Home

Modbus ASCII Master

1. 43H lt reg_data 3 gt High A3H lt reg_data 3 gt Low xxH LRC Reply Message from Slave FUNCTION 16 05H Slave Address 10H Function Code OOH Register Address High 60H Register Address Low OOH Amount of Registers High 03H Amount of Registers Low xxH LRC Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 16 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Codes 5 15 Function Code 16 Write Multiple 32 Bit Registers Function Start Address Amount of Registers SEND Source DB Function code 16 serves to overwrite up to 61 registers in the slave with one request message The parameter Register Start Address is not checked by the driver and is sent unchanged A maximum of 61 registers 1 register four bytes can be written The parameter byte counter in the request message is generated by the driver based on the transferred parameter amount of registers It is not included in the SEND Source DB Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 50 Function Code reg_startadr WORD W 16 0120 Register Start Address INT Amount of Registers reg_data 1 DWORD w 16 51A152A2 Register Data reg_data 2 DWORD w 16 53A354A4 Register Data Example Request Message FUNCTION 16 05H Slave Address 10H Function Code 01H Register Address High 20H Register Address Low OOH Amo
2. 79 The R_TYP specified for SFB SEND RK is illegal X has to be entered for R_TYP with this driver in P_SND_RK Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 7 8 6ES7870 1CA00 0YA0 Manual Edition 1 0 Event Class E 0EH Loadable Driver General Processing Errors lt Receive Evaluation gt Event Number Decimal E o o B A 7 B Loadable Driver CP341 6ES7870 1CA00 0YA0 Event Text Slave address incorrect The received slave address is different from the sent slave address Function code incorrect The function code received in the reply message is different from the sent function code Byte Underflow Amount of characters received is less than should have resulted from the byte counter of the reply message or is less than expected with this function code Byte Overflow Amount of characters received is more than should have resulted from the byte counter of the reply message or is more than expected with this function code Byte counter wrong The byte counter received in the reply message is too small Byte counter wrong The byte counter received in the reply message is wrong Echo wrong The data of the reply message amount of bits echoed from the slave are different from the data sent in the request message LRC incorrect An error has occurred on checking the LRC of the reply message from the slave A received character
3. WORD W 16 0180 Register Address WORD __ W 16 3E7F _ Registers Value Example Request Message FUNCTION 06 05H Slave Address 06H Function Code 01H Register Address High 80H Register Address Low 3EH Register Value High 7FH Register Value Low xxH LRC Reply Message from Slave FUNCTION 06 05H Slave Address 06H Function Code 01H Register Address High 80H Register Address Low 3EH Register Value High 7FH Register Value Low xxH LRC Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 9 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Codes 5 8 Function Code 06 Write Single 32 Bit Register Function Register Address Register Value SEND Source DB This command serves to overwrite a slave 32 bit register with a new value The parameter Register Address is not checked by the driver and is sent unchanged Any value can be used as the Register Value Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 46 Function Code WORD W 16 0180 Register Address DWORD W 16 11223344 Registers Value Example Request Message FUNCTION 06 05H Slave Address 06H Function Code 01H Register Address High 80H Register Address Low 11H Register Value Byte 1 22H Register Value Byte 2 33H Register Value Byte 3 44H Register Value Byte 4 xxH LRC Reply Message from Slave FUNCT
4. At this point the length of the received data block is displayed in the parameter LEN As mentioned above completion of the entire Modbus job can be recognized at output DONE of FB P_SND_RK In the event of receive or transfer errors there is no data transfer to the CPU In this instance P_SND_RK is completed with an edge at the output ERROR The user data received with a reading function code are entered into the P_RCV_RK destination area A detailed description of each P_RCV_RK destination DB can be found in the chapter Function Codes The length of data entered is displayed on the parameter LEN of P_RCV_RK Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 6 4 6ES7870 1CA00 0YA0 Manual Edition 1 0 Diagnostics of the Driver 7 Diagnostics of the Driver Diagnostics Functions Display Elements LED STATUS Output of FBs Diagnostic Buffer of the CP The diagnostics functions of the CP enable you to easily know when an error has occurred and quickly determine the cause of the problem The following diagnostic facilities are available e Diagnostics via display elements of the CP e Diagnostics via the STATUS output of the function blocks e Diagnostic buffer of the CP The display elements provide information on the operating status and or a possible error status of the CP The display elements give a first overview of internal or external errors as well as interface specific errors Each func
5. DONE DB40 DBX0 4 ERROR DB40 DBX0 5 STATUS DB40 DBW12 6ES7870 1CA00 0YA0 Manual Edition 1 0 0 4 0 5 0 0 0 0 Trigger SEND ISEND_REQ SEND_DONE SEND_ERROR Reset Trigger SEND Set SEND_REQ ISEND_DONE SEND_ERROR ISEND_REQ ISEND with REQ 0 Length SEND Data ISEND LEN Il Hf Hf CON1 CON2 LEAV U DB40 DBX 0 4 SPBN CONI L DB40 DBW 6 amp 6 1 T DB40 DBW 6 amp 6 SPA LEAV U DB40 DBX 0 5 SPBN CON2 L DB40 DBW 8 1 T DB40 DBW 8 L 0 L DB40 DBW 12 SPB LEAV T DB40 DBW 14 SPA LEAV L 0 L DB40 DBW 12 SPB LEAV T DB40 DBW 14 CLR Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 6ES7870 1CA00 0YA0 Manual Edition 1 0 Application Example IDONE lif NO Complete without error increment counter I further user functions I ERROR if NO Complete with error increment counter IT Error Handling Il Hif STATUS lt gt 0 save STATUS if STATUS lt gt 0 save STATUS IT Error Handling IT 8 6 Application Example FC23 Carry out RCV Receive wren nn nn nn nana nn nana enna nn nn nnn ne nn ne nn nn nee Enable Receive Data ween n nnn nn nana nn nana enna enna nnn nn nn eens ene SET E DB41 DBX 0 0 l O gt RCV with Instance DB ME toctaetetceieceaaetaaeitamamatanaam CALL FB 7 DB70 EN_R DB41 DBX
6. With this parameter you can choose whether RS 232 C secondary signals are used or not If no secondary signals are parameterized the CP neither sets nor checks these signals The description of the used secondary signal please find in Chapter 4 of this manual After output of a request the CP waits the defined time to set the RTS line to OFF Data Output The data output waiting time is the time that the CP 341 is to wait for the Waiting Time communication partner to set CTS to ON after setting the RTS line to ON and before starting the transmission Selecting Select the parameters required for your data link and exit the individual dialog Parameters boxes by clicking OK Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 3 8 6ES7870 1CA00 0YA0 Manual Edition 1 0 Commissioning Driver 3 7 Loading the Configuration and Parameter Assignment Data Data Management On closing the Hardware Configuration the data is automatically saved into your Step7 project Loading of The configuration and parameterization data can now be downloaded online from Configuration and the programming unit to the CPU Use menu commands PLC gt Download to Parameters transfer the data to the CPU During CPU startup and each time you switch between STOP mode and RUN mode the module parameters of the CP are automatically transferred to the CP as soon as it can be reached via the S7 300 backplane bus The driver code is not saved in
7. at User Level Decimal 01 05 15 Output bit OXXxx 02 Input bit 1XXXx 04 Input register 3XXXX 03 06 16 Holding register 4xxxx In the transmission messages on the serial transmission line the addresses used in the Modbus user system are referenced to 0 In the Modbus user system itself these addresses are counted beginning with 1 Example If the first holding register in the user system is represented as register 40001 in the transmission message the value 0000 Hex is transmitted as the register address when FC 03 06 or 16 is used to access register 40001 If the 127th coil is represented as coil 00127 in the user system it is assigned the coil address 007E Hex in the transmission message Note The CP341 driver only deals with the transmitted or received zero based PDU addresses Any translation from the user level address must be handled in the application program in the S7 PLC or the associated HMI Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 1 3 6ES7870 1CA00 0YA0 Manual Edition 1 0 Installation 2 Installation 2 1 Use of the Dongle Introduction In order to run the CP with loadable drivers you require a dongle When the dongle is plugged in drivers can be loaded How to Plug In the Before you can plug in the dongle you must take the CP out of the rack At the Dongle back of the CP above the plugs for the backplane bus there is a slot into which the dongle can be
8. 0 Function Codes 5 10 Function Code 08 Diagnostics Loop Back Test Function This function serves to check the communications connection Only Diagnostic Code 0000 is supported with this function code Diagnostic Code The only permissible value for the parameter Diagnostic Code is 0000 Test Value Any value can be used as the Test Value SEND Source DB Structure of SEND Source Area Address Name Type Start value Comment W 16 0000 W 16 A5C3 Example Request Message FUNCTION 08 05H Slave Address 08H Function Code 00H Diagnostic Code High OOH Diagnostic Code Low A5H Test Value High C3H Test Value Low xxH LRC Reply Message from Slave FUNCTION 08 05H Slave Address 08H Function Code 00H Diagnostic Code High OOH Diagnostic Code Low A5H Test Value High C3H Test Value Low xxH LRC The slave must return the request message to the master unchanged echo The reply message is not entered into an RCV DB Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 12 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Codes 5 11 Function Code 11 Get Comm Event Counter Function This function code serves to read a Status Word 2 bytes long and an Event Counter 2 bytes long from the slave SEND Source DB Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 0B Function Code Example Request Mess
9. CP341 Modbus ASCII Master with 32 Bit Extensions 8 3 6ES7870 1CA00 0YA0 Manual Edition 1 0 Application Example 8 1 2 Programming Example Programming T Example he blocks are listed as follows Bo oomme FC 10 FC for Startup OB OB 100 Startup OB for Restart OB 1 Cyclic program processing FC 21 FC Calling P_LSND_RK FC 22 FC Calling FB P_RCV_RK Program Startup OB100 Start Up OB L 272 logical address T DB40 DBW 16 for SEND T DB41 DBW 16 and RCV UC FC 10 Call of FC for Initiation FC10 Initiation L B 16 0 T DB40 DBB 0 SEND Work DB T DB41 DBB 0 RCV Work DB Reset counters STATUS L W 16 0 T DB40DBW 6 SEND Work DB T DB40DBW 8 T DB40DBW 12 T DB40DBW 14 T DB41DBW 6 RCV Work DB T DB41DBW 8 T DB41DBW 12 T DB41DBW 14 Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 8 4 6ES7870 1CA00 0YA0 Manual Edition 1 0 Cyclic Program OBI Sequence Cyclic OB UC FC 21 UC FC 23 Application Example Call of SEND Call of RCV FC21 Execute SEND Jobs Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions U M 120 7 U N DB40 DBX U N DB40 DBX U N DB40 DBX R M 120 7 S DB40 DBX U O DB40 DBX O DB40 DBX U DB40 DBX R DB40 DBX Supply LEN L W 16 20 T DB40 DBW CALL FB 8 DB50 SF REQ DB40 DBX0 0 R DB40 DBX0 1 LADDR DB40 DBW16 DB_NO 42 DBB_NO 10 LEN DB40 DBW10 R_CPU_NO R_TYP x R_NO R_OFFSET R_CF_BYT R_CF_BIT
10. Status SEND Source DB This function serves to set or delete individual bits in the slave The parameter Bit Address is not checked by the driver and is sent unchanged The following two values are valid as the Bit Status FFOOH gt set bit to logical 1 0000H gt reset bit to logical 0 Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 5 Function Code 20 bit address WORD__ W 16 0019 Bit Address 40 bit_state WORD W 16 FF00 Bit Status Example Request Message FUNCTION 05 05H Slave Address 05H Function Code 00H Bit Address High 19H Bit Address Low FFH Set Bit OOH xxH LRC Reply Message from Slave FUNCTION 05 05H Slave Address 05H Function Code 00H Bit Address High 19H Bit Address Low FFH Bit Status High OOH Bit Status Low xxH LRC Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 8 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Codes 5 7 Function Code 06 Write Single Register Function Register Address Register Value SEND Source DB This command serves to overwrite a slave register with a new value The parameter Register Address is not checked by the driver and is sent unchanged Any value can be used as the Register Value Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 6 Function Code Reg_address
