open modbus tcp for ncm cp redundant english

SIMATIC

OPEN MODBUS / TCP Redundant Communication via CP443-1 in H-Systems

Manual

SIMATIC S7

OPEN MODBUS / TCP Redundant Communication via CP443-1 in H-Systems

Manual

Edition 1.0

Preface, Table of Contents

Product Description 1

Mounting 2

Commissioning 3

FB MODB4H 4

Transmission Protocol 5

Diagnostics 6

Application Sample 7

Appendices

Literature

Glossary

Safety Precautions and Warnings

This manual contains warnings, which you should note for your own safety as well as for the prevention of damage to property. These warnings are indicated by means of a triangle and displayed as follows in accordance with the level of danger: __________________________________________________________________

Danger

indicates that loss of life, severe personal injury or substantial damage will result if proper precautions are not taken. __________________________________________________________________ __________________________________________________________________

Warning

indicates that loss of life, severe personal injury or substantial damage can result if proper precautions are not taken. __________________________________________________________________ __________________________________________________________________

Caution

indicates that minor personal injury or property damage can result if proper precautions are not taken. __________________________________________________________________ __________________________________________________________________

Notes

call attention to information that is especially significant to the product, handling of the product or a specific part of this documentation.

__________________________________________________________________

Qualified Personnel

The equipment may be commissioned and put into operation by qualified personnel only. For the purpose of safety relevant warnings of this manual a qualified person is one who is authorized to commission, ground and tag devices, systems and circuits.

Use as prescribed

Trademarks

Please note the following:

_________________________________________________________________________

Warning

This equipment must only be used in applications as prescribed in the catalogue and the technical description and in conjunction with equipment and components recommended and authorized by Siemens.

Successful and safe operation of this equipment is dependent upon proper transport, and storage, erection and installation as well as careful operation and maintenance.

SIMATIC® and SIMATIC NET® are registered trademarks of SIEMENS AG.

The other brand names in this manual may be trademarks use of which by third parties for their purposes may infringe the proprietors’ rights.

Copyright © Siemens AG 2004-2008 All Rights Reserved The reproduction, transmission or use of this document or its contents is not permitted without express written authority. Offenders will be liable for damages. All rights, including rights created by patent grant or registration of a utility model or design, are reserved.

Siemens AG Industrial Solution and Services IT4Industry P.O. Box 3240, D- 91050 Erlangen [email protected]

Exclusion from Liability We have checked the contents of this document with regard to conformity to the described hardware and software. Deviations, however, cannot be excluded; therefore we cannot accept prejudice for its complete conformity. The information in this document is checked regularly and necessary corrections are contained in subsequent issues. Any suggestions for improvement are gratefully received.

We reserve the right to make technical changes.

Preface

OPEN MODBUS / TCP Redundant Communication via CP443-1 in H-Systems 2XV9450-1MB01; Manual edition 1.0

1

Preface

Purpose of the Manual

The information in this manual alows you to set up and put in operation the connection between the CP 443-1 in an S7 redundant system and a device that supports the Open MODBUS/TCP protocol.

Contents of the Manual

This manual describes the function of the Modbus function block and their integration into the hardware and software of the communication processors CP 443-1.

The manual contains the following topics:

• Production description / Mounting

• Commissioning / Installation / Parameterization • Function block • Transmission protocol • Diagnostics • Application sample

Scope of this Manual

This manual is valid for the following software: Product Identification number From version

OPEN MODBUS / TCP Redundant 2XV9 450-1MB01 1.0

FB 1733 “MODB4H 1.0

FB 1734 “MODB4” 1.2

Note

This manual contains the FB description, as it is valid at the time of publication.

How to Access the Information in this Manual

To enable you a quick access to selected information, the manual provides the following access aids:

• The next pages contain a complete table of contents.

Preface


2

Additional Sources of Information

All additional information concerning CP 443 (mounting, commissioning etc.) can be found in the manual SIEMENS SIMATIC Hochverfügbare Systeme S7-400H Systemhandbuch A5E00267693-03

SIEMENS SIMATIC NET S7-CPs for Industrial Ethernet device manual C79000-G8900-C155

SIEMENS SIMATIC NET S7-CPs for Industrial Ethernet device manual part B4 CP 443-1 C79000-G8900-C152

SIEMENS SIMATIC NET NCM S7 for Industrial Ethernet manual C79000-G8900-C129

Additional information concerning STEP7 can be found in the following manuals:

SIEMENS SIMATIC Software Base software for S7 and M7 STEP7 user manual C79000-G7000-C502-..

SIEMENS SIMATIC Software System software for S7-300/400 System and standard functions Reference manual C79000-G7000-C503-02

Additional Questions

If you have further questions regarding the use of the FBs described in this manual, which are not answered in this document, please contact your Siemens partner who supplied you with this function block.

Terminology This document uses the term CP or CP 443. The descriptions only apply to communications processor CP 443-1.

Scope of Application

The function block described in this manual establishes a connection between the CP 443-1 and third party MODBUS devices.

Table of contents


i

Table of Contents

1 ...... Product Description....................................................................................................... 1-1

1.1 ........ Field of Applications.......................................................................................... 1-1

1.2 ........ Hardware and Software Prerequisites.............................................................. 1-2

2 ...... Mounting ......................................................................................................................... 2-1

3 ...... Commissioning .............................................................................................................. 3-1

3.1 ........ Installing the Library on the STEP7 PG/-PC .................................................... 3-1

3.2 ........ Configuration of the Communication Link ........................................................ 3-2

3.3 ........ Parameterization of the CP .............................................................................. 3-3

3.4 ........ Network Configuration ...................................................................................... 3-5

3.5 ........ Insertion of the Function Blocks into the Program.......................................... 3-10

3.6 ........ Start_up Characteristics of CP443 ................................................................. 3-11

3.7 ........ Renaming of Standard Functions ................................................................... 3-12

4 ...... Function Block MODB4H for Redundancy.................................................................. 4-1

4.1 ........ Configuration of the Redundant Communication ............................................. 4-2

4.2 ........ Functionality of the FB...................................................................................... 4-5

4.3 ........ Connection Monitoring Using Cyclic Telegrams .............................................. 4-8

4.4 ........ Parameters of the Function Block MODB4H.................................................... 4-9

4.5 ........ Example for Address Mapping ....................................................................... 4-18

4.6 ........ Data and Standard Function used by the FB ................................................. 4-20

5 ...... Transmission Protocol .................................................................................................. 5-1

5.1 ........ General Communication Architecture .............................................................. 5-1

5.2 ........ Overview........................................................................................................... 5-1

5.3 ........ Function Code 03 – Read Holding Registers ................................................... 5-3

5.4 ........ Function Code 16 – Write Holding Register ..................................................... 5-4

5.5 ........ Function Code 04 – Read Input Registers ....................................................... 5-5

5.6 ........ Exception Code Telegram ................................................................................ 5-6

Table of contents


ii

5.7 ........ Further Sources of Information......................................................................... 5-6

6 ...... Diagnostics..................................................................................................................... 6-1

6.1 ........ Diagnostics via the Display Elements of the CP .............................................. 6-1

6.2 ........ Verification by the FB MODB4/MODB4H ......................................................... 6-2

6.3 ........ Diagnostic Messages of the FB MODB4H ....................................................... 6-5

6.4 ........ Diagnostic Messages of included FCs/SFCs ................................................... 6-9

6.5 ........ Diagnostic Messages of SFC24 ....................................................................... 6-9

7 ...... Application Sample MODB4H ....................................................................................... 7-1

7.1 ........ Programming Example CP is Client ................................................................. 7-3

7.2 ........ Programming Example CP is Server................................................................ 7-8

A...... Literature............................................................................................................................ 1

Product description


1-1

1 Product Description

1.1 Field of Applications

Placement in the System Environ-ment

The driver described here is a software product for the Communications Processor CP443-1 in a SIMATIC S7 redundant system.

CP 443-1 can be used in the SIMATIC S7-400 automation systems and can establish communication links to partner systems.

Function of the FBs

These function blocks enable a communication link between CP 443-1 and a device that supports the Open MODBUS/TCP protocol. Thereby Conformance Class 0 and functioncode 4 of Conformance Class 1 is applied.

All other function codes of Conformance Class 1 and the function codes of Conformance Class 2 are not implemented in this function block.

Data transmission is carried out following the Client-Server principle.

The SIMATIC S7 can act as both client and server during the data transmission.

Redundant communication is supported.

In operating mode server the functionality multitasking according to the MODBUS reference is not implemented.

TCP/IP with CP443-1

TCP/IP with CP443-1 uses static connections. The TCP connection is not disconnected during operation.

Network configuration of STEP7 enables only a unique use of a specific port number, when using TCP native stack of the CP. Therefore the CP/FB is not capable to be addressed from different devices by the same port number.

Product description


1-2

1.2 Hardware and Software Prerequisites

Usable Modules for MODB4H

The function block is released for following CP443-1: 6GK7 443-1EX10-0XE0 FW V2.6 6GK7 443-1EX11-0XE0 FW V2.6.

Software Versions The usage of the FB MODB4H is possible with STEP7 Version 5.1 or higher with the option NCM S7 for Industrial Ethernet.

From version 5.3 of STEP 7 the option NCM is part of the main package of STEP 7.

Memory requirements

The FB MODB4H requires 9326 byte work memory and 11134 byte load memory.

Mounting


2-1

2 Mounting

Information You can find all information regarding S7 400H installation options in the manual „SIMATIC Fault-tolerant Systems S7-400H“, chapter 3.

Commissioning


3-1

3 Commissioning

General Information

The configuration of the CP 443-1 is possible via MPI or LAN/Industrial Ethernet. Required software is STEP7 with NCM S7 for Industrial Ethernet (shortly named ”NCM IE”).

All statements in the following sections referring to STEP7 or NCM IE are related to the STEP7-Version 5.4 SP3 and NCM S7 Industrial Ethernet Version 5.4

Operation flows, names and directory names might be different in other STEP7 versions.

Requirements Knowledge of AWL and basic knowledge of STEP7 and PLC.

3.1 Installing the Library on the STEP7 PG/-PC

What We Provide You

The attached CD contains a setup, which installs the library “MODBUS_TCP_CP_Redundant”, the example projects and the manuals in English and German in the corresponding STEP7 directories.

The manuals are available outside the setup additionally, to give you the opportunity to get all information regarding the software without installation.

Requirements To install, STEP7 must be installed. With older STEP7 versions the option NCM S7 for Industrial Ethernet is necessary additionally.

Installation Insert your Modbus CD into the CD-ROM drive and follow step-by-step the instructions that are automatically displayed by the installation program. If the installation program fails to automatically run, perform these steps:

1. Using Windows Explorer, navigate to the CD-ROM drive and go to the directory setup and double-click Setup.EXE file to start the installation procedure.

2. Follow step-by-step the instructions that are displayed by the installation program.

Now you can find • the library in \Program Files\Siemens\Step7\S7libs, • the example project in \Program Files\Siemens\Step7\Examples, • the manual in \Program Files\Siemens\Step7\S7manual\S7Comm.

To access the Modbus library the first time, use the browse function of the open dialog for libraries. The manual can be accessed via short cut in \Program Files \Siemens \Documentation as well.

Commissioning


3-2

3.2 Configuration of the Communication Link

Introduction The configuration of the communication link consists of the order of the hardware in the configuration table using HW Config. You do the configuration using STEP7 software.

For an Industrial Ethernet link, the SIMATIC 400H-Station, the communication partner and the Industrial Ethernet-network must be configured.

S7 Project Before you can do the configuration, you must have created a new S7 Project on STEP7.

Project Components

Insert the necessary project components with SIMATIC-Manager into the opened project: SIMATIC H-Station, Other Station, Industrial Ethernet network.

Before each insertion, click on the opened project to select it.

