Open Modbus TCP For NCM - CP Redundant English

SIMATIC OPEN MODBUS / TCP Redundant Communication via CP443-1 in H-Systems
Manual
Preface, Table of Contents Product Description Mounting
1 2 3 4 5 6
SIMATIC S7
Commissioning
OPEN MODBUS / TCP Redundant Communication via CP443-1 in HSystems

Manual
FB MODB4H Diagnostics Application Sample Appendices Literature Glossary
Edition 1.1
Safety Precautions and Warnings
This manual contains warnings, which you should note for your own safety as well as for the prevention of damage to property. These warnings are indicated by means of a triangle and displayed as follows in accordance with the level of danger: __________________________________________________________________
Danger indicates that loss of life, severe personal injury or substantial damage will result if proper precautions are not taken.
__________________________________________________________________ __________________________________________________________________
Warning indicates that loss of life, severe personal injury or substantial damage can result if proper precautions are not taken.
__________________________________________________________________ __________________________________________________________________
Caution indicates that minor personal injury or property damage can result if proper precautions are not taken.
__________________________________________________________________ __________________________________________________________________
Notes call attention to information that is especially significant to the product, handling of the product or a specific part of this documentation.
__________________________________________________________________
Qualified Personnel The equipment may be commissioned and put into operation by qualified personnel only. For the purpose of safety relevant warnings of this manual a qualified person is one who is authorized to commission, ground and tag devices, systems and circuits. Please note the following: _________________________________________________________________________ Warning This equipment must only be used in applications as prescribed in the catalogue and the technical description and in conjunction with equipment and components recommended and authorized by Siemens. Successful and safe operation of this equipment is dependent upon proper transport, and storage, erection and installation as well as careful operation and maintenance.
Use as prescribed
SIMATIC and SIMATIC NET are registered trademarks of SIEMENS AG. Trademarks The other brand names in this manual may be trademarks use of which by third parties for their purposes may infringe the proprietors rights.
Copyright Siemens AG 2004-2008 All Rights Reserved

The reproduction, transmission or use of this document or its contents is not permitted without express written authority. Offenders will be liable for damages. All rights, including rights created by patent grant or registration of a utility model or design, are reserved. Siemens AG Industrial Solution and Services IT4Industry P.O. Box 3240, D- 91050 Erlangen [email protected]
Exclusion from Liability

We have checked the contents of this document with regard to conformity to the described hardware and software. Deviations, however, cannot be excluded; therefore we cannot accept prejudice for its complete conformity. The information in this document is checked regularly and necessary corrections are contained in subsequent issues. Any suggestions for improvement are gratefully received. We reserve the right to make technical changes.
Preface
Preface
Purpose of the Manual The information in this manual alows you to set up and put in operation the connection between the CP 443-1 in an S7 redundant system and a device that supports the Open MODBUS/TCP protocol. This manual describes the function of the Modbus function block and their integration into the hardware and software of the communication processors CP 443-1. The manual contains the following topics: Production description / Mounting Commissioning / Installation / Parameterization Function block Diagnostics Application sample Scope of this Manual This manual is valid for the following software: Product OPEN MODBUS / TCP Redundant FB 1733 MODB4H FB 1734 MODB4 Identification number 2XV9 450-1MB01 From version 1.1 1.1 1.3
Contents of the Manual
Note This manual contains the FB description, as it is valid at the time of publication.
How to Access the Information in this Manual
To enable you a quick access to selected information, the manual provides the following access aids: The next pages contain a complete table of contents.
OPEN MODBUS / TCP Redundant Communication via CP443-1 in H-Systems 2XV9450-1MB01; Manual edition 1.1
Preface
Additional Sources of Information
All additional information concerning CP 443 (mounting, commissioning etc.) can be found in the manual SIEMENS SIMATIC Hochverfgbare Systeme S7-400H Systemhandbuch A5E00267693-03 SIEMENS SIMATIC NET S7-CPs for Industrial Ethernet device manual C79000-G8900-C155 SIEMENS SIMATIC NET S7-CPs for Industrial Ethernet device manual part B4 CP 443-1 C79000-G8900-C152 SIEMENS SIMATIC NET NCM S7 for Industrial Ethernet manual C79000-G8900-C129 Additional information concerning STEP7 can be found in the following manuals: SIEMENS SIMATIC Software Base software for S7 and M7 STEP7 user manual C79000-G7000-C502-.. SIEMENS SIMATIC Software System software for S7-300/400 System and standard functions Reference manual C79000-G7000-C503-02
Additional Questions
If you have further questions regarding the use of the FBs described in this manual, which are not answered in this document, please contact your Siemens partner who supplied you with this function block. This document uses the term CP or CP 443. The descriptions only apply to communications processor CP 443-1. The function block described in this manual establishes a connection between the CP 443-1 and third party MODBUS devices.
Terminology
Scope of Application
Table of contents
Table of Contents
1 ...... Product Description....................................................................................................... 1-1 1.1 ........ Field of Applications.......................................................................................... 1-1 1.2 ........ Hardware and Software Prerequisites.............................................................. 1-2 2 ...... Mounting ......................................................................................................................... 2-1 3 ...... Commissioning .............................................................................................................. 3-1 3.1 ........ Installing the Library on the STEP7 PG/-PC .................................................... 3-1 3.2 ........ Configuration of the Communication Link ........................................................ 3-2 3.3 ........ Parameterization of the CP .............................................................................. 3-3 3.4 ........ Network Configuration ...................................................................................... 3-5 3.5 ........ Insertion of the Function Blocks into the Program.......................................... 3-10 3.6 ........ Start_up Characteristics of CP443 ................................................................. 3-11 3.7 ........ Renaming of Standard Functions ................................................................... 3-12 4 ...... Function Block MODB4H for Redundancy.................................................................. 4-1 4.1 ........ Configuration of the Redundant Communication ............................................. 4-2 4.2 ........ Functionality of the FB ...................................................................................... 4-5 4.3 ........ Connection Monitoring Using Cyclic Telegrams .............................................. 4-8 4.4 ........ Parameters of the Function Block MODB4H.................................................... 4-9 4.5 ........ Example for Address Mapping ....................................................................... 4-18 4.6 ........ Data and Standard Function used by the FB ................................................. 4-20 5 ...... Diagnostics..................................................................................................................... 5-1 5.1 ........ Diagnostics via the Display Elements of the CP .............................................. 5-1 5.2 ........ Verification by the FB MODB4/MODB4H ......................................................... 5-2 5.3 ........ Diagnostic Messages of the FB MODB4H ....................................................... 5-5 5.4 ........ Diagnostic Messages of included FCs/SFCs ................................................... 5-9 5.5 ........ Diagnostic Messages of SFC24 ....................................................................... 5-9
Table of contents
6 ...... Application Sample MODB4H ....................................................................................... 6-1 6.1 ........ Programming Example CP is Client ................................................................. 6-3 6.2 ........ Programming Example CP is Server................................................................ 6-8 A ...... Literature............................................................................................................................ 1
ii
Product description
Product Description
1.1
Field of Applications
The driver described here is a software product for the Communications Processor CP443-1 in a SIMATIC S7 redundant system. CP 443-1 can be used in the SIMATIC S7-400 automation systems and can establish communication links to partner systems.
Placement in the System Environment
Function of the FBs
These function blocks enable a communication link between CP 443-1 and a device that supports the Open MODBUS/TCP protocol. Thereby function codes 3, 4 and 16 are applied. All other function codes are not implemented in this function block. Data transmission is carried out following the Client-Server principle. The SIMATIC S7 can act as both client and server during the data transmission. Redundant communication is supported. In operating mode server the functionality multitasking according to the MODBUS reference is not implemented.
TCP/IP with CP443-1
TCP/IP with CP443-1 uses static connections. The TCP connection is not disconnected during operation. Network configuration of STEP7 enables only a unique use of a specific port number, when using TCP native stack of the CP. Therefore the CP/FB is not capable to be addressed from different devices by the same port number.
1-1
Product description
1.2
Hardware and Software Prerequisites