11. fail the send job The discarded and reception starts again error only appears in the CP diagnostic with the second start character buffer Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 7 5 6ES7870 1CA00 0YA0 Manual Edition 1 0 Diagnostics of the Driver 7 3 3 Error Codes for General Processing Errors Event Class E OEH General Processing Errors Event Event Text Remedy Number Decimal OE 01H 1 Error during initialization of the driver specific Reassign parameters of driver SCC process and reload OE 02H 2 Error during initialization of the driver specific Reassign parameters of driver SCC process and reload OE 03H 3 Error during startup of driver Wrong data Reassign parameters of driver transfer process active interface to SFBs and reload The driver cannot function with this data transfer process OE 04H 4 Error during startup of driver Check and correct parameter Illegal interface submodule assignment The driver cannot run with the parameterized interface submodule OE 05H 5 Error with driver dongle Check if a driver dongle is No dongle plugged in or inserted dongle is plugged into the CP faulty If the inserted dongle is faulty The driver is not ready to run replace it with a correct dongle Error with driver dongle Obtain a correct dongle from the The dongle has no valid contents Siemens office which supplied The driver is not ready to run you with the driver O
12. find below an illustration of system configuration schematics Interface R amp 232C7 TTY X27 Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 1 1 6ES7870 1CA00 0YA0 Manual Edition 1 0 Product Description 1 2 Hardware and Software Prerequisites Useable Module Dongle Loading Memory of the CPU Memory Card Software Issue Levels Data Structures The Driver runs on CP341 with part number 6ES7 341 1AH01 0AEO as well as 1BH01 and 1CHO01 Also the previous modules 1AHO0 1BH00 and 1CHO00 can be used with this driver In order to use the CP with loadable drivers you require a dongle The dongle with identification number 6 S7870 1CA00 is supplied with the driver Every CP interface for which this loadable driver has been assigned parameters requires a CPU loading memory amount of about 25 Kbytes With CP 341 the loadable drivers are downloaded directly to the CP 341 Therefore you do not require a loading memory on the S7 300 CPU You should note however that this means that you cannot change a module without a programming device Loading of drivers is possible with STEP 7 from issue level 4 04 An installed version of the Parameter Assignment Tool CP Point to Point Communication Parameter Assignment V4 1 or higher is required We recommend to use STEP 7 V5 1 or higher and Parameter Assignment Tool V5 1 or higher Prior to project configuration of your S7 data structures you should ens
13. from Slave FUNCTION 15 05H Slave Address OFH Function Code OOH Bit Address High 50H Bit Address Low OOH Amount of Bits High OAH Amount of Bits Low xxH LRC Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 15 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Codes 5 14 Function Code 16 Write Multiple Registers Function Start Address Amount of Registers SEND Source DB Function code 16 serves to overwrite up to 123 registers in the slave with one request message The parameter Register Start Address is not checked by the driver and is sent unchanged A maximum of 123 registers 1 register two bytes can be written The parameter byte counter in the request message is generated by the driver based on the transferred parameter amount of registers It is not included in the SEND Source DB Structure of SEND Source Area Address Name Type Start value Comment reg_data 1 WORD w 16 41A1 Register Data reg data 2 WORD w 16 42A2 _ Register Data reg_data 3 WORD w 16 43A3 _ Register Data Example Request Message FUNCTION 16 05H Slave Address 10H Function Code OOH Register Address High 60H Register Address Low OOH Amount of Registers High 03H Amount of Registers Low 06H Byte Counter 41H lt reg_data 1 gt High A1H lt reg_data 1 gt Low 42H lt reg_data 2 gt High A2H lt reg_data 2 gt Low
14. program error or by operating mode transitions The diagnostics functions cover the entire system diagnosis and include detection analysis and reporting of errors within the PLC Downloading means loading load objects e g code blocks from the programming device into the load memory of the CPU Function blocks are components of the user program and in accordance with the IEC standard are blocks with memory The memory for the function block is an assigned data block of the instance data block Function blocks can be assigned parameters or they can be used without parameters Hardware is the term given to all the physical and technical equipment of a PLC Glossary 2 6ES7870 1CA00 0YA0 Manual Edition 1 0 Instance Data Block Interface Submodule Interrupt Module Module Parameter O Online Offline Online Help Operand Operating Mode Operating System of the CPU Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions Glossary An instance data block is a block assigned to a function block and contains data for this particular function block The CP 441 2 interface submodule is responsible for the physical conversion of signals By changing the interface submodule you can make the communications processor compatible with the communications partner An interrupt occurs when program processing in the processor of a PLC is interrupted by an external alarm Modules are pluggable p
15. relevant warnings of this manual a qualified person is one who is authorized to commission ground and tag devices systems and circuits Please note the following Warning This device and its components may only be used for the applications described in the catalog or the technical description and only in connection with devices or components from other manufacturers which have been approved or recommended by Siemens This product can only function correctly and safely if it is transported stored set up and installed correctly and operated and maintained as recommended Trademarks SIMATIC and SINEC are registered trademarks of SIEMENS AG The other brand names in this manual may be trademarks use of which by third parties for their purposes may infringe the proprietors rights Copyright Siemens AG 2006 All Rights Reserved Disclaimer of Liability The reproduction transmission or use of this document or its contents is We have checked the contents of this manual for agreement with the not permitted without express written authority Offenders will be liable hardware and software described Since deviations cannot be precluded for damages All rights reserved including rights created by patent grant entirely we cannot guarantee full agreement However the data in this or registration of a utility model or design are reserved manual are reviewed regularly and any necessary corrections included in subsequent editions Suggest
16. soon as the DSR line is set to ON If the receive buffer of the CP threatens to overflow the CP does not respond e A send request or data receipt is aborted with an error message if DSR changes from ON to OFF The message DSR OFF automatic use of V24 signals is entered in the diagnostics buffer of the CP Note When automatic use of the RS 232C secondary signals is parameterized neither RTS CTS data flow control nor RTS and DTR control by means of the V24_ SET FB are not possible Note The time to RTS OFF must be set in the parameterization interface so that the communication partner can receive the last characters of the message frame in their entirety before RTS and thus the send request is taken away The data out put waiting time must be set so that the communication partner can be ready to receive before the time elapses Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 4 7 6ES7870 1CA00 0YA0 Manual Edition 1 0 Transmission Protocol Time Diagram The following Figure illustrates the chronological sequence of a send request Send request Transmission RTS ON terminated Partner Time to RTS OFF CTS ON elapsed Data output wait time Partner expired 3 Sen CTS OFF _ Data output Time to RTS waiting time OFF Figure 4 1 Time Diagram for Automatic Use of the RS 232C Secondary Signals Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 4 8 6ES7870 1CA00 0YA0 Manu
17. takes some more time for data transfer CPU gt CP because more data than needed are transferred The parameters required for the execution of a function code must be entered as user data in the source data area A detailed description of each P_SND_RK source DB can be found in the chapter Function Codes Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 6 2 6ES7870 1CA00 0YA0 Manual Edition 1 0 Generation of Messages Job Completion for Writing Functions Job Completion for Reading Functions STATUS Entry on Job Completion CPU CP Interface The request messages to the slave are generated in accordance with the transferred P_SND_RK source data and sent by the CP First of all the driver checks if the length LEN specified at P_SND_RK corresponds to the length for this function code If it does not the job is not carried out and it is completed with an edge at output ERROR of the P_SND_RK When using function codes other than those listed the activated job is not carried out either and is completed with ERROR at P_SND_RK The elements byte counter and LRC in the request message are generated by the CP an entry in the P_LSND_RK source DB is not required For writing function codes the activated P_SND_RK is completed after a reply message is received without error This is communicated to the SIMATIC user program by means of an edge at output DONE of the P_SND_RK If errors were recog
18. 0 0 LADDR DB41 DBW16 DB _NO 43 DBB_NO 0 L_TYP L_NO L_OFFSET L_CF_BYT L_CF_BIT NDR DB41 DBX0 4 ERROR DB41 DBX0 5 LEN DB41 DBW10 STATUS DB41 DBW12 ME gt Check Receive without error wren nn nana nn naan nana nana en nn nnn n nnn nn nn nn ene U DB41 DBX 0 4 SPBN CON1 L DB41 DBW 6 1 T DB41 DBW 6 L DB41 DBW 10 T DB41 DBW 4 SPA LEAV O gt Check Receive with error O gt CON1 U DB41 DBX 0 5 SPBN CON2 L DB41 DBW 8 1 T DB41 DBW 8 L 0 L DB41 DBW 12 SPB LEAV T DB41 DBW 14 SPA LEAV ween nena nn naan nn nn nana enna nnn n nnn nn nn nnnnnn Check Error in STATUS wet nn nn nn nn nana nn nn nana enna nn nn enn nn eens nn nn CON2 LO L DB41 DBW 12 SPB LEAV T DB41 DBW 14 LEAV CLR Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 6ES7870 1CA00 0YA0 Manual Edition 1 0 RCV with EN_R 1 INDR lif NO Receive without error increment counter Isave Receive Length LEN IERROR lif NO Receive with error increment counter if STATUS lt gt 0 save STATUS if STATUS lt gt 0 save STATUS Wiring Diagrams Multipoint A Wiring Diagrams Multipoint Wiring diagram RS422 multipoint Modbus Multipoint Receiver MODBUS Master g CP341 or CP441 2 e
19. 2 Bit Extensions 6ES7870 1CA00 0YA0 Manual Edition 1 0 Contents Product Description 1 Product Description 1 1 Usage Possibilities Position in the System Environment Function of the Driver Usable Interfaces and Protocols Possible System Configuration The driver described here is a software product for communication processor CP341 CP341 can be used in automation systems S7 300 and can establish serial communication links to partner systems This driver enables you to establish a communication link between communication module CP341 and Modbus capable slaves The transmission protocol used is the Modbus Protocol in ASCII Format In addition de facto standard 32 bit extensions are supported for accessing floating point and double word registers in compatible slaves Data transmission is carried out in accordance with the Master Slave principle The Master SIMATIC S7 has the initiative during the transmission Function codes 01 02 03 04 05 06 07 08 11 12 15 and 16 can be used for communication between the CP and the slaves You can use this driver on a CP341 having a RS232 TTY or RS422 485 X27 interface With this driver it is possible to use the RS422 485 X27 interface submodule in both 2 wire operation and 4 wire operation In 2 wire operation It is possible to connect up to 32 slaves to one master in half duplex operation thus creating a multipoint connection network Please
