SIMATIC

S7 - OPEN MODBUS / TCP Communication

via the integrated PN interface of the PLC

Manual
 Preface, Table of Contents

Product Description 1

Getting Started 2
SIMATIC S7
Commissioning 3
S7 OPEN MODBUS / TCP Parameterization 4
Communication via the
integrated PN interface of the PLC Licensing 5

FB MODBUSPN 6
Manual
Diagnosis 7

Sample Application 8

Appendices

Literature

Glossary

Edition 2.1
Safety Precautions and This manual contains warnings, which you should note for your own safety as well as for
Warnings the prevention of damage to property. These warnings are indicated by means of a warning
triangle and are displayed as follows in accordance with the level of danger:
__________________________________________________________________
Danger
indicates that loss of life, severe personal injury or substantial damage
will result if proper precautions are not taken.
__________________________________________________________________
__________________________________________________________________
Warning
indicates that loss of life, severe personal injury or substantial damage can result if proper
precautions are not taken.
__________________________________________________________________
__________________________________________________________________
Caution
indicates that minor personal injury or property damage can result if proper precautions are
not taken.
__________________________________________________________________
__________________________________________________________________
Note
represents an important information especially significant to the product, handling of the
product or a specific part of this documentation.
__________________________________________________________________

Qualified The start-up and the operation of the device may only be carried out by qualified
Personnel personnel. Qualified personnel in the sense of the security advices of this manual are any
persons authorized to commission, ground and label devices, systems and electric circuits.

Use as prescribed Please note:

_________________________________________________________________________
Warning
This device may only be used for applications as prescribed in the catalogue and the
technical description. Furthermore, they may only be used in conjunction with third-party
devices and components recommended and authorized by Siemens.

A successful and safe operation of this product is depends on proper transport, and correct
storage, installation and assembly as well as careful operation and maintenance.

SIMATIC and SIMATIC NET are registered trademarks of SIEMENS AG.

Trademarks Since any other brand names in this manual may refer to trademarks, the use of these
names by third parties for their own purposes may infringe the rights of the owner.

Copyright Siemens AG 2008 All Rights Reserved Exclusion of Liability

Passing on and reproducing this document as well as using and We have checked the contents of this document with regard to its
disclosing its contents is prohibited unless an explicit permission is conformity with the described hardware and software. Deviations,
given. Offenders will be liable for damages. All rights reserved, however, cannot be excluded. Therefore, we cannot guarantee its
especially in the case of patent grant or registration of a utility model complete conformity. The information in this document is checked
or design. regularly and necessary corrections are contained in subsequent
versions. We will be grateful for any suggestions for improvement.
Siemens AG
Industry Sector Technical data subject to change.
Engineering and Construction
I IS IN E&C
P.O. Box 3240, D- 91050 Erlangen
[email protected]
 Preface

Preface

Purpose of the The information in this manual allows you to set up and put in operation the
Manual connection between a PLC with integrated PN interface and a device that
supports the Open MODBUS/TCP protocol.

Contents of the This manual describes the function of the Modbus function block and its
Manual parameterization.
The manual contains the following topics:
Production description
Getting Started
Commissioning
Parameterization
Licensing
Function block MODBUSPN
Diagnosis
Sample application

Scope of this This manual is valid for the following software:

Manual
Product Identification number From version
OPEN MODBUS/TCP 2XV9 450-1MB02 2.1
FB 102 MODBUSPN 3.1
FB 103 TCP_COMM 3.0
FB 104 MOD_CLI 1.1
FB 105 MOD_SERV 1.0

Note

This manual contains the FB description valid at the time of publication.

Additional All additional information concerning PN PLCs and IM 151-8 PN/DP CPU
Sources of (Startup, commissioning etc.) can be found in the manuals
Information
SIEMENS
SIMATIC S7-300
CPU 31xC and CPU 31x: Installation
Operating Instructions
A5E00105491-07

MODBUS / TCP communication via the integrated PN interface of the CPU 1

2XV9450-1MB02; Manual edition 2.1
 Preface

SIEMENS
SIMATIC S7-300
CPU 31xC and CPU 31x, Technical Specifications
Manual
A5E00105474-07

SIEMENS
SIMATIC S7-400
Automation System S7-400 Hardware and Installation
Operating Instructions
A5E00850740-01

SIEMENS
SIMATIC S7-400
S7-400 Automation System, CPU Specifications
Manual
A5E00850746-06

SIEMENS
SIMATIC
Distributed I/Os ET 200S
Interface Module IM151-8 PN/DP CPU
Manual
A5E02049033-01

SIEMENS
Product Information on
CPU315-2 PN/DP, 6ES7315-2EH13-0AB0
CPU315F-2 PN/DP, 6ES7315-2FH13-0AB0
CPU317-2 PN/DP, 6ES7317-2EK13-0AB0
CPU317F-2 PN/DP, 6ES7317-2FK13-0AB0
CPU317-2 DP, 6ES7317-2AJ10-0AB0
CPU317F-2 DP, 6ES7317-6FF03-0AB0
CPU319-3 PN/DP, 6ES7318-3EL00-0AB0
CPU319F-3 PN/DP, 6ES7318-3FL00-0AB0
A5E01103134-03

Additional information concerning STEP7 can be found in the following

manuals:

SIEMENS
SIMATIC Software
Base software for S7 and M7
STEP7 user manual
C79000-G7000-C502-..

SIEMENS
SIMATIC Software
System software for S7-300/400
System and standard functions
Reference manual C79000-G7000-C503-02

MODBUS / TCP communication via the integrated PN interface of the CPU 2

2XV9450-1MB02; Manual edition 2.1
 Preface

Additional For further questions regarding the use of the FBs described in this manual,
Questions please contact your Siemens partner who provided you with this function
block.

Terminology This document uses the term PN PLC. The descriptions apply to PN PLCs
of series 315, 317, 319, 414 and 416 as well as IM 151-8 PN/DP CPU.

Scope of The function block described in this manual establishes a connection

Application between a PN PLC and third-party MODBUS devices.

MODBUS / TCP communication via the integrated PN interface of the CPU 3

2XV9450-1MB02; Manual edition 2.1
 Table of contents

Table of Contents

1 Product Description....................................................................................................... 1-1

1.1 Field of Applications.......................................................................................... 1-1

1.2 Hardware and Software Prerequisites.............................................................. 1-1

2 Getting Started ............................................................................................................... 2-1

3 Commissioning .............................................................................................................. 3-1

3.1 Installing the Library on the STEP7 PG/-PC .................................................... 3-1

3.2 PLC Assigning the IP Address ...................................................................... 3-2

3.3 Insertion of the Function Blocks into the Program............................................ 3-4

4 Parameterization of the Modbus Communication ...................................................... 4-1

4.1 Parameterization with the Wizard..................................................................... 4-2

4.2 Editing the Parameterization ............................................................................ 4-3

5 Licensing ........................................................................................................................ 5-1

6 Function Block MODBUSPN ......................................................................................... 6-1

6.1 Functionality of the FB ...................................................................................... 6-1

6.2 Parameters of the Function Block MODBUSPN .............................................. 6-5

6.3 Example of Address Mapping......................................................................... 6-12

6.4 Data and Standard Functions used by the FB ............................................... 6-15

6.5 Renaming Standard Functions ....................................................................... 6-16

7 Diagnosis ........................................................................................................................ 7-1

7.1 Diagnosis via the Display Elements of the PLC ............................................... 7-2

7.2 Verification by the FB MODBUSPN.................................................................. 7-3

7.3 Diagnosis Messages of the FB MODBUSPN................................................... 7-6

7.4 Diagnosis Messages of Called Blocks ........................................................... 7-12

7.5 Diagnosis Messages of SFC24 ...................................................................... 7-12

8 Sample Application........................................................................................................ 8-1

A Literature............................................................................................................................ 1

MODBUS / TCP communication via the integrated PN interface of the CPU i

2XV9450-1MB02; Manual edition 2.1
 Product description

1 Product Description

1.1 Field of Applications

Placement in the The function block described here is a software product for PLCs with
System Environ- integrated PN interface of Simatic S7-300, S7-400 and IM 151-8 PN/DP CPU.
ment

Function of the With these function blocks, communication link is established between a
FBs Simatic PLC with integrated PN interface and a device that supports the Open
MODBUS/TCP protocol.

Data transmission is carried out in accordance with the client-server principle.

The SIMATIC S7 can act as both, a client and a server, during the data
transmission.

Use of Port In general, the protocol uses the port 502. This port number has not been
Number 502 released for all PN PLCs yet and is only possible when using a 319 CPU, an
IM 151-8 PN/DP CPU, a 414 CPU or a 416 CPU with the corresponding
firmware version. You can find further information about the released port
numbers in the relevant manual of your PLC.

The PLC only allows a one-time use of a specific port number. Therefore
the PLC/FB cannot be addressed simultaneous from different devices on the
same port number.

1.2 Hardware and Software Prerequisites

Usable Modules The function blocks have been tested on the PLCs with the product
identifications

CPU315-2 PN/DP 6ES7315-2EG10-0AB0

CPU317-2 PN/DP 6ES7317-2EK13-0AB0
CPU319-3 PN/DP 6ES7318-3EL00-0AB0
CPU414-3 PN/DP 6ES7414-3EM05-0AB0
CPU416-3 PN/DP 6ES7416-3FR05-0AB0
IM151-8 PN/DP 6ES7151-8AB00-0AB0

You can find the latest hardware prerequisites on the internet:

www.siemens.com/s7modbus.

Software Versions The usage of the FB MODBUSPN is possible with STEP7 Version 5.4 SP4 or
higher.

MODBUS / TCP communication via the integrated PN interface of the CPU 1-1
2XV9450-1MB02; Manual edition 2.1
 Product description

Memory The FB MODBUSPN requires 6048 byte work memory and 7294 byte load
requirements memory.

The FB MOD_CLI requires 11184 byte work memory and 12054 byte load
memory.

The FB MOD_SERV requires 10660 byte work memory and 11452 byte load
memory.

The FB TCP_COMM requires 1880 byte work memory and 2224 byte load
memory.

