Home

SIMATIC S7 - OPEN MODBUS / TCP Communication via

Contents

1. MODBUS TCP communication via the integrated PN interface of the CPU 5 1 2XV9450 1MB02 Manual edition 2 1 Licensing 3 The output IDENT _CODE shows an 18 character string Copy this string per copy paste from the DB und and insert it in the form IT4Industry SOFTWARE REGISTRATION FORM This form is stored in the library path Program Files Siemens Step7 S7LIBS Modbus_PN_CPU during installation and is also available on the installation CD Insert the License No of the product package into the form EDE Param D8102 MODBUS_PN_CPU_EXAMPLE SIMATIC 400 Server CPU 414 0 x TA Datablock Edit PLC Debug Yiew Window Help 8 x CAA e E T CaL Addre Declar Name Type Initial val Actual value caj D WORD vit 6a0 v1 61 DB_PARAM BLOCK_DB DB1 DB2 RECV_TIME TIME TROMS T 500MS CONN_TIME TIME TROMS T 5S KEEP_ALIVE TIME TROMS T OMS ENG_ENR BOOL FALSE TRUE DISCONNECT BOOL FALSE FALSE REG_KEY STRING 17 SOOFOOSOOFOOFOOGOOSO LICENSED BOOL FALSE FALSE BUSY BOOL FALSE TRUE CONN_ESTABLISHED BOOL FALSE FALSE DONE_NDR BOOL FALSE FALSE ERROR BOOL FALSE FALSE STATUS_MODBUS WORD VIBRO Witt 624090 STATUS_CONN WORD Wt 6 0 Wit 6 0 STATUS_FUNC STRING 8 z IDENT_CODE STRING 18 UNIT BYTE B 16 0 B 16 0 x wj Messages Press F1 for help gt M Please insert the IDENT CODE here The manual contains information how to find oy the
2. Error messages of FB MODBUSPN at the output STATUS _MODBUS STATUS Remedy Hex A035 The parameterized areas data_type_3and data_type_5 Correct the parameterization in overlap DB MODBUS_ PARAM A036 The parameterized areas data_type_3and data_type_6 The data areas must not overlap contain any overlapping A037 The parameterized areas data_type_3and register areas data_type_7overlap A038 The parameterized areas data_type_3and data_type_8overlap A045 The parameterized areas data_type_4 and data_type_5 overlap A046 The parameterized areas data_type_4 and data_type_ 6 overlap A047 The parameterized areas data_type_4 and data_type_7 overlap A048 The parameterized areas data_type_4and data_type_8 overlap A056 The parameterized areas data_type_5 and data_type 6 overlap A057 The parameterized areas data_type_5and data_type_7 overlap A058 The parameterized areas data_type_5 and data_type_8 overlap A067 The parameterized areas data_type_6and data_type_7 overlap A068 The parameterized areas data_type_6 and data_type 8 overlap A078 The parameterized areas data_type_7 and data_type_8 overlap A079 The connection ID of parameter ID is not defined in DB Correct the parameterization at MODBUS_PARAM the input ID A0O7A An invalid value ID is parameterized Range of values is 1 to 4095 AO7B_ The parameter ID exists twice in the parameter DB Correct the parameterization in DB MODB PARAM A07C_
3. and can be used as a sample Structure of DB MODBUS PARAM Address Name STRUCT 0 0 Connection 1 Connection parameters 64 0 Connection 1 Modbus parameters END_STRUCT STRUCT 650 0 Connection 2 Connection parameters 714 0 Connection 2 Modbus parameters END_STRUCT STRUCT 650 i Connection i 1 Connection parameters 65 650 i 64 Connection i 1 Modbus parameters END_STRUCT MODBUS TCP communication via the integrated PN interface of the CPU 4 1 2XV9450 1MBO02 Manual edition 2 1 Connection Parameters Modbus Parameters Alternatives for Parameterization Parameterisation of the Modbus Communication The parameters of the connection are defined in the first block e g the used local interface and the IP address of the communication partner The functions TCON and TDISCON can establish and terminate a connection by means of these parameters A detailed structure can be found in section 4 2 The structure of the connection parameter block is obligatory und may not be changed Otherwise it becomes impossible to set up a connection The Modbus parameters define the mode of communication and the address reference e g how many register or bit areas are mapped to which DB or the differentiation between the S7 acting as server or as client The structure of the parameter DB has to remain unchanged to ensure proper communication
4. e The initialization parameters must be set according to the station configuration e The initialization parameters are copied into the instance DB e The runtime parameters are not evaluated during the start up e The values of the parameter data block MODBUS_PARAM are evaluated In case of cyclical operation the FB MODBUSPN is called in OB1 or ina cyclic interrupt OB e Corresponding to the runtime parameters the functions of the function block are activated e While a request is being processed changes to the runtime parameters are ignored e Inthe cyclical operation mode initialization parameters are ignored The block MODBUSPN must be called in OB121 with the same instance DB as in the start up OB and the cyclic OB If the block has not been licensed yet the OB121 is called Warning The CPU will turn to STOP mode if the OB121 is not available The call of MODBUSPN in OB121 executes an entry in the diagnostic buffer which points out that the registration key is missing The LED SF or INTF of the CPU flashes simultaneously MODBUS TCP communication via the integrated PN interface of the CPU 6 2 2XV9450 1MB02 Manual edition 2 1 Function Block MODBUSPN Connection Active connection establishment can be carried out by the Modbus client as Handling well as the Modbus server It is recommended explicitly that the Modbus client executes the active establishment The relevant information is read from the conne
5. There are two alternatives for a parameterization of the connection and Modbus parameters The first one is to use a Wizard which offers an easy way to setup the connection parameters The second possibility is to edit the parameters in the structure in the data block with the editor of STEP7 The two opportunities are described in detail in the following sections 4 1 and 4 2 4 1 Parameterization with the Wizard General Information With the wizard Modbus TCP Wizard you can easily parameterize the connection parameters as well as the Modbus parameters in the parameter data block MODBUS_PARAM The complete structure connection parameters and Modbus parameters is created It is recommended to use the wizard for the parameterization of the block MODBUS_PARAM You can find the wizard at http support automation siemens com WW view en 31535566 MODBUS TCP communication via the integrated PN interface of the CPU 4 2 2XV9450 1MBO02 Manual edition 2 1 Parameterisation of the Modbus Communication 4 2 Editing the Parameterization Procedure Structure of and Adaption of Connection Parameters block_length id For each logical connection one structure is required Address Name ime mitia value e coc SCS llocal_tsap_id ARRAY 1 16 B 16 D0 B 16 7 B 16 0 BS16 0 es a OOO rem tsap_ia armaYi1 16 B 16 0 B 16 0 B 16 0 B 16 0 O a 62 0 spare WORD WH1LEFO This parameter desc
6. 6 15 and 16 A00C The received byte count does not match the number of Verify the data of the registers communication partner with the The connection is terminated help of a telegram trace AOOD Only if S7 is client The register or bit address respectively the number of registers or bits in the response telegram is not equal to the one in the request telegram AOOE The length indicated in the MODBUS specific telegram header does not match the number of registers bits or the byte count in the telegram The FB ignores all data The connection is terminated MODBUS TCP communication via the integrated PN interface of the CPU 7 7 2XV9450 1MB02 Manual edition 2 1 Diagnosis Error messages of FB MODBUSPN at the output STATUS _MODBUS STATUS Remedy Hex AOOF A protocol identifier lt gt 0 was received Verify the data of the communication partner with the help of a telegram trace A010 In the parameters db_1 to db_8a DB number is used Correct the parameterization in twice DB MODBUS_PARAM A011 An invalid value for DATA_TYPE is given Value range 1 Correct the parameters to 4 The connection is terminated A012 The parameterized areas data_type_1 and data_type_2 Correct the parameterization in overlap DB MODBUS_PARAM A013 The parameterized areas data_type_1 and data_type_3 The data areas must not overlap contain any overlapping register areas A014 The parameterized areas data_type_1 and
7. An invalid value data_type_x was given The value range pei is 0 to 4 A07D Parameter data_type_1 is not defined The parameter area _1 is the default area and must be defined AO7E The DB number of db_xis identical to the number of the parameter DB MODBUS_PARAM or to the instance DB AO7F The data block defined at DB_PARAM is no parameter Correct the parameterization at DB for Modbus communication The length information in the INPUT DB_PARAM DBWO was changed or a wrong DB was defined The parameter DB_PARAM was changed without a DB_PARAM is an initialization restart of the CPU parameter Restart the CPU after changing this parameter MODBUS TCP communication via the integrated PN interface of the CPU 7 9 2XV9450 1MB02 Manual edition 2 1 Diagnosis Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Remedy Hex A081 Only if S7 is client and function code 5 Verify the data of the The received coil status is not equal to the sent one communication partner with the help of a telegram trace A082 Only if S7 is client and function code 6 Verify the data of the The received register value is not equal to the sent one communication partner with the help of a telegram trace A083 Only if S7 is client Wait with the initiation of a new A request was initiated prior to the completion of the request until the previous one previous one was finished either with DONE NDR TRUE or ERROR TRUE A084 T
8. During Start up Cyclical Operation S7 is Client Unambiguousness of the id parameter in the connection parameters of DB MODBUS_ PARAM Parameter group data_type_x db_x start_x end_x x 1 to 8 1 With data_type_x 0 the Modbus area is disabled and not further verified At least the first area _ 7 has to be parameterized 2 Validity check of data_type 3 db_x lt gt 0 4 Test end_x gt start_x 5 Modbus addresses for the same data type defined in two db_x lead to an error message address overlap Errors during start up provoke the ERROR bit to remain set In the cyclical operation no requests are executed A correction of the parameterization and a STOP gt RUN transition of the PLC are necessary Verification when the FB is called Valid registration key DB MODBUS_ PARAM is available with the necessary length Range of values monitoring time RECV_TIME and CONN_TIME Range of values START_ADRESS Range of values LENGTH When executing a request there also is a check whether the data block specified by the register or bit address is available and has the necessary length The DB number must not be 0 and or identical to the number of MODBUS_ PARAM or the instance DB Receipt of the response telegram within the monitoring time The monitoring time can also elapse if less data than specified in the MODBUS telegram header is received Subsequent errors with loss of telegrams can occur MODBUS TCP communicati
