Configuring WinCC Modbus TCP for Twido PLC Input Reading

Configuring WinCC Modbus TCP for Twido PLC Input Reading

This field-proven reference bridges a Schneider Electric Twido controller to Siemens WinCC V7 and WinCC Unified over Modbus TCP/IP. It documents the Ethernet expansion module commissioning, the Twido Modbus server parameters, the Modicon-style address mapping for %I, %Q, %M and %MW objects, and the driver / tag settings in both the WinCC classic explorer and the TIA Portal Unified project tree. Each section ends with a verification step so a commissioning engineer can confirm the link before looping the rest of the plant into the HMI.

1. Integration Overview

Twido controllers expose their I/O and memory map through Modbus TCP when equipped with the Twido Ethernet expansion module (Modular bases) or the integrated Ethernet port found on certain Compact bases. By configuring WinCC as a Modbus TCP client, the HMI can poll discrete inputs (%I), output coils (%Q), internal memory bits (%M), and 16-bit memory words (%MW) without any custom OPC bridging layer. The protocol is plain Modbus TCP/IP: TCP transport, server port 502, deterministic request/response, well suited to HMI refresh intervals of 250 ms to 1 s.

The WinCC side can use one of two platforms: WinCC V7.x (Classic) with the "SIMATIC WinCC Modbus TCP/IP" driver option, or WinCC Unified inside TIA Portal (Comfort Panels, Unified Comfort Panels, or Unified PC). Both platforms speak identical wire-level Modbus TCP; they differ in project-tree structure, tag editor layout, and how events are wired to scripts.

Typical network topology

2. Prerequisites

3. Twido Ethernet Module Commissioning

The Twido Ethernet module drops into the right-side expansion slot of a Modular Twido base. The panel provides two RJ45 sockets that act as an unmanaged internal switch, so a daisy-chain topology is possible without external switching hardware.

1. Open TwidoSuite and load the active Twido project.
2. Connect to the controller (USB / Serial / Ethernet if reachable).
3. Open Hardware configuration and confirm the Ethernet option module is detected. Note its slot index; the slot order determines how TwidoSuite references the module in the network configuration dialog.
4. Open the Ethernet dialog of the module and configure:
   • IP address: 192.168.10.50
   • Subnet mask: 255.255.255.0
   • Gateway: 0.0.0.0 unless inter-VLAN routing is required
   • Ethernet Mode: 100BaseTX, auto-negotiate
   • Transmission: Auto
5. Download the configuration to the controller. A cold restart is required for the IP to take effect on certain firmware revisions.
6. Ping the controller from the WinCC engineering station. A ping failure indicates either physical link, subnet, or Windows Defender Firewall; verify link LEDs (green steady = 100 Mbit/s link), subnet mask, and firewall rules.

4. Twido Modbus TCP Server Configuration

Twido firmware ships the controller's internal data map over the standard Modbus TCP port 502. The Modbus function codes supported by a Twido are listed below.

1. In TwidoSuite, expand the Ethernet option module under the controller and double-click TCP/IP Protocols.
2. Tick Modbus TCP Server. The default listener is TCP port 502. Edit only if a port collision is known (for example, a SCADA gateway already occupying 502).
3. Configure the connection inactivity timeout: 30 seconds is a safe default that lets the WinCC client detect a lost connection faster than the OS-level TCP keepalive.
4. If the Twido sits behind a NAT router, forward TCP 502 to the controller IP. The WinCC-side address becomes the NAT public IP and the Unit Identifier (also called the Modbus slave address) stays at the Twido's local ID (default 1, or 255 to ignore it).
5. Save and download to the controller. Confirm the server is listening with a portable Modbus TCP client (see §9).

5. Modbus Address Mapping Reference

Twido follows the Modicon addressing convention. The reference number is the Modbus 0-based offset plus a leading area digit; the table below summarizes the relationship between Twido objects and Modbus reference numbers.

Example for a TWDLMDA40DRF with default memory layout. The exact base addresses vary by Twido firmware revision and physical I/O count; always export TwidoSuite's addressing report into the WinCC project so the offsets match.

Conversion formulas

When the Twido stores values that WinCC must display with engineering units, the conversions use the standard Modbus driver scaling. For a signed 16-bit value raw coming back from %MW (Function 03), the WinCC tag should be configured with Signed 16-bit data type so the driver already produces the two's-complement signed value; the formula for displaying raw / full-scale 0–2000 counts as °C is:

For a Float32 spanning %MW400..%MW401 with a 0.1 engineering scaling (raw 0..10000):

For a Boolean input sent as a single bit in %MW500 (least significant bit), set the WinCC bit offset to 15 - bit_index or use the dedicated bit-access primitive exposed by the driver.

6. WinCC V7 Classic Configuration

WinCC V7 (from V7.4 onward) provides the "SIMATIC WinCC Modbus TCP/IP" driver. The configuration is performed in WinCC Explorer.

1. Open WinCC Explorer and select the project.
2. Right-click Tag Management → Add New Driver. Choose ModbusTCP from the catalog under "SIMATIC NET/TCP/IP" drivers.
3. Right-click the new driver → New Connection:
   • Name: e.g., TWD_TWDLMDA40
   • Type: TCP/IP
   • Device address: 192.168.10.50
   • Port: 502
   • Unit Identifier / Slave ID: 1; use 255 if the Twido sits behind a NAT or when the Unit ID is not enforced.
   • Connection timeout: 5000 ms
   • Cycle time: 1000 ms (lower for tight updates)
4. Click the new connection and define tags. The WinCC V7 tag dialog accepts:
   • Data Type: Binary, Unsigned 16-bit, Signed 16-bit, Float 32, etc.
   • Direction: Input (read) or Output (write)
   • PLC name: e.g., Twido (within connection tree)
   • Address (0-based offset within the area): type the requested Twido address as decimal offset.