MODBUS / TCP communication via the integrated PN interface of the CPU 1-2
2XV9450-1MB02; Manual edition 2.1
 Getting started

2 Getting Started

Procedure 1. Install OpenModbusTCP PN CPU and insert the Modbus function blocks
into your SIMATIC project.
=> Section 3.1 to 3.3

2. Parameterize the connection parameters regarding your requirements

(IP-address, port number, etc.).
=> Section 4.1 and 4.2

3. Parameterize the Parameter-DBs MODBUS_PARAM regarding your

requirements (client/server, connect at start-up, register numbers,
DB numbers, etc.).
=> Section 4.1 and 4.2

4. Call the Modbus block FB102 in the required OBs.

=> Section 6.1

5. Parameterize the Modbus block for initialization and runtime.

=> Section 6.2

6. Load the user program into the PLC and license the Modbus block for this
CPU.
=> Section 5

MODBUS / TCP communication via the integrated PN interface of the CPU 2-1
2XV9450-1MB02; Manual edition 2.1
 Commissioning

3 Commissioning

General The information below on STEP7 refers to Version 5.4 SP4. In later versions,
Information the sequences, names and directories might be different.

Requirements Knowledge of AWL and basic knowledge of STEP7 and PLC is required.

3.1 Installing the Library on the STEP7 PG/-PC

What We Provide The attached CD contains a setup which installs the library
Modbus_PN_CPU, the sample projects and the manuals in English and
German in the corresponding STEP7 directories.

The manuals are also available as PDF files on CD.

Requirements STEP7 has to be installed.

Installation Insert your Modbus CD into the CD ROM drive and follow step-by-step the
instructions which are displayed automatically by the installation program. If
the installation program does not start automatically, please proceed as
follows:

1. In the Windows Explorer, navigate to the CD ROM drive. Double-click on

the setup directory and then on Setup.EXE to start the installation.

2. Follow the step-by-step the instructions which are displayed by the

installation program.

Now you can find

the library in \Program Files\Siemens\Step7\S7libs,
the sample project in \Program Files\Siemens\Step7\Examples,
the manual in \Program Files\Siemens\Step7\S7manual\S7Comm,
the software registration form in
\Program Files\Siemens\Step7\S7libs\Modbus_PN_CPU.

To initially access the Modbus library, use the browse function of the Open
dialog for libraries.

The manual can be accessed via short cut under \Program Files \Siemens\
Documentation as well.

MODBUS / TCP communication via the integrated PN interface of the CPU 3-1
2XV9450-1MB02; Manual edition 2.1
 Commissioning

3.2 PLC Assigning the IP Address

Introduction Each node on the Ethernet network is identified by an internationally unique

address. This so-called MAC address is preset by the manufacturer and
cannot be changed.

Following the steps below, you can assign an IP address in the Ethernet to
this physical address.
In this example, a PLC 317-2 PN/DP is inserted.

Procedure Before the configuration, it is necessary to create a new S7 project with

STEP7.

1. Open HWConfig
The PLC 317-2 PN/DP is inserted in slot 2 and the properties dialog
box of the PN-IO interface X2 is mapped.

2. A double click on line X2 opens the object properties dialog of Ind.

Ethernet.

MODBUS / TCP communication via the integrated PN interface of the CPU 3-2
2XV9450-1MB02; Manual edition 2.1
 Commissioning

3. Enter the IP address and the subnet mask.

To establish a connection via a router, enter the address of the router
as well.

4. Click on "New" to assign a name for a new Industrial Ethernet subnet.

Confirm your entries with "OK".
Result: You created a new Industrial Ethernet subnet.

5. Click on the "OK" button.

Result: The properties window of Ethernet interface X2 for PLC 317-2
PN/DP closes.

MODBUS / TCP communication via the integrated PN interface of the CPU 3-3
2XV9450-1MB02; Manual edition 2.1
 Commissioning

3.3 Insertion of the Function Blocks into the Program

Content of the The following blocks are required for the Modbus communication:
MODBUS library
MODBUSPN
MOD_CLI
MOD_SERV
TCP_COMM

The blocks have to be copied from the library into your project.

Additionally, the library contains the parameter data block MODBUS_PARAM

as a draft. They can be inserted into your project for assistance purposes.

Blocks of the The following blocks are required for the Modbus communication:
Standard Library
TSEND (FB63)
TRCV (FB64)
TCON (FB65)
TDISCON (FB66).

You can find these blocks in Standard Library Communication Blocks.

They have to be inserted into your project.

Please note that the following versions of the FBs are a prerequisite for the
faultless function of the FB MODBUSPN:

TSEND V2.1 or higher

TRCV V2.2 or higher
TCON V2.3 or higher
TDISCON V2.1 or higher

Furthermore the block FC10 EQ_STRNG is necessary. You can find this
function in Standard Library IEC Function Blocks.

MODBUS / TCP communication via the integrated PN interface of the CPU 3-4
2XV9450-1MB02; Manual edition 2.1
 Parameterisation of the Modbus Communication

4 Parameterization of the Modbus Communication

General For the communication via the integrated PN interface of the PLC, a network
Information configuration in NetPro is not necessary. The connections are established
and terminated by means of the function blocks TCON (FB65) und TDISCON
(FB66).

Several connections to different communication partners can be

parameterized and established at the same time. The maximal number of
coexistent connections depends on the PLC.

Connection The parameters to establish a connection and to execute the Modbus

Description DB communication are defined as a structure in a parameter DB called
MODBUS_PARAM MODBUS_PARAM. At first the connection parameters are defined,
subsequently, the Modbus parameters are defined.

For each logical connection, a separate structure is required. This structure

contains the connection parameters of both communication partners and the
Modbus parameters. For each additional connection, the parameter data
block must be expanded by or a new data block created with the structure for
connection parameters and the Modbus parameters.

The parameter data block can contain parameter information of all defined
connections. It is also possible to use a separate parameter data block for
each connection.

A prepared structure is part of the library MODBUS_PN_CPU and can be

used as a sample.

Structure of DB MODBUS_PARAM:

Address Name
STRUCT
+0.0 Connection 1: Connection parameters
+64.0 Connection 1: Modbus parameters
END_STRUCT
STRUCT
+650.0 Connection 2: Connection parameters
+714.0 Connection 2: Modbus parameters
END_STRUCT
... ...
STRUCT
650*i Connection i+1: Connection parameters (65+i)
650*i+64 Connection i+1: Modbus parameters
END_STRUCT

MODBUS / TCP communication via the integrated PN interface of the CPU 4-1
2XV9450-1MB02; Manual edition 2.1
 Parameterisation of the Modbus Communication

Connection The parameters of the connection are defined in the first block, e.g. the used
Parameters local interface and the IP address of the communication partner. The
functions TCON and TDISCON can establish and terminate a connection by
means of these parameters. A detailed structure can be found in section 4.2.

The structure of the connection parameter block is obligatory und may not be
changed. Otherwise it becomes impossible to set up a connection.

Modbus The Modbus parameters define the mode of communication and the address
Parameters reference, e.g. how many register or bit areas are mapped to which DB or the
differentiation between the S7 acting as server or as client. The structure of
the parameter DB has to remain unchanged to ensure proper communication.

Alternatives for There are two alternatives for a parameterization of the connection and
Parameterization Modbus parameters. The first one is to use a Wizard, which offers an easy
way to setup the connection parameters. The second possibility is to edit the
parameters in the structure in the data block with the editor of STEP7.

The two opportunities are described in detail in the following sections 4.1 and
4.2.

4.1 Parameterization with the Wizard

General With the wizard Modbus TCP Wizard you can easily parameterize the
Information connection parameters as well as the Modbus parameters in the parameter
data block MODBUS_PARAM. The complete structure (connection
parameters and Modbus parameters) is created.

It is recommended to use the wizard for the parameterization of the block

MODBUS_PARAM.

You can find the wizard at

http://support.automation.siemens.com/WW/view/en/31535566.

MODBUS / TCP communication via the integrated PN interface of the CPU 4-2
2XV9450-1MB02; Manual edition 2.1
 Parameterisation of the Modbus Communication

4.2 Editing the Parameterization

Procedure Copy DB2 of the library Modbus_PN_CPU and insert them in your project. If
the number is already used, rename the DB.

The parameter of data block MODBUS_PARAM must not be changed during

runtime. It is necessary to restart the PLC after the modification of
MODBUS_PARAM.

Structure of and For each logical connection one structure is required.

Adaption of
Connection
Parameters

block_length This parameter describes the length of the connection parameters and must
not be changed.

Fixed value: W#16#40

id A connection ID is assigned to each logical connection. This ID must be

unique within the complete parameter data block and has to be
parameterized during the call of FB MODBUSPN. It is used for the internal
calls of the T blocks (TCON, TSEND, TRCV and TDISCON).

Value range: W#16#1 to W#16#FFF

MODBUS / TCP communication via the integrated PN interface of the CPU 4-3
2XV9450-1MB02; Manual edition 2.1
 Parameterisation of the Modbus Communication

connection_type The structure of the connection is defined here. It is used by the function
TCON when establishing the connection. The value depends on the PLC.

TCP (compatibility mode): B#16#01 with CPU315 and 317 <= FW V2.3
TCP: B#16#11 with CPU315 and 317 >= FW V2.4,
IM 151-8 PN/DP CPU, CPU 319, CPU 414
and CPU416

The values vary depending on the used firmware. You can find further
information on the internet:
http://support.automation.siemens.com/WW/view/en/24294554

active_est This parameter defines the way the connection is established (active or
passive). It is recommended that the Modbus client performs an active
connection establishment while the Modbus server establishes passive
connections.

Active connection establishment: TRUE

Passive connection establishment: FALSE

local_device_id The local_device_id defines the IE interface of the used PN PLC. The
following values are necessary with the different PLC types.

IM 151-8 PN/DP CPU B#16#1

CPU315 or 317 B#16#2
CPU319 B#16#3
CPU414 or CPU416 B#16#5

local_tsap_id_len The length of the parameter local_tsap_id (= local port number) is defined
here.

Active connection establishment: 0

Passive connection establishment: 2

rem_subnet_id_ This parameter is currently not used. Please assign the value B#16#0.
len

rem_staddr_len The length of rem-staddr, i.e. the IP address of the communication partner, is
defined here. If an unspecified connection is to be used, no IP address is
required for the partner.

Unspecified connection: B#16#0

Specified connection: B#16#4

rem_tsap_id_len This parameter defines the length of rem_tsap_id, the port number of the
remote communication partner.