9. IDENT CODE Bitte tragen Sie den IDENT CODE hier ei Das Handbuch enth lt Informationen wieSie den IDENT CODE ermitteln so gt gt gt IDENT_CODE lt lt Il Il S7 OpenModbus TCP HOP x samar INDUSTRIAL ype of Software 4 Softwaretyp Auntime Software Please insert the License No here Tyreol Licenses Lizenztyp Single License You find the License No on the package of the pl Tyee ote FA ov Bunot Software Class fSoltevare dasse A Bitte tragen Sie die Lizenz Nr hier ein Reference hardware Zielharcv are Sie finden die Lizenz Nr auf der Verpackung deES SMATICFN sd 3 Systemi Cond tions Systemanforc eung gt gt gt License No Lizenz Nr lt lt lt Weld ows Recrark Avmerkung Soktvare anc electronic documentation or CD Order No Hestell Ne 2XV orn se No Lizenze 20996 65 MEMS ORIGINAL INDUSTRIAL SOFTWARE SIEMENS OR 4 Please send the form per e mail to IT4Industry it4 industry siemens com Hereupon you will receive the registration key for your PLC MODBUS TCP communication via the integrated PN interface of the CPU 5 2 2XV9450 1MB02 Manual edition 2 1 Licensing Declaration of the The registration key REG_KEY must be declared for each call of the block Registration Key MODBUSPN REG_KEY The registration key REG_KEY should be stored in a global DB Via this global DB all MODBUSPN blocks can receive the registration key See also the following example Please procee
10. S7 300 CPU 31xC and CPU 31x Technical Specifications Manual A5E00105474 07 SIEMENS SIMATIC S7 400 Automation System S7 400 Hardware and Installation Operating Instructions A5E00850740 01 SIEMENS SIMATIC S7 400 S7 400 Automation System CPU Specifications Manual A5E00850746 06 SIEMENS SIMATIC Distributed I Os ET 200S Interface Module IM151 8 PN DP CPU Manual A5E02049033 01 SIEMENS Product Information on CPU315 2 PN DP 6ES7315 2EH13 0ABO CPU315F 2 PN DP 6ES7315 2FH13 0AB0O CPU317 2 PN DP 6ES7317 2EK13 0ABO CPU317F 2 PN DP 6ES7317 2FK13 0ABO CPU317 2 DP 6ES7317 2AJ10 0ABO CPU317F 2 DP 6 S7317 6FFO3 0ABO CPU319 3 PN DP 6ES7318 3EL00 0ABO CPU319F 3 PN DP 6ES7318 3FL00 0ABO A5E01103134 03 Additional information concerning STEP7 can be found in the following manuals SIEMENS SIMATIC Software Base software for S7 and M7 STEP7 user manual C79000 G7000 C502 SIEMENS SIMATIC Software System software for S7 300 400 System and standard functions Reference manual C79000 G7000 C503 02 MODBUS TCP communication via the integrated PN interface of the CPU 2 2XV9450 1MB02 Manual edition 2 1 Additional Questions Terminology Scope of Application MODBUS TCP communication via the integrated PN interface of the CPU Preface For further questions regarding the use of the FBs described in this manual please contact your Siemens partner who provided you with this function block Thi
11. The CPU will turn to STOP mode if the OB121 is not available Modbus communication is carried out even with a missing or wrong registration key but the output STATUS _MODBUS is set to W 16 A090 no valid license If this error code is shown although the registration key has been inserted please check if the FC EQ_STRING is copied into the project MODBUS TCP communication via the integrated PN interface of the CPU 5 4 2XV9450 1MB02 Manual edition 2 1 Function Block MODBUSPN 6 Function Block MODBUSPN 6 1 Functionality of the FB General The function block MODBUSPN enables a communication between a PLC Information with integrated PN interface and a partner which supports Open MODBUS TCP The function codes 1 2 3 4 5 6 15 and 16 are supported Depending on the parameterization the FB can be operated either in client or in server mode In the server operating mode the functionality multitasking in the sense of the MODBUS specification is not implemented The block MODBUSPN calls the blocks MOD_CLI FB104 and MOD_SERV FB105 internally The block MOD_CLI comprises the function of Modbus client the block MOD_SERV executes the function of Modbus server and the block TCP_COMM handles the connection management The blocks provide the following functions e Connection and data handling by means of T blocks of the standard library e Generation of MODBUS specific telegram header before sending e Verification of th
12. a wrong one is detected the SF LED Licensing S7 300 and IM151 8 or the INTF LED S7 400 of the CPU is flashing A cyclic error message regarding the missing license is displayed in the diagnostic buffer too The error number of the missing license is W 16 A090 ii E zici Path Wizard_Test SIMATIC PN 319 CPU 319 3F Operating mode of the CPU lt gt RUN Status 9 Error Not a force job Performance Data el Communication Stacks Identification General Diagnostic Buffer Memory Scan Cycle Time Time System Events P Filter settings active J Time including CPU local time difference Time of day 1 10 31 32 071 PM 05 14 1994 Event ID 16 A090 2 10 31 32 071PM 05 14 1994 EventID 16 A090 3 10 31 32 071 PM 05 14 1994 Event ID 16 A090 4 10 31 32 071PM 05 14 1994 Event ID 16 A090 5 10 31 32 071 PM 05 14 1994 Area length error when reading 6 10 31 31 105PM 05 14 1994 Made transition from STARTUP to RUN 7 10 31 31 103 PM 05 14 1994 Request for manual warm restart 8 10 31 31 047PM 05 14 1994 Made transition from STOP to STARTUP x Details on Event 1of10 EventID 16 A090 No entry in text database Hexadecimal values will be displayed Event ID 16 A090 OB 16 79 PK 16 01 DatlD 1 2 16 52 C2 Additional info 2 3 16 4D4F 4442 5553 i Save As Settings Open Black Help on Event The entry in the diagnostic buffer is carried out by means of OB121 Programming Error Warning
13. client S7 is Client An invalid value for the parameter LENGTH is given Correct the parameter S7 is Server LENGTH The number of registers bits in the request telegram is S7 is Server invalid Modify the number in the Range of values request telegram Read coils inputs 1 to 2000 Write coils 1 to 800 Read registers 1 to 125 Write holding registers 1 to 100 A006 The given range of registers defined with DATA_TYPE S7 is Client START_ADDRESS and LENGTH does not exist in Correct the parameter data_type_1 to data_type_8 combination DATA_TYPE START_ADDRESS LENGTH S7 is Server Modify the request of the client or correct the parameterization of data_type_x A007 Only if S7 is client Correct the parameterization An invalid monitoring time RECV_TIME or CONN_TIME is parameterized The RECV_TIME has to be at least 20 ms CONN_TIME 100ms A009 Only if S7 is client Verify the data of the The received transaction identifier TI is not equal to the communication partner with the sent one help of a telegram trace The connection is terminated AOOA Only if S7 is client The received UNIT is not equal to the sent one A00B S7 is client S7 is client Received function code is not equal to the sent one Verify the data of the S7 is server communication partner with the An invalid function code was received help of a telegram trace S7 is server The FB MODBUS only supports the function codes 1 2 3 4 5
14. number has not been released for all PN PLCs yet and is only possible when using a 319 CPU an IM 151 8 PN DP CPU a 414 CPU or a 416 CPU with the corresponding firmware version You can find further information about the released port numbers in the relevant manual of your PLC The PLC only allows a one time use of a specific port number Therefore the PLC FB cannot be addressed simultaneous from different devices on the same port number 1 2 Hardware and Software Prerequisites Usable Modules Software Versions The function blocks have been tested on the PLCs with the product identifications CPU315 2 PN DP 6ES7315 2EG10 0ABO CPU317 2 PN DP 6ES7317 2EK13 0AB0 CPU319 3 PN DP 6ES7318 3EL00 0ABO CPU414 3 PN DP 6ES7414 3EM05 0ABO CPU416 3 PN DP 6ES7416 3FRO05 0ABO IM151 8 PN DP 6ES7151 8AB00 0ABO You can find the latest hardware prerequisites on the internet www siemens com s 7modbus The usage of the FB MODBUSPN is possible with STEP7 Version 5 4 SP4 or higher MODBUS TCP communication via the integrated PN interface of the CPU 1 1 2XV9450 1MB02 Manual edition 2 1 Product description Memory The FB MODBUSPN requires 6048 byte work memory and 7294 byte load requirements memory The FB MOD_CLI requires 11184 byte work memory and 12054 byte load memory The FB MOD_SERV requires 10660 byte work memory and 11452 byte load memory The FB TCP_COMM requires 1880 byte work memory and 2224 byte load memory MODBUS TCP co
15. the response to the request telegram has been received from the server In the operating mode 7 is Server this output indicates a telegram exchange without errors In the parameters UNIT DATA_TYPE START_ADDRESS LENGTH TI and WRITE_READ the request parameters of the client are displayed These outputs are only available and valid as long as DONE_NDR is TRUE When this output is set an error was recognized In the operating mode S7 is Client the activated request was ended with an error The error number is displayed in the STATUS_ MODBUS or STATUS_CONN output In the operating mode S7 is Server an error was detected at a request telegram of the client or when sending a response telegram The error number is displayed in the STATUS MODBUS or STATUS_CONN output When ERROR is TRUE the STATUS _MODBUS output displays the error number regarding the processing of Modbus telegrams The error numbers are described in section 7 When ERROR is TRUE the STATUS_ CONN output displays the error number regarding the processing of the T functions The error numbers are described in section 7 and in the STEP7 online help of the functions TCON TDISCON TSEND and TRCV Status information like job processing active is provided by STATUS CONN as well In this case the ERROR bit is set to FALSE This parameter shows the name of the function which caused the error occurred With the identification string IDENT_CODE you can order the reg
16. 7 is server an indication CONN_TIME lt 100 ms causes the use of the default time 5s This is also true for the operating mode S7 is client with connect_at_startup TRUE During cyclic operation in the operating mode S7 is client CONN_TIME lt 100ms causes an error message and the request is rejected MODBUS TCP communication via the integrated PN interface of the CPU 6 8 2XV9450 1MB02 Manual edition 2 1 Function Block MODBUSPN ENQ_ENR Operating mode 7 is Client The data transfer is initiated with a TRUE edge at the input The request telegram is generated with the values of the input parameters UNIT DATA_TYPE START_ADDRESS LENGTH TI and WRITE_READ A new request may only be initiated when the previous one is ended with DONE_NDR or ERROR If the connection is not established CONN_ESTABLISHED FALSE the connection establishment is carried out first and then the data transfer takes places Operating mode 7 is Server The FB is activated with a TRUE signal at the input Telegrams from the client can be received If the connection is not established CONN_ESTABLISHED FALSE the connection establishment is activated When the parameter ENQ_ENR turns from TRUE to FALSE the connection may be terminated depending on the parameter DISCONNECT With a FALSE signal at the input and an established connection data is received from the client and discarded DISCONNECT In the operating mode S7 is client the parameter DISCONNECT TR
