38586568 Modbus TCP Kopplung Doku v12 En

5/23/2018 38586568 Modbus TCP Kopplung Doku v12 En

1/80

Applications & ToolsAnswers for industry.

Cover

Communication betweenSIMATIC S7-300 and a Modicon M340Controller

Modbus TCP Connection

Application Description Sept 2011


2/80

2 Modbus TCP ConnectionV 1.2, Entry ID: 38586568

CopyrightS

ie

mensAG2011Allrightsreserved

Industry Automation and Drive Technologies Service & Support Portal

This article is taken from the Service Portal of Siemens AG, Industry Automationand Drive Technologies. The following link takes you directly to the download pageof this document.

http://support.automation.siemens.com/WW/view/en/38586568

Warning:The functions and solutions described in this entry are mainly limited to therealization of the automation task. Please also note that if you link your plant withother parts of the plant, the companys network or the Internet, that you have totake according security measures within the framework of Industrial Security. Moreinformation can be found under entry ID 50203404.

http://support.automation.siemens.com/WW/view/en/50203404

If you have any questions about this document, please contact us at the followinge-mail address:

[email protected]

You can also actively use our Technical Forum from the Service & Support Portalregarding this subject. Add your questions, suggestions and problems and discussthem together in our strong forum community:

http://www.siemens.com/forum-applications
http://support.automation.siemens.com/WW/view/en/38586568http://support.automation.siemens.com/WW/view/en/50203404mailto:[email protected]:[email protected]://www.siemens.com/forum-applicationshttp://www.siemens.com/forum-applicationsmailto:[email protected]://support.automation.siemens.com/WW/view/en/50203404http://support.automation.siemens.com/WW/view/en/38586568


3/80

Modbus TCP ConnectionV 1.2, Entry ID: 38586568 3

CopyrightS

iem

ensAG2

011Allrightsreserved

s

SIMATIC

Modbus TCP Connection

Automation Task 1

Automation Solution 2

Basics 3

Functional Mechanismsof this Application 4

Installation 5

Startup of the Application

6

Operating the Application

7

Literature 8

History 9


4/80

Warranty and Liability


CopyrightS

ie


Warranty and LiabilityNote The application examples are not binding and do not claim to be complete

regarding configuration, equipment and any eventuality. The applicationexamples do not represent customer-specific solutions. They are only intended

to provide support for typical applications. You are responsible for ensuring thatthe described products are used correctly. These application examples do notrelieve you of the responsibility to use sound practices in application, installation,operation and maintenance. When using these application examples, yourecognize that we cannot be made liable for any damage/claims beyond theliability clause described. We reserve the right to make changes to theseapplication examples at any time and without prior notice. If there are anydeviations between the recommendations provided in this application exampleand other Siemens publications e.g. catalogs the contents of the otherdocuments have priority.

We accept no liability for information contained in this document.

Any claims against us based on whatever legal reason resulting from the use ofthe examples, information, programs, engineering and performance data etc.,described in this Application Example shall be excluded. Such an exclusion shallnot apply in the case of mandatory liability, e.g. under the German Product LiabilityAct (Produkthaftungsgesetz), in case of intent, gross negligence, or injury of life,body or health, guarantee for the quality of a product, fraudulent concealment of adeficiency or breach of a condition which goes to the root of the contract(wesentliche Vertragspflichten). However, claims arising from a breach of acondition which goes to the root of the contract shall be limited to the foreseeabledamage which is intrinsic to the contract, unless caused by intent or grossnegligence or based on mandatory liability for injury of life, body or health. Theabove provisions do not imply a change in the burden of proof to your detriment.

It is not permissible to transfer or copy these Application Examples or excerptsthereof without express authorization from Siemens Industry Sector.


5/80

Table of Contents


CopyrightS

ie


Table of ContentsWarranty and Liability ................................................................................................. 4

Table of Contents......................................................................................................... 5

1 Automation Task................................................................................................ 7

2 Automation Solution ......................................................................................... 9

2.1 Overview of the general solution.......................................................... 9

2.2 Description of the core functionality ................................................... 11

2.3 Hardware and software components used......................................... 14

3 Basics ...............................................................................................................16

3.1 Basics on Modbus TCP...................................................................... 16

3.2 S7 function blocks for Modbus TCP................................................... 20

4 Functional Mechanisms of this Application ................................................. 23

4.1 Program structure of S7 CPU and ET200S CPU with integrated PNinterface.............................................................................................. 24

4.1.1 Program details on Modbus PN blocks.............................................. 244.1.2 Configuration explanations................................................................. 30

4.2 Program structure of S7 CPU with CP............................................... 314.2.1 Program details on MODBUS CP blocks ........................................... 314.2.2 Explanation of the configuration......................................................... 39

4.3 Program structure of Modicon M340.................................................. 394.3.1 Program details regarding the Modicon M340 blocks........................ 394.3.2 Explanation of the configuration......................................................... 40

5 Installation........................................................................................................ 41

6 Startup of the Application............................................................................... 44

6.1 Configuration of the CPU319-3 PN/DP.............................................. 446.1.1 Hardware configuration ...................................................................... 446.1.2 Inserting Modbus TCP blocks in project............................................. 466.1.3 Configuring Modbus TCP connections............................................... 476.1.4 Downloading the project..................................................................... 49

6.2 Configuration of the IM151-8 PN/DP CPU......................................... 506.2.1 Hardware configuration ...................................................................... 50

6.3 Configuration of the CPU315-2 PN/DP with CP343-1 Lean.............. 526.3.1 Hardware configuration ...................................................................... 52

6.3.2

Creating project for Modbus TCP....................................................... 55

6.3.3 Configuring Modbus TCP connections............................................... 566.3.4 Downloading the project..................................................................... 61

6.4 Configuration of the Modicon M340 ................................................... 616.4.1 Using application example ................................................................. 616.4.2 Hardware configuration ...................................................................... 626.4.3 Configuring an Ethernet interface for Modbus TCP........................... 656.4.4 Creating a project for Modbus TCP.................................................... 66

7 Operating the Application............................................................................... 69

7.1 Operation CPU319-3 PN/DP and IM151-8 PN/DP CPU.................... 697.1.1 S7 station is client .............................................................................. 697.1.2 S7 station is server............................................................................. 71

7.2 Operation of CPU315-2 PN/DP + CP343-1 Lean .............................. 72


6/80

Table of Contents


CopyrightS

iem

ensAG2

011Allrightsreserved

7.2.1 S7 station is client .............................................................................. 727.2.2 S7 station is server............................................................................. 75

7.3 Operation Modicon M340................................................................... 767.3.1 Modicon M340 is client....................................................................... 767.3.2 Modicon M340 is server..................................................................... 77

8 Literature .......................................................................................................... 79

8.1 Bibliographic references..................................................................... 79

8.2 Internet link specifications .................................................................. 79

9 History............................................................................................................... 79


7/80

1 Automation Task2.1 Overview of the general solution


CopyrightS

ie


1 Automation TaskIntroduction

Protocols are necessary to exchange data between communication partners. Oneof these protocols which is mainly used in an industrial environment, is ModbusTCP. The specification of this protocol is open and can therefore be used byanyone. As a result, there is a multitude of components of various manufacturerswith Modbus TCP interface.

To enable simple and fast connection to such third-party devices they also have tosupport Modbus TCP.

Overview of the automation task

The figure below provides an overview of the automation task.

Figure 1-1

S7 Controller External controller

Ethernet

Production plant 1 Production plant 2

Description of the automation task

There are two production plants in a product line which carry out intermediate andfinal assembly of a serial production. Production data is to be exchanged betweenthese two production plants. One of the two plants has the controller of anothermanufacturer. To communicate with other components, this external controllerprovides a Modbus TCP interface. The data exchange is to be realized through thisinterface.

The controllers of the two production plants and the panel are located in the same

IP subnet. Therefore a gateway is not required.


8/80

1 Automation Task2.1 Overview of the general solution


CopyrightS

ie


Quantity frameworks of the data transmission

The quantity of the data that is to be transferred through Modbus TCP is limited to64 bits in the application example. The transfer is word by word. I.e., per client jobfour words are read out from the server or are written into the server.

