Silo - Tips Simatic Simatic Modbus TCP Communication Via The Integrated PN Interface of The PLC Manual
Silo - Tips Simatic Simatic Modbus TCP Communication Via The Integrated PN Interface of The PLC Manual
Manual
Preface, Table of Contents
Product Description 1
Getting Started 2
SIMATIC S7
Commissioning 3
SIMATIC Modbus/TCP Parameterization 4
Communication via the
integrated PN interface of the PLC Licensing 5
FB MODBUSPN 6
Manual
Additional Blocks 7
Diagnosis 8
Sample Application 9
Appendices
Literature
Glossary
Edition 2.7
Safety Precautions and This manual contains warnings, which you should note for your own safety as well as
Warnings for the prevention of damage to property. These warnings are indicated by means of a
warning triangle and are displayed as follows in accordance with the level of danger:
__________________________________________________________________
Danger
indicates that loss of life, severe personal injury or substantial damage
will result if proper precautions are not taken.
__________________________________________________________________
__________________________________________________________________
Warning
indicates that loss of life, severe personal injury or substantial damage can result if proper
precautions are not taken.
__________________________________________________________________
__________________________________________________________________
Caution
indicates that minor personal injury or property damage can result if proper precautions are
not taken.
__________________________________________________________________
__________________________________________________________________
Note
represents an important information especially significant to the product, handling of the
product or a specific part of this documentation.
__________________________________________________________________
Qualified The start-up and the operation of the device may only be carried out by qualified
Personnel personnel. Qualified personnel in the sense of the security advices of this manual are any
persons authorized to commission, ground and label devices, systems and electric circuits.
A successful and safe operation of this product is depends on proper transport, and correct
storage, installation and assembly as well as careful operation and maintenance.
Trademarks Since any other brand names in this manual may refer to trademarks, the use of these
names by third parties for their own purposes may infringe the rights of the owner.
Preface
Purpose of the The information in this manual allows you to set up and put in operation the
Manual connection between a PLC with integrated PN interface and a device that
supports the Modbus/TCP protocol.
Contents of the This manual describes the function of the Modbus function block and its
Manual parameterization.
The manual contains the following topics:
Production description
Getting Started
Commissioning
Parameterization
Licensing
Function block MODBUSPN
Diagnosis
Sample application
Note
Additional All additional information concerning PN PLCs and IM 151-8 PN/DP CPU
Sources of (Startup, commissioning etc.) can be found in the manuals
Information
SIEMENS
SIMATIC S7-300
CPU 31xC and CPU 31x: Installation
Operating Instructions
A5E00105491-07
SIEMENS
SIMATIC S7-300
CPU 31xC and CPU 31x, Technical Specifications
Manual
A5E00105474-07
SIEMENS
SIMATIC S7-400
Automation System S7-400 Hardware and Installation
Operating Instructions
A5E00850740-01
SIEMENS
SIMATIC S7-400
S7-400 Automation System, CPU Specifications
Manual
A5E00850746-06
SIEMENS
SIMATIC
Distributed I/Os ET 200S
Interface Module IM151-8 PN/DP CPU
Manual
A5E02049033-01
SIEMENS
Product Information on
CPU314C-2 PN/DP, 6ES7314-6EH04-0AB0
CPU315-2 PN/DP, 6ES7315-2EH13-0AB0
CPU315F-2 PN/DP, 6ES7315-2FH13-0AB0
CPU317-2 PN/DP, 6ES7317-2EK13-0AB0
CPU317F-2 PN/DP, 6ES7317-2FK13-0AB0
CPU317-2 DP, 6ES7317-2AJ10-0AB0
CPU317F-2 DP, 6ES7317-6FF03-0AB0
CPU319-3 PN/DP, 6ES7318-3EL00-0AB0
CPU319F-3 PN/DP, 6ES7318-3FL00-0AB0
A5E01103134-03
SIMATIC
Windows Automation Center RTX
WinAC RTX 2008
Operating Instructions
A5E00486536-02
SIMATIC
Windows Automation Center RTX
WinAC RTX 2009
Operating Instructions
A5E00486536-03
SIMATIC
Windows Automation Center RTX
WinAC RTX (F) 2010
Operating Instructions
A5E00486536-04
SIEMENS
SIMATIC Software
Base software for S7 and M7
STEP7 user manual
C79000-G7000-C502-..