SIMATIC 400H-Station Insert Station SIMATIC 400H-Station for your S7-Program (Rack, PS, HCPU, CP443-1...), Insert Station Other Station for the communication partner, Insert Subnet Industrial Ethernet for an Industrial Ethernet network between the SIMATIC 400H-Station and the communication partner.

Configure Hardware

The configuration of the hardware includes the selection of the hardware components and its characteristics.

SIMATIC 400H-Station By selecting the SIMATIC-Station and double clicking on “Hardware“ (or Edit

Open object“) HW Configuration is started. With “Insert Hardware components“ insert 2 RACKs, 2 PSes, 2 CPUs and 2 CP Industrial Ethernet CPs 443-1 with the appropriate order numbers.

The procedures for configuring S7 devices are described in detail in the user manual of STEP7.

Commissioning

3.3 Parameterization of the CP

Parameterization of the CP

After the devices are arranged on your rack with “HW Config” they have to be parameterized.

The parameterization window of the CP 443-1 can be started in “HW Config“ by double clicking the CP or selecting the CP and clicking the menu item Edit

Object properties.

Properties – CP443-1 General

Click on tab “General”, then select “Properties” (single click). This will open the Ethernet interface window. Here you can enter the IP Address and the Subnet Mask of the CP. If you have your stations connected with each other without a router, then they have to be within the same subnet. In the field Subnet connect the CP with the Industrial Ethernet. In order to do that, select the entry with the name of your network. For newly created networks this is normally “Ethernet(1)“.

After the successful parameterization you will be back in the dialog box, “Properties CP443-1”. Here click on “OK“ to finish the parameterization of the CP and you will be back in the dialog box “HW Config“.

Save and Compile the parameterization and close “HW Config“. You will be back in the main menu of the STEP7 project.


3-3

Commissioning

Parameterization of the Communication Partner

In the mode “CP is client” an “other station” is required for network configuration.

After you have inserted the communication partner’s station into your STEP7 project (as described in “Project components: Insert Other station“) you have to specify the object properties of the external station.

Starting from the STEP7 project, you can select the communication partner (Other station) by clicking it.

Select the menu item Edit Object Properties. This opens the dialog box “Properties – Other Station”.

1) Properties – Other Station Interfaces

On the tab “Interfaces“ click on “New“. In the upcoming selection, select “Industrial Ethernet” and click on “OK”.

This opens a dialog box “Properties – Ethernet Interface“. Enter an IP Address that is in the same subnet as the communication partner’s station. The subnet mask should be the same as the one of the partner’s station. Select the associated subnet that connects the CP interface with the communication partner’s interface.

Click on the “OK“ button. This will bring you back to the tab “Interfaces“.


3-4

Commissioning

2) Properties – Other Station General

In tab “General” you do not have to make any settings.

Click on the “OK“ button and you will be back in the main menu of the STEP7 project.

An external station can have multiple interfaces (= Ethernet devices) and may be connected to different Ethernet networks.

3.4 Network Configuration

Communications Connection

The CP is the link for the Industrial Ethernet connection between the S7-CPU and the communication partner / bus. A connection configuration must be made for the connection of the interfaces to the communication partner / bus.

Configure Network in mode “CP is Client”

In the STEP7 project, select the CPU in your S7400H-Station and open “Network configuration“ by double clicking “Connections”. This opens the program “NetPro“ with which your connections can be configured.


3-5

Commissioning

After selecting Insert New Connection... the dialog box ”Insert new connection“ will come up.

Select the connection partner (Other Station) for the new connection and use “TCP Connection” for the connection. Put a check mark on “Show properties dialog“.

Click “OK“. This will take you back to the dialog box “Properties TCP connection“.


3-6

Commissioning

Object Properties of the Connection

• An ID is provided. You can change the ID if needed. • Click on the button “Routing” and the configured connection will be shown. • The MODBUS client normally does “Active connection establishment”.

• In the register “Addresses” the port numbers are defined.

Click on “OK“ and the inputs are accepted.

Save the network configuration and close the program “NetPro“.

Please note that the connection ID (Local ID) has to be used when the FB is called in the user program.

Selection of the Port Number

In a MODBUS communication a MODBUS server are normally addressed via port 502, whereas a MODBUS client uses a port different to 502.


3-7

Commissioning

Unspecified Connection with “CP is server”

If you have got a communication with CP as MODBUS server, and you did not know the port number of the client, the communication can be set up as “unspecified connection”. But the client has to meet the requirement of active connection establishment.

You do not need an “other station” in your S7-project in that case. After selecting Insert New Connection... the dialog box ”Insert new connection“ will come up.

Select here “unspecified” instead of the communication partner and use “TCP Connection” for the connection. Put a check mark on “Show properties dialog“


3-8

Commissioning

Click “OK“. This will take you back to the dialog box “Properties TCP connection“.

The check box “active connection establishment” must not be activated.

In the register “addresses” all information regarding the partner, “IP” and “PORT” are left blank.

Click on “OK“ and the inputs are accepted.


3-9

Commissioning


3-10

3.5 Insertion of the Function Blocks into the Program

Content of MODBUS library

The Modbus library contains the folder “S7400H System” with the FBs for the redundant communication.

This folder contains the function blocks FB1733 (MODB4H) and FB1734 (MODB4). Both blocks are required for redundant communication. The function block MODB4H executes a multiple call of MODB4. The function blocks execute the function codes FC3, 4 and 16.

Insertion of the MODB4H FB

In order to exchange data with MODBUS devices, you need the function blocks MODB4 and MODB4H. To be able to insert this into your project you have to copy the function block from the library. For that, open the library “Modbus_TCP_CP_Redundant “ by selecting the menu item File Open. In the dialog box “Open Project“ select the tab ”Libraries“. Select the library “Modbus_TCP_CP_Redundant” using the Browse-Button and click “OK”.

This opens the library. Open the folder “S7400H System” by double clicking it. Select the function blocks FB MODB4 and MODB4H and copy it via “Edit

Copy”. Then change back to your project . In the Step7 project, in your opened S7400H-Station, select the CPU. Double click “S7-program”, and then “Blocks”. This will open the “Blocks” folder. Select “Edit Paste”. This will insert the blocks into your program.

Commissioning


3-11

Insertion of the Communication Blocks

The modbus function block uses the function blocks AG_LSEND and AG_LRECV. These should be inserted into your program. You can find these communication function blocks in the library “SIMATIC_NET_CP“ which are included in the software package NCM S7 for Industrial Ethernet. Open the library by selecting “File Open”. In the dialog box “Open Project“ select the tab “Libraries“. Select the library “SIMATIC_NET_CP“ and click “OK“. This will open the library.

Open the folder “CP 400“ by double click, select the function FC50 (AG_LSEND) and FC60 (AG_LRECV) and copy it with Edit Copy. Then change back to your project.

Select in the STEP7 project in your opened S7400H-Station the CPU. Open the “Blocks” folder by double clicking “S7-Programm“ and then “Blocks”. With “Edit Paste”, insert the function block into your program.

Please note, that the following versions of the FCs are a prerequisite for the faultless function of the FBs MODB4H/MODB4:

AG_LSEND V3.0 or higher AG_LRECV V3.0 or higher

Insertion of the Conversion Block

For the processing of MODB4H block the function FC40 „TIM_S5TI“ from the “IEC standard library” is needed as well. Please follow the instruction above for copying/insertion of blocks to insert this block in your project.

3.6 Start_up Characteristics of CP443

Introduction The start up of the CP is divided into the following phases:

• Initialization (Power on of the CP)

• Parameterization

Initialization As soon as the CP is connected to power, the hardware self test runs. The firmware of the CP is set up for operation.

Parameterization During parameterization the CP receives the device parameters that are assigned to its slot.

The CP is now ready for operation.

Commissioning


3-12

3.7 Renaming of Standard Functions

Inducement Whether you have already used the numbers of standard functions in your project or the block number is reserved for a different application, you may rename the internal called function blocks AG_LSEND/AG_LRECV and TIM_S5TI of FB MODB4/MODB4H. It is not possible to rename the system functions SFC6 and SFC24.

General In principle, you can execute the wiring of modules and operands "leading symbolically" or "leading absolutely". Blocks with KNOW_HOW_PROTECT like FB MODB4/MODB4H can only be handled "leading absolutely"

Renaming To rename FC50/60 proceed as described subsequently:

1. Get the information about the used operand by clicking "Extras > Reference data > Display".

2. Set the operand priority in the object properties of the block folder to "Absolute value".

3. Call the function "Extras > Re-wire" in the SIMATIC Manager, in order to re-wire the operands into free areas.

4. To be able to keep on using the symbolism diagnostics tools, add the modifications in the symbolism table supplementary.

The modifications can be verified by clicking "Extras > Reference data > Display".

Function Block MODB4H

4 Function Block MODB4H for Redundancy

General Information

The function block MODB4H allows a communication between a CP443-1 in a redundant system (H-system) and a partner, which supports conformance class 0 (includes function codes 3 and 16) and function code 4 of Open MODBUS/TCP.

The communication partner of the H-system can be mounted stand-alone or redundant too (single sided or double sided redundancy).

Single sided redundancy Double sided redundancy

Depending on the parameterization, the FB MODB4H can be operated both in client and in server mode.


4-1



4-2

4.1 Configuration of the Redundant Communication

Configuration in HW Config

While configuring the hardware in HW Config, both CP0 and CP1 get different input and IP addresses, so that they can be addressed unique in the S7-program respectively from the communication partner.

Configuration in NetPro

You have to define one connection in NetPro for each possible connection between the communication partners.

With single sided redundancy, there is one connection for CPU0/CP0 and one for CPU1/CP1:

• Connection from CPU0/CP0 to Partner => Connection 0A

• Connection from CPU1/CP1 to Partner => Connection 1A

With double-sided redundancy, there are two connections for CPU0/CP0 and two for CPU1/CP1:

• Connection from CPU0/CP0 to Partner/Node A=> Connection 0A

• Connection from CPU1/CP1 to Partner/Node A=> Connection 1A

• Connection from CPU0/CP0 to Partner/Node B=> Connection 0B

• Connection from CPU1/CP1 to Partner/Node B=> Connection 1B

The figures in the following example illustrate the denotation of the connections.

Please note when configuring network connections, that the end points of the connection (S7: CP0 und CP1, partner: node A and node B ) must have at least one distinctive feature for addressing: either the IP address or the port number. In HW Config CP0 und CP 1 get always different IP-addresses. Therefore in the network configuration each CP can use the same port number. If the communication partner has got only one IP address, then each connection has to use a different port number.

Usually the Modbus server is addressed via the port number 502; the Modbus client uses a port number different from 502.

A wrong port number (identical port numbers) will be recognized by NetPro while entering the value and/or closing the configuration window.


Example: Single Sided Redundancy

The following figure illustrates a configuration example in NetPro for single sided redundancy.

Mode: “S7 is server” The S7-station has got the IP-addresses 10.0.0.50 und 10.0.0.51 and can be addressed via both connections with the port number 502.The communication partner has got the IP-Address 10.0.0.60 and has to use 2 different port numbers for the two connections: 2000 und 2001

Mode: “S7 is client” The S7-station has got the IP-addresses 10.0.0.50 and 10.0.0.51 and can use the port number 2000 for both connections. The communication partner has got the IP-Address 10.0.0.60 and must be addressed with 2 different port numbers: 502 and 503.


4-3


Example: Double Sided Redundancy

The following figure illustrates a configuration example in NetPro for double sided redundancy.