Active connection establishment: 2

Passive connection establishment: 0

next_staddr_len This parameter defines the length of next_staddr as the distinction between
the communication running via an external CP or via the integrated PN
interface of the PLC.

PN interface of the PLC: B#16#0

MODBUS / TCP communication via the integrated PN interface of the CPU 4-4
2XV9450-1MB02; Manual edition 2.1
 Parameterisation of the Modbus Communication

local_tsap_id This parameter defines the local port number. The representation depends on
the parameter connection_type. The value range depends on the PLC. The
port number has to be unique within the PLC.
With connection_type B#16#01
local_tsap_id[1] low byte of the local port number in hexadecimal
local_tsap_id[2] high byte of the local port number in hexadecimal
local_tsap_id[3-16] B#16#00
With connection_type B#16#11
local_tsap_id[1] high byte of the local port number in hexadecimal
local_tsap_id[2] low byte of the local port number in hexadecimal
local_tsap_id[3-16] B#16#00

rem_subnet_id This parameter is currently not used. Please assign the value B#16#0.

rem_staddr In this array of bytes, the IP address of the remote communication partner is
defined. When an unspecified connection is used, no IP address has to be
entered. The representation depends on the parameter connection_type.

Example: IP address 192.168.0.1:

With connection_type B#16#01

rem_staddr[1] = B#16#01 (1),
rem_staddr[2] = B#16#00 (0),
rem_staddr[3] = B#16#A8 (168),
rem_staddr[4] = B#16#C0 (192),
rem_staddr[5-6]= B#16#00 (reserved)

With connection_type B#16#11

rem_staddr[1] = B#16#C0 (192),
rem_staddr[2] = B#16#A8 (168),
rem_staddr[3] = B#16#00 (0),
rem_staddr[4] = B#16#01 (1),
rem_staddr[5-6]= B#16#00 (reserved)

rem_tsap_id This parameter defines the remote port number. The representation depends
on the parameter connection_type. The value range depends on the PLC.
With connection_type B#16#01
local_tsap_id[1] low byte of the remote port number in hexadecimal
local_tsap_id[2] high byte of the remote port number in hexadecimal
local_tsap_id[3-16] B#16#00
With connection_type B#16#11
local_tsap_id[1] high byte of the remote port number in hexadecimal
local_tsap_id[2] low byte of the remote port number in hexadecimal
local_tsap_id[3-16] B#16#00

next_staddr This parameter defines rack and slot of the corresponding CP. When using
the integrated PN interface of the PLC, assign 0 to this parameter.
next_staddr[1-6] B#16#00

spare Reserved; assign 0 to this parameter.

MODBUS / TCP communication via the integrated PN interface of the CPU 4-5
2XV9450-1MB02; Manual edition 2.1
 Parameterisation of the Modbus Communication

Adaption of the The Modbus parameters in the block MODBUS_PARAM define the mode of
Modbus operation of the Modbus communication and the address reference of
Parameters Modbus addresses and SIMATIC addresses.

server_client TRUE: S7 is server

FALSE: S7 is client

single_write In operating mode S7 is client and single_write = TRUE write requests with
length 1 are carried out with the function codes 5 and 6.

With single_write = FALSE all write requests use the function codes 15 and
16.

MODBUS / TCP communication via the integrated PN interface of the CPU 4-6
2XV9450-1MB02; Manual edition 2.1
 Parameterisation of the Modbus Communication

connect_at_ This parameter defines the point in time at which the connection is being
startup established.

FALSE: establish connection when ENQ_ENR=TRUE

TRUE: establish connection immediate after PLC start-up

When connect_at_startup = TRUE, the first request should be started after

the connection was established (CONN_ESTABLISHED = TRUE) or an error
has been reported respectively (ERROR =TRUE).

8 Data Areas 8 data areas are available to map the Modbus addresses in the S7 storage.
At least the first data area has to be defined. The other 7 data areas are
optional. Depending on the type of request, these memory areas are read or
written.

With one request, only one DB can be accessed. Even if consecutive register
numbers or coils are located in two different DBs, two requests are necessary
to access them both. This has to be taken into account during the
parameterization.

It is possible to map more Modbus values (registers or coils) in one data block
than could be processed with one telegram.

data_type_x The parameter data_type_x defines the MODBUS data type which is to be
mapped with this definition.
If data_type_x set to 0, this data area is not used

Identifier Data type Size

0 Area not used
1 Coils Bit
2 Inputs Bit
3 Holding Register Word
4 Input Register Word

db_x The parameter db_x defines the number of the data block in which the
consecutively defined MODBUS registers or bits are mapped.
0 cannot be used as DB number since it is reserved for system functions.

db_x
DB-Number 1 - 65535 (W#16#0001 to W#16#FFFF)

MODBUS / TCP communication via the integrated PN interface of the CPU 4-7
2XV9450-1MB02; Manual edition 2.1
 Parameterisation of the Modbus Communication

start_x Start_x specifies the first register or bit address, which is stored in the data
end_x element 0 of the DB. End_x defines the of the last MODBUS address.

When accessing registers, the number of the data element of the S7 DB in

which the last register is mapped, can be calculated with the following
formula:
DBW number = (end_x start_x) 2

When accessing coils or inputs, the number of the data element of the S7 DB
in which the last bit is mapped, can be calculated with the following formula:
DBB number = (end_x start_x +7) / 8

The defined memory areas must not overlap. The parameter end_x must not
be smaller than start_x. In case of an error occurring, the initialization of the
FB is stopped with an error. When start_x is equal to end_x, one Modbus
address (1 register or 1 bit) is allocated.

In section 6.3 you can find an example of the mapping of the MODBUS
addresses to S7 memory areas.

start_x, end_x
MODBUS address 0 to 65535 (W#16#0000 to W#16#FFFF)

internal_send_ This array is used internally for message data within the FB. Accessing or
buffer changing the array is inadmissible.

internal_recv_ This array is used internally for the received data within the FB. Accessing or
buffer changing the array is inadmissible.

MODBUS / TCP communication via the integrated PN interface of the CPU 4-8
2XV9450-1MB02; Manual edition 2.1
 Licensing

5 Licensing

General The block MODBUSPN must be licensed for each CPU individually. The
licensing takes place in two steps: reading the IDENT_CODE and declaring
the registration key REG_KEY.

Read the To read the IDENT_CODE please proceed as follows:

IDENT_CODE
1. Parameterize the block in the cyclic OB (OB1 or cyclic interrupt OB),
in OB100 and OB121 according to your requirements. Transfer the
program to the PLC and turn it to RUN mode.

2. Open the instance DB of the block MODBUSPN. Data block ->

Open Online to open the DB.
Monitoring the block via the button is insufficient.

MODBUS / TCP communication via the integrated PN interface of the CPU 5-1
2XV9450-1MB02; Manual edition 2.1
 Licensing

3. The output IDENT_CODE shows an 18 character string.

Copy this string per copy/paste from the DB und and insert it in the
form IT4Industry SOFTWARE REGISTRATION FORM. This form is
stored in the library path
..\Program Files\Siemens\Step7\S7LIBS\Modbus_PN_CPU
during installation and is also available on the installation CD.
Insert the License-No. of the product package into the form.

4. Please send the form per e-mail to IT4Industry

[email protected].

Hereupon you will receive the registration key for your PLC.

MODBUS / TCP communication via the integrated PN interface of the CPU 5-2
2XV9450-1MB02; Manual edition 2.1
 Licensing

Declaration of the The registration key REG_KEY must be declared for each call of the block
Registration Key MODBUSPN.
REG_KEY
The registration key REG_KEY should be stored in a global DB. Via this
global DB all MODBUSPN blocks can receive the registration key (See also
the following example).

Please proceed as follows to declare the registration key REG_KEY:

1. Copy the prepared license block DB3 of the library

Modbus_PN_CPU into your project. If the DB number is already
used in your project, rename the license DB.

2. Open the license DB and copy the 17 digit registration key you
received from IT4industry to the column Initial value.

3. Declare the registration key in the data block as initial value to avoid
a repeated insertion after reloading the PLC. Open the data block in
the SIMATIC manager with the editor in the declaration view. Change
over to the data view via the menu View -> Data View. Choose in
the menu Edit > Initialize Data Block all values of the column
initial value are copied to actual values.

4. Assign the value DB3.REG_KEY to the parameter REG_KEY of the

block MODBUSPN.

5. Transfer the changed blocks to the PLC. The registration key can be
set at run time. A STOP -> RUN transition is not necessary.

The block is now licensed for this CPU.

MODBUS / TCP communication via the integrated PN interface of the CPU 5-3
2XV9450-1MB02; Manual edition 2.1
 Licensing

Missing or Wrong When the registration key is missing or a wrong one is detected, the SF LED
Licensing (S7-300 and IM151-8) or the INTF LED (S7-400) of the CPU is flashing. A
cyclic error message regarding the missing license is displayed in the
diagnostic buffer too. The error number of the missing license is W#16#A090.

The entry in the diagnostic buffer is carried out by means of OB121

Programming Error.

_____________________________________________________________

Warning

! The CPU will turn to STOP mode, if the OB121 is not available.
_____________________________________________________________

Modbus communication is carried out even with a missing or wrong

registration key, but the output STATUS_MODBUS is set to W#16#A090 no
valid license.

If this error code is shown although the registration key has been inserted,
please check if the FC EQ_STRING is copied into the project.

MODBUS / TCP communication via the integrated PN interface of the CPU 5-4
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

6 Function Block MODBUSPN

6.1 Functionality of the FB

General The function block MODBUSPN enables a communication between a PLC

Information with integrated PN interface and a partner which supports Open
MODBUS/TCP.
The function codes 1, 2, 3, 4, 5, 6, 15 and 16 are supported.
Depending on the parameterization, the FB can be operated either in client or
in server mode. In the server operating mode, the functionality multitasking in
the sense of the MODBUS specification is not implemented.

The block MODBUSPN calls the blocks MOD_CLI (FB104) and MOD_SERV
(FB105) internally. The block MOD_CLI comprises the function of Modbus
client, the block MOD_SERV executes the function of Modbus server and the
block TCP_COMM handles the connection management.

