Description of MB_SERVER (S7-1200, S7-1500)

Description of MB_SERVER

Description
The "MB_SERVER" instruction communicates as Modbus TCP server via a PROFINET
connection. The instruction "MB_SERVER" processes connection requests of a Modbus
TCP client, receives and processes Modbus requests and sends responses.
For the S7-1200 with firmware version V4.0 you can use the "MB_SERVER" instruction up
to and including library version V3.1. With the S7-1200 as of firmware version V4.1 and the
S7-1500, you can use the "MB_SERVER" instruction of all library versions.
The connection can take place via the local interface of the CPU or CM/CP.
To use the instruction, you do not require an additional hardware module.
NOTICE
Security information
Note that each client of the network is given read and write access to the process image
inputs and outputs and to the data block or bit memory area defined by the Modbus hold-
ing register.
The option is available to restrict access to an IP address to prevent unauthorized read
and write operations. Note, however, that the shared address can also be used for unau-
thorized access.

Multiple server connections

You can create multiple Server connections. This allows a single CPU to accept connec-
tions from multiple Modbus TCP clients at the same time.
A Modbus TCP server can support several TCP connections and the maximum number of
connections depends on the CPU being used.
The total number of connections of one CPU, including those of the Modbus TCP clients
and server must not exceed the maximum number of supported connections.
Modbus TCP connections can also be shared by "MB_CLIENT" and/or "MB_SERVER" in-
stances.
In the case of Server connections, remember the following rules:
• Each "MB_SERVER" connection must use a unique instance DB.
• Each "MB_SERVER" connection must use a unique connection ID.
The relevant individual connection ID must be used for each individual instance DB of
the instruction. The connection ID and instance DB belong together in pairs and must be
unique for each connection.
• For each connection, the "MB_SERVER" instruction must be called individually.

Parameters
The following table shows the parameters of the "MB_SERVER" instruction:

Parameter Declaration Data type Description

-1-
 Description of MB_SERVER (S7-1200, S7-1500)

The "MB_SERVER" instruction is used to enter into

a passive connection with a partner module. The
server responds to a connection request from the IP
address which is entered in the SDT "TCON_IP_v4"
in the CONNECT parameter.
You can use this parameter to control when a con-
DISCON-
Input BOOL nection request is accepted:
NECT
• 0: A passive connection is established when there
is no communications connection.
• 1: Initialization of the connection termination. If the
input is set, no other operations are executed.
The value 0003 is output at the STATUS parame-
ter after successful connection termination.
Pointer to the Modbus holding register of the
"MB_SERVER" instruction
MB_HOLD_REG must always reference a memory
area that is larger than two bytes.
MB_HOLD_ VAR- The holding register contains the values that may be
InOut accessed by a Modbus client using the Modbus
REG IANT
functions 3 (read), 6 (write), 16 (multiple write) and
23 (reading and writing in one job).
As the holding register, use either a global data
block with optimized access or the memory area of
the bit memories.
Pointer to the structure of the connection description
The following structures (SDTs) can be used:
• TCON_IP_v4: Includes all address parameters
that are required for establishing a programmed
connection. The default address is 0.0.0.0 (any IP
address), but you can enter a specific IP address
VAR- so that the server only responds to requests from
CONNECT InOut this address. When using TCON_IP_v4, the con-
IANT
nection is established when calling the
"MB_SERVER" instruction.
• TCON_Configured (only with S7-1500): Includes
the address parameters of a configured connec-
tion. When using TCON_Configured, the connec-
tion is established by the CPU after download of
the hardware configuration.
"New Data Ready":
NDR Output BOOL • 0: No new data
• 1: New data written by the Modbus client written
"Data Read":
DR Output BOOL • 0: No data read
• 1: Data read by the Modbus client
If an error occurs during the call of the "MB_SERV-
ER" instruction, the output of the ERROR parameter
ERROR Output BOOL
is set to "1". Detailed information about the cause of
the problem is indicated by the STATUS parameter.

-2-
 Description of MB_SERVER (S7-1200, S7-1500)

STATUS Output WORD Detailed status information of the instruction.

Note
Use of Modbus function 23 in the instruction "MB_SERVER"
The instruction "MB_SERVER" supports the use of Modbus function 23 with which you
can write to a holding register and read from a holding register in a job; however, the in-
struction "MB_CLIENT" does NOT support this function and returns an error code.
Also note that for a job with read access and write access, write access is executed be-
fore the read access.

You can find additional information on valid data types under "Overview of the valid data
types".

Static tags of MB_SERVER in instruction version V4.2

The following table describes the static tags of the instance data block of the "MB_SERV-
ER" instruction used in the program. You can write the HR_Start_Offset tag. You can read
the other tags to monitor the Modbus status.