SIEMENS
SIMATIC Software
System software for S7-300/400
System and standard functions
Reference manual C79000-G7000-C503-02
Additional For further questions regarding the use of the FBs described in this manual,
Questions please contact your Siemens partner who provided you with this function
block.
Terminology This document uses the term PN PLC. The descriptions apply to PN PLCs
of series 314C, 315, 317, 319, 412, 414 and 416 as well as IM 151-8 PN/DP
CPU and WinAC RTX.
Table of Contents
3.3 Insertion of the Function Blocks into the Program .......................................... 3-4
8.1 Diagnosis via the Display Elements of the PLC ............................................. 8-2
A Literature ....................................................................................................................... 1
1 Product Description
Placement in the The function block described here is a software product for PLCs with
System Environ- integrated PN interface of Simatic S7-300, S7-400 and IM 151-8 PN/DP
ment CPU.
Function of the These function blocks enable communication between a Simatic PLC with
FBs integrated PN interface and a device that supports the Modbus/TCP protocol.
The SIMATIC S7 can act as both client and server during the data
transmission.
Use of Port In general, the protocol uses the port 502. This port number has been
Number 502 released for all PN PLCs with the corresponding firmware version. You can
find the information about the released port numbers on the internet:
http://support.automation.siemens.com/WW/view/en/34010717.
With specific CPUs it is possible to use multiple connections via port 502 to
different clients simultaneously.
In section 3.4 “Multiple Connections via Port 502” you can find technical
details regarding this matter.
Usable Modules You can find the latest hardware requirements on the internet:
www.siemens.com/s7modbus.
Software Versions The usage of the FB MODBUSPN is possible with STEP7 Version 5.5 or
higher.
Memory The FB MODBUSPN requires ca. 8 kbyte work memory and ca. 9 kbyte load
requirements memory.
The FB MOD_CLI requires ca. 9 kbyte work memory and ca. 10 kbyte load
memory.
The FB MOD_SERV requires ca. 9 kbyte work memory and ca. 10 kbyte load
memory.
The FB TCP_COMM requires ca. 2 kbyte work memory and ca. 2 kbyte load
memory.
2 Getting Started
Procedure 1. Install “Modbus/TCP PN CPU“ and insert the Modbus function blocks into
your SIMATIC project.
=> Section 3.1 to 3.3
6. Load the user program into the PLC and license the Modbus block for this
CPU.
=> Section 5
3 Commissioning
General The information below on STEP7 refers to Version 5.5. In later versions, the
Information sequences, names and directories might be different.
Requirements Knowledge of AWL and basic knowledge of STEP7 and PLC is required.
What We Provide The attached CD contains a setup which installs the library
“Modbus_PN_CPU”, the sample projects and the manuals in English and
German in the corresponding STEP7 directories.
Installation Insert your Modbus CD into the CD ROM drive and follow the instructions
which are displayed automatically by the installation program step by step. If
the installation program does not start automatically, please proceed as
follows:
1. In the Windows Explorer, navigate to the CD ROM drive. Open the setup
directory and double-click on Setup.EXE to start the installation.
To initially access the Modbus library, use the browse function of the “Open”
dialog for libraries.
The manual can be accessed via short cut under \Program Files \Siemens\
Documentation as well.
Following the steps below, you can assign an IP address in the Ethernet to
this physical address.
In this example, a PLC 317-2 PN/DP is inserted.
1. Open HWConfig
The PLC 317-2 PN/DP is inserted in slot 2 and the properties dialog
box of the PN-IO interface X2 is mapped.
Content of the The following blocks are required for the Modbus communication:
MODBUS library
MODBUSPN
MOD_CLI
MOD_SERV
TCP_COMM
The blocks have to be copied from the library into your project.
Blocks of the The following blocks are required for the Modbus communication:
Standard Library
TSEND (FB63)
TRCV (FB64)
TCON (FB65)
TDISCON (FB66).
