Use an RS485-capable S7-1200 serial module and a G120 variant that supports Modbus RTU. Initialize the PLC port, prove a read transaction, then schedule supported single-register writes and status reads. A PROFINET-only port cannot be converted to RTU by changing a parameter.
Confirm compatible hardware and protocol
This guide targets an S7-1200 using the MB_COMM_LOAD / MB_MASTER instruction family with a compatible CM1241 or CB1241 RS485 interface. Other Siemens controllers and newer instruction families may use different blocks and interfaces. Use the online help for the block version inserted in your project.
Record the complete G120 control-unit order number and firmware. Confirm that its physical interface and firmware support Modbus RTU, rather than assuming that every G120 supports the same buses. Keep the serial register map for that exact device with the PLC project.
Use an RS485 bus layout with termination and biasing according to the module and drive manuals. Check the signal designations at both ends; A/B naming is not a sufficient wiring instruction across different products. Begin with one slave to simplify diagnosis.
Set the drive and PLC serial parameters
The referenced SINAMICS fieldbus manual describes selecting the USS-fieldbus preset p0015=21 and then Modbus protocol p2030=2 on supported variants. Confirm the resulting command/reference connections. Check baud rate p2020, slave address p2021, timing p2024 and process-data monitoring p2040 against your firmware. Hardware address switches can take precedence.
Configure matching baud rate and frame format on the PLC. Do not type a baud-rate number into a drive parameter that expects an enumerated choice. Follow the manual’s save and restart requirements for any setting that needs reinitialization.
Initialize the PLC port through MB_COMM_LOAD with the configured hardware identifier and the correct master instance association. Wait for successful initialization before issuing transactions. Retain initialization errors as diagnostics instead of repeatedly reinitializing the port every scan.
Map the documented process-data registers
| G120 holding register | Purpose | Example MB_MASTER job |
|---|---|---|
| 40100 | Control word | MODE=1, DATA_LEN=1: FC06 write |
| 40101 | Main setpoint | MODE=1, DATA_LEN=1: FC06 write |
| 40110 | Status word | MODE=0: FC03 read |
| 40111 | Main actual value | Read together with 40110, DATA_LEN=2 |
These register assignments follow the cited SINAMICS FW V4.7 fieldbus manual. It documents FC03 reads and FC06 writes: do not assume FC16 block writes are available. The legacy Siemens block selects the function from MODE, address range and length; MODE is not the raw Modbus function code.
Documented register: 40100
Zero-based protocol offset: 40100 - 40001 = 99 (0x0063)
Legacy MB_MASTER DATA_ADDR: 40100
Single-register write: MODE = 1, DATA_LEN = 1Do not enter offset 99 in a block expecting the 4xxxx reference notation. Conversely, do not send 40100 as a raw protocol offset when using a different library. Document both columns in the register sheet.
Build a sequential request scheduler
Use one owner for the serial port. Store receive data in a dedicated WORD array compatible with the selected DATA_PTR interface; legacy versions may require a standard, non-optimized global data block. Keep outgoing and incoming buffers separate.
INITIALIZE → READ STATUS → PREPARE COMMAND → WRITE SETPOINT
→ WRITE CONTROL → READ STATUS → repeat
Any transaction error → record STATUS → invalidate feedback
→ bounded retry / communication faultCall the communication instruction cyclically as required, generate a request only when the previous job has completed, and keep job arguments stable while BUSY. Evaluate DONE and ERROR before advancing. A timer pulse should request the next job, not overwrite an active job.
First prove a status read with motion inhibited. Validate the returned bytes against the online drive state. Then test supported writes using an application-approved control sequence. Decode the status word and permissions before issuing an enable; a copied hexadecimal run word is not a complete drive state machine.
Verify reference normalization before scaling a speed command. If the selected interface uses 16384 for 100%, a 50% example is 8192; that arithmetic is conditional on the confirmed mapping and reference quantity. It is not a universal value for every register or drive profile.
Practical lab and communication-loss checks
- Start with a single drive, a known slave address and a verified serial configuration. Record the successful port-initialization status.
- Read the documented status pair and compare the values with the drive diagnostics. Save one known-good request configuration.
- With the approved test setup, verify setpoint transfer, controlled start and normal stop. Record requested and actual state separately.
- Measure the complete polling cycle, including retries. Choose monitoring settings from the application response requirement and worst-case bus timing.
- Test loss of communication under the approved procedure. Confirm the drive response, PLC alarm, stale-data indication and recovery sequence.
- Save both projects and preserve the register map, serial settings and diagnostic trace.
A successful read does not prove the write path or the loss-of-control response. In the referenced mapping, process-data accesses are relevant to the setpoint watchdog; unrelated parameter traffic should not be used as proof of healthy cyclic control.
| Failure | Check |
|---|---|
| Timeout / no reply | Slave address, frame format, polarity, hardware and termination |
| Modbus exception | Function support, start address, length and access rights |
| Writes succeed; drive does not run | Command source, control sequence, permissions and drive faults |
| Intermittent loss | Port ownership, request overlap, noise and cycle timing |
Frequently asked questions
Can a G120 PROFINET connector carry Modbus RTU?
Modbus RTU requires a supported serial interface. Check the exact control unit; a protocol setting cannot create absent RS485 hardware.
Can I write the control word and setpoint together?
Only if the exact device supports the required multi-register write function. The cited G120 mapping uses FC06 single-register writes, so schedule those writes separately.
Why does DATA_ADDR differ from a Modbus monitor?
One tool may display a 4xxxx reference while another expects a zero-based protocol offset. Register 40100 corresponds to offset 99 in that notation.
Technical references
Use the document edition matching your installed hardware and firmware. The linked manuals establish the device-specific facts; the worked examples and check sheets are training exercises.