PID CONTROL AND

COMMUNICATION IN
SIEMENS PLC

S7 COMMUNICATION (DAY3)
8 MARCH 2022
GET- Read Data from Remote CPU

Description
With the instruction "GET", you can read data from a remote CPU.
The instruction is started on a positive edge at control input REQ:
• The relevant pointers to the areas to be read out (ADDR_i) are then sent to the partner CPU. The partner CPU
can be in RUN or STOP mode.
• The partner CPU returns the data:
• If the reply exceeds the maximum user data length, this is displayed with error code "2" at the STATUS
parameter.
• The received data is copied to the configured receive areas (RD_i) at the next call.
• Completion of this action is indicated by the status parameter NDR having the value "1".
GET- Read Data from Remote CPU

Parameters ERROR and STATUS

The following table contains all specific error information for the "GET" instruction that can be output via the
ERROR and STATUS parameters.
GET- Read Data from Remote CPU

Parameters
The following table shows the parameters of the "GET" instruction:
GET- Read Data from Remote CPU

Parameters
The following table shows the parameters of the "GET" instruction:
GET- Read Data from Remote CPU

Parameters
The following table shows the parameters of the "GET" instruction:
GET- Read Data from Remote CPU

Parameters ERROR and STATUS

The following table contains all specific error information for the "GET" instruction that can be output via the
ERROR and STATUS parameters.
GET- Read Data from Remote CPU

Parameters ERROR and STATUS

The following table contains all specific error information for the "GET" instruction that can be output via the
ERROR and STATUS parameters.
PUT- Write Data to a Remote CPU

Description
You can write data to a remote CPU with the instruction "PUT".
The instruction is started on a positive edge at control input REQ:
• The pointers to the areas to be written (ADDR_i) and the data (SD_i) are then sent to the partner CPU. The
partner CPU can be in RUN or STOP mode.
• The data to be sent is copied from the configured send areas ((SD_i). The partner CPU saves the sent data
under the addresses supplied with the data and returns an execution acknowledgment.
• If no errors occur, this is indicated at the next instruction call with status parameter DONE = "1". The writing
process can only be activated again after the last job is complete.
Errors and warnings are output via ERROR and STATUS if access problems occurred while the data was being
written or if the execution check results in an error.
PUT- Write Data to a Remote CPU
ERROR and STATUS parameters
The following table contains all specific error information for the "PUT" instruction that can be output via the
ERROR and STATUS parameters.
PUT- Write Data to a Remote CPU
Parameters
The following table shows the parameters of the "PUT" instruction:
PUT- Write Data to a Remote CPU
Parameters
The following table shows the parameters of the "PUT" instruction:
PUT- Write Data to a Remote CPU
ERROR and STATUS parameters
The following table contains all specific error information for the "PUT" instruction that can be output via the
ERROR and STATUS parameters.
Give Permit Access of 1st PLC
Configure the parameter of 2nd PLC
Add 2nd PLC
Configure the parameter of 1st PLC
Uncheck Optimized Block Address
Add PUT from Communication
Give Permit Access of 2nd PLC
Add DB to Send Data to PLC_2
Uncheck Optimized Block Address
Add PUT from Communication
Add PUT - GET from Communication
Description of MB_CLIENT
Description
The "MB_CLIENT" instruction communicates as a Modbus TCP client via the PROFINET connection. With the
"MB_CLIENT" instruction, you establish a connection between the client and the server, send Modbus requests
and receive responses and control connection termination of the Modbus TCP client.
For the S7-1200 with firmware version V4.0 you can use the "MB_CLIENT" instruction up to and including
library version V3.1. With the S7-1200 as of firmware version V4.1 and the S7-1500, you can use the
"MB_CLIENT" instruction of all library versions.
The connection can take place via the local interface of the CPU or CM/CP.
To use the instruction, you do not require an additional hardware module.
Description of MB_CLIENT
Parameters
The following table shows the parameters of the "MB_CLIENT" instruction:
Modbus Protocol

