hit counter script
Siemens SIMATIC S7 Manual
  1. Manuals
  2. Brands
  3. Siemens Manuals
  4. Controller
  5. SIMATIC S7
  6. Manual

Siemens SIMATIC S7 Manual

S7 open modbus / tcp communication via the integrated pn interface of the plc
Hide thumbs Also See for SIMATIC S7:
Table of Contents

Advertisement

Quick Links

See also: System Manual , User Manual
SIMATIC
S7 - OPEN MODBUS / TCP Communication
via the integrated PN interface of the PLC
Manual

Advertisement

Table of Contents
loading

Related Manuals for Siemens SIMATIC S7

Summary of Contents for Siemens SIMATIC S7

  • Page 1 SIMATIC S7 - OPEN MODBUS / TCP Communication via the integrated PN interface of the PLC Manual...
  • Page 2 Preface, Table of Contents Product Description Getting Started SIMATIC S7 Commissioning S7 OPEN MODBUS / TCP Parameterization Communication via the Licensing integrated PN interface of the PLC FB MODBUSPN Manual Diagnosis Sample Application Appendices Literature Glossary Edition 2.1...
  • Page 3 This device may only be used for applications as prescribed in the catalogue and the technical description. Furthermore, they may only be used in conjunction with third-party devices and components recommended and authorized by Siemens. A successful and safe operation of this product is depends on proper transport, and correct storage, installation and assembly as well as careful operation and maintenance.
  • Page 4 Additional (Startup, commissioning etc.) can be found in the manuals Sources of Information SIEMENS SIMATIC S7-300 CPU 31xC and CPU 31x: Installation Operating Instructions A5E00105491-07 MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02; Manual edition 2.1...
  • Page 5 Preface SIEMENS SIMATIC S7-300 CPU 31xC and CPU 31x, Technical Specifications Manual A5E00105474-07 SIEMENS SIMATIC S7-400 Automation System S7-400 Hardware and Installation Operating Instructions A5E00850740-01 SIEMENS SIMATIC S7-400 S7-400 Automation System, CPU Specifications Manual A5E00850746-06 SIEMENS SIMATIC Distributed I/Os ET 200S...
  • Page 6 Preface Additional For further questions regarding the use of the FBs described in this manual, please contact your Siemens partner who provided you with this function Questions block. Terminology This document uses the term PN PLC. The descriptions apply to PN PLCs of series 315, 317, 319, 414 and 416 as well as IM 151-8 PN/DP CPU.

  • Page 7: Table Of Contents

    Table of contents Table of Contents Product Description....................... 1-1 Field of Applications..................1-1 Hardware and Software Prerequisites.............. 1-1 Getting Started ....................... 2-1 Commissioning ......................3-1 Installing the Library on the STEP7 PG/-PC ............ 3-1 PLC – Assigning the IP Address ..............3-2 Insertion of the Function Blocks into the Program..........

  • Page 8: Product Description

    Simatic PLC with integrated PN interface and a device that supports the Open MODBUS/TCP protocol. Data transmission is carried out in accordance with the client-server principle. The SIMATIC S7 can act as both, a client and a server, during the data transmission. Use of Port In general, the protocol uses the port 502.
  • Page 9 Product description Memory The FB MODBUSPN requires 6048 byte work memory and 7294 byte load memory. requirements The FB MOD_CLI requires 11184 byte work memory and 12054 byte load memory. The FB MOD_SERV requires 10660 byte work memory and 11452 byte load memory.

  • Page 10: Getting Started

    Getting started Getting Started Procedure 1. Install “OpenModbusTCP PN CPU“ and insert the Modbus function blocks into your SIMATIC project. => Section 3.1 to 3.3 2. Parameterize the connection parameters regarding your requirements (IP-address, port number, etc.). => Section 4.1 and 4.2 3.

  • Page 11: Commissioning

    To initially access the Modbus library, use the browse function of the “Open” dialog for libraries. The manual can be accessed via short cut under \Program Files \Siemens\ Documentation as well. MODBUS / TCP communication via the integrated PN interface of the CPU...

