You are on page 1of 64

SIMATIC

S7 - OPEN MODBUS / TCP Communication
via the integrated PN interface of the PLC
Manual

Preface, Table of Contents
Product Description

1

Getting Started

2

Commissioning

3

Parameterization

4

Licensing

5

FB MODBUSPN

6

Diagnosis

7

Sample Application

8

SIMATIC S7
S7 OPEN MODBUS / TCP
Communication via the
integrated PN interface of the PLC
Manual

Appendices
Literature
Glossary

Edition 2.4

Safety Precautions and
Warnings

This manual contains warnings, which you should note for your own safety as well as for
the prevention of damage to property. These warnings are indicated by means of a warning
triangle and are displayed as follows in accordance with the level of danger:
__________________________________________________________________
Danger
indicates that loss of life, severe personal injury or substantial damage
will result if proper precautions are not taken.

__________________________________________________________________
__________________________________________________________________
Warning
indicates that loss of life, severe personal injury or substantial damage can result if proper
precautions are not taken.

__________________________________________________________________
__________________________________________________________________
Caution
indicates that minor personal injury or property damage can result if proper precautions are
not taken.

__________________________________________________________________
__________________________________________________________________
Note
represents an important information especially significant to the product, handling of the
product or a specific part of this documentation.

__________________________________________________________________
Qualified
Personnel

The start-up and the operation of the device may only be carried out by qualified
personnel. Qualified personnel in the sense of the security advices of this manual are any
persons authorized to commission, ground and label devices, systems and electric circuits.

Use as prescribed

Please note:
_________________________________________________________________________
Warning
This device may only be used for applications as prescribed in the catalogue and the
technical description. Furthermore, they may only be used in conjunction with third-party
devices and components recommended and authorized by Siemens.
A successful and safe operation of this product is depends on proper transport, and correct
storage, installation and assembly as well as careful operation and maintenance.

®

®

SIMATIC and SIMATIC NET are registered trademarks of SIEMENS AG.
Trademarks

Since any other brand names in this manual may refer to trademarks, the use of these
names by third parties for their own purposes may infringe the rights of the owner.

Copyright © Siemens AG 2008 All Rights Reserved

Exclusion of Liability

Passing on and reproducing this document as well as using and
disclosing its contents is prohibited unless an explicit permission is
given. Offenders will be liable for damages. All rights reserved,
especially in the case of patent grant or registration of a utility model
or design.

We have checked the contents of this document with regard to its
conformity with the described hardware and software. Deviations,
however, cannot be excluded. Therefore, we cannot guarantee its
complete conformity. The information in this document is checked
regularly and necessary corrections are contained in subsequent
versions. We will be grateful for any suggestions for improvement.

Siemens AG
Industry Sector
Engineering and Construction
I IS IN E&C
P.O. Box 3240, D- 91050 Erlangen
IT4.Industry@siemens.com

Technical data subject to change.

) can be found in the manuals SIEMENS SIMATIC S7-300 CPU 31xC and CPU 31x: Installation Operating Instructions A5E00105491-07 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Contents of the Manual This manual describes the function of the Modbus function block and its parameterization. commissioning etc. The manual contains the following topics: • Production description • Getting Started • Commissioning • Parameterization • Licensing • Function block MODBUSPN • Diagnosis • Sample application Scope of this Manual This manual is valid for the following software: Product Identification number From version OPEN MODBUS/TCP 2XV9 450-1MB02 2.4 FB 103 “TCP_COMM” 3.4 1 .Preface Preface Purpose of the Manual The information in this manual allows you to set up and put in operation the connection between a PLC with integrated PN interface and a device that supports the Open MODBUS/TCP protocol.3 Note This manual contains the FB description valid at the time of publication.5 FB 105 “MOD_SERV“ 1. Manual edition 2. Additional Sources of Information All additional information concerning PN PLCs and IM 151-8 PN/DP CPU (Startup.4 FB 102 “MODBUSPN” 3.0 FB 104 “MOD_CLI“ 1.

CPU Specifications Manual A5E00850746-06 SIEMENS SIMATIC Distributed I/Os ET 200S Interface Module IM151-8 PN/DP CPU Manual A5E02049033-01 SIEMENS Product Information on CPU315-2 PN/DP. SIEMENS SIMATIC Software System software for S7-300/400 System and standard functions Reference manual C79000-G7000-C503-02 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. 6ES7317-2EK13-0AB0 CPU317F-2 PN/DP. Technical Specifications Manual A5E00105474-07 SIEMENS SIMATIC S7-400 Automation System S7-400 Hardware and Installation Operating Instructions A5E00850740-01 SIEMENS SIMATIC S7-400 S7-400 Automation System. 6ES7318-3EL00-0AB0 CPU319F-3 PN/DP.4 2 . 6ES7315-2EH13-0AB0 CPU315F-2 PN/DP. Manual edition 2. 6ES7317-2FK13-0AB0 CPU317-2 DP. 6ES7317-6FF03-0AB0 CPU319-3 PN/DP. 6ES7318-3FL00-0AB0 A5E01103134-03 Additional information concerning STEP7 can be found in the following manuals: SIEMENS SIMATIC Software Base software for S7 and M7 STEP7 user manual C79000-G7000-C502-.Preface SIEMENS SIMATIC S7-300 CPU 31xC and CPU 31x.. 6ES7315-2FH13-0AB0 CPU317-2 PN/DP. 6ES7317-2AJ10-0AB0 CPU317F-2 DP.

Terminology This document uses the term PN PLC. Scope of Application The function block described in this manual establishes a connection between a PN PLC and third-party MODBUS devices. 319. please contact your Siemens partner who provided you with this function block.Preface Additional Questions For further questions regarding the use of the FBs described in this manual. The descriptions apply to PN PLCs of series 315. 317. 414 and 416 as well as IM 151-8 PN/DP CPU.4 3 . MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Manual edition 2.

................... 4-2 4.................................2 Hardware and Software Prerequisites.................2 Verification by the FB MODBUSPN.................................................. 6-12 6.........................1 Functionality of the FB ....................................................... 3-1 4 3.. 7-2 7...... 1-1 2 Getting Started ......................................... 7-6 7.................................................................3 Diagnosis Messages of the FB MODBUSPN............... 7-12 8 Sample Application..................... 7-3 7..................................4 Diagnosis Messages of Called Blocks .1 Installing the Library on the STEP7 PG/-PC ....................................................................................... 1-1 1...................................................................................................................... 2-1 3 Commissioning ......................................3 Example of Address Mapping........................................................................................................... 4-3 5 Licensing .5 Renaming Standard Functions ...................................2 Parameters of the Function Block MODBUSPN ........................................................................................1 Diagnosis via the Display Elements of the PLC ............................................................................................................................ 6-5 6..........2 Editing the Parameterization .................2 PLC – Assigning the IP Address ..................... 6-1 7 6............. 7-1 7.................................................................................................................5 Diagnosis Messages of SFC24 ..........................................................Table of contents Table of Contents 1 Product Description.............................................................................. 6-16 Diagnosis ........................................................3 Insertion of the Function Blocks into the Program........................................................................................................1 Field of Applications................................................................................................................................................................................... 4-1 4........................................1 Parameterization with the Wizard..................................................... 6-1 6......................................... 1 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02....... 6-15 6............................................................................. 1-1 1..................4 Data and Standard Functions used by the FB .............. 3-2 3............ 8-1 A Literature............... 3-1 3............... 7-12 7........................ 5-1 6 Function Block MODBUSPN ....................... Manual edition 2................4 i .......... 3-4 Parameterization of the Modbus Communication ......................................

Product description

1

Product Description

1.1

Field of Applications

Placement in the
System Environment

The function block described here is a software product for PLCs with
integrated PN interface of Simatic S7-300, S7-400 and IM 151-8 PN/DP CPU.

Function of the
FBs

With these function blocks, communication link is established between a
Simatic PLC with integrated PN interface and a device that supports the Open
MODBUS/TCP protocol.
Data transmission is carried out in accordance with the client-server principle.
The SIMATIC S7 can act as both, a client and a server, during the data
transmission.

Use of Port
Number 502

In general, the protocol uses the port 502. This port number has not been
released for all PN PLCs yet and is only possible when using a 319 CPU, an
IM 151-8 PN/DP CPU, a 414 CPU or a 416 CPU with the corresponding
firmware version. You can find the information about the released port
numbers on the internet:
http://support.automation.siemens.com/WW/view/en/34010717.
The PLC only allows a one-time use of a specific port number. Therefore
the PLC/FB cannot be addressed simultaneous from different devices on the
same port number.

1.2

Hardware and Software Prerequisites

Usable Modules

The function blocks have been tested on the PLCs with the product
identifications
CPU315-2 PN/DP
CPU317-2 PN/DP
CPU319-3 PN/DP
CPU414-3 PN/DP
CPU416-3 PN/DP
IM151-8 PN/DP

6ES7315-2EG10-0AB0
6ES7317-2EK13-0AB0
6ES7318-3EL00-0AB0
6ES7414-3EM05-0AB0
6ES7416-3FR05-0AB0
6ES7151-8AB00-0AB0

You can find the latest hardware prerequisites on the internet:
www.siemens.com/s7modbus.
Software Versions

The usage of the FB MODBUSPN is possible with STEP7 Version 5.4 SP4 or
higher.

MODBUS / TCP communication via the integrated PN interface of the CPU
2XV9450-1MB02; Manual edition 2.4

1-1

Product description

Memory
requirements

The FB MODBUSPN requires ca. 6 kbyte work memory and ca. 7 kbyte load
memory.
The FB MOD_CLI requires ca. 11 kbyte work memory and ca. 12 kbyte load
memory.
The FB MOD_SERV requires ca. 10 kbyte work memory and ca. 11 kbyte
load memory.
The FB TCP_COMM requires ca. 2 kbyte work memory and ca. 2 kbyte load
memory.