Mode: “S7 is server” The S7-station has got the IP addresses 10.0.0.50 and 10.0.0.51.for the access from node A of the communication partner. Both CPs, CP0 and CP1, can use port number 502, because both of them are having different IP-addresses (connection 0A and 1A). For the access from node B of the communication partner, it is also possible that both CPs, CP0 and CP1 use the same port number 503 (Connection 0B and 1B). The communication partner has got the IP-Addresses 10.0.0.60 and 10.0.0.61 for the access to CP0 of S7, node A and node B can use the same port number: 2000 (connection 0A and 0B). For the access to CP1 of S7 it is also possible to use the same port number: 2001 (connection 1A and 1B)

Mode: “S7 is client” The S7-station has got the IP-addresses 10.0.0.50 and 10.0.0.51. For the access to node A of the communication partner, both CPs, CP0 and CP1, can use port number 2000, because both of them are having different IP-Addresses (connection 0A and 1A). For the access to node B of the communication partner, it is also possible that both CPs, CP0 and CP1, use the same Port number 2001(Connection 0B and 1B). The communication partner has got the IP-Addresses 10.0.0.60 and 10.0.0.61. For the access to CP0 of S7, node A and node B can use the same port number: 502(Connection 0A and 0B). For the access to CP1 of S7 it is also possible to use the same port number: 503 (Connection 1A and 1B).


4-4



4-5

4.2 Functionality of the FB

Performed Functions

The function block MODB4H performs the following functions:

• Automatic switch-over to the redundant connection, in case the current active connection fails or the switch-over time elapses

• Display of the current active CP in H-System

• Display of the current active node of the communication partner in case it is build up redundant too

• Monitoring of the connection: CP is client: Facility to send cyclic telegrams CP is server: Check for reception in a defined time frame

• Control the Transaction identifier TI (only in mode “CP is client”).

The function block MODB4H executes a multiple call of MODB4 and coordinates these calls for the different connections.

The function block MODB4 performs the following functions:

• Calls the standard functions for the data transfer between the CPU and the CP

• Generates MODBUS specific telegram header before send

• Verification of the MODBUS specific telegram header after receive

• Verification if the memory areas exist which are requested by the client

• Generate exception telegrams when failures occur (only when CP is in server mode)

• Data transfer to and from the parameterized DB

• Monitoring the data reception with a time-out

Call of the FB The function block has to be called both in the start up OB100 as well as in the cyclic OB1.

For each connection of NetPro, the FB MODB4H can be called once.

It is not allowed to call FB MODB4H in cyclic interrupt organization blocks (e. g. OB35).

Online-Help In SIMATIC Manager an online help for function block MODB4H is provided. Mark the FB and press the key “F1”. The online help is displayed; it contains the main information regarding the FB.

If "OpenModbusTCP CP" and "OpenModbusTCP CP Redundant" are installed on the same computer the online help of the MODB4 (FB101) is displayed after pressing the button "F1" at marked MODB4 (FB1734). The contents of the help files are identical, only the FB numbers are different.



4-6

Start up of the FB The function block MODB4H should be unconditionally called once in OB100. The initialization parameters must be set according to the station configuration. They will be copied into the instance DB.

The runtime parameters will not be evaluated during the start up.

Cyclical Operation of the FB

In cyclical operation the MODB4H is called in OB1. According to the runtime parameters, the functions of the function block are activated. While a request is running, changes to the runtime parameters are ignored.

During cyclical operation changes to the initialization parameters are ignored.

Initiate Request CP is Client

A rising edge at the trigger input ENQ-ENR initiates a request via the active connection. Depending on the inputs parameters UNIT, WRITE_READ, START_ADDRESS, LENGTH und INPUT_HOLDING, a MODBUS request is generated and sent to the partner station via TCP/IP connection. The client waits for the parameterized monitoring time for a response from the server.

In case the monitoring time elapses (no answer from the server) or a faulty connection, the telegram will be sent successively via the other configured connections. If all retries fail, ERROR is set and the last error code is displayed.

When the client receives a respond, a validity check is carried out. If the result is positive, necessary actions will be taken and the request will be terminated without error. The output DONE_NDR is set. When an error is recognized during verification, the request is terminated with an error, the ERROR bit is set and an error number is returned in STATUS. In this case the request telegram will not be sent again via the next configured connection.

With the parameters SO_TIMER and SO_TIME, the user has the possibility to send cyclic telegrams to the server for a prompt recognition of a connection break-down. With SO_TIME = 0, no cyclic telegrams are sent to the server. With SO_TIME > 0, cyclic telegrams are sent in this time frame. In case of a break-down of the active connection, a switch-over to the next connection is carried out.

The switch-over to the next configured connection only takes place if the monitoring time of the current connection elapses or a connection break-down occurs.



4-7

Activation of the Function Block CP is Server

With a true signal at the input ENQ_ENR the FB is ready to receive a request telegram from the client. The server remains passive.

The telegram received via the active connection is verified. If the telegram is verified positive, the response telegram is generated and sent. The completed transmission is reported to the user by setting the DONE_NDR bit. At this time the completed function is indicated at the outputs START_ADDRESS, READ_WRITE, LENGTH, UNIT and INPUT_HOLDING.

A faulty request telegram causes an error message and the ERROR bit is set. The error number is returned in STATUS. Depending on the kind of error, the request of the client is either answered with an exception telegram or no respond is sent.

If a break-down of the active connection is recognized, all configured connections will be set to “ready for receive”. With the first error free received telegram, the respective connection is set as the active connection. Henceforce telegrams received via the active connection will be processed.

A switch-over to the other configured connections only takes place when the switch-over time SO_TIME elapses or when a break-down of the active connection is recognized.

Data Transfer CPU – CP

The data transfer between CP and CPU are done with the standard function blocks AG_LSEND and AG_LRECV.

At the activation of a MODBUS request by the user (CP is client) or at the receipt of a telegram from the client (CP is server) the standard blocks necessary for the CP are called by the FB in the right order and number.

At the receipt of a telegram, the first 6 Bytes are read with the function AG_LRECV. This header contains the length of the rest of the telegram. A second call of the AG_LRECV function follows with the rest of the telegram length. The verification of the received data takes place after the complete receipt of the data.

TCP/IP with CP443-1

TCP/IP with CP443-1 uses statistic connections. The TCP connection cannot be disconnected while in run mode. Given this system characteristic, telegrams might be lost under unfavorable conditions when the synchronization had been lost after an error. The function of the FB in this situation is described in chapter “Diagnostics”



4-8

4.3 Connection Monitoring Using Cyclic Telegrams

General Information

The FB MODB4H can detect the state “connection not established” not until a data telegram is transferred and the communication blocks AG_LSEND/AG_LRECV report an error.

For a fast detection of possible connection errors and prompt switch-over to another configured connection, you can use the feature to configure a cyclic telegram monitoring.

The cyclic telegram monitoring means that at least one telegram has to be exchanged between MODBUS client and MODBUS server during the configured switch-over time SO_TIME. The parameter SO_TIME defines the time gap between the last respond and the next request telegram.

CP is Client When “cyclic telegrams” are activated, the FB MODB4H monitors the interval after an initiated request with ENQ_ENR. If the monitoring time SO_TIME elapses without ENQ_ENR is set to TRUE again, the MODB4H generates the cyclic telegram and sends the corresponding request to the server. If a data telegram is initiated with ENQ_ENR = TRUE while executing a cyclic telegram, the data telegram will be executed after the cyclic telegram is finished.

The cyclic telegrams are defined with the parameters CHECK_REG, CHECK_LEN, and CHECK_UNIT. They are always sent with function code 3 (Read Holding Register).

The outputs DONE_NDR, ERROR are only set accordingly while executing a data telegram.

If a data telegram or a cyclic telegram could not be sent via any of the configured connections, an error message is returned in STATUS and the connection 0A is used as default connection.

CP is Server With “telegram monitoring” activated, the MODB4H expects a telegram from the client within the switch-over time SO_TIME. If the SO_TIME elapses without receiving a new request, data reception is verified on all other configured connections.

If the monitoring time SO_TIME elapses for all configured connections, an error message is returned in STATUS. Subsequent data reception is verified for all configured connections.



4-9

4.4 Parameters of the Function Block MODB4H

Parameter Decl. Type Description Value range Init

ID_0_A IN WORD Connection-ID for CPU/CP0 according to the configuration in NetPro

1 to 64 W#16#1 to W#16#40

yes

ID_1_A IN WORD Connection-ID for CPU/CP1 according to the configuration in NetPro

1 to 64 W#16#1 to W#16#40

yes

ID_0_B IN WORD Connection-ID for CPU/CP0 according to the configuration in NetPro

Only requird with double-sided redundancy

1 to 64 W#16#1 to W#16#40

yes

ID_1_B IN WORD Connection-ID for CPU/CP1 according to the configuration in NetPro ,

Only requird with double-sided redundancy

1 to 64 W#16#1 to W#16#40

yes

LADDR_0 IN WORD Input address of the CP0 from HW Config CPU dependent

yes

LADDR_1 IN WORD Input address of the CP1 from HW Config CPU dependent

yes

TIMER_NR_0A

IN TIMER Timer number for the response monitoring time for Connection 0A

CPU dependent

no

TIMER_NR_1A

IN TIMER Timer number for the response monitoring time for Connection 1A

CPU dependent

no

TIMER_NR_0B

IN TIMER Timer number for the response monitoring time for Connection 0B

CPU dependent

no

TIMER_NR_1B

IN TIMER Timer number for the response monitoring time for Connection 1B

CPU dependent

no

MONITOR IN INT Monitoring time: Wait for Data from the communication, in 100 ms Units

1 to 999 W#16#1 to W#16#3E7

no

SO_TIMER IN TIMER Timer number for the SO_TIME CPU dependent

yes

SO_TIME IN INT CP is Server: time monitoring for switch over to the other CP

CP is Client: Maximal time interval between Respond and next Request

The monitoring time is switched off.

Monitoring time in 100 ms units

0

1 to 999

yes



4-10


DB_1 IN WORD Data block number, first range for Holding Register

1 to 65535 W#16#1 to

W#16#FFFF

yes

START_1 IN WORD First MODBUS register address 0 to 65535 W#16#0000 to W#16#FFFF

yes

END_1 IN WORD Last MODBUS register address 0 to 65535 W#16#0000 to W#16#FFFF

yes

DB_2 IN WORD Data block number, second range for Holding Register Null if not used

1 to 65535 W#16#1 to

W#16#FFFF

0

yes


yes


yes

DB_3 IN WORD Data block number, third range for Holding Register

Null if not used

1 to 65535 W#16#1 to

W#16#FFFF

0

yes


yes


yes

DB_4 IN WORD Data block number, fourth range for Holding Register Null if not used

1 to 65535 W#16#1 to

W#16#FFFF

0

yes


yes


yes

DB_5 IN WORD Data block number, fifth range for Holding Register Null if not used

1 to 65535 W#16#1 to

W#16#FFFF

0

yes


yes



4-11



yes

DB_6 IN WORD Data block number, first range for input Register

1 to 65535 W#16#1 to

W#16#FFFF

yes


yes


yes

DB_7 IN WORD Data block number, second range for input Register Null if not used

1 to 65535 W#16#1 to

W#16#FFFF

0

yes


yes


yes

DB_8 IN WORD Data block number, third range for input Register Null if not used

1 to 65535 W#16#1 to

W#16#FFFF

0

yes


yes


yes

WRITE_ PROTECT1

IN BOOL Area 1 is write protected (only in SERVER mode)

TRUE FALSE

yes

WRITE_ PROTECT2


TRUE FALSE

yes

WRITE_ PROTECT3


TRUE FALSE

yes

WRITE_ PROTECT4


TRUE FALSE

yes

WRITE_ PROTECT5


TRUE FALSE

yes



4-12


ENQ_ENR IN BOOL CP is Client: Initiate request at true signal

CP is Server: Ready to receive at true signal

TRUE

FALSE

no

SERVER_ CLIENT

IN BOOL CP/FB operates in Server mode or in Client mode

TRUE FALSE

yes

CHECK_ REG

IN WORD Register number which is used in cyclic telegrams, only required when CP is client and SO_TIME>0

