, you should be prompted to create either a data block or an instance for the instance memory. In this example, we will create a multi-instance with the name fbModbus_Server_Instance. 
  3. Now create another static variable in your function block called, “connect” of data type, “TCON_IP_V4.”
  4. Your function should now look like the screenshot below.

Configuring Connection:

Now you should be able to set the default values for your connection profile. Below is a description of the tag meaning with an example shown to the right.

  • InterfaceID – This is the hardware Identifier of the port you are using to communicate through
  • ID – Modbus connection node ID
  • ActiveEstablished – Active/passive connection establishment
  • ConnectionType – 16#11 indicates Modbus
  • RemoteAddress – This can be left blank or at its default values of 16#0
  • RemotePort – Remote UDP/TCP port number (can remain at 0)
  • LocalPort – Local UDP/TCP port number (502 for Modbus)

Creating Transfer Area and Linking Tags:

Before we can begin linking everything together, we need to first create a data buffer. This will be an array of Words that our client will both read and write to. These will effectively be input and output tags to our Modbus TCP clients. Below is a simple explanation of how to create a transfer buffer

  1. In TIA under program blocks double-click on “Add new block”
  2. Change the name to something unique (dbModbusBuffer in this example)
  3. Change the type to array DB
  4. Change the array limit to the size of the transfer area you require
  5. Click OK to finalize
  6. Link All tags to the MB_Server function

Allen Bradley Studio 5000 Configuration

Downloading the AOI:

Unlike Siemens TIA, Logix Designer does not come with any Modbus instructions. Rockwell Automation does provide a free-to-use add-on instruction (AOI) that can perform the operations. (Link to download at end of article) Below are some instructions on how to add the AOI to your project.

  1.  Your download should include a single executable named 101037.exe. Double-click on the file to run the executable.
  2. Accept the user agreement.
  3. Browse for a location to store the contents. (This can be moved at any time)
  4. Open the newly created folder and extract the contents of, “Modbus TCP AOI ver x.xx.zip.”
  5. You should now be able to navigate Modbus TCP AOI ver 2.04\Logic and see the file named, “raC_Opr_NetModbusTCPClient_Rung.L5X”
  6. You can now add the AOI to your project by opening a routine and creating an empty ladder logic rung.
  7. Right-click on the rung, select import rung, and navigate to “raC_Opr_NetModbusTCPClient_Rung.L5X”
  8. After selecting the file, you should see the AOI created as well as several controller tags and a fully linked AOI call.

Configuring the Communication:

In this section, we will go over some of the import tags that were just created, how to initialize the connection, and how to use the transfer area.

Useful controller tags:

  • Client_01_Data.HoldRegisters_4xxx – Modbus holding registers for your Allen Bradley Client
  • Client_01_EN – Enable for your AOI call. This will need to be reset whenever a change is made to a configuration parameter.
  • Client_01_Parameters – Contains all the tags required to initialize the Modbus connection
  • Client_01_Transactions – An array of 5 independent Modbus functions

Setup Instructions:

  1. Expand the Clent_01_Parameters tag
  2. Match the parameters where applicable to the screenshot on the right;
    1. LocalSlot -> Slot the PLC is in
    2. LocalAddress -> IP Address of the Allen Bradley PLC
    3. DestinationAddress -> IP Address of the Siemens PLC
    4. DestinationPort -> Modbus TCP Port (502)
  3. Expand the Client_01_Transactions[0] tag (This will be the READ transaction)
  4. Match the parameters where applicable to the screenshot on the right;
    1. Enabled -> Enable the transaction
    2. PollInterval -> How often the tags will be updated
    3. TransType -> Type of transaction (Read Holding Registers)
    4. StationID -> Modbus Node ID
    5. BeginingAddress -> Modbus Address to start reading from
    6. Count -> How many addresses to read
    7. LocalAddress -> Local address of where the address should be mapped too
  5. Expand the tag Client_01_Transactions[1] (this will be the WRITE transaction)
  6. Match the parameters where applicable to the screenshot on the right;
    1. Enabled -> Enable the transaction
    2. PollInterval -> How often the tags will be updated
    3. TransType -> Type of transaction (Write Multiple Holding Registers)
    4. StationID -> Modbus Node ID
    5. BeginingAddress -> Modbus Address to start writing to
    6. Count -> How many addresses to written
    7. LocalAddress -> Local address of where the address should be mapped too
  7. Write the tag Client_01_EN to one to start the connection (will need to be reset if something was changed