The function block is released for following CP443-1: 6GK7 443-1EX10-0XE0 FW V2.6 6GK7 443-1EX11-0XE0 FW V2.6 6GK7 443-1EX20-0XE0 FW V2.0 6GK7 443-1GX20-0XE0 FW V2.0. The usage of the FB MODB4H is possible with STEP7 Version 5.1 or higher with the option NCM S7 for Industrial Ethernet. From version 5.3 of STEP 7 the option NCM is part of the main package of STEP 7.
Usable Modules for MODB4H
Software Versions
Memory requirements
The FB MODB4H requires 8452 byte work memory and 10260 byte load memory.
1-2
Mounting
Mounting
You can find all information regarding S7 400H installation options in the manual SIMATIC Fault-tolerant Systems S7-400H, chapter 3.
Information
2-1
Commissioning
Commissioning
The configuration of the CP 443-1 is possible via MPI or LAN/Industrial Ethernet. Required software is STEP7 with NCM S7 for Industrial Ethernet (shortly named NCM IE). All statements in the following sections referring to STEP7 or NCM IE are related to the STEP7-Version 5.4 SP3 and NCM S7 Industrial Ethernet Version 5.4 Operation flows, names and directory names might be different in other STEP7 versions.
General Information
Requirements
Knowledge of AWL and basic knowledge of STEP7 and PLC.
3.1
Installing the Library on the STEP7 PG/-PC

The attached CD contains a setup, which installs the library MODBUS_TCP_CP_Redundant, the example projects and the manuals in English and German in the corresponding STEP7 directories. The manuals are available outside the setup additionally, to give you the opportunity to get all information regarding the software without installation.
What We Provide You
Requirements
To install, STEP7 must be installed. With older STEP7 versions the option NCM S7 for Industrial Ethernet is necessary additionally. Insert your Modbus CD into the CD-ROM drive and follow step-by-step the instructions that are automatically displayed by the installation program. If the installation program fails to automatically run, perform these steps: 1. Using Windows Explorer, navigate to the CD-ROM drive and go to the directory setup and double-click Setup.EXE file to start the installation procedure. 2. Follow step-by-step the instructions that are displayed by the installation program. Now you can find the library in the manual in \Program Files\Siemens\Step7\S7libs, \Program Files\Siemens\Step7\S7manual\S7Comm. the example project in \Program Files\Siemens\Step7\Examples,
Installation
To access the Modbus library the first time, use the browse function of the open dialog for libraries. The manual can be accessed via short cut in \Program Files \Siemens \Documentation as well.
3-1
Commissioning
3.2
Configuration of the Communication Link