17. BUS TCP communication via the integrated PN interface of the CPU Function Block MODBUSPN data_type_1 B 16 3 Holding Register db_1 W 16 B DB 11 start_1 W 16 1 Start address 1 end_1 W 1 6 1F4 End address 500 data_type_2 B 16 3 Holding Register db_2 W 16 C DB 12 start 2 W 16 2D0 Start address 720 end 2 W 1 6 384 End address 900 data_type_3 B 16 4 Input Register db_3 W 16 D DB 13 start_3 W 16 2D0 Start address 720 end_3 W 1 6 3E8 End address 900 data_type_4 B 16 0 Not used db_4 0 0 start_4 0 0 end_4 0 0 data_type_5 BHI 6 1 Coils db_5 W 16 E DB 14 start 5 W 16 280 Start address 640 end_5 W 1 6 4E2 End address 1250 data_type_6 B 16 2 Inputs db_6 W 16 F DB 15 start_6 W 1 6 6A4 Start address 1700 end _6 W 1 6 8FC End address 2300 data_type_7 B 16 1 Coils db_7 W 16 10 DB 16 start _7 W 1 6 6A4 Start address 1700 end 7 W 1 6 8FC End address 2300 data_type_8 B 16 0 Not used db_8 0 0 start _8 0 0 end_8 0 0 2XV9450 1MB02 Manual edition 2 1 The following diagram shows a comparison of the SIMATIC memory area and the Modbus typical register oriented storage arrangement The diagram is based on the parameterization in the table above The Modbus addresses printed in black refer to the Data Link Layer and the ones printed in grey refer to the Application Layer The SIMATIC addresses printed in black are the offset in the DB Additionally you can find the Modbus register num
18. R mode Coils Reading function 1 to 2000 Writing function 1 to 800 Inputs Reading function 1 to 2000 Holding Register Reading function 1 to 125 Writing function 1 to 100 Input Register Reading function 1 to 125 Tl IN WORD _ Transaction Identifier 0 to 65535 OUT INPUT if in CLIENT mode OUTPUT if in W 16 0 to SERVER mode W 1 6 FFFF WRITE_ READ _ IN BOOL Write access or Read access INPUT if in CLIENT mode OUTPUT if in SERVER mode MODBUS TCP communication via the integrated PN interface of the CPU 6 6 2XV9450 1MB02 Manual edition 2 1 Function Block MODBUSPN General The parameters of the FB MODBUSPN can be divided into two groups Information e Initialization parameters e Runtime parameters Initialization parameters are evaluated only during the call of OB100 and are adopted into the instance DB They are marked with yes in the column INIT in the table displayed above A modification of the initialization parameters during run mode has no impact After a modification of these parameters e g during the test phase the instance DB must be initialized again via a STOP gt RUN transition of the PLC Runtime parameters can by modified during the cyclical operation In the mode S7 is server it is not advisable to modify the input parameters while a request is active Wait with the next request and the change of the parameters until the previous request ends with DONE_NDR or ERROR In the oper
19. ROR bit is set The error number is returned in STATUS _MODBUS The request of the client is not answered MODBUS TCP communication via the integrated PN interface of the CPU 6 4 2XV9450 1MB02 Manual edition 2 1 Function Block MODBUSPN 6 2 Parameters of the Function Block MODBUSPN parameter per Tvoo owen vase T wt IN WORD Connection ID must be identical to the 1 to 4095 associated parameter in the local W 16 1 to connection description W 16 FFF DB_PARAM BLOCK_ Number of the parameter DB depending on DB PLC RECV_TIME IN TIME Monitoring Time wait for data from communication partner RRNA T 24d20h31 Shortest adjustable time 20 ms m23s647ms CONN_TIME TIME Monitoring Time wait for establishing or termination of the connection to staat T 24d20h31 Shortest adjustable time 100 ms m23s647ms KEEP ALE WW TE oa o e ENQ ENR IN BOOL S7 is Client TRUE no Initiate request at positive edge FALSE S7 is Server Ready to receive at TRUE signal DISCONNECT JIN BOOL S7 is Client TRUE no TRUE connection is terminated after FALSE reception of response S7 is Server TRUE connection is terminated when ENQ_ENR FALSE REG_KEY IN STRING Registration key to activate the license Character no 17 LICENSED OUT BOOL License state of the function block no Block is licensed TRUE Block is not licensed FALSE BUSY OUT BOOL Operating state of the T functions no TCON TDISCON TSEND or TRCV Job processing TRUE No job process
20. Read the IDENT_CODE Licensing The block MODBUSPN must be licensed for each CPU individually The licensing takes place in two steps reading the IDENT_CODE and declaring the registration key REG_KEY To read the IDENT_CODE please proceed as follows 1 Parameterize the block in the cyclic OB OB1 or cyclic interrupt OB in OB100 and OB121 according to your requirements Transfer the program to the PLC and turn it to RUN mode Open the instance DB of the block MODBUSPN Data block gt Open Online to open the DB Monitoring the block via the button Si is insufficient EDB Param DB102 MODBUS_PN_CPU_EXAMPLE SIMATIC 400 ClienE Data block Edit PLC Debug view Window Help lal x lg Open Open Online Close Save Ctrl S Properties Print Ctrl P Print Preview Page Setup 1 MODBUS_PN_CPU_EXAMPLE ET2005 Client IM151 8 PN DP CPLI DB102 2 MODBUS_PN_CPU_EXAMPLE SIMATIC 400 Server CPU 414 3 PN DP DB102 3 ModbusProject SIMATIC ET2005 IM151 8 PN DP CPU DB120 4 ModbusProject SIMATIC ET2005 IM151 8 PN DP CPU DB121 ee Se ea Fa es fa _ pa N m m w Exit 42 0 out STATUS_CONN STATUS_FUNC 54 0 out IDENT_CODE 74 0 in_out UNIT STRING 8 STRING 18 B 16 0 B 16 0 zi gt A J Messages Opens the offline online partner of the current block offline A
21. SIEMENS SIMATIC S7 OPEN MODBUS TCP Communication via the integrated PN interface of the PLC SIEMENS SIMATIC S7 S7 OPEN MODBUS TCP Communication via the integrated PN interface of the PLC Manual Edition 2 1 Preface Table of Contents Product Description Getting Started Commissioning Parameterization Licensing FB MODBUSPN Diagnosis Sample Application Appendices Literature Glossary O N O OA A WS N Safety Precautions and Warnings Qualified Personnel Use as prescribed Trademarks This manual contains warnings which you should note for your own safety as well as for the prevention of damage to property These warnings are indicated by means of a warning triangle and are displayed as follows in accordance with the level of danger Danger indicates that loss of life severe personal injury or substantial damage will result if proper precautions are not taken Warning indicates that loss of life severe personal injury or substantial damage can result if proper precautions are not taken Caution indicates that minor personal injury or property damage can result if proper precautions are not taken Note represents an important information especially significant to the product handling of the product or a specific part of this documentation The start up and the operation of the device may only be carried out by qualified personnel Qualified personnel in t
22. U414 or CPU416 B 16 5 The length of the parameter ocal_tsap_id local port number is defined here Active connection establishment 0 Passive connection establishment 2 This parameter is currently not used Please assign the value B 16 0 The length of rem staddr i e the IP address of the communication partner is defined here If an unspecified connection is to be used no IP address is required for the partner Unspecified connection B 16 0 Specified connection B 16 4 This parameter defines the length of rem_tsap_id the port number of the remote communication partner Active connection establishment 2 Passive connection establishment 0 This parameter defines the length of next_staddr as the distinction between the communication running via an external CP or via the integrated PN interface of the PLC PN interface of the PLC B 16 0 MODBUS TCP communication via the integrated PN interface of the CPU 4 4 2XV9450 1MB02 Manual edition 2 1 Parameterisation of the Modbus Communication local_tsap_id This parameter defines the local port number The representation depends on the parameter connection_type The value range depends on the PLC The port number has to be unique within the PLC With connection type BH16 01 local_tsap_id 1 low byte of the local port number in hexadecimal local_tsap_id 2 high byte of the local port number in hexadecimal local_tsap_id 3 16 B 16 00 With connection type B 16 11 loca
23. UE indicates that the connection is terminated after the completed data transfer In the operating mode S7 is server the parameter DISCONNECT TRUE indicates that the connection is terminated when the parameter ENQ_ENR is set to FALSE This parameter is a runtime parameter and can be set optionally according to your requirements REG_KEY The block MODBUSPN must be licensed for each CPU individually to permit a correct program sequence With the registration key REG_KEY the block MODBUSPN is licensed and the Modbus communication runs without any restraint You can find further information in section 5 Licensing BUSY If this output is TRUE one of the T functions TCON TDISCON TSEND or TRCV is running CONN_ CONN_ESTABLISHED indicates that a connection to the communication ESTABLISHED partner is established and data can be transferred If CONN_ ESTABLISHED is set to FALSE the connection to the communication partner is not established MODBUS TCP communication via the integrated PN interface of the CPU 6 9 2XV9450 1MB02 Manual edition 2 1 DONE_NDR ERROR STATUS_MODBUS STATUS_CONN STATUS_FUNC IDENT_CODE UNIT Function Block MODBUSPN The parameter DONE_NDR indicates an error free execution of the request In the operating mode S7 is Client the activated request was executed without an error With a reading function the response data from the server has already been entered into the DB With a writing function
24. aced with actual values when the relevant block is called Blocks are elements of the user program which are defined by their function structure or purpose With STEP7 there are e Code blocks FB FC OB SFB SFC e Data blocks DB SDB e User defined data types UDT Part of a gt subnet Subnets can consist of bus segments and connectivity devices such as repeaters and bridges Segments are transparent for addressing A client is a device or in general terms an object that requests a service from a gt server Communications processors are modules for point to point connections and bus connections The configuration is the set up of individual modules of the PLC in the configuration table The specification of a connection ID in the system function block With the help of a connection ID the system function blocks can communicate between two communication points Communications Processor Module for communications tasks MODBUS TCP communication via the integrated PN interface of the CPU Glossary 1 2XV9450 1MB02 Manual edition 2 1 CPU CRC Cycle Time Cyclic Program Processing D Data Block DB Data Type Default Setting Diagnostic Buffer Diagnostic Event Diagnostic Functions Download F Function Block FB H Hardware MODBUS TCP communication via the integrated PN interface of the CPU Central processing unit of the S7 programmable logic controller with control and ar
25. arameterization of exceeded when executing a job the connection When RECV_TIME is exceeded the connection is terminated A101 The monitoring time of the TDISCON is exceeded Please contact the product support MODBUS TCP communication via the integrated PN interface of the CPU 7 11 2XV9450 1MB02 Manual edition 2 1 Diagnosis 7 4 Diagnosis Messages of Called Blocks Error messages of SFC 6 and SFC 20 at the output STATUS_MODBUS STATUS Remedy Hex 7XXX For detailed information please refer to the online help See online help SIMATIC of SIMATIC Manager manager gt mark block gt key F1 8XXX For detailed information please refer to the online help See online help SIMATIC of SIMATIC Manager manager gt mark block gt key F 1 Error messages of FB 63 FB 64 FB 65 and FB 66 at the output STATUS_CONN STATUS Remedy Hex 7XXX For detailed information please refer to the online help See online help SIMATIC of SIMATIC Manager manager gt mark block gt key F1 8XXX For detailed information please refer to the online help See online help SIMATIC of SIMATIC Manager manager gt mark block gt key F 1 7 5 Diagnosis Messages of SFC24 Error messages of SFC24 at the output STATUS MODBUS STATUS Remedy Hex 80A1 DB Number 0 or too large for the PLC Choose a valid DB number This error code is also reported when FB Use the same IDB for the call of MODBUSPN is called with different instance DBs