0 to 65535 W#16#0000 to W#16#FFFF

yes

CHECK_ LEN

IN BYTE Length of the cyclic telegram, only required when CP is client and SO_TIME>0

1 to 125 B#16#1 to B#16#7D

yes

CHECK_ UNIT

IN BYTE Unit number for cyclic telegrams, only relevant when CP is Client and SO_TIME>0

0 to 255 B#16#0 to B#16#FF

yes

FREE_ CODE_0

IN DWORD Not used

FREE_ CODE_1

IN DWORD Not used

LICENSED OUT BOOL Not used

CP1_ ACTIVE

OUT BOOL Request was carried out via CP1 Request was carried out via CP0

TRUE FALSE

no

C_B_ ACTIVE

OUT BOOL Connection Node B of the communication partners is active Connection Node A of the communication partners is active

TRUE

FALSE

no

DONE_NDR OUT BOOL CP is Client: Active request finished without errors

CP is Server: Request from the client was executed and answered

TRUE FALSE

no

ERROR OUT BOOL An error has occurred TRUE FALSE

no

STATUS OUT WORD Error number 0 to FFFF no

CODE_0 OUT DWORD Not used

CODE_1 OUT DWORD Not used



4-13


START_ ADDRESS

IN/ OUT

WORD MODBUS start address (INPUT in CLIENT function, OUTPUT in SERVER function)

0 to 65535 W#16#0000 to W#16#FFFF

no

LENGTH IN/ OUT

BYTE Number of registers to be processed (INPUT in CLIENT function, OUTPUT in SERVER function) Read Function Write Function

1 to 125 B#16#1 to B#16#7D

1 to 100 B#16#1 to B#16#64

no

WRITE_ READ

IN/ OUT

BOOL Write access Read access (INPUT in CLIENT function, OUTPUT in SERVER function)

TRUE FALSE

no

INPUT_ HOLDING

IN/ OUT

BOOL CP/FB operates with Input Register (FC3) or Holding Register (FC4)

TRUE FALSE

no

UNIT IN/ OUT

BYTE Unit Identifier (INPUT in CLIENT function, OUTPUT in SERVER function)

0 to 255 B#16#0 to B#16#FF

no

General information

The parameters of the FB MODB4H can be divided into two groups:

• Initialization parameter

• Runtime parameter

The initialization parameters are evaluated only at the first initial execution of the function block MODB4H and taken over into the instance DB. They are marked in the above table in the column „INIT“ with „yes“. A modification of the initialization parameters during the runtime has no impact. After the modification of these parameters (e.g. at the test mode), the instance DB must be initialized via a STOP/RUN transition of the CPU.

Runtime parameters can be used in cyclical operations. It is not advised to change the input parameters while a request is active. Wait with the preparation of the next request and the change of the parameter until the previous request ends with DONE_NDR or ERROR. The outputs parameters can only be evaluated when DONE_NDR is true.

Range of Values For the range of values of the different parameters, CPU specific restrictions must be taken in consideration.



4-14

ID_0_A, ID_1_A ID_0_B, ID_1_B

For each configured connection in STEP7/NetPro, a connection ID is assigned. The connection ID is the distinct description of the connection from the CPU via the CP to the communication partner.

The number of the configured connection has to be entered here. The value range for this parameter depends on the CPU.

ID_0_A represents the connection from the CP0 to node A.

ID_1_A represents the connection from the CP1 to node A

ID_0_B represents the connection from the CP0 to node B

ID_1_B represents the connection from the CP1 to node B

The connection 0A is the default connection, its configuration is mandatory.

If the communication partner is built up standalone, then the parameters ID_0_A and ID_0_B are used.

LADDR_0, LADDR_1

The parameters LADDR_0 and LADDR_1 represent the input address of the CP0 and the CP1 from HW Config (I-Address). The configured value has to be entered here.

The range of values for these parameters depends on the CPU.

You can find the parameters ID_x and LADDR_x in the menue “Properties – TCP Connection” as well.

TIMER_NR_0A, TIMER_NR_0B, TIMER_NR_1A, TIMER_NR_1B

The particular timers, which realize the monitoring time MONITOR are defined here. Each timer will be used for the corresponding connection.

The range of values for these parametere depend on the CPU. Any other program must not use these timers.

MONITOR The monitoring time observes the entry of the data input from the communication partner over the active connection. The monitoring time can be set in 100ms intervals. A monitoring time of 1,5 seconds is recommended.

In the operating mode “CP is client“ MONITOR specifies the timeout for the receipt of the complete response telegram from the server. When the monitoring time elapses, the active request is cancelled with an error. The time is started after sending of the request telegram is finished and is stopped after the receipt of the complete data.

In the operating mode „CP is server“ the receipt of the second part of the telegram is monitored with the MONITOR time. When this time elapses an error is reported. The timer is started after the receipt of the MODBUS specific telegram header and is stopped after the receipt of the complete request telegram.

SO_TIMER The number of the timer to monitor the SO_TIME is entered here.

The range of values for this parameter depends on the CPU. Other programs must not use this timer.



4-15

SO_TIME The parameter SO_TIME (switch over time) provides the feature to monitor the connection by using cyclic telegrams. With cyclic telegrams a prompt recognition of connection failures is possible.

With SO_TIME = 0 the monitoring is switched off.

To activate the monitoring, the SO_TIME can be set within 100ms intervals from 100 milliseconds to 99,9 seconds. It is recommended to set the SO_TIME longer than the monitoring time MONITOR.

In the operating mode “CP is client“ the SO_TIME is the time gap in which cyclic telegrams are sent to the communication partner. The cyclic telegrams are set with the parameters CHECK_REG, CHECK_LEN and CHECK UNIT.

In the operation mode “CP is server“, the SO_TIME is the time frame in which the telegram from the communication partner should be received. If this time elapses without receipt, the reception of the telegram is checked on all other configured connections.

DB_x START_x END_x

The FB offers 8 memory areas for mapping the MODBUS register addresses in the S7 storage. DB_1 to DB_5 are used for the Holding Register, DB_6 to DB_8 are used for the Input Register. At least DB_1and DB_6 must be defined. The other DBs are optional.

Holding Register can be read and written; the Input register can only be read.

With one request only one DB can be accessed. Even if consecutive register numbers are located in two different DBs, you need two requests to access them. This has to be taken into account during parameterization.

In the operating mode „CP is client“ 3 parameters are required: DB_x, START_x und END_x. In the operating mode „CP is server“ the parameter WRITE_PROTECTx is required additionally.

The parameter DB_x specifies the DB, into which the below defined MODBUS registers are mapped. START_x specifies the first memory address, which is stored in word 0 of the DB. END_x defines the address of the last MODBUS register.

The number of the data word of the S7 DB in which the last register is mapped, can be calculated with the following formula:

DBW number = (END_x – START_x) ∗ 2

If 0 is entered for DB_x, the respective memory area is not used.

The defined memory areas must not overlap. The parameter END_x must not be smaller than START_x. In case of an error the initialization of the FB is stopped with an error.

At the end of this section you can find an example of the mapping of the MODBUS addresses to S7 memory areas.



4-16

WRITE_ PROTECTx

Memory areas can be set write protected in the operating mode” CP is server”. That insures that the client cannot write in certain areas of S7.

For each memory area (DB_1 to DB_5) there is a separate write protection flag. Write accesses to locked areas initiate an exception telegram.

ENQ_ENR Operation mode ”CP is Client”: The data transfer is initiated with a TRUE signal at the input. The request telegram is generated with the values of input parameters UNIT, READ/WRITE, START_ADDRESS, LENGTH and INPUT_HOLDING. A new request can only be sent when the previous one is finished with DONE or ERROR.

Operation mode “CP is Server“: The FB is activated with a TRUE signal at this input. Telegrams from the client can be received. With a FALSE signal at this input data is received from the CP and discarded.

SERVER_CLIENT This parameter differentiates the client from the server mode. If this input is TRUE, then the operation mode is “CP is server”. If the input is FALSE, the operating mode is “CP is Client“.

CHECK_REG This parameter specifies the first Modbus register that is read with a cyclic telegram. This parameter is only applicable in the operating mode ”CP is client”.

CHECK_LEN This parameter specifies the number of Modbus registers that are read with a cyclic telegram. This parameter is only applicable in the operating mode ”CP is client”.

CHECK_UNIT This parameter specifies the unit number which is sent in a cyclic telegram. This parameter is only applicable in the operating mode ”CP is client”.

CP1_ACTIVE This parameter displays the current active CP in the H-System. This parameter set to FALSE means, the last telegram was sent via the CP0. CP1_ACTIVE set to TRUE displays that the last telegram was sent via the CP1.

C_B_ACTIVE This parameter displays which node of the redundant communication partner is active. If the output is FALSE, the last telegram was sent via the node A. If the output is TRUE, the last telegram was sent via the node B.

If the communication partner is built up standalone, this parameter is always set to FALSE.

DONE_NDR In the operating mode „CP is Client“ the activated request was executed without error. For a read function the response data from the server has already been entered into the DB. For a write function the response to the request telegram has been received from the server.

In the operating mode „CP is Server“ this output indicates a telegram exchange without errors. In the parameters READ_WRITE, START_ADDRESS, LENGTH and INPUT_HOLDING the request parameters of the client are displayed. These outputs are only available and valid as long as DONE_NDR is TRUE.



4-17

ERROR When this output is set, an error was recognized.

In case of a protocol error, ERROR is immediately set. In case of a connection error, all the configured connections are verified and ERROR is set not until all connections report an error.

In the operation mode “CP is Client“ the activated request was finished with an error. The error number is displayed in the STATUS output.

In the operating mode „CP is Server“ an error is detected at a request telegram of the client or during sending a response telegram. The error number is displayed in the STATUS output.

STATUS The STATUS output displays the error number when ERROR is TRUE. The error numbers are described in chapter “Diagnostics”.

START_ADDRESS The parameter START_ADDRESS specifies the first MODBUS register that is read or written. In the operating mode “CP is Client“ it is an input parameter, in the operating mode „CP is Server“ it is an output parameter.

LENGTH The parameter LENGTH specifies the number of MODBUS registers that are read or written. In the operating mode, “CP is Client“ it is an input parameter. In the operating mode “CP is Server“ it is an output parameter.

For read functions, a maximum of 125 registers is possible per telegram. For write functions a maximum of 100 registers is possible. All registers have to be in the same DB per telegram.

WRITE_READ This parameter defines if a read or write function should be carried out. If the value of the input/output is FALSE, it specifies the read mode. The value TRUE specifies the write mode. In the operating mode “CP is Client“ it is an input parameter. In the operating mode „CP is Server“ it is an output parameter.

INPUT_HOLDING This parameter defines if Input Registers or Holding Registers should be worked on. If the value of the input/output is FALSE, it specifies that Holding Registers are accessed. The value TRUE specifies access of Input Registers. In the operating mode “CP is Client“ it is an input parameter. In the operating mode „CP is Server“ it is an output parameter.

Holding Registers can be read and written. Function code 3 reads Holding Registers, function code 16 writes Holding Registers.

Input registers can only be read. Function code 4 reads input registers.



4-18

UNIT In mode „CP is Client“ the parameter UNIT is an input parameter. This input has to be set according to the requirements. The FB copies this value to the request telegram and verifies when the respond telegram is received. Please note, that some communication partners expect a certain unit number.

In mode „CP is Server“ the parameter UNIT is an output parameter. The FB copies this value from the request telegram to the respond telegram. The output is set with the received value when the job is finished without error.