20. 6ES7870 1CA00 0YA0 Manual Edition 1 0 Application Example Used Data The following operands memory bits data bits or data words are used in the programming example Trigger bit for the execution of aP_SND_RK job M 120 7 DB40 DBX 0 0 Control parameter REQuest Control parameter Reset for aborting current P_SND_RK DB40 DBX 0 4 Status parameter DONE Indicates that current P_SND_RK was completed without error DB40 DBX 0 1 DB40 DBX 0 5 Status parameter ERROR Indicates that current P_SND_RK was completed with error Success counter for P_SND_ RK Success counter for P_SND_ RK Error counter for P_SND_ RK DB40 DBW 2 DB40 DBW 6 DB40 DBW 8 Ld ea be transferred to the CP in bytes Peopewi sratus asaye sno R peopewIa Sire P_SND_AKSTATUS dspay DB41 DBX 0 0 Control parameter EN_R P_RCV_RK ready to receive DB41 DBX 0 4 Status parameter NDR Indicates that current P_RCV_RK has received new data from the CP DB41 DBX 0 5 Status parameter ERROR Indicates that current P_RCV_RK has been completed with error DB41 DBW 4 Stored length LEN of P_RCV_RK DB41 DBW 6 Success counter for P_RCV_RK_ DB41 DBW 8 Error counter for P_RCV_RK a E area received by the CP in bytes DB41 DBW 12 STATUS displayin P_RCV_RK_ DB41 DBW 14 Stored P_RCV_RK STATUS display Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 8 2 6ES7870 1CA00 0YA0 Manual Edition 1 0 Application E
21. Bit Extensions 4 4 6ES7870 1CA00 0YA0 Manual Edition 1 0 Transmission Protocol 4 2 Exception Responses Exception Responses Exception Code Message On recognition of an error in the request message from the master for example register address illegal the slave sets the highest value bit in the function code of the reply message This is followed by transmission of one byte of error code Exception Code which describes the reason for the error A detailed description of the meaning of the above mentioned parameters can be found in the Modbus Application Protocol Specification The error code reply message from the slave has the following structure for example slave address 5 function code 5 exception code 2 Reply Message from Slave EXCEPTION_CODE_xx 05H Slave Address 85H Function Code 02H Exception Code 1 to 7 xxH LRC On receipt of an error code reply message by the driver the current job is completed with error An error number corresponding to the received error code Exception Code 1 7 is also entered in the STATUS area No entry is made in a P_RCV_RK destination data block The following error codes are defined in accordance with the Modbus Specification Code Modbus Specification o 0 o 2 o5 o6 vsy ejected Message Staves ot recy to resene Check slave for further details Not all are supported by driver See Modbus spec for detailed descriptions Loadable Driver CP341 Modbus ASC
22. Connection Here you can select the required driver protocol Modbus ASCII Master from the drop down menu After selecting the Protocol you can carry out the Parameter Assignment of the Driver start by double clicking the envelope symbol labeled Protocol A detailed description of how to select the protocol and assign parameters to the dialog boxes for the loadable driver can be found in the section Assigning Parameters to the Loadable Driver After parameter assignment is complete you return to the Properties CP dialog box 2 Properties CP341 gt Addresses No settings are required in the Addresses tab Properties CP dialog box 3 Properties CP341 gt General No settings are required in the General tab Properties CP dialog box You can complete the parameter assignment of the CP by clicking OK in the Properties CP dialog box You then return to the Hardware Configuration dialog box Save the parameter assignment and close the Hardware Configuration dialog box You return to the basic menu of the STEP 7 project Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 3 3 6ES7870 1CA00 0YA0 Manual Edition 1 0 Commissioning Driver 3 5 Loading the Driver to the CP Loading the Driver After selection of a loadable driver in the selection box Protocol you can load the driver to the CP Double clicking on to the icon Load Drivers gets
23. E 06H OE 10H 16 Internal error procedure Restart CP Mains_ON default branch in procedure automatic device default branch for procedure status Send Receive default branch default branch Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 7 6 6ES7870 1CA00 0YA0 Manual Edition 1 0 Diagnostics of the Driver Event Class E OEH Loadable Driver General Processing Errors lt Parameter Assignment gt Event For this data link the amount of data bits must be set to 7 The driver is not ready to run The Character Delay Time parameter is not within the range of 1 to 6500 milliseconds The driver is operating with a default value of 1000 milliseconds The operating mode set for the driver is illegal Normal operation or Interference Suppression must be specified The driver is not ready to run An illegal value for parameter Response Time out has been set Valid values are 5 to 65500ms Event Text Remedy Number Decimal Correct parameter assignment of the driver Load driver parameters Correct parameter assignment of the driver Load driver parameters Correct parameter assignment of the driver Load driver parameters Correct parameter assignment of the driver Load driver parameters The driver is operating with a default value of 2000 milliseconds An error occurred when reading the interface parameter file The driver is not ready to run Rest
24. II Master with 32 Bit Extensions 4 5 6ES7870 1CA00 0YA0 Manual Edition 1 0 Transmission Protocol 4 3 RS 232C Secondary Signals Available Signals Using the RS 232C Secondary Signals The following RS 232C secondary signals exist on the CP when the RS232C interface submodule is used DCD input Data carrier detect Data carrier detected DTR output Data terminal ready CP ready for operation e DSR input Data set ready Communication partner ready for operation RTS output Request to send CP ready to send e CTS input Clear to send Communication partner can receive data from the CP response to RTS ON of the CP RI input Ring indicator Indication of an incoming call When the CP is switched on the output signals are in the OFF state inactive You can parameterize the way in which the DTR DSR and RTS CTS control signals are used with the CP 341 Point to Point Communication Parameter Assignment parameterization interface or control them by means of function calls FBs in the user program The RS 232C secondary signals can be used as follows e When the automatic use of all RS 232C secondary signals is parameterized e By means of the V24_STAT and V24_SET functions FBs Note When automatic use of the RS 232C secondary signals is parameterized neither RTS CTS data flow control nor RTS and DTR control by means of the V24_SET FB are possible On the other hand it is always possible to re
25. ION 06 05H Slave Address 06H Function Code 01H Register Address High 80H Register Address Low 11H Register Value Byte 1 22H Register Value Byte 2 33H Register Value Byte 3 44H Register Value Byte 4 xxH LRC Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 10 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Codes 5 9 Function Code 07 Read Exception Status Function SEND Source DB Example RCV Destination DB This function code serves to read 8 event bits of the connected slave The start bit number of the event bit is determined by the connected device Therefore it has not to be specified by the SIMATIC user program Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 7 Function Code Request Message FUNCTION 07 05H Slave Address 07H Function Code xxH LRC Reply Message from Slave FUNCTION 07 05H Slave Address 07H Function Code 3EH lt Data gt xxH LRC Contents of RCV Destination Area Address Name Type Actual value Comment 0 0 datalt WORD__ W 16 3Exx The driver enters the individual bits of the reply message into the High Byte in the destination DB data 1 The Low Byte of data 1 remains unchanged Value 1 is displayed as the length in parameter LEN of P_RCV_RK Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 11 6ES7870 1CA00 0YA0 Manual Edition 1
26. LF The Modbus serial line PDU is describes as follows 05H Slave Address 08H Function Code 00H Diagnostic Code High 00H Diagnostic Code Low A5H Test Value High C3H Test Value Low xxH LRC In ASCII transmission mode the following data is transferred on the line 3AH Start Character 30H Slave Address 35H 30H Function Code 38H 30H Diagnostic Code High 30H 30H Diagnostic Code Low 30H 41H Test Value High 35H 43H Test Value Low 33J xxH LRC Code High xxH LRC Code Low ODH CR OAH LF Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 4 3 6ES7870 1CA00 0YA0 Manual Edition 1 0 Transmission Protocol Error Handling If BREAK is recognized on the receiving line by the CP during output of a message the triggered P_SND_RK job is completed with error Reception during transmission is ignored If any of the errors listed below is recognized by the CP during reception of the reply message the received data string is rejected an error is reported and the triggered Send job is completed with error e reply monitoring time elapsed e wrong start character e received character is no ASCII character e overrun of the receive buffer e received LRC incorrect e transmission error in a character parity framing or overrun error e character delay time elapsed e BREAK line break or DSR or CTS not asserted Loadable Driver CP341 Modbus ASCII Master with 32
27. Register start address is not checked by the driver and is sent unchanged Amount of A maximum of 62 registers 1 register four bytes can be read Register SEND Source DB Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 43 Function Code reg_startadr WORD W 16 0040 Register Start Address Amount of Registers Request Message FUNCTION 03 Example 05H Slave Address 03H Function Code 00H Register Start Address High 40H Register Start Address Low OOH Amount of Register High 02H Amount of Register Low xxH LRC Reply Message from Slave FUNCTION 03 05H Slave Address 03H Function Code 08H Byte Counter 21H Register Address 40H Data Byte 1 22H Register Address 40H Data Byte 2 23H Register Address 40H Data Byte 3 24H Register Address 40H Data Byte 4 25H Register Address 41H Data Byte 1 26H Register Address 41H Data Byte 2 27H Register Address 41H Data Byte 3 28H Register Address 41H Data Byte 4 xxH LRC RCV Destination Contents of RCV Destination Area DB Address Name Type Actual value Comment soo aman DWORD waiew21200004 Daa 40 atale DWORD W 16 25262728 Data Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 6 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Codes 5 5 Function Code 04 Read Input Registers Function Start Address Amount of Regi
28. SIEMENS SIMATIC Loadable Driver for CP 341 Modbus ASCII Master with 32 Bit Extensions SIEMENS SIMATIC Loadable Driver for CP341 Modbus Protocol ASCII Format with 32 Bit Extensions S7 is Master Manual Edition 1 0 Preface Contents Product Description Installation Commissioning Driver Transmission Protocol Interface CPU CP Diagnostics Driver Application Example Appendices Wiring Diagrams Multipoint Literature List Glossary h Y O CO A Q N Safety Precautions and Warnings Qualified Personnel Correct Usage This manual contains warnings which you should note for your own safety as well as for the prevention of damage to property These warnings are indicated by means of a triangle and displayed as follows in accordance with the level of danger Danger indicates that death severe personal injury or substantial damage will result if proper precautions are not taken Warning indicates that death severe personal injury or substantial damage can result if proper precautions are not taken Caution indicates that minor personal injury or property damage can result if proper precautions are not taken Notice draws your attention to particularly important information on the product handling the product or to a particular part of the documentation The equipment may be commissioned and put into operation by qualified personnel only For the purpose of safety
29. STOP to the RUN mode the PLC goes through the RESTART mode Glossary 4 6ES7870 1CA00 0YA0 Manual Edition 1 0 Software Standard Mode STEP 7 System Block System Function SFC System Function Block SFB U Upload User Program Variable Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions Glossary Software is the term given to all programs used on a computer system These include the operating system and the user programs The standard mode of Modbus ASCII slave driver means that the parameter with 32 Bit registers is not set In this mode all registers imply 16 bit values This is the programming software for SIMATIC S7 programmable controllers System blocks differ from the other blocks in that they are already integrated into the S7 300 400 system and are available for already defined system functions They are subdivided into system data blocks system functions and system function blocks System functions are modules without memory which are already integrated into the operating system of the CPU and can be called up by the user as required System function blocks are modules with memory which are already integrated into the operating system of the CPU and can be called up by the user as required Uploading means loading load objects e g code blocks from the load memory of the CPU into the programming device The user program contains all instructions and declarations