26. arameters and module parameters Parameterization means setting the behavior of a module The execution of a data interchange operation according to a specific protocol is called a procedure This is a special memory area in the PLC At the beginning of the cyclic program the signal states of the input modules are transferred to the process image input table At the end of the cyclic program the process image of the outputs is transferred to the output modules as output signals The communications partners involved in a data interchange must abide by fixed rules for handling and implementing the data traffic These rules are called protocols A rack is a rail containing slots for mounting modules A server is a device or in general terms an object that provides certain services A service is started at the instigation of a gt client Software is the term given to all programs used on a computer system These include the operating system and the user programs The operating mode START UP is active when the PLC transits from operating mode STOP to operating mode RUN STEP7 is the programming software of SIMATIC S7 A subnet is part of a gt network whose parameters must be matched The subnet includes bus components and all the attached stations Subnets can for example be connected together by gt gateways to form a network A system consists of several subnets with unique subnet numbers A subnet consists of several s
27. ation mode 7 is server the output parameters may only be evaluated when DONE_NDR is TRUE The output parameters are displayed dynamically i e they are only available for one PLC cycle They have to be copied to an additional memory area if you need to process them or to display the values in a VAT STEP7 variable table Range of Values For the range of values of the different parameters PLC specific restrictions must be taken into consideration MODBUS TCP communication via the integrated PN interface of the CPU 6 7 2XV9450 1MB02 Manual edition 2 1 DB_PARAM RECV_TIME CONN_TIME Function Block MODBUSPN To each connection between the PN PLC and a communication partner a connection ID is assigned When operating various connections an individual ID is required for each logical connection This connection ID is defined in the connection parameter block which is part of the parameter data block MODBUS_PARAM The connection ID unambiguously specifies the connection between the PLC and the communication partner The ID can be set to values between 1and 4095 The connection ID defined in the connection parameter block has to be entered here and must be unique within the PLC The parameter DB_PARAM assigns the number of the data block MODBUS_PARAM This parameter data block includes the connection parameters and the Modbus specific parameters which are necessary for the communication between the PN PLC and the Modbus device Th
28. bers printed in grey 6 13 Function Block MODBUSPN SIMATIC Modbus device DB 14 Coils from 00001 Input Register from 30001 Holding Register from 40001 MODBUS TCP communication via the integrated PN interface of the CPU 6 14 2XV9450 1MBO02 Manual edition 2 1 Function Block MODBUSPN 6 4 Data and Standard Functions used by the FB Instance DB Local Variables Parameter DB Timers Flags Standard FBs for Connection Handling Standard FBs for Data Transfer The function block MODBUS stores its data in an instance DB This instance DB is created by STEP7 when initially calling the FB The instance data block contains parameters of the types input output and input output as well as static variables required for its execution These variables are remanent and keep their validity between FB calls The variables control the internal process flow of the FB Required memory of the instance DBs Instance DB MODBUSPN work memory 830 Byte load memory 1852 Byte The FB requires 96 bytes of local variables Additionally MOD_CLI 110 Byte or MOD_SERV 84 Byte and TCP_COMM require 2 bytes local variables and TCON TDISCON TSEND or TRCV use up to 28 bytes depending on the used function block That is a total of max 236 bytes of local data for one FB MODBUSPN call The connection and Modbus specific parameters are stored in the parameter data block MODBUS_PARAM The FB doe
29. called blocks V Variable A variable is an operand e g E 1 0 which can have a symbolic name and can therefore also be addressed symbolically WwW Work Memory The work memory is a RAM on the PLC which the processor accesses while processing the user program MODBUS TCP communication via the integrated PN interface of the CPU Glossary 5 2XV9450 1MB02 Manual edition 2 1 Customer Support Siemens AG Industry Sector l IS IN E amp C Werner von Siemens Str 60 91052 Erlangen Tel 49 9131 7 46111 Fax 49 9131 7 44757 Mail it4 industry siemens com http www siemens com s7modbus Siemens Aktiengesellschaft Subject to change without prior notice MODBUS TCP communication via the integrated PN interface of the CPU 2XV9450 1MBO02 Manual edition 2 1 Stand 06 2009
30. cks are required for the Modbus communication e MODBUSPN e MOD CLI e MOD_SERV e TCP_COMM The blocks have to be copied from the library into your project Additionally the library contains the parameter data block MODBUS_ PARAM as a draft They can be inserted into your project for assistance purposes Modbus_PN_CPU E Program Files Siemens Step S 7LIBS Modbus PN CPU oj x Modbus_PN_CPU Object Symbolic name Cr Size Type V Name Header PN CPU S FB102 MODBUSPN SCL 6048 FunctionBlock 31 MODBUSPN READ IMPORTANT lt 5 F103 TCP_COMM SCL 1880 FunctionBlock 3 0 TCP_COMM arms g FB104 MOD_CLI SCL 11184 FunctionBlock 1 1 MOD_CLI g FB105 MOD_SERV SCL 10660 FunctionBlock 1 0 MOD_SERV D62 MODBUS_PARAM DB 686 Data Block 0 1 MODB_PAR TDB3 License DB DB 56 Data Block 0 1 The following blocks are required for the Modbus communication e TSEND FB63 e TRCV FB64 e TCON FB65 e TDISCON FB66 You can find these blocks in Standard Library gt Communication Blocks They have to be inserted into your project Please note that the following versions of the FBs are a prerequisite for the faultless function of the FB MODBUSPN TSEND V2 1 or higher TRCV V2 2 or higher TCON V2 3 or higher TDISCON V2 1 or higher Furthermore the block FC10 EQ_STRNG is necessary You can find this function in Standard Library gt IEC Function Blocks MODBUS TCP communication via
31. ction parameters of DB MODBUS_ PARAM With a parameter of the connection parameter block active_esi it is possible to define whether the PLC performs active or passive connection establishment During runtime the function TCON establishes the connection to the communication partner for both types of connections active and passive The point in time at which the connection is established is defined in DB MODBUS_PARAM parameter connect_at_startup The termination of the connection is defined with the parameter DISCONNECT of FB MODBUSPN Multiple A PN PLC can establish multiple connections to various communication Communication partners To ensure a proper operation and data transfer a strict division of Partners the different connections to the corresponding communication partners is inevitable Correspondingly there are the following requirements for each connection e one connection parameter block and the related Modbus parameter in DB MODBUS_PARAM e call of FB MODBUSPN in OB100 e call of FB MODBUSPN in OB121 e call of FB MODBUSPN in OB1 or cyclic interrupt OB In this case the calls of the FB MODBUSPN in the OB100 OB121 and in the OB1 receive the same instance DB for one connection A different instance DB is required for each additional connection MODBUS TCP communication via the integrated PN interface of the CPU 6 3 2XV9450 1MB02 Manual edition 2 1 Function Block MODBUSPN Initiate Request A rising edge at t
32. d as follows to declare the registration key REG_KEY 1 Copy the prepared license block DB3 of the library Modbus_PN_CPU into your project If the DB number is already used in your project rename the license DB 2 Open the license DB and copy the 17 digit registration key you received from IT4industry to the column Initial value i LAD STL FBD DB3 License DB Modbus_PN_CPU PN CPU DBa i lol x Eile Edit Insert PLC Debug View Options Window Help 18 x De SH Sk M o t ia S lon e ee ee e Press F1 to get Help offline labs lt 5 2 7 3 Declare the registration key in the data block as initial value to avoid a repeated insertion after reloading the PLC Open the data block in the SIMATIC manager with the editor in the declaration view Change over to the data view via the menu View gt Data View Choose in the menu Edit gt Initialize Data Block all values of the column initial value are copied to actual values 4 Assign the value DB3 REG_KEY to the parameter REG_KEY of the block MODBUSPN 5 Transfer the changed blocks to the PLC The registration key can be set at run time A STOP gt RUN transition is not necessary The block is now licensed for this CPU MODBUS TCP communication via the integrated PN interface of the CPU 5 3 2XV9450 1MB02 Manual edition 2 1 Missing or Wrong Licensing When the registration key is missing or
33. data subject to change We have checked the contents of this document with regard to its conformity with the described hardware and software Deviations however cannot be excluded Therefore we cannot guarantee its complete conformity The information in this document is checked Preface Preface Purpose of the The information in this manual allows you to set up and put in operation the Manual connection between a PLC with integrated PN interface and a device that supports the Open MODBUS TCP protocol Contents of the This manual describes the function of the Modbus function block and its Manual parameterization The manual contains the following topics e Production description e Getting Started e Commissioning e Parameterization e Licensing e Function block MODBUSPN e Diagnosis e Sample application Scope of this This manual is valid for the following software Manual Product Identification number From version OPEN MODBUS TCP 2XV9 450 1MB02 2 1 Note This manual contains the FB description valid at the time of publication Additional All additional information concerning PN PLCs and IM 151 8 PN DP CPU Sources of Startup commissioning etc can be found in the manuals Information SIEMENS SIMATIC S7 300 CPU 31xC and CPU 31x Installation Operating Instructions A5E00105491 07 MODBUS TCP communication via the integrated PN interface of the CPU 1 2XV9450 1MB02 Manual edition 2 1 Preface SIEMENS SIMATIC