4.5 Example for Address Mapping

Example:

Parameterization of the Memory Areas

SERVER_CLIENT Server DB_1 W#16#B (11) START_1 W#16#1 (1) END_1 W#16#1F4 (500) WRITE_ PROTECT1 FALSE DB_2 W#16#C (12) START_2 W#16#1F5 (501) END_2 W#16#258 (600) WRITE_ PROTECT2 TRUE DB_3 W#16#D (13) START_3 W#16#2BD (701) END_3 W#16#320 (800) WRITE_ PROTECT3 FALSE DB_4 0 DB_5 0 DB_6 W#16#10 (16) START_6 W#16#1 (1) END_6 W#16#1F4 (500) DB_7 W#16#11 (17) START_7 W#16#3E8 (1000) END_7 W#16#448 (1099) DB_8 0

Address Mapping The following diagram shows the comparison of the SIMATIC memory area and the Modbus typical register oriented storage arrangement. The diagram is based on the above parameterization.

The Modbus addresses printed in black refer to the Data Link Layer, the ones printed in grey refer to the Application Layer.

The SIMATIC addresses printed in black are the offset in the DB. You can find additionally the Modbus register numbers printed in grey.

Function block MODBUS

SIMATIC

DB 11

DB 12

DB 13

Modbus Device

Holding Register

Input Register

+ 0.0 1

+996.0 499

+998.0 500

+ 4.0 3

+ 2.0 2

500 40501

3 40004

2 40003

1 40002

499 40500

600 40601

501 40502

502 40503

599 40600

601 40602

700 40701

701 40702

702 40703

799 40800

800 40801

801 40802

+ 0.0 501

+ 2.0 502

+198.0 600

+196.0 599

+ 0.0 701

+ 2.0 702

+198.0 800

+196.0 799

DB 16

+ 0.0 1

+996.0 499

+998.0 500

+ 4.0 3

+ 2.0 2

DB 17

+ 0.0 1000

+ 2.0 1002

+198.0 1099

+196.0 1098

500 30501

3 30004

2 30003

1 30002

499 30500

501 30502

999 31000

1000 31001

1099 31100


4-19

Function block MODBUS


4-20

4.6 Data and Standard Function used by the FB

Instance DB The function block MODBUS stores its data in an instance DB. This instance DB is created by STEP7 at the first call of the FB.

The instance data block contains parameters of type Input, Output, Input/Output as well as static variables needed for its execution. These variables are non-volatile and keep its validity between FB calls. The variables control the internal process flow of the FB.

Required memory of the instance-DBs: Instance-DB work memory load memory

MODB4H 3022 Byte 4524 Byte

Local Variables The FB requires 44 Bytes of local variables. Additionally AG_LSEND or AG_LRECV require local variables, up to 58 bytes, depending on the used function block. That gives a maximum of 102 Bytes of local data for a FB MODB4H-call.

Timers The function block uses up to 5 timers to realize the monitoring time. The number of the used timers can be parameterized. Other programs must not use this timers.

Flags The function block does not use any flags.

Standard-FCs for Data Transfer

The function block uses the blocks AG_LSEND and AG_LRECV from the SIMATIC_NET library for the data transfer between CPU and CP.

The following versions of the FCs are tested with the FB and released for the communication:

• FC50 „AG_LSEND“ Version 3.0

• FC60 „AG_LRECV“ Version 3.0

Funktionsbaustein MODBUS


4-21

SFCs and FCs for Miscellaneous Functions

The FB MODB4H uses the following SFCs from the standard library:

• SFC6 “RD_SINFO“

• FC40 “TIM_S5TI“

The block MODB4H executes multiple calls of MODB4. In MODB4 the following system functions are called:

• SFC6 “RD_SINFO“

• SFC24 “TEST_DB”

• FC50 “AG_LSEND“

• FC60 “AG_LRECV“

With SFC6 the FB checks if it was called from OB100 or OB1 and decides this way if the initialization part or the cyclic part should be executed.

The conversion of the data format TIME to S5TIME is done with SFC40.

A call of SFC24 determines, whether the DB specified in DB_x is available at runtime and has the required length.

Additional Information

The parameter TI, which exists in both function blocks MODBUS and MODB4H as input respectively output, is operated internally in MODB4H and is incremented in mode “S7 is client” with each new request.

In the operation mode “S7 is Client” FB MODB4H tries to send the telegram successively over one of the 4 configured connections. Thereby the order is 0A, 0B, 1B and 1A. If a telegram is successfully transferred over one of the connections, this one is marked as active and the following transmission is carried out via this connection. In case of a connection error at the active connection the FB tries to send the telegram successively via all configured connections.

Error 8304: When the connection from the CP to the communication partner is interrupted, the interruption is recognized by the CP and error number 8304 stored. When a communication request is activated, first error code 8304 is returned even if the connection is available again, because this error code is still stored. This is a given system characteristics of the CP.

When the MODBUS function block returns ERROR=TRUE and STATUS=8304, the communication request should be activated once again.

Übertragungsprotokoll

5 Transmission Protocol

5.1 General Communication Architecture

General MODBUS frame

The MODBUS protocol defines a simple Protocol Data Unit (PDU) independent of the underlying communication layers. The mapping of MODBUS protocol on specific buses or networks can introduce some additional fields on the Application Data Unit (ADU).

PDU

ADU

Additional address

Function code

Data Error Check

MODBUS on TCP/IP Application Data Unit

The picture shows the encapsulation of a MODBUS request or response when it is carried on a MODBUS TCP/IP network.

PDU

MODBUS TCP/IP ADU

Header Function code

Data

With MODBUS on TCP the error check of TCP is used, so the error check of the general MODBUS frame is not used.


5-1

Transmission Protocol


5-1

5.2 Overview

General Information

The protocol Open MODBUS/TCP uses the standardized TCP/IP protocol to transfer data. The MODBUS specific data is created or verified by the FB. The function block complies “Conformance Class 0” of the MODBUS specification.

Client/Server With the FB MODB4H the PLC S7 with its CP can act as both client and server. Functionality multitasking of server according to the MODBUS reference is not supported.

The client sends a request telegram to the server. The server responds within the monitoring time. The server itself cannot initiate any data transmission. A communication from server to server is not possible.

Function Codes “Conformance Class 0” consists of the following codes:

• FC3: Read holding register

• FC16: Write holding register

The function block MODB4 comprises the following function code in addition to Conformance Class 0:

• FC4: Read input registers

Protocol Structure An Open MODBUS/TCP telegram starts with a header. This header is identical for request and response telegrams and consists of 6 bytes.

The 6 bytes of the header are defined as follows:

Byte 0 : Transaction Identifier Byte 1 : Transaction Identifier Byte 2 : Protocol Identifier = 0 Byte 3 : Protocol Identifier = 0 Byte 4 : Length Specifier, High Byte = 0 Byte 5 : Length Specifier, Low Byte

Followed by: Byte 6 : Unit Identification Byte 7 : MODBUS Function Code

Byte 8 : first byte of Telegram Data



5-2

Transaction Identifier

The server copies the Transaction Identifier TI from the request telegram to the response telegram according to the MODBUS specification.

With a TI changed cyclically it is possible to have a firm correlation of request and respond telegrams. The function block MODB4H increments TI with each request.

In the operating mode “CP is Client“ the received transaction identifier is compared to the one sent. If differences appear, the actual job is ended with an error. In the operating mode “CP is Server“ the received transaction identifier is copied to the response telegram.

Protocol Identifier The protocol identifier must always be 0. The FB sets the protocol identifier in the request telegram to 0. When a telegram is received, the protocol identifier is checked for the value 0. A value other than 0 creates an error message.

Length Field The length specifier in the length field defines the data length of the telegram without the Header (starting with byte 6). Thus the end of the telegram is determined. The following telegram lengths are allowed for request and response telegrams for read and write functions: Request Response

Read 6 3 or 5 to 253

Write 9 to 207 3 or 6

Unit Identifier The parameter UNIT identifies a remote slave connected on a serial line or on other buses. It is used for intra-system routing purposes. With MODBUS/TCP the parameter UNIT is copied from the request to the respond telegram. The Master verifies that the UNIT of the received telegram is identical to the one in the telegram sent. If there are differences between sent and received UNIT, the received telegram is discarded.

Function Code The function code describes the function of the telegram. The structure of the telegram data depends on the function code.

Interpretation of MODBUS Register Addresses

MODBUS bases its data model on a series of tables, which have distinguishing characteristics. The distinction between these memory areas is done via the register address by some systems, e.g. MODICON PLCs. So a MODBUS message requesting the read of a holding register at offset 0 would return the value known to the application programmer as found in register 40001 (memory type 4xxxx, reference 0001).

One potential source of confusion is the varying interpretation of the register address in different manuals. Sometimes the register address means the address of the application layer, sometimes the address transferred.

The FB MODB4H uses the register address transferred at its parameters START_x und START_ADDRESS. So it is possible to use register addresses from von 0000H to FFFFH with each function code.



5-3

5.3 Function Code 03 – Read Holding Registers

General Information

With the function code multiple holding registers can be read. The request telegram contains UNIT, the function code, the start address of the registers and the number of registers to be read.

The response telegram contains UNIT, the function code, the byte count for the following data as well as the contents of the registers that were read. In case of an error, the response can be an exception code telegram.

An open MODBUS/TCP specific header precedes the telegram structure that is shown below.

Request Telegram Byte 0: Unit Identifier Byte 1: Function Code = 03 Byte 2: Register Start Address, High Byte Byte 3: Register Start Address, Low order Byte Byte 4: Number of Registers, High Byte = 0 Byte 5: Number of Registers, Low Byte

Response Telegram

Byte 0: Unit Identifier Byte 1: Function Code = 03 Byte 2: Byte count Byte 3 to ( 2 * number of registers + 2 ): Register Values



5-4

5.4 Function Code 16 – Write Holding Register

General With function code 16 multiple holding registers can be written. The request telegram contains UNIT, the function code, the start address of the registers, the byte count and the values to be written. The response telegram contains UNIT, the function code, the start address of the registers and the number of registers written. In case of an error, the response can be an exception code telegram.

The open MODBUS/TCP specific header precedes the telegram structure shown below.

Request Telegram Byte 0: Unit Identification Byte 1: Function Code = 10H Byte 2: Register Start Address, High Byte Byte 3: Register Start Address, Low Byte Byte 4: Number of Registers, High Byte = 0 Byte 5: Number of Registers, Low Byte Byte 6: Byte Count Byte 7 to ( 2 * number of words + 6 ): Register values

Response Telegram

Byte 0: Unit Identification Byte 1: Function Code = 10H Byte 2: Register Start Address, High Byte Byte 3: Register Start Address, Low Byte Byte 4: Number of Registers, High Byte = 0 Byte 5: Number of Registers, Low Byte



5-5

5.5 Function Code 04 – Read Input Registers

General Information

With the function code multiple input registers can be read. The request telegram contains UNIT, the function code, the start address of the registers and the number of registers to be read.

The response telegram contains UNIT, the function code, the byte count for the following data as well as the contents of the registers that were read. In case of an error, the response can be an exception code telegram.

An open MODBUS/TCP specific header precedes the telegram structure that is shown below.

Request Telegram Byte 0: Unit Identifier Byte 1: Function Code = 04 Byte 2: Register Start Address, High Byte Byte 3: Register Start Address, Low order Byte Byte 4: Number of Registers, High Byte = 0 Byte 5: Number of Registers, Low Byte

Response Telegram

Byte 0: Unit Identifier Byte 1: Function Code = 04 Byte 2: Byte count Byte 3 to ( 2 * number of registers + 2 ): Register Values



5-6

5.6 Exception Code Telegram

General Information

For certain errors the server responds with an exception code telegram.

Telegram Structure

The exception code telegram contains UNIT, the function code in which Bit 27

is set and the exception code.

The open MODBUS/TCP specific header precedes the telegram structure shown below.

Byte 0: Unit Identification Byte 1: Function Code + 80H Byte 2: Exception Code

Exception Code

According to MODBUS

specification

Reason

01 Illegal Function Function code not defined

02 Illegal Data Address • FC16: Access to write protected area

• DB does not exist

• Not all the data are located in the same DB

• Number of registers is too high

5.7 Further Sources of Information

Please find further information on the Open MODBUS/TCP protocol in the document listed in appendix A.