MODBUS / TCP communication via the integrated PN interface of the CPU
2XV9450-1MB02; Manual edition 2.4

1-2

Getting started

2

Getting Started

Procedure

1. Install “OpenModbusTCP PN CPU“ and insert the Modbus function blocks
into your SIMATIC project.
=> Section 3.1 to 3.3
2. Parameterize the connection parameters regarding your requirements
(IP-address, port number, etc.).
=> Section 4.1 and 4.2
3. Parameterize the Parameter-DBs MODBUS_PARAM regarding your
requirements (client/server, connect at start-up, register numbers,
DB numbers, etc.).
=> Section 4.1 and 4.2
4. Call the Modbus block FB102 in the required OBs.
=> Section 6.1
5. Parameterize the Modbus block for initialization and runtime.
=> Section 6.2
6. Load the user program into the PLC and license the Modbus block for this
CPU.
=> Section 5
.

MODBUS / TCP communication via the integrated PN interface of the CPU
2XV9450-1MB02; Manual edition 2.4

2-1

the sample projects and the manuals in English and German in the corresponding STEP7 directories. names and directories might be different.4 3-1 . • the software registration form in \Program Files\Siemens\Step7\S7libs\Modbus_PN_CPU. In the Windows Explorer. • the sample project in \Program Files\Siemens\Step7\Examples. 3. To initially access the Modbus library. navigate to the CD ROM drive.EXE to start the installation.4 SP4. Requirements Knowledge of AWL and basic knowledge of STEP7 and PLC is required. Follow the step-by-step the instructions which are displayed by the installation program. 2. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. The manual can be accessed via short cut under \Program Files \Siemens\ Documentation as well. Manual edition 2. The manuals are also available as PDF files on CD. Double-click on the setup directory and then on Setup.1 Installing the Library on the STEP7 PG/-PC What We Provide The attached CD contains a setup which installs the library “Modbus_PN_CPU”.Commissioning 3 Commissioning General Information The information below on STEP7 refers to Version 5. If the installation program does not start automatically. In later versions. Installation Insert your Modbus CD into the CD ROM drive and follow step-by-step the instructions which are displayed automatically by the installation program. • the manual in \Program Files\Siemens\Step7\S7manual\S7Comm. use the browse function of the “Open” dialog for libraries. please proceed as follows: 1. Requirements STEP7 has to be installed. the sequences. Now you can find • the library in \Program Files\Siemens\Step7\S7libs.

2. Ethernet.4 3-2 . you can assign an IP address in the Ethernet to this physical address. a PLC 317-2 PN/DP is inserted.2 PLC – Assigning the IP Address Introduction Each node on the Ethernet network is identified by an internationally unique address. Manual edition 2. Following the steps below.Commissioning 3. Open HWConfig The PLC 317-2 PN/DP is inserted in slot 2 and the properties dialog box of the PN-IO interface X2 is mapped. it is necessary to create a new S7 project with STEP7. Procedure Before the configuration. In this example. 1. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. A double click on line X2 opens the object properties dialog of Ind. This so-called MAC address is preset by the manufacturer and cannot be changed.

Enter the IP address and the subnet mask. Confirm your entries with "OK". Result: You created a new Industrial Ethernet subnet. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.4 3-3 . 4.Commissioning 3. Click on the "OK" button. To establish a connection via a router. Result: The properties window of Ethernet interface X2 for PLC 317-2 PN/DP closes. 5. Manual edition 2. Click on "New" to assign a name for a new Industrial Ethernet subnet. enter the address of the router as well.

2 or higher V2. Manual edition 2.Commissioning 3.3 Insertion of the Function Blocks into the Program Content of the MODBUS library The following blocks are required for the Modbus communication: • MODBUSPN • MOD_CLI • MOD_SERV • TCP_COMM The blocks have to be copied from the library into your project. You can find these blocks in Standard Library Æ Communication Blocks. They can be inserted into your project for assistance purposes.1 or higher V2. Please note that the following versions of the FBs are a prerequisite for the faultless function of the FB MODBUSPN: TSEND TRCV TCON TDISCON V2. They have to be inserted into your project.1 or higher Furthermore the block FC10 EQ_STRNG is necessary.3 or higher V2. Blocks of the Standard Library The following blocks are required for the Modbus communication: • TSEND (FB63) • TRCV (FB64) • TCON (FB65) • TDISCON (FB66). Additionally. You can find this function in „Standard Library Æ IEC Function Blocks“. the library contains the parameter data block MODBUS_PARAM as a draft. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.4 3-4 .

0 Connection 2: Modbus parameters END_STRUCT .. subsequently. The connections are established and terminated by means of the function blocks TCON (FB65) und TDISCON (FB66). The parameter data block can contain parameter information of all defined connections. Structure of DB MODBUS_PARAM: Address Name STRUCT +0. The maximal number of coexistent connections depends on the PLC.0 Connection 1: Connection parameters Connection 1: Modbus parameters END_STRUCT STRUCT +650. Connection Description DB MODBUS_PARAM The parameters to establish a connection and to execute the Modbus communication are defined as a structure in a parameter DB called MODBUS_PARAM... For each additional connection. a separate structure is required. This structure contains the connection parameters of both communication partners and the Modbus parameters. It is also possible to use a separate parameter data block for each connection. Manual edition 2. the Modbus parameters are defined.0 +64. . A prepared structure is part of the library “MODBUS_PN_CPU” and can be used as a sample. a network configuration in NetPro is not necessary. At first the connection parameters are defined.4 4-1 .0 Connection 2: Connection parameters +714. STRUCT 650*i 650*i+64 Connection i+1: Connection parameters (65+i) Connection i+1: Modbus parameters END_STRUCT MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. the parameter data block must be expanded by or a new data block created with the structure for connection parameters and the Modbus parameters.. For each logical connection.Parameterisation of the Modbus Communication 4 Parameterization of the Modbus Communication General Information For the communication via the integrated PN interface of the PLC. Several connections to different communication partners can be parameterized and established at the same time.

Otherwise it becomes impossible to set up a connection.automation. The two opportunities are described in detail in the following sections 4.g. You can find the wizard at http://support. A detailed structure can be found in section 4.siemens. Modbus Parameters The Modbus parameters define the mode of communication and the address reference. The structure of the connection parameter block is obligatory und may not be changed. It is recommended to use the wizard for the parameterization of the block MODBUS_PARAM. The first one is to use a Wizard. The functions TCON and TDISCON can establish and terminate a connection by means of these parameters. the used local interface and the IP address of the communication partner.g. how many register or bit areas are mapped to which DB or the differentiation between the S7 acting as server or as client.4 4-2 . Alternatives for Parameterization There are two alternatives for a parameterization of the connection and Modbus parameters. . The second possibility is to edit the parameters in the structure in the data block with the editor of STEP7. e. The structure of the parameter DB has to remain unchanged to ensure proper communication.2.Parameterisation of the Modbus Communication Connection Parameters The parameters of the connection are defined in the first block.com/WW/view/en/31535566.1 Parameterization with the Wizard General Information With the wizard Modbus TCP Wizard you can easily parameterize the connection parameters as well as the Modbus parameters in the parameter data block MODBUS_PARAM. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.1 and 4. 4. Manual edition 2.2. The complete structure (connection parameters and Modbus parameters) is created. which offers an easy way to setup the connection parameters. e.

TRCV and TDISCON). Fixed value: id W#16#40 A connection ID is assigned to each logical connection. Manual edition 2.4 4-3 . It is necessary to restart the PLC after the modification of MODBUS_PARAM. rename the DB. The parameter of data block MODBUS_PARAM must not be changed during runtime.Parameterisation of the Modbus Communication 4. If the number is already used.2 Editing the Parameterization Procedure Copy DB2 of the library Modbus_PN_CPU and insert them in your project. Structure of and Adaption of Connection Parameters For each logical connection one structure is required. It is used for the internal calls of the T blocks (TCON. TSEND. This ID must be unique within the complete parameter data block and has to be parameterized during the call of FB MODBUSPN. block_length This parameter describes the length of the connection parameters and must not be changed. Value range: W#16#1 to W#16#FFF MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.

PN interface of the PLC: B#16#0 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. no IP address is required for the partner.Parameterisation of the Modbus Communication connection_type The structure of the connection is defined here. the port number of the remote communication partner. Active connection establishment: Passive connection establishment: local_device_id The local_device_id defines the IE interface of the used PN PLC.automation. Manual edition 2. If an unspecified connection is to be used. You can find further information on the internet: http://support. Please assign the value B#16#0. rem_staddr_len The length of rem-staddr.4 4-4 .siemens. CPU 414 and CPU416 The values vary depending on the used firmware. It is used by the function TCON when establishing the connection. Unspecified connection: Specified connection: rem_tsap_id_len B#16#0 B#16#4 This parameter defines the length of rem_tsap_id. is defined here. TCP (compatibility mode): TCP: B#16#01 with CPU315 and 317 <= FW V2.4. CPU 319. Active connection establishment: Passive connection establishment: 0 2 rem_subnet_id_ len This parameter is currently not used. It is recommended that the Modbus client performs an active connection establishment while the Modbus server establishes passive connections. The following values are necessary with the different PLC types.e.com/WW/view/en/24294554 active_est This parameter defines the way the connection is established (active or passive).3 B#16#11 with CPU315 and 317 >= FW V2. Active connection establishment: Passive connection establishment: next_staddr_len 2 0 This parameter defines the length of next_staddr as the distinction between the communication running via an external CP or via the integrated PN interface of the PLC. The value depends on the PLC. i. IM 151-8 PN/DP CPU. IM 151-8 PN/DP CPU CPU315 or 317 CPU319 CPU414 or CPU416 local_tsap_id_len TRUE FALSE B#16#1 B#16#2 B#16#3 B#16#5 The length of the parameter local_tsap_id (= local port number) is defined here. the IP address of the communication partner.