  • Page 12: Plc - Assigning The Ip Address

    Commissioning PLC – Assigning the IP Address Introduction Each node on the Ethernet network is identified by an internationally unique address. This so-called MAC address is preset by the manufacturer and cannot be changed. Following the steps below, you can assign an IP address in the Ethernet to this physical address.
  • Page 13 Commissioning 3. Enter the IP address and the subnet mask. To establish a connection via a router, enter the address of the router as well. 4. Click on "New" to assign a name for a new Industrial Ethernet subnet. Confirm your entries with "OK". Result: You created a new Industrial Ethernet subnet.

  • Page 14: Insertion Of The Function Blocks Into The Program

    Commissioning Insertion of the Function Blocks into the Program Content of the The following blocks are required for the Modbus communication: MODBUS library • MODBUSPN • MOD_CLI • MOD_SERV • TCP_COMM The blocks have to be copied from the library into your project. Additionally, the library contains the parameter data block MODBUS_PARAM as a draft.

  • Page 15: Parameterization Of The Modbus Communication

    Parameterisation of the Modbus Communication Parameterization of the Modbus Communication General For the communication via the integrated PN interface of the PLC, a network Information configuration in NetPro is not necessary. The connections are established and terminated by means of the function blocks TCON (FB65) und TDISCON (FB66).

  • Page 16: Parameterization With The Wizard

    Modbus parameters) is created. It is recommended to use the wizard for the parameterization of the block MODBUS_PARAM. You can find the wizard at http://support.automation.siemens.com/WW/view/en/31535566. MODBUS / TCP communication via the integrated PN interface of the CPU 2XV9450-1MB02; Manual edition 2.1...

  • Page 17: Editing The Parameterization

    Parameterisation of the Modbus Communication Editing the Parameterization Procedure Copy DB2 of the library Modbus_PN_CPU and insert them in your project. If the number is already used, rename the DB. The parameter of data block MODBUS_PARAM must not be changed during runtime.
  • Page 18 CPU416 The values vary depending on the used firmware. You can find further information on the internet: http://support.automation.siemens.com/WW/view/en/24294554 active_est This parameter defines the way the connection is established (active or passive). It is recommended that the Modbus client performs an active connection establishment while the Modbus server establishes passive connections.
  • Page 19 Parameterisation of the Modbus Communication local_tsap_id This parameter defines the local port number. The representation depends on the parameter connection_type. The value range depends on the PLC. The port number has to be unique within the PLC. With connection_type B#16#01 local_tsap_id[1] low byte of the local port number in hexadecimal local_tsap_id[2]...
  • Page 20 Parameterisation of the Modbus Communication Adaption of the The Modbus parameters in the block MODBUS_PARAM define the mode of operation of the Modbus communication and the address reference of Modbus Modbus addresses and SIMATIC addresses. Parameters server_client TRUE: S7 is server FALSE: S7 is client In operating mode “S7 is client”...
  • Page 21 Parameterisation of the Modbus Communication connect_at_ This parameter defines the point in time at which the connection is being established. startup FALSE: establish connection when ENQ_ENR=TRUE TRUE: establish connection immediate after PLC start-up When connect_at_startup = TRUE, the first request should be started after the connection was established (CONN_ESTABLISHED = TRUE) or an error has been reported respectively (ERROR =TRUE).
  • Page 22 Parameterisation of the Modbus Communication start_x Start_x specifies the first register or bit address, which is stored in the data element 0 of the DB. End_x defines the of the last MODBUS address. end_x When accessing registers, the number of the data element of the S7 DB in which the last register is mapped, can be calculated with the following formula: DBW number = (end_x –...