Modbus is often used to connect a plant/system supervisory computer with a remote terminal unit (RTU) in
supervisory control and data acquisition (SCADA) systems in the electric power industry. Many of the data
types are named from industrial control of factory devices, such as ladder logic because of its use in driving
relays: A single physical output is called a coil, and a single physical input is called a discrete input or a contact.
Modbus object types

The following is a table of object types provided by a Modbus server device to a Modbus client device:
Description of MB_CLIENT
Description
The "MB_CLIENT" instruction communicates as a Modbus TCP client via the PROFINET connection. With the
"MB_CLIENT" instruction, you establish a connection between the client and the server, send Modbus requests
and receive responses and control connection termination of the Modbus TCP client.
For the S7-1200 with firmware version V4.0 you can use the "MB_CLIENT" instruction up to and including
library version V3.1. With the S7-1200 as of firmware version V4.1 and the S7-1500, you can use the
"MB_CLIENT" instruction of all library versions.
The connection can take place via the local interface of the CPU or CM/CP.
To use the instruction, you do not require an additional hardware module.
Description of MB_CLIENT
Parameters
The following table shows the parameters of the "MB_CLIENT" instruction:
Description of MB_CLIENT
Parameters
The following table shows the parameters of the "MB_CLIENT" instruction:
MB_MODE, MB_DATA_ADDR and MB_DATA_LEN parameters
Examples:
•The combination MB_MODE=1, MB_DATA_ADDR=1, MB_DATA_LEN=1 specifies the function code 05. 1 output
bit is written starting from the remote address 0.
•The combination MB_MODE=1, MB_DATA_ADDR=1, MB_DATA_LEN=2 specifies the function code 15. 2 output
bits are written starting from the remote address 0.
Description of MB_CLIENT
Static tags of the instruction
The following table describes the editable static tags of the instance data block of the "MB_CLIENT"
instruction.
Description of MB_CLIENT
Static tags of the instruction
The following table describes the editable static tags of the instance data block of the "MB_CLIENT"
instruction.
REQ and DISCONNECT parameters
Description
If no job is active and if the value of the DISCONNECT parameter is "0", a new job executes if REQ=1. If there is
not yet a connection, this is established during execution.
If the same instance of the "MB_CLIENT" instruction executes again (DISCONNECT = 0 and REQ = 1), before the
active job was executed, this is not executed on completion of the active job. A new job can only be started on
completion of the active job (REQ = 1).
The status of the execution is output by the output parameters. You can use it to monitor the execution status
when the "MB_CLIENT" instruction is executed sequentially.
MB_MODE, MB_DATA_ADDR and MB_DATA_LEN parameters
Description
The combination of the MB_MODE, MB_DATA_ADDR and MB_DATA_LEN parameters defines the Modbus
function code used in the current Modbus message for the values 0, 1 and 2 of MB_MODE:
• MB_MODE contains the information on whether to read or to write.
• MB_MODE=0: Read, MB_MODE=1 and 2: Write (Note: With MB_MODE=2, there is not distinction between
Modbus functions 15 and 05 or between Modbus functions 16 and 06.)
• MB_DATA_ADDR contains the information on what is to be read or written, as well as address information
from which the "MB_CLIENT" instruction calculates the remote address.
• MB_DATA_LEN contains the number of values to be read/written.
MB_MODE, MB_DATA_ADDR and MB_DATA_LEN parameters
The following table shows the relationship between the input parameters MB_MODE, MB_DATA_ADDR,
MB_DATA_LEN of the "MB_CLIENT" instruction and the associated Modbus function.
MB_MODE, MB_DATA_ADDR and MB_DATA_LEN parameters
The following applies to the values 101 to 106 and 115 to 116 from MB_MODE:
•MB_MODE defines the Modbus function code.
•MB_DATA_ADDR contains the remote address.
•MB_DATA_LEN contains the number of values to be read/written.