The blocks provide the following functions:

Connection and data handling by means of T blocks of the standard
library
Generation of MODBUS-specific telegram header before sending
Verification of the MODBUS-specific telegram header when receiving
Verification whether the memory areas requested by the client exist
Generation of exception telegrams when errors occur (only when S7
is in server mode)
Data transfer to and from the parameterized DB
Time monitoring of the data reception as well as connection
establishment and termination
Verification of the registration key

Online-Help The SIMATIC Manager provides an online help for the function block
MODBUSPN. Mark the FB and press F1 so that he online help is displayed.
It contains the main information on the FB.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-1
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

Call of the FB For a correct program sequence the function block MODBUSPN has to be
called in 3 organization blocks:
OB100 Start-Up
OB121 Programming Error
Cyclic OB (OB1 or cyclic interrupt OB, e.g. OB35)

The subordinate blocks of the Modbus library MOD_CLI, MOD_SERV and

TCP_COMM must not be called additionally in an organization block.

A coexistent call of FB MODBUSPN in OB1 and a cyclic interrupt OB, e.g.

OB35 is not permissible.

The Modbus block must be called in OB121. You will find more information
regarding this matter in section 5 Licensing.

Start-up of the FB The function block MODBUSPN is unconditionally called once in OB100.
The initialization parameters must be set according to the station
configuration.
The initialization parameters are copied into the instance DB.
The runtime parameters are not evaluated during the start-up.
The values of the parameter data block MODBUS_PARAM are
evaluated.

Cyclical Operation In case of cyclical operation, the FB MODBUSPN is called in OB1 or in a

of the FB cyclic interrupt OB.
Corresponding to the runtime parameters, the functions of the
function block are activated.
While a request is being processed, changes to the runtime
parameters are ignored.
In the cyclical operation mode, initialization parameters are ignored.

OB121 The block MODBUSPN must be called in OB121 with the same instance DB
Programming as in the start-up OB and the cyclic OB.
Error
If the block has not been licensed yet, the OB121 is called.

_____________________________________________________________

Warning

! The CPU will turn to STOP mode, if the OB121 is not available.
_____________________________________________________________

The call of MODBUSPN in OB121 executes an entry in the diagnostic buffer,

which points out that the registration key is missing. The LED SF or INTF of
the CPU flashes simultaneously.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-2
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

Connection Active connection establishment can be carried out by the Modbus client as
Handling well as the Modbus server. It is recommended explicitly that the Modbus client
executes the active establishment. The relevant information is read from the
connection parameters of DB MODBUS_PARAM.

With a parameter of the connection parameter block (active_est), it is possible

to define whether the PLC performs active or passive connection
establishment.
During runtime the function TCON establishes the connection to the
communication partner for both types of connections, active and passive.

The point in time at which the connection is established is defined in DB

MODBUS_PARAM (parameter connect_at_startup).
The termination of the connection is defined with the parameter
DISCONNECT of FB MODBUSPN.

Multiple A PN PLC can establish multiple connections to various communication

Communication partners. To ensure a proper operation and data transfer, a strict division of
Partners the different connections to the corresponding communication partners is
inevitable.

Correspondingly, there are the following requirements for each connection:

one connection parameter block and the related Modbus parameter in

DB MODBUS_PARAM
call of FB MODBUSPN in OB100
call of FB MODBUSPN in OB121
call of FB MODBUSPN in OB1 or cyclic interrupt OB

In this case, the calls of the FB MODBUSPN in the OB100, OB121 and in the
OB1 receive the same instance DB for one connection. A different instance
DB is required for each additional connection.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-3
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

Initiate Request A rising edge at the trigger input ENQ_ENR initiates a request. Depending on
S7 is Client the input parameters UNIT, DATA_TYPE, START_ADDRESS, LENGTH, TI
and WRITE_READ, a MODBUS request telegram is generated and sent to
the partner station via the TCP/IP connection. The client waits for the
parameterized monitoring time RECV_TIME for a response from the server.
When the monitoring time elapses (no response from the server), the
activated request is terminated with an error. A new request can be initiated.

After the receipt of the response telegram, a validity check is carried out. If the
result is positive, the necessary actions are taken and the request is
terminated without error. The output DONE_NDR is set. When an error is
recognized during verification, the request is terminated with an error, the
ERROR bit is set and an error number is returned at the output STATUS.

Activation of the With the signal TRUE at the trigger input ENQ_ENR, the FB is ready to
Function Block receive a request telegram from the client. The server remains passive and
S7 is Server waits for a telegram from the client. The received telegram is verified. If the
verification result is positive, the response telegram is sent. The completed
transmission is reported to the user by setting the DONE_NDR bit. At this
point, the completed function is indicated at the outputs UNIT, DATA_TYPE,
START_ADDRESS, LENGTH, TI and WRITE_READ.

An erroneous request telegram causes an error message and the ERROR bit
is set. The error number is returned in STATUS_MODBUS. The request of
the client is not answered.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-4
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

6.2 Parameters of the Function Block MODBUSPN

Parameter Decl. Type Description Value range Init

ID IN WORD Connection ID, must be identical to the 1 to 4095 yes
associated parameter in the local W#16#1 to
connection description W#16#FFF

DB_PARAM IN BLOCK_ Number of the parameter DB depending on yes

DB PLC
RECV_TIME IN TIME Monitoring Time: wait for data from T#20ms no
communication partner to
T#+24d20h31
Shortest adjustable time: 20 ms.
m23s647ms
CONN_TIME IN TIME Monitoring Time: wait for establishing or T#20ms no
termination of the connection to
T#+24d20h31
Shortest adjustable time: 100 ms.
m23s647ms
KEEP_ALIVE IN TIME Not used
ENQ_ENR IN BOOL S7 is Client: TRUE no
Initiate request at positive edge FALSE
S7 is Server:
Ready to receive at TRUE signal
DISCONNECT IN BOOL S7 is Client: TRUE no
TRUE: connection is terminated after FALSE
reception of response
S7 is Server:
TRUE: connection is terminated when
ENQ_ENR = FALSE
REG_KEY IN STRING Registration key to activate the license Character no
[17]
LICENSED OUT BOOL License state of the function block: no
Block is licensed TRUE
Block is not licensed FALSE
BUSY OUT BOOL Operating state of the T functions no
(TCON, TDISCON, TSEND or TRCV)
Job processing TRUE
No job processing active FALSE
CONN_ OUT BOOL Connection established TRUE no
ESTABLISHED Connection terminated FALSE
DONE_NDR OUT BOOL S7 is Client: TRUE no
TRUE: Active request finished without FALSE
errors
S7 is Server:
TRUE: Request from the client was
executed and answered

MODBUS / TCP communication via the integrated PN interface of the CPU 6-5
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

Parameter Decl. Type Description Value range Init

ERROR OUT BOOL An error has occurred TRUE no
No error has occurred FALSE
STATUS_ OUT WORD Error number for protocol errors when 0 to FFFF no
MODBUS evaluating a Modbus telegram
STATUS_ OUT WORD Error number for connection errors during 0 to FFFF no
CONN execution of the T blocks
(TCON, TSEND, TRCV, TDISON)
STATUS_FUNC OUT STRING Name of the function, which causes the Character no
[8] error at STATUS_MODBUS or
STATUS_CONN
IDENT_CODE OUT STRING Identification for licensing Character no
[18] Please order your license with this
identification string.
UNIT IN/ BYTE Unit identification 0 to 255 no
OUT (INPUT if in CLIENT mode, OUTPUT if in B#16#0 to
SERVER mode) B#16#FF

DATA_TYPE IN/ BYTE Data type to be accessed: no

OUT (INPUT if in CLIENT mode, OUTPUT if in
SERVER mode)
Coils 1
Inputs 2
Holding registers 3
Input registers 4
START_ IN/ WORD MODBUS start address 0 to 65535 no
ADDRESS OUT (INPUT if in CLIENT mode, OUTPUT if in W#16#0000 to
SERVER mode) W#16#FFFF

LENGTH IN/ WORD Number of values to be processed no

OUT (INPUT if in CLIENT mode, OUTPUT if in
SERVER mode)
Coils
Reading function 1 to 2000
Writing function 1 to 800
Inputs
Reading function 1 to 2000
Holding Register
Reading function 1 to 125
Writing function 1 to 100
Input Register
Reading function 1 to 125

TI IN/ WORD Transaction Identifier 0 to 65535 no

OUT (INPUT if in CLIENT mode, OUTPUT if in W#16#0 to
SERVER mode) W#16#FFFF

WRITE_ READ IN/ BOOL Write access or TRUE no

OUT Read access FALSE
(INPUT if in CLIENT mode, OUTPUT if in
SERVER mode)

MODBUS / TCP communication via the integrated PN interface of the CPU 6-6
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

General The parameters of the FB MODBUSPN can be divided into two groups:
Information
Initialization parameters

Runtime parameters

Initialization parameters are evaluated only during the call of OB100 and
are adopted into the instance DB. They are marked with yes in the column
INIT in the table displayed above.
A modification of the initialization parameters during run mode has no impact.
After a modification of these parameters (e.g. during the test phase), the
instance DB must be initialized again via a STOP RUN transition of the
PLC.

Runtime parameters can by modified during the cyclical operation. In the

mode S7 is server, it is not advisable to modify the input parameters while a
request is active. Wait with the next request and the change of the
parameters until the previous request ends with DONE_NDR or ERROR.

In the operation mode S7 is server, the output parameters may only be

evaluated when DONE_NDR is TRUE.

The output parameters are displayed dynamically, i.e. they are only
available for one PLC cycle. They have to be copied to an additional memory
area if you need to process them or to display the values in a VAT (STEP7
variable table).

Range of Values For the range of values of the different parameters, PLC-specific restrictions
must be taken into consideration.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-7
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

ID To each connection between the PN PLC and a communication partner a

connection ID is assigned. When operating various connections an individual
ID is required for each logical connection. This connection ID is defined in the
connection parameter block, which is part of the parameter data block
MODBUS_PARAM. The connection ID unambiguously specifies the
connection between the PLC and the communication partner. The ID can be
set to values between 1and 4095.
The connection ID defined in the connection parameter block has to be
entered here and must be unique within the PLC.

DB_PARAM The parameter DB_PARAM assigns the number of the data block
MODBUS_PARAM. This parameter data block includes the connection
parameters and the Modbus-specific parameters, which are necessary for the
communication between the PN PLC and the Modbus device.