34. data_type_4 i overlap A015 The parameterized areas data_type_1 and data_type_5 overlap A016 The parameterized areas data_type_1 and data_type_6 overlap A017 The parameterized areas data_type_1 and data_type_7 overlap A018 The parameterized areas data_type_1 and data_type_8 overlap A019 0 is assigned to one of the parameters db_x while the Correct the parameterization in according data_type_xis lt gt 0 DB MODBUS_PARAM DB 0 can t be used it is reserved for system functions Wrong length in the Modbus header 1 to 253 byte are Verify the data of the valid communication partner with the The connection is terminated help of a telegram trace A01F The FB MODBUSPN has turned to an invalid state Please contact the product support A023 The parameterized areas data_type_2and data_type_3 Correct the parameterization in overlap DB MODBUS_ PARAM A024 The parameterized areas data_type_2and data_type_4 The data areas must not overlap contain any overlapping A025 The parameterized areas data_type_2and data_type_5 peoisierarces overlap A026 The parameterized areas data_type_2and data_type_5 overlap A027 The parameterized areas data_type_2and data_type_5 overlap A028 The parameterized areas data_type_2and data_type_5 overlap A034 The parameterized areas data_type_3and data_type_4 overlap MODBUS TCP communication via the integrated PN interface of the CPU 7 8 2XV9450 1MB02 Manual edition 2 1 Diagnosis
35. ddress is available and has the necessary length The DB number must not be 0 or identical to the number of MODBUS_ PARAM or the instance DB In case of an error an exception telegram is sent MODBUS TCP communication via the integrated PN interface of the CPU 7 4 2XV9450 1MB02 Manual edition 2 1 Diagnosis Termination of the In special error situations the FB terminates the connection Connection in Case of Error e Monitoring time for connection establishment exceeded e Monitoring time for receive exceeded e Pl lt gt 0 e received TI different to sent TI e Length in the header does not match the length information in the telegram MODBUS TCP communication via the integrated PN interface of the CPU 7 5 2XV9450 1MB02 Manual edition 2 1 Diagnosis 7 3 Diagnosis Messages of the FB MODBUSPN Messages at the The block MOBUSPN has 3 status outputs STATUS MODBUS STATUS Outputs STATUS_CONN and STATUS_FUNC of the FB STATUS_MODBUS displays the error numbers regarding the processing of Modbus telegrams whereas STATUS_CONN displays the error numbers regarding the connection handling STATUS_FUNC shows the name of the function which caused the error STATUS is valid when ERROR is TRUE Below you can find a list of FB specific error messages Error Messages of The FBs MODBUSPN MOD_CLI and MOD_SERV use the standard the called SFCs functions SFC6 SFC20 SFC24 SFC51 und SFC52 The error messages of and FBs these blocks are passed on t
36. e MODBUS specific telegram header when receiving e Verification whether the memory areas requested by the client exist e Generation of exception telegrams when errors occur only when S7 is in server mode e Data transfer to and from the parameterized DB e Time monitoring of the data reception as well as connection establishment and termination e Verification of the registration key Online Help The SIMATIC Manager provides an online help for the function block MODBUSPN Mark the FB and press F1 so that he online help is displayed It contains the main information on the FB MODBUS TCP communication via the integrated PN interface of the CPU 6 1 2XV9450 1MB02 Manual edition 2 1 Call of the FB Start up of the FB Cyclical Operation of the FB OB121 Programming Error Function Block MODBUSPN For a correct program sequence the function block MODBUSPN has to be called in 3 organization blocks e OB100 Start Up e B121 Programming Error e Cyclic OB OB1 or cyclic interrupt OB e g OB35 The subordinate blocks of the Modbus library MOD_CLI MOD_SERV and TCP_COMM must not be called additionally in an organization block A coexistent call of FB MODBUSPN in OB1 and a cyclic interrupt OB e g OB35 is not permissible The Modbus block must be called in OB121 You will find more information regarding this matter in section 5 Licensing The function block MODBUSPN is unconditionally called once in OB100
37. e TI ensures a reliable operation of the FB Therefore we recommend increment the TI by 1 with any request This parameter defines whether a reading or writing function is to be carried out If the value of the input output is FALSE the reading mode is specified The value TRUE specifies the writing mode In the operating mode S7 is Client this is an input parameter In the operating mode S7 is Server this is an output parameter 6 3 Example of Address Mapping Interpretation of MODBUS Register Addresses The MODBUS data model is based on a series of storage areas with distinct properties Some systems e g MODICON PLCs distinguish these areas by the register or bit addresses The Holding Register with offset 0 for example is called 40001 memory type 4xxxx reference 0001 A potential source of confusion is the varying interpretation of the register address in different manuals Sometimes the register or bit address is defined as the address of the application layer and in other manuals it is the actually transferred address The FB MODBUSPN uses the register or bit address transferred for its parameters start_x end_x und START_ADDRESS Therefore it is possible to use register or bit addresses from von 0000 to FFFF for each function code MODBUS TCP communication via the integrated PN interface of the CPU 6 12 2XV9450 1MB02 Manual edition 2 1 Example Parameterization of the Memory Areas Address Mapping MOD
38. eeseeeeees 6 4 Data and Standard Functions used by the FB 44 6 5 Renaming Standard Functions 0 ccccsceeeseeeeeeeeeeeeeeees 7 DIAGNOSIS 22223 A AE AEEA T EAEE A AA 7 1 Diagnosis via the Display Elements of the PLC 7 2 Verification by the FB MODBUSPN ssssssssesessresenrrssrnrnes 7 3 Diagnosis Messages of the FB MODBUSPN 06 7 4 Diagnosis Messages of Called Blocks ccceceeeeeees 7 5 Diagnosis Messages Of SFO24 ieee 8 Sample Application c ccccsccsseceseeeeeseeeseeesesneeenseeeesseeseseeneeseeeeeas A LiteratUre onioni naa an Saas cca dot eased ar toes calc AAN A AREIAS MODBUS TCP communication via the integrated PN interface of the CPU 2XV9450 1MB02 Manual edition 2 1 Product description 1 Product Description 1 1 Field of Applications Placement in the System Environ ment Function of the FBs Use of Port Number 502 The function block described here is a software product for PLCs with integrated PN interface of Simatic S7 300 S7 400 and IM 151 8 PN DP CPU With these function blocks communication link is established between a Simatic PLC with integrated PN interface and a device that supports the Open MODBUS TCP protocol Data transmission is carried out in accordance with the client server principle The SIMATIC S7 can act as both a client and a server during the data transmission In general the protocol uses the port 502 This port
39. ess in the Ethernet to this physical address In this example a PLC 317 2 PN DP is inserted Procedure Before the configuration it is necessary to create a new S7 project with STEP7 1 Open HWConfig The PLC 317 2 PN DP is inserted in slot 2 and the properties dialog box of the PN IO interface X2 is mapped 2 Adouble click on line X2 opens the object properties dialog of Ind Ethernet MODBUS TCP communication via the integrated PN interface of the CPU 3 2 2XV9450 1MBO02 Manual edition 2 1 Commissioning 3 Enter the IP address and the subnet mask To establish a connection via a router enter the address of the router as well Properties Ethernet interface PN IO RO S2 2 x General Parameters IP adrese 192168 0 Gaga Subnet mask 255 255 255 0 Do not use router C Use router Address 192 168 0 1 New Properties Delete mo Cancel Help 4 Click on New to assign a name for a new Industrial Ethernet subnet Confirm your entries with OK Result You created a new Industrial Ethernet subnet 5 Click on the OK button Result The properties window of Ethernet interface X2 for PLC 317 2 PN DP closes MODBUS TCP communication via the integrated PN interface of the CPU 3 3 2XV9450 1MB02 Manual edition 2 1 Commissioning 3 3 Insertion of the Function Blocks into the Program Content of the MODBUS library Blocks of the Standard Library The following blo
40. he character string for identification IDENT_CODE Please contact the Product could not be determined Support A090 The block MODBUSPN is not licensed for this CPU Read the identification string IDENT_CODE for this CPU and order the registration key at IT4industry See also section 5 Licensing A091 An exception telegram with exception code 1 was The communication partner received only if CP is client does not support the requested function A092 An exception telegram with exception code 2 was Correct LENGTH or received only if CP is client START_ADDRESS atthe call An attempt to an invalid or non existing address at the of the FB communication partner was made A093 An exception telegram with exception code 3 was Check the error message of the received only if CP is client communication partner A094 An exception telegram with exception code 4 was Check the error message of the received only if CP is client communication partner A095 An exception telegram with an unknown exception code Check the error message of the was received only if CP is client communication partner and verify the data with a telegram trace if needed MODBUS TCP communication via the integrated PN interface of the CPU 7 10 2XV9450 1MB02 Manual edition 2 1 Diagnosis Error messages of FB MODBUSPN at the output STATUS_CONN STATUS Remedy Hex A100 The monitoring time CONN_TIME or RECV_TIME was Check the p
41. he sense of the security advices of this manual are any persons authorized to commission ground and label devices systems and electric circuits Please note Warning This device may only be used for applications as prescribed in the catalogue and the technical description Furthermore they may only be used in conjunction with third party devices and components recommended and authorized by Siemens A successful and safe operation of this product is depends on proper transport and correct storage installation and assembly as well as careful operation and maintenance SIMATIC and SIMATIC NET are registered trademarks of SIEMENS AG Since any other brand names in this manual may refer to trademarks the use of these names by third parties for their own purposes may infringe the rights of the owner Copyright Siemens AG 2008 All Rights Reserved Exclusion of Liability Passing on and reproducing this document as well as using and disclosing its contents is prohibited unless an explicit permission is given Offenders will be liable for damages All rights reserved especially in the case of patent grant or registration of a utility model or design Siemens AG Industry Sector Engineering and Construction l IS IN E amp C P O Box 3240 D 91050 Erlangen IT4 Industry siemens com regularly and necessary corrections are contained in subsequent versions We will be grateful for any suggestions for improvement Technical
42. he trigger input ENQ_ENR initiates a request Depending on S7 is Client the input parameters UNIT DATA_TYPE START_ADDRESS LENGTH TI and WRITE_READ a MODBUS request telegram is generated and sent to the partner station via the TCP IP connection The client waits for the parameterized monitoring time RECV_TIME for a response from the server When the monitoring time elapses no response from the server the activated request is terminated with an error A new request can be initiated After the receipt of the response telegram a validity check is carried out If the result is positive the necessary actions are taken and the request is terminated without error The output DONE_NDR is set When an error is recognized during verification the request is terminated with an error the ERROR bit is set and an error number is returned at the output STATUS Activation of the With the signal TRUE at the trigger input ENQ_ENR the FB is ready to Function Block receive a request telegram from the client The server remains passive and S7 is Server waits for a telegram from the client The received telegram is verified If the verification result is positive the response telegram is sent The completed transmission is reported to the user by setting the DONE_NDR bit At this point the completed function is indicated at the outputs UNIT DATA_TYPE START_ADDRESS LENGTH TI and WRITE_READ An erroneous request telegram causes an error message and the ER
