You are on page 1of 62

SIMATIC S7 - OPEN MODBUS / TCP Communication via the integrated PN interface of the PLC

Manual

Preface, Table of Contents Product Description Getting Started

1 2 3 4 5 6 7 8

SIMATIC S7
Commissioning

S7 OPEN MODBUS / TCP Communication via the integrated PN interface of the PLC
Manual

Parameterization Licensing FB MODBUSPN Diagnosis Sample Application Appendices Literature Glossary

Edition 2.1

Safety Precautions and Warnings

This manual contains warnings, which you should note for your own safety as well as for the prevention of damage to property. These warnings are indicated by means of a warning triangle and are displayed as follows in accordance with the level of danger: __________________________________________________________________
Danger indicates that loss of life, severe personal injury or substantial damage will result if proper precautions are not taken.

__________________________________________________________________ __________________________________________________________________
Warning indicates that loss of life, severe personal injury or substantial damage can result if proper precautions are not taken.

__________________________________________________________________ __________________________________________________________________
Caution indicates that minor personal injury or property damage can result if proper precautions are not taken.

__________________________________________________________________ __________________________________________________________________
Note represents an important information especially significant to the product, handling of the product or a specific part of this documentation.

__________________________________________________________________
Qualified Personnel The start-up and the operation of the device may only be carried out by qualified personnel. Qualified personnel in the sense of the security advices of this manual are any persons authorized to commission, ground and label devices, systems and electric circuits. Please note: _________________________________________________________________________ Warning This device may only be used for applications as prescribed in the catalogue and the technical description. Furthermore, they may only be used in conjunction with third-party devices and components recommended and authorized by Siemens. A successful and safe operation of this product is depends on proper transport, and correct storage, installation and assembly as well as careful operation and maintenance.

Use as prescribed

SIMATIC and SIMATIC NET are registered trademarks of SIEMENS AG. Trademarks Since any other brand names in this manual may refer to trademarks, the use of these names by third parties for their own purposes may infringe the rights of the owner.

®

®

Copyright © Siemens AG 2008 All Rights Reserved
Passing on and reproducing this document as well as using and disclosing its contents is prohibited unless an explicit permission is given. Offenders will be liable for damages. All rights reserved, especially in the case of patent grant or registration of a utility model or design. Siemens AG Industry Sector Engineering and Construction I IS IN E&C P.O. Box 3240, D- 91050 Erlangen IT4.Industry@siemens.com

Exclusion of Liability
We have checked the contents of this document with regard to its conformity with the described hardware and software. Deviations, however, cannot be excluded. Therefore, we cannot guarantee its complete conformity. The information in this document is checked regularly and necessary corrections are contained in subsequent versions. We will be grateful for any suggestions for improvement. Technical data subject to change.

Manual edition 2.1 1 .1 3. commissioning etc. Additional Sources of Information All additional information concerning PN PLCs and IM 151-8 PN/DP CPU (Startup.) can be found in the manuals SIEMENS SIMATIC S7-300 CPU 31xC and CPU 31x: Installation Operating Instructions A5E00105491-07 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.1 3.1 1.0 Note This manual contains the FB description valid at the time of publication.Preface Preface Purpose of the Manual The information in this manual allows you to set up and put in operation the connection between a PLC with integrated PN interface and a device that supports the Open MODBUS/TCP protocol. The manual contains the following topics: • Production description • Getting Started • Commissioning • Parameterization • Licensing • Function block MODBUSPN • Diagnosis • Sample application Contents of the Manual Scope of this Manual This manual is valid for the following software: Product OPEN MODBUS/TCP FB 102 “MODBUSPN” FB 103 “TCP_COMM” FB 104 “MOD_CLI“ FB 105 “MOD_SERV“ Identification number 2XV9 450-1MB02 From version 2.0 1. This manual describes the function of the Modbus function block and its parameterization.

6ES7315-2FH13-0AB0 CPU317-2 PN/DP. 6ES7315-2EH13-0AB0 CPU315F-2 PN/DP. 6ES7318-3EL00-0AB0 CPU319F-3 PN/DP. CPU Specifications Manual A5E00850746-06 SIEMENS SIMATIC Distributed I/Os ET 200S Interface Module IM151-8 PN/DP CPU Manual A5E02049033-01 SIEMENS Product Information on CPU315-2 PN/DP. Technical Specifications Manual A5E00105474-07 SIEMENS SIMATIC S7-400 Automation System S7-400 Hardware and Installation Operating Instructions A5E00850740-01 SIEMENS SIMATIC S7-400 S7-400 Automation System. Manual edition 2. 6ES7317-2EK13-0AB0 CPU317F-2 PN/DP. 6ES7317-6FF03-0AB0 CPU319-3 PN/DP..1 2 . 6ES7317-2FK13-0AB0 CPU317-2 DP. SIEMENS SIMATIC Software System software for S7-300/400 System and standard functions Reference manual C79000-G7000-C503-02 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. 6ES7318-3FL00-0AB0 A5E01103134-03 Additional information concerning STEP7 can be found in the following manuals: SIEMENS SIMATIC Software Base software for S7 and M7 STEP7 user manual C79000-G7000-C502-.Preface SIEMENS SIMATIC S7-300 CPU 31xC and CPU 31x. 6ES7317-2AJ10-0AB0 CPU317F-2 DP.

319.1 3 . The descriptions apply to PN PLCs of series 315. Terminology Scope of Application MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Manual edition 2. The function block described in this manual establishes a connection between a PN PLC and third-party MODBUS devices. 317.Preface Additional Questions For further questions regarding the use of the FBs described in this manual. please contact your Siemens partner who provided you with this function block. 414 and 416 as well as IM 151-8 PN/DP CPU. This document uses the term PN PLC.

...................................................... 7-6 Diagnosis Messages of Called Blocks .. 4-1 4.................3 7................................ 7-12 8 A Sample Application........................................................... 6-15 Renaming Standard Functions ................ 7-12 Diagnosis Messages of SFC24 .2 2 3 Field of Applications......... 7-3 Diagnosis Messages of the FB MODBUSPN.....................................................................................4 6...................3 6... 3-2 Insertion of the Function Blocks into the Program..............................................................................................................2 3............................................................................................ 6-1 Parameters of the Function Block MODBUSPN ..................... 3-1 PLC – Assigning the IP Address .............1 7..............................................2 6................................................................................ 2-1 Commissioning ........................1 3..............................................................................................................................................................................................................................................1 1...................................... 1-1 1................................................................................................................................................... Manual edition 2........................................................................................2 Parameterization with the Wizard......... 6-5 Example of Address Mapping.......................................... 6-12 Data and Standard Functions used by the FB ............. 7-2 Verification by the FB MODBUSPN.................................... 1-1 Hardware and Software Prerequisites............................ 6-16 7 Diagnosis ...........................................................................................................................................................................................................2 7.......................................... 4-2 Editing the Parameterization ..............................................................................Table of contents Table of Contents 1 Product Description........................ 1-1 Getting Started ...............3 Installing the Library on the STEP7 PG/-PC .....................1 .............. 1 i MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.......5 Functionality of the FB ............................. 4-3 5 6 Licensing ................................................1 4................5 Diagnosis via the Display Elements of the PLC ..............1 6...................... 7-1 7....................... 5-1 Function Block MODBUSPN ...................... 3-1 3. 6-1 6.......................... 8-1 Literature................................................... 3-4 4 Parameterization of the Modbus Communication ................4 7........................................

2 Hardware and Software Prerequisites The function blocks have been tested on the PLCs with the product identifications CPU315-2 PN/DP CPU317-2 PN/DP CPU319-3 PN/DP CPU414-3 PN/DP CPU416-3 PN/DP IM151-8 PN/DP 6ES7315-2EG10-0AB0 6ES7317-2EK13-0AB0 6ES7318-3EL00-0AB0 6ES7414-3EM05-0AB0 6ES7416-3FR05-0AB0 6ES7151-8AB00-0AB0 Usable Modules You can find the latest hardware prerequisites on the internet: www. the protocol uses the port 502. Software Versions The usage of the FB MODBUSPN is possible with STEP7 Version 5.com/s7modbus. Manual edition 2.Product description 1 Product Description 1. during the data transmission. The PLC only allows a one-time use of a specific port number. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. communication link is established between a Simatic PLC with integrated PN interface and a device that supports the Open MODBUS/TCP protocol.4 SP4 or higher. 1. a client and a server.1 Field of Applications The function block described here is a software product for PLCs with integrated PN interface of Simatic S7-300. The SIMATIC S7 can act as both. Use of Port Number 502 In general. a 414 CPU or a 416 CPU with the corresponding firmware version. an IM 151-8 PN/DP CPU. Data transmission is carried out in accordance with the client-server principle. You can find further information about the released port numbers in the relevant manual of your PLC.siemens. This port number has not been released for all PN PLCs yet and is only possible when using a 319 CPU. Therefore the PLC/FB cannot be addressed simultaneous from different devices on the same port number. S7-400 and IM 151-8 PN/DP CPU. Placement in the System Environment Function of the FBs With these function blocks.1 1-1 .

The FB MOD_CLI requires 11184 byte work memory and 12054 byte load memory.1 1-2 . The FB MOD_SERV requires 10660 byte work memory and 11452 byte load memory. Manual edition 2. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.Product description Memory requirements The FB MODBUSPN requires 6048 byte work memory and 7294 byte load memory. The FB TCP_COMM requires 1880 byte work memory and 2224 byte load memory.

