How do I programm a PC as a PLC that has registers that are readable via Modbus using Beckhoff Twin CAT 3 TCP Modbus?

Question

I would like to use Beckhoff Twin CAT 3 TCP Modbus module to make registers in a PC which is running as a PLC readable via Modbus. I have downloaded the function Modbus TCP from the Backhoff website. I have followed the example in the Manual TF6250 TwinCAT 3 | Modbus TCP page 55. When I try to read the register at address 0x3000 with a modbus client I get an invalid address error.

The code looks as follows:

PROGRAM MAIN
    VAR
        ipAddr : STRING(15) := '';
        nValue AT%MB0 : ST_EM_Ausgangsdaten_Float;
        fbWriteRegs : FB_MBWriteRegs;
        bWriteRegs : BOOL;
    END_VAR

IF NOT bWriteRegs THEN
    nValue.BlindleistungL1 := nValue.BlindleistungL1+1;
    nValue.BlindleistungL2 := nValue.BlindleistungL2+1;
    nValue.BlindleistungL3 := nValue.BlindleistungL3+1;
    
    bWriteRegs :=TRUE;
    fbWriteRegs.sIPAddr :=ipAddr;
    fbWriteRegs.nQuantity := 1;
    fbWriteRegs.nMBAddr := 16#3000;
    fbWriteRegs.cbLength := SIZEOF(nValue);
    fbWriteRegs.pSrcAddr := ADR(nValue);
    fbWriteRegs.tTimeout := T#5S;
    fbWriteRegs(bExecute:=TRUE);
ELSE
    IF NOT fbWriteRegs.bBUSY THEN
        bWriteRegs :=FALSE;
    END_IF
    fbWriteRegs(bExecute:=FALSE);
END_IF

Could someone point me to the direction of how to read a variable in a PLC via Modbus.

Answer 1

If I understand your question correctly you are wanting run a Modbus TCP Server (and from your comments it sounds like you have already got something running, but you might not understand exactly why).

I am sure that you know this, but Modbus TCP works by Clients issuing Modbus commands to Read/Write data to/from a Modbus Server and the server responds with the data (or success). The TF6250 communication module allows you to do this in a few ways.

---

The first issue you have is that the sample code on page 55 you implemented is for the "FB_MBWriteRegs" function. This is a function where your program is acting as a Modbus client (and not a server). It is trying to connect to a remote server and write data to the Modbus address on that server. The description in the manual probably isn't the best and I can see how it may be misleading.

In your case (as it is in the sample code) the STRING ipAddr is empty. I wouldn't be surprised if your fbWriteRegs is reporting an error. You could check this by inspecting the value of the fbWriteRegs.bError and fbWriteRegs.nErrId tags.

For this code to work you would need to connect to an existing Modbus TCP Server and populate the correct IP address.

Additionally, I don't know what data type "ST_EM_Ausgangsdaten_Float" is, but given that this function is for writing to output registers, I wouldn't be surprised if there were issues there as well.

In any case, this isn't what you are wanting to do. I think you will find that if you remove/delete this code and leave your variables mapped as globals it will still 'work'.

---

What you are probably interested in, is section 4.2 and 4.3.

TF6250 installs a Windows Application that acts as a Modbus TCP server. This server acts as a Modbus to ADS converter which maps values from Modus registers to PLC memory areas via ADS.

You can access the configuration of the Modbus TCP server and the mapping from the TwinCAT Modbus TCP Configuration Tool. For windows this is usually located in the "C:\TwinCAT3\Functions\TF6250-Modbus-TCP" directory. (For Twicat/BSD it is a different procedure all together).

The config app looks like this;

If you click "Get Configuration" - wait a while until it loads, and then "Export Configuration" you can save the mapping/config in a XML file.

The Default mapping is shown on page 19 in section 4.3, which is how I suspect yours is currently working.

If you want to map directly to memory areas rather than via global you will need to know your IndexGroup and Index Offset available here and here. Note: I understand mapping this way improves performance for larger amounts of data but I haven't tested it.

You can manipulate the XML file for the mapping you require. However if you are able to choose whatever memory area you like, I would leave the default configuration for what you want to do and delete the rest of the config, then I would map my data to the appropriate TwinCAT memory area, but that is entirely up to you.

After you have modified your XML file, you can use the Config tool to "Import Configuration" select your modified XML file, and then "Set Configuration" to update the mapping.

You should then be able to use a Modbus Client to connect to your modbus server and know EXACTLY what data is being written to what Modbus address and thus memory area (%M, %Q, %I etc...)

Good luck!