The configuration of the communication link consists of the order of the hardware in the configuration table using HW Config. You do the configuration using STEP7 software. For an Industrial Ethernet link, the SIMATIC 400H-Station, the communication partner and the Industrial Ethernet-network must be configured.
Introduction
S7 Project
Before you can do the configuration, you must have created a new S7 Project on STEP7. Insert the necessary project components with SIMATIC-Manager into the opened project: SIMATIC H-Station, Other Station, Industrial Ethernet network. Before each insertion, click on the opened project to select it.
Project Components
SIMATIC 400H-Station Insert Station SIMATIC 400H-Station for your S7-Program (Rack, PS, HCPU, CP443-1...), Insert Station Other Station for the communication partner, Insert Subnet Industrial Ethernet for an Industrial Ethernet network between the SIMATIC 400H-Station and the communication partner. Configure Hardware The configuration of the hardware includes the selection of the hardware components and its characteristics. SIMATIC 400H-Station By selecting the SIMATIC-Station and double clicking on Hardware (or Edit Open object) HW Configuration is started. With Insert Hardware components insert 2 RACKs, 2 PSes, 2 CPUs and 2 CP Industrial Ethernet CPs 443-1 with the appropriate order numbers. The procedures for configuring S7 devices are described in detail in the user manual of STEP7.
3-2
Commissioning
3.3
Parameterization of the CP
After the devices are arranged on your rack with HW Config they have to be parameterized. The parameterization window of the CP 443-1 can be started in HW Config by double clicking the CP or selecting the CP and clicking the menu item Edit Object properties. Properties CP443-1 General Click on tab General, then select Properties (single click). This will open the Ethernet interface window. Here you can enter the IP Address and the Subnet Mask of the CP. If you have your stations connected with each other without a router, then they have to be within the same subnet. In the field Subnet connect the CP with the Industrial Ethernet. In order to do that, select the entry with the name of your network. For newly created networks this is normally Ethernet(1).
Parameterization of the CP
After the successful parameterization you will be back in the dialog box, Properties CP443-1. Here click on OK to finish the parameterization of the CP and you will be back in the dialog box HW Config. Save and Compile the parameterization and close HW Config. You will be back in the main menu of the STEP7 project.
3-3
Commissioning
Parameterization of the Communication Partner
In the mode CP is client an other station is required for network configuration. After you have inserted the communication partners station into your STEP7 project (as described in Project components: Insert Other station) you have to specify the object properties of the external station. Starting from the STEP7 project, you can select the communication partner (Other station) by clicking it. Select the menu item Edit Object Properties. This opens the dialog box Properties Other Station. 1) Properties Other Station Interfaces On the tab Interfaces click on New. In the upcoming selection, select Industrial Ethernet and click on OK.
This opens a dialog box Properties Ethernet Interface. Enter an IP Address that is in the same subnet as the communication partners station. The subnet mask should be the same as the one of the partners station. Select the associated subnet that connects the CP interface with the communication partners interface.
Click on the OK button. This will bring you back to the tab Interfaces. OPEN MODBUS / TCP Redundant Communication via CP443-1 in H-Systems 2XV9450-1MB01; Manual edition 1.1 3-4
Commissioning
2) Properties Other StationGeneral In tab General you do not have to make any settings. Click on the OK button and you will be back in the main menu of the STEP7 project. An external station can have multiple interfaces (= Ethernet devices) and may be connected to different Ethernet networks.
3.4
Network Configuration
The CP is the link for the Industrial Ethernet connection between the S7-CPU and the communication partner / bus. A connection configuration must be made for the connection of the interfaces to the communication partner / bus. In the STEP7 project, select the CPU in your S7400H-Station and open Network configuration by double clicking Connections. This opens the program NetPro with which your connections can be configured.
Communications Connection
Configure Network in mode CP is Client
3-5
Commissioning
After selecting Insert New Connection... the dialog box Insert new connection will come up.
Select the connection partner (Other Station) for the new connection and use TCP Connection for the connection. Put a check mark on Show properties dialog.
Click OK. This will take you back to the dialog box Properties TCP connection.
3-6
Commissioning
Object Properties of the Connection
An ID is provided. You can change the ID if needed. Click on the button Routing and the configured connection will be shown. The MODBUS client normally does Active connection establishment.
In the register Addresses the port numbers are defined.
Click on OK and the inputs are accepted. Save the network configuration and close the program NetPro. Please note that the connection ID (Local ID) has to be used when the FB is called in the user program. Selection of the Port Number In a MODBUS communication a MODBUS server are normally addressed via port 502, whereas a MODBUS client uses a port different to 502.
3-7
Commissioning
Unspecified Connection with CP is server
If you have got a communication with CP as MODBUS server, and you did not know the port number of the client, the communication can be set up as unspecified connection. But the client has to meet the requirement of active connection establishment. You do not need an other station in your S7-project in that case. After selecting Insert New Connection... the dialog box Insert new connection will come up.
Select here unspecified instead of the communication partner and use TCP Connection for the connection. Put a check mark on Show properties dialog
3-8
Commissioning
Click OK. This will take you back to the dialog box Properties TCP connection. The check box active connection establishment must not be activated.
In the register addresses all information regarding the partner, IP and PORT are left blank.
Click on OK and the inputs are accepted.
3-9
Commissioning
3.5
Insertion of the Function Blocks into the Program

The Modbus library contains the folder S7400H System with the FBs for the redundant communication. This folder contains the function blocks FB1733 (MODB4H) and FB1734 (MODB4). Both blocks are required for redundant communication. The function block MODB4H executes a multiple call of MODB4. The function blocks execute the function codes FC3, 4 and 16.
Content of MODBUS library
Insertion of the MODB4H FB
In order to exchange data with MODBUS devices, you need the function blocks MODB4 and MODB4H. To be able to insert this into your project you have to copy the function block from the library. For that, open the library Modbus_TCP_CP_Redundant by selecting the menu item File Open. In the dialog box Open Project select the tab Libraries. Select the library Modbus_TCP_CP_Redundant using the Browse-Button and click OK. This opens the library. Open the folder S7400H System by double clicking it. Select the function blocks FB MODB4 and MODB4H and copy it via Edit Copy. Then change back to your project . In the Step7 project, in your opened S7400H-Station, select the CPU. Double click S7-program, and then Blocks. This will open the Blocks folder. Select Edit Paste. This will insert the blocks into your program.
3-10
Commissioning
Insertion of the Communication Blocks
The modbus function block uses the function blocks AG_LSEND and AG_LRECV. These should be inserted into your program. You can find these communication function blocks in the library SIMATIC_NET_CP which are included in the software package NCM S7 for Industrial Ethernet. Open the library by selecting File Open. In the dialog box Open Project select the tab Libraries. Select the library SIMATIC_NET_CP and click OK. This will open the library. Open the folder CP 400 by double click, select the function FC50 (AG_LSEND) and FC60 (AG_LRECV) and copy it with Edit Copy. Then change back to your project. Select in the STEP7 project in your opened S7400H-Station the CPU. Open the Blocks folder by double clicking S7-Programm and then Blocks. With Edit Paste, insert the function block into your program. Please note, that the following versions of the FCs are a prerequisite for the faultless function of the FBs MODB4H/MODB4: AG_LSEND AG_LRECV V3.0 or higher V3.0 or higher
Insertion of the Conversion Block
For the processing of MODB4H block the function FC40 TIM_S5TI from the IEC standard library is needed as well. Please follow the instruction above for copying/insertion of blocks to insert this block in your project.
3.6
Start_up Characteristics of CP443

The start up of the CP is divided into the following phases: Initialization (Power on of the CP) Parameterization
Introduction
Initialization
As soon as the CP is connected to power, the hardware self test runs. The firmware of the CP is set up for operation. During parameterization the CP receives the device parameters that are assigned to its slot. The CP is now ready for operation.
Parameterization
3-11
Commissioning
3.7
Renaming of Standard Functions