=> Section 5 .1 and 4. etc.2 6.Getting started 2 Getting Started 1. Parameterize the Parameter-DBs MODBUS_PARAM regarding your requirements (client/server.). => Section 4.1 5. => Section 6.2 3. register numbers.).1 2-1 . Install “OpenModbusTCP PN CPU“ and insert the Modbus function blocks into your SIMATIC project. Parameterize the connection parameters regarding your requirements (IP-address.3 2. Procedure MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. DB numbers. Manual edition 2. etc. => Section 6. connect at start-up. => Section 3.1 and 4.1 to 3. port number. Load the user program into the PLC and license the Modbus block for this CPU. Parameterize the Modbus block for initialization and runtime. => Section 4. Call the Modbus block FB102 in the required OBs.2 4.

Manual edition 2. names and directories might be different. General Information Requirements 3. The manual can be accessed via short cut under \Program Files \Siemens\ Documentation as well. Follow the step-by-step the instructions which are displayed by the installation program. • the sample project in \Program Files\Siemens\Step7\Examples. In later versions. In the Windows Explorer.EXE to start the installation. If the installation program does not start automatically. \Program Files\Siemens\Step7\S7manual\S7Comm. Now you can find • the library in • the manual in \Program Files\Siemens\Step7\S7libs. What We Provide Requirements Installation STEP7 has to be installed. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. To initially access the Modbus library. the sample projects and the manuals in English and German in the corresponding STEP7 directories. please proceed as follows: 1. • the software registration form in \Program Files\Siemens\Step7\S7libs\Modbus_PN_CPU.4 SP4.1 3-1 . The manuals are also available as PDF files on CD. Double-click on the setup directory and then on Setup.1 Installing the Library on the STEP7 PG/-PC The attached CD contains a setup which installs the library “Modbus_PN_CPU”.Commissioning 3 Commissioning The information below on STEP7 refers to Version 5. 2. navigate to the CD ROM drive. Insert your Modbus CD into the CD ROM drive and follow step-by-step the instructions which are displayed automatically by the installation program. the sequences. use the browse function of the “Open” dialog for libraries. Knowledge of AWL and basic knowledge of STEP7 and PLC is required.

you can assign an IP address in the Ethernet to this physical address. Ethernet.2 PLC – Assigning the IP Address Each node on the Ethernet network is identified by an internationally unique address. A double click on line X2 opens the object properties dialog of Ind.1 3-2 . In this example. Open HWConfig The PLC 317-2 PN/DP is inserted in slot 2 and the properties dialog box of the PN-IO interface X2 is mapped. 2. 1. Manual edition 2. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. it is necessary to create a new S7 project with STEP7. This so-called MAC address is preset by the manufacturer and cannot be changed. a PLC 317-2 PN/DP is inserted.Commissioning 3. Introduction Procedure Before the configuration. Following the steps below.

Manual edition 2. Result: The properties window of Ethernet interface X2 for PLC 317-2 PN/DP closes. Result: You created a new Industrial Ethernet subnet. Click on "New" to assign a name for a new Industrial Ethernet subnet. 4. Confirm your entries with "OK". enter the address of the router as well. Click on the "OK" button. 5.Commissioning 3. Enter the IP address and the subnet mask.1 3-3 . MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. To establish a connection via a router.

Blocks of the Standard Library The following blocks are required for the Modbus communication: • • • • TSEND (FB63) TRCV (FB64) TCON (FB65) TDISCON (FB66). They can be inserted into your project for assistance purposes. You can find this function in „Standard Library IEC Function Blocks“. They have to be inserted into your project. Additionally. Please note that the following versions of the FBs are a prerequisite for the faultless function of the FB MODBUSPN: TSEND TRCV TCON TDISCON V2. Manual edition 2.3 or higher V2.1 or higher Furthermore the block FC10 EQ_STRNG is necessary.3 Insertion of the Function Blocks into the Program The following blocks are required for the Modbus communication: • • • • MODBUSPN MOD_CLI MOD_SERV TCP_COMM Content of the MODBUS library The blocks have to be copied from the library into your project. You can find these blocks in Standard Library Communication Blocks.Commissioning 3.1 or higher V2. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.2 or higher V2.1 3-4 . the library contains the parameter data block MODBUS_PARAM as a draft.

At first the connection parameters are defined. For each logical connection. The maximal number of coexistent connections depends on the PLC. Manual edition 2. It is also possible to use a separate parameter data block for each connection.0 +714.0 Connection 1: Connection parameters Connection 1: Modbus parameters END_STRUCT STRUCT +650. A prepared structure is part of the library “MODBUS_PN_CPU” and can be used as a sample.1 4-1 .. STRUCT 650*i 650*i+64 Connection i+1: Connection parameters (65+i) Connection i+1: Modbus parameters END_STRUCT MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02... subsequently. .Parameterisation of the Modbus Communication 4 Parameterization of the Modbus Communication For the communication via the integrated PN interface of the PLC. For each additional connection. a separate structure is required. the parameter data block must be expanded by or a new data block created with the structure for connection parameters and the Modbus parameters. The parameter data block can contain parameter information of all defined connections.0 +64. Structure of DB MODBUS_PARAM: Address Name STRUCT +0. This structure contains the connection parameters of both communication partners and the Modbus parameters.. General Information Connection Description DB MODBUS_PARAM The parameters to establish a connection and to execute the Modbus communication are defined as a structure in a parameter DB called MODBUS_PARAM. a network configuration in NetPro is not necessary. The connections are established and terminated by means of the function blocks TCON (FB65) und TDISCON (FB66).0 Connection 2: Connection parameters Connection 2: Modbus parameters END_STRUCT . the Modbus parameters are defined. Several connections to different communication partners can be parameterized and established at the same time.

Otherwise it becomes impossible to set up a connection. the used local interface and the IP address of the communication partner.com/WW/view/en/31535566.1 4-2 . There are two alternatives for a parameterization of the connection and Modbus parameters. Modbus Parameters The Modbus parameters define the mode of communication and the address reference. Alternatives for Parameterization 4. The complete structure (connection parameters and Modbus parameters) is created. The second possibility is to edit the parameters in the structure in the data block with the editor of STEP7. .Parameterisation of the Modbus Communication Connection Parameters The parameters of the connection are defined in the first block. The first one is to use a Wizard.2.2. The structure of the parameter DB has to remain unchanged to ensure proper communication. Manual edition 2.1 and 4. e. It is recommended to use the wizard for the parameterization of the block MODBUS_PARAM.g. The two opportunities are described in detail in the following sections 4.automation. A detailed structure can be found in section 4. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. how many register or bit areas are mapped to which DB or the differentiation between the S7 acting as server or as client.siemens. The structure of the connection parameter block is obligatory und may not be changed. e.1 Parameterization with the Wizard With the wizard Modbus TCP Wizard you can easily parameterize the connection parameters as well as the Modbus parameters in the parameter data block MODBUS_PARAM. which offers an easy way to setup the connection parameters.g. General Information You can find the wizard at http://support. The functions TCON and TDISCON can establish and terminate a connection by means of these parameters.

1 4-3 . It is necessary to restart the PLC after the modification of MODBUS_PARAM. This ID must be unique within the complete parameter data block and has to be parameterized during the call of FB MODBUSPN. Fixed value: W#16#40 id A connection ID is assigned to each logical connection.Parameterisation of the Modbus Communication 4. If the number is already used. Manual edition 2. Procedure Structure of and Adaption of Connection Parameters For each logical connection one structure is required. rename the DB.2 Editing the Parameterization Copy DB2 of the library Modbus_PN_CPU and insert them in your project. TSEND. It is used for the internal calls of the T blocks (TCON. Value range: W#16#1 to W#16#FFF MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. block_length This parameter describes the length of the connection parameters and must not be changed. The parameter of data block MODBUS_PARAM must not be changed during runtime. TRCV and TDISCON).

Manual edition 2. the IP address of the communication partner. You can find further information on the internet: http://support. Active connection establishment: Passive connection establishment: 0 2 rem_subnet_id_ len rem_staddr_len This parameter is currently not used.3 B#16#11 with CPU315 and 317 >= FW V2.com/WW/view/en/24294554 active_est This parameter defines the way the connection is established (active or passive). The length of rem-staddr. Unspecified connection: Specified connection: B#16#0 B#16#4 rem_tsap_id_len This parameter defines the length of rem_tsap_id. CPU 319. It is used by the function TCON when establishing the connection. no IP address is required for the partner. The following values are necessary with the different PLC types.Parameterisation of the Modbus Communication connection_type The structure of the connection is defined here.automation. the port number of the remote communication partner. IM 151-8 PN/DP CPU. It is recommended that the Modbus client performs an active connection establishment while the Modbus server establishes passive connections. Active connection establishment: Passive connection establishment: local_device_id TRUE FALSE The local_device_id defines the IE interface of the used PN PLC. Active connection establishment: Passive connection establishment: 2 0 next_staddr_len This parameter defines the length of next_staddr as the distinction between the communication running via an external CP or via the integrated PN interface of the PLC. The value depends on the PLC. PN interface of the PLC: B#16#0 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. TCP (compatibility mode): TCP: B#16#01 with CPU315 and 317 <= FW V2.e. is defined here.siemens. Please assign the value B#16#0. CPU 414 and CPU416 The values vary depending on the used firmware.1 4-4 .4. IM 151-8 PN/DP CPU CPU315 or 317 CPU319 CPU414 or CPU416 B#16#1 B#16#2 B#16#3 B#16#5 local_tsap_id_len The length of the parameter local_tsap_id (= local port number) is defined here. i. If an unspecified connection is to be used.