The table below shows the maximum possible data transfer per Modbus TCP job.

Table 1-1: Maximum data volume per order

Transfer bit by bit Transfer word by word

Read job 250 bytes 250 bytes

Write job 246 bytes 246 bytes


9/80

2 Automation Solution2.1 Overview of the general solution


CopyrightS

ie


2 Automation Solution

2.1 Overview of the general solutionThere are several options to connect an external controller through Modbus TCP toa SIMATIC system. This is due to the fact that there are various connectionpartners on the SIMATIC side that support this protocol with the help of variousfunction blocks for Modbus TCP. Below, on the example of three different SIMATICcomponents, you will be shown how to realize a link to an external controller viaModbus TCP.

Schematic layout

The figures below display the components of three different solution alternatives:

Figure 2-1: Connection Modicon M340with S7-CPUs

SIMATIC solution External

controller

SIMATIC S7 CPU

Production plant 1

Modicon M340Ethernet

Production plant 2

SCALANCE

X108

Modbus TCP

ET200S

IM151-8 PN/DP CPU

CPU319-3 PN/DP

CPU315-2DP

CP343-1 Lean

IP address:

192.168.1.1

IP address:

192.168.1.10

Structure of the SIMATIC systemIn each solution alternative the SIMATIC components are physically connected viaan industrial Ethernet cable. A SCALANCE X108 enables a connection with aPG/PC and the SIMATIC station as well as the connection to the third-partysystem. Production data is exchanged with the help of Modbus TCP through thephysical connection between SIMATIC components and third party system. APG/PC is used to trigger the send and receive jobs.

The following SIMATIC stations are available:

CPU319-3 PN/DP

ET200S (IM151-8 PN/DP)

CPU315-2 PN/DP with CP 343-1 Lean


10/80

2 Automation Solution2.1 Overview of the general solution


CopyrightS

ie


Structure of the third-party system

The third-party system is a Modicon M340 controller. It is physically connected withthe SCALANCE X108 through an industrial Ethernet cable.

Classification

This application does not

provide an introduction to STEP7

provide an introduction to Unity Pro XL

contain an introduction to WinCC flexible

Basic knowledge of these topics is assumed.

Scope of the application example

This application example will describe: Basics on Modbus TCP

configuration and structure of a Modbus TCP connection between a CPU319-3PN/DP and a Modicon M340, as well as data transmission via Modbus TCPbetween the two peers (variant 1: Modicon M340 acts as client, CPU319-3PN/DP acts as server; variant 2: Modicon M340 acts as server, CPU319-3PN/DP acts as client)

configuration and structure of a Modbus TCP connection between an ET200S(IM151-8 PN/DP) and a Modicon M340, as well as data transmission viaModbus TCP between the two peers (variant 1: Modicon M340 acts as client,ET200S acts as server; variant 2: Modicon M340 acts as server, ET200S actsas client)

configuration and structure of a Modbus TCP connection between a CPU315-2PN/DP with CP343-1 Lean and a Modicon M340, as well as data transmissionvia Modbus TCP between the two peers (variant 1: Modicon M340 acts asclient, CPU315-2 PN/DP acts as server; variant 2: Modicon M340 acts asserver, CPU315-2 PN/DP with CP acts as client)

handling the Modbus TCP Wizard


11/80

2 Automation Solution2.2 Description of the core functionality


CopyrightS

ie


2.2 Description of the core functionality

Sequence of the core functionality

A Modbus TCP communication between a SIMATIC controller and a ModiconM340 is established to exchange data between the two nodes. There are varioushardware solutions on the SIMATIC side that need different software solutions forModbus TCP. The SIMATIC station and Modicon M340 are alternately client orserver. I.e. when the SIMATIC station acts as server, the Modicon M340 station isthe client and visa versa.

The figure below shows the alternative solutions for this application example.

Connection Modicon M340 CPU319-3 PN/DPFigure 2-2: CPU319-3 PN/DP as Modbus TCP client; Modicon M340 as Modbus TCP server

CPU319-3 PN/DPModicon M340

Ethernet

Scalance X108

IP address:

192.168.1.1

IP address:

192.168.1.10

Client: Modbus TCP Server: Modbus TCP

Protocol: Modbus TCP

Figure 2-3: CPU319-3 PN/DP as Modbus TCP server; Modicon M340 as ModbusTCP client

CPU319-3 PN/DP Modicon M340

Ethernet

Scalance X108

IP address:192.168.1.1

IP address:

192.168.1.10

Server: Modbus TCP Client: Modbus TCP



12/80



CopyrightS

ie


Connection Modicon M340 CPU315-2 PN/DP + CP343-1 LeanFigure 2-4: CPU315-2 PN/DP + CP343-1 Lean as Modbus TCP client; Modicon M340 as

Modbus TCP server

CPU315-2 PN/DP mit

CP 343-1 Lean Modicon M340

Ethernet

Scalance X108

IP address:

192.168.1.1

IP address:

192.168.1.10



Figure 2-5: CPU315-2 PN/DP + CP343-1 Lean as Modbus TCP server; Modicon M340 as

Modbus TCP client

CPU315-2 PN/DP mit

CP343-1 Lean Modicon M340

Ethernet

Scalance X108

IP address:

192.168.1.1

IP address:

192.168.1.10



Connection Modicon M340 IM151-8 PN/DP CPUFigure 2-6: IM151-8 PN/DP CPU as Modbus TCP client; Modicon M340 as Modbus TCP

server

IM151-8 PN/DP CPU Modicon M340

Ethernet

Scalance X108

IP address:

192.168.1.1

IP address:

192.168.1.10




13/80



CopyrightS

ie


Figure 2-7:IM151-8 PN/DP CPU as Modbus TCP server; Modicon M340 as Modbus TCP

client

IM151-8 PN/DP CPU Modicon M340

Ethernet

Scalance X108

IP address:

192.168.1.1

IP address:

192.168.1.10



Advantages of this solution

The solution presented here offers the following advantages:

option to connect Modbus TCP-capable external controllers

expansion of existing plants with SIMATIC S7 modules

few changes necessary in SIMATIC component when exchanging a ModbusTCP peer

Option to select client- or server functionality

Typical fields of application

The devices displayed here are typical Modbus TCP Siemens peers.

Table 2-1

Machine or branch Task Figure

Multi-function measuringinstrument SentronPAC3200

U,I,R,f measurement

e.g. TP177B,MP 277 8,

MP 377 12" Touch

Visualization

Other Modbus TCP components by third-party manufacturers:

Modicon M340 by Schneider Electric

Modbus/TCP (UDP) bus link by Phoenix Contact

TwinCAT Modbus TCP server by Beckhoff


14/80

2 Automation Solution2.3 Hardware and software components used


CopyrightS

ie


2.3 Hardware and software components used

The application document was generated using the following components:

Hardware components

Table 2-2

Component No. MLFB / order number Note

CPU319-3 PN/DP 1 6ES7318-3EL00-0AB0

IM 151-8 PN/DP CPU 1 6ES7151-8AB00-0AB0

CPU315-2 PN/DP 1 6ES7315-2EG10-0AB0

CP343-1 Lean 1 6GK7343-1CX10-0XE0

SCALANCE X108 1 6GK5108-0AB00-2AA3

PS307 24 V/5 A 1 6ES7307-1EA00-0AA0

Modicon M340CPS2010

1

P34 2030 1 Modicon M340communication module

DDO 1602 1 Modicon M340 digitaloutput module

DDI 1602 1 Modicon M340 digitalinput module

Standard software componentsTable 2-3

Component No. MLFB / order number Note

SIMATIC ManagerV5.4+SP4

1 56ES7810-4CC08-0YA5 Configuration softwarefor S7 CPUs

UnityProXL 1 Configuration softwarefor Modicon M340

Modbus TCP Wizard 1 Program for configuringthe Modbus TCPcommunication via PN -CPUs

Function blocks forModbus TCP via PNCPU V 2.4

1 2XV9 450-1MB02 These function blocksare not suitable forModbus TCP via CP

Function blocks forModbus TCP via CP

V 4.3

1 2XV9 450-1MB00 These function blocksare not suitable forModbus TCP via PNCPU


15/80

2 Automation Solution2.3 Hardware and software components used


CopyrightS

ie


Sample files and projects

The following list includes all files and projects used in this example.