This parameter is declared in plain text: DBxy.

The range of values for this parameter depends on the PLC. 0 cannot be
used as a DB number since it is reserved for system functions.

The parameter data block can contain a sequence of parameters for several
connections. It is also possible to use different parameter data blocks for
multiple connections.

RECV_TIME The monitoring time RECV_TIME observes the data input from the
communication partner. The shortest adjustable time is 20 ms.

In the operating mode S7 is client, an indication RECV_TIME < 20 ms

causes an error message and the request is rejected. When the time
RECV_TIME elapses, the active request is cancelled with an error.
In order to receive a Modbus telegram, TRCV has to be called twice. With
each call of TRCV, the RECV_TIME is triggered. The monitoring time is
started with the call of TRCV and stopped after the receipt of the telegram
segment.

In the operating mode S7 is server, an indication RECV_TIME < 20 ms

causes the use of the default time of 1,2s. If the monitoring time elapses, an
error is reported. The RECV_TIME monitors the duration of the TCP stream.
The interval between two requests is not taken into consideration.

CONN_TIME The monitoring time CONN_TIME observes the connection establishment

and the connection termination. The shortest adjustable time is 100 ms.

When CONN_TIME elapses, the corresponding error code is displayed at the

output STATUS_CONN.

In the operating mode S7 is server, an indication CONN_TIME < 100 ms

causes the use of the default time 5s. This is also true for the operating mode
S7 is client with connect_at_startup = TRUE.

During cyclic operation in the operating mode S7 is client,

CONN_TIME < 100ms causes an error message and the request is rejected.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-8
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

ENQ_ENR Operating mode S7 is Client:

The data transfer is initiated with a TRUE edge at the input. The request
telegram is generated with the values of the input parameters UNIT,
DATA_TYPE, START_ADDRESS, LENGTH, TI and WRITE_READ. A new
request may only be initiated when the previous one is ended with
DONE_NDR or ERROR.
If the connection is not established (CONN_ESTABLISHED = FALSE), the
connection establishment is carried out first and then the data transfer takes
places.

Operating mode S7 is Server:

The FB is activated with a TRUE signal at the input. Telegrams from the client
can be received.
If the connection is not established (CONN_ESTABLISHED = FALSE), the
connection establishment is activated.
When the parameter ENQ_ENR turns from TRUE to FALSE, the connection
may be terminated depending on the parameter DISCONNECT.
With a FALSE signal at the input and an established connection, data is
received from the client and discarded.

DISCONNECT In the operating mode S7 is client, the parameter DISCONNECT = TRUE

indicates that the connection is terminated after the completed data transfer.

In the operating mode S7 is server, the parameter DISCONNECT = TRUE

indicates that the connection is terminated when the parameter ENQ_ENR is
set to FALSE.

This parameter is a runtime parameter and can be set optionally according to

your requirements.

REG_KEY The block MODBUSPN must be licensed for each CPU individually to permit
a correct program sequence.

With the registration key REG_KEY the block MODBUSPN is licensed and
the Modbus communication runs without any restraint.

You can find further information in section 5 Licensing.

BUSY If this output is TRUE, one of the T functions TCON, TDISCON, TSEND or
TRCV is running.

CONN_ CONN_ESTABLISHED indicates that a connection to the communication

ESTABLISHED partner is established and data can be transferred.

If CONN_ESTABLISHED is set to FALSE, the connection to the

communication partner is not established.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-9
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

DONE_NDR The parameter DONE_NDR indicates an error-free execution of the request.

In the operating mode S7 is Client, the activated request was executed

without an error. With a reading function, the response data from the server
has already been entered into the DB. With a writing function, the response to
the request telegram has been received from the server.

In the operating mode S7 is Server, this output indicates a telegram

exchange without errors. In the parameters UNIT, DATA_TYPE,
START_ADDRESS, LENGTH, TI and WRITE_READ the request parameters
of the client are displayed. These outputs are only available and valid as long
as DONE_NDR is TRUE.

ERROR When this output is set, an error was recognized.

In the operating mode S7 is Client, the activated request was ended with an
error. The error number is displayed in the STATUS_MODBUS or
STATUS_CONN output.

In the operating mode S7 is Server, an error was detected at a request

telegram of the client or when sending a response telegram. The error
number is displayed in the STATUS_MODBUS or STATUS_CONN output.

STATUS_MODBUS When ERROR is TRUE, the STATUS_MODBUS output displays the error
number regarding the processing of Modbus telegrams. The error numbers
are described in section 7.

STATUS_CONN When ERROR is TRUE, the STATUS_CONN output displays the error
number regarding the processing of the T functions. The error numbers are
described in section 7 and in the STEP7 online help of the functions TCON,
TDISCON, TSEND and TRCV.

Status information like job processing active is provided by STATUS_CONN

as well. In this case, the ERROR bit is set to FALSE.

STATUS_FUNC This parameter shows the name of the function, which caused the error
occurred.

IDENT_CODE With the identification string IDENT_CODE you can order the registration key
at IT4industry. After start-up of the PLC an 18 character string is displayed,
which can be read by means of a variable table?

You can find further information in section 5 Licensing.

UNIT In mode S7 is Client, the parameter UNIT is an input parameter. This input
has to be set according to your requirements. The FB copies this value to the
request telegram and verifies when receiving the respond telegram.

In mode S7 is Server, the parameter UNIT is an output parameter. The FB

copies this value from the request telegram to the respond telegram. The
output is set with the received value when the job is finished without an error.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-10
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

DATA_TYPE The parameter DATA_TYPE defines which Modbus data type is to be

accessed with the current job. The following data types are available:

Coils B#16#1
Inputs B#16#2
Holding Register B#16#3
Input Register B#16#4

In the operating mode S7 is Client, DATA_TYPE is an input parameter. In the

operating mode S7 is Server, DATA_TYPE is an output parameter.

The different data types are related directly to the used function codes.

Data type DATA_ Function Length single_ Function

TYPE write code
Coils 1 read any irrelevant 1
Coils 1 write 1 TRUE 5
Coils 1 write 1 FALSE 15
Coils 1 write >1 irrelevant 15
Inputs 2 read any irrelevant 2
Holding Register 3 read any irrelevant 3
Holding Register 3 write 1 TRUE 6
Holding Register 3 write 1 FALSE 16
Holding Register 3 write >1 irrelevant 16
Input Register 4 read any irrelevant 4

START_ADDRESS The parameter START_ADDRESS specifies the first MODBUS address that
is read or written.

In the operating mode S7 is Client, this is an input parameter. In the

operating mode S7 is Server, this is an output parameter.

LENGTH The parameter LENGTH specifies the number of MODBUS values that are
read or written.

In the operating mode S7 is Client, this is an input parameter. In the

operating mode S7 is Server, this is an output parameter.

With a reading function, a maximum of 125 registers or 2000 bits is possible

per telegram. With a writing function, a maximum of 100 registers or 800 bits
is possible.

For each telegram, all registers or bits have to be in the same DB.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-11
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

TI The parameter TI (Transaction Identifier) is copied by the server from the

request telegram to the respond telegram according to the MODBUS
specification.

In the operating mode S7 is Client, this is an input parameter. The FB copies

this value to the request telegram and verifies it when receiving the respond
telegram.
In the operating mode S7 is Server, this is an output parameter. The FB
copies this value from the request telegram into the respond telegram.

The Transaction Identifier is used for the identification of telegrams and the
unambiguous allocation of the requests to the corresponding responds. The
FB MODBUSPN can only perform this function properly if the TI is changed
with each transaction. Only a change of the TI ensures a reliable operation of
the FB.

Therefore, we recommend increment the TI by 1 with any request.

WRITE_READ This parameter defines whether a reading or writing function is to be carried

out. If the value of the input/output is FALSE, the reading mode is specified.
The value TRUE specifies the writing mode.

In the operating mode S7 is Client, this is an input parameter. In the

operating mode S7 is Server, this is an output parameter.

6.3 Example of Address Mapping

Interpretation of The MODBUS data model is based on a series of storage areas with distinct
MODBUS Register properties. Some systems, e.g. MODICON PLCs, distinguish these areas by
Addresses the register or bit addresses. The Holding Register with offset 0, for example,
is called 40001 (memory type 4xxxx, reference 0001).

A potential source of confusion is the varying interpretation of the register

address in different manuals. Sometimes the register or bit address is defined
as the address of the application layer and in other manuals it is the actually
transferred address.

The FB MODBUSPN uses the register or bit address transferred for its
parameters start_x, end_x und START_ADDRESS. Therefore, it is possible to
use register or bit addresses from von 0000H to FFFFH for each function code.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-12
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

Example: data_type_1 B#16#3 Holding Register

db_1 W#16#B DB 11
Parameterization start_1 W#16#1 Start address: 1
of the Memory end_1 W#16#1F4 End address: 500
Areas data_type_2 B#16#3 Holding Register
db _2 W#16#C DB 12
start _2 W#16#2D0 Start address: 720
end _2 W#16#384 End address: 900
data_type_3 B#16#4 Input Register
db _3 W#16#D DB 13
start _3 W#16#2D0 Start address: 720
end _3 W#16#3E8 End address: 900
data_type_4 B#16#0 Not used
db _4 0 0
start _4 0 0
end _4 0 0
data_type_5 B#16#1 Coils
db _5 W#16#E DB 14
start _5 W#16#280 Start address: 640
end _5 W#16#4E2 End address: 1250
data_type_6 B#16#2 Inputs
db _6 W#16#F DB 15
start _6 W#16#6A4 Start address:1700
end _6 W#16#8FC End address: 2300
data_type_7 B#16#1 Coils
db _7 W#16#10 DB 16
start _7 W#16#6A4 Start address: 1700
end _7 W#16#8FC End address: 2300
data_type_8 B#16#0 Not used
db _8 0 0
start _8 0 0
end _8 0 0

Address Mapping The following diagram shows a comparison of the SIMATIC memory area and
the Modbus-typical register oriented storage arrangement. The diagram is
based on the parameterization in the table above.

The Modbus addresses printed in black refer to the Data Link Layer and the
ones printed in grey refer to the Application Layer.