The port number has to be unique within the PLC. rem_staddr[4] = B#16#01 (1). rem_staddr[3] = B#16#00 (0). MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. rem_staddr[4] = B#16#C0 (192).1: With connection_type B#16#01 rem_staddr[1] = B#16#01 (1). Please assign the value B#16#0.168.0.1 4-5 . When using the integrated PN interface of the PLC. Example: IP address 192. rem_staddr[2] = B#16#A8 (168). rem_staddr[5-6]= B#16#00 (reserved) rem_tsap_id This parameter defines the remote port number. The value range depends on the PLC. With connection_type B#16#01 local_tsap_id[1] low byte of the local port number in hexadecimal local_tsap_id[2] high byte of the local port number in hexadecimal local_tsap_id[3-16] B#16#00 With connection_type B#16#11 local_tsap_id[1] high byte of the local port number in hexadecimal local_tsap_id[2] low byte of the local port number in hexadecimal local_tsap_id[3-16] B#16#00 rem_subnet_id rem_staddr This parameter is currently not used. Manual edition 2. no IP address has to be entered. The value range depends on the PLC. rem_staddr[5-6]= B#16#00 (reserved) With connection_type B#16#11 rem_staddr[1] = B#16#C0 (192). next_staddr[1-6] B#16#00 spare Reserved. assign 0 to this parameter. The representation depends on the parameter connection_type. With connection_type B#16#01 local_tsap_id[1] low byte of the remote port number in hexadecimal local_tsap_id[2] high byte of the remote port number in hexadecimal local_tsap_id[3-16] B#16#00 With connection_type B#16#11 local_tsap_id[1] high byte of the remote port number in hexadecimal local_tsap_id[2] low byte of the remote port number in hexadecimal local_tsap_id[3-16] B#16#00 next_staddr This parameter defines rack and slot of the corresponding CP. The representation depends on the parameter connection_type. the IP address of the remote communication partner is defined. rem_staddr[2] = B#16#00 (0). assign 0 to this parameter.Parameterisation of the Modbus Communication local_tsap_id This parameter defines the local port number. In this array of bytes. rem_staddr[3] = B#16#A8 (168). When an unspecified connection is used. The representation depends on the parameter connection_type.

1 4-6 . Manual edition 2.Parameterisation of the Modbus Communication Adaption of the Modbus Parameters The Modbus parameters in the block MODBUS_PARAM define the mode of operation of the Modbus communication and the address reference of Modbus addresses and SIMATIC addresses. single_write MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. With single_write = FALSE all write requests use the function codes 15 and 16. server_client TRUE: S7 is server FALSE: S7 is client In operating mode “S7 is client” and single_write = TRUE write requests with length 1 are carried out with the function codes 5 and 6.

Depending on the type of request. these memory areas are read or written. FALSE: establish connection when ENQ_ENR=TRUE TRUE: establish connection immediate after PLC start-up When connect_at_startup = TRUE. At least the first data area has to be defined. It is possible to map more Modbus values (registers or coils) in one data block than could be processed with one telegram. Even if consecutive register numbers or coils are located in two different DBs. the first request should be started after the connection was established (CONN_ESTABLISHED = TRUE) or an error has been reported respectively (ERROR =TRUE).1 4-7 .Parameterisation of the Modbus Communication connect_at_ startup This parameter defines the point in time at which the connection is being established. db_x DB-Number 1 . 8 Data Areas 8 data areas are available to map the Modbus addresses in the S7 storage. If data_type_x set to 0. This has to be taken into account during the parameterization. only one DB can be accessed. The other 7 data areas are optional.65535 (W#16#0001 to W#16#FFFF) MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. With one request. two requests are necessary to access them both. 0 cannot be used as DB number since it is reserved for system functions. Manual edition 2. this data area is not used Identifier 0 1 2 3 4 Data type Area not used Coils Inputs Holding Register Input Register Bit Bit Word Word Size db_x The parameter db_x defines the number of the data block in which the consecutively defined MODBUS registers or bits are mapped. data_type_x The parameter data_type_x defines the MODBUS data type which is to be mapped with this definition.

Parameterisation of the Modbus Communication

start_x end_x

Start_x specifies the first register or bit address, which is stored in the data element 0 of the DB. End_x defines the of the last MODBUS address. When accessing registers, the number of the data element of the S7 DB in which the last register is mapped, can be calculated with the following formula: DBW number = (end_x – start_x) ∗ 2 When accessing coils or inputs, the number of the data element of the S7 DB in which the last bit is mapped, can be calculated with the following formula: DBB number = (end_x – start_x +7) / 8 The defined memory areas must not overlap. The parameter end_x must not be smaller than start_x. In case of an error occurring, the initialization of the FB is stopped with an error. When start_x is equal to end_x, one Modbus address (1 register or 1 bit) is allocated. In section 6.3 you can find an example of the mapping of the MODBUS addresses to S7 memory areas. start_x, end_x MODBUS address

0 to 65535 (W#16#0000 to W#16#FFFF)

internal_send_ buffer internal_recv_ buffer

This array is used internally for message data within the FB. Accessing or changing the array is inadmissible. This array is used internally for the received data within the FB. Accessing or changing the array is inadmissible.

MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02; Manual edition 2.1

4-8

Licensing

5

Licensing
The block MODBUSPN must be licensed for each CPU individually. The licensing takes place in two steps: reading the IDENT_CODE and declaring the registration key REG_KEY. To read the IDENT_CODE please proceed as follows: 1. Parameterize the block in the cyclic OB (OB1 or cyclic interrupt OB), in OB100 and OB121 according to your requirements. Transfer the program to the PLC and turn it to RUN mode. 2. Open the instance DB of the block MODBUSPN. „Data block“ -> „Open Online“ to open the DB. Monitoring the block via the button is insufficient.

General

Read the IDENT_CODE

MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02; Manual edition 2.1

5-1

Licensing

3. The output IDENT_CODE shows an 18 character string. Copy this string per copy/paste from the DB und and insert it in the form IT4Industry SOFTWARE REGISTRATION FORM. This form is stored in the library path ..\Program Files\Siemens\Step7\S7LIBS\Modbus_PN_CPU during installation and is also available on the installation CD. Insert the License-No. of the product package into the form.

4. Please send the form per e-mail to IT4Industry it4.industry@siemens.com. Hereupon you will receive the registration key for your PLC.

MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02; Manual edition 2.1

5-2

Assign the value “DB3. Copy the prepared license block DB3 of the library “Modbus_PN_CPU“ into your project. Transfer the changed blocks to the PLC. 2. Open the data block in the SIMATIC manager with the editor in the declaration view. The block is now licensed for this CPU. If the DB number is already used in your project. The registration key can be set at run time.REG_KEY” to the parameter REG_KEY of the block MODBUSPN. 5. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Please proceed as follows to declare the registration key REG_KEY: 1. A STOP -> RUN transition is not necessary. Choose in the menu “Edit > Initialize Data Block” – all values of the column “initial value” are copied to “actual values”. 3. Manual edition 2. Declare the registration key in the data block as “initial value” to avoid a repeated insertion after reloading the PLC. The registration key REG_KEY should be stored in a global DB. 4.1 5-3 .Licensing Declaration of the Registration Key REG_KEY The registration key REG_KEY must be declared for each call of the block MODBUSPN. rename the license DB. Via this global DB all MODBUSPN blocks can receive the registration key (See also the following example). Open the license DB and copy the 17 digit registration key you received from IT4industry to the column “Initial value”. Change over to the data view via the menu “View” -> “Data View”.

The error number of the missing license is W#16#A090.1 5-4 . A cyclic error message regarding the missing license is displayed in the diagnostic buffer too. _____________________________________________________________ Modbus communication is carried out even with a missing or wrong registration key. Manual edition 2. _____________________________________________________________ Warning ! The CPU will turn to STOP mode. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. if the OB121 is not available. please check if the FC “EQ_STRING” is copied into the project. If this error code is shown although the registration key has been inserted.Licensing Missing or Wrong Licensing When the registration key is missing or a wrong one is detected. but the output STATUS_MODBUS is set to W#16#A090 “no valid license”. The entry in the diagnostic buffer is carried out by means of OB121 “Programming Error”. the SF LED (S7-300 and IM151-8) or the INTF LED (S7-400) of the CPU is flashing.

The blocks provide the following functions: • • • • • • • • Connection and data handling by means of T blocks of the standard library Generation of MODBUS-specific telegram header before sending Verification of the MODBUS-specific telegram header when receiving Verification whether the memory areas requested by the client exist Generation of exception telegrams when errors occur (only when S7 is in server mode) Data transfer to and from the parameterized DB Time monitoring of the data reception as well as connection establishment and termination Verification of the registration key General Information Online-Help The SIMATIC Manager provides an online help for the function block MODBUSPN. Mark the FB and press “F1” so that he online help is displayed.1 Functionality of the FB The function block MODBUSPN enables a communication between a PLC with integrated PN interface and a partner which supports Open MODBUS/TCP. 4.1 6-1 . Manual edition 2. the block MOD_SERV executes the function of Modbus server and the block TCP_COMM handles the connection management. The block MODBUSPN calls the blocks MOD_CLI (FB104) and MOD_SERV (FB105) internally. It contains the main information on the FB. Depending on the parameterization. 15 and 16 are supported.Function Block MODBUSPN 6 Function Block MODBUSPN 6. The block MOD_CLI comprises the function of Modbus client. the functionality multitasking in the sense of the MODBUS specification is not implemented. the FB can be operated either in client or in server mode. 6. The function codes 1. 2. 5. In the server operating mode. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. 3.

