Cognex In-Sight to PLC Communication — Profinet & Modbus TCP Setup

Cognex · intermediate · 25 min

Wire a Cognex In-Sight vision system to a Siemens or Allen-Bradley PLC over Profinet and Modbus TCP. Covers In-Sight Explorer network config, GSDML import, Native Mode vs industrial protocol tags, and the common pass/fail data map.

Cognex In-Sight cameras ship with three practical ways to talk to a PLC: Profinet IO (Siemens S7-1200/1500), EtherNet/IP (Allen-Bradley ControlLogix/CompactLogix), and Modbus TCP (universal fallback). This guide walks the Profinet and Modbus TCP paths end-to-end using In-Sight Explorer.

The two things that trip most integrators are (1) enabling the industrial protocol before going online with the job, and (2) matching the PLC-side tag layout to the exact byte offsets Cognex publishes — In-Sight uses a fixed input/output assembly, not a free-form tag list.

1. Network baseline

• Give the camera a static IP in the PLC subnet (default 192.168.0.10 / 255.255.255.0). Set it in In-Sight Explorer → Sensor → Network Settings, not from the PC network adapter.
• Set the PC on the same subnet with a different host address.
• Confirm ping in both directions before enabling any industrial protocol.

2. Enable the industrial protocol

In In-Sight Explorer → Sensor → Industrial Protocols, tick exactly one of:

• Profinet — for Siemens PLCs
• EtherNet/IP — for Allen-Bradley PLCs
• Modbus TCP Server — for everything else, or as a second channel

Enabling a protocol requires a reboot of the sensor. The camera goes offline for ~30 s; don't interpret this as a fault.

3. Profinet setup (Siemens S7-1500 / S7-1200)

GSDML

1. Download the current GSDML-V2.xx-Cognex-InSight-xxxx.xml from Cognex support.
2. In TIA Portal: Options → Manage general station description files (GSD) → Install.
3. The device appears under Other field devices → Profinet IO → Ident Systems → Cognex → In-Sight.

Add the device

• Drag the In-Sight module onto the Profinet subnet.
• Assign a PROFINET device name (must match the one In-Sight Explorer shows under Industrial Protocols, character for character — a mismatch triggers Diagnostic 0x8001 station name not set).
• Assign the IP from the PLC side (uncheck "IP address is set directly at the device" only if you also cleared it in In-Sight Explorer, otherwise you get a duplicate-IP conflict).

I/O mapping

The fixed assembly Cognex publishes over Profinet:

The Trigger bit is edge-sensitive — the PLC must hold it high until TriggerAck goes high, then release it. A ladder rung that only pulses Trigger for one scan will race the camera and drop triggers under load.

4. Modbus TCP setup (universal fallback)

• In In-Sight Explorer, set Modbus TCP Server → Enabled, keep default TCP port 502.
• Cognex exposes the same input/output assembly through the following register map:

• Register values are big-endian (Cognex documents them "Modbus standard"). If your PLC library is Modicon-native it will already read them correctly; if you're on a Rockwell or Beckhoff Modbus client, byte-swap the 32-bit results before parsing.
• Trigger the job by writing 1 → coil 00001 (Trigger) and waiting for input status 10001 (Trigger Ack) to go high.

5. Verify the pass/fail cycle

On either protocol the smoke test is the same:

1. Force Trigger high from the PLC.
2. Watch Acquiring blink high for one scan.
3. Watch Result Valid go high and Inspection ID increment by 1.
4. Read your first user-data word — it should contain the pass/fail integer your job wrote (0/1 by convention).
5. Release Trigger; confirm Trigger Ready returns high before the next inspection.

If Result Valid never comes back, the job hasn't been mapped to output data in the spreadsheet view — see the next section.

6. Common failure modes

• PLC sees zeros in every user-data word. The camera job hasn't written to the output assembly. Open the job, insert WriteOutputInteger() / WriteOutputFloat() cells (Native Mode WriteResult... in EasyBuilder), and reference the correct output offset.
• Trigger works from In-Sight Explorer but not from the PLC. Industrial protocol is disabled, or Explorer is holding the sensor online — set the sensor offline in Explorer or take Explorer off the network before running production.
• Profinet won't go into DATA_EXCHANGE. Device name mismatch (99% of cases). Right-click the device in TIA online view → Assign PROFINET device name and copy the value exactly into In-Sight Explorer.
• Modbus reads return 0xFFFF / timeouts. The client is polling before Trigger Ack. Add a 50 ms poll delay after writing the trigger coil, or gate reads on Trigger Ready = 1.
• Decode Valid stays 0 on a barcode job. The job hasn't written the decoded string into a Modbus/Profinet-visible cell. In EasyBuilder, drag the decoded string onto the Output Data tab; in Spreadsheet, use FormatString() into an output cell.