43. in MODBUSPN in OB1 or cyclic OB1 or cyclic interrupt OB and OB100 interrupt OB and OB100 80B1 The DB does not exist in the PLC All data blocks that are specified in DB_x must be created and copied into the PLC 80B2 DB UNLINKED DB must not be created as UNLINKED MODBUS TCP communication via the integrated PN interface of the CPU 7 12 2XV9450 1MB02 Manual edition 2 1 Application Sample 8 Sample Application General The following simple programming example illustrates the use of Information FB MODBUSPN Please note the provided example project is meant for information purposes only It displays the handling of the Modbus blocks and is not to be understood as a solution for a customer specific installation configuration Example Project On the CD you can find an extensive example project which offers all varieties on the CD of parameterization possibilities for the Simatic stations e Simatic Station is S7 300 S7 400 or IM 151 8 PN DP CPU e Simatic Station is client or server Sample Program The programming example consists of the blocks e Start Up OB100 with call of FB102 e Programming error OB121 with call of FB102 e Cyclic program processing OB1 with call of FB102 e Global DBs for job trigger e g with variable table and for licensing e Data blocks for register and bit values Used Blocks The following blocks are used in the provided sample project for S7 stations with FB MODBUSPN OB1 CYCL_EXC cyclic p
44. ing STEP7 directories The manuals are also available as PDF files on CD STEP7 has to be installed Insert your Modbus CD into the CD ROM drive and follow step by step the instructions which are displayed automatically by the installation program If the installation program does not start automatically please proceed as follows 1 Inthe Windows Explorer navigate to the CD ROM drive Double click on the setup directory and then on Setup EXE to start the installation 2 Follow the step by step the instructions which are displayed by the installation program Now you can find e the library in Program Files Siemens Step7 S 7libs e the sample project in Program Files Siemens Step7 Examples e the manual in Program Files Siemens Step7 S7manual S7Comm e the software registration form in Program Files Siemens Step7 S7libs Modbus_ PN CPU To initially access the Modbus library use the browse function of the Open dialog for libraries The manual can be accessed via short cut under Program Files Siemens Documentation as well MODBUS TCP communication via the integrated PN interface of the CPU 3 1 2XV9450 1MB02 Manual edition 2 1 Commissioning 3 2 PLC Assigning the IP Address Introduction Each node on the Ethernet network is identified by an internationally unique address This so called MAC address is preset by the manufacturer and cannot be changed Following the steps below you can assign an IP addr
45. ing active FALSE CONN OUT BOOL Connection established TRUE no ESTABLISHED Connection terminated FALSE DONE_NDR OUT BOOL S7 is Client TRUE no TRUE Active request finished without FALSE errors S7 is Server TRUE Request from the client was executed and answered MODBUS TCP communication via the integrated PN interface of the CPU 6 5 2XV9450 1MB02 Manual edition 2 1 Function Block MODBUSPN ERROR OUT BOOL An error has occurred TRUE No error has occurred FALSE STATUS _ OUT WORD Error number for protocol errors when 0 to FFFF MODBUS evaluating a Modbus telegram STATUS _ OUT WORD Error number for connection errors during 0 to FFFF CONN execution of the T blocks TCON TSEND TRCV TDISON STATUS FUNC OUT STRING Name of the function which causes the Character 8 error at STATUS_ MODBUS or STATUS_ CONN IDENT _CODE STRING Identification for licensing Character 18 Please order your license with this identification string UNIT BYTE Unit identification 0 to 255 INPUT if in CLIENT mode OUTPUT if in B 16 0 to SERVER mode B 16 FF DATA_TYPE BYTE Data type to be accessed no INPUT if in CLIENT mode OUTPUT if in SERVER mode Coils Inputs Holding registers Input registers O C pur START_ WORD MODBUS start address 0 to 65535 ADDRESS INPUT if in CLIENT mode OUTPUT if in w 16 0000 to SERVER mode W 16 FFFF LENGTH WORD _ Number of values to be processed INPUT if in CLIENT mode OUTPUT if in SERVE
46. is parameter is declared in plain text DBxy The range of values for this parameter depends on the PLC 0 cannot be used as a DB number since it is reserved for system functions The parameter data block can contain a sequence of parameters for several connections It is also possible to use different parameter data blocks for multiple connections The monitoring time RECV_TIME observes the data input from the communication partner The shortest adjustable time is 20 ms In the operating mode S7 is client an indication RECV_TIME lt 20 ms causes an error message and the request is rejected When the time RECV_TIME elapses the active request is cancelled with an error In order to receive a Modbus telegram TRCV has to be called twice With each call of TRCV the RECV_TIME is triggered The monitoring time is started with the call of TRCV and stopped after the receipt of the telegram segment In the operating mode 7 is server an indication RECV_TIME lt 20 ms causes the use of the default time of 1 2s If the monitoring time elapses an error is reported The RECV_TIME monitors the duration of the TCP stream The interval between two requests is not taken into consideration The monitoring time CONN_TIME observes the connection establishment and the connection termination The shortest adjustable time is 100 ms When CONN_TIME elapses the corresponding error code is displayed at the output STATUS CONN In the operating mode S
47. istration key at IT4industry After start up of the PLC an 18 character string is displayed which can be read by means of a variable table You can find further information in section 5 Licensing In mode S7 is Client the parameter UNIT is an input parameter This input has to be set according to your requirements The FB copies this value to the request telegram and verifies when receiving the respond telegram In mode S7 is Server the parameter UNIT is an output parameter The FB copies this value from the request telegram to the respond telegram The output is set with the received value when the job is finished without an error MODBUS TCP communication via the integrated PN interface of the CPU 6 10 2XV9450 1MB02 Manual edition 2 1 Function Block MODBUSPN DATA_TYPE The parameter DATA_TYPE defines which Modbus data type is to be accessed with the current job The following data types are available Coils BHI 6 1 Inputs B 16 2 Holding Register B 16 3 Input Register B 16 4 In the operating mode S7 is Client DATA_TYPE is an input parameter In the operating mode S7 is Server DATA_TYPE is an output parameter The different data types are related directly to the used function codes a write code Cois o read any irrelevant irrelevant 1 e e rong Regier o we 1 mue 6 START_ADDRESS The parameter START_ADDRESS specifies the first MODBUS address that is read or written In the operati
48. ithmetic unit memory operating system and interfaces to I O modules Cyclic Redundancy Check Checksum which guarantees a high probability of error recognition The cycle time is the time the PLC needs to execute the user program once In cyclic program processing the user program is executed in a constantly repeating program loop called a cycle These are blocks containing data and parameters with which the user program works Unlike all other blocks data blocks do not contain instructions They are subdivided into global data blocks and instance data blocks The data held in the data blocks can be accessed absolutely or symbolically Complex data can be stored in structured form Data types allow users to define how the value of a variable or constant is to be used in the user program They are classified into elementary and structured data types The default setting is a basic setting which is always used if no other value is specified Every PLC has a diagnostic buffer in which detailed information on diagnostic events are stored in the order in which they occur Diagnostic events are for example errors on a module or system errors in the PLC which are caused by say a program error or by operating mode transitions The diagnostics functions cover the entire system diagnosis and include detection analysis and reporting of errors within the automation system Downloading means loading objects e g code blocks fr
49. l_tsap_id 1 high byte of the local port number in hexadecimal local_tsap_id 2 low byte of the local port number in hexadecimal local_tsap_id 3 16 B 16 00 rem_subnet_id This parameter is currently not used Please assign the value B 16 0 rem_staddr In this array of bytes the IP address of the remote communication partner is defined When an unspecified connection is used no IP address has to be entered The representation depends on the parameter connection_type Example IP address 192 168 0 1 With connection type BH16 01 rem_staddr 1 B 16 01 1 rem_staddr 2 B 16 00 0 rem_staddr 3 B 16 A8 168 rem_staddr 4 B 16 CO 192 rem_staddr 5 6 B 16 00 reserved With connection type BH16 11 rem_staddr 1 B 16 CO 192 rem_staddr 2 B 16 A8 168 rem_staddr 3 B 16 00 0 rem_staddr 4 B 16 01 1 rem_staddr 5 6 B 16 00 reserved rem_tsap_id This parameter defines the remote port number The representation depends on the parameter connection_type The value range depends on the PLC With connection type BH16 01 local_tsap_id 1 low byte of the remote port number in hexadecimal local_tsap_id 2 high byte of the remote port number in hexadecimal local_tsap_id 3 16 B 16 00 With connection type B 16 11 local_tsap_id 1 high byte of the remote port number in hexadecimal local_tsap_id 2 low byte of the remote port number in hexadecimal local_tsap_id 3 16 B 16 00 next_staddr This parameter defines
50. mmunication via the integrated PN interface of the CPU 1 2 2XV9450 1MB02 Manual edition 2 1 Getting started 2 Getting Started Procedure Install OpenModbusTCP PN CPU and insert the Modbus function blocks into your SIMATIC project gt Section 3 1 to 3 3 Parameterize the connection parameters regarding your requirements IP address port number etc gt Section 4 1 and 4 2 Parameterize the Parameter DBs MODBUS_PARAM regarding your requirements client server connect at start up register numbers DB numbers etc gt Section 4 1 and 4 2 Call the Modbus block FB102 in the required OBs gt Section 6 1 Parameterize the Modbus block for initialization and runtime gt Section 6 2 Load the user program into the PLC and license the Modbus block for this CPU gt Section 5 MODBUS TCP communication via the integrated PN interface of the CPU 2 1 2XV9450 1MB02 Manual edition 2 1 Commissioning 3 Commissioning General Information Requirements 3 1 Installing the What We Provide Requirements Installation The information below on STEP7 refers to Version 5 4 SP4 In later versions the sequences names and directories might be different Knowledge of AWL and basic knowledge of STEP7 and PLC is required Library on the STEP7 PG PC The attached CD contains a setup which installs the library Modbus_PN_CPU the sample projects and the manuals in English and German in the correspond