  • Page 23: Licensing

    Licensing Licensing General The block MODBUSPN must be licensed for each CPU individually. The licensing takes place in two steps: reading the IDENT_CODE and declaring the registration key REG_KEY. To read the IDENT_CODE please proceed as follows: Read the IDENT_CODE 1.
  • Page 24 Copy this string per copy/paste from the DB und and insert it in the form IT4Industry SOFTWARE REGISTRATION FORM. This form is stored in the library path ..\Program Files\Siemens\Step7\S7LIBS\Modbus_PN_CPU during installation and is also available on the installation CD. Insert the License-No. of the product package into the form.
  • Page 25 Licensing Declaration of the The registration key REG_KEY must be declared for each call of the block MODBUSPN. Registration Key REG_KEY The registration key REG_KEY should be stored in a global DB. Via this global DB all MODBUSPN blocks can receive the registration key (See also the following example).
  • Page 26 Licensing Missing or Wrong When the registration key is missing or a wrong one is detected, the SF LED (S7-300 and IM151-8) or the INTF LED (S7-400) of the CPU is flashing. A Licensing cyclic error message regarding the missing license is displayed in the diagnostic buffer too.

  • Page 27: Function Block Modbuspn

    Function Block MODBUSPN Function Block MODBUSPN Functionality of the FB General The function block MODBUSPN enables a communication between a PLC with integrated PN interface and a partner which supports Open Information MODBUS/TCP. The function codes 1, 2, 3, 4, 5, 6, 15 and 16 are supported. Depending on the parameterization, the FB can be operated either in client or in server mode.
  • Page 28 Function Block MODBUSPN Call of the FB For a correct program sequence the function block MODBUSPN has to be called in 3 organization blocks: • OB100 Start-Up • OB121 Programming Error • Cyclic OB (OB1 or cyclic interrupt OB, e.g. OB35) The subordinate blocks of the Modbus library MOD_CLI, MOD_SERV and TCP_COMM must not be called additionally in an organization block.
  • Page 29 Function Block MODBUSPN Connection Active connection establishment can be carried out by the Modbus client as well as the Modbus server. It is recommended explicitly that the Modbus client Handling executes the active establishment. The relevant information is read from the connection parameters of DB MODBUS_PARAM.
  • Page 30 Function Block MODBUSPN Initiate Request A rising edge at the trigger input ENQ_ENR initiates a request. Depending on the input parameters UNIT, DATA_TYPE, START_ADDRESS, LENGTH, TI S7 is Client and WRITE_READ, a MODBUS request telegram is generated and sent to the partner station via the TCP/IP connection.

  • Page 31: Parameters Of The Function Block Modbuspn

    Function Block MODBUSPN Parameters of the Function Block MODBUSPN Parameter Decl. Type Description Value range Init WORD Connection ID, must be identical to the 1 to 4095 associated parameter in the local W#16#1 to connection description W#16#FFF DB_PARAM BLOCK_ Number of the parameter DB depending on RECV_TIME TIME...
  • Page 32 Function Block MODBUSPN Parameter Decl. Type Description Value range Init ERROR OUT BOOL An error has occurred TRUE No error has occurred FALSE STATUS_ OUT WORD Error number for protocol errors when 0 to FFFF MODBUS evaluating a Modbus telegram STATUS_ OUT WORD Error number for connection errors during...
  • Page 33 Function Block MODBUSPN General The parameters of the FB MODBUSPN can be divided into two groups: Information • Initialization parameters • Runtime parameters Initialization parameters are evaluated only during the call of OB100 and are adopted into the instance DB. They are marked with “yes“ in the column “INIT“...
  • Page 34 Function Block MODBUSPN To each connection between the PN PLC and a communication partner a connection ID is assigned. When operating various connections an individual ID is required for each logical connection. This connection ID is defined in the connection parameter block, which is part of the parameter data block MODBUS_PARAM.
  • Page 35 Function Block MODBUSPN ENQ_ENR Operating mode S7 is Client: The data transfer is initiated with a TRUE edge at the input. The request telegram is generated with the values of the input parameters UNIT, DATA_TYPE, START_ADDRESS, LENGTH, TI and WRITE_READ. A new request may only be initiated when the previous one is ended with DONE_NDR or ERROR.
  • Page 36 Function Block MODBUSPN DONE_NDR The parameter DONE_NDR indicates an error-free execution of the request. In the operating mode S7 is Client, the activated request was executed without an error. With a reading function, the response data from the server has already been entered into the DB. With a writing function, the response to the request telegram has been received from the server.
  • Page 37 Function Block MODBUSPN DATA_TYPE The parameter DATA_TYPE defines which Modbus data type is to be accessed with the current job. The following data types are available: Coils B#16#1 Inputs B#16#2 Holding Register B#16#3 Input Register B#16#4 In the operating mode S7 is Client, DATA_TYPE is an input parameter. In the operating mode S7 is Server, DATA_TYPE is an output parameter.

