Connecting a WAGO PFC200 Controller
How to read PLC variables from a WAGO PFC200 controller over Modbus/TCP by mapping them to Modbus registers in the CODESYS project and publishing them into an ISA-95 style MQTT topic hierarchy.
This guide shows you how to read PLC variables from a WAGO PFC200 controller with the Connectware Modbus/TCP connector and map them into an ISA-95 style MQTT topic hierarchy. The PFC200 is a modular controller of the WAGO I/O System 750 that runs a CODESYS V3 based runtime, and its built-in Modbus/TCP server is a robust way to get PLC data into Connectware without touching the fieldbus side of the application. In more detail, the following topics are covered:
Making PLC variables Modbus-readable in the CODESYS project
Choosing register offsets and the matching function code
Decoding 16-bit and 32-bit values with the correct
dataTypeCreating the service commissioning file
Mapping the values into an ISA-95 style MQTT topic hierarchy
Verifying data in the Data Explorer
This guide focuses on the PFC200 specifics. For a general introduction to the Modbus/TCP connector, including function codes and write operations, see Connecting & Integrating a Modbus/TCP Server.
A complete example file is available at the end of this guide.
Prerequisites
To follow this guide, you will need the following:
A running instance of Cybus Connectware.
A WAGO PFC200 controller (750-82xx) that is reachable over Ethernet from Connectware and runs the CODESYS V3 based runtime (e!RUNTIME).
Access to the CODESYS project of the controller (CODESYS 3.5 or e!COCKPIT), because the Modbus register map of a PFC200 is defined in the project.
Access to the Admin UI with sufficient user permissions.
Basic knowledge of MQTT and the Connectware services concept (for example, service commissioning files, connections, and endpoints).
First-generation PFC200 controllers can also run the legacy CODESYS 2.3 runtime. That runtime exposes a fixed, firmware-defined Modbus process image instead of a project-defined one. The address ranges are documented in the product manual of your controller, available in the WAGO PFC200 product documentation. The Connectware side of this guide applies unchanged; only the register offsets come from the manual instead of your CODESYS project.
Making PLC Variables Modbus-Readable
Unlike a device with a fixed register table, such as a power meter, the PFC200 has no predefined Modbus registers for your application data. You define the register map yourself in the CODESYS project by adding a Modbus/TCP server device and assigning PLC variables to its registers. CODESYS uses the terms master and slave for the Modbus client and server roles: the PFC200 acts as the server (slave), and Connectware is the client (master).
To publish PLC variables over Modbus/TCP:
In the CODESYS device tree, right-click the PFC200 and select Add Device.
Add an Ethernet adapter from the Ethernet Adapter category.
Right-click the new Ethernet device and add a Modbus TCP Slave Device from the Modbus category.
Double-click the new device to open its configuration and set the sizes of the holding register and input register areas. Leave the port at the default 502.
Open the Modbus TCP Slave Device I/O Mapping tab and enter a PLC variable for each register the controller should expose. Registers that the controller fills for Connectware to read belong in the input register area. The holding register area is meant for data written by the client.
Download the application to the controller and start it. The Modbus/TCP server is part of the application, so it only accepts connections on port 502 while the application is running.
WAGO describes this workflow in detail in the Modbus example project in the WAGO technical documentation.
The register offsets on the I/O mapping tab start at 0 and map directly to the address property of a Connectware endpoint. Input registers are read with function code 4, holding registers with function code 3.
Example Register Map
The register map is specific to your project, so this guide works with the following example mapping. Replace the variables, offsets, and data types with the ones from your I/O mapping tab.
Offset
Number of registers
CODESYS variable
IEC type
dataType
0
1
wMachineState
WORD
uint16BE
1
1
iLineSpeed
INT
int16BE
2
2
rMotorTemperature
REAL
floatBEWS
4
2
rAirPressure
REAL
floatBEWS
Decoding Multi-Register Values
Modbus registers are 16 bits long. WORD, INT, and UINT variables fit into a single register, and their dataType follows directly from the IEC type: uint16BE for unsigned values, int16BE for signed values.
A REAL (IEEE 754, 32-bit) spans two registers, and here the word order matters: the Modbus protocol defines big-endian byte order within each register, but not which of the two registers carries the high word. On a PFC200, the CODESYS runtime typically places the low word at the lower register offset, which corresponds to dataType: floatBEWS (big-endian with word swap) in Connectware. Because the word order depends on the runtime and how the value is written in the project, verify it against a known value: set the variable to a constant such as 1234.5 in the PLC and check the published value. If the value arrives extremely large, near zero, or otherwise implausible, switch between floatBEWS and floatBE. For all available data types, see Modbus/TCP Endpoint Properties.
Writing the Service Commissioning File
The service commissioning file contains all connection and mapping details. Do not worry about copying the snippets together into one file, the complete example file is available at the end of this guide.
Description and Metadata
These sections contain general information about the service commissioning file. Only the metadata name is required.
Parameters and Definitions
We define the network address of the controller as parameters, so you can set them when you install the service. The default Modbus/TCP port is 502.
The MQTT topics in this guide follow an ISA-95 style equipment hierarchy (<enterprise>/<site>/<area>/<line>). We define the prefix once in the definitions section and reuse it in every mapping with !sub.
Cybus::Connection
The connection resource establishes the Modbus/TCP connection to the controller. The connectionStrategy object controls how Connectware retries failed connection attempts with increasing delays. The default unit ID 1 works for a PFC200 that you address directly; if you reach the controller through a Modbus gateway, set the unitId connection property accordingly. For all connection properties, see Modbus/TCP Connection Properties.
Cybus::Endpoint
Each endpoint polls one PLC variable. The address and length values come directly from the example register map: the offset becomes address, the number of registers becomes length. All values are in the input register area, so every endpoint reads with function code 4. The state and speed values are polled every second, the slower analog values every two seconds.
If you poll many endpoints, enable batch read processing on the connection. Connectware then combines reads of neighboring registers, such as the contiguous offsets 0 to 5 in this example, into a single request.
Cybus::Mapping
The mapping publishes each endpoint on a topic of the ISA-95 hierarchy.
With this mapping, the motor temperature of the line is published on the topic enterprise/hamburg/packaging/line-2/temperature/motor, and every other value follows the same pattern.
Installing the Service Commissioning File
Install the service commissioning file. See Installing Services.
Enable the service. See Enabling Services.
Result: The service is enabled. Connectware establishes the Modbus/TCP connection to the PFC200 and polls the configured registers.
Verifying the Data
Open the Data Explorer and subscribe to enterprise/hamburg/packaging/line-2/#. Each topic carries a JSON object with the keys timestamp and value, where the value is the decoded PLC variable:
A few plausibility checks for the first readings:
The machine state is a small integer code that matches the state shown by the machine or its HMI.
The REAL values are in a physically plausible range, for example a motor temperature between 20 and 100 degrees Celsius.
Forcing a variable to a known constant in CODESYS changes the published value accordingly.
If the connection does not reach the Connected state, verify that the CODESYS application with the Modbus/TCP server device is running on the controller and that port 502 is reachable from Connectware; the firewall settings in the Web-Based Management (WBM) of the PFC200 can block the port. If values arrive but look implausible (for example, extremely large or near-zero numbers for a REAL), the register decoding does not match: check that address, length, and dataType correspond to one row of your I/O mapping, and switch between the word order variants as described in Decoding Multi-Register Values.
Service Commissioning File Example
Last updated
Was this helpful?