30. Slave non Siemens Slave non Siemens Caution In the RS422 mode CP341 can only be used as a Master because the transmitter Sender always drives the line and never goes to the high impedance Tri State mode Wiring diagram RS485 multipoint Modbus Multipoint Sender Receiver MODBUS Master E Cp e g CP341 or CP441 2 fecal E pr vane sanoe soono anoe soona oroat areca seseo cee jesse Banan sana annan oan i RLRE 7 Connector RAP 39 gje ai Bes mma Slave non Siemens Slave non Siemens Slave CP341 or CP441 2 Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions A 1 6ES7870 1CA00 0YA0 Manual Edition 1 0 Wiring Diagrams Multipoint The following applies e GND PIN 8 must always be connected on both sides e The casing shield must be installed everywhere e A terminating resistor of approx 330 Q is to be soldered into the connector on the last receiver of a node sequence e Recommended cable type LIYCY 3 x 2 x 0 14 R A R B and T A T B twisted pairs For additional information see the Cables section of the Modbus over Serial Line Specification and Implementation Guide available at www modbus org e A wiring with Stub is not allowed Wiring diagram RS232 Point to Point Modbus RS232 Please refer to Section B 1 of the CP 341 Point to Point Communication Manual Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensi
31. WORD W 16 0220 bytedata 1 BYTE B 16 01 Event Byte 1 bytedata 2 BYTE B 16 02 Event Byte 2 bytedata 63 BYTE B 16 C2 Event Byte 63 bytedata 64 BYTE B 16 C3 Event Byte 64 Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 14 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Codes 5 13 Function Code 15 Write Multiple Coils Function Start Address Amount of Bits SEND Source DB This function code serves to change up to 1976 bits in the slave The parameter Bit Start Address is not checked by the driver and is sent unchanged Any value between 1 and 1976 is permitted as the amount of bits number of coils This indicates how many bits in the slave should be overwritten The parameter byte counter in the request message is generated by the driver based on the transferred parameter amount of bits It is not included in the SEND Source DB Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 1 6 0F Function Code bit_startadr_ WORD W 16 0050 Bit Start Address Amount of Bits 6 0 coil_state 1 WORD W 16 EFCD Status Coil 5FH 58H 57H 50H Example Request Message FUNCTION 15 05H Slave Address OFH Function Code 00H Bit Address High 50H Bit Address Low OOH Amount of Bits High OAH Amount of Bits Low 02H Byte Counter CDH Status Coil 57H 50H EFH Status Coil 59H 58H xxH LRC Reply Message
32. ad all RS 232C secondary signals by means of the V24_STAT FB The sections that follow describe how the control and evaluation of the RS 232C secondary signals is handled Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 4 6 6ES7870 1CA00 0YA0 Manual Edition 1 0 Automatic Use of the Secondary Transmission Protocol The automatic use of the RS 232C secondary signals on the CP is implemented as follows Signals e Assoon as the CP is switched by means of parameterization to an operating mode with automatic use of the RS 232C secondary signals it switches the RTS line to OFF and the DTR line to ON CP ready for use e Message frames cannot be sent and received until the DTR line is set to ON As long as DTR remains set to OFF no data is received via the RS 232C interface If a send request is made it is aborted with an error message e When a send request is made RTS is set to ON and the parameterized data output waiting time starts When the data output time elapses and CTS ON the data is sent via the RS 232C interface e Ifthe CTS line is not set to ON within the data output time so that data can be sent or if CTS changes to OFF during transmission the send request is aborted and an error message generated e After the data is sent the RTS line is set to OFF after the parameterized time to RTS OFF has elapsed The CP does not wait for CTS to change to OFF e Data can be received via the RS 232C interface as
33. age FUNCTION 11 05H Slave Address OBH Function Code xxH LRC Reply Message from Slave FUNCTION 11 05H Slave Address OBH Function Code FEH Status Word High DCH Status Word Low 01H Event Counter High 08H Event Counter Low xxH LRC RCV Destination Contents of RCV Destination Area DB Address Name Type Actual value Comment W 16 0108 Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 13 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Codes 5 12 Function Code 12 Get Comm Event Log Function This function code serves to read a 2 Byte Status Word 2 Byte Event Counter 2 Byte Message Counter and 64 Byte Event Bytes from the slave SEND Source DB Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address Example Request Message FUNCTION 12 05H Slave Address OCH Function Code xxH LRC Reply Message from Slave FUNCTION 12 05H Slave Address OCH Function Code 46H Byte Counter 87H Status Word High 65H Status Word Low 01H Event Counter High 08H Event Counter Low 02H Message Counter High 20H Message Counter Low 01H Event Byte 1 12H Event Byte 2 C2H Event Byte 63 D2H Event Byte 64 xxH LRC RCV Destination Contents of RCV Destination Area DB Address Name Type Actual value Comment data 1 WORD Wi 16 8765 data2 WORD __ w 16 0108 data 3
34. al Edition 1 0 Function Codes 5 Function Codes General All telegram examples for the different function codes refer to Modbus serial line PDU format 32 Bit Registers The register oriented function codes 3 6 16 can also handle 32 bit registers If Protocol Parameter for Modbus Master With 32 bit Registers is set the driver is prepared to handle registers with the length of 4 byte The decision whether the send job refers to 16 bit or 32 bit registers is done via the second byte of the send data block The second byte of the send data block determines the Modbus Function Code sent in the message If bit 2 the bit to the right of the most significant bit is set the send job refers to 32 bit registers Bit 2 doesn t affect the function code actually sent it is just information for the master CP for what to expect in the response from the slave when reading or what to send when writing The register s accessed in the slave when bit 2 is set must be within a 32 bit register address range defined in the slave such that 4 bytes per register is returned in the read response or 4 bytes per register are expected in a write request If bit 2 is set and a normal 2 bytes per register range is read in the slave 2 bytes per register is returned by the slave As the master expects more data the activated send job is finished with error Likewise bit 2 is not set and a 4 bytes per register range is read in the slave 4 bytes per
35. art CP Mains_ON Event Class 5 05h Loadable Driver General Processing Errors lt CPU CP gt Event Event Text Remedy Number f Decimal OE 30H 48 Internal error during data transfer to CPU Can be ignored if it happens Unexpected acknowledgment Passive intermittently OE 31H Timeout during data transfer to CPU Check CP CPU interface OE 32H 50 Error occurred during data transfer to CPU with Check CP CPU interface RCV Exact failure reason detailed error is in diagnostic buffer before this entry OE 33H 51 Internal error during data transfer to CPU Illegal Check CP CPU interface status of automatic device Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 7 7 6ES7870 1CA00 0YA0 Manual Edition 1 0 Diagnostics of the Driver Event Class 5 05h Loadable Driver General Processing Errors lt Processing of a Send Job gt Event Event Text Remedy Number Decimal 64 Value specified for parameter LEN at SFB SEND Minimum length is 2 bytes too small Value specified for parameter LEN at SFB SEND The minimum length for this too small A greater length is required for the function code is 6 bytes transferred function code Transferred function code is illegal The only function codes which are permitted are those listed in the chapter Function Codes 67 Slave Address 0 Broadcast not permitted with Only use Slave Address 0 for this function code the su
36. as is valid at the time of publication To enable you to access the information in this manual more easily we would like to draw your attention to the following e The next few pages contain a complete list of contents Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions i 6ES7870 1CA00 0YA0 Manual Edition 1 0 Further sources of information Queries Terminology Scope of Application Preface Any further information regarding CP 341 installation commissioning etc can be found in the following manual SIEMENS SIMATIC CP341 Point to Point Communication Installation and Parameter Assignment Manual C79000 G7076 C341 Further information regarding STEP7 can be found in the following manuals SIEMENS SIMATIC Software Standard Software for S7 and M7 STEP7 User Manual C79000 G7000 C502 SIEMENS SIMATIC Software System Software for S7 300 400 System and Standard Functions Reference Manual C79000 G7000 C503 Should you have any queries regarding the use of the driver described in this manual which are not answered in this documentation please contact the relevant person at Siemens who supplied you with this driver This documentation uses the terms CP or CP341 The driver described in this manual serves as a loadable protocol for CP341 which may be used instead of Standard Protocols 3964R RK512 and ASCII Note With this driver modifications or expansions to the sequences betw
37. ccceeeeeeeeeeeeseeeeeeeeeeeneeeeeees 5 3 5 3 Function Code 03 Read Holding Registers cccccseeeceeceeeeeeceeeeeneeeeees 5 5 5 4 Function Code 03 Read 32 Bit Holding RegisterS ccccccesseeeseeeeees 5 6 5 5 Function Code 04 Read Input Registers c ccccccessceeeeeeeeeeeeeseeeeneeeeees 5 7 5 6 Function Code 05 Write Single Col ccsceecsececeeeeeeeeeeeeeseeeeeseaeeseeeeeaees 5 8 5 7 Function Code 06 Write Single Register cccccccesseeeeeseeeeeseteeeeeneeeeees 5 9 5 8 Function Code 06 Write Single 32 Bit Register cccceessseeereeee 5 10 5 9 Function Code 07 Read Exception Status cccccseeeeeeessteeeeseeeeeneeeees 5 11 5 10 Function Code 08 Diagnostics Loop Back Test e cceeeeeeesteeeeereeeees 5 12 5 11 Function Code 11 Get Comm Event Countet 0 ccccessceeeeeeeessteeeeneeeeees 5 13 5 12 Function Code 12 Get Comm Event L0g cc ccceceeeeseeeeeeeeseeeeessaeeeeneeeeaes 5 14 5 13 Function Code 15 Write Multiple Coils ececcceeeeeeeeeeeeeeeceeeeeneeeeeneeees 5 15 5 14 Function Code 16 Write Multiple Registers ccssceeeseeeeseeeeeseeeeeneeeees 5 16 5 15 Function Code 16 Write Multiple 32 Bit RegisterS cecseeeeeeee 5 17 6 CPU CP Inter Fe To PA P E E 6 1 6 1 1 Data Transfer from CPU to CP with P_SND_ RK ccc ccecccceesseaeeeeeeeseeenes 6 1 6 1 2 Data Transfer fro
38. ction Start Address Amount of Register SEND Source DB Example RCV Destination DB Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions This function serves to read individual registers from the slave The parameter Register start address is not checked by the driver and is sent unchanged A maximum of 125 registers 1 register two bytes can be read Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 3 Function Code reg_startadr WORD W 16 0040 Register Start Address Amount of Registers Request Message FUNCTION 03 05H Slave Address 03H Function Code 00H Register Start Address High 40H Register Start Address Low OOH Amount of Register High 02H Amount of Register Low xxH LRC Reply Message from Slave FUNCTION 03 05H Slave Address 03H Function Code 04H Byte Counter 21H Register Address 40H Data High 23H Register Address 40H Data Low 25H Register Address 41H Data High 27H Register Address 41H Data Low xxH LRC Contents of RCV Destination Area Address Name Type Actual value Comment data 1 WORD _ W tt6 2123 2 0 omale WORD wei6 2527 6ES7870 1CA00 0YA0 Manual Edition 1 0 5 5 Function Codes 5 4 Function Code 03 Read 32 Bit Holding Registers Function This function serves to read individual 32 bit registers from the slave Start Address The parameter
39. dule The CP Point to Point Communication Parameter Assignment Tool is used to assign parameters to the interface submodule of the communications processor and to set the driver specific parameters The standard range is expanded for each loadable driver In a point to point connection the communications processor forms the interface between a PLC and a communications partner The execution of a data interchange operation according to a specific protocol is called a procedure The process image is a special memory area in the PLC At the beginning of the cyclic program the signal states of the input modules are transferred to the process image input table At the end of the cyclic program the process image output table is transferred to the output modules as signal state Programmable controllers PLCs are electronic control devices consisting of at least one central processing unit various input output modules and operator control and monitoring devices Project configuration of data link is the term given to the allocation of a Connection ID in the system function block The Connection ID enables the system function blocks to communicate between two communication terminal points The communications partners involved in a data interchange must abide by fixed rules for handling and implementing the data traffic These rules are called protocols A rack is the rail containing slots for mounting modules On transition from the