The representation depends on the parameter connection_type. assign 0 to this parameter. the IP address of the remote communication partner is defined. With connection_type B#16#01 local_tsap_id[1] low byte of the local port number in hexadecimal local_tsap_id[2] high byte of the local port number in hexadecimal local_tsap_id[3-16] B#16#00 With connection_type B#16#11 local_tsap_id[1] high byte of the local port number in hexadecimal local_tsap_id[2] low byte of the local port number in hexadecimal local_tsap_id[3-16] B#16#00 rem_subnet_id This parameter is currently not used. rem_staddr[5-6]= B#16#00 (reserved) With connection_type B#16#11 rem_staddr[1] = B#16#C0 (192). rem_staddr[3] = B#16#00 (0). Manual edition 2. The port number has to be unique within the PLC.Parameterisation of the Modbus Communication local_tsap_id This parameter defines the local port number. Please assign the value B#16#0. When an unspecified connection is used. rem_staddr[4] = B#16#C0 (192). The representation depends on the parameter connection_type. The value range depends on the PLC. assign 0 to this parameter. next_staddr[1-6] spare B#16#00 Reserved.4 4-5 . rem_staddr[2] = B#16#00 (0). no IP address has to be entered.1: With connection_type B#16#01 rem_staddr[1] = B#16#01 (1). The value range depends on the PLC. rem_staddr[3] = B#16#A8 (168). MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. rem_staddr[5-6]= B#16#00 (reserved) rem_tsap_id This parameter defines the remote port number.168. rem_staddr In this array of bytes. rem_staddr[4] = B#16#01 (1). The representation depends on the parameter connection_type.0. Example: IP address 192. rem_staddr[2] = B#16#A8 (168). When using the integrated PN interface of the PLC. With connection_type B#16#01 local_tsap_id[1] low byte of the remote port number in hexadecimal local_tsap_id[2] high byte of the remote port number in hexadecimal local_tsap_id[3-16] B#16#00 With connection_type B#16#11 local_tsap_id[1] high byte of the remote port number in hexadecimal local_tsap_id[2] low byte of the remote port number in hexadecimal local_tsap_id[3-16] B#16#00 next_staddr This parameter defines rack and slot of the corresponding CP.

MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. server_client TRUE: S7 is server FALSE: S7 is client single_write In operating mode “S7 is client” and single_write = TRUE write requests with length 1 are carried out with the function codes 5 and 6.Parameterisation of the Modbus Communication Adaption of the Modbus Parameters The Modbus parameters in the block MODBUS_PARAM define the mode of operation of the Modbus communication and the address reference of Modbus addresses and SIMATIC addresses. With single_write = FALSE all write requests use the function codes 15 and 16. Manual edition 2.4 4-6 .

data_type_x db_x The parameter data_type_x defines the MODBUS data type which is to be mapped with this definition. Even if consecutive register numbers or coils are located in two different DBs. two requests are necessary to access them both. these memory areas are read or written. At least the first data area has to be defined.4 4-7 . This has to be taken into account during the parameterization. The other 7 data areas are optional. 0 cannot be used as DB number since it is reserved for system functions. Manual edition 2. this data area is not used Identifier Data type Size 0 Area not used 1 Coils Bit 2 Inputs Bit 3 Holding Register Word 4 Input Register Word The parameter db_x defines the number of the data block in which the consecutively defined MODBUS registers or bits are mapped. FALSE: establish connection when ENQ_ENR=TRUE TRUE: establish connection immediate after PLC start-up When connect_at_startup = TRUE. If data_type_x set to 0.65535 (W#16#0001 to W#16#FFFF) MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. only one DB can be accessed. Depending on the type of request. With one request. db_x DB-Number 1 . It is possible to map more Modbus values (registers or coils) in one data block than could be processed with one telegram. the first request should be started after the connection was established (CONN_ESTABLISHED = TRUE) or an error has been reported respectively (ERROR =TRUE).Parameterisation of the Modbus Communication connect_at_ startup This parameter defines the point in time at which the connection is being established. 8 Data Areas 8 data areas are available to map the Modbus addresses in the S7 storage.

When accessing registers. End_x defines the of the last MODBUS address. start_x. end_x MODBUS address 0 to 65535 (W#16#0000 to W#16#FFFF) internal_send_ buffer This array is used internally for message data within the FB. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. the initialization of the FB is stopped with an error. which is stored in the data element 0 of the DB. The parameter end_x must not be smaller than start_x. Manual edition 2. can be calculated with the following formula: DBB number = (end_x – start_x +7) / 8 The defined memory areas must not overlap. the number of the data element of the S7 DB in which the last register is mapped.4 4-8 . In section 6. internal_recv_ buffer This array is used internally for the received data within the FB. In case of an error occurring. When start_x is equal to end_x.3 you can find an example of the mapping of the MODBUS addresses to S7 memory areas. Accessing or changing the array is inadmissible. one Modbus address (1 register or 1 bit) is allocated. Accessing or changing the array is inadmissible.Parameterisation of the Modbus Communication start_x end_x Start_x specifies the first register or bit address. can be calculated with the following formula: DBW number = (end_x – start_x) ∗ 2 When accessing coils or inputs. the number of the data element of the S7 DB in which the last bit is mapped.

MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.4 5-1 . Manual edition 2. The OB121 must be available in the CPU. Parameterize the block in the cyclic OB (OB1 or cyclic interrupt OB) and in OB100 according to your requirements. Transfer the program to the PLC and turn it to RUN mode. Open the instance DB of the block MODBUSPN. Read the IDENT_CODE To read the IDENT_CODE please proceed as follows: 1. Monitoring the block via the button is insufficient. „Data block“ -> „Open Online“ to open the DB. The licensing takes place in two steps: reading the IDENT_CODE and declaring the registration key REG_KEY.Licensing 5 Licensing General The block MODBUSPN must be licensed for each CPU individually. 2.

4 5-2 . Hereupon you will receive the registration key for your PLC. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.com. of the product package into the form. 4. The output IDENT_CODE shows an 18 character string. This form is stored in the library path . Please send the form per e-mail to IT4Industry it4. Manual edition 2..Licensing 3. Insert the License-No.\Program Files\Siemens\Step7\S7LIBS\Modbus_PN_CPU during installation and is also available on the installation CD.industry@siemens. Copy this string per copy/paste from the DB und and insert it in the form IT4Industry SOFTWARE REGISTRATION FORM.

Transfer the changed blocks to the PLC. Choose in the menu “Edit > Initialize Data Block” – all values of the column “initial value” are copied to “actual values”. Copy the prepared license block DB3 of the library “Modbus_PN_CPU“ into your project. A STOP -> RUN transition is not necessary. The block is now licensed for this CPU. Open the data block in the SIMATIC manager with the editor in the declaration view. Manual edition 2.4 5-3 . rename the license DB. 2.Licensing Declaration of the Registration Key REG_KEY The registration key REG_KEY must be declared for each call of the block MODBUSPN. 5. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. The registration key can be set at run time. Open the license DB and copy the 17 digit registration key you received from IT4industry to the column “Initial value”. Via this global DB all MODBUSPN blocks can receive the registration key (See also the following example). Assign the value “DB3. Please proceed as follows to declare the registration key REG_KEY: 1. The registration key REG_KEY should be stored in a global DB.REG_KEY” to the parameter REG_KEY of the block MODBUSPN. 3. Declare the registration key in the data block as “initial value” to avoid a repeated insertion after reloading the PLC. If the DB number is already used in your project. Change over to the data view via the menu “View” -> “Data View”. 4.

4 5-4 .Licensing Missing or Wrong Licensing When the registration key is missing or a wrong one is detected. The error number of the missing license is W#16#A090. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. A cyclic error message regarding the missing license is displayed in the diagnostic buffer too. _____________________________________________________________ Modbus communication is carried out even with a missing or wrong registration key. the SF LED (S7-300 and IM151-8) or the INTF LED (S7-400) of the CPU is flashing. Manual edition 2. If this error code is shown although the registration key has been inserted. please check if the FC “EQ_STRING” is copied into the project. but the output STATUS_MODBUS is set to W#16#A090 “no valid license”. _____________________________________________________________ Warning ! The CPU will turn to STOP mode. if the OB121 is not available.

It contains the main information on the FB. 5. 15 and 16 are supported. Mark the FB and press “F1” so that he online help is displayed. The blocks provide the following functions: Online-Help • Connection and data handling by means of T blocks of the standard library • Generation of MODBUS-specific telegram header before sending • Verification of the MODBUS-specific telegram header when receiving • Verification whether the memory areas requested by the client exist • Generation of exception telegrams when errors occur (only when S7 is in server mode) • Data transfer to and from the parameterized DB • Time monitoring of the data reception as well as connection establishment and termination • Verification of the registration key The SIMATIC Manager provides an online help for the function block MODBUSPN. The function codes 1. The block MODBUSPN calls the blocks MOD_CLI (FB104) and MOD_SERV (FB105) internally. the block MOD_SERV executes the function of Modbus server and the block TCP_COMM handles the connection management.Function Block MODBUSPN 6 Function Block MODBUSPN 6. the functionality multitasking in the sense of the MODBUS specification is not implemented. 2.1 Functionality of the FB General Information The function block MODBUSPN enables a communication between a PLC with integrated PN interface and a partner which supports Open MODBUS/TCP. Manual edition 2. The block MOD_CLI comprises the function of Modbus client. 4. the FB can be operated either in client or in server mode. In the server operating mode. Depending on the parameterization. 3. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.4 6-1 . 6.

The OB121 must be available in the CPU. e. • While a request is being processed. A coexistent call of FB MODBUSPN in OB1 and a cyclic interrupt OB. • The values of the parameter data block MODBUS_PARAM are evaluated. the FB MODBUSPN is called in OB1 or in a cyclic interrupt OB. initialization parameters are ignored. You will find more information regarding this matter in section 5 “Licensing“. MOD_SERV and TCP_COMM must not be called additionally in an organization block. the OB121 is called. OB35 is not permissible. the functions of the function block are activated. If the block has not been licensed yet. • Corresponding to the runtime parameters. OB35) The subordinate blocks of the Modbus library MOD_CLI. if the OB121 is not available. changes to the runtime parameters are ignored.g. • The initialization parameters are copied into the instance DB.Function Block MODBUSPN Call of the FB For a correct program sequence the function block MODBUSPN has to be called in 2 organization blocks: • OB100 Start-Up and Cyclic OB (OB1 or cyclic interrupt OB. In case of cyclical operation. e. • In the cyclical operation mode. ____________________________________________________________ Warning ! The CPU will turn to STOP mode. • The runtime parameters are not evaluated during the start-up.g. Start-up of the FB Cyclical Operation of the FB OB121 “Programming Error” The function block MODBUSPN is unconditionally called once in OB100. • The initialization parameters must be set according to the station configuration. _____________________________________________________________ MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Manual edition 2.4 6-2 .

MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.Function Block MODBUSPN Connection Handling Active connection establishment can be carried out by the Modbus client as well as the Modbus server. there are the following requirements for each connection: • • • one connection parameter block and the related Modbus parameter in DB MODBUS_PARAM call of FB MODBUSPN in OB100 call of FB MODBUSPN in OB1 or cyclic interrupt OB In this case. Multiple Communication Partners A PN PLC can establish multiple connections to various communication partners. With a parameter of the connection parameter block (active_est). The termination of the connection is defined with the parameter DISCONNECT of FB MODBUSPN. The point in time at which the connection is established is defined in DB MODBUS_PARAM (parameter connect_at_startup). To ensure a proper operation and data transfer. Manual edition 2. active and passive. A different instance DB is required for each additional connection. the calls of the FB MODBUSPN in the OB100 and in the OB1 receive the same instance DB for one connection. It is recommended explicitly that the Modbus client executes the active establishment. During runtime the function TCON establishes the connection to the communication partner for both types of connections. The relevant information is read from the connection parameters of DB MODBUS_PARAM.4 6-3 . Correspondingly. a strict division of the different connections to the corresponding communication partners is inevitable. it is possible to define whether the PLC performs active or passive connection establishment.

Activation of the Function Block S7 is Server With the signal TRUE at the trigger input ENQ_ENR.4 6-4 . The error number is returned in STATUS_MODBUS. a validity check is carried out. DATA_TYPE. TI and WRITE_READ. the ERROR bit is set and an error number is returned at the output STATUS. START_ADDRESS. The request of the client is not answered. LENGTH. START_ADDRESS. The server remains passive and waits for a telegram from the client. When the monitoring time elapses (no response from the server). Manual edition 2. After the receipt of the response telegram. The received telegram is verified. A new request can be initiated. The client waits for the parameterized monitoring time RECV_TIME for a response from the server. the completed function is indicated at the outputs UNIT. TI and WRITE_READ.Function Block MODBUSPN Initiate Request S7 is Client A rising edge at the trigger input ENQ_ENR initiates a request. the FB is ready to receive a request telegram from the client. The completed transmission is reported to the user by setting the DONE_NDR bit. If the result is positive. the response telegram is sent. the necessary actions are taken and the request is terminated without error. If the verification result is positive. Depending on the input parameters UNIT. When an error is recognized during verification. DATA_TYPE. a MODBUS request telegram is generated and sent to the partner station via the TCP/IP connection. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. At this point. the activated request is terminated with an error. the request is terminated with an error. An erroneous request telegram causes an error message and the ERROR bit is set. LENGTH. The output DONE_NDR is set.

Type Description ID IN Connection ID.2 Parameters of the Function Block MODBUSPN Parameter Decl. TSEND or TRCV) no Job processing TRUE No job processing active FALSE CONN_ ESTABLISHED OUT BOOL Connection established Connection terminated TRUE FALSE no DONE_NDR OUT BOOL S7 is Client: TRUE: Active request finished without errors TRUE FALSE no S7 is Server: TRUE: Request from the client was executed and answered MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. TDISCON. CONN_TIME IN TIME Monitoring Time: wait for establishing or termination of the connection Shortest adjustable time: 100 ms.Function Block MODBUSPN 6. Manual edition 2. KEEP_ALIVE IN TIME Not used ENQ_ENR IN BOOL S7 is Client: Initiate request at positive edge S7 is Server: Ready to receive at TRUE signal DISCONNECT IN BOOL S7 is Client: TRUE: connection is terminated after reception of response S7 is Server: TRUE: connection is terminated when ENQ_ENR = FALSE REG_KEY IN LICENSED OUT BOOL BUSY STRING [17] OUT BOOL Registration key to activate the license License state of the function block: Block is licensed Block is not licensed no TRUE FALSE Operating state of the T functions (TCON.4 6-5 . must be identical to the associated parameter in the local connection description WORD Value range Init 1 to 4095 yes W#16#1 to W#16#FFF DB_PARAM IN BLOCK_ Number of the parameter DB DB depending on PLC yes RECV_TIME IN TIME T#20ms to T#+24d20h31 m23s647ms no T#20ms to T#+24d20h31 m23s647ms no TRUE FALSE no TRUE FALSE no Character no Monitoring Time: wait for data from communication partner Shortest adjustable time: 20 ms.

Manual edition 2. Type Description Value range Init ERROR OUT BOOL An error has occurred TRUE no No error has occurred FALSE STATUS_ MODBUS OUT WORD Error number for protocol errors when evaluating a Modbus telegram 0 to FFFF no STATUS_ CONN OUT WORD Error number for connection errors during execution of the T blocks (TCON. OUTPUT if in SERVER mode) LENGTH IN/ WORD OUT Number of values to be processed (INPUT if in CLIENT mode. OUTPUT if in SERVER mode) 0 to 255 no IN/ BYTE OUT Data type to be accessed: (INPUT if in CLIENT mode.Function Block MODBUSPN Parameter Decl. OUTPUT if in SERVER mode) TRUE FALSE MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. TSEND. TDISON) 0 to FFFF no STATUS_FUNC OUT STRING [8] Name of the function. OUTPUT if in SERVER mode) TI WRITE_ READ B#16#0 to B#16#FF no 1 2 3 4 0 to 65535 no Coils Reading function Writing function 1 to 2000 1 to 1968 Inputs Reading function 1 to 2000 Holding Register Reading function Writing function 1 to 125 1 to 123 Input Register Reading function 1 to 125 IN/ WORD OUT Transaction Identifier (INPUT if in CLIENT mode. OUTPUT if in SERVER mode) DATA_TYPE Coils Inputs Holding registers Input registers START_ ADDRESS IN/ WORD OUT MODBUS start address (INPUT if in CLIENT mode.4 no W#16#0000 to W#16#FFFF no W#16#0 to W#16#FFFF no 6-6 . which causes the error at STATUS_MODBUS or STATUS_CONN Character no IDENT_CODE OUT STRING [18] Identification for licensing Please order your license with this identification string. TRCV. OUTPUT if in SERVER mode) 0 to 65535 IN/ BOOL OUT Write access or Read access (INPUT if in CLIENT mode. Character no UNIT IN/ BYTE OUT Unit identification (INPUT if in CLIENT mode.

the instance DB must be initialized again via a STOP Æ RUN transition of the PLC. Manual edition 2. They are marked with “yes“ in the column “INIT“ in the table displayed above. it is not advisable to modify the input parameters while a request is active. After a modification of these parameters (e.4 6-7 . MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.e.g. PLC-specific restrictions must be taken into consideration. Range of Values For the range of values of the different parameters. In the operation mode S7 is server. they are only available for one PLC cycle. Wait with the next request and the change of the parameters until the previous request ends with DONE_NDR or ERROR. They have to be copied to an additional memory area if you need to process them or to display the values in a VAT (STEP7 variable table). during the test phase). i. In the mode S7 is client. Runtime parameters can by modified during the cyclical operation. A modification of the initialization parameters during run mode has no impact. The output parameters are displayed dynamically. the output parameters may only be evaluated when DONE_NDR is TRUE.Function Block MODBUSPN General Information The parameters of the FB MODBUSPN can be divided into two groups: • Initialization parameters • Runtime parameters Initialization parameters are evaluated only during the call of OB100 and are adopted into the instance DB.

If the monitoring time elapses. an indication RECV_TIME < 20 ms causes the use of the default time of 1. The shortest adjustable time is 20 ms. This parameter data block includes the connection parameters and the Modbus-specific parameters. The parameter data block can contain a sequence of parameters for several connections. an error is reported.4 6-8 . RECV_TIME The monitoring time RECV_TIME observes the data input from the communication partner. the corresponding error code is displayed at the output STATUS_CONN. In order to receive a Modbus telegram. The connection ID defined in the connection parameter block has to be entered here and must be unique within the PLC. In the operating mode S7 is server. the active request is cancelled with an error. The interval between two requests is not taken into consideration. an indication CONN_TIME < 100 ms causes the use of the default time 5s. It is also possible to use different parameter data blocks for multiple connections. The range of values for this parameter depends on the PLC. DB_PARAM The parameter DB_PARAM assigns the number of the data block MODBUS_PARAM. This is also true for the operating mode S7 is client with connect_at_startup = TRUE. CONN_TIME < 100ms causes an error message and the request is rejected. The monitoring time is started with the call of TRCV and stopped after the receipt of the telegram segment. CONN_TIME The monitoring time CONN_TIME observes the connection establishment and the connection termination. The RECV_TIME monitors the duration of the TCP stream. When CONN_TIME elapses. the RECV_TIME is triggered. Manual edition 2. which are necessary for the communication between the PN PLC and the Modbus device. The connection ID unambiguously specifies the connection between the PLC and the communication partner. When the time RECV_TIME elapses. This parameter is declared in plain text: “DBxy“. an indication RECV_TIME < 20 ms causes an error message and the request is rejected. The ID can be set to values between 1and 4095.2s.Function Block MODBUSPN ID To each connection between the PN PLC and a communication partner a connection ID is assigned. 0 cannot be used as a DB number since it is reserved for system functions. which is part of the parameter data block MODBUS_PARAM. In the operating mode S7 is server. When operating various connections an individual ID is required for each logical connection. During cyclic operation in the operating mode S7 is client. The shortest adjustable time is 100 ms. TRCV has to be called twice. In the operating mode S7 is client. With each call of TRCV. This connection ID is defined in the connection parameter block. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.