The SIMATIC addresses printed in black are the offset in the DB. Additionally,
you can find the Modbus register numbers printed in grey.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-13
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

SIMATIC Modbus device

DB 14
Coils (from 00001)
+ 0.0 640
0 00001
+ 0.1 641
...
...
640 00641
+76.2 1250
641 00642
DB 16 ...
+ 0.0 1700 1250 01251
+ 0.1 1701 ...
... 1700 01701
+74.7 2299 ...
+75.0 2300 2300 02301
Inputs (from 10001) 2301 02302
DB 15
0 10001
+ 0.0 1700
...
+ 0.1 1701
1700 11701
...
1701 11702 Input Register
+74.7 2299 (from 30001)
...
+75.0 2300 0 30001
2300 12301
1 30002
DB 13 2301 12302
...
+ 0.0 720
720 30721
+ 2.0 721
721 30722
...
...
+560.0 1000
1000 31001
DB 11 Holding Register 1001 31002
(from 40001)
+ 0.0 1
0 40001
+ 2.0 2
1 40002
...
...
+996.0 499
499 40500
+998.0 500
500 40501
DB 12 501 40502
+ 0.0 720 ...
+ 2.0 721 720 40721
... ...
+358.0 899 900 40901
+360.0 900 901 40902

MODBUS / TCP communication via the integrated PN interface of the CPU 6-14
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

6.4 Data and Standard Functions used by the FB

Instance DB The function block MODBUS stores its data in an instance DB. This instance
DB is created by STEP7 when initially calling the FB.

The instance data block contains parameters of the types input, output and
input/output as well as static variables required for its execution. These
variables are remanent and keep their validity between FB calls. The
variables control the internal process flow of the FB.

Required memory of the instance-DBs:

Instance-DB work memory load memory

MODBUSPN 830 Byte 1852 Byte

Local Variables The FB requires 96 bytes of local variables. Additionally, MOD_CLI (110 Byte)
or MOD_SERV (84 Byte) and TCP_COMM require 2 bytes local variables and
TCON, TDISCON, TSEND or TRCV use up to 28 bytes depending on the
used function block. That is a total of max. 236 bytes of local data for one FB
MODBUSPN call.

Parameter DB The connection- and Modbus-specific parameters are stored in the parameter
data block MODBUS_PARAM.

Timers The FB does not use any timers.

Flags The function block does not use any flags.

Standard FBs for The function block TCP_COMM, called by MODBUSPN, uses the blocks
Connection TCON and TDISCON of the standard library to establish and terminate the
Handling connection between the PLC and the communication partner.

Standard FBs for The function block TCP_COMM, called by MODBUSPN, uses the blocks
Data Transfer TSEND and TRCV of the standard library for the data transfer between the
PLC and the communication partner.

MODBUSPN: The FB MODBUSPN uses the following SFCs from the standard library:
SFCs for
FC10 EQ_STRING
Miscellaneous
Functions SFC6 RD_SINFO
SFC20 BLKMOV
SFC24 TEST_DB
SFC51 RDSYST
SFC52 WR_USMSG

MODBUS / TCP communication via the integrated PN interface of the CPU 6-15
2XV9450-1MB02; Manual edition 2.1
 Function Block MODBUSPN

MOD_CLI and The FBs MOD_CLI and MOD_SERV use the following SFCs from the
MOD_SERV: standard library:
SFCs for
SFC20 BLKMOV
Miscellaneous
Functions SFC24 TEST_DB

TCP_COMM: The FB TCP_COMM uses the following SFB from the standard library in
SFCs for addition to the T-blocks:
Miscellaneous
SFB4 TON
Functions

6.5 Renaming Standard Functions

Inducement If the numbers of the standard functions are already assigned within your
project or if the number interval is reserved for a different application, it is
possible to rename the internally called function blocks FB63, FB64, FB65
and FB66 of FB TCP_COMM or the called function blocks MOD_CLI,
MOD_SERV und TCP_COMM.

It is not possible to rename the system functions SFC6, SFC20, SFC24,

SFC51, SFC52 and SFB4.

Renaming To rename the blocks proceed as described subsequently:

1. Change the numbers of the function blocks in the desired numbers in

your program in SIMATIC Manager.

2. Add the modifications in the symbolism table supplementary.

A modification of the FB numbers via Extras -> Re-wire is not necessary.

MODBUS / TCP communication via the integrated PN interface of the CPU 6-16
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

7 Diagnosis

Diagnostic The diagnostic functions of the PN PLC enable a fast localization of errors.
Function The following diagnostic features are available:

Diagnosis via the display elements of the PLC

Diagnosis via the STATUS_MODBUS and STATUS_CONN output of the

MODBUSPN function block.

Display Elements The display elements inform you about the operating mode or about the error
(LED) conditions of the PLC. The display elements provide an overview of internal
errors, external errors and interface-specific errors.

STATUS Outputs For an error diagnosis, the MODBUSPN function block has 3 STATUS
of the outputs.
FB MODBUSPN
When reading the STATUS_MODBUS output, you are provided with a
general indication of errors that occurred during the Modbus-specific telegram
processing.

The STATUS_CONN output displays status information and error codes with
regard to the processing of the T functions.

The output STATUS_FUNC shows the name of the function, which caused
the error at STATUS_MODBUS or STATUS_CONN.

When reading the STATUS outputs, you are provided with a general
indication of errors that occurred during the telegram processing and
connection handling. The STATUS parameters can be evaluated in the user
program.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-1
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

7.1 Diagnosis via the Display Elements of the PLC

Display Functions The display elements of the PLC provide information on the status of the
component. There are two types of display functions:

Group Error Displays

PN CPU 300
- SF Group error
When this LED is flashing, the Modbus block has not been licensed yet.
You can find further information in section 5 Licensing.

PN-CPU 400
- INTF Internal error
When this LED is flashing, the Modbus block has not been licensed yet.
You can find further information in section 5 Licensing.

Special Displays

PN CPU 300, PN CPU 400 and IM 151-8 PN/DP CPU:

- RX/TX a telegram is transferred via the integrated interface

A detailed description of the display elements can be found in the device

manual of the PLC.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-2
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

7.2 Verification by the FB MODBUSPN

During Start-up Unambiguousness of the id parameter in the connection parameters

of DB MODBUS_PARAM

Parameter group data_type_x, db_x, start_x, end_x. (x = 1 to 8)

1. With data_type_x = 0 the Modbus area is disabled and not

further verified. At least the first area (_1) has to be
parameterized.

2. Validity check of data_type

3. db_x <> 0

4. Test end_x >= start_x

5. Modbus addresses for the same data type defined in two

db_x lead to an error message (address overlap).

Errors during start-up provoke the ERROR bit to remain set. In the cyclical
operation no requests are executed. A correction of the parameterization and
a STOP RUN transition of the PLC are necessary.

Cyclical Operation Verification when the FB is called:

S7 is Client
Valid registration key

DB MODBUS_PARAM is available with the necessary length

Range of values monitoring time RECV_TIME and CONN_TIME

Range of values START_ADRESS

Range of values LENGTH

When executing a request, there also is a check whether the data

block specified by the register or bit address is available and has the
necessary length. The DB number must not be 0 and/or identical to
the number of MODBUS_PARAM or the instance DB.

Receipt of the response telegram within the monitoring time

The monitoring time can also elapse if less data than specified in the
MODBUS telegram header is received. Subsequent errors with loss
of telegrams can occur.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-3
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

Verification in the response telegram:

Received transaction identifier is equal to the sent one.

Protocol identifier = 0

Length is between 3 and 253

Additionally, the length in the header of the response telegram is
checked for plausibility regarding the request.

Sent UNIT is equal to the received one

Sent FC is equal to the received one

Response is an exception code telegram

For write requests, the start address and number of registers/bits

have to match with the request telegram.

FC 5 or FC6:
Echo in the respond is equal to the request

Cyclical Operation Receipt of the second part of the request telegram within the
S7 is Server monitoring time

The monitoring time can also elapse if less data than specified in the
MODBUS telegram header is received. Subsequent errors with loss
of telegrams can occur.

Protocol Identifier = 0

Length between 6 and 207

Received function code is verified. If the function code is not equal to

1, 2, 3, 4, 5, 6, 15 or 16 an exception telegram is sent.

For write requests, the length in the header, the number of registers
or bits and the byte count in the telegram must match.

The number of registers or bits is verified. If the number is too large,

an exception telegram is sent.

During the execution of a request, there is also a check whether the

data block specified by the register or bit address is available and has
the necessary length. The DB number must not be 0 or identical to
the number of MODBUS_PARAM or the instance DB. In case of an
error, an exception telegram is sent.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-4
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

Termination of the In special error situations, the FB terminates the connection:

Connection in
Case of Error Monitoring time for connection establishment exceeded

Monitoring time for receive exceeded

PI <> 0

received TI different to sent TI

Length in the header does not match the length information in the
telegram

MODBUS / TCP communication via the integrated PN interface of the CPU 7-5
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

7.3 Diagnosis Messages of the FB MODBUSPN

Messages at the The block MOBUSPN has 3 status outputs: STATUS_MODBUS,

STATUS Outputs STATUS_CONN and STATUS_FUNC.
of the FB STATUS_MODBUS displays the error numbers regarding the processing of
Modbus telegrams, whereas STATUS_CONN displays the error numbers
regarding the connection handling. STATUS_FUNC shows the name of the
function, which caused the error. STATUS is valid when ERROR is TRUE.
Below you can find a list of FB-specific error messages.

Error Messages of The FBs MODBUSPN, MOD_CLI and MOD_SERV use the standard
the called SFCs functions SFC6, SFC20, SFC24, SFC51 und SFC52. The error messages of
and FBs these blocks are passed on to STATUS_MODBUS without any changes.

The block TCP_COMM, called by MOD_CLI or MOD_SERV, uses the

standard blocks SFB4, FB63, FB64, FB65 and FB66. The error messages of
these blocks are passed on to STATUS_CONN without any changes.

For further details on the error messages, please consult the diagnosis buffer
or the online help of the SIMATIC Manager.