Please note that the following versions of the FBs are a requirement for the
faultless function of the FB MODBUSPN:
TSEND V2.1
TRCV V2.2
TCON V2.4
TDISCON V2.1
Restart in During commissioning arranging several CPU restarts after changing the
Commissioning initialization parameters can be complicated. By setting the static parameter
“Init_Start” manually, the restart part in the modbus block can be processed.
The manual initialization can only be done when there is no job active. For a
correct initialization all initialization parameters must be parameterized in the
cyclical OB.
General Some CPUs are able to multiplex TCP connections. In doing so several
Modbus clients can establish a connection via port 502. The CPU acts as
Modbus server.
Here you can find information which CPU and which firmware release
supports multiple connections via port 502:
www.siemens.com/s7modbus
Requirements To use this functionality, the parameterization must be carried out as follows:
CPU is server
port 502 as local port
unspecified TCP connection
passive connection establishment
Number of The maximum number of Modbus clients that can be connected to port 502
Released of the CPU is CPU-specific and can be found in the technical data of the
Connections CPU.
Programming For each client that should be connected to port 502 of the server, 1 unique
connection is needed in the parameter data block. Furthermore in the S7
program 1 Modbus block instance is needed for each client.
General For the communication via the integrated PN interface of the PLC, a network
Information configuration in NetPro is not necessary. The connections are established
and terminated by means of the function blocks TCON (FB65) und TDISCON
(FB66).
The parameter data block can contain parameter information of all defined
connections. It is also possible to use a separate parameter data block for
each connection.
Structure of DB MODBUS_PARAM:
Address Name
STRUCT
+0.0 Connection 1: Connection parameters
+64.0 Connection 1: Modbus parameters
END_STRUCT
STRUCT
+650.0 Connection 2: Connection parameters
+714.0 Connection 2: Modbus parameters
END_STRUCT
... ...
STRUCT
650*i Connection i+1: Connection parameters
650*i+64 Connection i+1: Modbus parameters
END_STRUCT
Connection The parameters of the connection are defined in the first block, e.g. the used
Parameters local interface and the IP address of the communication partner. The
functions TCON and TDISCON can establish and terminate a connection by
means of these parameters. The detailed structure can be found in section
4.2.
The structure of the connection parameter block is obligatory und may not be
changed. Otherwise it becomes impossible to establish a connection.
Modbus The Modbus parameters define the mode of communication and the address
Parameters reference, e.g. how many register or bit areas are mapped to which DB and
the differentiation between the S7 acting as server or as client. The structure
of the parameter DB has to remain unchanged to ensure proper
communication.
Alternatives for There are two alternatives for a parameterization of the connection and
Parameterization Modbus parameters. The first one is to use a Wizard, which offers an easy
way to setup the connection parameters. The second possibility is to edit the
parameters in the structure in the data block with the editor of STEP7.
The two opportunities are described in detail in the following sections 4.1 and
4.2.
General With the wizard ModbusTCP Wizard you can easily parameterize the
Information connection parameters as well as the Modbus parameters in the parameter
data block MODBUS_PARAM. The complete structure (connection
parameters and Modbus parameters) is created.
Procedure Copy DB2 of the library Modbus_PN_CPU and insert it in your project. If the
number is already used, rename the DB.
block_length This parameter describes the length of the connection parameters and must
not be changed.
connection_type The structure of the connection is defined here. It is used by the function
TCON when establishing the connection. The value depends on the PLC.
TCP (compatibility mode): B#16#01 with CPU315 and 317 <= FW V2.3
TCP: B#16#11 with CPU315 and 317 >= FW V2.4,
IM 151-8 PN/DP CPU, CPU314C, CPU319,
CPU412, CPU414, CPU416 and WinAC RTX
The values vary depending on the used firmware. You can find further
information on the internet:
http://support.automation.siemens.com/WW/view/en/24294554
active_est This parameter defines the way the connection is established (active or
passive). The Modbus client performs an active connection establishment
while the Modbus server establishes passive connections.
local_device_id The local_device_id defines the IE interface of the used PN PLC. The
following values are necessary for the different PLC types.