Example:
MB_MODE=104, MB_DATA_ADDR=17,834, MB_DATA_LEN=125
• MB_MODE=104 defines the function code 04 (read input words).
• MB_DATA_ADDR=17,834 defines the remote address 17,834.
• MB_DATA_LEN=125 defines that 125 values are read.
MB_MODE, MB_DATA_ADDR and MB_DATA_LEN parameters
The following table shows the relationship between the input parameters MB_MODE, MB_DATA_ADDR,
MB_DATA_LEN of the "MB_CLIENT" instruction and the associated Modbus function.
MB_MODE, MB_DATA_ADDR and MB_DATA_LEN parameters
The following table shows the relationship between the input parameters MB_MODE, MB_DATA_ADDR,
MB_DATA_LEN of the "MB_CLIENT" instruction and the associated Modbus function.
MB_MODE, MB_DATA_ADDR and MB_DATA_LEN parameters
The following table shows the relationship between the input parameters MB_MODE, MB_DATA_ADDR,
MB_DATA_LEN of the "MB_CLIENT" instruction and the associated Modbus function.
MB_MODE, MB_DATA_ADDR and MB_DATA_LEN parameters
The following table shows the relationship between the input parameters MB_MODE, MB_DATA_ADDR,
MB_DATA_LEN of the "MB_CLIENT" instruction and the associated Modbus function.
MB_DATA_PTR parameter
Description
The MB_DATA_PTR parameter is a pointer to a data buffer for the data to be received from the Modbus server
or to be sent to the Modbus server. As the data buffer, you can use a global data block or a memory area (M).
For a buffer in the memory area (M), use a pointer in the ANY format as follows: "P#bit address" "data type"
"length" (example: P#M1000.0 WORD 500).
MB_DATA_PTR parameter
Depending on the memory area in which the data buffer is located, MB_DATA_PTR can reference different data
structures:
• When you use a global DB with optimized access, MB_DATA_PTR can reference a tag with elementary data
type or an array of elementary data types. The following data types are supported:
CONNECT parameter
Connection description for programmed connections
Use the following structure for connection description to TCON_IP_v4 for programmed connections at the
CONNECT parameter:
•Make sure that only connections of the type TCP are specified in the TCON_IP_v4 structure.
•The connection may not use the following TCP port numbers: 20, 21, 25, 80, 102, 123, 5001, 34962, 34963
and 34964.
CONNECT parameter
Connection description for programmed connections
Parameter STATUS
Parameter STATUS (general status information)
Parameter STATUS
Parameter STATUS (protocol error)
Parameter STATUS
Parameter STATUS (protocol error)
Differences between PLCSIM & PLCSIM Advanced

Runtime Independence
The PLCSIM (V12 or V5.X) cannot run without running of Step-7 software program unlike the PLCSIM
Advanced it’s independent.
Communication
For PLCSIM (V15 or V5.X) they are communicating just into your PC with a bus called SOFTBUS.
But on the other hand, we will find that PLCSIM Advanced has the ability to communicate with outside
devices using TCP/IP protocol and Virtual SIEMENS LAN adaptor and can also make a connection into your
PC using SOFTBUS.
Supported CPUs
The PLCSIM Advanced supports S7-1500 and ET-200SP CPUs for the emulating, PLCSIM V12 and Higher
support S7-1200, S7-1500, and ET-200SP CPUs and for PLCSIM V5.X can handle S7-300 and S7-400.
Differences between PLCSIM & PLCSIM Advanced

Number of Available PLCs That Can be Simulated

PLCSIM V5.X can just simulate one PLC unlike the PLCSIM Advanced can handle up to 16 Instance and
PLCSIM V12 and higher can simulate up to 2 PLCs.
OPC UA Sever
One of the best features in PLCSIM Advanced that it can use to emulate an OPC server on 1500 station so
you can activate this server and connect it with the SCADA system that supports OPC UA.
Instances Communication
PLCSIM Advanced does not support communication between the simulated PLCs but the PLCSIM V12
instance can communicate with PLCSIM V5.X Via soft bus.
Description of MB_SERVER
Description
The "MB_SERVER" instruction communicates as Modbus TCP server via a PROFINET connection. The
instruction "MB_SERVER" processes connection requests of a Modbus TCP client, receives and processes
Modbus requests and sends responses.
For the S7-1200 with firmware version V4.0 you can use the "MB_SERVER" instruction up to and including
library version V3.1. With the S7-1200 as of firmware version V4.1 and the S7-1500, you can use the
"MB_SERVER" instruction of all library versions.
The connection can take place via the local interface of the CPU or CM/CP.
Download and Install PLC SIM Advanced
TRIAL Download: SIMATIC S7-PLCSIM Advanced V3.0 - ID: 109772889 - Industry Support Siemens
Configuration of the Software

•CPU type – Here you select the type of CPU to be simulated.