The runtime parameters are not evaluated during the start-up. the functions of the function block are activated. In the cyclical operation mode. The values of the parameter data block MODBUS_PARAM are evaluated. Start-up of the FB The function block MODBUSPN is unconditionally called once in OB100.g.Function Block MODBUSPN Call of the FB For a correct program sequence the function block MODBUSPN has to be called in 3 organization blocks: • OB100 Start-Up • OB121 Programming Error • Cyclic OB (OB1 or cyclic interrupt OB. which points out that the registration key is missing. _____________________________________________________________ The call of MODBUSPN in OB121 executes an entry in the diagnostic buffer. You will find more information regarding this matter in section 5 “Licensing“. The initialization parameters are copied into the instance DB. if the OB121 is not available. MOD_SERV and TCP_COMM must not be called additionally in an organization block. the OB121 is called. OB35) The subordinate blocks of the Modbus library MOD_CLI. • • • Corresponding to the runtime parameters. e. Cyclical Operation of the FB In case of cyclical operation. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. A coexistent call of FB MODBUSPN in OB1 and a cyclic interrupt OB. If the block has not been licensed yet. Manual edition 2.g. the FB MODBUSPN is called in OB1 or in a cyclic interrupt OB. While a request is being processed. OB35 is not permissible. • • • • The initialization parameters must be set according to the station configuration. The Modbus block must be called in OB121. OB121 “Programming Error” The block MODBUSPN must be called in OB121 with the same instance DB as in the start-up OB and the cyclic OB. changes to the runtime parameters are ignored. e.1 6-2 . The LED SF or INTF of the CPU flashes simultaneously. _____________________________________________________________ Warning ! The CPU will turn to STOP mode. initialization parameters are ignored.

With a parameter of the connection parameter block (active_est). To ensure a proper operation and data transfer.1 6-3 . During runtime the function TCON establishes the connection to the communication partner for both types of connections. Multiple Communication Partners A PN PLC can establish multiple connections to various communication partners. The relevant information is read from the connection parameters of DB MODBUS_PARAM. The termination of the connection is defined with the parameter DISCONNECT of FB MODBUSPN. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. the calls of the FB MODBUSPN in the OB100. It is recommended explicitly that the Modbus client executes the active establishment. A different instance DB is required for each additional connection. The point in time at which the connection is established is defined in DB MODBUS_PARAM (parameter connect_at_startup). a strict division of the different connections to the corresponding communication partners is inevitable.Function Block MODBUSPN Connection Handling Active connection establishment can be carried out by the Modbus client as well as the Modbus server. active and passive. OB121 and in the OB1 receive the same instance DB for one connection. there are the following requirements for each connection: • • • • one connection parameter block and the related Modbus parameter in DB MODBUS_PARAM call of FB MODBUSPN in OB100 call of FB MODBUSPN in OB121 call of FB MODBUSPN in OB1 or cyclic interrupt OB In this case. Manual edition 2. it is possible to define whether the PLC performs active or passive connection establishment. Correspondingly.

A new request can be initiated. The client waits for the parameterized monitoring time RECV_TIME for a response from the server. the necessary actions are taken and the request is terminated without error. the ERROR bit is set and an error number is returned at the output STATUS.1 6-4 . The request of the client is not answered. The server remains passive and waits for a telegram from the client. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. a validity check is carried out. After the receipt of the response telegram. If the verification result is positive. the completed function is indicated at the outputs UNIT. TI and WRITE_READ. Depending on the input parameters UNIT. the FB is ready to receive a request telegram from the client. The completed transmission is reported to the user by setting the DONE_NDR bit. At this point. START_ADDRESS. the activated request is terminated with an error. The error number is returned in STATUS_MODBUS. When the monitoring time elapses (no response from the server).Function Block MODBUSPN Initiate Request S7 is Client A rising edge at the trigger input ENQ_ENR initiates a request. The received telegram is verified. The output DONE_NDR is set. DATA_TYPE. the request is terminated with an error. An erroneous request telegram causes an error message and the ERROR bit is set. LENGTH. TI and WRITE_READ. a MODBUS request telegram is generated and sent to the partner station via the TCP/IP connection. If the result is positive. When an error is recognized during verification. the response telegram is sent. DATA_TYPE. Manual edition 2. LENGTH. START_ADDRESS. Activation of the Function Block S7 is Server With the signal TRUE at the trigger input ENQ_ENR.

Manual edition 2. depending on PLC T#20ms to T#+24d20h31 m23s647ms T#20ms to T#+24d20h31 m23s647ms yes no CONN_TIME IN TIME Monitoring Time: wait for establishing or termination of the connection Shortest adjustable time: 100 ms. TSEND or TRCV) Job processing No job processing active TRUE FALSE no TRUE FALSE TRUE FALSE TRUE FALSE no no BUSY OUT BOOL CONN_ ESTABLISHED DONE_NDR OUT BOOL OUT BOOL Connection established Connection terminated S7 is Client: TRUE: Active request finished without errors S7 is Server: TRUE: Request from the client was executed and answered MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. must be identical to the associated parameter in the local connection description Value range 1 to 4095 W#16#1 to W#16#FFF Parameter ID Init yes DB_PARAM RECV_TIME IN IN BLOCK_ Number of the parameter DB DB TIME Monitoring Time: wait for data from communication partner Shortest adjustable time: 20 ms.2 Parameters of the Function Block MODBUSPN Decl. no KEEP_ALIVE ENQ_ENR IN IN TIME BOOL Not used S7 is Client: Initiate request at positive edge S7 is Server: Ready to receive at TRUE signal TRUE FALSE no DISCONNECT IN BOOL S7 is Client: TRUE: connection is terminated after reception of response S7 is Server: TRUE: connection is terminated when ENQ_ENR = FALSE TRUE FALSE no REG_KEY LICENSED IN STRING [17] Registration key to activate the license Character no no OUT BOOL License state of the function block: Block is licensed Block is not licensed Operating state of the T functions (TCON. Type IN WORD Description Connection ID.Function Block MODBUSPN 6.1 6-5 . TDISCON.

TDISON) Name of the function. OUTPUT if in SERVER mode) Number of values to be processed (INPUT if in CLIENT mode. Type OUT BOOL Description An error has occurred No error has occurred Value range TRUE FALSE 0 to FFFF 0 to FFFF Init no STATUS_ MODBUS STATUS_ CONN STATUS_FUNC OUT WORD OUT WORD Error number for protocol errors when evaluating a Modbus telegram Error number for connection errors during execution of the T blocks (TCON. which causes the error at STATUS_MODBUS or STATUS_CONN Identification for licensing Please order your license with this identification string. Manual edition 2. TSEND. TRCV. OUTPUT if in SERVER mode) no WRITE_ READ TRUE FALSE no MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. OUTPUT if in SERVER mode) Data type to be accessed: (INPUT if in CLIENT mode. OUTPUT if in SERVER mode) Write access or Read access (INPUT if in CLIENT mode. OUTPUT if in SERVER mode) Coils Reading function Writing function Inputs Reading function Holding Register Reading function Writing function Input Register Reading function no no 1 to 2000 1 to 800 1 to 2000 1 to 125 1 to 100 1 to 125 0 to 65535 W#16#0 to W#16#FFFF TI IN/ WORD OUT IN/ BOOL OUT Transaction Identifier (INPUT if in CLIENT mode.Function Block MODBUSPN Parameter ERROR Decl.1 6-6 . Unit identification (INPUT if in CLIENT mode. OUTPUT if in SERVER mode) Coils Inputs Holding registers Input registers no no OUT STRING [8] OUT STRING [18] IN/ BYTE OUT IN/ BYTE OUT Character no IDENT_CODE Character no UNIT 0 to 255 B#16#0 to B#16#FF no DATA_TYPE no 1 2 3 4 0 to 65535 W#16#0000 to W#16#FFFF START_ ADDRESS LENGTH IN/ WORD OUT IN/ WORD OUT MODBUS start address (INPUT if in CLIENT mode.

Runtime parameters can by modified during the cyclical operation. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. it is not advisable to modify the input parameters while a request is active. Range of Values For the range of values of the different parameters. After a modification of these parameters (e. during the test phase). PLC-specific restrictions must be taken into consideration. Manual edition 2. They are marked with “yes“ in the column “INIT“ in the table displayed above. Wait with the next request and the change of the parameters until the previous request ends with DONE_NDR or ERROR. the output parameters may only be evaluated when DONE_NDR is TRUE. In the operation mode S7 is server.1 6-7 . They have to be copied to an additional memory area if you need to process them or to display the values in a VAT (STEP7 variable table).e. In the mode S7 is server. they are only available for one PLC cycle.g. A modification of the initialization parameters during run mode has no impact. i.Function Block MODBUSPN General Information The parameters of the FB MODBUSPN can be divided into two groups: • • Initialization parameters Runtime parameters Initialization parameters are evaluated only during the call of OB100 and are adopted into the instance DB. The output parameters are displayed dynamically. the instance DB must be initialized again via a STOP RUN transition of the PLC.