51. mon transmission medium shared with other stations Modules are pluggable printed circuit boards for programmable logic controllers Module parameters are used to set the module behaviors A distinction is made between static and dynamic module parameters Configuration software for configuration and diagnostic functions on an Ethernet CP Online means that a data connection exists between PLC and programming device Offline means that no such data connection exists STEPZ7 allows you to display contextual help texts on the screen while working with the programming software An operand is part of a STEP7 instruction and states with what the processor is to do something It can be both absolutely and symbolically addressed The SIMATIC S7 programmable controllers have three different operating modes STOP START UP and RUN The functionality of the PLCs varies in the individual operating modes The operating system of the PLC organizes all functions and operations of the PLC which are not connected to a specific control task MODBUS TCP communication via the integrated PN interface of the CPU Glossary 3 2XV9450 1MB02 Manual edition 2 1 P Parameter Parameterization Procedure Process image Protocol Rack S Server Software START UP STEP7 Subnet System Block System Function SFC System Function Block SFB Parameters are values that can be assigned A distinction is made between block p
52. n and error codes with regard to the processing of the T functions The output STATUS_FUNC shows the name of the function which caused the error at STATUS MODBUS or STATUS_ CONN When reading the STATUS outputs you are provided with a general indication of errors that occurred during the telegram processing and connection handling The STATUS parameters can be evaluated in the user program MODBUS TCP communication via the integrated PN interface of the CPU 7 1 2XV9450 1MB02 Manual edition 2 1 Diagnosis 7 1 Diagnosis via the Display Elements of the PLC Display Functions The display elements of the PLC provide information on the status of the component There are two types of display functions Group Error Displays PN CPU 300 SF Group error When this LED is flashing the Modbus block has not been licensed yet You can find further information in section 5 Licensing PN CPU 400 INTF Internal error When this LED is flashing the Modbus block has not been licensed yet You can find further information in section 5 Licensing Special Displays PN CPU 300 PN CPU 400 and IM 151 8 PN DP CPU RX TX a telegram is transferred via the integrated interface A detailed description of the display elements can be found in the device manual of the PLC MODBUS TCP communication via the integrated PN interface of the CPU 7 2 2XV9450 1MB02 Manual edition 2 1 Diagnosis 7 2 Verification by the FB MODBUSPN
53. ng mode S7 is Client this is an input parameter In the operating mode S7 is Server this is an output parameter LENGTH The parameter LENGTH specifies the number of MODBUS values that are read or written In the operating mode S7 is Client this is an input parameter In the operating mode S7 is Server this is an output parameter With a reading function a maximum of 125 registers or 2000 bits is possible per telegram With a writing function a maximum of 100 registers or 800 bits is possible For each telegram all registers or bits have to be in the same DB MODBUS TCP communication via the integrated PN interface of the CPU 6 11 2XV9450 1MB02 Manual edition 2 1 Tl WRITE_READ Function Block MODBUSPN The parameter TI Transaction Identifier is copied by the server from the request telegram to the respond telegram according to the MODBUS specification In the operating mode S7 is Client this is an input parameter The FB copies this value to the request telegram and verifies it when receiving the respond telegram In the operating mode S7 is Server this is an output parameter The FB copies this value from the request telegram into the respond telegram The Transaction Identifier is used for the identification of telegrams and the unambiguous allocation of the requests to the corresponding responds The FB MODBUSPN can only perform this function properly if the TI is changed with each transaction Only a change of th
54. o STATUS_ MODBUS without any changes The block TCP_COMM called by MOD_CLI or MOD_SERV uses the standard blocks SFB4 FB63 FB64 FB65 and FB66 The error messages of these blocks are passed on to STATUS_CONN without any changes For further details on the error messages please consult the diagnosis buffer or the online help of the SIMATIC Manager Error messages of FB MODBUSPN at the output STATUS _MODBUS STATUS Remedy Hex A001 The parameter data block MODBUS_PARAM is too Correct the length of short MODBUS_PARAM A002 The parameter end x is less than start_x Correct the parameterization in DB MODBUS _ PARAM A003 The DB to which MODBUS addresses shall be mapped Extend the DB is too short S7 is Client Correct the Minimum length parameters START_ADDRESS register values end x start_x 1 2 or LENGTH bit values end x start_x 7 8 S7 is Server Other possible reasons Modify the request of the client e Wrong initialization parameter S7 is client e Wrong address area in the request telegram of the client S7 is server A004 Applies only if S7 is client Correct the parameters Only An invalid combination of DATA_TYPE and data type 1 or 3 can be written WRITE_READ is given MODBUS TCP communication via the integrated PN interface of the CPU 7 6 2XV9450 1MB02 Manual edition 2 1 Diagnosis Error messages of FB MODBUS MODBUSPN at the output STATUS_MODBUS STATUS Remedy Hex A005 S7 is
55. of FB TCP_COMM or the called function blocks MOD_ CLI MOD_SERV und TCP_COMM It is not possible to rename the system functions SFC6 SFC20 SFC24 SFC51 SFC52 and SFB4 To rename the blocks proceed as described subsequently 1 Change the numbers of the function blocks in the desired numbers in your program in SIMATIC Manager 2 Add the modifications in the symbolism table supplementary A modification of the FB numbers via Extras gt Re wire is not necessary MODBUS TCP communication via the integrated PN interface of the CPU 6 16 2XV9450 1MB02 Manual edition 2 1 Diagnosis 7 Diagnosis Diagnostic Function Display Elements LED STATUS Outputs of the FB MODBUSPN The diagnostic functions of the PN PLC enable a fast localization of errors The following diagnostic features are available e Diagnosis via the display elements of the PLC e Diagnosis via the STATUS MODBUS and STATUS_CONN output of the MODBUSPN function block The display elements inform you about the operating mode or about the error conditions of the PLC The display elements provide an overview of internal errors external errors and interface specific errors For an error diagnosis the MODBUSPN function block has 3 STATUS outputs When reading the STATUS_MODBUS output you are provided with a general indication of errors that occurred during the Modbus specific telegram processing The STATUS_CONN output displays status informatio
56. om the programming device into the load memory of the PLC Function blocks are components of the user program and in accordance with the IEC standard are blocks with memory The memory for the function block is an assigned data block a so called instance data block Function blocks can be parameterized but can also be used without parameters Hardware is the term given to all the physical and technical equipment of a PLC Glossary 2 2XV9450 1MB02 Manual edition 2 1 l Industrial Ethernet Instance Data Block Interface Module Interrupt MAC Address Media Access Control MAC Module Module Parameters N NCM S7 for Industrial Ethernet O Online Offline Online Help Operand Operating Mode Operating System of the PLC A LAN system complying with IEEE 802 3 ISO 8802 2 An instance data block is a block assigned to a function block and contains data for this special function block On the interface module the physical conversion of signals takes place By exchanging the pluggable interface module you can adapt the communications processor to the physical interface of the communications partner Interrupt is a name for a break of the program processing in the processor of an automation system by an external alarm Address to distinguish between different stations connected to a common transmission medium Industrial Ethernet Mechanisms for controlling access by a station to a com
57. on 2 1 start_x end_x internal_send_ buffer internal_recv_ buffer Parameterisation of the Modbus Communication Start_x specifies the first register or bit address which is stored in the data element 0 of the DB End_x defines the of the last MODBUS address When accessing registers the number of the data element of the S7 DB in which the last register is mapped can be calculated with the following formula DBW number end_x start_x 2 When accessing coils or inputs the number of the data element of the S7 DB in which the last bit is mapped can be calculated with the following formula DBB number end_x start_x 7 8 The defined memory areas must not overlap The parameter end_x must not be smaller than start_x In case of an error occurring the initialization of the FB is stopped with an error When start_x is equal to end_x one Modbus address 1 register or 1 bit is allocated In section 6 3 you can find an example of the mapping of the MODBUS addresses to S7 memory areas start x end x MODBUS address 0 to 65535 W 16 0000 to W 16 FFFF This array is used internally for message data within the FB Accessing or changing the array is inadmissible This array is used internally for the received data within the FB Accessing or changing the array is inadmissible MODBUS TCP communication via the integrated PN interface of the CPU 4 8 2XV9450 1MB02 Manual edition 2 1 5 Licensing General
58. on via the integrated PN interface of the CPU 7 3 2XV9450 1MB02 Manual edition 2 1 Diagnosis Verification in the response telegram Received transaction identifier is equal to the sent one Protocol identifier 0 Length is between 3 and 253 Additionally the length in the header of the response telegram is checked for plausibility regarding the request Sent UNIT is equal to the received one Sent FC is equal to the received one Response is an exception code telegram For write requests the start address and number of registers bits have to match with the request telegram FC 5 or FC6 Echo in the respond is equal to the request Cyclical Operation e Receipt of the second part of the request telegram within the S7 is Server monitoring time The monitoring time can also elapse if less data than specified in the MODBUS telegram header is received Subsequent errors with loss of telegrams can occur e Protocol Identifier 0 e Length between 6 and 207 e Received function code is verified If the function code is not equal to 1 2 3 4 5 6 15 or 16 an exception telegram is sent e For write requests the length in the header the number of registers or bits and the byte count in the telegram must match e The number of registers or bits is verified If the number is too large an exception telegram is sent e During the execution of a request there is also a check whether the data block specified by the register or bit a