Whether you have already used the numbers of standard functions in your project or the block number is reserved for a different application, you may rename the internal called function blocks AG_LSEND/AG_LRECV and TIM_S5TI of FB MODB4/MODB4H. It is not possible to rename the system functions SFC6 and SFC24. In principle, you can execute the wiring of modules and operands "leading symbolically" or "leading absolutely". Blocks with KNOW_HOW_PROTECT like FB MODB4 can only be handled "leading absolutely" To rename FC50/60 proceed as described subsequently: 1. Get the information about the used operand by clicking "Extras > Reference data > Display". 2. Set the operand priority in the object properties of the block folder to "Absolute value". 3. Call the function "Extras > Re-wire" in the SIMATIC Manager, in order to re-wire the operands into free areas. 4. To be able to keep on using the symbolism diagnostics tools, add the modifications in the symbolism table supplementary. The modifications can be verified by clicking "Extras > Reference data > Display".
Inducement
General
Renaming
3-12
Function Block MODB4H
Function Block MODB4H for Redundancy

The function block MODB4H allows a communication between a CP443-1 in a redundant system (H-system) and a partner, which supports the Open MODBUS/TCP protocol. The block can execute function codes 3, 4 and 16. The communication partner of the H-system can be mounted stand-alone or redundant too (single sided or double sided redundancy).
General Information
Single sided redundancy
Double sided redundancy
Depending on the parameterization, the FB MODB4H can be operated both in client and in server mode.
4-1
4.1
Configuration of the Redundant Communication

While configuring the hardware in HW Config, both CP0 and CP1 get different input and IP addresses, so that they can be addressed unique in the S7program respectively from the communication partner. You have to define one connection in NetPro for each possible connection between the communication partners. With single sided redundancy, there is one connection for CPU0/CP0 and one for CPU1/CP1: Connection from CPU0/CP0 to Partner => Connection 0A Connection from CPU1/CP1 to Partner => Connection 1A
Configuration in HW Config
Configuration in NetPro
With double-sided redundancy, there are two connections for CPU0/CP0 and two for CPU1/CP1: Connection from CPU0/CP0 to Partner/Node A=> Connection 0A Connection from CPU1/CP1 to Partner/Node A=> Connection 1A Connection from CPU0/CP0 to Partner/Node B=> Connection 0B Connection from CPU1/CP1 to Partner/Node B=> Connection 1B
The figures in the following example illustrate the denotation of the connections. Please note when configuring network connections, that the end points of the connection (S7: CP0 und CP1, partner: node A and node B ) must have at least one distinctive feature for addressing: either the IP address or the port number. In HW Config CP0 und CP 1 get always different IP-addresses. Therefore in the network configuration each CP can use the same port number. If the communication partner has got only one IP address, then each connection has to use a different port number. Usually the Modbus server is addressed via the port number 502; the Modbus client uses a port number different from 502. A wrong port number (identical port numbers) will be recognized by NetPro while entering the value and/or closing the configuration window.
4-2
Example: Single Sided Redundancy
The following figure illustrates a configuration example in NetPro for single sided redundancy.
Mode: S7 is server The S7-station has got the IP-addresses 10.0.0.50 und 10.0.0.51 and can be addressed via both connections with the port number 502.The communication partner has got the IP-Address 10.0.0.60 and has to use 2 different port numbers for the two connections: 2000 und 2001 Mode: S7 is client The S7-station has got the IP-addresses 10.0.0.50 and 10.0.0.51 and can use the port number 2000 for both connections. The communication partner has got the IP-Address 10.0.0.60 and must be addressed with 2 different port numbers: 502 and 503.
4-3
Example: Double Sided Redundancy
The following figure illustrates a configuration example in NetPro for double sided redundancy.
Mode: S7 is server The S7-station has got the IP addresses 10.0.0.50 and 10.0.0.51.for the access from node A of the communication partner. Both CPs, CP0 and CP1, can use port number 502, because both of them are having different IP-addresses (connection 0A and 1A). For the access from node B of the communication partner, it is also possible that both CPs, CP0 and CP1 use the same port number 503 (Connection 0B and 1B). The communication partner has got the IP-Addresses 10.0.0.60 and 10.0.0.61 for the access to CP0 of S7, node A and node B can use the same port number: 2000 (connection 0A and 0B). For the access to CP1 of S7 it is also possible to use the same port number: 2001 (connection 1A and 1B) Mode: S7 is client The S7-station has got the IP-addresses 10.0.0.50 and 10.0.0.51. For the access to node A of the communication partner, both CPs, CP0 and CP1, can use port number 2000, because both of them are having different IPAddresses (connection 0A and 1A). For the access to node B of the communication partner, it is also possible that both CPs, CP0 and CP1, use the same Port number 2001(Connection 0B and 1B). The communication partner has got the IP-Addresses 10.0.0.60 and 10.0.0.61. For the access to CP0 of S7, node A and node B can use the same port number: 502(Connection 0A and 0B). For the access to CP1 of S7 it is also possible to use the same port number: 503 (Connection 1A and 1B).
4-4
4.2
Functionality of the FB
The function block MODB4H performs the following functions: Automatic switch-over to the redundant connection, in case the current active connection fails or the switch-over time elapses Display of the current active CP in H-System Display of the current active node of the communication partner in case it is build up redundant too Monitoring of the connection: CP is client: Facility to send cyclic telegrams CP is server: Check for reception in a defined time frame Control the Transaction identifier TI (only in mode CP is client).
Performed Functions
The function block MODB4H executes a multiple call of MODB4 and coordinates these calls for the different connections. The function block MODB4 performs the following functions: Call of the FB Calls the standard functions for the data transfer between the CPU and the CP Generates MODBUS specific telegram header before send Verification of the MODBUS specific telegram header after receive Verification if the memory areas exist which are requested by the client Generate exception telegrams when failures occur (only when CP is in server mode) Data transfer to and from the parameterized DB Monitoring the data reception with a time-out
The function block has to be called both in the start up OB100 as well as in a cyclic OB. For each connection of NetPro, the FB MODB4H can be called once.
Online-Help
In SIMATIC Manager an online help for function block MODB4H is provided. Mark the FB and press the key F1. The online help is displayed; it contains the main information regarding the FB. If "OpenModbusTCP CP" and "OpenModbusTCP CP Redundant" are installed on the same computer the online help of the MODB4 (FB101) is displayed after pressing the button "F1" at marked MODB4 (FB1734).
4-5
Start up of the FB
The function block MODB4H should be unconditionally called once in OB100. The initialization parameters must be set according to the station configuration. They will be copied into the instance DB. The runtime parameters will not be evaluated during the start up.
Cyclical Operation of the FB
In cyclical operation the MODB4H is called e.g. in OB1. According to the runtime parameters, the functions of the function block are activated. While a request is running, changes to the runtime parameters are ignored. During cyclical operation changes to the initialization parameters are ignored.
Initiate Request CP is Client
A rising edge at the trigger input ENQ-ENR initiates a request via the active connection. Depending on the inputs parameters UNIT, WRITE_READ, START_ADDRESS, LENGTH und INPUT_HOLDING, a MODBUS request is generated and sent to the partner station via TCP/IP connection. The client waits for the parameterized monitoring time for a response from the server. In case the monitoring time elapses (no answer from the server) or a faulty connection, the telegram will be sent successively via the other configured connections. If all retries fail, ERROR is set and the last error code is displayed. When the client receives a respond, a validity check is carried out. If the result is positive, necessary actions will be taken and the request will be terminated without error. The output DONE_NDR is set. When an error is recognized during verification, the request is terminated with an error, the ERROR bit is set and an error number is returned in STATUS. In this case the request telegram will not be sent again via the next configured connection. With the parameters SO_TIMER and SO_TIME, the user has the possibility to send cyclic telegrams to the server for a prompt recognition of a connection break-down. With SO_TIME = 0, no cyclic telegrams are sent to the server. With SO_TIME > 0, cyclic telegrams are sent in this time frame. In case of a break-down of the active connection, a switch-over to the next connection is carried out. The switch-over to the next configured connection only takes place if the monitoring time of the current connection elapses or a connection break-down occurs.
4-6
Activation of the Function Block CP is Server
With a true signal at the input ENQ_ENR the FB is ready to receive a request telegram from the client. The server remains passive. The telegram received via the active connection is verified. If the telegram is verified positive, the response telegram is generated and sent. The completed transmission is reported to the user by setting the DONE_NDR bit. At this time the completed function is indicated at the outputs START_ADDRESS, READ_WRITE, LENGTH, UNIT and INPUT_HOLDING. A faulty request telegram causes an error message and the ERROR bit is set. The error number is returned in STATUS. Depending on the kind of error, the request of the client is either answered with an exception telegram or no respond is sent. If a break-down of the active connection is recognized, all configured connections will be set to ready for receive. With the first error free received telegram, the respective connection is set as the active connection. Henceforce telegrams received via the active connection will be processed. A switch-over to the other configured connections only takes place when the switch-over time SO_TIME elapses or when a break-down of the active connection is recognized.
Data Transfer CPU CP
The data transfer between CP and CPU are done with the standard function blocks AG_LSEND and AG_LRECV. At the activation of a MODBUS request by the user (CP is client) or at the receipt of a telegram from the client (CP is server) the standard blocks necessary for the CP are called by the FB in the right order and number. At the receipt of a telegram, the first 6 Bytes are read with the function AG_LRECV. This header contains the length of the rest of the telegram. A second call of the AG_LRECV function follows with the rest of the telegram length. The verification of the received data takes place after the complete receipt of the data.
TCP/IP with CP443-1
TCP/IP with CP443-1 uses statistic connections. The TCP connection cannot be disconnected while in run mode. Given this system characteristic, telegrams might be lost under unfavorable conditions when the synchronization had been lost after an error. The function of the FB in this situation is described in chapter Diagnostics
4-7
4.3
Connection Monitoring Using Cyclic Telegrams