Tag Data type Start value Description

HR_Start_Off- Assign the start address of the Modbus holding reg-

WORD 0
set ister.
Start address of the permitted addressing range of
QB_Start WORD 0
the outputs that can be written (bytes 0 to 65535)
Number of output bytes that can be written by the
Modbus master.
Example:
QB_Count WORD 0xFFFF
QB_Start=0 and QB_Count=10: Output bytes 0 to 9
can be written.
QB_Count=0: No output byte can be written.
Re-
WORD 0 Total number of requests received by the server.
quest_Count
Server_Mes- Total number of received alarms for the relevant
WORD 0
sage_Count server.
Counter for detecting the number of transfers during
Xmt_Rcv_Cou which an error occurred. The counter is only incre-
WORD 0
nt mented when an invalid Modbus request is re-
ceived.
Counters for detecting the number of errors specifi-
Excep-
WORD 0 cally for Modbus which cause an error message to
tion_Count
"MB_CLIENT".
Suc- Event counter for detecting the number of requests
WORD 0
cess_Count that were successfully executed by the server.
Indicates whether the connection to the assigned
Connected BOOL FALSE client has been established or not: TRUE = connec-
ted, FALSE = not connected.

Mapping of Modbus addresses to the process image

-3-
 Description of MB_SERVER (S7-1200, S7-1500)

The "MB_SERVER" instruction allows incoming Modbus functions (1, 2, 4, 5 and 15) direct
read and write access to the process image inputs and outputs of the CPU (use of the data
types BOOL and WORD).
For S7-1200-CPUs, the address space for the process image of the inputs and the process
image of the outputs is 1 KB; it is 32 KB each for S7-1500-CPUs.
The following table shows the address space of the Modbus functions listed above.

Modbus function

Function
Function Data area Address space
code
01 Read: Bits Output 0 to 65.535
02 Read: Bits Input 0 to 65.535
04 Read: WORD Input 0 to 65.535
05 Write: Bit Output 0 to 65.535
15 Write: Bits Output 0 to 65.535
Incoming Modbus requests with the function codes 3, 6, 16 and 23 write or read the Mod-
bus holding registers (you specify the holding register with the MB_HOLD_REG parame-
ter).

Example: Addressing via static tag HR_Start_Offset

The addresses of the Modbus holding register start at 0 (from the perspective of the
MB_CLIENT at 40.001). These addresses correspond to the address area of the CPU
memory area for the holding register. You can also define the HR_Start_Offset tag so that
the Modbus holding register has a start address other than 0.
Example: The holding register begins at MW100, and has a length of 100 WORD. An offset
value in the HR_Start_Offset parameter means that the start address of the holding regis-
ter is moved from 0 to 20. This causes an error whenever the holding register is addressed
below the address 20 and above the address 119.

HR_Start_Offset Address Minimum Maximum

Modbus address
0 99
0 (WORD)
CPU address MW100 MW298
Modbus address
20 119
20 (WORD)
CPU address MW100 MW298

Modbus functions
The following table lists all the Modbus functions that are supported by the "MB_SERVER"
instruction.

Function code Description

01 Read output bits

02 Read input bits
03 Read a holding register

-4-
 Description of MB_SERVER (S7-1200, S7-1500)

04 Read input words

05 Write an output bit
06 Write a holding register
Diagnostics function:
• Echo test (subfunction 0x0000): The "MB_SERVER" instruction receives a
08 data word and returns this unchanged to the Modbus client.
• Reset event counter (subfunction 0x000A): The "MB_SERVER" instruction
resets the following event counters: "Success_Count", "Xmt_Rcv_Count",
"Exception_Count", "Server_Message_Count" and "Request_Count".
Diagnostics function: Fetch event counter of the communication
The "MB_SERVER" instruction uses an internal event counter for communi-
cation to record the number of successfully executed read and write requests
sent to the Modbus server.
11
The event counter is not incremented with the functions 8 or 11. The same
holds true for requests that cause a communications error, for example, if a
protocol error has occurred (e.g., the function code in the received Modbus
request is not supported).
15 Write output bits
16 Write a holding register
23 Write a holding register and read holding register with a request

Example
An example project for the Modbus TCP communication between two S7-1500 CPUs can
be found in the Service and Support Portal under Entry ID 94766380.
Two Modbus functions are used in this example. For each Modbus function, a Modbus
TCP connection is established using a Modbus block pair (MB_CLIENT and MB_SERV-
ER).

See also

-5-
 Description of MB_SERVER (S7-1200, S7-1500)

Difference between synchronous and asynchronous instructions (S7-1200, S7-1500)

-6-