Step-by-step instructions for configuring the built-in Modbus driver of the WinCC OA scada system

The purpose of this article is to create a step-by-step instruction for mastering the configuration of the built-in Modbus driver in the WinCC OA scada system

Unfortunately, in the basic course, this connection is not checked and such instructions are not given, therefore, I am eliminating this gap.

So, step-by-step instructions for connecting a standard WinCC OA station using the Modbus TCP protocol. Uses the popular Modbus TCP protocol simulator Modbus Tools

1. A 64-bit operating system, demo or key version of Wincc OA (v3.14 or later) must be preinstalled on the working machine

2. Download and install ModbusPollSetup64Bit.exe and ModbusSlaveSetup64Bit.exe. Install these components to emulate the data stream (sending and receiving telegrams) using the Modbus TCP protocol

3. First we start Modbus Slave (telegram generation) with the settings as shown in the figures, allowing work in the home network (top checkmark)

4. We set any numbers on the slave emulator

5. We set up the master emulator in accordance with the figure. Start Modbus Poll

6. We see the telegram counter (TX) is ticking, we see the received and transmitted data. Function 03 Holding Register is set by default

7. Create a new standard Wincc OA project. Having chosen two languages for the interface, I refuse to enter a password.

8. We launch the created project "TestModbusTCP"

9. We are waiting for the start of all console services

10. Stop the protocol emulation driver (stub) and install the new Modbus driver master

11. Set the initialization string in the Modbus manager

Manager initialization

The console should look like this:

12. We expose in the configuration file of the project
[mod_1]
tcpServerPort = 502
We expose in the configuration file of the project

Use on a private network

13. Confirm access

Console Wincc OA

The console should look like this
14. We configure the driver as in the frame below and activate it, click Active and Apply

15. Trying to run the Slave emulator
If it swears that the port is busy - A GOOD SIGN
We leave this idea without action and start Modbus Pool

We see that telegrams are coming (Tx is changing), the counter is moving, an error is lit alternately, then a read error, then a write error. We take into account that so far we have not created a single tag and the survey has not been created.
16. We create a new data type and a new data point. Set the data type to the new point as integer (Int)

17. Add an alias of the peripheral address to this variable and click on the parameters

Set the Modbus protocol from the list

Set polling options

18. Choose which PLC we have, set the polling period. Important!!! wherever it comes across, put a tick "Active"
19. It remains correct with understanding the network, start the exchange process and everything should work out
You need to start the Modbus Slave (telegram receiver) first, only then the WinCC OA driver. By changing the value in the slave, we see that WinCC OA reads / receives data
Modbus Poll can also be launched, for example, to replace a value in a register, but after starting the main WinCC OA driver

View request:
00 1C 00 00 00 06 01 03 00 00 00 0A
00 1C - package identifier.
00 00 – always this value
00 06 – length of the information part of the packet 6 bytes
01 – the logical address of the controller / is usually 1, but …/
03 – register read instruction
00 00 – from address 0000
00 0A – a total of ten registers are read (twenty bytes)

Type response:
00 1C 00 00 00 17 01 03 14 00 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 1C – repeat id from request
00 00 – always this value
00 17 – information part length (twenty-three bytes)
01 – PLC address / repeat from query /
03 – function
02 - the number of bytes/registers are usually 16-bit, so the number of bytes is a multiple of two /
хххх – register value

00 1C 00 00 00 06 01 03 00 00 00 0A
00 1C 00 00 00 17 01 03 14 00 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Advice, if it doesn’t work out: reboot more often when setting up drivers + if there is no exchange or writes nonsense, then analyze what is inside the exchange packages.
A handy sniffer for Modbus TCP can be found here:
https://soft.mydiv.net/win/files-SmartSniff.html