All sample programs contain non-licensed Mobus TCP blocks. A valid license can

be obtained through the homepage of S7 OpenModbus/TCP solution (see \6\).

Table 2-4

Component Note

38586568_Modbus_TCP_Kopplung_CODE_v11.zip

38586568_Modbus_TCP_Kopplung_Doku_v11_en.pdf


16/80

3 Basics3.1 Basics on Modbus TCP


CopyrightS

ie


3 Basics

3.1 Basics on Modbus TCP

Modbus TCP is a client/server communication that uses the TCP/IP astransmission medium. In this architecture the client establishes a connection andsends request frames to the server. The server processes this request and sendsthe appropriate answer to the request back to the client. Depending on the job,data is either read from the memory area of the server or written into it. To be ableto distinguish the type of jobs and the memory areas, there are clearly definedfunction codes for Modbus TCP. They are sent to the server by the client in therequest frame, including the address of the memory area, the so called registeraddress.

Frame structure

A Modbus frame consists of PDU (Protocol Data Unit) and ADU (Application DataUnit). In the PDU, function code and data belonging to the function are transmitted.ADU is for addressing and error detection. Whilst the PDU is identical for allModbus variants (Modbus TCP, Modbus RTU, etc.) there are some differences forADU. Addressing and error detection for Modbus TCP, for example, is undertakenby the subordinate TCP protocol. At the same time the TCP protocol is responsiblefor the integrity check of the data packets and if necessary also for troubleshooting.The information for addressing and error detection is transferred in the "MBAPHeader" (Modbus Application Header).

Figure 3-1:Modbus standard frame

Figure 3-2: Modbus TCP frame

Additional address Function code Data Error codeADU

PDU

MBAP Header Function code Data

MODBUS TCP/IP ADU

PDU


17/80



CopyrightS

ie


Modbus register and memory areas

Modbus is based on a series of memory areas with various properties. Theaddresses within this memory area are called register. Depending on the Modbusmemory area these registers are either word- or bit-oriented. The table belowdisplays all memory areas a Modbus component may contain.

Table 3-1

Memory area Register size Access Note

Inputs 1 bit Read can be changed by I/Osystem

Coils 1 bit read and write can be changed by userprogram

Input register(input data)

16 bit word Read can be changed by I/Osystem

Holding Register(output data)

16 bit word read and write can be changed by userprogram

Function codes

In the Modbus frame, the function code defines whether it is a read or write job andwhich memory area is to be accessed.Precise addressing in the memory areas is via a register number and the numberof registers to be processed. This information is also contained in the Modbusframe. The table below displays the function codes supported by S7 Modbus TCP.

All S7 MODBUS variants (PN-CPUs and CPs) support the function codes 1, 2, 3,

4, 5, 6, 15 and 16.

Table 3-2

Functioncode

Function Memory area

01 reads several bits Coils (outputs)

02 reads several bits Inputs

03 reads any number ofregisters


04 reads any number ofregisters

Input Register (inputdata)

05 writes individual bits Coils (outputs)

06 writes individualregister


15 writes several bits Coils (outputs)

16 writes more than oneregister



18/80



CopyrightS

ie


Display of address

Modbus addresses can vary from the internal address of a Modbus component.

For this reason it is necessary to have information on the display of address. I.e. ithas to be known which Modbus address displays an internal address of a Modbuscomponent.

This is now explained, using a simple example. This example shows the addressdisplay between a Siemens and a Modicon controller during data exchange via aholding register.

The Modbus register addresses are displayed in black. The internal addresses ofthe controllers are displayed in gray.

Figure 3-3

SIMATIC Controller

DB 11

0

1

122

123

252

253

254

498

499

0.0

2.0

244.0

246.0

504.0

506.0

508.0

996.0

998.0

Modicon Controller

Holding Register

0

1

122

123

252

253

254

498

499

%MW 0

%MW 1

%MW 122

%MW 123

%MW 252

%MW 253

%MW 254

%MW 498

%MW 499

Modbus register address

Internal memory address


19/80



CopyrightS

ie


Another example shows the address display between a Siemens and a Modiconcontroller during data exchange via coils.

The Modbus bit addresses are displayed in black. The internal addresses of thecontrollers are displayed in gray.

Figure 3-4

SIMATIC Controller

DB 11

0

1

8

9

16

17

18

32

33

0.0

0.1

1.0

1.1

2.0

2.1

2.2

4.0

4.1

Modicon Controller

Coils

0

1

8

9

16

17

18

32

33

%M 0

%M 1

%M 8

%M 9

%M 16

%M 17

%M 18

%M 32

%M 33

Modbus bit address

Internal memory address

Configuring the Modbus addresses

When configuring the Modbus register addresses, attention has to be paid thatthere is no overlap on the SIMATIC side in the data areas.I.e. if there are, for example, two holding registers, one each configured in DB11and DB12, no Modbus register addresses may be assigned twice.

The figure below shows the example of two DBs as holding register with unique

Modbus register addresses. Configuration is via the Modbus parameter DB(MODBUS_PARAM) or the OB100.


20/80

3 Basics3.2 S7 function blocks for Modbus TCP


CopyrightS

ie


Figure 3-5: Realization of address display by configuring the S7 Modbus TCP blocks

(parameters are displayed in simplified form)

Modbus TCP Parameter

11

160

660

12

20

100

0

0

0

0

DB 1

Start

End

DB 2

Start

End

DB 3

Start

End

Variable Value

DB 11

160

161

282

283

412

413

414

659

660

0.0

2.0

244.0

246.0

504.0

506.0

508.0

998.0

1000.0

DB 12

2021

42

43

72

73

74

99

100

0.02.0

44.0

46.0

104.0

106.0

108.0

158.0

160.0

Data_type

Data_type

Data_type

3

3

3.2 S7 function blocks for Modbus TCP

There are several solutions for a S7 controller to communicate with an externalsystem which supports the Modbus TCP protocol. Each of these solutions is asoftware product which differs, depending on the existing Ethernet interface. For aModbus TCP communication via a CP (Communication Processor) a differentsoftware product is required than for the Modbus TCP communication via theintegrated PN interface of a S7-CPU. This is due to the different internal dataprocessing between the interface used and the user program in the S7 CPU.The basis for each of these software solutions is a user program for a S7 CPU.This user program consists of different function blocks and data blocks which cansimply be implemented in an existing S7 project.

The Modbus TCP Wizard is available for the configuration of a Modbus TCPcommunication via integrated PN interface of a S7 CPU. The Modbus TCPcommunication via a CP has to be configured manually.

Assigning a Modbus register address to an internal address of a SIMATIC CPUdata block depends on the respective configuration of the Modbus TCP functionblocks (MODBUS_PARAM or OB100).


21/80



CopyrightS

ie


Modbus TCP via CP

If an existing S7 CPU does not have an integrated PN interface, it can beconnected to an existing Ethernet network using a CP.Whilst the CP and the CPU, which are linked via a backplane bus, are exchangingdata with each other, the CP simultaneously handles communication to the otherEthernet nodes.For this hardware option the Modbus TCP solution "S7 Open Modbus TCP viaCP343-1 and CP443-1" is available. This Modbus solution enables Modbus TCPcommunication for S7-300 and S7-400 CPUs in combination with a CP.

The following hardware and software requirements are necessary for the use of theModbus TCP CP solution. There are no firmware restrictions.