  • Page 38: Example Of Address Mapping

    Function Block MODBUSPN The parameter TI (Transaction Identifier) is copied by the server from the request telegram to the respond telegram according to the MODBUS specification. In the operating mode S7 is Client, this is an input parameter. The FB copies this value to the request telegram and verifies it when receiving the respond telegram.
  • Page 39 Function Block MODBUSPN Example: data_type_1 B#16#3 Holding Register db_1 W#16#B DB 11 start_1 W#16#1 Start address: 1 Parameterization end_1 W#16#1F4 End address: 500 of the Memory data_type_2 B#16#3 Holding Register Areas db _2 W#16#C DB 12 start _2 W#16#2D0 Start address: 720 end _2 W#16#384 End address: 900...
  • Page 40 Function Block MODBUSPN SIMATIC Modbus device DB 14 Coils (from 00001) + 0.0 00001 + 0.1 00641 +76.2 1250 00642 DB 16 + 0.0 1700 1250 01251 + 0.1 1701 1700 01701 +74.7 2299 +75.0 2300 2300 02301 Inputs (from 10001) 2301 02302 DB 15...

  • Page 41: Data And Standard Functions Used By The Fb

    Function Block MODBUSPN Data and Standard Functions used by the FB Instance DB The function block MODBUS stores its data in an instance DB. This instance DB is created by STEP7 when initially calling the FB. The instance data block contains parameters of the types input, output and input/output as well as static variables required for its execution.

  • Page 42: Renaming Standard Functions

    Function Block MODBUSPN MOD_CLI and The FBs MOD_CLI and MOD_SERV use the following SFCs from the standard library: MOD_SERV: SFCs for • SFC20 „BLKMOV“ Miscellaneous • Functions SFC24 “TEST_DB” TCP_COMM: The FB TCP_COMM uses the following SFB from the standard library in addition to the T-blocks: SFCs for Miscellaneous...

  • Page 43: Diagnosis

    Diagnosis Diagnosis Diagnostic The diagnostic functions of the PN PLC enable a fast localization of errors. Function The following diagnostic features are available: • Diagnosis via the display elements of the PLC • Diagnosis via the STATUS_MODBUS and STATUS_CONN output of the MODBUSPN function block.

  • Page 44: Diagnosis Via The Display Elements Of The Plc

    Diagnosis Diagnosis via the Display Elements of the PLC Display Functions The display elements of the PLC provide information on the status of the component. There are two types of display functions: • Group Error Displays PN CPU 300 - SF Group error When this LED is flashing, the Modbus block has not been licensed yet.

  • Page 45: Verification By The Fb Modbuspn

    Diagnosis Verification by the FB MODBUSPN • During Start-up Unambiguousness of the id parameter in the connection parameters of DB MODBUS_PARAM • Parameter group data_type_x, db_x, start_x, end_x. (x = 1 to 8) 1. With data_type_x = 0 the Modbus area is disabled and not further verified.
  • Page 46 Diagnosis Verification in the response telegram: • Received transaction identifier is equal to the sent one. • Protocol identifier = 0 • Length is between 3 and 253 Additionally, the length in the header of the response telegram is checked for plausibility regarding the request. •...
  • Page 47 Diagnosis Termination of the In special error situations, the FB terminates the connection: Connection in • Case of Error Monitoring time for connection establishment exceeded • Monitoring time for receive exceeded • PI <> 0 • received TI different to sent TI •...