local_tsap_id_len The length of the parameter local_tsap_id (= local port number) is defined.
rem_subnet_id_ This parameter is currently not used. Please assign the value B#16#0.
len
rem_staddr_len The length of rem-staddr, i.e. the IP address of the communication partner, is
defined here. If an unspecified connection is to be used, no IP address is
required for the partner.
rem_tsap_id_len This parameter defines the length of rem_tsap_id, the port number of the
remote communication partner.
next_staddr_len This parameter defines the length of next_staddr as the distinction between
the communication running via an external CP or via the integrated PN
interface of the PLC.
local_tsap_id This parameter defines the local port number. The representation depends on
the parameter connection_type. The value range depends on the PLC. The
port number has to be unique within the PLC.
With connection_type B#16#01
local_tsap_id[1] low byte of the local port number in hexadecimal
local_tsap_id[2] high byte of the local port number in hexadecimal
local_tsap_id[3-16] B#16#00
With connection_type B#16#11
local_tsap_id[1] high byte of the local port number in hexadecimal
local_tsap_id[2] low byte of the local port number in hexadecimal
local_tsap_id[3-16] B#16#00
rem_subnet_id This parameter is currently not used. Please assign the value B#16#0.
rem_staddr In this array of bytes, the IP address of the remote communication partner is
defined. When an unspecified connection is used, no IP address has to be
entered. The representation depends on the parameter connection_type.
rem_tsap_id This parameter defines the remote port number. The representation depends
on the parameter connection_type. The value range depends on the PLC.
With connection_type B#16#01
local_tsap_id[1] low byte of the remote port number in hexadecimal
local_tsap_id[2] high byte of the remote port number in hexadecimal
local_tsap_id[3-16] B#16#00
With connection_type B#16#11
local_tsap_id[1] high byte of the remote port number in hexadecimal
local_tsap_id[2] low byte of the remote port number in hexadecimal
local_tsap_id[3-16] B#16#00
next_staddr This parameter defines rack and slot of the corresponding CP. When using
the integrated PN interface of the PLC, assign 0 to this parameter.
next_staddr[1-6] B#16#00
Adaption of the The Modbus parameters in the block MODBUS_PARAM define the mode of
Modbus operation of the Modbus communication and the address reference of
Parameters Modbus addresses and SIMATIC addresses.
single_write In operating mode “S7 is client” and single_write = TRUE write requests with
length 1 are carried out with the function codes 5 and 6.
With single_write = FALSE all write requests use the function codes 15 and
16.
connect_at_ This parameter defines the point in time at which the connection is being
startup established.
8 Data Areas 8 data areas are available to map the Modbus addresses in the S7 storage.
At least the first data area has to be defined. The other 7 data areas are
optional. Depending on the type of request, these memory areas are read or
written.
With one request, only one DB can be accessed. Even if consecutive register
numbers or coils are located in two different DBs, two requests are necessary
to access them both. This has to be taken into account during the
parameterization.
data_type_x The parameter data_type_x defines the MODBUS data type which is to be
mapped with this definition.
If data_type_x is set to 0, this data area is not used
Identifie Size
Data type
r
0 Area not used
1 Coils Bit
2 Inputs Bit
3 Holding Register Word
4 Input Register Word
db_x The parameter db_x defines the number of the data block in which the
consecutively defined MODBUS registers or bits are mapped.
0 cannot be used as DB number since it is reserved for system functions.
db_x
DB-Number 1 - 65535 (W#16#0001 to W#16#FFFF)
The data block must be longer by 2 bytes than it is necessary for the
parameterized data. The last 2 bytes are required for internal purposes.
start_x Start_x specifies the first register or bit address, which is stored in the data
end_x block word 0 of the DB. End_x defines the address of the last MODBUS
address.
When accessing registers, the number of the data block word of the S7 DB in
which the last register is mapped, can be calculated with the following
formula:
DBW number = (end_x – start_x) 2
When accessing coils or inputs, the number of the data element of the S7 DB
in which the last bit is mapped, can be calculated with the following formula:
DBB number = (end_x – start_x +7) / 8
The defined memory areas must not overlap. The parameter end_x must not
be smaller than start_x. In case of an error occurring, the initialization of the
FB is stopped with an error. When start_x is equal to end_x, one Modbus
address (1 register or 1 bit) is allocated.