Error messages of FB MODBUSPN at the output STATUS_MODBUS

STATUS Event text Remedy
(Hex)
A001 The parameter data block MODBUS_PARAM is too Correct the length of
short. MODBUS_PARAM
A002 The parameter end_x is less than start_x. Correct the parameterization in
DB MODBUS_PARAM
A003 The DB to which MODBUS addresses shall be mapped Extend the DB.
is too short. S7 is Client: Correct the
Minimum length: parameters START_ADDRESS
- register values (end_x - start_x + 1) * 2 or LENGTH
- bit values (end_x - start_x + 7) / 8
S7 is Server:
Other possible reasons:
Modify the request of the client.
Wrong initialization parameter (S7 is client)
Wrong address area in the request telegram of
the client (S7 is server)
A004 Applies only if S7 is client: Correct the parameters. Only
An invalid combination of DATA_TYPE and data type 1 or 3 can be written.
WRITE_READ is given.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-6
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

Error messages of FB MODBUS MODBUSPN at the output STATUS_MODBUS

STATUS Event text Remedy
(Hex)
A005 S7 is client: S7 is Client:
An invalid value for the parameter LENGTH is given. Correct the parameter
S7 is Server: LENGTH.
The number of registers/bits in the request telegram is S7 is Server:
invalid. Modify the number in the
Range of values: request telegram.
Read coils/inputs: 1 to 2000
Write coils: 1 to 800
Read registers: 1 to 125
Write holding registers: 1 to 100
A006 The given range of registers defined with DATA_TYPE, S7 is Client:
START_ADDRESS and LENGTH does not exist in Correct the parameter
data_type_1 to data_type_8. combination DATA_TYPE,
START_ADDRESS, LENGTH.
S7 is Server:
Modify the request of the client
or correct the parameterization
of data_type_x.
A007 Only if S7 is client: Correct the parameterization.
An invalid monitoring time RECV_TIME or CONN_TIME
is parameterized.
The RECV_TIME has to be at least 20 ms, CONN_TIME
100ms
A009 Only if S7 is client: Verify the data of the
The received transaction identifier TI is not equal to the communication partner with the
sent one. help of a telegram trace.
The connection is terminated.
A00A Only if S7 is client:
The received UNIT is not equal to the sent one.
A00B S7 is client: S7 is client:
Received function code is not equal to the sent one. Verify the data of the
S7 is server: communication partner with the
An invalid function code was received. help of a telegram trace.
S7 is server:
The FB MODBUS only
supports the function codes 1,
2, 3, 4, 5, 6, 15 and 16.
A00C The received byte count does not match the number of Verify the data of the
registers. communication partner with the
The connection is terminated. help of a telegram trace.
A00D Only if S7 is client:
The register or bit address respectively the number of
registers or bits in the response telegram is not equal to
the one in the request telegram.
A00E The length indicated in the MODBUS-specific telegram
header does not match the number of registers/bits or
the byte count in the telegram. The FB ignores all data.
The connection is terminated.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-7
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

Error messages of FB MODBUSPN at the output STATUS_MODBUS

STATUS Event text Remedy
(Hex)
A00F A protocol identifier <> 0 was received. Verify the data of the
communication partner with the
The connection is terminated.
help of a telegram trace.
A010 In the parameters db_1 to db_8 a DB number is used Correct the parameterization in
twice. DB MODBUS_PARAM.
A011 An invalid value for DATA_TYPE is given (Value range: 1 Correct the parameters.
to 4).
A012 The parameterized areas data_type_1 and data_type_2 Correct the parameterization in
overlap. DB MODBUS_PARAM.
A013 The parameterized areas data_type_1 and data_type_3 The data areas must not
overlap. contain any overlapping
register areas.
A014 The parameterized areas data_type_1 and data_type_4
overlap.
A015 The parameterized areas data_type_1 and data_type_5
overlap.
A016 The parameterized areas data_type_1 and data_type_6
overlap.
A017 The parameterized areas data_type_1 and data_type_7
overlap.
A018 The parameterized areas data_type_1 and data_type_8
overlap.
A019 0 is assigned to one of the parameters db_x while the Correct the parameterization in
according data_type_x is <> 0. DB MODBUS_PARAM.
DB 0 cant be used; it is reserved for system functions.
A01A Wrong length in the Modbus header (1 to 253 byte are Verify the data of the
valid). communication partner with the
help of a telegram trace.
The connection is terminated.
A01F The FB MODBUSPN has turned to an invalid state. Please contact the product
support.
A023 The parameterized areas data_type_2 and data_type_3 Correct the parameterization in
overlap. DB MODBUS_PARAM
A024 The parameterized areas data_type_2 and data_type_4 The data areas must not
overlap. contain any overlapping
register areas.
A025 The parameterized areas data_type_2 and data_type_5
overlap.
A026 The parameterized areas data_type_2 and data_type_5
overlap.
A027 The parameterized areas data_type_2 and data_type_5
overlap.
A028 The parameterized areas data_type_2 and data_type_5
overlap.
A034 The parameterized areas data_type_3 and data_type_4
overlap.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-8
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

Error messages of FB MODBUSPN at the output STATUS_MODBUS

STATUS Event text Remedy
(Hex)
A035 The parameterized areas data_type_3 and data_type_5 Correct the parameterization in
overlap. DB MODBUS_PARAM
A036 The parameterized areas data_type_3 and data_type_6 The data areas must not
overlap. contain any overlapping
A037 The parameterized areas data_type_3 and register areas.
data_type_7overlap.
A038 The parameterized areas data_type_3 and
data_type_8overlap.
A045 The parameterized areas data_type_4 and data_type_5
overlap.
A046 The parameterized areas data_type_4 and data_type_6
overlap.
A047 The parameterized areas data_type_4 and data_type_7
overlap.
A048 The parameterized areas data_type_4 and data_type_8
overlap.
A056 The parameterized areas data_type_5 and data_type_6
overlap.
A057 The parameterized areas data_type_5 and data_type_7
overlap.
A058 The parameterized areas data_type_5 and data_type_8
overlap.
A067 The parameterized areas data_type_6 and data_type_7
overlap.
A068 The parameterized areas data_type_6 and data_type_8
overlap.
A078 The parameterized areas data_type_7 and data_type_8
overlap.
A079 The connection ID of parameter ID is not defined in DB Correct the parameterization at
MODBUS_PARAM. the input ID.
A07A An invalid value ID is parameterized. Range of values is
1 to 4095.
A07B The parameter ID exists twice in the parameter DB. Correct the parameterization in
DB MODBUS_PARAM.
A07C An invalid value data_type_x was given. The value range
is 0 to 4.
A07D Parameter data_type_1 is not defined. The parameter
area _1 is the default area and must be defined.
A07E The DB number of db_x is identical to the number of the
parameter DB MODBUS_PARAM or to the instance DB.
A07F The data block defined at DB_PARAM is no parameter Correct the parameterization at
DB for Modbus communication. The length information in the INPUT DB_PARAM.
DBW0 was changed or a wrong DB was defined.
A080 The parameter DB_PARAM was changed without a DB_PARAM is an initialization
restart of the CPU. parameter. Restart the CPU
after changing this parameter.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-9
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

Error messages of FB MODBUSPN at the output STATUS_MODBUS

STATUS Event text Remedy
(Hex)

A081 Only if S7 is client and function code 5: Verify the data of the
The received coil status is not equal to the sent one. communication partner with the
help of a telegram trace.

A082 Only if S7 is client and function code 6: Verify the data of the
The received register value is not equal to the sent one. communication partner with the
help of a telegram trace.

A083 Only if S7 is client: Wait with the initiation of a new

A request was initiated prior to the completion of the request until the previous one
previous one. was finished either with
DONE/NDR = TRUE or
ERROR = TRUE.
A084 The character string for identification IDENT_CODE Please contact the Product
could not be determined. Support.
A090 The block MODBUSPN is not licensed for this CPU. Read the identification string
IDENT_CODE for this CPU and
order the registration key at
IT4industry.
See also section 5 Licensing.
A091 An exception telegram with exception code 1 was The communication partner
received (only if CP is client) does not support the requested
function.
A092 An exception telegram with exception code 2 was Correct LENGTH or
received (only if CP is client) START_ADDRESS at the call
An attempt to an invalid or non existing address at the of the FB.
communication partner was made.
A093 An exception telegram with exception code 3 was Check the error message of the
received (only if CP is client) communication partner.
A094 An exception telegram with exception code 4 was Check the error message of the
received (only if CP is client) communication partner.
A095 An exception telegram with an unknown exception code Check the error message of the
was received (only if CP is client). communication partner and
verify the data with a telegram
trace if needed.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-10
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

Error messages of FB MODBUSPN at the output STATUS_CONN

STATUS Event text Remedy
(Hex)
A100 The monitoring time CONN_TIME or RECV_TIME was Check the parameterization of
exceeded when executing a job. the connection.
When RECV_TIME is exceeded, the connection is
terminated.
A101 The monitoring time of the TDISCON is exceeded. Please contact the product
support.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-11
2XV9450-1MB02; Manual edition 2.1
 Diagnosis

7.4 Diagnosis Messages of Called Blocks

Error messages of SFC 6 and SFC 20 at the output STATUS_MODBUS

STATUS Event text Remedy
(Hex)
7xxx For detailed information please refer to the online help See online help (SIMATIC
of SIMATIC Manager. manager -> mark block -> key F1)
8xxx For detailed information please refer to the online help See online help (SIMATIC
of SIMATIC Manager. manager -> mark block -> key F1)

Error messages of FB 63, FB 64, FB 65 and FB 66 at the output STATUS_CONN

STATUS Event text Remedy
(Hex)
7xxx For detailed information please refer to the online help See online help (SIMATIC
of SIMATIC Manager. manager -> mark block -> key F1)
8xxx For detailed information please refer to the online help See online help (SIMATIC
of SIMATIC Manager. manager -> mark block -> key F1)

7.5 Diagnosis Messages of SFC24

Error messages of SFC24 at the output STATUS_MODBUS

STATUS Event text Remedy
(Hex)
80A1 DB Number = 0 or too large for the PLC Choose a valid DB number.
This error code is also reported, when FB Use the same IDB for the call of
MODBUSPN is called with different instance DBs in MODBUSPN in OB1 or cyclic
OB1 or cyclic interrupt OB and OB100. interrupt OB and OB100.
80B1 The DB does not exist in the PLC. All data blocks that are specified
in DB_x must be created and
copied into the PLC.
80B2 DB UNLINKED DB must not be created as
UNLINKED.