You can find further information in section 5 “Licensing”. In the operating mode S7 is server. BUSY If this output is TRUE.Function Block MODBUSPN ENQ_ENR Operating mode S7 is Client: The data transfer is initiated with a TRUE edge at the input. the connection to the communication partner is not established.4 6-9 . START_ADDRESS. the parameter DISCONNECT = TRUE indicates that the connection is terminated when the parameter ENQ_ENR is set to FALSE. one of the T functions TCON. A new request may only be initiated when the previous one is ended with DONE_NDR or ERROR. the connection establishment is carried out first and then the data transfer takes places. With the registration key REG_KEY the block MODBUSPN is licensed and the Modbus communication runs without any restraint. TSEND or TRCV is running. DISCONNECT In the operating mode S7 is client. the parameter DISCONNECT = TRUE indicates that the connection is terminated after the completed data transfer. If the connection is not established (CONN_ESTABLISHED = FALSE). MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. This parameter is a runtime parameter and can be set optionally according to your requirements. then the Modbus block is licensed on this CPU. The request telegram is generated with the values of the input parameters UNIT. DATA_TYPE. data is received from the client and discarded. Operating mode S7 is Server: The FB is activated with a TRUE signal at the input. If CONN_ESTABLISHED is set to FALSE. TI and WRITE_READ. TDISCON. CONN_ ESTABLISHED CONN_ESTABLISHED indicates that a connection to the communication partner is established and data can be transferred. the connection establishment is activated. the connection may be terminated depending on the parameter DISCONNECT. Manual edition 2. With a FALSE signal at the input and an established connection. When the parameter ENQ_ENR turns from TRUE to FALSE. REG_KEY The block MODBUSPN must be licensed for each CPU individually to permit a correct program sequence. LENGTH. Telegrams from the client can be received. LICENSED If this output is TRUE. If the output is FALSE. none or a faulty license string was entered. If the connection is not established (CONN_ESTABLISHED = FALSE).

The error numbers are described in section 7. the STATUS_MODBUS output displays the error number regarding the processing of Modbus telegrams. TSEND and TRCV. START_ADDRESS. Manual edition 2. In the parameters UNIT. an error was recognized. which can be read by means of a variable table? You can find further information in section 5 “Licensing”. an error was detected at a request telegram of the client or when sending a response telegram. In the operating mode S7 is Server. the activated request was executed without an error. In the operating mode S7 is Client. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. The error number is displayed in the STATUS_MODBUS or STATUS_CONN output. this output indicates a telegram exchange without errors. This input has to be set according to your requirements. IDENT_CODE With the identification string IDENT_CODE you can order the registration key at IT4industry. LENGTH. the parameter UNIT is an output parameter. With a writing function. In this case. STATUS_MODBUS When ERROR is TRUE. the activated request was ended with an error.4 6-10 . which caused the error occurred. TDISCON. the response data from the server has already been entered into the DB. the parameter UNIT is an input parameter. the STATUS_CONN output displays the error number regarding the processing of the T functions. STATUS_FUNC This parameter shows the name of the function. Status information like “job processing active” is provided by STATUS_CONN as well. These outputs are only available and valid as long as DONE_NDR is TRUE. the ERROR bit is set to FALSE. DATA_TYPE. With a reading function. ERROR When this output is set. The error number is displayed in the STATUS_MODBUS or STATUS_CONN output. In the operating mode S7 is Server.Function Block MODBUSPN DONE_NDR The parameter DONE_NDR indicates an error-free execution of the request. The FB copies this value to the request telegram and verifies when receiving the respond telegram. TI and WRITE_READ the request parameters of the client are displayed. In mode S7 is Server. In the operating mode S7 is Client. the response to the request telegram has been received from the server. The output is set with the received value when the job is finished without an error. The FB copies this value from the request telegram to the respond telegram. After start-up of the PLC an 18 character string is displayed. UNIT In mode S7 is Client. The error numbers are described in section 7 and in the STEP7 online help of the functions TCON. STATUS_CONN When ERROR is TRUE.

The following data types are available: Coils Inputs Holding Register Input Register B#16#1 B#16#2 B#16#3 B#16#4 In the operating mode S7 is Client. In the operating mode S7 is Server. this is an output parameter. this is an input parameter. In the operating mode S7 is Server.4 6-11 . this is an input parameter. For each telegram. With a reading function.Function Block MODBUSPN DATA_TYPE The parameter DATA_TYPE defines which Modbus data type is to be accessed with the current job. The different data types are related directly to the used function codes. DATA_TYPE is an output parameter. all registers or bits have to be in the same DB. Data type START_ADDRESS DATA_ TYPE Function Length single_ write Function code Coils 1 read any irrelevant 1 Coils 1 write 1 TRUE 5 Coils 1 write 1 FALSE 15 Coils 1 write >1 irrelevant 15 Inputs 2 read any irrelevant 2 Holding Register 3 read any irrelevant 3 Holding Register 3 write 1 TRUE 6 Holding Register 3 write 1 FALSE 16 Holding Register 3 write >1 irrelevant 16 Input Register 4 read any irrelevant 4 The parameter START_ADDRESS specifies the first MODBUS address that is read or written. LENGTH The parameter LENGTH specifies the number of MODBUS values that are read or written. Manual edition 2. a maximum of 123 registers or 1968 bits is possible. With a writing function. In the operating mode S7 is Client. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. In the operating mode S7 is Server. this is an output parameter. DATA_TYPE is an input parameter. a maximum of 125 registers or 2000 bits is possible per telegram. In the operating mode S7 is Client.

e. for example. it is possible to use register or bit addresses from von 0000H to FFFFH for each function code. we recommend increment the TI by 1 with any request. distinguish these areas by the register or bit addresses. The FB copies this value to the request telegram and verifies it when receiving the respond telegram. The FB MODBUSPN uses the register or bit address transferred for its parameters start_x. MODICON PLCs. this is an output parameter. The FB copies this value from the request telegram into the respond telegram. end_x und START_ADDRESS. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. In the operating mode S7 is Server. WRITE_READ This parameter defines whether a reading or writing function is to be carried out. Some systems. A potential source of confusion is the varying interpretation of the register address in different manuals. The Transaction Identifier is used for the identification of telegrams and the unambiguous allocation of the requests to the corresponding responds. Therefore. TI In the operating mode S7 is Client. In the operating mode S7 is Server.g. If the value of the input/output is FALSE. The value TRUE specifies the writing mode. this is an output parameter. Sometimes the register or bit address is defined as the address of the application layer and in other manuals it is the actually transferred address.3 Example of Address Mapping Interpretation of MODBUS Register Addresses The MODBUS data model is based on a series of storage areas with distinct properties. this is an input parameter. The FB MODBUSPN can only perform this function properly if the TI is changed with each transaction.Function Block MODBUSPN The parameter TI (Transaction Identifier) is copied by the server from the request telegram to the respond telegram according to the MODBUS specification. is called 40001 (memory type 4xxxx. Manual edition 2. In the operating mode S7 is Client. The Holding Register with offset 0. this is an input parameter. reference 0001).4 6-12 . 6. Therefore. the reading mode is specified. Only a change of the TI ensures a reliable operation of the FB.

The diagram is based on the parameterization in the table above. The SIMATIC addresses printed in black are the offset in the DB. Manual edition 2. The Modbus addresses printed in black refer to the Data Link Layer and the ones printed in grey refer to the Application Layer. Additionally. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. you can find the Modbus register numbers printed in grey.Function Block MODBUSPN Example: Parameterization of the Memory Areas Address Mapping data_type_1 db_1 start_1 end_1 data_type_2 db _2 start _2 end _2 data_type_3 db _3 start _3 end _3 data_type_4 db _4 start _4 end _4 data_type_5 db _5 start _5 end _5 data_type_6 db _6 start _6 end _6 data_type_7 db _7 start _7 end _7 data_type_8 db _8 start _8 end _8 B#16#3 W#16#B W#16#1 W#16#1F4 B#16#3 W#16#C W#16#2D0 W#16#384 B#16#4 W#16#D W#16#2D0 W#16#3E8 B#16#0 0 0 0 B#16#1 W#16#E W#16#280 W#16#4E2 B#16#2 W#16#F W#16#6A4 W#16#8FC B#16#1 W#16#10 W#16#6A4 W#16#8FC B#16#0 0 0 0 Holding Register DB 11 Start address: 1 End address: 500 Holding Register DB 12 Start address: 720 End address: 900 Input Register DB 13 Start address: 720 End address: 900 Not used 0 0 0 Coils DB 14 Start address: 640 End address: 1250 Inputs DB 15 Start address:1700 End address: 2300 Coils DB 16 Start address: 1700 End address: 2300 Not used 0 0 0 The following diagram shows a comparison of the SIMATIC memory area and the Modbus-typical register oriented storage arrangement.4 6-13 .