The FB MODB4H can detect the state connection not established not until a data telegram is transferred and the communication blocks AG_LSEND/AG_LRECV report an error. For a fast detection of possible connection errors and prompt switch-over to another configured connection, you can use the feature to configure a cyclic telegram monitoring. The cyclic telegram monitoring means that at least one telegram has to be exchanged between MODBUS client and MODBUS server during the configured switch-over time SO_TIME. The parameter SO_TIME defines the time gap between the last respond and the next request telegram.
General Information
CP is Client
When cyclic telegrams are activated, the FB MODB4H monitors the interval after an initiated request with ENQ_ENR. If the monitoring time SO_TIME elapses without ENQ_ENR is set to TRUE again, the MODB4H generates the cyclic telegram and sends the corresponding request to the server. If a data telegram is initiated with ENQ_ENR = TRUE while executing a cyclic telegram, the data telegram will be executed after the cyclic telegram is finished. The cyclic telegrams are defined with the parameters CHECK_REG, CHECK_LEN, and CHECK_UNIT. They are always sent with function code 3 (Read Holding Register). The outputs DONE_NDR, ERROR are only set accordingly while executing a data telegram. If a data telegram or a cyclic telegram could not be sent via any of the configured connections, an error message is returned in STATUS and the connection 0A is used as default connection.
CP is Server
With telegram monitoring activated, the MODB4H expects a telegram from the client within the switch-over time SO_TIME. If the SO_TIME elapses without receiving a new request, data reception is verified on all other configured connections. If the monitoring time SO_TIME elapses for all configured connections, an error message is returned in STATUS. Subsequent data reception is verified for all configured connections.
4-8
4.4
Parameters of the Function Block MODB4H
Parameter ID_0_A
Decl. IN
Type WORD
Description Connection-ID for CPU/CP0 according to the configuration in NetPro Connection-ID for CPU/CP1 according to the configuration in NetPro Connection-ID for CPU/CP0 according to the configuration in NetPro Only requird with double-sided redundancy
Value range 1 to 64
W#16#1 to W#16#40
Init yes
ID_1_A
IN
WORD
1 to 64
W#16#1 to W#16#40
yes
ID_0_B
IN
WORD
1 to 64
W#16#1 to W#16#40
yes
ID_1_B
IN
WORD
Connection-ID for CPU/CP1 according to the configuration in NetPro , Only requird with double-sided redundancy
1 to 64
W#16#1 to W#16#40
yes
LADDR_0 LADDR_1 TIMER_NR _0A TIMER_NR _1A TIMER_NR _0B TIMER_NR _1B MONITOR
IN IN IN IN IN IN IN
WORD WORD TIMER TIMER TIMER TIMER INT
Input address of the CP0 from HW Config Input address of the CP1 from HW Config Timer number for the response monitoring time for Connection 0A Timer number for the response monitoring time for Connection 1A Timer number for the response monitoring time for Connection 0B Timer number for the response monitoring time for Connection 1B Monitoring time: Wait for Data from the communication, in 100 ms Units Timer number for the SO_TIME CP is Server: time monitoring for switch over to the other CP CP is Client: Maximal time interval between Respond and next Request The monitoring time is switched off. Monitoring time in 100 ms units
CPU dependent CPU dependent CPU dependent CPU dependent CPU dependent CPU dependent 1 to 999
W#16#1 to W#16#3E7
yes yes no no no no no
SO_TIMER SO_TIME
IN IN
TIMER INT
CPU dependent
yes yes
0 1 to 999
4-9
Parameter DB_1
Decl. IN
Type WORD
Description Data block number, first range for Holding Register First MODBUS register address
Value range 1 to 65535