Table 3-3

Hardware MLFB Firmware

CP343-1 6GK7 343-1CX00-0XE0

6GK7 343-1CX10-0XE0

6GK7 343-1EX11-0XE0

6GK7 343-1EX20-0XE0

6GK7 343-1EX21-0XE0

6GK7 343-1EX30-0XE0

6GK7 343-1GX11-0XE0

6GK7 343-1GX20-0XE0

6GK7 343-1GX21-0XE0

6GK7 343-1GX30-0XE0

CP443-1 6GK7 443-1EX11-0XE0

6GK7 443-1EX20-0XE0

6GK7 443-1EX40-0XE0

6GK7 443-1EX41-0XE0

6GK7 443-1GX11-0XE0

6GK7 443-1GX20-0XE0

Table 3-4

Software MLFB Version

SIMATIC Manager 6ES7810-4CC07-0YA5 as of version 5.3


22/80



CopyrightS

ie


Modbus TCP via integrated interface of a CPU

If the integrated interface of the S7-CPU is to be used instead of the CP, anotherModbus TCP solution is necessary, as already mentioned earlier. "S7 Open

Modbus TCP PN" enables the Modbus TCP communication via the integrated PNinterface for all S7-CPUs and ET200S-CPUs.

The following hardware and software requirements are necessary for the use of theModbus TCP PN solution.

Table 3-5

Hardware MLFB Firmware

CPU315-2 PN/DP 6ES7 315-2EH13-0AB0 V2.6.7

6ES7 315-2EG10-0AB0 V2.3.4

CPU317-2 PN/DP 6ES7317-2EJ10-0AB0 V2.3.4

6ES7317-2EK13-0AB0 V2.6.7

CPU319-3 PN/DP 6ES7319-3EL00-0AB0 V2.7.2

CPU414-3 PN/DP 6ES7414-3EM05-0AB0 V5.2

CPU416-3 PN/DP 6ES7416-3FR05-0AB0 V5.2

IM151-8 PN/DP 6ES7151-8AB00-0AB0 V2.7.1

Table 3-6

Software MLFB Version

SIMATIC Manager 56ES7810-4CC08-0YA5 as of version 5.4 SP4


23/80

4 Functional Mechanisms of this Application3.2 S7 function blocks for Modbus TCP


CopyrightS

ie


4 Functional Mechanisms of this Application

This chapter shows the program structures of the S7 Modbus solution and theModicon M340.

The Modicon M340 controller can be used as Modbus server without additionalfunctions in the user program at any time. As soon as a Modbus request isreceived, it is processed and immediately answered. A Modbus server usuallyexpects such a request on port 502. Several requests from different clients canalso be processed on this port.If the Modicon M340 controller is to be used as client, different function calls arenecessary in the user program depending on the type of the job to be sent. Here, ithas to be distinguished whether it is a read or a write job.

By calling the respective functions or function blocks in the user program, theSIMATIC S7 CPU can work either as Modbus server or Modbus client.In theprocess, a further call of the Modbus function block with individual instance and therespective connection parameters is necessary for each Modbus connection. Asopposed to the M340 CPU the S7 Modbus server can only process one clientrequest per port. Therefore it is necessary that an extra server is to be configuredwith another port for each extra client which is supposed to connect itselfsimultaneously with station S7 via Modbus TCP.


24/80

4 Functional Mechanisms of this Application4.1 Program structure of S7 CPU and ET200S CPU with integrated PN interface


CopyrightS

ie


4.1 Program structure of S7 CPU and ET200S CPU withintegrated PN interface

To be able to create one or several Modbus connections with a SIMATIC S7 CPUor an ET200S CPU with integrated PN interface it is necessary to configure thecalls of the Modbus library blocks correctly. Doing this, a certain program structurehas to be met. This program structure is displayed for two connections in the figurebelow. Only one Modbus TCP connection is required for the application example.

Figure 4-1

FB 102

"MODBUSPN"

OB1

"TCON"

Library blocks fr

Modbus PN

"MODBUSPN"

FB 66

"TDISCON"

FB 63

"TSEND"

FB 64

"TRECV"

FB 103

"TCP_COMM"

DB 11

"Data_Area_1"

DB

FB

IDB 2

IDB 1

OB100

Modbus

parameter 1

Connection

parameter 1

MODBUS_PARAM

Send

data 1

Receive data1

Receive

data 2

Send

data 2

Modbus

parameter 2

Connection

parameter 2

4.1.1 Program details on Modbus PN blocks

The Modbus PN blocks have a Modbus DB parameter (Modbus_Param). EachModbus connection is configured in this DB parameter and the Modbus registeraddresses as well as the respective memory areas are assigned in S7 (e.g. DB11"Data_Area_1"). The corresponding send and receive data of each connection isalso stored in this DB parameter.To configure the DB parameter the Modbus TCP Wizard can be used or a directvalue input can be performed in DB.

A separate call of the "MODBUSPN" function block with individual DB instance isnecessary for each client or server connection. Please note that the call of the


25/80



CopyrightS

ie


"MODBUSPN" function block has to take place in a cyclic OB (OB1 or timed OB)and in OB100 with the same DB instance per connection.

Modbus PN library blocks

The figure below displays all S7 program blocks which are needed for ModbusTCP via the integrated PN interface of a SIMATIC S7-CPU. They can be insertedand configured in any project from the examples for Modbus TCP for PN CPUs ordirectly from the Modbus TCP library for PN CPUs.

To be able to use Modbus TCP for PN CPUs in a program it is only necessary tocall the "MODBUSPN" function block. The call of the other blocks is internally in the"MODBUSPN" function block.

Figure 4-2: Modbus TCP PN blocks from the sample program

OB1 call

The cyclical calls of the "MODBUSNP" function block are performed in OB1 (or in atimed OB, such as, for example OB35) as well as other user-specific functions andfunction blocks. This is where runtime parameters are transferred to the"MODBUSPN" function block.

OB100 call

In OB100 the "MODBUSPN" function block is initialized. OB100 is completed oncewhen there is a STOP RUN transfer or when restarting the CPU in case of apower failure.


26/80



CopyrightS

ie


OB121

This OB has to be available in the project; however, the MODBUSPN functionblock must not be called in it.The OB121 makes an entry in the diagnostic buffer when there is no valid license.Additionally, without a valid license the SF (system error) error LED of the CPU willflash. If OB121 was not configured, the CPU will go to stop mode after start-up.

Structure of Modbus DB parameter

The Modbus DB parameter stores the Modbus parameters, the send and receivedata buffer and the connection parameters for the TCP/IP connection. These fourareas of the DB parameter can be seen in the table below.

For each Modbus connection all four areas each have to be created in the DBparameter.

Table 4-1

Address Comment

+0.0 Start of structure for connection 1

+0.0 Connection parameters

+64.0 Modbus parameters

+130.0 Internal send buffer

+390.0 Internal receive buffer

+650.0 End of structure for connection 1

+650.0 Start of structure for connection 2

+650.0 Connection parameters+714.0 Modbus parameters

+780.0 Internal send buffer

+1040.0 Internal receive buffer

+1300.0 End of structure for connection 2

(i-1)*650 Start of structure for connection i

Connection parameters

Modbus parameters

Internal send buffer

Internal receive bufferi*650 End of structure for connection i


27/80



CopyrightS

ie


Parameters of "MODBUSPN" function block

The figure below shows all input and output parameters of the "MODBUSPN"

function block.