Diagnostics


6-1

6 Diagnostics

Diagnostic Function

The diagnostic functions of the CP443 allow you fast failure localization. The following diagnostic features are available:

• Diagnostics via the display elements of the CP

• Diagnostics via the STATUS output of the MODB4H function block.

Display Elements (LED)

The display elements inform you about the operating mode or about the failure conditions of the CP. The display elements give you an overview of internal failures, external failures and interface specific failures.

STATUS Output of the MODBUS FB

For error diagnostics, the MODB4H function block has a STATUS output. By reading the STATUS output you get a general indication of failures that have occurred during the communication. The STATUS parameter can be evaluated in the users program.

6.1 Diagnostics via the Display Elements of the CP

Display Functions The display elements of the CP give you information on the module status. There are two types of display functions:

• Group Error Displays - INTF Internal failure - EXTF External failure

• Special Displays CP 443-1: - TXD A telegram is being sent via the interface. - RXD A telegram is being received via the interface.

A detailed description of the display elements can be found in the device manual of the CP.

Diagnostics


6-2

6.2 Verification by the FB MODB4/MODB4H

During start up • Parameter group DB_x, STAT_x, END_x. (x = 1 to 8)

1. With DB_x = 0 the register area is disabled and not verified further. At least one area for each holding and input register must be enabled.

2. Test END_x >= START_x

3. Register addresses that are defined in two DB_x lead to an error message (register overlap).

• Parameter CHECK_REG and CHECK_LEN depending on SO_TIME

o With SO_TIME > 0 the parameters CHECK_REG and CHECK_LEN are verified, whether they are defined in the DB areas.

• Evaluation of the monitoring time MONITOR and SO_TIME

• CP is Server: UNIT is within the allowed range of values.

• Configuring of default connection 0A

Errors during start up provoke the ERROR bit to remain set. In the cyclical operation no requests are executed. A correction of the parameterization and a STOP RUN transition of the CPU are necessary.

Cyclical Operation CP is Client

Verification when the FB is called:

• Range of values START_ADRESS

• Range of values LENGTH

• At the execution of a request, it is checked whether the data block that is specified by the register address is available and has the necessary length.

• Receipt of the response telegram within the monitoring time

The monitoring time can also elapse if less data than specified in the MODBUS telegram header is received. Subsequent failures with loss of telegrams can occur.

• The comletion of the previous job is checked, when a new job is started with ENQ_ENR = TRUE.

Verification in the response telegram:

• Received transaction identifier is equal to the sent one.

• Protocol identifier = 0

Diagnostics


6-3

• Length is between 3 and 253 Besides the length in the header of the response telegram is checked for plausibility regarding the request.

• UNIT sent is equal to the received one

• FC sent is equal to the received one

• Response is an Exception Code Telegram

• For read requests, the number of registers in the request telegram, length in the header and byte count in the telegram must match.

• For write requests it is verified that start address and number of registers match with the request telegram.

Cyclical Operation CP is Server

• Receipt of the second part of the request telegram within the monitoring time

• The monitoring time also can elapse if less data than specified in the MODBUS telegram header is received. Subsequent failures can occur with loss of telegrams.

• Checking whether the cyclical monitoring time SO_TIME has elapsed

• Protocol Identifier = 0

• Length between 6 and 207 Additional the length in the header of the response telegram is checked for plausibility regarding the telegram data.

• Received FC is verified. If the FC is not equal to 03 or 16 an exception telegram is sent.

• For write requests, the length in the header, the number of registers and the byte count in the telegram must match.

• The number of registers is verified. If the number is too large an exception telegram is sent.

• Access to write protected area: Send exception telegram

• At the execution of a request, it is checked whether the data block that is specified by the register address is present and has the necessary length. In case of an error an exception telegram is sent.

Diagnostics


6-4

Lost Synchronization

The lost synchronization described below can only occur when the communication partner has extreme malfunctions or there are serious interferences on the transmission line.

In order to read a MODB4H specific telegram header, the function block MODBUS starts an AG_RECV with 6 bytes length. With the length in the telegram header another AG_RECV is started. If the length in the telegram header is not equal to the actual number of bytes sent to the CP (which is a serious failure), the CP resolves this situation as follows:

1. More data as specified in the header is received: The next AG_RECV gets data that are not compliant with the MODBUS specific header. This leads to after effects like wrong TI or PI, data is interpreted as a length specification, the length used by FB/AG_RECV is wrong.

2. Less data as specified in the header is received: The activated AG_RECV returns no ready signal and the monitoring time MONITOR elapses. The activated AG_RECV has only received a part of the data, therefore it is still in the receiving state. This AG_RECV cannot be cancelled. More data has to be received in order to be synchronized again. In operating mode “CP is client“ the request of the FB MODB4H is cancelled with ERROR. Another FB request can be activated. The response data is received with the old AG_RECV. Receiving must continue until the expected amount of data has been received. Multiple requests, which all end with the status “monitoring time elapsed“, might be necessary to regain synchronization. In the operating mode “CP is server” the expected amount of data must be reached with request telegrams of the client. Multiple error messages “No response from server” might occur at the client. When the old AG_RECV ends, the FB reads a single byte in order to receive a possible telegram fragment from the CP. The reading is observed with the monitoring time MONITOR as well. When the monitoring time elapses it is assumed that the synchronization has been regained. The normal operation of the FB MODB4H is continued.

3. The announced amount of data does not match the request telegram (CP is client): The FB MODB4H receives the announced amount of data and ignores it. ERROR and STATUS return an error code.

The above mentioned function of the FB is necessary because neither the TCP/IP connection nor the activated AG_RECV can be cancelled.

Diagnostics


6-5

6.3 Diagnostic Messages of the FB MODB4H

Messages at the STATUS Output of the FB

The error messages are displayed at the status output of the FB MODB4H. STATUS is valid when ERROR is TRUE. Below you will find a list of FB specific error messages.

Error Messages of the called SFCs and FCs

The FBs MODB4 and MODB4H uses the standard functions SFC6, SFC24, FC40, FC50 and FC60. The error messages of these blocks are passed on to STATUS without any changes.

In the diagnostics buffer or in the online help of SIMATIC Manager you will find further details on these error messages, as well as in the SIMATIC STEP7 NCM S7 Industrial Ethernet Manual.

Error messages of FB MODB4H

STATUS (Hex)

Event text Remedy

A002 The parameter END_x is less than START_x. Correct the parameterization A003 The DB, to which MODBUS addresses shall be

mapped, is too short. Minimum length: ( END_x – START_x + 1 ) ∗ 2 Other possible reasons:

• Wrong initialization parameter (CP is client) • Wrong address area in the request telegram of

the client (CP is server)

Extend the DB. CP is Client: Correct the parameters START_ADDRESS or LENGTH CP is Server: Modify the request of the client.

A004 Applies only with CP is client: Both parameters INPUT_HOLDING and WRITE_READ are set. It is not possible to write input registers.

Correct the parameters.

A005 CP is client: An invalid value for the parameter LENGTH is given. CP is Server: The number of registers in the request telegram is invalid. Range of values: 1 to 125 for read, 1 to 100 for write.

CP is Client: Correct the parameter LENGTH. CP is Server: Modify the number of registers in the request telegram.

A006 The given range of registers does not exist in DB_1 to DB_8.

CP is Client: Correct the parameter’s combination START_ADDRESS, LENGTH. CP is Server: Modify the request of the client or correct the parameterization of DB_x.

A007 CP is client: An invalid monitoring time MONITOR is parameterized. Range of values: 1 to 999.

Correct the parameterization.

Diagnostics


6-6

Error messages FB MODB4H

STATUS (Hex)

Event text Remedy

A008 Monitoring time MONITOR elapsed when AG_RECV waits for receipt. E.g. connection is not established. Partner is not ready. As an after effect the loss of synchronization can occur, which leads to a loss of telegrams.

Verify error messages at the communication partner.

Check if the communication partner needs a special unit identifier.

A009 A Protocol Identifier not equal to 0 was received, or if CP is client: The received transaction identifier TI is not equal to the sent one. This error can also indicate an unsuccessful attempt for synchronization. This error may occur once, when CPU Restart is executed during data transfer. In that case the CP turns over “old” data to the CPU.

Verify the data of the communication partner with the help of a telegram trace. CP is server: Ensure that the parameterized monitoring time MONITOR is shorter than the monitoring time MONITOR of the client. This is necessary to remove corrupt data from the CP.

A00A CP is client: The received UNIT is not equal to the sent one.

Verify the data of the communication partner with the help of a telegram trace.

A00B CP is client: Received function code is not equal to the sent one. CP is server: An invalid Function Code was received.

CP is client: Verify the data of the communication partner with the help of a telegram trace. CP is Server : The FB MODB4H supports the function codes 03, 04 and 16.

A00C The received byte count does not match the number of registers.


A00D The register address in the response telegram is not equal to the one in the request telegram (only if CP is client).


A00E The length indicated in the MODBUS specific telegram header does not match the number of registers or the byte count in the telegram. The FB receives all data and ignores them. As an after effect a loss of synchronization might occur.


A00F CP is server Attempt to write on a write protected area.

Modify the request of the client or correct the parameterization.

A010 In the parameterized area DB_1 to DB_8 a DB number is used twice.


Diagnostics


6-7

Error messages the FB MODB4H

STATUS (Hex)

Event text Remedy

A01A Corrupt data or wrong length in header: Byte 4 of the prefix is not equal to 0


A01B An exception telegram with exception code 1 was received (only if CP is client)

The communication partner does not support the requested function.

A01C An exception telegram with exception code 2 was received (only if CP is client) An attempt to an invalid or non existing address at the communication partner was made.

Correct LENGTH or START_ADDRESS at the call of the FB.

A01D An exception telegram with an unknown exception code was received (only if CP is client).

Check the error message of the communication partner and verify the data with a telegram trace if needed.

A01E The CP has received invalid data which could not be assigned. The CP has lost synchronization and needs data from the communication partner to finish the active AG_RECV.

Check the error message of the communication partner and verify the data with a telegram trace if needed.

A012 The parameterized DB_1 and DB_2 overlap.




A023 The parameterized DB_2 and DB_3 overlap..







The data areas must not contain any overlapping register areas.





The data areas must not contain any overlapping register areas.

Diagnostics


6-8

Error messages the FB MODB4H

STATUS (Hex)

Event text Remedy

A080 The connection 0A is not initialized. Parameterize the default connection 0A.

A081 SO_TIME is parameterized, but the parameter CHECK_LEN is not set to a value from 1 to 125.


A082 The parameters CHECK_START and CHECK_LEN lead to a register area which is not parameterized in DB_x.

Correct the parameterization. The CHECK parameters have to be parameterized in the DB area.

A083 CP is client: A request was initiated prior to the completion of the previous one.

Wait with the initiation of a new request until the previous one was finished either with DONE/NDR = TRUE or ERROR = TRUE.

A084 An invalid SO_TIME is parameterized. Range of values is 1 to 999.


A085 The switch-over time (SO_TIME) elapsed for all configured connection. The reception of a telegram is monitored via all parameterized connections.

With next transferred data telegram SO_TIME is retriggered and the error code is deleted.

Diagnostics


6-9

6.4 Diagnostic Messages of included FCs/SFCs

Error messages of included FCs/SFCs

STATUS (Hex)

Event text Remedy

7xxx For detailed information please refer to the online help of SIMATIC Manager.

See online help (SIMATIC manager -> mark block -> key F1 –> Ethernet -> see also -> code evaluation )

8xxx For detailed information please refer to the online help of SIMATIC Manager.

See online help (SIMATIC manager -> mark block -> key F1 –> Ethernet -> see also -> code evaluation )

8186 ID parameter invalid This error code is also reported, when MODB4H is called with different instance DBs in OB1 and OB100.