MODBUS / TCP communication via the integrated PN interface of the CPU 7-12
2XV9450-1MB02; Manual edition 2.1
 Application Sample

8 Sample Application

General The following simple programming example illustrates the use of

Information FB MODBUSPN.

Please note, the provided example project is meant for information

purposes only. It displays the handling of the Modbus blocks and is not
to be understood as a solution for a customer-specific installation
configuration.

Example Project On the CD you can find an extensive example project which offers all varieties
on the CD of parameterization possibilities for the Simatic stations.
Simatic Station is S7-300, S7-400 or IM 151-8 PN/DP CPU
Simatic Station is client or server

Sample Program The programming example consists of the blocks:

Start-Up OB100 with call of FB102
Programming error OB121 with call of FB102
Cyclic program processing OB1 with call of FB102
Global DBs for job trigger (e.g. with variable table) and for licensing
Data blocks for register and bit values

Used Blocks The following blocks are used in the provided sample project for S7 stations
with FB MODBUSPN.

Block Symbol Comment

OB 1 CYCL_EXC cyclic program processing
OB 100 COMPLETE start-up OB for restart
RESTART
OB 121 PROG_ERR programming error OB
FB 102 MODBUSPN FB MODBUSPN
FB 103 TCP_COMM FB TCP_COMM
FB 104 MOD_CLI FB MOD_CLI
FB 105 MOD_SERV FB MOD_SERV
DB 1 CONTROL_DAT work DB CONTROL DAT for FB MODBUSPN
DB 2 MODBUS_PARAM parameter DB PARAM_DB for FB MODBUSPN
DB 3 LICENSE_DB license data block for FB MODBUSPN
DB 102 IDB_MODBUS instance DB for FB MODBUSPN
DB 11 DATA_AREA_1 value DB for area 1
DB 12 DATA_AREA_2 value DB for area 2
DB 13 DATA_AREA_3 value DB for area 3
DB 14 DATA_AREA_4 value DB for area 4
DB 15 DATA_AREA_5 value DB for area 5

MODBUS / TCP communication via the integrated PN interface of the CPU 8-1
2XV9450-1MB02; Manual edition 2.1
A Literature

MODBUS IDA MODBUS APPLICATION PROTOCOL SPECIFICATION

V1.1b, December 28, 2006

http://www.modbus-IDA.org

MODBUS / TCP communication via the integrated PN interface of the CPU Appendix - 1
2XV9450-1MB02; Manual edition 2.1
Glossary

A
Address The address identifies a physical storage location. If the address is
known, the operand stored there can be directly accessed.

Automation System An automation system is a programmable logic controller that contains

at least a PLC, different input and output devices as well as HMI
devices.

B
Baud Rate - > transmission rate

Block Call A block call occurs when program processing branches to the called
block

Block Parameter Block parameters are variables within multiple-use blocks, which are
replaced with actual values when the relevant block is called.

Blocks Blocks are elements of the user program which are defined by their
function, structure, or purpose. With STEP7 there are

Code blocks (FB, FC, OB, SFB, SFC)

Data blocks (DB, SDB)

User-defined data types (UDT)

Bus Segment Part of a -> subnet. Subnets can consist of bus segments and
connectivity devices such as repeaters and bridges. Segments are
transparent for addressing.

C
Client A client is a device or, in general terms, an object that requests a
service from a -> server.

Communications Processor Communications processors are modules for point-to-point connections

and bus connections.

Configuration The configuration is the set up of individual modules of the PLC in the
configuration table.

Connection Parameterization The specification of a connection ID in the system function block. With
the help of a connection ID the system function blocks can
communicate between two communication points.

CP Communications Processor. Module for communications tasks.

MODBUS / TCP communication via the integrated PN interface of the CPU Glossary - 1
2XV9450-1MB02; Manual edition 2.1
CPU Central processing unit of the S7 programmable logic controller with
control and arithmetic unit, memory, operating system, and interfaces to
I/O modules.

CRC Cyclic Redundancy-Check = Checksum which guarantees a high

probability of error recognition.

Cycle Time The cycle time is the time the PLC needs to execute the user program
once.

Cyclic Program Processing In cyclic program processing, the user program is executed in a
constantly repeating program loop, called a cycle.

D
Data Block (DB) These are blocks containing data and parameters with which the user
program works. Unlike all other blocks, data blocks do not contain
instructions. They are subdivided into global data blocks and instance
data blocks. The data held in the data blocks can be accessed
absolutely or symbolically. Complex data can be stored in structured
form.

Data Type Data types allow users to define how the value of a variable or constant
is to be used in the user program. They are classified into elementary
and structured data types.

Default Setting The default setting is a basic setting which is always used if no other
value is specified.

Diagnostic Buffer Every PLC has a diagnostic buffer, in which detailed information on
diagnostic events are stored in the order in which they occur.

Diagnostic Event Diagnostic events are, for example, errors on a module or system
errors in the PLC, which are caused by, say, a program error or by
operating mode transitions.

Diagnostic Functions The diagnostics functions cover the entire system diagnosis and include
detection, analysis and reporting of errors within the automation
system.

Download Downloading means loading objects (e.g. code blocks) from the
programming device into the load memory of the PLC.

F
Function Block (FB) Function blocks are components of the user program and, in
accordance with the IEC standard, are blocks with memory. The
memory for the function block is an assigned data block, a so called
instance data block. Function blocks can be parameterized but can
also be used without parameters.

H
Hardware Hardware is the term given to all the physical and technical equipment
of a PLC.

MODBUS / TCP communication via the integrated PN interface of the CPU Glossary - 2
2XV9450-1MB02; Manual edition 2.1
I
Industrial Ethernet A LAN system complying with IEEE 802.3 (ISO 8802-2)

Instance Data Block An instance data block is a block assigned to a function block and
contains data for this special function block.

Interface Module On the interface module the physical conversion of signals takes place.
By exchanging the pluggable interface module you can adapt the
communications processor to the physical interface of the
communications partner.

Interrupt Interrupt is a name for a break of the program processing in the

processor of an automation system by an external alarm.

M
MAC-Address Address to distinguish between different stations connected to a
common transmission medium (Industrial Ethernet).

Media Access Control (MAC) Mechanisms for controlling access by a station to a common
transmission medium shared with other stations.

Module Modules are pluggable printed circuit boards for programmable logic
controllers

Module Parameters Module parameters are used to set the module behaviors. A distinction
is made between static and dynamic module parameters.

N
NCM S7 for Industrial Configuration software for configuration and diagnostic functions on an
Ethernet Ethernet CP.

O
Online / Offline Online means that a data connection exists between PLC and
programming device. Offline means that no such data connection
exists.

Online Help STEP7 allows you to display contextual help texts on the screen while
working with the programming software.

Operand An operand is part of a STEP7 instruction and states with what the
processor is to do something. It can be both absolutely and symbolically
addressed.

Operating Mode The SIMATIC S7 programmable controllers have three different

operating modes: STOP, START UP and RUN. The functionality of the
PLCs varies in the individual operating modes.

Operating System of the PLC The operating system of the PLC organizes all functions and operations
of the PLC which are not connected to a specific control task.

MODBUS / TCP communication via the integrated PN interface of the CPU Glossary - 3
2XV9450-1MB02; Manual edition 2.1
P
Parameter Parameters are values that can be assigned. A distinction is made
between block parameters and module parameters.

Parameterization Parameterization means setting the behavior of a module.

Procedure The execution of a data interchange operation according to a specific

protocol is called a procedure.

Process image This is a special memory area in the PLC. At the beginning of the cyclic
program, the signal states of the input modules are transferred to the
process image input table. At the end of the cyclic program, the process
image of the outputs is transferred to the output modules as output
signals.

Protocol The communications partners involved in a data interchange must

abide by fixed rules for handling and implementing the data traffic.
These rules are called protocols.

R
Rack A rack is a rail containing slots for mounting modules.

S
Server A server is a device, or in general terms, an object that provides certain
services. A service is started at the instigation of a -> client.

Software Software is the term given to all programs used on a computer system.
These include the operating system and the user programs.

START UP The operating mode START UP is active when the PLC transits from
operating mode STOP to operating mode RUN.

STEP7 STEP7 is the programming software of SIMATIC S7.

Subnet A subnet is part of a -> network whose parameters must be matched.

The subnet includes bus components and all the attached stations.
Subnets can, for example, be connected together by -> gateways to
form a network.
A system consists of several subnets with unique subnet numbers. A
subnet consists of several stations with unique -> MAC addresses.

System Block System blocks differ from the other blocks in that they are already
integrated into the S7-400 system and are available for already defined
system functions. They are classified into system data blocks, system
functions, and system function blocks.

System Function (SFC) System functions are software modules without memory which are
already integrated into the operating system of the S7-PLC and can be
called by the user as required.

System Function Block (SFB) System function blocks are software modules with memory which are
already integrated into the operating system of the S7-PLC and can be
called up by the user as required.

MODBUS / TCP communication via the integrated PN interface of the CPU Glossary - 4
2XV9450-1MB02; Manual edition 2.1
T
Tool A tool is a piece of software that is capable of accessing operating
system functions in a programming device.

Transmission Rate According to DIN 44302, this is the number of binary decisions
transmitted per time unit. The unit is bps. he set or selected
transmission rate depends on various conditions, for example the
distance across

U
Upload Uploading means loading objects (e.g. code blocks) from the load
memory of the PLC into the programming device.

User Program The user program contains all instructions and declarations for signal
processing, by means of which a system or a process can be
controlled. The user program for SIMATIC S7 is structured and is
divided into smaller units called blocks.

V
Variable A variable is an operand (e.g. E 1.0) which can have a symbolic name
and can therefore also be addressed symbolically.

W
Work Memory The work memory is a RAM on the PLC which the processor accesses
while processing the user program.

MODBUS / TCP communication via the integrated PN interface of the CPU Glossary - 5
2XV9450-1MB02; Manual edition 2.1
Customer Support
Siemens AG
Industry Sector
I IS IN E&C
Werner-von-Siemens-Str. 60
91052 Erlangen
Tel: ++49 9131 7-46111
Fax: ++49 9131 7-44757
Mail: [email protected]

http://www.siemens.com/s7modbus

Siemens Aktiengesellschaft Subject to change without prior notice. Stand: 06/2009

MODBUS / TCP communication via the integrated PN interface of the CPU

2XV9450-1MB02; Manual edition 2.1