Figure 4-3

Table 4-2

Parameters Decl. Type Description Value range Initialization

ID IN WORD Connection ID has to beidentical with correspondingid parameter in DB parameterMODBUS-PARAM

1 to 4095

W#16#1 toW#16#FFF

Yes

DB_PARAM IN BLOCK_DB

Number of DB parameter

MODBUS_PARAM

CPUdependent

Yes

RECV_TIME IN TIME Monitoring time for the receiptof data from peer

The minimum time that canbe set is 100ms

T#100ms toT#+24d20h31m23s647ms

no

CONN_TIME IN TIME Monitoring time forestablishing or terminatingconnection

The minimum time that canbe set is 100ms


no

KEEP_ALIVE IN TIME not used

ENQ_ENR IN BOOL S7 is client:job initiation at positive edge

S7 is server:

ready to receive at positive

TRUEFASLE

no


28/80



CopyrightS

ie



level

DISCONNECT IN BOOL S7 is client:TRUE: after receiving theresponse frame theconnection is disconnected

S7 is server:TRUE: for ENQ_ENR =FALSE the connection is tobe disconnected

TRUEFALSE no

REG_KEY IN STRING[17]

Registration key (activationcode) for licensing

Character no

LICENSED OUT BOOL License status of blockBlock is licensedBlock is not licensed

TRUEFALSE

no

BUSY OUT BOOL Processing status of Tfunctions (TCON, TDISCON,TSEND or TRCV)

In processNot in process TRUE

FALSE

no

CONN_ESTABLISHED OUT BOOL Connection establishedConnection disconnected

TRUEFASLE

no

DONE_NDR OUT BOOL S7 is client:TRUE: enabled job wascompleted without errors

S7 is server:

TRUE: request was carried

out and answered by client

TRUE

FALSE

no

ERROR OUT BOOL An error has occurred.There was no error

TRUEFALSE

no

STATUS_MODBUS OUT WORD Error number for protocolerror when processingModbus frames

0 to FFFF no

STATUS_CONN OUT WORD Error number for connectionerror when processing Tblocks (TCON, TSEND,TRCV, TDISCON)

0 to FFFF no

STATUS_FUNC OUT STRING[8]

Name of function whichcaused error onSTATUS_MODBUS orSTATUS_CONN

Character no

IDENT_CODE OUT STRING[18]

Identification number forlicensingWith this identifier you canapply for the REG_KEYactivation code for yourlicense.

Character no

UNIT IN/OUT

BYTE Unit identifier(INPUT for CLIENT function,OUTPUT for server function)

0 to 255

B#16#0 toB#16#FF

no


29/80



CopyrightS

ie



DATA_TYPE IN/OUT

BYTE Data type to be processed:(INPUT for CLIENT function,OUTPUT for SERVERfunction)

CoilsInputsHolding RegisterInput register

1234

no

START_ADDRESS IN/OUT

WORD MODBUS start address(INPUT for CLIENT function,OUTPUT for SERVERfunction)

0 to 65535W#16#0000toW#16#FFFF

no

LENGTH IN/OUT

WORD Number of values to beprocessed(INPUT for CLIENT function,OUTPUT for SERVERfunction)

Coilsread functionwrite function

Inputsread function

Holding registerread functionwrite function

Input registerread function

1 to 20001 to 1968

1 to 2000

1 to 1251 to 123

1 to 125

no

TI IN/OUT

WORD Transaction identifier(INPUT for client function,OUTPUT for server function)

0 to 65535

W#16#0 toW#16#FFFF

no

WRITE_READ IN/OUT

BOOL Write access or read access(INPUT for CLIENT function,OUTPUT for SERVERfunction)

TRUEFALSE

no

The parameters of the MODBUSPN function block are divided into two groups:

initialization parameters

runtime parameters

The initialization parametersare only evaluated for calls in OB100 and aretransferred to the instance DB. Initialization parameters are marked with "yes" inthe table above in the initialization column. Changing the initialization parametersduring operation is of no consequence. When these parameters are changed, forexample, during test mode, the instance DB (I-DB) of the CPU has to bereinitialized by STOP -> RUN.

The runtime parameterscan be changed during cyclical operation. However, in"S7 is client" mode, it does not make sense to change the input parameters while ajob is being processed. It should be waited with the preparations for the next joband the thus connected changes of the parameters until the previous job wasterminated with DONE_NDR or ERROR. In the "S7 is server" mode the output

parameters can only be evaluated when DONE_NDR was set.


30/80



CopyrightS

ie


Output parameters are dynamical displaysand are therefore only pending for oneCPU cycle. For possible further processing or for displaying the variable table theyhave to be copied to other memory areas.

The generation of the function code is via the parameters DATA_TYPE, LENGTHand WRITE_READ. Possible combinations to generate a function code are shownin the table below.

Table 4-3

Data type DATA_TYPE Function LENGTH WRITE_READ Functioncode

Coils 1 read 1 to 2000 false 1

Coils 1 write 1 true 5

Coils 1 write 1 true 15

Coils 1 write >1 to 1968 true 15

Inputs 2 read 1 to 2000 false 2

Holding Register 3 read 1 to 125 false 3

Holding Register 3 write 1 true 6

Holding Register 3 write 1 true 16

Holding Register 3 write >1 to 123 true 16

Input Register 4 read 1 to 125 false 4

4.1.2 Configuration explanations

In this application example, read and write data exchange is to be realizedbetween Modbus client and server. If the S7 CPU with integrated PN interfacetakes on the client function, data is brought from the server through the readaccess and is returned through the write access to the Modbus server.

If the S7 CPU acts as Modbus server, no write or read jobs can be started. In thiscase the S7 CPU will wait for a job from the Modbus client (M340).


31/80

4 Functional Mechanisms of this Application4.2 Program structure of S7 CPU with CP


CopyrightS

ie


4.2 Program structure of S7 CPU with CP

The main difference of the program structure of the Modbus TCP solution via a CPand the PN CPU is the configuration of the connection parameters. It is exclusivelydone in STEP7 NetPro. There is no data structure in which the connectionparameters or the Modbus parameters can be entered. The Modbus parametersare transferred in OB1.

Figure 4-4

"MODBUSCP"

OB1

Netpro

Connectionconfiguration

Library

blocks for

MODBUS CP

FB 108

"MODBUSCP"

SFC

Connection

parameter 2

Connection

parameter 1

Connection

parameter 3

Connection

parameter 4

Connection

parameter 5

OB100

IDB2

IDB1

FB 106

"MB_CPCLI"

FC 5

"AG_SEND"

FC 6

"AG_RECV"

DB 11

"DATA_AREA_1"

DB 12

"DATA_AREA_2"

DB 13

"DATA_AREA_3"

DB

4.2.1 Program details on MODBUS CP blocks

A separate call of the "MODBUSCP" function block with individual DB instance isnecessary for each connection. Please note that the call of the "MODBUSCP"function block has to take place in OB1 and in OB100 with the same DB instanceper connection.


32/80



CopyrightS

ie


Modbus library blocks

The figure below displays all S7 program blocks which are necessary for ModbusTCP via CP.

To be able to use Modbus TCP for CPs in a program, only the "MODBUSCP" blockhas to be called. The other blocks are called internally in the "MODBUSCP"function block.

Figure 4-5: Modbus TCP CP blocks from the sample program

OB1 call

The cyclical calls of the "MODBUSCP" function block are performed in OB1 (or in atimed OB, such as, for example OB35) as well as other user-specific functions andfunction blocks. This is where runtime parameters are transferred to the"MODBUSCP" function block.

OB100 call

In OB100 the "MODBUSCP" function block is initialized. OB100 is completed oncewhen there is a STOP RUN transfer or when restarting the CPU in case of apower failure.

OB121 call

This OB has to be available in the project; however, the MODBUSCP functionblock must not be called in it.The OB121 makes an entry in the diagnostic buffer when there is no valid license.Additionally, without a valid license the SF (system error) error LED of the CPU willflash. If OB121 was not configured, the CPU will go to stop mode after start-up.


33/80



CopyrightS

ie


Parameters of "MODBUSCP" function block

This section describes the input and output parameters of the "MODBUSCP"function block.