W#16#1 to W#16#FFFF
Init yes
START_1
IN
WORD
0 to 65535
W#16#0000 to W#16#FFFF
yes
END_1
IN
WORD
Last MODBUS register address
0 to 65535
W#16#0000 to W#16#FFFF
yes
DB_2
IN
WORD
Data block number, second range for Holding Register Null if not used
1 to 65535
W#16#1 to W#16#FFFF
yes
0 0 to 65535
W#16#0000 to W#16#FFFF
START_2
IN
WORD
First MODBUS register address
yes
END_2
IN
WORD
0 to 65535
W#16#0000 to W#16#FFFF
yes
DB_3
IN
WORD
Data block number, third range for Holding Register Null if not used
1 to 65535
W#16#1 to W#16#FFFF
yes
0 0 to 65535
W#16#0000 to W#16#FFFF
START_3
IN
WORD
yes
END_3
IN
WORD
0 to 65535
W#16#0000 to W#16#FFFF
yes
DB_4
IN
WORD
Data block number, fourth range for Holding Register Null if not used
1 to 65535
W#16#1 to W#16#FFFF
yes
0 0 to 65535
W#16#0000 to W#16#FFFF
START_4
IN
WORD
yes
END_4
IN
WORD
0 to 65535
W#16#0000 to W#16#FFFF
yes
DB_5
IN
WORD
Data block number, fifth range for Holding Register Null if not used
1 to 65535
W#16#1 to W#16#FFFF
yes
0 0 to 65535
W#16#0000 to W#16#FFFF
START_5
IN
WORD
yes
4-10
Parameter END_5
Decl. IN
Type WORD
Description Last MODBUS register address

W#16#0000 to W#16#FFFF
Init yes
DB_6
IN
WORD
Data block number, first range for input Register First MODBUS register address
1 to 65535
W#16#1 to W#16#FFFF
yes
START_6
IN
WORD
0 to 65535
W#16#0000 to W#16#FFFF
yes
END_6
IN
WORD
0 to 65535
W#16#0000 to W#16#FFFF
yes
DB_7
IN
WORD
Data block number, second range for input Register Null if not used
1 to 65535
W#16#1 to W#16#FFFF
yes
0 0 to 65535
W#16#0000 to W#16#FFFF
START_7
IN
WORD
yes
END_7
IN
WORD
0 to 65535
W#16#0000 to W#16#FFFF
yes
DB_8
IN
WORD
Data block number, third range for input Register Null if not used
1 to 65535
W#16#1 to W#16#FFFF
yes
0 0 to 65535
W#16#0000 to W#16#FFFF
START_8
IN
WORD
yes
END_8
IN
WORD
0 to 65535
W#16#0000 to W#16#FFFF
yes
WRITE_ PROTECT1 WRITE_ PROTECT2 WRITE_ PROTECT3 WRITE_ PROTECT4 WRITE_ PROTECT5
IN IN IN IN IN
BOOL BOOL BOOL BOOL BOOL
Area 1 is write protected (only in SERVER mode) Area 2 is write protected (only in SERVER mode) Area 3 is write protected (only in SERVER mode) Area 4 is write protected (only in SERVER mode) Area 5 is write protected (only in SERVER mode)
TRUE FALSE TRUE FALSE TRUE FALSE TRUE FALSE TRUE FALSE
yes yes yes yes yes
4-11
Parameter ENQ_ENR
Decl. IN
Type BOOL
Description CP is Client: Initiate request at true signal CP is Server: Ready to receive at true signal
Value range TRUE FALSE TRUE FALSE 0 to 65535

W#16#0000 to W#16#FFFF
Init no
SERVER_ CLIENT CHECK_ REG CHECK_ LEN CHECK_ UNIT FREE_ CODE_0 FREE_ CODE_1 LICENSED CP1_ ACTIVE C_B_ ACTIVE
IN IN
BOOL WORD
CP/FB operates in Server mode or in Client mode Register number which is used in cyclic telegrams, only required when CP is client and SO_TIME>0 Length of the cyclic telegram, only required when CP is client and SO_TIME>0 Unit number for cyclic telegrams, only relevant when CP is Client and SO_TIME>0 Not used Not used Not used Request was carried out via CP1 Request was carried out via CP0 Connection Node B of the communication partners is active Connection Node A of the communication partners is active CP is Client: Active request finished without errors CP is Server: Request from the client was executed and answered
yes yes
IN
BYTE
1 to 125
B#16#1 to B#16#7D
yes
IN
BYTE
0 to 255
B#16#0 to B#16#FF
yes
IN IN OUT OUT OUT
DWORD DWORD BOOL BOOL BOOL
TRUE FALSE TRUE FALSE TRUE FALSE
no no
DONE_NDR OUT
BOOL
no
ERROR STATUS CODE_0 CODE_1
OUT OUT OUT OUT
BOOL WORD DWORD DWORD
An error has occurred Error number Not used Not used
TRUE FALSE 0 to FFFF
no no
4-12
Parameter START_ ADDRESS LENGTH
Decl. IN/ OUT IN/ OUT
Type WORD
Description MODBUS start address (INPUT in CLIENT function, OUTPUT in SERVER function) Number of registers to be processed (INPUT in CLIENT function, OUTPUT in SERVER function) Read Function