When operating various connections an individual ID is required for each logical connection. The shortest adjustable time is 100 ms. The interval between two requests is not taken into consideration. CONN_TIME < 100ms causes an error message and the request is rejected. which are necessary for the communication between the PN PLC and the Modbus device. This connection ID is defined in the connection parameter block. TRCV has to be called twice. the active request is cancelled with an error. the corresponding error code is displayed at the output STATUS_CONN. The monitoring time is started with the call of TRCV and stopped after the receipt of the telegram segment. With each call of TRCV. This parameter is declared in plain text: “DBxy“. the RECV_TIME is triggered. When the time RECV_TIME elapses. This is also true for the operating mode S7 is client with connect_at_startup = TRUE. an indication RECV_TIME < 20 ms causes an error message and the request is rejected. If the monitoring time elapses. In order to receive a Modbus telegram. CONN_TIME The monitoring time CONN_TIME observes the connection establishment and the connection termination. Manual edition 2. The parameter DB_PARAM assigns the number of the data block MODBUS_PARAM. an indication RECV_TIME < 20 ms causes the use of the default time of 1. The connection ID defined in the connection parameter block has to be entered here and must be unique within the PLC. The ID can be set to values between 1and 4095. 0 cannot be used as a DB number since it is reserved for system functions. The range of values for this parameter depends on the PLC. During cyclic operation in the operating mode S7 is client.Function Block MODBUSPN ID To each connection between the PN PLC and a communication partner a connection ID is assigned. It is also possible to use different parameter data blocks for multiple connections. This parameter data block includes the connection parameters and the Modbus-specific parameters. which is part of the parameter data block MODBUS_PARAM. The shortest adjustable time is 20 ms.1 6-8 . The parameter data block can contain a sequence of parameters for several connections. an error is reported. an indication CONN_TIME < 100 ms causes the use of the default time 5s. In the operating mode S7 is server. In the operating mode S7 is client.2s. The RECV_TIME monitors the duration of the TCP stream. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. When CONN_TIME elapses. DB_PARAM RECV_TIME The monitoring time RECV_TIME observes the data input from the communication partner. In the operating mode S7 is server. The connection ID unambiguously specifies the connection between the PLC and the communication partner.

LENGTH. If the connection is not established (CONN_ESTABLISHED = FALSE). TDISCON. CONN_ESTABLISHED indicates that a connection to the communication partner is established and data can be transferred. START_ADDRESS. The request telegram is generated with the values of the input parameters UNIT. In the operating mode S7 is server. When the parameter ENQ_ENR turns from TRUE to FALSE. With the registration key REG_KEY the block MODBUSPN is licensed and the Modbus communication runs without any restraint. the connection may be terminated depending on the parameter DISCONNECT. Telegrams from the client can be received. With a FALSE signal at the input and an established connection. CONN_ ESTABLISHED MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. BUSY If this output is TRUE. the parameter DISCONNECT = TRUE indicates that the connection is terminated after the completed data transfer. the connection establishment is activated. the connection establishment is carried out first and then the data transfer takes places.1 6-9 . You can find further information in section 5 “Licensing”. If CONN_ESTABLISHED is set to FALSE. DATA_TYPE.Function Block MODBUSPN ENQ_ENR Operating mode S7 is Client: The data transfer is initiated with a TRUE edge at the input. the parameter DISCONNECT = TRUE indicates that the connection is terminated when the parameter ENQ_ENR is set to FALSE. Manual edition 2. REG_KEY The block MODBUSPN must be licensed for each CPU individually to permit a correct program sequence. DISCONNECT In the operating mode S7 is client. data is received from the client and discarded. If the connection is not established (CONN_ESTABLISHED = FALSE). the connection to the communication partner is not established. This parameter is a runtime parameter and can be set optionally according to your requirements. Operating mode S7 is Server: The FB is activated with a TRUE signal at the input. TI and WRITE_READ. TSEND or TRCV is running. one of the T functions TCON. A new request may only be initiated when the previous one is ended with DONE_NDR or ERROR.

The error number is displayed in the STATUS_MODBUS or STATUS_CONN output. Status information like “job processing active” is provided by STATUS_CONN as well. STATUS_CONN STATUS_FUNC This parameter shows the name of the function. the parameter UNIT is an input parameter. which caused the error occurred. After start-up of the PLC an 18 character string is displayed. the activated request was executed without an error. This input has to be set according to your requirements. START_ADDRESS. the activated request was ended with an error. an error was recognized. These outputs are only available and valid as long as DONE_NDR is TRUE. In the operating mode S7 is Server. TI and WRITE_READ the request parameters of the client are displayed. the response data from the server has already been entered into the DB. When ERROR is TRUE. The error number is displayed in the STATUS_MODBUS or STATUS_CONN output. IDENT_CODE UNIT In mode S7 is Client. DATA_TYPE. which can be read by means of a variable table? You can find further information in section 5 “Licensing”. LENGTH. With the identification string IDENT_CODE you can order the registration key at IT4industry. In the parameters UNIT. The error numbers are described in section 7. TDISCON. The FB copies this value from the request telegram to the respond telegram. In the operating mode S7 is Server. The error numbers are described in section 7 and in the STEP7 online help of the functions TCON. The output is set with the received value when the job is finished without an error. In this case. this output indicates a telegram exchange without errors. TSEND and TRCV. the STATUS_CONN output displays the error number regarding the processing of the T functions. With a reading function. In the operating mode S7 is Client. In mode S7 is Server. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. an error was detected at a request telegram of the client or when sending a response telegram. the ERROR bit is set to FALSE. the response to the request telegram has been received from the server. The FB copies this value to the request telegram and verifies when receiving the respond telegram. Manual edition 2. ERROR When this output is set. the parameter UNIT is an output parameter. In the operating mode S7 is Client. the STATUS_MODBUS output displays the error number regarding the processing of Modbus telegrams. With a writing function.Function Block MODBUSPN DONE_NDR The parameter DONE_NDR indicates an error-free execution of the request.1 6-10 . STATUS_MODBUS When ERROR is TRUE.

all registers or bits have to be in the same DB. In the operating mode S7 is Server. DATA_TYPE is an output parameter. In the operating mode S7 is Server. For each telegram. this is an output parameter. The different data types are related directly to the used function codes. The following data types are available: Coils Inputs Holding Register Input Register B#16#1 B#16#2 B#16#3 B#16#4 In the operating mode S7 is Client.1 6-11 . a maximum of 125 registers or 2000 bits is possible per telegram. With a reading function. In the operating mode S7 is Client. Data type Coils Coils Coils Coils Inputs Holding Register Holding Register Holding Register Holding Register Input Register START_ADDRESS DATA_ TYPE 1 1 1 1 2 3 3 3 3 4 Function read write write write read read write write write read Length any 1 1 >1 any any 1 1 >1 any single_ write irrelevant TRUE FALSE irrelevant irrelevant irrelevant TRUE FALSE irrelevant irrelevant Function code 1 5 15 15 2 3 6 16 16 4 The parameter START_ADDRESS specifies the first MODBUS address that is read or written. With a writing function. In the operating mode S7 is Server. this is an output parameter. a maximum of 100 registers or 800 bits is possible.Function Block MODBUSPN DATA_TYPE The parameter DATA_TYPE defines which Modbus data type is to be accessed with the current job. Manual edition 2. this is an input parameter. DATA_TYPE is an input parameter. In the operating mode S7 is Client. this is an input parameter. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. LENGTH The parameter LENGTH specifies the number of MODBUS values that are read or written.

e. MODICON PLCs. If the value of the input/output is FALSE. Only a change of the TI ensures a reliable operation of the FB. it is possible to use register or bit addresses from von 0000H to FFFFH for each function code. 6. we recommend increment the TI by 1 with any request. The FB copies this value to the request telegram and verifies it when receiving the respond telegram. this is an output parameter. The value TRUE specifies the writing mode. The FB MODBUSPN can only perform this function properly if the TI is changed with each transaction. Therefore. reference 0001). end_x und START_ADDRESS. this is an input parameter. the reading mode is specified. In the operating mode S7 is Client. is called 40001 (memory type 4xxxx. The FB copies this value from the request telegram into the respond telegram. Some systems. for example.g.3 Example of Address Mapping The MODBUS data model is based on a series of storage areas with distinct properties. In the operating mode S7 is Server. distinguish these areas by the register or bit addresses. The Holding Register with offset 0. A potential source of confusion is the varying interpretation of the register address in different manuals. WRITE_READ This parameter defines whether a reading or writing function is to be carried out. The FB MODBUSPN uses the register or bit address transferred for its parameters start_x. In the operating mode S7 is Client.Function Block MODBUSPN TI The parameter TI (Transaction Identifier) is copied by the server from the request telegram to the respond telegram according to the MODBUS specification. Interpretation of MODBUS Register Addresses MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Therefore. this is an output parameter. this is an input parameter. In the operating mode S7 is Server. Sometimes the register or bit address is defined as the address of the application layer and in other manuals it is the actually transferred address. Manual edition 2. The Transaction Identifier is used for the identification of telegrams and the unambiguous allocation of the requests to the corresponding responds.1 6-12 .

you can find the Modbus register numbers printed in grey. The diagram is based on the parameterization in the table above.1 6-13 . The SIMATIC addresses printed in black are the offset in the DB.Function Block MODBUSPN Example: Parameterization of the Memory Areas data_type_1 db_1 start_1 end_1 data_type_2 db _2 start _2 end _2 data_type_3 db _3 start _3 end _3 data_type_4 db _4 start _4 end _4 data_type_5 db _5 start _5 end _5 data_type_6 db _6 start _6 end _6 data_type_7 db _7 start _7 end _7 data_type_8 db _8 start _8 end _8 B#16#3 W#16#B W#16#1 W#16#1F4 B#16#3 W#16#C W#16#2D0 W#16#384 B#16#4 W#16#D W#16#2D0 W#16#3E8 B#16#0 0 0 0 B#16#1 W#16#E W#16#280 W#16#4E2 B#16#2 W#16#F W#16#6A4 W#16#8FC B#16#1 W#16#10 W#16#6A4 W#16#8FC B#16#0 0 0 0 Holding Register DB 11 Start address: 1 End address: 500 Holding Register DB 12 Start address: 720 End address: 900 Input Register DB 13 Start address: 720 End address: 900 Not used 0 0 0 Coils DB 14 Start address: 640 End address: 1250 Inputs DB 15 Start address:1700 End address: 2300 Coils DB 16 Start address: 1700 End address: 2300 Not used 0 0 0 Address Mapping The following diagram shows a comparison of the SIMATIC memory area and the Modbus-typical register oriented storage arrangement. Additionally. The Modbus addresses printed in black refer to the Data Link Layer and the ones printed in grey refer to the Application Layer. Manual edition 2. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.