Figure 4-6: "MODBUSCP" function block call in STL

-


34/80



CopyrightS

ie


Table 4-4

Parameters Decl. Type Description Value range Initializ

ation

id IN WORD Connection ID inaccordance with theconfiguration

1 to 64

W#16#1 toW#16#40

yes

laddr IN WORD LADDR address fromhardware configuration

CPUdependent

yes

MONITOR IN TIME Monitoring time for thereceipt of data from thepeerThe minimum time that canbe set is 20ms


no

REG_KEY IN STRING[

17]

Registration key for

licensing

Character no

server_client IN BOOL CP/FB works as serverCP/FB works as client

TRUEFALSE

yes

single_write IN BOOL Writing of 1 coil/registerfunction code 5 or 6function code 15 or 16 TRUE

FALSE

yes

data_type_1 IN BYTE 1. Range: Data TypeCoilsInputsHolding RegisterInput Register

1234

yes

db_1 IN WORD 1. Range: data block

number

1 to 65535

W#16#1 toW#16#FFFF

yes

start_1 IN WORD 1. Range:first Modbus address in thisDB

0 to 65535

W#16#0000toW#16#FFFF

yes

end_1 IN WORD 1. Range:last Modbus address in thisDB

0 to 65535


yes

data_type_2 IN BYTE 2. Range: Data type (coils,inputs, holding register,

input register), 0 if notneeded

0 to 4 yes

db_2 IN WORD 2. Range: data blocknumber

1 to 65535

W#16#1 toW#16#FFFF

yes


0 to 65535


yes


0 to 65535


yes


35/80



CopyrightS

ie



data_type_3 IN BYTE 3. Range: data type (coils,inputs, holding register,input register), 0 if notneeded

0 to 4 yes


1 to 65535

W#16#1 toW#16#FFFF

yes


0 to 65535


yes


0 to 65535


yes


0 to 4 yes


1 to 65535

W#16#1 toW#16#FFFF

yes

start_4 IN WORD 4. Range:first Modbus address in this

DB

0 to 65535

W#16#0000

toW#16#FFFF

yes


0 to 65535


yes


0 to 4 yes


1 to 65535

W#16#1 toW#16#FFFF

yes


0 to 65535


yes


0 to 65535


yes


0 to 4 yes

db_6 IN WORD 6. Range: data block 1 to 65535 yes


36/80



CopyrightS

ie



number W#16#1 toW#16#FFFF


0 to 65535


yes


0 to 65535


yes


0 to 4 yes


1 to 65535W#16#1 toW#16#FFFF

yes


0 to 65535


yes


0 to 65535


yes

data_type_8 IN BYTE 8. Range: data type (coils,

inputs, holding register,input register), 0 if notneeded

0 to 4 yes


1 to 65535

W#16#1 toW#16#FFFF

yes


0 to 65535


yes


0 to 65535

W#16#0000to

W#16#FFFF

yes

ENQ_ENR IN BOOL CP is client:job initiation at positiveedge

CP is server:ready to receive at positivelevel

TRUEFALSE

no

LICENSED OUT BOOL License state of block:licensed:

not licensed: TRUEFALSE

no

BUSY OUT BOOL Processing status of thefunctions AG_SEND orAG_RECV

no


37/80



CopyrightS

ie



in process:

not in process:

TRUEFALSE

DONE_NDR OUT BOOL CP is client:enabled job was completedwithout errors

CP is server:request was carried outand answered by client

TRUEFALSE

no

ERROR OUT BOOL An error has occurred.

yes:no: TRUE

FALSE

no

STATUS OUT WORD Error number 0 to FFFF no

STATUS_FUNC OUT STRING[8] Name of function that

caused the error

Character no

IDENT_CODE OUT STRING[18]

Identification for licensingRequest the license withthis identification string.

Character no

UNIT IN/OUT

BYTE Unit identifier(INPUT for CLIENTfunction, OUTPUT forSERVER function)

0 to 255

B#16#0 toB#16#FF

no

DATA_TYPE IN/OUT

BYTE Data type to be processed(INPUT for CLIENTfunction, OUTPUT for

SERVER function)coilsinputsholding registerinput register

1234

no

START_ADDRESS IN/OUT

WORD MODBUS start address(INPUT for CLIENTfunction, OUTPUT forSERVER function)

0 to 65535 no

LENGTH IN/OUT

WORD Number of values to beprocessed(INPUT for CLIENTfunction, OUTPUT for

SERVER function)Coils: Read fct.

Write fct.Inputs: Read fct.

Holding reg.: Read fct.

Read fct.Input reg.: Read fct.

1 to 20001 to 1968

1 to 2000

1 to 1251 to 123

1 to 125

no

TI IN/OUT

WORD Transaction identifier(INPUT for CLIENTfunction, OUTPUT forSERVER function)

0 to 65535 no

WRITE_READ IN/OUT

BOOL INPUT for CLIENTfunction, OUTPUT for

SERVER function)

no


38/80



CopyrightS

ie



write accessread access

TRUEFALSE

The parameters of the MODBUSCP function block are divided into two groups:

initialization parameters

runtime parameters

The initialization parameters are only evaluated in the first run of the MODBUSCPfunction block and accepted in the instance DB. The initialization parameters are

marked with yes in the above table in the Initialization column. A change of theinitialization parameters during running operation has no effect. Once theseparameters have been changed, for example, in the test operation, the instanceDB (I-DB) has to be reinitialized by STOPRUN of the CPU.

Runtime parameters can be changed in cyclic operation. It is not advisable tochange the input parameters whilst a job is being processed. It should be waitedwith the preparations for the next job and the thus connected changes of theparameters until the previous job was terminated with DONE_NDR or ERROR. Theoutput parameters should only be evaluated when DONE_NDR is set.

The generation of the function code is via the parameters DATA_TYPE, LENGTH,single_write and WRITE_READ. Possible combinations to generate a function

code are shown in the table below.

Table 4-5

Data type DATA_TYPE

Function LENGTH WRITE_READ single_write

Functioncode

Coils 1 read 1 to 2000 false irrelevant 1

Coils 1 write 1 true TRUE 5

Coils 1 write 1 true FALSE 15

Coils 1 write >1 to 1968 true irrelevant 15

Inputs 2 read 1 to 2000 false irrelevant 2

HoldingRegister

3 read 1 to 125 false irrelevant 3

HoldingRegister

3 write 1 true TRUE 6

HoldingRegister

3 write 1 true FALSE 16

HoldingRegister

3 write >1 to 123 true irrelevant 16

InputRegister

4 read 1 to 125 false irrelevant 4


39/80

4 Functional Mechanisms of this Application4.3 Program structure of Modicon M340


CopyrightS

ie


4.2.2 Explanation of the configuration

In this application example a read and a write data exchange between Modbusclient and server is to be implemented. If the S7 CPU with CP takes on the client

function, data is taken from the server via read access and returned to the Modbusserver via the write access.

If the S7 CPU with CP acts as Modbus server, no write or read jobs can be started.In this case, the S7 CPU with CP waits for a job from the Modbus client (M340).

4.3 Program structure of Modicon M340

The following program structure only shows the Modbus client application of theModicon M340. If the Modicon M340 is to act as Modbus server, no special blockcall is necessary in the user program.

Figure 4-7

READ_VAR

WRITE_VAR

Connection

parameter

Sections

ADDM

4.3.1 Program details regarding the Modicon M340 blocks

READ_VAR

With this function data from a Modbus server can be read. The addressing of theModbus server is via IP address.

WRITE_VAR

With the WRITE_VAR function, data can be written in a Modbus server. For thisfunction the IP address of the Modbus server is also needed.


40/80

4 Functional Mechanisms of this Application4.3 Program structure of Modicon M340


CopyrightS

ie


ADDM

Through this function a string is converted into an address which can be used bycommunication functions (READ_VAR, WRITE_VAR). The IP address is assignedto the string as initial value in the tag declaration.

4.3.2 Explanation of the configuration

In this application example a read and a write data exchange between Modbus

client and server is to be implemented. When the Modicon M340 takes on the clientfunction, data is taken from the server (S7) via read access. This data is internallycopied to another memory area and then given back to the Modbus server via writeaccess.If the Modicon M340 takes on the server function, data is provided for the client(S7). This data is read by the client. In addition, the client can write data in theModicon M340.


41/80

5 Installation4.3 Program structure of Modicon M340


CopyrightS

ie


5 InstallationThis chapter describes which hardware and software components have to beinstalled. It is also important to read the descriptions, manuals and any delivery

information supplied with the products.

Hardware installation

The hardware components are listed in chapter 2.3 Hardware and softwarecomponents used. The following table provides an overview of the IP addressesand the devices that are to be used in the hardware structure of the application.Both S7 CPUs with integrated PN interface and the S7 CPU with CP have thesame IP address. These components are never connected at the same time to theEthernet network.