Correct the parameterization. Use the ID of NetPro and work with only 1 instance DB.

6.5 Diagnostic Messages of SFC24

Error messages of SFC24

STATUS (Hex)

Event text Remedy

80A1 DB Number = 0 or too large for the CPU Choose a valid DB number.

80B1 The DB does not exist in the CPU. All data blocks that are specified in DB_x must be created and copied into the CPU.

80B2 DB UNLINKED DB must not be created as UNLINKED.

Application Sample

7 Application Sample MODB4H

General Information

The following simple programming example illustrates the use of FB MODB4H.

The S7 program is for information purposes only and is not to be understood as a solution for a customer specific installation configura-tion.

Example Project on the CD

On the CD you can find an extensive example project, which offers all varieties of parameterization possibilities for the Simatic stations.

• S7-H-Station is client or server

• Single-sided or double-sided redundancy

Simatic Stations in the Example Project

The example project consists of the following Simatic stations:

Block / Station Name Single-sided Double-sided Client Server

H Double-sided (Client) x x

H Double-sided (Server) x x

H Single-sided (Client) x x

H Single-sided (Server) x x


7-1

Application Sample


7-2

Programming Example

The programming example consists of the blocks: • Start-Up OB100 • Cyclic program processing OB1 with call of FB 1733 • Work-DB for job trigger e.g. with variable table • Data blocks for register values

Used Blocks The subsequent listed blocks are used in the printed programming example. This block numbers are also used in the provided example project for S7 stations with FB MODB4H.

Block Symbol Comment

OB 1 Cyclic program processing

OB 100 Start-Up OB for Re-Start

FB 1733 FB MODB4H

FB 1734 FB MODB4 for internal calls

DB 100 Instance-DB for FB MODB4H

DB 222 Work-DB CONTROL_DAT for FB MODB4H

DB 11 Register -DB for memory area 1





Application Sample


7-3

7.1 Programming Example CP is Client

Programming Example

The blocks are listed as follows:

Block Comment

OB 1 Cyclic Program Processing

OB 100 Start-Up OB for Re-start

DB 222 work-DB "CONTROL DAT" for FB MODB4H

Start-Up OB100 Start-Up-OB

Initialization of FB MODB4H

AUF "CONTROL_DAT" //DB 222

L 1 //from NETPRO T "CONTROL DAT".ID_0_A L 3 //from NETPRO T "CONTROL DAT".ID_1_A L 8183 //from HW-Config T "CONTROL DAT".LADDR_0 L 8182 //from HW-Config T "CONTROL DAT".LADDR_1 L 0 //no cyclical telegrams T "CONTROL DAT".SO_TIME L 11 //first memory area T "CONTROL DAT".DB_1 //Registernumber 1 to 500 L 1 T "CONTROL DAT".START_1 L 500 T "CONTROL DAT".END_1 L 12 //second memory area T "CONTROL DAT".DB_2 //Registernumber 501 to 600 L 501 T "CONTROL DAT".START_2 L 600 T "CONTROL DAT".END_2 L 13 //third memory area T "CONTROL DAT".DB_3 //Registernumber 601 to 700 L 601 T "CONTROL DAT".START_3 L 700 T "CONTROL DAT".END_3

Application Sample


7-4

L 0 //fourth memory area T "CONTROL DAT".DB_4 //not used T "CONTROL DAT".START_4 T "CONTROL DAT".END_4 L 0 //fifth memory area T "CONTROL DAT".DB_5 //not used T "CONTROL DAT".START_5 T "CONTROL DAT".END_5 L 16 //sixth memory area T "CONTROL DAT".DB_6 //Registernumber 1 to 500 L 1 T "CONTROL DAT".START_6 L 500 T "CONTROL DAT".END_6 L 17 //seventh memory area T "CONTROL DAT".DB_7 //Registernumber 1001 to 1100 L 1001 T "CONTROL DAT".START_7 L 1100 T "CONTROL DAT".END_7 L 0 //eighth memor area T "CONTROL DAT".DB_8 //not used T "CONTROL DAT".START_8 T "CONTROL DAT".END_8

CLR = "CONTROL DAT".SERVER_CLIENT //CP ist Client

L 0 //start modbus register for T "CONTROL DAT".CKECK_REG //cyclical telegrams L 1 //count of modbus registers for T "CONTROL DAT".CKECK_LEN //cyclical telegrams L 1 //Unit number for T "CONTROL DAT".CKECK_LEN //cyclical telegrams

CALL "MODB4H" , "MODB4H_DAT" ID_0_A :="CONTROL DAT".ID_0_A

ID_1_A :="CONTROL DAT".ID_1_A ID_0_B := ID_1_B := LADDR_0 :="CONTROL DAT".LADDR_0 LADDR_1 :="CONTROL DAT".LADDR_1 TIMER_NR_0A := TIMER_NR_1A := TIMER_NR_0B := TIMER_NR_1B := MONITOR := SO_TIMER :=T5 //nonattached timer SO_TIME :="CONTROL DAT".SO_TIME DB_1 :="CONTROL DAT".DB_1 START_1 :="CONTROL DAT".START_1 END_1 :="CONTROL DAT".END_1 DB_2 :="CONTROL DAT".DB_2 START_2 :="CONTROL DAT".START_2 END_2 :="CONTROL DAT".END_2

Application Sample


7-5

DB_3 :="CONTROL DAT".DB_3 START_3 :="CONTROL DAT".START_3 END_3 :="CONTROL DAT".END_3 DB_4 :="CONTROL DAT".DB_4 START_4 :="CONTROL DAT".START_4 END_4 :="CONTROL DAT".END_4 DB_5 :="CONTROL DAT".DB_5 START_5 :="CONTROL DAT".START_5 END_5 :="CONTROL DAT".END_5 DB_6 :="CONTROL DAT".DB_6 START_6 :="CONTROL DAT".START_6 END_6 :="CONTROL DAT".END_6 DB_7 :="CONTROL DAT".DB_7 START_7 :="CONTROL DAT".START_7 END_7 :="CONTROL DAT".END_7 DB_8 :="CONTROL DAT".DB_8 START_8 :="CONTROL DAT".START_8 END_8 :="CONTROL DAT".END_8 WRITE_PROTECT1 := WRITE_PROTECT2 := WRITE_PROTECT3 := WRITE_PROTECT4 := WRITE_PROTECT5 := ENQ_ENR := SERVER_CLIENT :="CONTROL DAT".SERVER_CLIENT CHECK_REG := "CONTROL DAT".CHECK_REG CHECK_LEN := "CONTROL DAT".CHECK_LEN CHECK_UNIT := "CONTROL DAT".CHECK_UNIT FREE_CODE_0 := FREE_CODE_1 := LICENSED := CP1_ACTIVE := C_B_ACTIVE := DONE_NDR := ERROR :="CONTROL DAT".ERROR STATUS :="CONTROL DAT".STATUS CODE_0 := CODE_1 := START_ADDRESS := LENGTH := WRITE_READ := INPUT_HOLDING := UNIT :=

Application Sample


7-6

Cyclic Program OB1 Cyclic-OB OPN "CONTROL DAT" CALL "MODB4H" , "MODB4H_DAT" ID_0_A :=

ID_1_A := ID_0_B := ID_1_B := LADDR_0 := LADDR_1 := TIMER_NR_0A :=T1 //nonattached Timer TIMER_NR_1A :=T2 //nonattached Timer TIMER_NR_0B := TIMER_NR_1B := MONITOR :=”CONTROL DAT".MONITOR SO_TIMER := SO_TIME := DB_1 := START_1 := END_1 := DB_2 := START_2 := END_2 := DB_3 := START_3 := END_3 := DB_4 := START_4 := END_4 := DB_5 := START_5 := END_5 := DB_6 := START_6 := END_6 := DB_7 := START_7 := END_7 := DB_8 := START_8 := END_8 := WRITE_PROTECT1 := WRITE_PROTECT2 := WRITE_PROTECT3 := WRITE_PROTECT4 := WRITE_PROTECT5 := ENQ_ENR :="CONTROL DAT".ENQ_ENR SERVER_CLIENT := CHECK_REG := CHECK_LEN := CHECK_UNIT := FREE_CODE_0 := FREE_CODE_1 := LICENSED := CP1_ACTIVE := "CONTROL DAT".CP1_ACTIVE C_B_ACTIVE := "CONTROL DAT".C_B_ACTIVE

Application Sample


7-7

DONE_NDR :="CONTROL DAT".DONE_NDR ERROR :="CONTROL DAT".ERROR STATUS :="CONTROL DAT".STATUS

CODE_0 := CODE_1 :=

START_ADDRESS :="CONTROL DAT".START_ADDRESS LENGTH :="CONTROL DAT".LENGTH WRITE_READ :="CONTROL DAT".WRITE_READ INPUT_HOLDING :="CONTROL DAT".INPUT_HOLDING

UNIT :="CONTROL DAT".UNIT A "CONTROL DAT".ENQ_ENR R "CONTROL DAT".ENQ_ENR //reset trigger A "CONTROL DAT".DONE_NDR //job finished without error FP #EDGE JC TRIG //trigger new job A "CONTROL DAT".ERROR //job finished with error //put your error handling here BEU //wait until job finished TRIG: SET = "CONTROL DAT".ENQ_ENR //trigger //initialize values for a //new job here

Application Sample


7-8

7.2 Programming Example CP is Server

Programming Example

The blocks are listed as follows:

Block Comment

OB 1 Cyclic Program Processing

OB 100 Start-Up OB for Re-start

DB 222 work-DB "CONTROL DAT" for FB MODB4H

Start-Up OB100 Start-Up-OB

Initialization of FB MODB4H

OPN "CONTROL DAT" //DB 222

L 1 //from NETPRO connection table T "CONTROL DAT". ID_0_A L 3 //from NETPRO connection table T "CONTROL DAT". ID_1_A L 8183 //from HW Config T "CONTROL DAT".LADDR L 8182 //from HW Config T "CONTROL DAT".LADDR L 0 //no cyclical telegrams T "CONTROL DAT".SO_TIME L 11 //first memory area T "CONTROL DAT".DB_1 //Register 1 to 500 L 1 T "CONTROL DAT".START_1 L 500 T "CONTROL DAT".END_1 L 12 //second memory area T "CONTROL DAT".DB_2 //Register 501 to 600 L 501 T "CONTROL DAT".START_2 L 600 T "CONTROL DAT".END_2 L 13 //third memory area T "CONTROL DAT".DB_3 //Register 601 to 700 L 601 T "CONTROL DAT".START_3 L 700 T "CONTROL DAT".END_3

Application Sample


7-9

L 0 //fourth memory area T "CONTROL DAT".DB_4 //not used T "CONTROL DAT".START_4 T "CONTROL DAT".END_4 L 0 //fifth memory area T "CONTROL DAT".DB_5 //not used T "CONTROL DAT".START_5 T "CONTROL DAT".END_5 L 16 //sixth memory area T "CONTROL DAT".DB_6 //Registernumber 1 to 500 L 1 T "CONTROL DAT".START_6 L 500 T "CONTROL DAT".END_6 L 17 //seventh memory area T "CONTROL DAT".DB_7 //Registernumber 1001 to 1100 L 1001 T "CONTROL DAT".START_7 L 1100 T "CONTROL DAT".END_7 L 0 //eighth memory area T "CONTROL DAT".DB_8 //not used T "CONTROL DAT".START_8 T "CONTROL DAT".END_8

CLR WRITE_PROTECT1 :=FALSE WRITE_PROTECT2 :=FALSE WRITE_PROTECT3 :=FALSE WRITE_PROTECT4 :=FALSE WRITE_PROTECT5 :=FALSE SET = "CONTROL DAT".SERVER_CLIENT //CP is server CALL "MODB4H" , "MODB4H_DAT"