. 1000 Holding Register (from 40001) 0 1 40001 40002 ..1 ..1 6-14 ..2 DB 16 + 0.0 + 0.0 899 900 900 901 720 721 720 499 500 1 2 1000 720 721 2299 2300 1700 1701 0 2299 2300 1700 1701 1250 640 641 Modbus device Coils (from 00001) 0 00001 . 2300 2301 12301 12302 Input Register (from 30001) 0 1 30001 30002 .7 +75.0 +360. +996..... +74. +76.... 1700 01701 ...0 DB 12 + 0...... +560. 1250 01251 .0 +998.0 DB 13 + 0. 40721 . 720 721 30721 30722 .....0 + 0.. +74.0 + 2..1 ..0 ..0 + 2..7 +75. 40901 40902 1001 31001 31002 2301 02301 02302 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02..0 + 0. 640 641 00641 00642 .0 . 2300 Inputs (from 10001) 10001 .. +358.0 . 499 500 501 40500 40501 40502 . 1700 1701 11701 11702 .0 DB 11 + 0..0 DB 15 + 0.1 ..0 + 2..Function Block MODBUSPN SIMATIC DB 14 + 0. Manual edition 2...

1 6-15 . The variables control the internal process flow of the FB. Required memory of the instance-DBs: Instance-DB MODBUSPN work memory 830 Byte load memory 1852 Byte Instance DB Local Variables The FB requires 96 bytes of local variables. uses the blocks TSEND and TRCV of the standard library for the data transfer between the PLC and the communication partner. The connection. The function block TCP_COMM.and Modbus-specific parameters are stored in the parameter data block MODBUS_PARAM. MOD_CLI (110 Byte) or MOD_SERV (84 Byte) and TCP_COMM require 2 bytes local variables and TCON. uses the blocks TCON and TDISCON of the standard library to establish and terminate the connection between the PLC and the communication partner. output and input/output as well as static variables required for its execution. The function block TCP_COMM. 236 bytes of local data for one FB MODBUSPN call. TDISCON. Additionally. This instance DB is created by STEP7 when initially calling the FB. called by MODBUSPN. That is a total of max. The instance data block contains parameters of the types input.4 Data and Standard Functions used by the FB The function block MODBUS stores its data in an instance DB. The FB does not use any timers. The FB MODBUSPN uses the following SFCs from the standard library: • • • • • • FC10 “EQ_STRING” Parameter DB Timers Flags Standard FBs for Connection Handling Standard FBs for Data Transfer MODBUSPN: SFCs for Miscellaneous Functions SFC6 “RD_SINFO“ SFC20 “BLKMOV” SFC24 “TEST_DB” SFC51 “RDSYST” SFC52 “WR_USMSG” MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. TSEND or TRCV use up to 28 bytes depending on the used function block. The function block does not use any flags. These variables are remanent and keep their validity between FB calls. called by MODBUSPN.Function Block MODBUSPN 6. Manual edition 2.

Inducement Renaming To rename the blocks proceed as described subsequently: 1. Change the numbers of the function blocks in the desired numbers in your program in SIMATIC Manager.5 Renaming Standard Functions If the numbers of the standard functions are already assigned within your project or if the number interval is reserved for a different application. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. FB65 and FB66 of FB TCP_COMM or the called function blocks MOD_CLI. 2. Manual edition 2.Function Block MODBUSPN MOD_CLI and MOD_SERV: SFCs for Miscellaneous Functions TCP_COMM: SFCs for Miscellaneous Functions The FBs MOD_CLI and MOD_SERV use the following SFCs from the standard library: • • SFC20 „BLKMOV“ SFC24 “TEST_DB” The FB TCP_COMM uses the following SFB from the standard library in addition to the T-blocks: • SFB4 „TON“ 6. SFC24. FB64. Add the modifications in the symbolism table supplementary. SFC52 and SFB4. it is possible to rename the internally called function blocks FB63.1 6-16 . MOD_SERV und TCP_COMM. SFC20. SFC51. A modification of the FB numbers via “Extras -> Re-wire” is not necessary. It is not possible to rename the system functions SFC6.

The STATUS parameters can be evaluated in the user program. STATUS Outputs of the FB MODBUSPN MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. The STATUS_CONN output displays status information and error codes with regard to the processing of the T functions.Diagnosis 7 Diagnosis The diagnostic functions of the PN PLC enable a fast localization of errors. The output STATUS_FUNC shows the name of the function. Diagnostic Function Display Elements (LED) The display elements inform you about the operating mode or about the error conditions of the PLC. When reading the STATUS_MODBUS output.1 7-1 . The display elements provide an overview of internal errors. The following diagnostic features are available: • Diagnosis via the display elements of the PLC • Diagnosis via the STATUS_MODBUS and STATUS_CONN output of the MODBUSPN function block. For an error diagnosis. which caused the error at STATUS_MODBUS or STATUS_CONN. you are provided with a general indication of errors that occurred during the telegram processing and connection handling. Manual edition 2. external errors and interface-specific errors. the MODBUSPN function block has 3 STATUS outputs. When reading the STATUS outputs. you are provided with a general indication of errors that occurred during the Modbus-specific telegram processing.

1 Diagnosis via the Display Elements of the PLC The display elements of the PLC provide information on the status of the component. PN CPU 400 and IM 151-8 PN/DP CPU: . Manual edition 2.SF Group error When this LED is flashing. • Special Displays PN CPU 300. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.1 7-2 . the Modbus block has not been licensed yet. PN-CPU 400 . You can find further information in section 5 “Licensing”. the Modbus block has not been licensed yet. You can find further information in section 5 “Licensing”.INTF Internal error When this LED is flashing.Diagnosis 7.RX/TX a telegram is transferred via the integrated interface Display Functions A detailed description of the display elements can be found in the device manual of the PLC. There are two types of display functions: • Group Error Displays PN CPU 300 .

During Start-up Cyclical Operation S7 is Client Verification when the FB is called: • • • • • • Valid registration key DB MODBUS_PARAM is available with the necessary length Range of values monitoring time RECV_TIME and CONN_TIME Range of values START_ADRESS Range of values LENGTH When executing a request. With data_type_x = 0 the Modbus area is disabled and not further verified. At least the first area (_1) has to be parameterized. Subsequent errors with loss of telegrams can occur. Receipt of the response telegram within the monitoring time The monitoring time can also elapse if less data than specified in the MODBUS telegram header is received.1 7-3 . In the cyclical operation no requests are executed.2 Verification by the FB MODBUSPN • • Unambiguousness of the id parameter in the connection parameters of DB MODBUS_PARAM Parameter group data_type_x. Validity check of data_type 3. (x = 1 to 8) 1. Test end_x >= start_x 5. start_x. Modbus addresses for the same data type defined in two db_x lead to an error message (address overlap). A correction of the parameterization and a STOP RUN transition of the PLC are necessary.Diagnosis 7. • MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. db_x <> 0 4. db_x. 2. end_x. there also is a check whether the data block specified by the register or bit address is available and has the necessary length. The DB number must not be 0 and/or identical to the number of MODBUS_PARAM or the instance DB. Manual edition 2. Errors during start-up provoke the ERROR bit to remain set.

5. Manual edition 2. the number of registers or bits and the byte count in the telegram must match. an exception telegram is sent. 3. Protocol identifier = 0 Length is between 3 and 253 Additionally. • • • • • • Protocol Identifier = 0 Length between 6 and 207 Received function code is verified. 15 or 16 an exception telegram is sent. During the execution of a request. 2. If the function code is not equal to 1. the length in the header of the response telegram is checked for plausibility regarding the request. FC 5 or FC6: Echo in the respond is equal to the request Receipt of the second part of the request telegram within the monitoring time The monitoring time can also elapse if less data than specified in the MODBUS telegram header is received. the start address and number of registers/bits have to match with the request telegram. 6. • • • • • • Cyclical Operation S7 is Server MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. the length in the header. If the number is too large. an exception telegram is sent. Subsequent errors with loss of telegrams can occur. In case of an error. 4. there is also a check whether the data block specified by the register or bit address is available and has the necessary length.1 7-4 . The DB number must not be 0 or identical to the number of MODBUS_PARAM or the instance DB. For write requests.Diagnosis Verification in the response telegram: • • • Received transaction identifier is equal to the sent one. Sent UNIT is equal to the received one Sent FC is equal to the received one Response is an exception code telegram For write requests. The number of registers or bits is verified.

1 7-5 . the FB terminates the connection: • • • • • Monitoring time for connection establishment exceeded Monitoring time for receive exceeded PI <> 0 received TI different to sent TI Length in the header does not match the length information in the telegram MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Manual edition 2.Diagnosis Termination of the Connection in Case of Error In special error situations.