Table 5-1

Device IP address

CPU319-3 PN/DP 192.168.1.1

IM 151-8 PN/DP CPU 192.168.1.1

CPU315-2 PN/DP none

CP343-1 Lean 192.168.1.1

SCALANCE X108 none

PS307 24 V/5 A none

Modicon M340 192.168.1.10

PG / PC 192.168.1.55

To set up the hardware, please follow the instructions in the below table:

Table 5-2

No. Action Comment

1 Mount the modules on a DIN rail.

2 Connect the CPU315-2PN/DP withthe CP343-1 Lean via the backplane

3 Connect all modules with the 24Vsupply voltage

If necessary use terminal strips or several power supplies

4 Connect the following modules via

Ethernet:* CP343-1 Lean or CPU319-3PN/DP or IM 151-8 PN/DP CPU withthe Scalance X108

*Modicon M340 with Scalance X108

*PG/PC with Scalance X108

Depending on the application example, use the

respective S7 CPU.


42/80



CopyrightS

ie


No. Action Comment

5 Assign the following IP address192.168.1.55 (Subnet mask:255.255.255.0) to the Ethernetinterface of the PG/PC.

Start Settings ControlPanel Network

Connections LAN

Properties TCP/IPProperties

6 Start the SIMATIC Manager andselect the TCP/IP interface

Options Set PG/PCinterface

7 Assign the IP addresses from table5-15 to the S7 CPUs.

For this purpose, use the SIMATICManager and search the menu foravailable nodes "PLC Edit

Ethernet Node"

Note The setup guidelines of the components used here always have to be observed.

Software installation

Table 5-3

No. Action Comment

1 Installing STEP7 The installation is automatic.Follow the setup instructions. Theinstallation of STEP7 is alsodescribed in the Programmingwith STEP7 V5.4 manual (see\3\).

2 Installing the Modbus TCP library The installation is automatic.Follow the setup instructions. Aninstallation description of theModbus TCP library is alsoprovided in the manuals forModbus TCP (see 1\4\).

3 Installing the Modbus TCP Wizard You can find information on the


43/80



CopyrightS

ie


No. Action Comment

installation and configuration of aModbus TCP communication inthe Modbus TCP Wizard manual

(see 1\5\).

4 Installing Unity Pro XL The installation is automatic.Follow the setup instructions.


44/80

6 Startup of the Application6.1 Configuration of the CPU319-3 PN/DP


CopyrightS

ie


6 Startup of the Application

6.1 Configuration of the CPU319-3 PN/DP

This chapter describes the configuration of CPU319-3 PN/DP. Based on thisconfiguration description, you can configure the application examples of theCPU319-3 PN/DP yourself and start up the CPU.

6.1.1 Hardware configuration

Table 6-1

No. Action Comment

1 Create a new project in the SIMATICManager.

Filenew

2 Right click the just created project

and insert the SIMATIC 300 station

via the menu "Insert New

Object SIMATIC 300

Station".

3 Right click Hardware and select

the OpenObject menu to open the

hardware configuration.


45/80



CopyrightS

ie


No. Action Comment

4 Insert a rack from the hardwarecatalog via drag&drop in thehardware configuration.

5 From the hardware catalog insert aCPU319-3 PN/DP V2.7 in slot 2 ofthe rack via drag&drop.

Hardware catalog:

SIMATIC 300CPU 300CPU319-3 PN/DP6ES7 318-3EL00-0AB0V2.7

6 Configure the Ethernet interface ofthe CPU319-3 PN/DP:

AssignIP address192.168.1.1

create newEthernetnetwork

Note: this menu opens automaticallyafter inserting the module.

A Profibus network does not have tobe created.

7 Save and compile hardwareconfiguration


46/80



CopyrightS

ie


6.1.2 Inserting Modbus TCP blocks in project

Table 6-2

No. Action Comment

1 Open the Modbus TCP examplesfrom the library for PN CPUs: File

Open Sample projects

2 Insert the S7 300 CPU library blocksinto the S7 project (FB104 or FB105has to be copied, depending whetherS7 CPU is to be client or server)

The blocks can be selected in thesample project and inserted viadrag&drop in the block container ofyour S7 Modbus project.

OB1 in the S7 Modbus project has tobe overwritten with OB1 of thesample project.


47/80



CopyrightS

ie


6.1.3 Configuring Modbus TCP connections

The Modbus TCP can be either configured with the Modbus TCP Wizard orthrough manual processing of the (MODBUS_PARAM) parameter DB. Manual

processing of MODBUS_PARAM is described in the Modbus TCP manual for PNCPUs (see 1\4\).

Modbus TCP Wizard

This section explains how a Modbus connection for S7 CPUs with integrated PNinterface can be configured with the help of the Modbus TCP Wizard. When usingthe wizard, attention needs to be paid that the Modbus Parameter DB(MODBUS_PARAM) is not open in the SIMATIC Manager.

Table 6-3

No. Action Comment

1 Start the Modbus TCP Wizard

(Start SIMATIC ModbusTCPWizard)and click the

Next button to get to the STEP 7project menu.

Select the just created S7 project inthis dialog.

2 Reading in existing project

Click the "upload"button to load a

configured connection of your project

into the Modbus TCP Wizard.

This connection can be processedby enabling the Changeoption.


48/80



CopyrightS

ie


No. Action Comment

3 Selection client/server operation

Enable the SIMATIC S7 acts asserver function if you want the S7

CPU to work as Modbus TCP server.

Enable the connect at

startup function so that a Modbus

TCP connection is automaticallyestablished to the remotecommunication partner, once theCPU was restarted.

4 Selection of the Modbus TCP partnerand the internal interface (Selectyour hardware here: e.g.: Integrated319)

Client application:

enter the remote IP address(192.168.1.10). The client is alwaysthe active partner.

Server application:

the server is configured as passivecommunication partner. Doing this,each client can connect with theserver when an unspecifiedconnection partner was selected.

5 Selection of the port

Client application:

selection of remote port (port 502 forModicon M340)

Server application:

selection of local port (port: 502)


49/80



CopyrightS

ie


No. Action Comment

6 Definition of the Modbus register

Client application:1 Holding Registers from 100 to 399

2 Input Registers from 400 to 600

Server application:

1 Holding Registers from 0 to 500

2 Holding Registers from 720 to 900

7 Transferring Modbus TCPparameters in theMODBUS_PARAM

Click the Next button to get to the subsequent dialogs.

In the Connection list dialog, the Modbus TCP data

is transferred to the DB MODBUS_PARAM by clicking theNext button.

After the transfer, click the Finishbutton to exit the

wizard.

8 Now you have to adjust the DBs forthe Modbus data areas in the S7project.

Client application:

DB11 ARRAY[0300]

DB12 ARRAY[0300]

Server application:

DB11 ARRAY[0600]

DB12 ARRAY[0300]

6.1.4 Downloading the project

Table 6-4

No. Action Comment

1 Select the SIMATIC 300 station in

the SIMATIC Manager and downloadthe project to the controller.


50/80

6 Startup of the Application6.2 Configuration of the IM151-8 PN/DP CPU


CopyrightS

ie


6.2 Configuration of the IM151-8 PN/DP CPU

The configuration of the ET200S (IM151-8 PN/DP CPU) is similar to theconfiguration of the CPU319-3 PN/DP. This is why this chapter only deals with thehardware configuration of the ET200S. Creating and configuring a Modbus TCPproject for the ET200S is analog to the project of the CPU319-3 PN/DP.When configuring the MODBUS_PARAM the respective local interface for theET200S has to be selected in the Modbus TCP Wizard! The other configurationsteps in the Modbus TCP wizard do not change.


Table 6-5

No. Action Comment

1 Create a new project in the SIMATIC

Manager.

FileNew

2 Right click the STEP7 project and

insert the SIMATIC 300 station via

the "Insert New Object"menu.


the Open Object menu to open

the hardware configuration of the S7300 station.