Recap:

We have now created two transfer areas. The first will start at address zero and end at address 19. This will be the data we read from the Siemens PLC and use in our Allen Bradley PLC. The next transfer area will start at index 20 and end at array index 39. This will be data written from the Allen Bradley PLC to the Siemens PLC. We are doing this with the Modbus functions 3 and  16. (3=Read Holding Register, 16 = Write Multiple Holding Registers)

Testing and Troubleshooting

Communication Testing

Both PLCs running the instruction sets above should now be connected via Modbus TCP. The easiest way to test the communication is to manually write a value on the Siemens PLC and use a simple program to reflect the values. Below is an example of a simple of how you move the values from register twenty into register zero.

Now on the Siemens PLC, we should be able to write values to the variable inside our data transfer buffer. When we write to register zero we should see that same value update into register twenty about one second later.

  • “dbModbusBuffer”.THIS[0] -> Output to Allen Bradley PLC, effectively address 40000
  • “dbModbusBuffer”.THIS[20] -> Input from Allen Bradley PLC, effectively address 40020

Troubleshooting:

Both the Siemens and the Allen Bradley instructions offer troubleshooting tags with error codes that can help diagnose any communication faults. Below are some of the tags that may help with troubleshooting

  • Siemens
    •  #MB_SERVER_Instance.ERROR – General Error Status Bit
    • #MB_SERVER_Instance.STATUS – Status of the MB_SERVER instance.
      • By clicking on the instance and pressing F1 on your keyboard you can launch the documentation for the block and view error code meanings
  • Allen Bradley
    •  Client_01_Transactions[X].TransState – Current state of the transmission
      • This variable should cycle between 0 and 1 when in normal operation and 2 or -1 if there is an error
      • Any error at this level will most likely be related to an error in the transaction configuration
    • Client_01_Transactions[X].Diagnostic – This data type will contain specifics as to why the transmission is failing 

Common Issues and Troubleshooting Advice:

  • A common issue with Modbus is the navigation through a building IT network. Modbus TCP communicates through network port 502. For security reasons, this port is usually disabled in building network switches. In this scenario, you would be able to “ping” both devices from the same subnet but any Modbus transmission would fail.
  • Both devices are on a separate subnet. The Siemens PLC can have two IP addresses for each network adapter. A common mistake is to set the IP address and then connect to the incorrect adapter.
  • You can third third-party software to test the configuration of each PLC independently before connecting them. (link to download below)
  • Addresses can easily overlap when first configuring a Modbus connection. This can happen because you have two or more function types trying to execute in the same register area. For example, if you had configured your program to both read and write to the same holding register location, you would see the inputs from your device be immediately overwritten. It is important to take note of what registers will be used as input and outputs.

 

Closing

Modbus TCP is a diversly supported protocol that can be used in a wide range of applications. Although this article was focused mainly on communication between two PLCs, both instruction sets can be used to communicate with any Modbus TCP support device. This diversity in support as well as the long history of stable Modbus TCP connections can make the protocol the go-to method of integrating systems across device manufacturers.

References and External Links

Useful Links:

Modbus TCP scanner: Modbus Tester

Siemens Modbus Help: Link

Allen Bradley Modbus Downloads: Download

References:

Modbus Organization. (2024). Retrieved from https://modbus.com/

Siemens AG. (2019)Modbus/TCP with “MB_CLIENT” and “MB_SERVER” S7-1500 CPU and S7-1200 CPU1. Retrieved from https://cache.industry.siemens.com/dl/files/340/102020340/att_118119/v6/net_modbus_tcp_s7-1500_s7-1200_en.pdf

 

Share this post

Leave A Comment

Let's work together to solve your automation problem

Call 480-900-2170

Message Us