W#16#0000 to W#16#FFFF
Init no
BYTE
no
1 to 125
B#16#1 to B#16#7D
Write Function
1 to 100
B#16#1 to B#16#64
WRITE_ READ
IN/ OUT
BOOL
Write access Read access (INPUT in CLIENT function, OUTPUT in SERVER function) CP/FB operates with Input Register (FC3) or Holding Register (FC4) Unit Identifier (INPUT in CLIENT function, OUTPUT in SERVER function)
TRUE FALSE
no
INPUT_ HOLDING UNIT
IN/ OUT IN/ OUT
BOOL
TRUE FALSE 0 to 255

B#16#0 to B#16#FF
no
BYTE
no
General information
The parameters of the FB MODB4H can be divided into two groups: Initialization parameter Runtime parameter
The initialization parameters are evaluated only at the first initial execution of the function block MODB4H and taken over into the instance DB. They are marked in the above table in the column INIT with yes. A modification of the initialization parameters during the runtime has no impact. After the modification of these parameters (e.g. at the test mode), the instance DB must be initialized via a STOP/RUN transition of the CPU. Runtime parameters can be used in cyclical operations. It is not advised to change the input parameters while a request is active. Wait with the preparation of the next request and the change of the parameter until the previous request ends with DONE_NDR or ERROR. The outputs parameters can only be evaluated when DONE_NDR is true. Range of Values For the range of values of the different parameters, CPU specific restrictions must be taken in consideration.
4-13
ID_0_A, ID_1_A ID_0_B, ID_1_B
For each configured connection in STEP7/NetPro, a connection ID is assigned. The connection ID is the distinct description of the connection from the CPU via the CP to the communication partner. The number of the configured connection has to be entered here. The value range for this parameter depends on the CPU. ID_0_A ID_1_A ID_0_B ID_1_B represents the connection from the CP0 to node A. represents the connection from the CP1 to node A represents the connection from the CP0 to node B represents the connection from the CP1 to node B
The connection 0A is the default connection, its configuration is mandatory. If the communication partner is built up standalone, then the parameters ID_0_A and ID_0_B are used. LADDR_0, LADDR_1 The parameters LADDR_0 and LADDR_1 represent the input address of the CP0 and the CP1 from HW Config (I-Address). The configured value has to be entered here. The range of values for these parameters depends on the CPU. You can find the parameters ID_x and LADDR_x in the menue Properties TCP Connection as well. TIMER_NR_0A, TIMER_NR_0B, TIMER_NR_1A, TIMER_NR_1B The particular timers, which realize the monitoring time MONITOR are defined here. Each timer will be used for the corresponding connection. The range of values for these parametere depend on the CPU. Any other program must not use these timers. The monitoring time observes the entry of the data input from the communication partner over the active connection. The monitoring time can be set in 100ms intervals. A monitoring time of 1,5 seconds is recommended. In the operating mode CP is client MONITOR specifies the timeout for the receipt of the complete response telegram from the server. When the monitoring time elapses, the active request is cancelled with an error. The time is started after sending of the request telegram is finished and is stopped after the receipt of the complete data. In the operating mode CP is server the receipt of the second part of the telegram is monitored with the MONITOR time. When this time elapses an error is reported. The timer is started after the receipt of the MODBUS specific telegram header and is stopped after the receipt of the complete request telegram. SO_TIMER The number of the timer to monitor the SO_TIME is entered here. The range of values for this parameter depends on the CPU. Other programs must not use this timer.
MONITOR
4-14
SO_TIME
The parameter SO_TIME (switch over time) provides the feature to monitor the connection by using cyclic telegrams. With cyclic telegrams a prompt recognition of connection failures is possible. With SO_TIME = 0 the monitoring is switched off. To activate the monitoring, the SO_TIME can be set within 100ms intervals from 100 milliseconds to 99,9 seconds. It is recommended to set the SO_TIME longer than the monitoring time MONITOR. In the operating mode CP is client the SO_TIME is the time gap in which cyclic telegrams are sent to the communication partner. The cyclic telegrams are set with the parameters CHECK_REG, CHECK_LEN and CHECK UNIT. In the operation mode CP is server, the SO_TIME is the time frame in which the telegram from the communication partner should be received. If this time elapses without receipt, the reception of the telegram is checked on all other configured connections.
DB_x START_x END_x
The FB offers 8 memory areas for mapping the MODBUS register addresses in the S7 storage. DB_1 to DB_5 are used for the Holding Register, DB_6 to DB_8 are used for the Input Register. At least DB_1and DB_6 must be defined. The other DBs are optional. Holding Register can be read and written; the Input register can only be read. With one request only one DB can be accessed. Even if consecutive register numbers are located in two different DBs, you need two requests to access them. This has to be taken into account during parameterization. In the operating mode CP is client 3 parameters are required: DB_x, START_x und END_x. In the operating mode CP is server the parameter WRITE_PROTECTx is required additionally.
The parameter DB_x specifies the DB, into which the below defined MODBUS registers are mapped. START_x specifies the first memory address, which is stored in word 0 of the DB. END_x defines the address of the last MODBUS register.
The number of the data word of the S7 DB in which the last register is mapped, can be calculated with the following formula: DBW number = (END_x START_x) 2 If 0 is entered for DB_x, the respective memory area is not used. The defined memory areas must not overlap. The parameter END_x must not be smaller than START_x. In case of an error the initialization of the FB is stopped with an error. At the end of this section you can find an example of the mapping of the MODBUS addresses to S7 memory areas.
4-15
WRITE_ PROTECTx
Memory areas can be set write protected in the operating mode CP is server. That insures that the client cannot write in certain areas of S7. For each memory area (DB_1 to DB_5) there is a separate write protection flag. Write accesses to locked areas initiate an exception telegram.
ENQ_ENR
Operation mode CP is Client: The data transfer is initiated with a TRUE signal at the input. The request telegram is generated with the values of input parameters UNIT, READ/WRITE, START_ADDRESS, LENGTH and INPUT_HOLDING. A new request can only be sent when the previous one is finished with DONE or ERROR. Operation mode CP is Server: The FB is activated with a TRUE signal at this input. Telegrams from the client can be received. With a FALSE signal at this input data is received from the CP and discarded.
SERVER_CLIENT
This parameter differentiates the client from the server mode. If this input is TRUE, then the operation mode is CP is server. If the input is FALSE, the operating mode is CP is Client. This parameter specifies the first Modbus register that is read with a cyclic telegram. This parameter is only applicable in the operating mode CP is client. This parameter specifies the number of Modbus registers that are read with a cyclic telegram. This parameter is only applicable in the operating mode CP is client. This parameter specifies the unit number which is sent in a cyclic telegram. This parameter is only applicable in the operating mode CP is client. This parameter displays the current active CP in the H-System. This parameter set to FALSE means, the last telegram was sent via the CP0. CP1_ACTIVE set to TRUE displays that the last telegram was sent via the CP1. This parameter displays which node of the redundant communication partner is active. If the output is FALSE, the last telegram was sent via the node A. If the output is TRUE, the last telegram was sent via the node B. If the communication partner is built up standalone, this parameter is always set to FALSE.
CHECK_REG
CHECK_LEN
CHECK_UNIT
CP1_ACTIVE
C_B_ACTIVE
DONE_NDR
In the operating mode CP is Client the activated request was executed without error. For a read function the response data from the server has already been entered into the DB. For a write function the response to the request telegram has been received from the server. In the operating mode CP is Server this output indicates a telegram exchange without errors. In the parameters READ_WRITE, START_ADDRESS, LENGTH and INPUT_HOLDING the request parameters of the client are displayed. These outputs are only available and valid as long as DONE_NDR is TRUE.
4-16
ERROR
When this output is set, an error was recognized. In case of a protocol error, ERROR is immediately set. In case of a connection error, all the configured connections are verified and ERROR is set not until all connections report an error. In the operation mode CP is Client the activated request was finished with an error. The error number is displayed in the STATUS output. In the operating mode CP is Server an error is detected at a request telegram of the client or during sending a response telegram. The error number is displayed in the STATUS output.
STATUS
The STATUS output displays the error number when ERROR is TRUE. The error numbers are described in chapter Diagnostics. The parameter START_ADDRESS specifies the first MODBUS register that is read or written. In the operating mode CP is Client it is an input parameter, in the operating mode CP is Server it is an output parameter. The parameter LENGTH specifies the number of MODBUS registers that are read or written. In the operating mode, CP is Client it is an input parameter. In the operating mode CP is Server it is an output parameter. For read functions, a maximum of 125 registers is possible per telegram. For write functions a maximum of 100 registers is possible. All registers have to be in the same DB per telegram.
START_ADDRESS
LENGTH
WRITE_READ
This parameter defines if a read or write function should be carried out. If the value of the input/output is FALSE, it specifies the read mode. The value TRUE specifies the write mode. In the operating mode CP is Client it is an input parameter. In the operating mode CP is Server it is an output parameter. This parameter defines if Input Registers or Holding Registers should be worked on. If the value of the input/output is FALSE, it specifies that Holding Registers are accessed. The value TRUE specifies access of Input Registers. In the operating mode CP is Client it is an input parameter. In the operating mode CP is Server it is an output parameter. Holding Registers can be read and written. Function code 3 reads Holding Registers, function code 16 writes Holding Registers. Input registers can only be read. Function code 4 reads input registers.
INPUT_HOLDING
4-17
UNIT
In mode CP is Client the parameter UNIT is an input parameter. This input has to be set according to the requirements. The FB copies this value to the request telegram and verifies when the respond telegram is received. Please note, that some communication partners expect a certain unit number. In mode CP is Server the parameter UNIT is an output parameter. The FB copies this value from the request telegram to the respond telegram. The output is set with the received value when the job is finished without error.
4.5
Example for Address Mapping