40. e bus Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 4 1 6ES7870 1CA00 0YA0 Manual Edition 1 0 Transmission Protocol Broadcast The master uses slave address zero to address all slaves on the bus Broadcast Message Messages are only permitted in conjunction with writing Function Codes 05 06 15 and 16 A Broadcast Message is not followed by a reply message from the slave After a broadcast message the CP waits for a time determined by the turnaround delay parameter before the send job is finished Function Code The function code defines the meaning as well as the structure of a message The following function codes are supported by the driver Function Function in Accordance with Code Modbus Specification 01 Read Coils 02 Read Discrete Inputs 03 Read Holding Registers 04 Read Input Registers 05 Write Single Coil 06 Preset Single Register 07 Read Exception Status 08 Loop Back Diagnostic Test 11 Fetch Communications Event Counter 12 Fetch Communications Event Log 15 Write Multiple Coils 16 Write Multiple Registers Data Field DATA The data field DATA is used to transfer the function code specific data such as Bytecount Coil_Start Address Register_Start Address Number_of_Coils Number_of_Registers See also Chapter Function Codes The data field contains up to 2x252 ASCII characters LRC The Longitudinal Redundancy Checking LRC field is one byte containing an 8 bit bina
41. een CP and CPU are possible These modifications and expansions may apply in particular to event classes or event numbers available for diagnostic purposes Furthermore please note that this manual only describes the modifications and expansions as against the standard functions Basic information may be found in the manuals mentioned in chapter Further Sources of Information In order to ensure safe use of the driver detailed knowledge of the functionality of CP341 is a pre requisite Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions ii 6ES7870 1CA00 0YA0 Manual Edition 1 0 Contents 1 Product DeSCTiptiOn cccceeecceeseeeeeeeeeeeeeeesneeeeenneeeeeeenseeeeeenseeeeenseeeeeenseeneeenees 1 1 Usage Possibilities cece ccccceesecceeeseccceeeeeeceeeeeeeeeeesneeeeeeeneneeeneenenaes 1 2 Hardware and Software PrerequiSites cccecceesseeeeseeeeeneeeeees 1 3 Summary of the Modbus Protocol ccccccceeeeeteeeeeeeeeeeeeeeeeeaes 2 mstalah ON 2a scecsede aE EE RA 2 1 Use of the Dongle cccceesceceeeeeeeeeeeeeeeeeeeeeecaaeeeeaaeseeneeseaeseeaaeennees 2 2 Interface Connection e e ereraa e aaa Merea aate eaaa aE TO AEE ERE 3 Commissioning the Driver cccsccssseesseeeeeeeeeeeeeeeseeeeseeeeeseneeseaeseseenenseeeees 3 1 Installation of the Driver on the STEP7 PG PC ceceeeeeereees 3 2 Uninstalling the Driver ccceeeeeeeeeeeeeeeeeneeeeeeeaeeeeeeaeeeeeeaeeeeseaas 3 3 Confi
42. for signal processing by means of which a system or a process can be controlled The user program for SIMATIC S7 is structured and is divided into smaller units called blocks A variable is an operand e g E 1 0 which can have a symbolic name and can therefore also be addressed symbolically Glossary 5 6ES7870 1CA00 0YA0 Manual Edition 1 0 Glossary WwW With 32 Bit Registers When choosing with 32 Bit Register mode holding registers can imply 32 bit values integer and floating point as well as 16 bit values when accessed by a master Work Memory The work memory is a RAM on the CPU which the processor accesses while processing the user program Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions Glossary 6 6ES7870 1CA00 0YA0 Manual Edition 1 0
43. guring a Data Link CP in Step7 eeeceeeeeeeeeeeeeeeeeeeeeeeneeeeaees 3 4 Assigning Parameters to the CP cceeccceseeeeeeeeeeeeeeeseteeeeeaeeeeeeeees 3 5 Loading the Driver to the CP eccceceseeceeeeeceeeeeeeeeeeneeseeeesnaaeenenees 3 6 Assigning Parameters to the Loadable Drivet cc ceeee 3 6 1 Modbus ASCII Protocol ccccccceceeeeeeseeceeeeeceaeeeeaaeeeeeeeesaeeesaeeeenees 3 6 2 RS422 485 X27 Interface cceecceceeceeeceeeeeeeeeeeeeeeeeeeeeeeesieeseaeenaees 3 6 3 RS232 Secondary Signals issi assier ekriis aetan aukana 3 7 Loading the Configuration and Parameter Assignment Data 3 8 Start up Characteristics Of CP341 ssssssnnnsnesnnnseennnnennnnnnennnnrnn nnen 4 Transmission Protocol ccceeeeececeeeee ee eeeeee ee eeeeeeseeeeeeeseeseeneeseseeeenseseeeeeeeseeeenens 4 1 Message Structure ccccccssceceeeceeeeeceeseeceeeeeeaeeeeaaeseeeeesaeeteaaeesanees 4 2 Exception Responses esra aini ieii iii e 4 3 RS 232C Secondary Signals cccccceceeeeeeeeeeeeseeeeeeeeseeeeseneeeennees Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 6ES7870 1CA00 0YA0 Manual Edition 1 0 Contents Contents 5 FUNCTION COGS isis aeaea aaaeeeaa ea a aaae aas Sae e ca scusseubedteaded saderduaderses 5 1 5 1 Function Code 01 Read Cols ceccccecsceeeseeceeeeeceeeeeaeeeeeeeeseaeeeseaeeseeeeeaees 5 2 5 2 Function Code 02 Read Discrete Input c ccce
44. hassis shield Further notes to interface connection please find in the manual Point to Point Data Link CP341 Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 2 2 6ES7870 1CA00 0YA0 Manual Edition 1 0 Commissioning Driver 3 Commissioning the Driver General Information All statements in the following sections referring to STEP7 or configuring or setting parameters for CP PtP CP341 or the Driver are related to the STEP7 Version 5 3 SP3 Operation flows names and directory names might be different in other STEP7 versions 3 1 Installation of the Driver on the STEP7 PG PC Prerequisites To make the driver installation possible a STEP7 Package and the Parameter Assignment Tool CP Point to Point Communication Parameter Assignment must have been installed before Installation Installation of the driver consisting of driver code and driver specific configuration screens for STEP7 Insert your Modbus ASCII Driver CD into the CD ROM drive and follow step by step the instructions that are automatically displayed by the installation program If the installation program fails to automatically run perform these steps 1 Using Windows Explore navigate to the CD ROM drive and go to the directory MODBUS_ASCIIMASTER and double click Setup EXE file to start the installation procedure 2 Follow step by step the instructions that are displayed by the installation program Result The driver and the paramete
45. inserted 2 2 Interface Connection TTY A point to point connection to one slave can be realized Further notes to the interface connection please find in the manual CP341 Point to Point Communication RS232C A point to point connection to one slave can be realized It is possible to use RS232 auxiliary signals for e g modem control Further notes to the interface connection please find in the manual CP341 Point to Point Communication Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 2 1 6ES7870 1CA00 0YA0 Manual Edition 1 0 Installation X27 2 wire A multipoint connection network connecting up to 32 slaves to one Master can be created directly The driver of the CP performs the switchover of the receive 2 wire line between transmit and receive Schematic connection 1 Master system 1 slave at the bus SIMATIC CP341 MODBUS Master MODBUS Slave R A 4 T R A R B 11 T R B GND 8 GND Chassis shield Chassis shield Further notes to the interface connection please find in the manual CP341 Point to Point Communication X27 4 wire A Point to Point connection to one slave can be created The direct construction of a multipoint connection network connecting more than one slave is not possible Schematic connection 1 Master system 1 Slave SIMATIC CP341 MODBUS Master MODBUS Slave T A 2 T B 9 R B R A 4 T A R B 11 T B GND 8 GND Chassis shield C
46. ions for improvement are welcome Siemens AG 2006 Subject to change without prior notice Preface Purpose of this Manual Required Basic Knowledge Contents of the Manual Validity of the Manual How to access the information in this manual Preface The information in this manual will enable you to establish and commission a data link between a CP 341 and a Modbus capable control system You require a general knowledge in the field of automation engineering to be able to understand this manual In addition you should know how to use computers or devices with similar functions e g programming devices under Windows 95 98 2000 NT or XP operating systems Since loadable driver are based on the STEP 7 software you should also know how to operate it This is provided in the manual Programming with STEP 7 V5 2 This manual describes the loadable driver functions and how to create a link to the hardware and software of communication processor CP 341 The manual contains the following subjects e Product Description Installation e Commissioning the Driver Installation Parameterization e Interface CPU CP e Transmission Protocol e Diagnostics Driver e Application Example This manual Issue is valid for the following software package Product Identification No from Version Loadable Driver for CP 341 6ES7870 1CA00 0YA0 1 0 Modbus ASCII Master Note This manual contains the driver description
47. ired change the connector pin assignment of the 2 wire receiving line R A R B DSR OFF or CTS OFF The partner has switched the DSR or CTS signal to OFF before or during a transmission Check the partner s control of the RS 232C secondary signals Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 7 4 6ES7870 1CA00 0YA0 Manual Edition 1 0 Diagnostics of the Driver Event Class 8 eer eens Ooo emnenl carder aan peace eer eens Ooo emnenl carder aan peace Receive Errors 08 30H A request message has been sent and Check if transmission line is interrupted the reply monitoring time has elapsed interface analyzer may be required without the start of a reply message Check if the protocol parameters being recognized transmission rate amount of data bits parity and amount of stop bits have the same settings in CP and the link partner Check if the value for the Response Time out parameter is big enough Check if the specified slave address exists 08 32H Overflow of receive buffer in CP during Check protocol settings for the slave reception of the reply message 08 33H 51 A wrong start character was received Check protocol settings for the slave The start character was not a colon 3Ah 08 34H 52 A start character was received within a Check if transmission line is interrupted telegram interface analyzer may be required This The first part of the telegram is does not in itself
48. itable function codes The value of the transferred parameter Amount Correct your source DB of Bits is not within the range 1 to 2008 The value of the transferred parameter Amount Correct your source DB of Registers is not within the range 1 to 125 or for 32 bit registers 1 to 62 Function codes 15 or 16 Correct your source DB The values of the transferred parameters Amount of Bits and or Amount of Registers are not within the range 1 to 1976 and or 1 to 123 and or for 32 bit registers 1 to 61 Function codes 15 or 16 Increase parameter LEN for The parameter LEN for SFB SEND does not SEND until a sufficient amount correspond to the transferred parameters of user data is transferred to Amount of Bits and or Amount of Registers the CP A larger amount of user Parameter LEN is too small data must be transferred to the CP because of the Amount of Bits and or Amount of Registers 72 Function code 5 Correct your source DB Only The code specified in SEND source DB for Set the value FFOOH or OOOOH are Bit FFOOH or Delete Bit 0000H is wrong allowed for writing a coil 73 Function code 8 The only permitted code is The code specified in SEND source DB for Diagnostic Code 0000H Diagnostic Code is wrong Access to 32 bit registers is only allowed with Correct your source DB function code 03 06 16 Bit 2 of function code in source DB is set
49. ly received colon character The setting R A OV R B 5V High is recommended as the preset for the receiving line Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 3 7 6ES7870 1CA00 0YA0 Manual Edition 1 0 Presetting of the Receiving Line Commissioning Driver None Float The two wire line R A R B is not preset In this instance the link partner should carry out assignment Presetting R A 5V R B 0V BREAK The two wire line R A R B is preset by the CP as follows R A gt 5V R B gt OV Va Vg 2 0 3V This means that BREAK level occurs on the CP in the event of a line break Presetting R A OV R B 5V High The two wire line R A R B is preset by the CP as follows R A gt OV R B gt 5V Va Vg lt 0 3V This means that HIGH level occurs on the CP in the event of a line break and or when it is running idle i e no slave is transmitting Line status BREAK cannot be recognized 3 6 3 RS232 Secondary Signals Overview Automatic Use of RS232 Signals Time to RTS OFF Data Transmission Parameter Description Value range Default value Automatic use RS232 secondary signals are of RS232 signals Time to RTS Time to elapse after the 0 to 655350 ms OFF transmission before the CP sets in 10 ms steps the RTS line to OFF Data output Delay before the CP starts 0 to 655350 ms 1s waiting time sending of a telegram in 10 ms steps