In section 6.3 you can find an example of the mapping of the MODBUS
addresses to S7 memory areas.
start_x, end_x
MODBUS address 0 to 65535 (W#16#0000 to W#16#FFFF)
internal_send_ This array is used internally for message data within the FB. Accessing or
buffer changing the array is inadmissible.
internal_recv_ This array is used internally for the received data within the FB. Accessing or
buffer changing the array is inadmissible.
5 Licensing
General The block MODBUSPN must be licensed for each CPU individually. The
licensing takes place in two steps: reading the IDENT_CODE and declaring
the registration key REG_KEY. The OB121 must be available in the CPU.
Copy this string per copy/paste from the DB and insert it in the form
SOFTWARE REGISTRATION FORM. This form is stored in the
library path
..\Program Files\Siemens\Step7\S7LIBS\Modbus_PN_CPU
during installation and is also available on the installation CD.
Insert the License-No. of the product package into the form.
5. Note for usage in CFC: The CFC editor can show only a limited
number of characters in online view. The complete IDENT_CODE is
shown in tooltip of the output parameter.
Declaration of the The registration key REG_KEY must be declared for each call of the block
Registration Key MODBUSPN.
REG_KEY
The registration key REG_KEY should be stored in a global DB. Via this
global DB all MODBUSPN blocks can receive the registration key (See also
the following example).
2. Open the license DB and copy the 17 digit registration key you
received to the column “Initial value”.
5. Transfer the changed blocks to the PLC. The registration key can be
set at runtime. A STOP -> RUN transition is not necessary.
Missing or Wrong When the registration key is missing or a wrong one is detected, the SF LED
Licensing (S7-300 and IM151-8) or the INTF LED (S7-400) of the CPU is flashing. A
cyclic error message regarding the missing license is displayed in the
diagnostic buffer, too. The error number of the missing license is
W#16#A090.
_____________________________________________________________
Warning
! The CPU will turn to STOP mode, if the OB121 is not available.
_____________________________________________________________
Online Help The SIMATIC Manager provides an online help for the function block
MODBUSPN. Mark the FB and press “F1” so that he online help is displayed.
It contains the main information on the FB.
Call of the FB For a correct program sequence the function block MODBUSPN has to be
called in 2 organization blocks:
OB100 Start-Up and Cyclic OB (OB1 or cyclic interrupt OB, e.g.
OB35)
The OB121 must be available in the CPU. You will find more information
regarding this matter in section 5 “Licensing“.
Start-up of the FB The function block MODBUSPN is unconditionally called once in OB100.
The initialization parameters must be set according to the station
configuration.
The initialization parameters are copied into the instance DB.
The runtime parameters are not evaluated during the start-up.
The values of the parameter data block MODBUS_PARAM are
evaluated.
OB121 If the block has not been licensed yet, the OB121 is called.
“Programming
Error”
____________________________________________________________
Warning
! The CPU will turn to STOP mode, if the OB121 is not available.
_____________________________________________________________
In this case, the calls of the FB MODBUSPN in the OB100 and in the OB1
receive the same instance DB for one connection. A different instance DB is
required for each additional connection.
Initiate Request A rising edge at the trigger input ENQ_ENR initiates a request. Depending on
S7 is Client the input parameters UNIT, DATA_TYPE, START_ADDRESS, LENGTH, TI
and WRITE_READ, a MODBUS request telegram is generated and sent to
the partner station via the TCP/IP connection. The client waits for the
parameterized monitoring time RECV_TIME for a response from the server.
When the monitoring time elapses (no response from the server), the
activated request is terminated with an error. A new request can be initiated.
After the receipt of the response telegram, a validity check is carried out. If
the result is positive, the necessary actions are taken and the request is
terminated without error. The output DONE_NDR is set. When an error is
recognized during verification, the request is terminated with an error, the
ERROR bit is set and an error number is returned at the output STATUS.