51/80

6 Startup of the Application6.2 Configuration of the IM151-8 PN/DP CPU


CopyrightS

ie


No. Action Comment

4 Add the IM151-8 PN/DP CPU fromthe hardware catalog via drag&drop.

Hardware catalog:

SIMATIC 300PROFINET IOI/OET200SIM151-8 PN/DPCPU

5 Configure the Ethernet interface ofthe ET200S:

assign the IP address 192.168.1.1and create a

new Ethernet network



52/80

6 Startup of the Application6.3 Configuration of the CPU315-2 PN/DP with CP343-1 Lean


CopyrightS

ie


No. Action Comment


6.3 Configuration of the CPU315-2 PN/DP with CP343-1Lean


Table 6-6

No. Action Comment

1 Create a new project in the SIMATICManager.

FileNew

2 Right click the STEP7 project and

insert the SIMATIC 300 station via

the "Insert New Object"menu.


the Open Object menu to openthe hardware configuration of the S7300 station.


53/80



CopyrightS

ie


No. Action Comment

4 Insert a SIMATIC 300 rack viadrag&drop.

5 Insert the CPU315-2 PN/DP in slot 2of the rack from the hardwarecatalog via drag&drop.

You do not need to define a CPUinterface. Close the configurationdialogs that open up automaticallyafter inserting the CPU.

Hardware catalog:

SIMATIC 300CPU-300CPU315-2 PN/DP6ES7 315-2EG10-0AB0V2.3

6 Now insert the CP343-1.

Hardware catalog:

SIMATIC 300CP-300Industrial EthernetCP343-1 Lean6GK7 343-1CX10-0XE0V2.0

7 Configure the Ethernet interface ofthe CP343-1:

assign the IP address 192.168.1.1and create a

new Ethernet network



54/80



CopyrightS

ie


No. Action Comment



55/80



CopyrightS

ie


6.3.2 Creating project for Modbus TCP

Table 6-7

No. Action Comment

1 Open the sample projects forModbus TCP CP via the File

Openmenu.

2 Copy the blocks from the sampleprojects for a server or clientapplication and insert them in yourModbus project.

Overwrite the already existing OB1.


56/80



CopyrightS

ie


6.3.3 Configuring Modbus TCP connections

Table 6-8

No. Action Comment

1 Open OB100 and process theinitialization parameters in order toadjust the Modbus data areas.

For the application exampledescribed here, the followingparameters have to be assigned(see figure). For areas not used azero is entered.

Client:

1. DB DB11 area: 100 399 as

Holding Register (data_type= 3)

2. DB DB12 area: 400 600 asInput Register (data_type =4)

3. 8. DB not required

Server:

1. DB DB11 area: 0 500 asHolding Register (data_type= 3)

2. DB DB12 area: 720 900 asHolding Register (data_type

= 3)3. -8. DB not required

2 Adjusting DBs for Modbus dataareas in S7 project

Client application:

DB11 ARRAY[0300]

DB12 ARRAY[0300]

Server application:

DB11 ARRAY[0600]

DB12 ARRAY[0300]

3 Open NetPro.

4 If the S7 CPU is the Modbus client,insert an Other Station.

If the S7 CPU is the Modbus serverskip steps 5-9 and continue at step10.


57/80



CopyrightS

ie


No. Action Comment

5 Process the properties of the OtherStation.

Note: this step is only necessary ifthe S7 CPU is the Modbus client.

6 Assign a suitable name for the OtherStation.


7 Insert a new network interface.


8 Select the Industrial Ethernet type.



58/80



CopyrightS

ie


No. Action Comment

9 Adjust the interface in a way so thatit contains the IP address of theModicon M340, has a suitablesubnet mask and is connected withthe same subnet as the S7 CPU.

Subsequently, end the Properties Other Station dialog with the OKbutton.


10 Insert a new connection andconfigure it in a way so that it can beused for the Modbus TCPcommunication to Modicon M340.


59/80



CopyrightS

ie


No. Action Comment

11 Select the "TCP connection"

connection type in the "Insert New

Connection"dialog field.

If the S7 CPU is the Modbus client,select the Other Station (herecalled Modicon M340) under"Connection Partner".

If the S7 CPU is the Modbus server,select the "Unspecified" entry

under "Connection Partner".

Note: once this has been confirmed

the properties window of thisconnection will open automatically.

12 Assign a unique name in theproperties dialog of the TCPconnection (e.g. Modbus TCP toModicon).

If the S7 CPU is the Modbus client,enable the "Active connection

establishment"function.


60/80



CopyrightS

ie


No. Action Comment

13 If the active connectionestablishment is selected, a portnumber of the communicationpartner (Modicon M340) has to beknown. The local port is irrelevant inthis case.

In the case of a passive connectionestablishment, IP address or port ofthe communication partner does notneed to be known. Only the localport has to be configured. On thisport a connection request of theremote communication partner hasto take place (local port: 502).

Confirm the entry with OK.

14 Save and compile the changes madeand subsequently exit NetPro.


61/80

6 Startup of the Application6.4 Configuration of the Modicon M340


CopyrightS

ie


6.3.4 Downloading the project

Table 6-9

No. Action Comment

1 Select the SIMATIC 300 station inthe SIMATIC Manager and downloadthe project to the controller.

Note:if asked via which interface youwould like to created the connectionto the CPU315 you have to selectthe IP of the CP.

6.4 Configuration of the Modicon M340

For you to be able to understand the application examples better, the followingpoints will describe how the Modicon M340 has to be configured to make a ModbusTCP connection with a SIMATIC station possible.

In the application examples included, these steps no longer need to be carried out.

6.4.1 Using application example

Table 6-10

No. Action Comment

1 Opening client or server application.

For the subsequent steps, open theapplication example included indelivery, for the Modicon M340.

Client: m340_client_s7_server.stu

Server: m340_server_s7_client.stu

FileOpen

2 Open the already created userprogram in the Section menu. A sample program with respective data areas alreadyexists.

3 Rebuild all project.


62/80



CopyrightS

ie


No. Action Comment

4 Establish an Online connectionbetween PG/PC and Modicon M340.

5 Transfer the server or client programin the Modicon M340.

6 Start the CPU.


Carry out the following steps in order to configure the hardware of the ModiconM340.

The table deals with the hardware of the application example. If you are usingother hardware, you have to adjust the configuration accordingly.

Table 6-11

No. Action Comment

1 Creating a new project in Unity ProXL

FileNew

2 Select the hardware.


63/80



CopyrightS

ie


No. Action Comment

3 Configure the project settings under

"Tools Project Settings

Build":

4 Configure the project settings under

"Tools Project Settings

Language extensions":


64/80



CopyrightS

ie


No. Action Comment

5 Open the hardware configuration by

double-clicking "PLC bus"in the

"Project Browser" menu.

6 The power supply and thecommunication module already exist

in the hardware configuration.

Right click on a free slot in the rackto insert the I/Os.

Insert a DDO1602 in slot 1 and aDDI1602 in slot 2.

Change the PLC BUS to BMX P342030 01.00.

7 Right click the rack to adjust it to theexisting hardware.

In the application example a rackwith 4 slots is used. Therefore therack with 7 slots configured here hasto be replaced with a rack with 4slots.


65/80



CopyrightS

ie


6.4.3 Configuring an Ethernet interface for Modbus TCP

Table 6-12

No. Action Comment

1 Right click Networksin the

Project Browser under

Communication and select

the New Network menu to

insert a new network.

2 Select Ethernet as network andassign the name Ethernet_1.

3 Now the local Ethernet interface hasto be configured.

You get to this menu by left double-

clicking on the just created network

Ethernet_1under the

Networksmenu

Change the Model Family to

CPU2020, CPU2030" and assign

the IP address and the subnet mask.

IP address: 192.168.1.10

Sub-network mask: 255.255.255.0

Exit this menu after the completedconfiguration and accept thechanges.


66/80



CopyrightS

ie


No. Action Comment

38586568 Modbus TCP Kopplung Doku v12 En

Documents

Transcript of 38586568 Modbus TCP Kopplung Doku v12 En