ID_0_A :="CONTROL DAT".ID_0_A ID_1_A :="CONTROL DAT".ID_1_A ID_0_B := ID_1_B := LADDR_0 :="CONTROL DAT".LADDR_0 LADDR_1 :="CONTROL DAT".LADDR_1 TIMER_NR_0A := TIMER_NR_1A := TIMER_NR_0B := TIMER_NR_1B := MONITOR := SO_TIMER :=T5 SO_TIME :="CONTROL DAT".SO_TIME DB_1 :="CONTROL DAT".DB_1 START_1 :="CONTROL DAT".START_1 END_1 :="CONTROL DAT".END_1 DB_2 :="CONTROL DAT".DB_2 START_2 :="CONTROL DAT".START_2 END_2 :="CONTROL DAT".END_2

Application Sample


7-10

DB_3 :="CONTROL DAT".DB_3 START_3 :="CONTROL DAT".START_3 END_3 :="CONTROL DAT".END_3 DB_4 :="CONTROL DAT".DB_4 START_4 :="CONTROL DAT".START_4 END_4 :="CONTROL DAT".END_4 DB_5 :="CONTROL DAT".DB_5 START_5 :="CONTROL DAT".START_5 END_5 :="CONTROL DAT".END_5 DB_6 :="CONTROL DAT".DB_6 START_6 :="CONTROL DAT".START_6 END_6 :="CONTROL DAT".END_6 DB_7 :="CONTROL DAT".DB_7 START_7 :="CONTROL DAT".START_7 END_7 :="CONTROL DAT".END_7 DB_8 :="CONTROL DAT".DB_8 START_8 :="CONTROL DAT".START_8 END_8 :="CONTROL DAT".END_8 WRITE_PROTECT1 :=“CONTROL DAT".WRITE_PROTECT1 WRITE_PROTECT2 :=“CONTROL DAT".WRITE_PROTECT2 WRITE_PROTECT3 :=“CONTROL DAT".WRITE_PROTECT3 WRITE_PROTECT4 :=“CONTROL DAT".WRITE_PROTECT4 WRITE_PROTECT5 :=“CONTROL DAT".WRITE_PROTECT5 ENQ_ENR := SERVER_CLIENT :="CONTROL DAT".SERVER_CLIENT CHECK_REG := CHECK_LEN := CHECK_UNIT := FREE_CODE_0 := FREE_CODE_1 := LICENSED := CP1_ACTIVE := C_B_ACTIVE := DONE_NDR := ERROR :="CONTROL DAT".ERROR STATUS :="CONTROL DAT".STATUS CODE_0 := CODE_1 := START_ADDRESS := LENGTH := WRITE_READ := INPUT_HOLDING := UNIT :=

A "CONTROL DAT".ERROR //INIT completed with error JC ERR //cyclic operation doesn’t

//make sense SET //INIT completed without = "CONTROL DAT".ENQ_ENR //enable data transfer BEU ERR: //put your error handling here

Application Sample


7-11

Cyclic Program OB1 Cyclic-OB OPN "CONTROL DAT" CALL "MODB4H" , "MODB4H_DAT" ID_0_A :=

ID_1_A := ID_0_B := ID_1_B := LADDR_0 := LADDR_1 := TIMER_NR_0A :=T1 //nonattached Timer TIMER_NR_1A :=T2 //nonattached Timer TIMER_NR_0B := TIMER_NR_1B := MONITOR :=”CONTROL DAT".MONITOR SO_TIMER := SO_TIME := DB_1 := START_1 := END_1 := DB_2 := START_2 := END_2 := DB_3 := START_3 := END_3 := DB_4 := START_4 := END_4 := DB_5 := START_5 := END_5 := DB_6 := START_6 := END_6 := DB_7 := START_7 := END_7 := DB_8 := START_8 := END_8 := WRITE_PROTECT1 := WRITE_PROTECT2 := WRITE_PROTECT3 := WRITE_PROTECT4 := WRITE_PROTECT5 := ENQ_ENR :="CONTROL DAT".ENQ_ENR SERVER_CLIENT := CHECK_REG := CHECK_LEN := CHECK_UNIT := FREE_CODE_0 := FREE_CODE_1 := LICENSED := CP1_ACTIVE := "CONTROL DAT".CP1_ACTIVE C_B_ACTIVE := "CONTROL DAT".C_B_ACTIVE

Application Sample


7-12

DONE_NDR :="CONTROL DAT".DONE_NDR ERROR :="CONTROL DAT".ERROR STATUS :="CONTROL DAT".STATUS CODE_0 := CODE_1 :=

START_ADDRESS :="CONTROL DAT".START_ADDRESS LENGTH :="CONTROL DAT".LENGTH WRITE_READ :="CONTROL DAT".WRITE_READ INPUT_HOLDING :="CONTROL DAT".INPUT_HOLDING

UNIT :="CONTROL DAT".UNIT

OPEN MODBUS / TCP Redundant communication via CP443-1 in H-systems 2XV9450-1MB01; Manual edition 1.0

A Literature

Schneider Electric OPEN MODBUS/TCP SPECIFICATION Release 1.0, 29 March 1999

Andy Swales Schneider Electric

MODBUS http://www.modbus.org


Glossary

A

Address The address identifies a physical storage location. If the address is known, the operand stored there can be directly accessed.

Automation System An automation system is a programmable logic controller that contains at least a CPU, different input and output devices as well as HMI devices.

B

Baud Rate - > transmission rate

Block Call A block call occurs when program processing branches to the called block

Block Parameter Block parameters are variables within multiple-use blocks, which are replaced with actual values when the relevant block is called.

Blocks Blocks are elements of the user program which are defined by their function, structure, or purpose. With STEP7 there are

• Code blocks (FB, FC, OB, SFB, SFC)

• Data blocks (DB, SDB)

• User-defined data types (UDT)

Bus Segment Part of a -> subnet. Subnets can consist of bus segments and connectivity devices such as repeaters and bridges. Segments are transparent for addressing.

C

Client A client is a device or, in general terms, an object that requests a service from a -> server.

Communications Processor Communications processors are modules for point-to-point connections and bus connections.

Configuration The configuration is the set up of individual modules of the PLC in the configuration table.

Connection Parameterization The specification of a connection ID in the system function block. With the help of a connection ID the system function blocks can communicate between two communication points.

CP Communications Processor. Module for communications tasks.


CPU Central processing unit of the S7 programmable logic controller with control and arithmetic unit, memory, operating system, and interfaces to I/O modules.

CRC Cyclic Redundancy-Check = Checksum which guarantees a high probability of error recognition.

Cycle Time The cycle time is the time the CPU needs to execute the user program once.

Cyclic Program Processing In cyclic program processing, the user program is executed in a constantly repeating program loop, called a cycle.

D

Data Block (DB) These are blocks containing data and parameters with which the user program works. Unlike all other blocks, data blocks do not contain instructions. They are subdivided into global data blocks and instance data blocks. The data held in the data blocks can be accessed absolutely or symbolically. Complex data can be stored in structured form.

Data Type Data types allow users to define how the value of a variable or constant is to be used in the user program. They are classified into elementary and structured data types.

Default Setting The default setting is a basic setting which is always used if no other value is specified.

Diagnostic Buffer Every CPU has a diagnostic buffer, in which detailed information on diagnostic events are stored in the order in which they occur.

Diagnostic Event Diagnostic events are, for example, errors on a module or system errors in the CPU, which are caused by, say, a program error or by operating mode transitions.

Diagnostic Functions The diagnostics functions cover the entire system diagnosis and include detection, analysis and reporting of errors within the automation system.

Download Downloading means loading objects (e.g. code blocks) from the programming device into the load memory of the CPU.

F

Function Block (FB) Function blocks are components of the user program and, in accordance with the IEC standard, are ”blocks with memory”. The memory for the function block is an assigned data block, a so called ”instance data block”. Function blocks can be parameterized but can also be used without parameters.

H

Hardware Hardware is the term given to all the physical and technical equipment of a PLC.


I

Industrial Ethernet A LAN system complying with IEEE 802.3 (ISO 8802-2)

Instance Data Block An instance data block is a block assigned to a function block and contains data for this special function block.

Interface Module On the interface module the physical conversion of signals takes place. By exchanging the pluggable interface module you can adapt the communications processor to the physical interface of the communications partner.

Interrupt Interrupt is a name for a break of the program processing in the processor of an automation system by an external alarm.

M

MAC-Address Address to distinguish between different stations connected to a common transmission medium (Industrial Ethernet).

Media Access Control (MAC) Mechanisms for controlling access by a station to a common transmission medium shared with other stations.

Module Modules are pluggable printed circuit boards for programmable logic controllers

Module Parameters Module parameters are used to set the module behaviors. A distinction is made between static and dynamic module parameters.

N

NCM S7 for Industrial Ethernet

Configuration software for configuration and diagnostic functions on an Ethernet CP.

O

Online / Offline Online means that a data connection exists between PLC and programming device. Offline means that no such data connection exists.

Online Help STEP7 allows you to display contextual help texts on the screen while working with the programming software.

Operand An operand is part of a STEP7 instruction and states with what the processor is to do something. It can be both absolutely and symbolically addressed.

Operating Mode The SIMATIC S7 programmable controllers have three different operating modes: STOP, START UP and RUN. The functionality of the CPUs varies in the individual operating modes.

Operating System of the CPU

The operating system of the CPU organizes all functions and operations of the CPU which are not connected to a specific control task.


P

Parameter Parameters are values that can be assigned. A distinction is made between block parameters and module parameters.

Parameterization Parameterization means setting the behavior of a module.

Procedure The execution of a data interchange operation according to a specific protocol is called a procedure.

Process image This is a special memory area in the PLC. At the beginning of the cyclic program, the signal states of the input modules are transferred to the process image input table. At the end of the cyclic program, the process image of the outputs is transferred to the output modules as output signals.

Protocol The communications partners involved in a data interchange must abide by fixed rules for handling and implementing the data traffic. These rules are called protocols.

R

Rack A rack is a rail containing slots for mounting modules.

S

Server A server is a device, or in general terms, an object that provides certain services. A service is started at the instigation of a -> client.

Software Software is the term given to all programs used on a computer system. These include the operating system and the user programs.

START UP The operating mode START UP is active when the CPU transits from operating mode STOP to operating mode RUN.

STEP7 STEP7 is the programming software of SIMATIC S7.

Subnet A subnet is part of a -> network whose parameters must be matched. The subnet includes bus components and all the attached stations. Subnets can, for example, be connected together by -> gateways to form a network. A system consists of several subnets with unique subnet numbers. A subnet consists of several stations with unique -> MAC addresses.

System Block System blocks differ from the other blocks in that they are already integrated into the S7-400 system and are available for already defined system functions. They are classified into system data blocks, system functions, and system function blocks.

System Function (SFC) System functions are software modules without memory which are already integrated into the operating system of the S7-CPU and can be called by the user as required.

System Function Block (SFB) System function blocks are software modules with memory which are already integrated into the operating system of the S7-CPU and can be called up by the user as required.


T

Tool A tool is a piece of software that is capable of accessing operating system functions in a programming device.

Transmission Rate According to DIN 44302, this is the number of binary decisions transmitted per time unit. The unit is bps. he set or selected transmission rate depends on various conditions, for example the distance across

U

Upload Uploading means loading objects (e.g. code blocks) from the load memory of the CPU into the programming device.

User Program The user program contains all instructions and declarations for signal processing, by means of which a system or a process can be controlled. The user program for SIMATIC S7 is structured and is divided into smaller units called blocks.

V

Variable A variable is an operand (e.g. E 1.0) which can have a symbolic name and can therefore also be addressed symbolically.

W

Work Memory The work memory is a RAM on the CPU which the processor accesses while processing the user program.

open modbus tcp for ncm cp redundant english

Documents

severe personal

0xe0 fw v2

holding register

overlapping

transaction

operating

show properties

current active