For further details on the error messages. STATUS_CONN and STATUS_FUNC. SFC51 und SFC52. SFC20. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. The parameter end_x is less than start_x. The error messages of these blocks are passed on to STATUS_CONN without any changes. The error messages of these blocks are passed on to STATUS_MODBUS without any changes. STATUS_FUNC shows the name of the function. S7 is Client: Correct the parameters START_ADDRESS or LENGTH S7 is Server: Modify the request of the client. STATUS_MODBUS displays the error numbers regarding the processing of Modbus telegrams. which caused the error. Manual edition 2.3 Diagnosis Messages of the FB MODBUSPN The block MOBUSPN has 3 status outputs: STATUS_MODBUS. The FBs MODBUSPN. please consult the diagnosis buffer or the online help of the SIMATIC Manager.start_x + 1) * 2 .1 7-6 . SFC24. The DB to which MODBUS addresses shall be mapped is too short. FB63. whereas STATUS_CONN displays the error numbers regarding the connection handling. uses the standard blocks SFB4. called by MOD_CLI or MOD_SERV. MOD_CLI and MOD_SERV use the standard functions SFC6. FB64. A001 A002 A003 The parameter data block MODBUS_PARAM is too short. Below you can find a list of FB-specific error messages.bit values (end_x . Messages at the STATUS Outputs of the FB Error Messages of the called SFCs and FBs Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text (Hex) Remedy Correct the length of MODBUS_PARAM Correct the parameterization in DB MODBUS_PARAM Extend the DB.register values (end_x . Correct the parameters.Diagnosis 7.start_x + 7) / 8 Other possible reasons: • • Wrong initialization parameter (S7 is client) Wrong address area in the request telegram of the client (S7 is server) A004 Applies only if S7 is client: An invalid combination of DATA_TYPE and WRITE_READ is given. The block TCP_COMM. STATUS is valid when ERROR is TRUE. Only data type 1 or 3 can be written. Minimum length: . FB65 and FB66.

1 7-7 . The connection is terminated. S7 is Server: Modify the request of the client or correct the parameterization of data_type_x. S7 is server: An invalid function code was received. The RECV_TIME has to be at least 20 ms. 15 and 16. 3. The connection is terminated. S7 is Client: Correct the parameter combination DATA_TYPE. A00A A00B S7 is client: Verify the data of the communication partner with the help of a telegram trace. START_ADDRESS and LENGTH does not exist in data_type_1 to data_type_8. The connection is terminated. 5. The length indicated in the MODBUS-specific telegram header does not match the number of registers/bits or the byte count in the telegram. A00C The received byte count does not match the number of registers. Range of values: Read coils/inputs: 1 to 2000 Write coils: 1 to 800 Read registers: 1 to 125 Write holding registers: 1 to 100 A006 The given range of registers defined with DATA_TYPE. START_ADDRESS. 4. A00D A00E MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Manual edition 2. CONN_TIME 100ms Only if S7 is client: The received transaction identifier TI is not equal to the sent one. S7 is client: Received function code is not equal to the sent one. The FB ignores all data. Correct the parameterization.Diagnosis Error messages of FB MODBUS MODBUSPN at the output STATUS_MODBUS STATUS Event text (Hex) Remedy S7 is Client: Correct the parameter LENGTH. S7 is Server: The number of registers/bits in the request telegram is invalid. 2. Only if S7 is client: The register or bit address respectively the number of registers or bits in the response telegram is not equal to the one in the request telegram. A007 Only if S7 is client: An invalid monitoring time RECV_TIME or CONN_TIME is parameterized. LENGTH. 6. S7 is server: The FB MODBUS only supports the function codes 1. S7 is Server: Modify the number in the request telegram. Only if S7 is client: The received UNIT is not equal to the sent one. Verify the data of the communication partner with the help of a telegram trace. A009 Verify the data of the communication partner with the help of a telegram trace. A005 S7 is client: An invalid value for the parameter LENGTH is given.

Correct the parameterization in DB MODBUS_PARAM. The parameterized areas data_type_1 and data_type_6 overlap. The parameterized areas data_type_1 and data_type_5 overlap.Diagnosis Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text (Hex) Remedy Verify the data of the communication partner with the help of a telegram trace. Correct the parameterization in DB MODBUS_PARAM.1 7-8 . Wrong length in the Modbus header (1 to 253 byte are valid). The parameterized areas data_type_1 and data_type_4 overlap. DB 0 can’t be used. The parameterized areas data_type_2 and data_type_4 overlap. Correct the parameterization in DB MODBUS_PARAM. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. it is reserved for system functions. 0 is assigned to one of the parameters db_x while the according data_type_x is <> 0. The parameterized areas data_type_3 and data_type_4 overlap. The parameterized areas data_type_2 and data_type_5 overlap. The parameterized areas data_type_2 and data_type_5 overlap. The parameterized areas data_type_1 and data_type_8 overlap. The connection is terminated. The parameterized areas data_type_1 and data_type_3 overlap. The parameterized areas data_type_1 and data_type_7 overlap. A00F A protocol identifier <> 0 was received. A01A A01F A023 A024 A025 A026 A027 A028 A034 The FB MODBUSPN has turned to an invalid state. Please contact the product support. The parameterized areas data_type_2 and data_type_3 overlap. The data areas must not contain any overlapping register areas. to 4). Verify the data of the communication partner with the help of a telegram trace. The parameterized areas data_type_1 and data_type_2 overlap. The parameterized areas data_type_2 and data_type_5 overlap. A010 A011 A012 A013 A014 A015 A016 A017 A018 A019 In the parameters db_1 to db_8 a DB number is used twice. The connection is terminated. An invalid value for DATA_TYPE is given (Value range: 1 Correct the parameters. Correct the parameterization in DB MODBUS_PARAM The data areas must not contain any overlapping register areas. Manual edition 2. The parameterized areas data_type_2 and data_type_5 overlap.

An invalid value data_type_x was given. The parameterized areas data_type_4 and data_type_8 overlap. The parameter ID exists twice in the parameter DB. The connection ID of parameter ID is not defined in DB MODBUS_PARAM. Correct the parameterization at the input ID.1 7-9 . A080 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.Diagnosis Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text (Hex) Remedy Correct the parameterization in DB MODBUS_PARAM The data areas must not contain any overlapping register areas. The parameterized areas data_type_4 and data_type_7 overlap. The parameterized areas data_type_6 and data_type_8 overlap. Range of values is 1 to 4095. The parameterized areas data_type_5 and data_type_8 overlap. The parameterized areas data_type_5 and data_type_7 overlap. The value range is 0 to 4. The parameterized areas data_type_6 and data_type_7 overlap. The parameterized areas data_type_4 and data_type_6 overlap. DB_PARAM is an initialization parameter. The parameterized areas data_type_5 and data_type_6 overlap. The DB number of db_x is identical to the number of the parameter DB MODBUS_PARAM or to the instance DB. Restart the CPU after changing this parameter. The parameter area _1 is the default area and must be defined. Correct the parameterization in DB MODBUS_PARAM. The parameterized areas data_type_3 and data_type_7overlap. The parameterized areas data_type_3 and data_type_6 overlap. The parameterized areas data_type_7 and data_type_8 overlap. An invalid value ID is parameterized. The parameter DB_PARAM was changed without a restart of the CPU. The data block defined at DB_PARAM is no parameter Correct the parameterization at DB for Modbus communication. The length information in the INPUT DB_PARAM. A035 A036 A037 A038 A045 A046 A047 A048 A056 A057 A058 A067 A068 A078 A079 A07A A07B A07C A07D A07E A07F The parameterized areas data_type_3 and data_type_5 overlap. Manual edition 2. DBW0 was changed or a wrong DB was defined. The parameterized areas data_type_4 and data_type_5 overlap. Parameter data_type_1 is not defined. The parameterized areas data_type_3 and data_type_8overlap.

Manual edition 2. Check the error message of the communication partner. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Correct LENGTH or START_ADDRESS at the call of the FB.1 7-10 . A082 A083 Only if S7 is client: A request was initiated prior to the completion of the previous one. Read the identification string IDENT_CODE for this CPU and order the registration key at IT4industry. Check the error message of the communication partner and verify the data with a telegram trace if needed. Please contact the Product Support. A084 A090 The character string for identification “IDENT_CODE” could not be determined. A081 Only if S7 is client and function code 5: The received coil status is not equal to the sent one. Wait with the initiation of a new request until the previous one was finished either with DONE/NDR = TRUE or ERROR = TRUE. Check the error message of the communication partner. A091 An exception telegram with exception code 1 was received (only if CP is client) An exception telegram with exception code 2 was received (only if CP is client) An attempt to an invalid or non existing address at the communication partner was made. The block MODBUSPN is not licensed for this CPU. A092 A093 A094 A095 An exception telegram with exception code 3 was received (only if CP is client) An exception telegram with exception code 4 was received (only if CP is client) An exception telegram with an unknown exception code was received (only if CP is client).Diagnosis Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text (Hex) Remedy Verify the data of the communication partner with the help of a telegram trace. The communication partner does not support the requested function. Only if S7 is client and function code 6: The received register value is not equal to the sent one. See also section 5 “Licensing”. Verify the data of the communication partner with the help of a telegram trace.

Diagnosis Error messages of FB MODBUSPN at the output STATUS_CONN STATUS Event text (Hex) Remedy Check the parameterization of the connection. Manual edition 2. A100 The monitoring time CONN_TIME or RECV_TIME was exceeded when executing a job. the connection is terminated. Please contact the product support. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.1 7-11 . When RECV_TIME is exceeded. A101 The monitoring time of the TDISCON is exceeded.

Manual edition 2. FB 65 and FB 66 at the output STATUS_CONN STATUS Event text (Hex) Remedy See online help (SIMATIC manager -> mark block -> key F1) See online help (SIMATIC manager -> mark block -> key F1) 7xxx 8xxx For detailed information please refer to the online help of SIMATIC Manager. 80A1 DB Number = 0 or too large for the PLC This error code is also reported.4 Diagnosis Messages of Called Blocks Error messages of SFC 6 and SFC 20 at the output STATUS_MODBUS STATUS Event text (Hex) Remedy See online help (SIMATIC manager -> mark block -> key F1) See online help (SIMATIC manager -> mark block -> key F1) 7xxx 8xxx For detailed information please refer to the online help of SIMATIC Manager. DB must not be created as UNLINKED.5 Diagnosis Messages of SFC24 Error messages of SFC24 at the output STATUS_MODBUS STATUS Event text (Hex) Remedy Choose a valid DB number. Error messages of FB 63.1 7-12 .Diagnosis 7. 7. 80B2 DB UNLINKED MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. FB 64. when FB MODBUSPN is called with different instance DBs in OB1 or cyclic interrupt OB and OB100. Use the same IDB for the call of MODBUSPN in OB1 or cyclic interrupt OB and OB100. For detailed information please refer to the online help of SIMATIC Manager. 80B1 The DB does not exist in the PLC. For detailed information please refer to the online help of SIMATIC Manager. All data blocks that are specified in DB_x must be created and copied into the PLC.