•“Start” button – Create with the button and start the instance.
Buttons for operating the selected instances.
Instance list – list shows the available local instances. The instances can be resorted using the mouse cursor.
LED displays the meaning of the LED is displayed when you move the mouse
over it.
Icons for operating the instance
Runtime Manager Port Here you open a port on the local PC.
Configuration of the Software

Virtual SIMATIC Memory Card Open an Explorer window here in which you select the path to the virtual
memory card.
Display messages Here you disable the PLCSIM Advanced messages in the Windows task bar for the duration of
the operation.
Function manual This is where you open the S7-PLCSIM Advanced Function Manual in a standard PDF viewer.
Exit logs off all instances and closes the Control Panel
Set the Server PLC
Advantages of PLCSIM Advanced

•Improve quality of automation projects by early error detection

•Avoid costs for hardware in simulation environments
•Reduced response times
•Reduce risk for commissioning
•Earlier training of operator is possible
•Increase production efficiency by optimizing program components
•Increase efficiency during replacement of machine components
•Increase efficiency during expansion of existing plants
NOTE The virtual controller cannot fully simulate a real CPU down to the individual details.
Even if a program is downloaded without errors to the CPU and running successfully, this does not
necessarily mean that the virtual controller in the simulation behaves exactly like a real CPU.
Configuration of the Software
Configuration of the Software

Online access Switch to select the communication interface.

TCP/IP communication Selection of network adapter for distributed communication.
Virtual time Slider to adjust the scaling factor.
Start Virtual S7-1500 PLC Opens and closes the input boxes for creating the instance (virtual controller).
•Name of the instance – Here you enter a unique name for the instance. Enter a minimum of 3, a maximum of 64
characters. If the name is unique in the network, the button “Start” is enabled.
•IP address
•Subnet mask
•Standard gateway – The input boxes are visible when you switch the communication interface to “PLCSIM
Virtual Ethernet Adapter”. The IP address is entered automatically.
Configuration of the Software

•CPU type – Here you select the type of CPU to be simulated.

•“Start” button – Create with the button and start the instance.
Buttons for operating the selected instances.
Instance list – list shows the available local instances. The instances can be resorted using the mouse cursor.
LED displays the meaning of the LED is displayed when you move the mouse
over it.
Icons for operating the instance
Runtime Manager Port Here you open a port on the local PC.
Make New DB at PLC Client, to Store the data
Run PLCSIM advanced
Set the Client PLC
Set the Server PLC
Start TIA Portal, put 1 PLC as a Client and 1 PLC as a Server
Put the parameter for CONNECT DB
Put the parameter for CONNECT DB
Make New DB at PLC Client, to Store the data
Put data list, in this case we put array data INT, at Data_client DB
Don’t forget to uncheck Optimized block access at Data_client DB
Don’t forget to right click Project Name, and under protection, check the support simulation
Add Data Block CONNECT to PLC CServer, to make parameter
Put the parameter for CONNECT DB
Make New DB at PLC Server, to Store the data
Put data list, in this case we put array data INT, at DATA_SERVER DB
Don’t forget to uncheck Optimized block access at DATA_SERVER DB
Change MB_MODE to 1, to make request from client to send data to server
MB_CLIENT sent data from Client to Server
Compile and Download for every PLC to their Simulator
Go Online
Make a request to send data from Server to Client by, set the DATA_LEN to 5
MB_SERVER sent data from server to Client
MB_SERVER sent data from server to Client
Change MB_MODE to 1, to make request from client to send data to server
MB_CLIENT sent data from Client to Server