50. ly registers are 16 bit values When choosing 32 bit mode registers can also imply 32 bit values when supported in the addressed slave 3 6 2 RS422 485 X27 Interface Overview Full duplex four wire operation Halfduplex two wire operation X27 RS 422 485 Interface Sub module Parameter Description Value range Default value Presetting of No presets none R A 5V the receiving Preset Break R A 5V R B OV R B OV line Preset High R A OV R B 5V X27 Operation Via the transmission line T A Full duplex Full duplex mode T B data are sent four wire four wire via the receiving line R A operation operation R B data are received The receiving line R A R B is Half duplex changed over from send to two wire receive operation operation In this operating mode data are sent via the transmission line T A T B and received via the receiving line R A R B Error handling is carried out in accordance with the function set at the Driver Operating Mode parameter Normal or Interference Suppression In this operating mode the driver switches the 2 wire receiving line R A R B of the interface from send to receive operation In this operating mode all recognized transmission errors and or BREAK before and after receive messages are ignored BREAK level during message pauses is also ignored The beginning of the receive message from the slave is recognized by means of the correct
51. m CPU to CP with P_RCV_RK ccccccccccccccsesseaeeeeeeeeeeees 6 4 7 Diagnostics of the Drivel cccsccceseesseeeeeeeeeeeeeesneeseseeeeeeeeeseaaesesneeeeeeeeseaeseseeeenseeeeeas 7 1 7 1 Diagnostics via Display Elements LEDS cecececeeeeeeeeeeeeeeeeeeeeeeeeeeeeaees 7 1 7 2 Diagnostic Messages of the Function BIOCKS ccssceeececeeeeeeeeeeeeeeeeeenees 7 2 7 3 Eable of Errors EVents ieccsfaecteececuseteeveteteiiceval vevahetuecdeeae reveled seecbideresteearecaeeies 7 3 7 3 1 Error Codes for CPU Job Errors c ccccccceceseeeeeeeeceneeeeaeeeeeeeeeeaeeeseaeeneneeeeaees 7 3 7 3 2 Error Codes for Receive Errors cccccccccesesceceeeeceeeeeeeaeeeeeeeescaeeeseaeeeeeeeenaees 7 4 7 3 3 Error Codes for General Processing Errors cccccccsceeeeseceeeeeeeeeeeseeeeeees 7 6 Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions iv 6ES7870 1CA00 0YA0 Manual Edition 1 0 8 Application Example ccccccseccceseeeeseseeeeseseseeeseseenenseseeeenseseeeenenseeenes 8 1 Used BIOCKS sirere evs A E A ines aeeieia le 8 1 1 Program DeSCTiptiOn eecceeecteeeeenneeeeeenaeeeeeeaeeeseeaeeeeeteaaes 8 1 2 Programming Example rerien a A Wiring Diagrams Multipoint 0 ccccecceeeeseeeeeeeeeeeeeeeeseeeeeeeseeeneeseeenes B Literature LISTS niran ae me E adage fe leat sects GOSS ANY ei saceccened En SEA IAEA AN EEE E E T Loadable Driver CP341 Modbus ASCII Master with 3
52. mission Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 3 5 6ES7870 1CA00 0YA0 Manual Edition 1 0 Commissioning Driver Overview of Protocol Parameters Protocol Parameters Parameter Description Default value Character Time period used to monitor 1 to 6500 1000ms delay time the incoming characters within milliseconds in a message ims intervals Response Time to monitor the start of the 5 to 65500 2000 time out reply from the slave milliseconds in 1ms intervals Turnaround Waiting time after sending a broadcast message delay Operating Normal Operation Normal Normal mode Interference Suppression Interference Suppression 32 Bit mode Registers can also imply not selected not 32 bit values selected selected Value range Character Delay When receiving a message the quiet time between characters is measured If the Time quiet time exceed the the character delay time the message is ignored and an error is reported Response Time The reply monitoring time is the time the master spends waiting for a reply out message from the slave after output of a request message If the start character is not received within the response timeout the message is ignored and an error is reported Turnaround Delay When a broadcast request is sent no response is returned from the slaves Nevertheless a delay is respected by the Master in order to allow any sla
53. munication partner is interrupted or CTS or DSR signals not asserted at the connector 7 2 Diagnostic Messages of the Function Blocks Introduction Event Class Event Number Each function block has a STATUS parameter for error diagnostics purposes Each STATUS message number has the same meaning independent of the system function block used The following figure shows the structure of the STATUS parameter Numbering Bit No 15 13 12 8 7 0 Scheme Reserve Event Class Event Number Error Number The individual errors events are listed in Section 7 3 Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 7 2 6ES7870 1CA00 0YA0 Manual Edition 1 0 Diagnostics of the Driver 7 3 Table of Errors Events Event Classes The following event classes are defined Event Description Described in Class 1 Hardware error on CP CP Manual 2 Error during initialization CP Manual 3 Error during parameter assignment of PBK CP Manual 4 Errors in CP CPU data traffic recognized CP Manual by CP 5 Error during processing of a CPU job CP Manual Driver Manual 6 Error during processing of a partner job CP Manual 7 Send error CP Manual 8 Receive error Driver Manual 9 Error code message received from link Not used partner 10 Errors recognized by CP in reaction Not used message from partner 14 rel processing errors of the loadable Driver Manual river 7 3 1 Er
54. nized during the message exchange or if the slave sends an error code reply message this is reported by an edge at output ERROR For reading functions the activated P_SND_RK is completed after the reply message is received without error and complete transfer of the received data to the CPU This is communicated to the SIMATIC user program by means of an edge at output DONE of the P_SND_RK This means that the received data are already available on the CPU If errors were recognized during the message exchange or if the slave sends an error code reply message this is reported by an edge at output ERROR In this case no receive data are transferred to the CPU For those instances when a job is completed with ERROR at P_SND_RK an additional error code is entered in the STATUS parameter The exact cause for the error can be determined with this error code Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 6 3 6ES7870 1CA00 0YA0 Manual Edition 1 0 CPU CP Interface 6 1 2 Data Transfer from CPU to CP with P_RCV_RK Data Destination How Data Reception is Displayed How to Handle an Error P_RCV_RK Destination DB All reading function codes require a P_RCV_RK When FB P_RCV_RK is ready to receive it accepts the received data from the CP and enters them into the data destination specified in the parameters DB_NO and DBB_NO The user is informed of data reception in the CPU by means of an edge at output NDR
55. of Bits Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 3 6ES7870 1CA00 0YA0 Manual Edition 1 0 Example RCV Destination DB Function Codes Request Message FUNCTION 02 05H Slave Address 02H Function Code 01H Bit Start Address High 20H Bit Start Address Low OOH Amount of Bits High 18H Amount of Bits Low xxH LRC Reply Message from Slave FUNCTION 02 05H Slave Address 02H Function Code 03H Byte Counter 04H lt Data gt DI 127H 120H 26H lt Data gt DI 12FH 128H C8H lt Data gt DI 137H 130H xxH LRC Contents of RCV Destination Area Address Name Type Actual value Comment 0 0 datai WORD _ W 16 2604 20 data2 WORD _ w 16 00C8 The driver enters the data of the reply message into the destination DB word by word The 1st received byte is entered as the Low Byte of the 1st word data 1 the 2 received byte is entered as the High Byte of the 1 word data 1 and the 3rd received byte as the Low Byte of the 2nd word data 2 etc If an odd number of bytes are returned the value OOH is entered into the High Byte of the last word Any unaccessed bits in the last received byte are masked to zero in the destination byte regardless of the received value Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 4 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Codes 5 3 Function Code 03 Read Holding Registers Fun
56. ons A 2 6ES7870 1CA00 0YA0 Manual Edition 1 0 B Literature List Modbus Protocol Modbus over Serial Line Specification amp Implementation Guide V1 0 12 02 02 Modbus Application Protocol Specification Vita 6 4 04 http www modbus org Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 6ES7870 1CA00 0YA0 Manual Edition 1 0 Literature List Glossary Address Block Block Call Block Parameter C Communications Processor Configuration CPU CRC Cycle Time Cyclic Program Processing Glossary The address identifies a physical storage location and enables the user to directly access the operand store there Blocks are elements of the user program which are defined by their function structure or purpose With STEP 7 there are _ Code blocks FB FC OB SFB SFC _ Data blocks DB SDB _ User defined data types UDT A block call occurs when program processing branches to the called block Block parameters are wildcards within multiple use blocks which are replaced with current values when the relevant block is called Communications processors are modules for point to point connections and bus connections The configuration is the setup of individual modules of the PLC in the configuration table Central processing unit of the S7 programmable controller with control and arithmetic unit memory operating system and interfaces to I O modules Cyclic Redundancy Check Check
57. ply monitoring time When devices are setup to communicate on a Modbus serial line using ASCII mode each 8 bit byte in a message is sent as two ASCII characters The allowable characters transmitted for all fields except the start character and end characters are hexadecimal 0 9 A F ASCII coded Example The byte 0X5B is encoded as two characters 0x35 and 0x42 0x35 5 and 0x42 B in ASCII 4 1 Message Structure Message Structure Start Character Slave Address The data exchange Master Slave and or Slave Master begins with the Start Character followed by Slave Address and Function Code Then the data are transferred The structure of the data field depends on the function code used The LRC check is transmitted at the end of the message followed by the End Characters START ADDRESS FUNCTION DATA LRC END 1 char 2 chars 2 chars 0 up to 2x252 2chars 2 chars colon char s CR LF START Start Character ADDRESS Modbus Slave Address FUNCTION Modbus Function Code DATA Message Data Byte_Count Coil_ Number Data LRC Message Checksum END End Characters CR LF The start character is a colon Ox3A The devices monitor the bus continuously for the colon character When this character is received each device decodes the next character until it detects the End Characters CR LF The slave address can be within the range 1 to 255 The address is used to address a defined slave on th
58. register is returned by the slave The master receives more data than expected and the activated send job is finished with error If bit 2 is set and a normal 2 bytes per register range is written to the slave 4 bytes per register are sent by the master and the slave should returned an exception response to the master Likewise if bit 2 is not set and a 4 bytes per register range is written to the slave 2 bytes per register are sent by the master and the slave should returned an exception response to the master Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 1 6ES7870 1CA00 0YA0 Manual Edition 1 0 Function Co 5 1 Function Code 01 Read Coils Function Start Address Amount of Bits SEND Source DB Example This function serves to read individual output bits coils from the slave The parameter bit start address is not checked by the driver and is sent unchanged Any value between 1 and 2008 is permitted as the amount of bits number of coils Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 1 Function Code bit_startadr WORD W 16 0040 Bit Start Address Amount of Bits Request Message FUNCTION 01 05H Slave Address 01H Function Code 00H Bit Start Address High 40H Bit Start Address Low OOH Amount of Bits High OFH Amount of Bits Low xxH LRC Reply Message from Slave FUNCTION 01 05H Slave Add