  • Page 48: Diagnosis Messages Of The Fb Modbuspn

    Diagnosis Diagnosis Messages of the FB MODBUSPN Messages at the The block MOBUSPN has 3 status outputs: STATUS_MODBUS, STATUS_CONN and STATUS_FUNC. STATUS Outputs STATUS_MODBUS displays the error numbers regarding the processing of of the FB Modbus telegrams, whereas STATUS_CONN displays the error numbers regarding the connection handling.
  • Page 49 Diagnosis Error messages of FB MODBUS MODBUSPN at the output STATUS_MODBUS STATUS Event text Remedy (Hex) A005 S7 is client: S7 is Client: An invalid value for the parameter LENGTH is given. Correct the parameter LENGTH. S7 is Server: The number of registers/bits in the request telegram is S7 is Server: invalid.
  • Page 50 Diagnosis Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text Remedy (Hex) A00F A protocol identifier <> 0 was received. Verify the data of the communication partner with the The connection is terminated. help of a telegram trace. A010 In the parameters db_1 to db_8 a DB number is used Correct the parameterization in...

  • Page 51: Parameterization

    Diagnosis Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text Remedy (Hex) A035 The parameterized areas data_type_3 and data_type_5 Correct the parameterization in overlap. DB MODBUS_PARAM A036 The parameterized areas data_type_3 and data_type_6 The data areas must not overlap.

  • Page 52: Licensing

    Diagnosis Error messages of FB MODBUSPN at the output STATUS_MODBUS STATUS Event text Remedy (Hex) Verify the data of the A081 Only if S7 is client function code 5: communication partner with the The received coil status is not equal to the sent one. help of a telegram trace.

  • Page 53: Fb Modbuspn

    Diagnosis Error messages of FB MODBUSPN at the output STATUS_CONN STATUS Event text Remedy (Hex) A100 The monitoring time CONN_TIME or RECV_TIME was Check the parameterization of exceeded when executing a job. the connection. When RECV_TIME is exceeded, the connection is terminated.

  • Page 54: Diagnosis Messages Of Called Blocks

    Diagnosis Diagnosis Messages of Called Blocks Error messages of SFC 6 and SFC 20 at the output STATUS_MODBUS STATUS Event text Remedy (Hex) 7xxx For detailed information please refer to the online help See online help (SIMATIC of SIMATIC Manager. manager ->...

  • Page 55: Sample Application

    Application Sample Sample Application General The following simple programming example illustrates the use of FB MODBUSPN. Information Please note, the provided example project is meant for information purposes only. It displays the handling of the Modbus blocks and is not to be understood as a solution for a customer-specific installation configuration.

  • Page 56: A Literature

    A Literature MODBUS IDA MODBUS APPLICATION PROTOCOL SPECIFICATION V1.1b, December 28, 2006 http://www.modbus-IDA.org MODBUS / TCP communication via the integrated PN interface of the CPU Appendix - 1 2XV9450-1MB02; Manual edition 2.1...
  • Page 57 Glossary Address The address identifies a physical storage location. If the address is known, the operand stored there can be directly accessed. Automation System An automation system is a programmable logic controller that contains at least a PLC, different input and output devices as well as HMI devices.
  • Page 58 Central processing unit of the S7 programmable logic controller with control and arithmetic unit, memory, operating system, and interfaces to I/O modules. Cyclic Redundancy-Check = Checksum which guarantees a high probability of error recognition. Cycle Time The cycle time is the time the PLC needs to execute the user program once.
  • Page 59 It can be both absolutely and symbolically addressed. Operating Mode The SIMATIC S7 programmable controllers have three different operating modes: STOP, START UP and RUN. The functionality of the PLCs varies in the individual operating modes.
  • Page 60 The operating mode START UP is active when the PLC transits from operating mode STOP to operating mode RUN. STEP7 STEP7 is the programming software of SIMATIC S7. Subnet A subnet is part of a -> network whose parameters must be matched.
  • Page 61 The user program contains all instructions and declarations for signal processing, by means of which a system or a process can be controlled. The user program for SIMATIC S7 is structured and is divided into smaller units called blocks. Variable A variable is an operand (e.g.
  • Page 62 Customer Support Siemens AG Industry Sector I IS IN E&C Werner-von-Siemens-Str. 60 91052 Erlangen Tel: ++49 9131 7-46111 Fax: ++49 9131 7-44757 Mail: it4.industry@siemens.com http://www.siemens.com/s7modbus Siemens Aktiengesellschaft Subject to change without prior notice. Stand: 06/2009 MODBUS / TCP communication via the integrated PN interface of the CPU...

Table of Contents