59. rack and slot of the corresponding CP When using the integrated PN interface of the PLC assign 0 to this parameter next_staddr 1 6 B 16 00 spare Reserved assign 0 to this parameter MODBUS TCP communication via the integrated PN interface of the CPU 4 5 2XV9450 1MB02 Manual edition 2 1 Adaption of the Modbus Parameters server_client single_write Parameterisation of the Modbus Communication The Modbus parameters in the block MODBUS_PARAM define the mode of operation of the Modbus communication and the address reference of Modbus addresses and SIMATIC addresses ee oe ee END_STRUCT 112 114 116 TELS 120 122 124 126 128 130 mae 390 ALE 650 650 64 0 server_client BOOL TRUE 0 o o o 0 o 0 o o o o 0 0 0 o TRUE S7 is server FALSE S7 is client In operating mode S7 is client and single _write TRUE write requests with length 1 are carried out with the function codes 5 and 6 With single_write FALSE all write requests use the function codes 15 and 16 MODBUS TCP communication via the integrated PN interface of the CPU 2XV9450 1MB02 Manual edition 2 1 4 6 Parameterisation of the Modbus Communication connect_at_ This parameter defines the point in time at which the connection is being Startup established FALSE establish connection when ENQ_ENR TRUE TRUE establish connection immediate after PLC start up When connec
60. ribes the length of the connection parameters and must not be changed Fixed value W 16 40 calls of the T blocks TCON TSEND TRCV and TDISCON Value range W 16 1 to W 16 FFF MODBUS TCP communication via the integrated PN interface of the CPU 4 3 2XV9450 1MB02 Manual edition 2 1 connection_type active_est local_device_id local_tsap_id_len rem_subnet_id_ len rem_staddr_len rem_tsap_id_len next_staddr_len Parameterisation of the Modbus Communication The structure of the connection is defined here It is used by the function TCON when establishing the connection The value depends on the PLC TCP compatibility mode B 16 01 with CPU315 and 317 lt FW V2 3 TCP B 16 11 with CPU315 and 317 gt FW V2 4 IM 151 8 PN DP CPU CPU 319 CPU 414 and CPU416 The values vary depending on the used firmware You can find further information on the internet http support automation siemens com WW view en 24294554 This parameter defines the way the connection is established active or passive It is recommended that the Modbus client performs an active connection establishment while the Modbus server establishes passive connections Active connection establishment TRUE Passive connection establishment FALSE The local_device_id defines the IE interface of the used PN PLC The following values are necessary with the different PLC types IM 151 8 PN DP CPU B 16 1 CPU315 or 317 B 16 2 CPU319 B 16 3 CP
61. rogram processing OB 100 COMPLETE start up OB for restart RESTART ros 121 PROG ERA progammingerorOB CS 081 CONTROL_DAT work DB CONTROL DAT or FB MODBUSPN DB 2 MODBUS PARAM parameter DB PARAW_DB tor FB MODBUSPN DBS License oB license data book for FBMODBUSPN foes oara AREA vave Deira SSCS p12 ata anea 2 vave De toraa SSCS oes Data ancas vave De torareas SCS oe15 pata aneas vaveDStoreeas MODBUS TCP communication via the integrated PN interface of the CPU 8 1 2XV9450 1MB02 Manual edition 2 1 A Literature MODBUS IDA MODBUS APPLICATION PROTOCOL SPECIFICATION V1 1b December 28 2006 http www modbus IDA org MODBUS TCP communication via the integrated PN interface of the CPU Appendix 1 2XV9450 1MBO02 Manual edition 2 1 Glossary A Address Automation System B Baud Rate Block Call Block Parameter Blocks Bus Segment C Client Communications Processor Configuration Connection Parameterization CP The address identifies a physical storage location If the address is known the operand stored there can be directly accessed An automation system is a programmable logic controller that contains at least a PLC different input and output devices as well as HMI devices gt transmission rate A block call occurs when program processing branches to the called block Block parameters are variables within multiple use blocks which are repl
62. s document uses the term PN PLC The descriptions apply to PN PLCs of series 315 317 319 414 and 416 as well as IM 151 8 PN DP CPU The function block described in this manual establishes a connection between a PN PLC and third party MODBUS devices 2XV9450 1MB02 Manual edition 2 1 Table of contents Table of Contents 1 Product DeSCIiptiOn ccsecccceeeeeceeeeeneeeeeeeneeeeeeneeseeenneeseeeeneeseeeenees 1 1 Field of Applications ccccecceeseeeeeeeeeeeeeeeseeeeesnaeeeseeeeeaas 1 2 Hardware and Software PrerequiSites c ceceeeeeee 2 Getting Started ccceceeeeeseeeeeseeeeeeseeeseeeseseaeenseeeenseeesseseseeeseseeeneas 3 COMMISSIONING lt ses2 0c2eccce2esezs sone sescceteeba cctcesciceesiecs cecceesseersenecercccestece 3 1 Installing the Library on the STEP7 PG PC nsee 3 2 PLC Assigning the IP Address csceeeeeteeeteeeeteeees 3 3 Insertion of the Function Blocks into the Program 4 Parameterization of the Modbus Communication 4 1 Parameterization with the Wizard 4 2 Editing the Parameterization ecccceeeeeeeeeeeeeeeeeeeeeeees 5 LICONSING scassi naa a aS E a IRA ia 6 Function Block MODBUSPN ssssssssussnuunnuunnunnnunnnnnnnnnnnnnnnnnnnnnnnnnnnna 6 1 Functionality of the FB cc ccceseeeeseeeeeeeeeeeeeeeeaeeeeneeeeees 6 2 Parameters of the Function Block MODBUSPN 6 3 Example of Address Mapping ccscceeeeeeeestee
63. s not use any timers The function block does not use any flags The function block TCP_COMM called by MODBUSPN uses the blocks TCON and TDISCON of the standard library to establish and terminate the connection between the PLC and the communication partner The function block TCP_COMM called by MODBUSPN uses the blocks TSEND and TRCV of the standard library for the data transfer between the PLC and the communication partner MODBUSPN The FB MODBUSPN uses the following SFCs from the standard library SFCs for Miscellaneous e FC10 EQ STRING Functions e SFC6 RD_SINFO e SFC20 BLKMOV e SFC24 TEST_DB e SFC51 RDSYST e SFC52 WR_USMSG MODBUS TCP communication via the integrated PN interface of the CPU 6 15 2XV9450 1MB02 Manual edition 2 1 MOD_CLI and MOD_SERV SFCs for Miscellaneous Functions TCP_COMM SFCs for Miscellaneous Functions Function Block MODBUSPN The FBs MOD_CLI and MOD_SERV use the following SFCs from the standard library e SFC20 BLKMOV e SFC24 TEST_DB The FB TCP_COMM uses the following SFB from the standard library in addition to the T blocks e SFB4_ TON 6 5 Renaming Standard Functions Inducement Renaming If the numbers of the standard functions are already assigned within your project or if the number interval is reserved for a different application it is possible to rename the internally called function blocks FB63 FB64 FB65 and FB66
64. t_at_startup TRUE the first request should be started after the connection was established CONN_ESTABLISHED TRUE or an error has been reported respectively ERROR TRUE 8 Data Areas 8 data areas are available to map the Modbus addresses in the S7 storage At least the first data area has to be defined The other 7 data areas are optional Depending on the type of request these memory areas are read or written With one request only one DB can be accessed Even if consecutive register numbers or coils are located in two different DBs two requests are necessary to access them both This has to be taken into account during the parameterization It is possible to map more Modbus values registers or coils in one data block than could be processed with one telegram data_type_x The parameter data_type_x defines the MODBUS data type which is to be mapped with this definition If data_type_x set to 0 this data area is not used Identifier Data type Size 0 Area not used 1 Coils Bit 2 Inputs Bit 3 Holding Register Word 4 Input Register Word db_x The parameter db_x defines the number of the data block in which the consecutively defined MODBUS registers or bits are mapped 0 cannot be used as DB number since it is reserved for system functions db x DB Number 1 65535 W 16 0001 to W 16 F FFF MODBUS TCP communication via the integrated PN interface of the CPU 4 7 2XV9450 1MB02 Manual editi
65. tations with unique gt MAC addresses System blocks differ from the other blocks in that they are already integrated into the S7 400 system and are available for already defined system functions They are classified into system data blocks system functions and system function blocks System functions are software modules without memory which are already integrated into the operating system of the S7 PLC and can be called by the user as required System function blocks are software modules with memory which are already integrated into the operating system of the S7 PLC and can be called up by the user as required MODBUS TCP communication via the integrated PN interface of the CPU Glossary 4 2XV9450 1MB02 Manual edition 2 1 T Tool Transmission Rate U Upload User Program A tool is a piece of software that is capable of accessing operating system functions in a programming device According to DIN 44302 this is the number of binary decisions transmitted per time unit The unit is bps he set or selected transmission rate depends on various conditions for example the distance across Uploading means loading objects e g code blocks from the load memory of the PLC into the programming device The user program contains all instructions and declarations for signal processing by means of which a system or a process can be controlled The user program for SIMATIC S7 is structured and is divided into smaller units
66. the integrated PN interface of the CPU 3 4 2XV9450 1MB02 Manual edition 2 1 Parameterisation of the Modbus Communication 4 Parameterization of the Modbus Communication General Information Connection Description DB MODBUS PARAM For the communication via the integrated PN interface of the PLC a network configuration in NetPro is not necessary The connections are established and terminated by means of the function blocks TCON FB65 und TDISCON FB66 Several connections to different communication partners can be parameterized and established at the same time The maximal number of coexistent connections depends on the PLC The parameters to establish a connection and to execute the Modbus communication are defined as a structure in a parameter DB called MODBUS_PARAM At first the connection parameters are defined subsequently the Modbus parameters are defined For each logical connection a separate structure is required This structure contains the connection parameters of both communication partners and the Modbus parameters For each additional connection the parameter data block must be expanded by or a new data block created with the structure for connection parameters and the Modbus parameters The parameter data block can contain parameter information of all defined connections It is also possible to use a separate parameter data block for each connection A prepared structure is part of the library MODBUS_PN_CPU

Download Pdf Manuals

Related Search

Related Contents

Livret personnel de compétences (LPC)  Dale Tiffany TW12324 Installation Guide  OPT-103-81/82/83/85/86  Whirlpool FSP DU9000XR-4 User's Manual  Manual del usuario  01 hdt liquido para frenos lf3 _dot-3  Référentiel Construction des Structures Artificielles d`Escalade  OPERATOR`S MANUAL  ASUS (ME176CX) User's Manual  製品仕様書 - プライム・スター株式会社  

Copyright © All rights reserved. Failed to retrieve file