59. ress 01H Function Code 02H Byte Counter 01H lt Data gt Coil 47H 40H F7H lt Data gt Coil 4EH 48H xxH LRC Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 6ES7870 1CA00 0YA0 Manual Edition 1 0 des 5 2 Function Codes RCV Destination Contents of RCV Destination Area DB Address Name Type Actual value Comment 0 0 dataft WORD__ w 16 7701 The driver enters the data of the reply message into the destination DB word by word The 1st received byte is entered as the Low Byte of the 1st word data 1 the 2 received byte is entered as the High Byte of the 1 word data 1 and the 3rd received byte as the Low Byte of the 2nd word data 2 etc If an odd number of bytes are returned the value 00H is entered into the High Byte of the last word Any unaccessed bits in the last received byte are masked to zero in the destination byte regardless of the received value 5 2 Function Code 02 Read Discrete Input Function This function serves to read individual input bits from the slave Start Address The parameter bit start address is not checked by the driver and is sent unchanged Amount of Bits Any value between 1 and 2008 is permitted as the amount of bits number of Dls SEND Source DB Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 2 Function Code bit_startadr WORD W 16 0120 Bit Start Address Amount
60. rinted circuit boards for programmable controllers Module parameters are used to set the module reactions A distinction is made between static and dynamic module parameters Online means that a data circuit exists between PLC and programming device Offline means that no such data circuit exists STEP 7 allows you to display contextual help texts on the screen while you are working with the programming software An operand is part of a STEP 7 instruction and states with what the processor is to do something It can be both absolutely and symbolically addressed The SIMATIC S7 programmable controllers have three different operating modes STOP RESTART and RUN The functionality of the CPUs varies in the individual operating modes The operating system of the CPU organizes all functions and operations of the CPU which are not connected to a specific control task Glossary 3 6ES7870 1CA00 0YA0 Manual Edition 1 0 Parameter Parameter Assignment Parameter Assignment Tool CP Point to Point Communication Parameter Assignment Point to Point Connection Procedure Process Image Programmable Controller Project Configuration of Data Link Protocol Rack RESTART Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions Glossary Parameters are values that can be assigned A distinction is made between block parameters and module parameters Parameter assignment means setting the behavior of a mo
61. rization masks are installed in the following directory c Program Files Step7 S7fptp S7Driver where the contents of are selectable during the installation procedures The directory includes the following files e S7 wipmab dll e S7wfpmax cod e S7wfpmbx cod Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 3 1 6ES7870 1CA00 0YA0 Manual Edition 1 0 Commissioning Driver 3 2 Uninstalling the Driver The driver can be uninstalled from the STEP 7 package by selecting Control Panel Add Remove Software Find the driver in the list and follow the instruction for uninstalling it The user can check if all the files S7wfpma S7wfpmb S7wfpmc have been deleted successfully in the c Program Files Step7 S7fptp S7 Driver directory Note Before uninstalling the package Parameter Assignment Tool CP Point to Point Communication Parameter Assignment all the loadable drivers must first be uninstalled 3 3 Configuring a Data Link CP in Step7 Introduction The configuration of a data link comprises the hardware allocation in the configuration table using HW config The configuration can be carried out using the STEP 7 software S7 Project Before you can carry out the configuration you must have created a S7 Project with STEP 7 Project Insert the required project components into the opened project using the SIMATIC Components Manager You must have a SIMATIC 300 Station in
62. ror Codes for CPU Job Errors Event Class 5 05h CPU Job Errors Event Event Event Text Class Number No Hex Decimal Transmission length during transmission is too Check the parameter LEN for large gt 4 Kbytes or transmission length for SEND is too small Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 7 3 6ES7870 1CA00 0YA0 Manual Edition 1 0 Diagnostics of the Driver 7 3 2 Error Codes for Receive Errors Event Class 8 08h CPU Receive Errors Event Event Event Text Class Number No Hex Decimal Character delay time exceeded Eliminate error in partner device or interference on the transmission line or increase the value of the Character Delay Time parameter Transmission error parity error Check for interference which could overflow error stop bit error frame influence the transmission line If recognized in a character required change system structure and or cable laying Check whether the protocol parameters transmission rate amount of data bits parity and amount of stop bits have the same settings for the CP and the link partner BREAK Establish connection between the Receiving line to partner device is devices or switch on partner device interrupted Make sure CTS and DSR are asserted at the CP connector For use with TTY operation check line current at idle state For use with an RS422 485 X27 connection check and if requ
63. ry value The LRC value is calculated by the transmitting device which appends the LRC to the message The device that receives recalculates an LRC during receipt of the message and compares the calculated value to the actual value it received in the LRC field If the two values are not equal an error results The LRC is calculated by adding together successive 8 bit bytes in the message discarding any carries and then two s complementing the result The LRC is an 8 bit field therefore each new addition of a character that would result in a value higher than 255 decimal simply rolls over the fields value through zero Because there is no ninth bit the carry is discarded automatically Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 4 2 6ES7870 1CA00 0YA0 Manual Edition 1 0 Message End Telegram Example Transmission Protocol A procedure for generating an LRC is 1 Add all bytes in the message excluding the starting colon and ending CRLF Add them into an 8 bit field so that carries will be discarded 2 Build the two s complement 3 Convert the LRC to ASCII Placing the LRC into the Message When the 8 bit LRC 2 ASCII characters is transmitted in the message the high order character will be transmitted first followed by the low order character For example if the LRC value is 61 hex 0110 0001 LRC high 0x36 LRC low 0x31 The end of the message is defined by the characters CR and
64. s is entered at LADDR You must enter X for expanded data block as the area type of the partner CPU No values must be specified for the other parameters of the partner CPU R_ This ensures transfer to the driver of the function codes required for the execution When P_SND_RK is activated the source data area specified with the parameters DB_NO and DBB_NO is transferred to the CP with the length LEN Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 6 1 6ES7870 1CA00 0YA0 Manual Edition 1 0 Length Indication SEND Source DB CPU CP Interface The length LEN depends on the function code used Function Code Length LEN in Byte 01 6 02 03 04 05 06 16 Bit Register 06 32 Bit Register 07 08 11 12 2 15 gt 8 16 gt 8 16 Bit Register 16 gt 10 32 Bit Register DIJI oQ NIOIN If the transferred data quantities differ from those listed above for the individual function codes the job is not carried out and P_SND_RK rejects it with an edge at output ERROR The data length LEN may exceed the required amount of data for the activated function The driver checks the data length according to function code and amount of bits registers If less data than necessary are transferred to the CP the send job is finished with error So it is not necessary to calculate LEN for each send job when the maximum length is used But it
65. sion protocol an envelope icon gets you to the dialogue where the protocol specific parameters are set The parameters described below can be set for this driver in the individual dialog boxes Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 3 4 6ES7870 1CA00 0YA0 Manual Edition 1 0 Commissioning Driver 3 6 1 Modbus ASCII Protocol Overview of Transmission Parameters Transmission Rate Data Bits Stop Bits Parity Transmission Parameters Parameter Description Value range Default Baud rate Data transmission speed in bits second Data bits Bit per character Stop bits Amount of stop bits Parity amount of data bits is completed to an even number amount of data bits is completed to an odd number no parity bit transferred The transmission rate is the speed of data transmission in bits per second bps The amount of data bits describes how many bits represent a character to be transmitted With Modbus ASCII 7 data bits are mandatory The amount of stop bits defines the smallest possible distance between two characters to be transferred With even or odd parity 1 stop bit is pre defined None parity effects two stop bits The parity bit is for data safety depending on parameter assignment it completes the amount of transmitted data bits to either an even or an odd number If no parity is selected no parity bit is transmitted This reduces the safety of data trans
66. ster SEND Source DB Example RCV Destination DB Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions This function serves to read individual registers from the slave The parameter Register start address is not checked by the driver and is sent unchanged A maximum of 125 registers 1 register two bytes can be read Structure of SEND Source Area Address Name Type Start value Comment BYTE B 16 5 Slave Address BYTE B 16 4 Function Code reg_startadr WORD W 16 0050 Register Start Address Amount of Registers Request Message FUNCTION 04 05H Slave Address 04H Function Code 00H Register Start Address High 50H Register Start Address Low OOH Amount of Register High 03H Amount of Register Low xxH LRC Reply Message from Slave FUNCTION 04 05H Slave Address 04H Function Code 04H Byte Counter 31H Register Address 50H Data High 32H Register Address 50H Data Low 33H Register Address 51H Data High 34H Register Address 51H Data Low 35H Register Address 52H Data High 36H Register Address 52H Data Low xxH LRC Contents of RCV Destination Area Address Name Type Actual value Comment 0 0 datali WORD__ W 16 3132 20 data 2 WORD _ w 16 3334 40 data 3 WORD__ W 16 3536 6ES7870 1CA00 0YA0 Manual Edition 1 0 5 7 Function Codes 5 6 Function Code 05 Write Single Coil Function Bit Address Bit
67. sum which guaranteed accuracy of error recognition The cycle time is the time the CPU needs to scan the user program once In cyclic program processing the user program is executed in a constantly repeating program loop called a cycle Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions Glossary 1 6ES7870 1CA00 0YA0 Manual Edition 1 0 Data Block DB Data Type Default Setting Diagnostic Buffer Diagnostic Event Diagnostics Functions Download F Function Block FB Hardware Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions Glossary These are blocks containing data and parameters with which the user program works Unlike all other blocks data blocks do not contain instructions They are subdivided into global data blocks and instance data blocks The data held in the data blocks can be accessed absolutely or symbolically Complex data can be stored in structured form Data types allow users to define how the value of a variable or constant is to be used in the user program They are subdivided into elementary and structured data types The default setting is a practical basic setting which is always used if no other value is specified Every CPU has a diagnostic buffer in which detailed information on diagnostic events is stored in the order in which they occur Diagnostic events are for example errors on a module or system errors in the CPU which may be caused by a
68. the CPU but directly with the parameter assignment tool in the retentive memory of the CP 341 You should note however that this means you cannot change a module without a programming device Further Please refer to the User Manual for STEP7 for detailed description on inrormation e how to save the configuration and the parameters e how to load the configuration and the parameters into the CPU e how to read change copy and print the configuration and the parameters 3 8 Start up Characteristics of CP341 Introduction The startup of the CP is divided into two phases gt Initialization mains on of CP gt Parameter assignment Initialization As soon as voltage is applied to the CP and after completion of a hardware test program the firmware on the CP is prepared for operation Parameter During parameter assignment the CP receives the module parameters allocated Assignment to the current slot The CP is now ready to run Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 3 9 6ES7870 1CA00 0YA0 Manual Edition 1 0 Transmission Protocol 4 Transmission Protocol General Information Master Slave Relationship ASCIl Mode The procedure in use is asynchronous and half duplex Data transmission is carried out without handshake The CP initiates the transmission Master and after outputting a request message it waits for a reply message from the slave for the duration of the parameter re