Activation of the With the signal TRUE at the trigger input ENQ_ENR, the FB is ready to
Function Block receive a request telegram from the client. The server remains passive and
S7 is Server waits for a telegram from the client. The received telegram is verified. If the
verification result is positive, the response telegram is sent. The completed
transmission is reported to the user by setting the DONE_NDR bit. At this
point, the completed function is indicated at the outputs UNIT, DATA_TYPE,
START_ADDRESS, LENGTH, TI and WRITE_READ.
An erroneous request telegram causes an error message and the ERROR bit
is set. The error number is returned in STATUS_MODBUS. The request of
the client is not executed. Depending on which error occurred, an exception
telegram is sent to the client.
General The parameters of the FB MODBUSPN can be divided into two groups:
Information
Initialization parameters
Runtime parameters
Initialization parameters are evaluated only during the call of OB100 and
are adopted into the instance DB. They are marked with “yes“ in the column
“INIT“ in the table displayed above.
A modification of the initialization parameters during run mode has no
impact. After a modification of these parameters (e.g. during the test phase),
the instance DB must be initialized again via a STOP RUN transition of
the PLC.
The output parameters are displayed dynamically, i.e. they are only
available for one PLC cycle. They have to be copied to an additional
memory area if you need to process them or to display the values in a VAT
(STEP7 variable table).
Range of Values For the range of values of the different parameters, PLC-specific restrictions
must be taken into consideration.
DB_PARAM The parameter DB_PARAM assigns the number of the data block
MODBUS_PARAM. This parameter data block includes the connection
parameters and the Modbus-specific parameters, which are necessary for the
communication between the PN PLC and the Modbus device.
The range of values for this parameter depends on the PLC. 0 cannot be
used as a DB number since it is reserved for system functions.
The parameter data block can contain a sequence of parameters for several
connections. It is also possible to use different parameter data blocks for
multiple connections.
RECV_TIME The monitoring time RECV_TIME observes the data input from the
communication partner. The shortest adjustable time is 20 ms.
REG_KEY The block MODBUSPN must be licensed for each CPU individually to permit
a correct program sequence.
With the registration key REG_KEY the block MODBUSPN is licensed and
the Modbus communication runs without any restraint.
LICENSED If this output is TRUE, then the Modbus block is licensed on this CPU. If the
output is FALSE, none or a faulty license string was entered.
BUSY If this output is TRUE, one of the T functions TCON, TDISCON, TSEND or
TRCV is running.
In the operating mode S7 is Client, the activated request was ended with an
error. The error number is displayed in the STATUS_MODBUS or
STATUS_CONN output.
STATUS_MODBUS When ERROR is TRUE, the STATUS_MODBUS output displays the error
number regarding the processing of Modbus telegrams. The error numbers
are described in section 8.
STATUS_CONN When ERROR is TRUE, the STATUS_CONN output displays the error
number regarding the processing of the T functions. The error numbers are
described in section 8 and in the STEP7 online help of the functions TCON,
TDISCON, TSEND and TRCV.
STATUS_FUNC This parameter shows the name of the function, which caused the error
occurred.
IDENT_CODE With the identification string IDENT_CODE you can order the registration
key. After start-up of the PLC an 18 character string is displayed.
UNIT The parameter UNIT, Unit Identifier, describes the unambiguous assignment
of the communication partner. If multiple serial devices are connected to a
TCP converter, it is required to address them by using their unique UNIT
number.
Coils B#16#1
Inputs B#16#2
Holding Register B#16#3
Input Register B#16#4
The different data types are related directly to the used function codes.
START_ADDRESS The parameter START_ADDRESS specifies the first MODBUS address that
is read or written.
LENGTH The parameter LENGTH specifies the number of MODBUS values that are
read or written.
For each telegram, all registers or bits have to be in the same DB.
The Transaction Identifier is used for the identification of telegrams and the
unambiguous allocation of the requests to the corresponding responds. The
FB MODBUSPN can only perform this function properly if the TI is changed
with each transaction. Only a change of the TI ensures a reliable operation of
the FB.
Holding Registers and Coils are readable and writeable. Inputs and Input
Registers are only readable.