.0 2 ... DB 11 01701 . 1000 + 0.0 2300 10001 ... +358.1 641 0 .. 720 30721 721 30722 ..0 721 0 1700 11701 1701 11702 .0 720 + 2... +74. + 0..4 6-14 . +996..2 00001 1250 640 00641 641 00642 DB 16 .. 2300 12301 2301 12302 + 2...0 2300 DB 15 + 0. Holding Register (from 40001) 1 02301 .7 2299 +75.0 899 900 40901 +360.. ....0 1700 + 0.0 2300 DB 13 + 0.. 1700 +74. Inputs (from 10001) +560.0 720 + 2.7 2299 +75.. Manual edition 2..0 500 DB 12 + 0..... 499 40500 500 40501 501 40502 .0 01251 0 40001 1 40002 1000 31001 1001 31002 . 720 ...Function Block MODBUSPN SIMATIC Modbus device DB 14 Coils (from 00001) + 0..0 900 901 40902 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.. +76. 40721 ..1 1701 .0 499 +998.1 1701 1250 ....0 721 2301 02302 Input Register (from 30001) 0 30001 1 30002 . .0 640 + 0.0 1700 + 0..

uses the blocks TSEND and TRCV of the standard library for the data transfer between the PLC and the communication partner. MODBUSPN: SFCs for Miscellaneous Functions The FB MODBUSPN uses the following SFCs from the standard library: • FC10 • SFC6 “RD_SINFO“ • SFC20 “BLKMOV” • SFC24 “TEST_DB” • SFC51 “RDSYST” • SFC52 “WR_USMSG” “EQ_STRING” MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Standard FBs for Connection Handling The function block TCP_COMM. MOD_CLI (52 Byte) or MOD_SERV (28 Byte) and TCP_COMM require 2 bytes local variables and TCON. The instance data block contains parameters of the types input. TSEND or TRCV use up to 28 bytes depending on the used function block. That is a total of max. output and input/output as well as static variables required for its execution. This instance DB is created by STEP7 when initially calling the FB.4 6-15 . called by MODBUSPN. Manual edition 2.Function Block MODBUSPN 6. 160 bytes of local data for one FB MODBUSPN call. Additionally. called by MODBUSPN. 2 kByte Local Variables The FB requires 78 bytes of local variables. 1 kByte ca. Parameter DB The connection. Standard FBs for Data Transfer The function block TCP_COMM. These variables are remanent and keep their validity between FB calls. The variables control the internal process flow of the FB. uses the blocks TCON and TDISCON of the standard library to establish and terminate the connection between the PLC and the communication partner. TDISCON. Required memory of the instance-DBs: Instance-DB work memory load memory MODBUSPN ca.and Modbus-specific parameters are stored in the parameter data block MODBUS_PARAM. Flags The function block does not use any flags. Timers The FB does not use any timers.4 Data and Standard Functions used by the FB Instance DB The function block MODBUS stores its data in an instance DB.

which then calls FB65. function block FB104 calls function block FB103. Manual edition 2. In this line-up it is possible to rewire FB65 since it is called by TCP_COMM (FB103) which has a smaller function block number than MOD_CLI (FB104). Behavior A set of rules concerning the function block numbering have to be considered when rewiring function blocks in SIMATIC STEP 7 Manager: When rewiring a function block make sure that the previous function blocks in the call hierarchy have descending numbers.Function Block MODBUSPN MOD_CLI and MOD_SERV: SFCs for Miscellaneous Functions The FBs MOD_CLI and MOD_SERV use the following SFCs from the standard library: TCP_COMM: SFCs for Miscellaneous Functions The FB TCP_COMM uses the following SFB from the standard library in addition to the T-blocks: 6.4 6-16 . SFC20. SFC24. FB65 and FB66 of FB TCP_COMM or the function blocks MODBUSPN. it is possible to rename the internally called function blocks FB63. It is not possible to rename the system functions SFC6. FB64. SFC51. MOD_SERV und TCP_COMM. SFC52 and SFB4. MOD_CLI. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.5 • SFC20 „BLKMOV“ • SFC24 “TEST_DB” • SFB4 „TON“ Renaming Standard Functions Inducement If the numbers of the standard functions are already assigned within your project or if the number interval is reserved for a different application. Exemplification: The call hierarchy in MODBUSPN: FB63 TSEND FB104 MOD_CLI FB102 MODBUSP FB64 TRCV FB103 TCP_COMM FB65 TCON FB105 MOD_SERV FB66 TDISCON Rewiring FB65 is possible: FB104 MOD_CLI FB103 TCP_COMM FB65 TCON Internally.

in order to re-wire the operands into free areas. since the function block MOD_CLI (FB104) has a higher function block number than MODBUSPN (FB102). add the modifications in the symbolism table supplementary.4 6-17 . Renaming To rename the blocks proceed as described subsequently: 1. After this step rewiring TCP_COMM (FB103) will be possible. though. Manual edition 2. To be able to keep on using the symbolism diagnostics tools. 2. The modifications can be verified by clicking "Extras > Reference data > Display". which then calls FB103. 3. 4. In this line-up it is not possible to rewire FB103. Set the operand priority in the object properties of the block folder to "Absolute value". it is necessary to temporarily assign a higher function block number to MODBUSPN (FB102) than MOD_CLI (FB104) has. Call the function "Extras > Re-wire" in the SIMATIC Manager. Get the information about the used operand by clicking "Extras > Reference data > Display". function block FB102 calls function block FB104. Solution: If FB103 is to be rewired.Function Block MODBUSPN Rewiring FB103 is not possible: FB102 MODBUSPN FB104 MOD_CLI FB103 TCP_COMM Internally. This is not necessary. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Afterwards MODBUSPN can have its original name reassigned.

The STATUS_CONN output displays status information and error codes with regard to the processing of the T functions.4 7-1 . you are provided with a general indication of errors that occurred during the telegram processing and connection handling. which caused the error at STATUS_MODBUS or STATUS_CONN. the MODBUSPN function block has 3 STATUS outputs. The output STATUS_FUNC shows the name of the function. you are provided with a general indication of errors that occurred during the Modbus-specific telegram processing. The STATUS parameters can be evaluated in the user program.Diagnosis 7 Diagnosis Diagnostic Function The diagnostic functions of the PN PLC enable a fast localization of errors. The following diagnostic features are available: • Diagnosis via the display elements of the PLC • Diagnosis via the STATUS_MODBUS and STATUS_CONN output of the MODBUSPN function block. external errors and interface-specific errors. Display Elements (LED) The display elements inform you about the operating mode or about the error conditions of the PLC. When reading the STATUS_MODBUS output. The display elements provide an overview of internal errors. STATUS Outputs of the FB MODBUSPN For an error diagnosis. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. When reading the STATUS outputs. Manual edition 2.

SF Group error When this LED is flashing. PN CPU 400 and IM 151-8 PN/DP CPU: .RX/TX a telegram is transferred via the integrated interface A detailed description of the display elements can be found in the device manual of the PLC.1 Diagnosis via the Display Elements of the PLC Display Functions The display elements of the PLC provide information on the status of the component. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. There are two types of display functions: • Group Error Displays PN CPU 300 . the Modbus block has not been licensed yet. You can find further information in section 5 “Licensing”. • Special Displays PN CPU 300. PN-CPU 400 . Manual edition 2.Diagnosis 7. You can find further information in section 5 “Licensing”.4 7-2 . the Modbus block has not been licensed yet.INTF Internal error When this LED is flashing.

2. A correction of the parameterization and a STOP Æ RUN transition of the PLC are necessary. • Receipt of the response telegram within the monitoring time The monitoring time can also elapse if less data than specified in the MODBUS telegram header is received. end_x. Manual edition 2. Subsequent errors with loss of telegrams can occur. Cyclical Operation S7 is Client Verification when the FB is called: • Valid registration key • DB MODBUS_PARAM is available with the necessary length • Range of values monitoring time RECV_TIME and CONN_TIME • Range of values START_ADRESS • Range of values LENGTH • When executing a request. With data_type_x = 0 the Modbus area is disabled and not further verified. Validity check of data_type_x 3.4 7-3 . Modbus addresses for the same data type defined in two db_x lead to an error message (address overlap). In the cyclical operation no requests are executed. db_x <> 0 4. db_x.2 Verification by the FB MODBUSPN During Start-up • Unambiguousness of the id parameter in the connection parameters of DB MODBUS_PARAM • Parameter group data_type_x. Errors during start-up provoke the ERROR bit to remain set. there also is a check whether the data block specified by the register or bit address is available and has the necessary length. Test end_x >= start_x 5. At least the first area (_1) has to be parameterized.Diagnosis 7. (x = 1 to 8) 1. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. start_x. The DB number must not be 0 and/or identical to the number of MODBUS_PARAM or the instance DB.

6. • Sent UNIT is equal to the received one • Sent FC is equal to the received one • Response is an exception code telegram • For write requests. If the function code is not equal to 1. • Protocol Identifier = 0 • Length between 6 and 207 • Received function code is verified. • Protocol identifier = 0 • Length is between 3 and 253 Additionally. there is also a check whether the data block specified by the register or bit address is available and has the necessary length. • FC 5 or FC6: Echo in the respond is equal to the request • Valid registration key • Receipt of the second part of the request telegram within the monitoring time The monitoring time can also elapse if less data than specified in the MODBUS telegram header is received. The DB number must not be 0 or identical to the number of MODBUS_PARAM or the instance DB. • During the execution of a request. • For write requests. the length in the header. 2. an exception telegram is sent. the start address and number of registers/bits have to match with the request telegram. 4. the number of registers or bits and the byte count in the telegram must match. In case of an error. an exception telegram is sent. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. 5. the length in the header of the response telegram is checked for plausibility regarding the request. If the number is too large. • The number of registers or bits is verified.Diagnosis Verification in the response telegram: Cyclical Operation S7 is Server • Received transaction identifier is equal to the sent one. 3. Manual edition 2. 15 or 16 an exception telegram is sent. Subsequent errors with loss of telegrams can occur.4 7-4 .

the FB terminates the connection: • Monitoring time for connection establishment exceeded • Monitoring time for receive exceeded • PI <> 0 • received TI different to sent TI • Length in the header does not match the length information in the telegram MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.4 7-5 .Diagnosis Termination of the Connection in Case of Error In special error situations. Manual edition 2.

Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text Remedy (Hex) A001 The parameter data block MODBUS_PARAM is too short. S7 is Client: Correct the parameters START_ADDRESS or LENGTH Other possible reasons: A004 • S7 is client: Wrong initialization parameter • S7 is server: Wrong address area in the request telegram of the client. SFC24. S7 is Server: Modify the request of the client. Correct the parameters. called by MOD_CLI or MOD_SERV.start_x + 1) * 2 .register values (end_x . SFC51 und SFC52.3 Diagnosis Messages of the FB MODBUSPN Messages at the STATUS Outputs of the FB The block MOBUSPN has 3 status outputs: STATUS_MODBUS. Error Messages of the called SFCs and FBs The FBs MODBUSPN. Applies only if S7 is client: An invalid combination of DATA_TYPE and WRITE_READ is given. For further details on the error messages. which caused the error.bit values (end_x . The S7 sends an exception telegram. Minimum length: . The error messages of these blocks are passed on to STATUS_CONN without any changes. STATUS_FUNC shows the name of the function.4 7-6 . Correct the parameterization in DB MODBUS_PARAM A003 The DB to which MODBUS addresses shall be mapped is too short. Only data type 1 or 3 can be written. Manual edition 2. The block TCP_COMM. MOD_CLI and MOD_SERV use the standard functions SFC6. STATUS is valid when ERROR is TRUE. SFC20.start_x ) / 8 + 1 Extend the DB. STATUS_MODBUS displays the error numbers regarding the processing of Modbus telegrams. FB63. STATUS_CONN and STATUS_FUNC.Diagnosis 7. please consult the diagnosis buffer or the online help of the SIMATIC Manager. FB65 and FB66. whereas STATUS_CONN displays the error numbers regarding the connection handling. The error messages of these blocks are passed on to STATUS_MODBUS without any changes. Correct the length of MODBUS_PARAM A002 The parameter end_x is less than start_x. FB64. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Below you can find a list of FB-specific error messages. uses the standard blocks SFB4.

Diagnosis Error messages of FB MODBUS MODBUSPN at the output STATUS_MODBUS STATUS Event text Remedy (Hex) A005 S7 is client: An invalid value for the parameter LENGTH is given. Verify the data of the communication partner with the help of a telegram trace. A009 Only if S7 is client: The received transaction identifier TI is not equal to the sent one. 4. 5. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. 2. 15 and 16. S7 is server: An invalid function code was received. A00A Only if S7 is client: The received UNIT is not equal to the sent one. The S7 sends an exception telegram. Range of values: Read coils/inputs: 1 to 2000 Write coils: 1 to 1968 Read registers: 1 to 125 Write holding registers: 1 to 123 A006 The given range of registers defined with DATA_TYPE. S7 is Server: Modify the number in the request telegram. The connection is terminated. S7 is Server: The number of registers/bits in the request telegram is invalid. The FB ignores all data. CONN_TIME 100ms Correct the parameterization. 3. A00D Only if S7 is client: The register or bit address respectively the number of registers or bits in the response telegram is not equal to the one in the request telegram. The connection is terminated. START_ADDRESS. START_ADDRESS and LENGTH does not exist in data_type_1 to data_type_8. The S7 sends an exception telegram. S7 is server: The FB MODBUS only supports the function codes 1. A00E The length indicated in the MODBUS-specific telegram header does not match the number of registers/bits or the byte count in the telegram. A00C The received byte count does not match the number of registers. A00B S7 is client: Received function code is not equal to the sent one. S7 is Client: Correct the parameter LENGTH. 6. A007 Only if S7 is client: An invalid monitoring time RECV_TIME or CONN_TIME is parameterized. S7 is Client: Correct the parameter combination DATA_TYPE. S7 is server: The S7 sends an exception telegram. S7 is client: Verify the data of the communication partner with the help of a telegram trace.4 7-7 . Manual edition 2. LENGTH. The connection is terminated. Verify the data of the communication partner with the help of a telegram trace. The RECV_TIME has to be at least 20 ms. S7 is Server: Modify the request of the client or correct the parameterization of data_type_x.

Manual edition 2. A018 The parameterized areas data_type_1 and data_type_8 overlap.4 7-8 . MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. A01A Wrong length in the Modbus header (1 to 253 byte are valid). A017 The parameterized areas data_type_1 and data_type_7 overlap. A016 The parameterized areas data_type_1 and data_type_6 overlap. it is reserved for system functions. Please contact the product support. A034 The parameterized areas data_type_3 and data_type_4 overlap. A013 The parameterized areas data_type_1 and data_type_3 overlap. Correct the parameterization in DB MODBUS_PARAM. Verify the data of the communication partner with the help of a telegram trace. Verify the data of the communication partner with the help of a telegram trace. The data areas must not contain any overlapping register areas. The data areas must not contain any overlapping register areas. Correct the parameterization in DB MODBUS_PARAM. The connection is terminated. A010 In the parameters db_1 to db_8 a DB number is used twice. A015 The parameterized areas data_type_1 and data_type_5 overlap. A026 The parameterized areas data_type_2 and data_type_5 overlap. A01F The FB MODBUSPN has turned to an invalid state. to 4).Diagnosis Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text Remedy (Hex) A00F A protocol identifier <> 0 was received. A025 The parameterized areas data_type_2 and data_type_5 overlap. Correct the parameterization in DB MODBUS_PARAM. A011 An invalid value for DATA_TYPE is given (Value range: 1 Correct the parameters. A027 The parameterized areas data_type_2 and data_type_5 overlap. A012 The parameterized areas data_type_1 and data_type_2 overlap. A028 The parameterized areas data_type_2 and data_type_5 overlap. A014 The parameterized areas data_type_1 and data_type_4 overlap. Correct the parameterization in DB MODBUS_PARAM A024 The parameterized areas data_type_2 and data_type_4 overlap. A019 0 is assigned to one of the parameters db_x while the according data_type_x is <> 0. DB 0 can’t be used. A023 The parameterized areas data_type_2 and data_type_3 overlap. The connection is terminated.

The data areas must not contain any overlapping register areas. A068 The parameterized areas data_type_6 and data_type_8 overlap. A079 The connection ID of parameter ID is not defined in DB MODBUS_PARAM. A045 The parameterized areas data_type_4 and data_type_5 overlap. A07A An invalid value ID is parameterized. A058 The parameterized areas data_type_5 and data_type_8 overlap. A046 The parameterized areas data_type_4 and data_type_6 overlap. The parameter area _1 is the default area and must be defined. A037 The parameterized areas data_type_3 and data_type_7overlap. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. A07C An invalid value data_type_x was given. Manual edition 2. Correct the parameterization in DB MODBUS_PARAM. A07E The DB number of db_x is identical to the number of the parameter DB MODBUS_PARAM or to the instance DB. A078 The parameterized areas data_type_7 and data_type_8 overlap. A057 The parameterized areas data_type_5 and data_type_7 overlap. A056 The parameterized areas data_type_5 and data_type_6 overlap. A048 The parameterized areas data_type_4 and data_type_8 overlap. A07D Parameter data_type_1 is not defined. The length information in DBW0 was changed or a wrong DB was defined. A047 The parameterized areas data_type_4 and data_type_7 overlap. A07B The parameter ID exists twice in the parameter DB.4 7-9 . The value range is 0 to 4.Diagnosis Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text Remedy (Hex) A035 The parameterized areas data_type_3 and data_type_5 overlap. Range of values is 1 to 4095. A067 The parameterized areas data_type_6 and data_type_7 overlap. Correct the parameterization at the input ID. A038 The parameterized areas data_type_3 and data_type_8overlap. A07F The data block defined at DB_PARAM is no parameter DB for Modbus communication. Correct the parameterization in DB MODBUS_PARAM A036 The parameterized areas data_type_3 and data_type_6 overlap.

A084 The character string for identification “IDENT_CODE” could not be determined. Verify the project if there is any invalid write access to the license DB. A094 An exception telegram with exception code 4 was received (only if S7 is client) The communication partner is in a state. Please contact the Product Support. A085 An error occurred during the license handling.g. A082 Only if S7 is client and function code 6: The received register value is not equal to the sent one. in which the received request can’t be processed.4 7-10 . Manual edition 2. A093 An exception telegram with exception code 3 was received (only if S7 is client) The communication partner can’t process the received request (e. doesn’t support the requested length). Please contact the Product Support. A092 An exception telegram with exception code 2 was received (only if S7 is client) Correct LENGTH or START_ADDRESS at the call of the FB.Diagnosis Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text Remedy (Hex) A080 The parameter DB_PARAM was changed without a restart of the CPU. DB_PARAM is an initialization parameter. A091 An exception telegram with exception code 1 was received (only if S7 is client) The communication partner does not support the requested function. See also section 5 “Licensing”. A090 The block MODBUSPN is not licensed for this CPU. This is a status information. The Modbus communication runs without a license as well. Restart the CPU after changing this parameter. Wait with the initiation of a new request until the previous one was finished either with DONE/NDR = TRUE or ERROR = TRUE. Read the identification string IDENT_CODE for this CPU and order the registration key at IT4industry. Verify the data of the communication partner with the help of a telegram trace. A095 An exception telegram with an unknown exception code was received (only if S7 is client). MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Verify the data of the communication partner with the help of a telegram trace. Check the error message of the communication partner and verify the data with a telegram trace if needed. A081 Only if S7 is client and function code 5: The received coil status is not equal to the sent one. The bit ERROR is not set. An attempt to an invalid or non existing address at the communication partner was made. A083 Only if S7 is client: A request was initiated prior to the completion of the previous one.

Check the parameterization of the connection. the connection is terminated.Diagnosis Error messages of FB MODBUSPN at the output STATUS_CONN STATUS Event text Remedy (Hex) A100 The monitoring time CONN_TIME or RECV_TIME was exceeded when executing a job. Please contact the product support. When RECV_TIME is exceeded. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. A101 The monitoring time of the TDISCON is exceeded. Manual edition 2.4 7-11 .

MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. See online help (SIMATIC manager -> mark block -> key F1) Error messages of FB 63. All data blocks that are specified in DB_x must be created and copied into the PLC.4 Diagnosis Messages of Called Blocks Error messages of SFC 6 and SFC 20 at the output STATUS_MODBUS STATUS Event text Remedy (Hex) 7xxx For detailed information please refer to the online help of SIMATIC Manager.4 7-12 . 80B1 The DB does not exist in the PLC. FB 64. See online help (SIMATIC manager -> mark block -> key F1) 8xxx For detailed information please refer to the online help of SIMATIC Manager. when FB MODBUSPN is called with different instance DBs in OB1 or cyclic interrupt OB and OB100. Manual edition 2. This error code is also reported. FB 65 and FB 66 at the output STATUS_CONN STATUS Event text Remedy (Hex) 7xxx For detailed information please refer to the online help of SIMATIC Manager. Use the same IDB for the call of MODBUSPN in OB1 or cyclic interrupt OB and OB100.5 Diagnosis Messages of SFC24 Error messages of SFC24 at the output STATUS_MODBUS STATUS Event text Remedy (Hex) 80A1 DB Number = 0 or too large for the PLC Choose a valid DB number.Diagnosis 7. See online help (SIMATIC manager -> mark block -> key F1) 8xxx For detailed information please refer to the online help of SIMATIC Manager. See online help (SIMATIC manager -> mark block -> key F1) 7. 80B2 DB UNLINKED DB must not be created as UNLINKED.

Manual edition 2. Example Project on the CD On the CD you can find an extensive example project which offers all varieties of parameterization possibilities for the Simatic stations. Please note. • Simatic Station is S7-300. the provided example project is meant for information purposes only.4 8-1 .Application Sample 8 Sample Application General Information The following simple programming example illustrates the use of FB MODBUSPN. It displays the handling of the Modbus blocks and is not to be understood as a solution for a customer-specific installation configuration. S7-400 or IM 151-8 PN/DP CPU • Simatic Station is client or server MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.

Manual edition 2.Application Sample Sample Program The programming example consists of the blocks: • Start-Up OB100 with call of FB102 • Programming error OB121 • Cyclic program processing OB1 with call of FB102 • Global DBs for job trigger (e.g. with variable table) and for licensing • Data blocks for register and bit values Used Blocks The following blocks are used in the provided sample project for S7 stations with FB MODBUSPN. Block Symbol Comment OB 1 CYCL_EXC cyclic program processing OB 100 COMPLETE RESTART start-up OB for restart OB 121 PROG_ERR programming error OB FB 102 MODBUSPN FB MODBUSPN FB 103 TCP_COMM FB TCP_COMM FB 104 MOD_CLI FB MOD_CLI FB 105 MOD_SERV FB MOD_SERV DB 1 CONTROL_DAT work DB CONTROL DAT for FB MODBUSPN DB 2 MODBUS_PARAM parameter DB PARAM_DB for FB MODBUSPN DB 3 LICENSE_DB license data block for FB MODBUSPN DB 102 IDB_MODBUS instance DB for FB MODBUSPN DB 11 DATA_AREA_1 value DB for area 1 DB 12 DATA_AREA_2 value DB for area 2 DB 13 DATA_AREA_3 value DB for area 3 DB 14 DATA_AREA_4 value DB for area 4 DB 15 DATA_AREA_5 value DB for area 5 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.4 8-2 .

4 Appendix .modbus-IDA.A Literature MODBUS IDA MODBUS APPLICATION PROTOCOL SPECIFICATION V1.1b. 2006 http://www. Manual edition 2. December 28.1 .org MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02.

different input and output devices as well as HMI devices. Blocks Blocks are elements of the user program which are defined by their function. Configuration The configuration is the set up of individual modules of the PLC in the configuration table. Module for communications tasks.4 Glossary .> transmission rate Block Call A block call occurs when program processing branches to the called block Block Parameter Block parameters are variables within multiple-use blocks. C Client A client is a device or. or purpose. in general terms. SFB. Subnets can consist of bus segments and connectivity devices such as repeaters and bridges. SDB) • User-defined data types (UDT) Part of a -> subnet.Glossary A Address The address identifies a physical storage location. OB. Connection Parameterization The specification of a connection ID in the system function block. an object that requests a service from a -> server. B Baud Rate . MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Segments are transparent for addressing. SFC) • Data blocks (DB. With the help of a connection ID the system function blocks can communicate between two communication points. which are replaced with actual values when the relevant block is called. CP Communications Processor.1 . Automation System An automation system is a programmable logic controller that contains at least a PLC. FC. Communications Processor Communications processors are modules for point-to-point connections and bus connections. structure. the operand stored there can be directly accessed. With STEP7 there are Bus Segment • Code blocks (FB. Manual edition 2. If the address is known.

Cyclic Program Processing In cyclic program processing. in which detailed information on diagnostic events are stored in the order in which they occur. Complex data can be stored in structured form. operating system. a program error or by operating mode transitions. errors on a module or system errors in the PLC. for example.2 . H Hardware Hardware is the term given to all the physical and technical equipment of a PLC. the user program is executed in a constantly repeating program loop.4 Glossary . They are classified into elementary and structured data types. in accordance with the IEC standard. Default Setting The default setting is a basic setting which is always used if no other value is specified. F Function Block (FB) Function blocks are components of the user program and. The data held in the data blocks can be accessed absolutely or symbolically. Diagnostic Event Diagnostic events are. D Data Block (DB) These are blocks containing data and parameters with which the user program works. analysis and reporting of errors within the automation system. They are subdivided into global data blocks and instance data blocks. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Cycle Time The cycle time is the time the PLC needs to execute the user program once. Diagnostic Functions The diagnostics functions cover the entire system diagnosis and include detection. CRC Cyclic Redundancy-Check = Checksum which guarantees a high probability of error recognition. data blocks do not contain instructions. Download Downloading means loading objects (e. are ”blocks with memory”. The memory for the function block is an assigned data block.g. Manual edition 2. Function blocks can be parameterized but can also be used without parameters. memory.CPU Central processing unit of the S7 programmable logic controller with control and arithmetic unit. code blocks) from the programming device into the load memory of the PLC. Diagnostic Buffer Every PLC has a diagnostic buffer. a so called ”instance data block”. Unlike all other blocks. which are caused by. and interfaces to I/O modules. Data Type Data types allow users to define how the value of a variable or constant is to be used in the user program. called a cycle. say.

3 (ISO 8802-2) Instance Data Block An instance data block is a block assigned to a function block and contains data for this special function block. Interface Module On the interface module the physical conversion of signals takes place. It can be both absolutely and symbolically addressed. A distinction is made between static and dynamic module parameters.3 . Operating Mode The SIMATIC S7 programmable controllers have three different operating modes: STOP. Online Help STEP7 allows you to display contextual help texts on the screen while working with the programming software. The functionality of the PLCs varies in the individual operating modes. Offline means that no such data connection exists.I Industrial Ethernet A LAN system complying with IEEE 802. O Online / Offline Online means that a data connection exists between PLC and programming device. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. M MAC-Address Address to distinguish between different stations connected to a common transmission medium (Industrial Ethernet). Module Modules are pluggable printed circuit boards for programmable logic controllers Module Parameters Module parameters are used to set the module behaviors. N NCM S7 for Industrial Ethernet Configuration software for configuration and diagnostic functions on an Ethernet CP. Interrupt Interrupt is a name for a break of the program processing in the processor of an automation system by an external alarm.4 Glossary . Manual edition 2. START UP and RUN. Operand An operand is part of a STEP7 instruction and states with what the processor is to do something. Media Access Control (MAC) Mechanisms for controlling access by a station to a common transmission medium shared with other stations. By exchanging the pluggable interface module you can adapt the communications processor to the physical interface of the communications partner. Operating System of the PLC The operating system of the PLC organizes all functions and operations of the PLC which are not connected to a specific control task.

the signal states of the input modules are transferred to the process image input table. for example. Subnet A subnet is part of a -> network whose parameters must be matched. A service is started at the instigation of a -> client. START UP The operating mode START UP is active when the PLC transits from operating mode STOP to operating mode RUN. Software Software is the term given to all programs used on a computer system. the process image of the outputs is transferred to the output modules as output signals. They are classified into system data blocks. System Block System blocks differ from the other blocks in that they are already integrated into the S7-400 system and are available for already defined system functions. A subnet consists of several stations with unique -> MAC addresses. These rules are called protocols. be connected together by -> gateways to form a network. and system function blocks. System Function Block (SFB) System function blocks are software modules with memory which are already integrated into the operating system of the S7-PLC and can be called up by the user as required. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Subnets can. or in general terms. A distinction is made between block parameters and module parameters. At the end of the cyclic program. A system consists of several subnets with unique subnet numbers. Procedure The execution of a data interchange operation according to a specific protocol is called a procedure. System Function (SFC) System functions are software modules without memory which are already integrated into the operating system of the S7-PLC and can be called by the user as required.4 . Manual edition 2. The subnet includes bus components and all the attached stations. an object that provides certain services. system functions. These include the operating system and the user programs. S Server A server is a device. Parameterization Parameterization means setting the behavior of a module. At the beginning of the cyclic program. R Rack A rack is a rail containing slots for mounting modules.P Parameter Parameters are values that can be assigned.4 Glossary . STEP7 STEP7 is the programming software of SIMATIC S7. Protocol The communications partners involved in a data interchange must abide by fixed rules for handling and implementing the data traffic. Process image This is a special memory area in the PLC.

Manual edition 2.g. code blocks) from the load memory of the PLC into the programming device. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. E 1. The user program for SIMATIC S7 is structured and is divided into smaller units called blocks. he set or selected transmission rate depends on various conditions. W Work Memory The work memory is a RAM on the PLC which the processor accesses while processing the user program. this is the number of binary decisions transmitted per time unit.0) which can have a symbolic name and can therefore also be addressed symbolically. V Variable A variable is an operand (e. Transmission Rate According to DIN 44302.4 Glossary . User Program The user program contains all instructions and declarations for signal processing.g. for example the distance across U Upload Uploading means loading objects (e. by means of which a system or a process can be controlled.5 .T Tool A tool is a piece of software that is capable of accessing operating system functions in a programming device. The unit is bps.

industry@siemens.4 Stand: 02/2010 . 60 91052 Erlangen Tel: ++49 9131 7-46111 Fax: ++49 9131 7-44757 Mail: it4.Customer Support Siemens AG Industry Sector I IS IN E&C Werner-von-Siemens-Str. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02. Manual edition 2.com http://www.com/s7modbus Siemens Aktiengesellschaft Subject to change without prior notice.siemens.