Example tag definitions

For float-32 values the driver reads two consecutive holding registers; ensure the Byte Order matches the Twido's word sequence to avoid a value such as 1.18E-19 in place of 23.5.

Verification in WinCC V7

• Activate the project. The tag icon shows green for a healthy connection; yellow or red indicates an error code.
• Open Tag Management → Tags → <tag> and click Status to read the driver-internal quality code.
• Use Tools → Channel Diagnostics to inspect the Modbus transaction count, RTT, and exception rate.

7. WinCC Unified (TIA Portal V17 / V18 / V19 / V20) Configuration

WinCC Unified combines Comfort Panel RT, Unified Comfort Panel RT, and Unified PC under one project model inside TIA Portal. The Modbus TCP driver is a built-in HMI driver.

1. Add a new HMI device in the project. For Comfort Panels use "Comfort Panel"; for unified panels use "Unified Comfort Panel"; for PC runtime use "WinCC Unified PC" (RT).
2. Open Devices & Networks → <HMI> → Connections. Add a new connection of type Modbus TCP.
3. Set the connection attributes:
   • Local endpoint: the HMI device's IP (e.g., 192.168.10.10)
   • Partner endpoint: 192.168.10.50, port 502, role Server (Twido is the Modbus server)
   • Mode: TCP direct
   • Unit ID: 1 or 255 per requirement
   • Acquisition cycle: 250 ms for fast inputs; 1000 ms for status words
4. Open the HMI tag editor and add tags under the connection. Each tag specifies:
   • Name: e.g., Twido_DI00
   • Connection: the Modbus TCP connection created above
   • Data type: Bool, Int, Word, Real, etc.
   • Address: Modicon notation (e.g., 100001 for the first discrete input)
   • Access mode: Read-only or Read / Write
   • Acquisition: Cyclic in operation for typical HMI updates; Cyclic continuous for background logging
5. Compile the HMI and download to the runtime. Confirm connection status via Runtime → Diagnostics → Connections.

WinCC Unified address syntax

Bit extraction from a Word

If the Twido packs 16 discrete inputs into a single %MW (for example, a remote I/O scanner that returns module-2 inputs in %MW50), expose that word as a 16-Bit Unsigned and decode in the HMI logic:

8. Reading and Reacting to Input Events

After the inputs are polled into WinCC Unified, two workflows commonly arise: triggering scripts on input changes and committing entered values back to the Twido.

1. Place an IO field, slider, or toggle button on the screen.
2. Open the Properties pane and expand Events.
3. The event "Input finished" (sometimes labeled "Value input finished") exposes an event to set a tag, change the active screen, or invoke a VB / C script.
4. To trigger a write back to a Twido setpoint, wire the IO field's "Value input finished" event to a SetTag / script that updates the writable %MW tag.

The official WinCC Unified runtime documentation describes the input life cycle of an IO field, including the numeric pad, as part of the function-list Input support (RT) section. See WinCC Unified input support (RT) for the canonical event names and runtime function signatures for V20; equivalent behavior exists in V17, V18, and V19 with the same event labels.

Tag change events

For raw input bit changes delivered by the Twido (e.g., a high-speed discrete input wired into %I2), configure a Value change trigger on the corresponding HMI tag. The handler runs in the Unified runtime's VBScript / C engine and can write to other tags, log to SQL, or trigger an alarm.

Modbus TCP transaction timing

9. Verification and Online Diagnostics

After the driver and tag settings are downloaded, run the following ladder before sign-off.

1. Physical layer: ping 192.168.10.50 from the engineering station. <5 ms RTT on a switch network is healthy; >50 ms suggests cabling or duplex mismatch.
2. Modbus TCP open: Use a portable client (qModMaster, Modbus Poll, or a custom Wireshark trace using the "mbtcp" decoder) to confirm port 502 answers and that holding register 100 holds the value programmed in TwidoSuite.
3. WinCC tag status: In WinCC V7 right-click the tag → Status, ensure Quality Code = "Good". In WinCC Unified inspect the tag's Quality column in the tag editor or the runtime diagnostics view.
4. Live update: Configure a screen containing an IO field bound to the tag. Toggle the input on the Twido base (or edit the value in an animation table in TwidoSuite) and confirm the IO field refreshes within the configured polling cycle.
5. Forced failure: Power the Twido to OFF. Within the connection timeout the tag should display "Communication Fault" / "No Connection". This validates the failure path before plant tie-in.
6. Input finished event: Trigger the HMI "Input finished" event by entering a value in a numeric IO field. Verify the configured handler executes (for example, a confirmation banner appears briefly).

Wireshark capture recipe

1. Run Wireshark on the engineering station with capture filter tcp port 502.
2. Apply display filter mbtcp to show only Modbus / TCP frames.
3. Confirm each request has a matching response with the same Transaction ID, normally < 50 ms apart.
4. Watch for TCP retransmissions; these indicate duplex mismatch or unstable cabling.

10. Troubleshooting Matrix

11. Frequently Asked Questions