Interpretation of The MODBUS data model is based on a series of storage areas with distinct
MODBUS Register properties. Some systems, e.g. MODICON PLCs, distinguish these areas by
Addresses the register or bit addresses. The Holding Register with offset 0, for example,
is called 40001 (memory type 4xxxx, reference 0001).
The FB MODBUSPN uses the register or bit address transferred for its
parameters start_x, end_x and START_ADDRESS. Therefore, it is possible
to use register or bit addresses from von 0000H to FFFFH for each function
code.
Address Mapping The following diagram shows a comparison of the SIMATIC memory area
and the Modbus-typical register oriented storage arrangement. The diagram
is based on the parameterization in the table above.
In Modbus device: The Modbus addresses printed in black refer to the Data
Link Layer and the ones printed in grey refer to the Application Layer.
In SIMATIC: The SIMATIC addresses in the first column are the offset in the
DB. Additionally, you can find the Modbus register numbers in the square
brackets.
0 00001
...
640 00641
641 00642
...
1250 01251
...
1700 01701
...
2300 02301
Inputs (from 10001) 2301 02302
0 10001
...
1700 11701
1701 11702 Input Register
(from 30001)
...
0 30001
2300 12301
1 30002
2301 12302
...
720 30721
721 30722
...
1000 31001
1001 31002
Holding Register
(from 40001)
0 40001
1 40002
...
499 40500
500 40501
501 40502
...
720 40721
...
900 40901
901 40902
Instance DB The function block MODBUS stores its data in an instance DB. This instance
DB is created by STEP7 when initially calling the FB.
The instance data block contains parameters of the types input, output and
input/output as well as static variables required for its execution. These
variables are remanent and keep their validity between FB calls. The
variables control the internal process flow of the FB.
Local Variables A total of max. 156 bytes of local data is needed for one FB MODBUSPN
call.
Parameter DB The connection- and Modbus-specific parameters are stored in the parameter
data block MODBUS_PARAM.
Standard FBs for The function block TCP_COMM, called by MOD_CLI and MOD_SERV, uses
Connection the blocks TCON and TDISCON of the standard library to establish and
Handling terminate the connection between the PLC and the communication partner.
Standard FBs for The function block TCP_COMM, called by MOD_CLI and MOD_SERV, uses
Data Transfer the blocks TSEND and TRCV of the standard library for the data transfer
between the PLC and the communication partner.
MODBUSPN: The FB MODBUSPN uses the following SFCs from the standard library:
SFCs for
SFC6 “RD_SINFO“
Miscellaneous
Functions SFC20 “BLKMOV”
SFC24 “TEST_DB”
SFC51 “RDSYSST”
SFC52 “WR_USMSG”
MOD_CLI and The FBs MOD_CLI and MOD_SERV use the following SFCs from the
MOD_SERV: standard library:
SFCs for
SFC20 „BLKMOV“
Miscellaneous
Functions SFC24 “TEST_DB”
TCP_COMM: The FB TCP_COMM uses the following SFB from the standard library in
SFCs for addition to the T-blocks:
Miscellaneous
SFB4 „TON“
Functions
Inducement If the numbers of the standard functions are already assigned within your
project or if the number interval is reserved for a different application (e.g.
CFC), it is possible to rename the internally called function blocks FB63,
FB64, FB65 and FB66 of FB TCP_COMM or the function blocks
MODBUSPN, MOD_CLI, MOD_SERV und TCP_COMM.
Behavior A set of rules concerning the function block numbering have to be considered
when rewiring function blocks in SIMATIC STEP 7 Manager:
If you want to rewire the blocks of the Modbus library, the following sequence
is required:
2. FB103 TCP_COMM
3. FB104 MOD_CLI
FB105 MOD_SERV
4. FB63 TSEND
FB64 TRCV
FB65 TCON
FB66 TDISCON
It is not necessary to rewire all blocks. Even if you want to rewire only some
of the blocks, you must follow the mentioned sequence.
1. Get the information about the used operand by clicking "Options >
Reference data > Display".
2. Set the operand priority in the object properties of the block folder to
"Absolute value".