69. tion block has a STATUS output for error diagnostics purposes Reading this STATUS output enables the user to obtain information on errors which occurred during communication The STATUS parameter can be evaluated in the user program All errors events described in Section 7 3 are also entered in the diagnostic buffer of the CP The manual for the CP describes how you can read the diagnostic buffer 7 1 Diagnostics via Display Elements LEDs Introduction The display LEDs of the CP 341 provide general operational information The following different display functions are available e Group Error Displays SF red Error occurred or new parameters assigned e Special Displays TXD green Send active lights up when the CP 341 sends user data via the interface RXD green Receive active lights up when the CP 341 receives user data via the interface Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 7 1 6ES7870 1CA00 0YA0 Manual Edition 1 0 Group Error Display SF Diagnostics of the Driver The group error display SF always lights up after power on and goes out after initialization is complete If parameter assignment data were created for the CP 341 the SF LED lights up again briefly when new parameters are loaded The group error display SF lights up when the following errors have occurred e Hardware error e Firmware error e Parameter assignment error e BREAK Receiving line between CP 341 and com
70. ual for slave device or 05 Acknowledge Modbus Protocol Specification 7 100 101 OE 66H 102 Reply message with Modbus Exception Code See manual for slave device or 06 Busy Rejected message Modbus Protocol Specification OE 67H 103 Reply message with Modbus Exception Code See manual for slave device or 07 Negative Acknowledgment Modbus Protocol Specification Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 7 10 6ES7870 1CA00 0YA0 Manual Edition 1 0 Application Example 8 Application Example General The following simple programming example illustrates the use of FBs P_SND_RK Information and P_RCV_RK When the Modbus master is installed the application example is stored in the STEP 7 directory EXAMPLES under the name MB_ASCIl The S7 program is for information purposes only and is not to be understood as a solution for a customer specific installation configuration In order to illustrate the basic structure we intentionally kept it simple and avoided symbolic display 8 1 Used Blocks Used Blocks The following blocks are used in the programming example Cycle Execution Cyclic program processing OB 100 Complete Restart Startup OB for Restart FC 10 FC for Startup OB FC 21 Execute Send Jobs FC Calling P_SND_RK FC 22 Execute Receive Jobs FC Calling FB P_RCV_RK DB43 DESTINATION_DB P_RCV_RK Destination DB for receive data Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 8 1
71. unt of Registers High 02H Amount of Registers Low 08H Byte Counter 51H lt reg_data 1 gt Byte 1 A1H lt reg_data 1 gt Byte 2 52H lt reg_data 1 gt Byte 3 A2H lt reg_data 1 gt Byte 4 53H lt reg_data 2 gt Byte 1 A3H lt reg_data 2 gt Byte 2 54H lt reg_data 2 gt Byte 3 A4H lt reg_data 2 gt Byte 4 xxH LRC Reply Message from Slave FUNCTION 16 05H Slave Address 10H Function Code 01H Register Address High 20H Register Address Low OOH Amount of Registers High 02H Amount of Registers Low xxH LRC Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 5 17 6ES7870 1CA00 0YA0 Manual Edition 1 0 CPU CP Interface 6 CPU CP Interface Used SFBs Parallel Processing of Requests Data transfer between CP and CPU is carried out by means of FBs P_SND_RK FB8 and P_RCV_RK FB7 FB P_SND_RK is activated by an edge at input REQ when data output is required FB P_RCV_RK is made ready to receive by EN_R 1 A P_RCV_RK is required for all reading function codes At a given time only one FB P_SND_RK and one FB P_RCV_RK can be called for each CP 341 in the user program 6 1 1 Data Transfer from CPU to CP with P_SND_RK Activation Data Source Execution of a Modbus function code is activated by means of an SFB P_SND_RK with an edge at input REQ Enter S for SEND at the SF parameter The logical module addres
72. ure that they are compatible with the user programs of the Modbus Slave systems clarify which function codes and which Modbus addresses will be used 1 3 Summary of the Modbus Protocol Function Codes Data Exchange The type of data exchange between Modbus systems is controlled by Function Codes FCs The following FCs can be used to carry out data exchange bit by bit FC 01 Read Coils FC 02 Read Discrete Inputs FC 05 Force Single Coil FC 15 Force Multiple Coils The following FCs can be used to carry out data exchange register by register FC 03 Read Holding registers FC 04 Read Input registers FC 06 Write Single Register FC 16 Write Multiple Registers Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 1 2 6ES7870 1CA00 0YA0 Manual Edition 1 0 Product Description Data Areas As a rule the individual FCs operates in accordance with the table below Function Data Type of Data Access Code 01 05 15 Coil output Bit Output read write status 02 Input Status Bit Input read only 03 06 16 Holding Register Register Output read write 16 or 32 bit Register 04 Input Register Register Input read only 16 or 32 bit Register Address Analogous to the partitioning into read write and read only areas data at user Representation level can be represented as shown in the table below Function Type of Data Example Code Address Representation
73. ve to process the current request before sending a new one This delay is called turnaround delay The turnaround delay should be shorter than the response timeout After the CP has sent the last character of a broadcast message it waits the turnaround delay before the send job is completed If the turnaround delay is set to 0 the CP completes the send job immediately after sending the last character of the request Reply Monitoring The reply monitoring time is the time the master spends waiting for a reply Time message from the slave after output of a request message If the slave doesn t send a start character during the reply monitoring time the send job is finished with error Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 3 6 6ES7870 1CA00 0YA0 Manual Edition 1 0 Normal Operation Interference Suppression 32 Bit Mode Commissioning Driver In this operating mode all recognized transmission errors and or BREAK before and after receive messages from the slave result in an appropriate error message If BREAK is recognized on the receiving line at the start of the receive message or if the CP interface block notices transmission errors before the message no error is reported The start of the receive message from the slave is recognized by means of the correctly received start character Transmission errors and or BREAK are also ignored when they occur after the end of the receive message Normal
74. within the reply message is not an ASCII character 0 9 A F Modbus ASCII Master with 32 Bit Extensions Manual Edition 1 0 Diagnostics of the Driver The wrong slave has replied Check if the transmission line is interrupted interface analyzer may be required Check slave device Check slave device If working with 32 bit registers check accessed address of the slave whether it belongs to the expected memory area 16 32 bit Check slave device If working with 32 bit registers check accessed address of the slave whether it belongs to the expected memory area 16 32 bit Check slave device Check slave device Check slave device Check slave device Check slave device Make sure it is in ASCII mode and not RTU 7 9 Diagnostics of the Driver Event Class 5 05h CPU Job Errors Event Event Text Remedy Number Decimal 9 Reply message with Modbus Exception Code See manual for slave device or 01 Illegal Function Modbus Protocol Specification Reply message with Modbus Exception Code See manual for slave device or 02 Illegal Data Address Modbus Protocol Specification Reply message with Modbus Exception Code See manual for slave device or 03 Illegal Data Value Modbus Protocol Specification Reply message with Modbus Exception Code See manual for slave device or 04 Failure in associated device Modbus Protocol Specification Reply message with Modbus Exception Code See man
75. xample 8 1 1 Program Description General Information P_SND_RK Job P_RCV_RK Job The programming example consists of Startup block OB100 FC10 Cyclic part OB1 calling Function block FC21 for data transfer CPU to CP Send FC23 to receive data CP to CPU The parameters for the programmed system function blocks P_SND_RK P_RCV_RK are stored in the work DBs DB40 and DB41 The send data SEND source area are contained in DB42 Data received from the link partner are entered into DB43 RCV destination area A P_SND_ RK job can be activated in the cyclic part of the program by setting memory bit M 120 7 for example by CONTROL VARIABLE The data with length LEN contained in the P_LSND_RK source area DB42 are transferred to the CP Memory bit M 120 7 is reset immediately After completion of the P_SND_RK job without error a success counter is incremented after completion with error an error counter is incremented An SFB P_RCV_RK is programmed in FC23 where the Receive Enable is always 1 in order to receive data from the link partner The receive data are entered into the P_RCV_RK destination area the amount of entered data is displayed in parameter LEN On taking on data without error the success counter is incremented on completion with error the error counter is incremented For the P_SND_RK and P_RCV_RK jobs the output parameter STATUS is stored when a value other than 0 is reported Loadable Driver
76. you to the dialogue where the driver is loaded e You need an online connection to the CPU to load drivers e The tab Load Drivers shows you which driver is already loaded on the CP and which driver was selected by you e Once again click Load Drivers and confirm with yes The transfer of the driver to the CP is carried out e After the transfer the information Driver version online on the module is updated e If the driver in the current version already exists on the CP the transfer in cancelled with the message Driver already exists e Click Close to return to the main tab The error Module rejected driver download may occur when the driver files are destroyed In that case a re installation of the driver is necessary 3 6 Assigning Parameters to the Loadable Driver Opening the Parameter Assignment Tool CP PtP Protocol Selection Driver Specific Parameters Select the SIMATIC station and double click Hardware or select the menu command Edit gt Open Object to start the Hardware Configuration Click the CP and select the menu command Edit gt Object Properties Click the Parameter button along the bottom to open the protocol selection dialog box In addition to the standard protocols the selection box also displays all installed loadable drivers Choose Modbus ASCII Master for this loadable driver Double clicking on to the symbol for the transmis
77. your project Before an insertion you must select the target project name by clicking it To insert the 300 Station from the Insert menu of Simatic Manager do Insert gt Station gt SIMATIC 300 Station Hardware The configuration of the hardware comprises defining the hardware components Configuration themselves and also their properties To start the hardware configuration select the SIMATIC 300 Station and double click Hardware or select the menu command Edit gt Open Object Use the menu command Insert gt Hardware Components to insert a RACK 300 a PS 300 a CPU 300 from SIMATIC 300 and the CP PtP from CP 300 with the appropriate part number A detailed description of how to configure S7 300 modules can be found in the User Manual for STEP 7 Loadable Driver CP341 Modbus ASCII Master with 32 Bit Extensions 3 2 6ES7870 1CA00 0YA0 Manual Edition 1 0 Commissioning Driver 3 4 Assigning Parameters to the CP Assigning Parameters to the CP After you have arranged the modules in your rack using Hardware Configuration you must assign parameters to them To start the parameter assignment tool double click the CP in Hardware Configuration or click the CP and select the menu command Edit gt Object Properties 1 Properties CP341 gt Basic Parameters Tab Clicking the Parameter button along the bottom opens the protocol selection interface Parameter Assignment of Point to Point

Modbus ASCII Master

Contents

Download Pdf Manuals

Related Search

Related Contents