• • Simatic Station is S7-300. Please note. the provided example project is meant for information purposes only. It displays the handling of the Modbus blocks and is not to be understood as a solution for a customer-specific installation configuration.1 8-1 .Application Sample 8 Sample Application The following simple programming example illustrates the use of FB MODBUSPN. Block OB 1 OB 100 OB 121 FB 102 FB 103 FB 104 FB 105 DB 1 DB 2 DB 3 DB 102 DB 11 DB 12 DB 13 DB 14 DB 15 Symbol CYCL_EXC COMPLETE RESTART PROG_ERR MODBUSPN TCP_COMM MOD_CLI MOD_SERV CONTROL_DAT MODBUS_PARAM LICENSE_DB IDB_MODBUS DATA_AREA_1 DATA_AREA_2 DATA_AREA_3 DATA_AREA_4 DATA_AREA_5 Comment cyclic program processing start-up OB for restart programming error OB FB MODBUSPN FB TCP_COMM FB MOD_CLI FB MOD_SERV work DB CONTROL DAT for FB MODBUSPN parameter DB PARAM_DB for FB MODBUSPN license data block for FB MODBUSPN instance DB for FB MODBUSPN value DB for area 1 value DB for area 2 value DB for area 3 value DB for area 4 value DB for area 5 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. S7-400 or IM 151-8 PN/DP CPU Simatic Station is client or server Sample Program The programming example consists of the blocks: • Start-Up OB100 with call of FB102 • Programming error OB121 with call of FB102 • Cyclic program processing OB1 with call of FB102 • Global DBs for job trigger (e. Manual edition 2. General Information Example Project on the CD On the CD you can find an extensive example project which offers all varieties of parameterization possibilities for the Simatic stations. with variable table) and for licensing • Data blocks for register and bit values Used Blocks The following blocks are used in the provided sample project for S7 stations with FB MODBUSPN.g.

1 Appendix . Manual edition 2.modbus-IDA.1 .A Literature MODBUS IDA MODBUS APPLICATION PROTOCOL SPECIFICATION V1. 2006 http://www.1b. December 28.org MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.

in general terms. an object that requests a service from a -> server. or purpose.> transmission rate A block call occurs when program processing branches to the called block Block parameters are variables within multiple-use blocks. The configuration is the set up of individual modules of the PLC in the configuration table. Manual edition 2. CP Communications Processor. Communications processors are modules for point-to-point connections and bus connections. OB.1 Glossary . Communications Processor Configuration Connection Parameterization The specification of a connection ID in the system function block.1 . the operand stored there can be directly accessed.Glossary A Address The address identifies a physical storage location. which are replaced with actual values when the relevant block is called. Blocks are elements of the user program which are defined by their function. Automation System B Baud Rate Block Call . If the address is known. FC. Module for communications tasks. With the help of a connection ID the system function blocks can communicate between two communication points. C Client A client is a device or. SFB. Subnets can consist of bus segments and connectivity devices such as repeaters and bridges. different input and output devices as well as HMI devices. SFC) Data blocks (DB. An automation system is a programmable logic controller that contains at least a PLC. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. With STEP7 there are • • • Bus Segment Code blocks (FB. SDB) User-defined data types (UDT) Block Parameter Blocks Part of a -> subnet. Segments are transparent for addressing. structure.

in which detailed information on diagnostic events are stored in the order in which they occur. errors on a module or system errors in the PLC. memory. for example. The diagnostics functions cover the entire system diagnosis and include detection. a program error or by operating mode transitions. called a cycle. They are subdivided into global data blocks and instance data blocks. data blocks do not contain instructions. in accordance with the IEC standard. The cycle time is the time the PLC needs to execute the user program once.1 Glossary .g. Cyclic Redundancy-Check = Checksum which guarantees a high probability of error recognition. Complex data can be stored in structured form. are ”blocks with memory”. which are caused by. the user program is executed in a constantly repeating program loop.CPU Central processing unit of the S7 programmable logic controller with control and arithmetic unit. Unlike all other blocks. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. The memory for the function block is an assigned data block. Function blocks can be parameterized but can also be used without parameters. CRC Cycle Time Cyclic Program Processing D Data Block (DB) These are blocks containing data and parameters with which the user program works.2 . The data held in the data blocks can be accessed absolutely or symbolically. Manual edition 2. Every PLC has a diagnostic buffer. Data types allow users to define how the value of a variable or constant is to be used in the user program. In cyclic program processing. and interfaces to I/O modules. say. H Hardware Hardware is the term given to all the physical and technical equipment of a PLC. operating system. code blocks) from the programming device into the load memory of the PLC. Data Type Default Setting Diagnostic Buffer Diagnostic Event Diagnostic Functions Download F Function Block (FB) Function blocks are components of the user program and. a so called ”instance data block”. They are classified into elementary and structured data types. analysis and reporting of errors within the automation system. Downloading means loading objects (e. The default setting is a basic setting which is always used if no other value is specified. Diagnostic events are.

MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Offline means that no such data connection exists. START UP and RUN. Media Access Control (MAC) Mechanisms for controlling access by a station to a common transmission medium shared with other stations. It can be both absolutely and symbolically addressed. The SIMATIC S7 programmable controllers have three different operating modes: STOP. O Online / Offline Online means that a data connection exists between PLC and programming device. An operand is part of a STEP7 instruction and states with what the processor is to do something.1 Glossary . Manual edition 2. Module Modules are pluggable printed circuit boards for programmable logic controllers Module parameters are used to set the module behaviors. A distinction is made between static and dynamic module parameters. Module Parameters N NCM S7 for Industrial Ethernet Configuration software for configuration and diagnostic functions on an Ethernet CP. On the interface module the physical conversion of signals takes place.3 .I Industrial Ethernet Instance Data Block A LAN system complying with IEEE 802. Online Help Operand Operating Mode Operating System of the PLC The operating system of the PLC organizes all functions and operations of the PLC which are not connected to a specific control task.3 (ISO 8802-2) An instance data block is a block assigned to a function block and contains data for this special function block. Interface Module Interrupt M MAC-Address Address to distinguish between different stations connected to a common transmission medium (Industrial Ethernet). STEP7 allows you to display contextual help texts on the screen while working with the programming software. Interrupt is a name for a break of the program processing in the processor of an automation system by an external alarm. By exchanging the pluggable interface module you can adapt the communications processor to the physical interface of the communications partner. The functionality of the PLCs varies in the individual operating modes.

A distinction is made between block parameters and module parameters. the process image of the outputs is transferred to the output modules as output signals. These rules are called protocols.4 . The subnet includes bus components and all the attached stations. STEP7 is the programming software of SIMATIC S7. They are classified into system data blocks. Parameterization Procedure Process image Protocol R Rack A rack is a rail containing slots for mounting modules. S Server A server is a device. or in general terms. System blocks differ from the other blocks in that they are already integrated into the S7-400 system and are available for already defined system functions. for example. The execution of a data interchange operation according to a specific protocol is called a procedure. Parameterization means setting the behavior of a module. Manual edition 2. A service is started at the instigation of a -> client. At the end of the cyclic program. At the beginning of the cyclic program. This is a special memory area in the PLC. The communications partners involved in a data interchange must abide by fixed rules for handling and implementing the data traffic. A subnet is part of a -> network whose parameters must be matched.1 Glossary . System functions are software modules without memory which are already integrated into the operating system of the S7-PLC and can be called by the user as required. A subnet consists of several stations with unique -> MAC addresses. an object that provides certain services. The operating mode START UP is active when the PLC transits from operating mode STOP to operating mode RUN. Subnets can. Software START UP STEP7 Subnet System Block System Function (SFC) System Function Block (SFB) System function blocks are software modules with memory which are already integrated into the operating system of the S7-PLC and can be called up by the user as required. system functions.P Parameter Parameters are values that can be assigned. be connected together by -> gateways to form a network. the signal states of the input modules are transferred to the process image input table. and system function blocks. Software is the term given to all programs used on a computer system. A system consists of several subnets with unique subnet numbers. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. These include the operating system and the user programs.

MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. The unit is bps.g.1 Glossary . he set or selected transmission rate depends on various conditions. The user program for SIMATIC S7 is structured and is divided into smaller units called blocks. for example the distance across Transmission Rate U Upload Uploading means loading objects (e.g. code blocks) from the load memory of the PLC into the programming device. E 1. Manual edition 2. The user program contains all instructions and declarations for signal processing.T Tool A tool is a piece of software that is capable of accessing operating system functions in a programming device. by means of which a system or a process can be controlled. User Program V Variable A variable is an operand (e. According to DIN 44302. this is the number of binary decisions transmitted per time unit.5 . W Work Memory The work memory is a RAM on the PLC which the processor accesses while processing the user program.0) which can have a symbolic name and can therefore also be addressed symbolically.

com/s7modbus Siemens Aktiengesellschaft Subject to change without prior notice. 60 91052 Erlangen Tel: ++49 9131 7-46111 Fax: ++49 9131 7-44757 Mail: it4.com http://www.Customer Support Siemens AG Industry Sector I IS IN E&C Werner-von-Siemens-Str. Stand: 06/2009 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.industry@siemens.1 .siemens. Manual edition 2.