3. Select the Blocks folder in the SIMATIC Manager and call the function
"Options > Rewire", in order to rewire the operands into free areas.
The modifications can be verified by clicking "Options > Reference data >
Display".
7 Additional Blocks
General The add-on offers the possibility to configure Modbus registers/bits in “data
collector FBs” instead of global DBs. The send buffer and receive buffer for
the values can be placed in the CFC chart per Drag & Drop.
Application - The data collector FBs are located in the CFC chart. The output “IDB” is
Sample connected to the DB parameters db_1 to db_8 of the parameter data block. In
CFC it is not possible to address an element in a STRUCT with the symbolic
name, so the absolute address of db_x needs to be entered, e.g.
MODBUS_PARAM.DBW68.
With this configuration the Modbus values can be connected directly from the
channel blocks to the data collector FB.
You can find the additional blocks and a detailed description here:
www.siemens.com/s7modbus or contact the Customer Support.
General By means of the block Job_List it is possible to generate a list of jobs, which
are executed cyclically.
Application -
Sample
You can find the additional block and a detailed description here:
www.siemens.com/s7modbus or contact the Customer Support.
8 Diagnosis
Diagnostic The diagnostic functions of the PN PLC enable a fast localization of errors.
Function The following diagnostic features are available:
Display Elements The display elements inform you about the operating mode or about the error
(LED) conditions of the PLC. The display elements provide an overview of internal
errors, external errors and interface-specific errors.
STATUS Outputs For an error diagnosis, the MODBUSPN function block has 3 STATUS
of the outputs.
FB MODBUSPN
When reading the STATUS_MODBUS output, you are provided with a
general indication of errors that occurred during the Modbus-specific telegram
processing.
The STATUS_CONN output displays status information and error codes with
regard to the processing of the T functions.
The output STATUS_FUNC shows the name of the function, which caused
the error at STATUS_MODBUS or STATUS_CONN.
When reading the STATUS outputs, you are provided with a general
indication of errors that occurred during the telegram processing and
connection handling. The STATUS parameters can be evaluated in the user
program.
Display Functions The display elements of the PLC provide information on the status of the
component. There are two types of display functions:
PN-CPU 400
- INTF Internal error
When this LED is flashing, the Modbus block has not been licensed yet.
You can find further information in section 5 “Licensing”.
Special Displays
3. db_x <> 0
Errors during start-up provoke the ERROR bit to remain set. In the cyclical
operation no requests are executed. A correction of the parameterization and
a STOP RUN transition of the PLC are necessary.
The monitoring time can also elapse if less data than specified in the
MODBUS telegram header is received. Subsequent errors with loss
of telegrams can occur.
Protocol identifier = 0
FC 5 or FC 6:
Echo in the respond is equal to the request
The monitoring time can also elapse if less data than specified in the
MODBUS telegram header is received. Subsequent errors with loss
of telegrams can occur.
Protocol Identifier = 0
For write requests, the length in the header, the number of registers
or bits and the byte count in the telegram must match.
PI <> 0
Length in the header does not match the length information in the
telegram
Error Messages of The FBs MODBUSPN, MOD_CLI and MOD_SERV use the standard
the Called SFCs functions SFC6, SFC20, SFC24, SFC51 und SFC52. The error messages of
and FBs these blocks are passed on to STATUS_MODBUS without any changes.
For further details on the error messages, please consult the diagnosis buffer
or the online help of the SIMATIC Manager.
A082 Only if S7 is client and function code 6: Verify the data of the
The received register value is not equal to the sent one. communication partner with the
help of a telegram trace.
9 Sample Application
The S7 programs are for information purposes only and are not to be
understood as a solution for a customer specific installation configura-
tion.
Example Project On the CD you can find an extensive example project which offers all
on the CD varieties of parameterization possibilities for the Simatic stations.
Simatic Station is S7-300, S7-400 or IM 151-8 PN/DP CPU
Simatic Station is client or server
Overview
Used Blocks This block numbers are used in the provided example project.
Overview
Used Blocks The following blocks are used in the provided sample project.
http://www.modbus.org
http://www.siemens.com/s7modbus