SERVER_CLIENT DB_1 START_1 END_1 WRITE_ PROTECT1 DB_2 START_2 END_2 WRITE_ PROTECT2 DB_3 START_3 END_3 WRITE_ PROTECT3 DB_4 DB_5 DB_6 START_6 END_6 DB_7 START_7 END_7 DB_8 Server W#16#B (11) W#16#1 (1) W#16#1F4 (500) FALSE W#16#C (12) W#16#1F5 (501) W#16#258 (600) TRUE W#16#D (13) W#16#2BD (701) W#16#320 (800) FALSE 0 0 W#16#10 (16) W#16#1 (1) W#16#1F4 (500) W#16#11 (17) W#16#3E8 (1000) W#16#448 (1099) 0
Example: Parameterization of the Memory Areas
Address Mapping
The following diagram shows the comparison of the SIMATIC memory area and the Modbus typical register oriented storage arrangement. The diagram is based on the above parameterization. In Modbus device: The Modbus addresses printed in black refer to the Data Link Layer, the ones printed in grey refer to the Application Layer. In SIMATIC: The SIMATIC addresses printed in black are the offset in the DB. You can find additionally the Modbus register numbers printed in grey.
4-18
Function block MODBUS
SIMATIC
DB 11 + 0.0 + 2.0 ... +996.0 +998.0 499 500 1 2
Modbus device
Holding Register (from 40001) 0 1 40001 40002 ... 499 500 40500 40501 40502 40503 ... 599 600 601 40600 40601 40602 ... 700 40701 40702 40703 ... 799 800 801 Input Register (from 30001) 40800 40801 40802
DB 12 + 0.0 + 2.0 ... +196.0 +198.0 599 600 501 502
501 502
DB 13 + 0.0 + 2.0 ... +196.0 +198.0 799 800 701 702
701 702
DB 16 + 0.0 + 2.0 ... +996.0 +998.0 499 500 1 2
0 1
30001 30002 ...
499 500 501
30500 30501 30502 ...
DB 17 + 0.0 + 2.0 ... +196.0 +198.0 1098 1099 1000 1001
999 1000 1001
31000 31001 31002 ...
1099 1100
31100 31101
4-19
Function block MODBUS
4.6
Data and Standard Function used by the FB

The function block MODBUS stores its data in an instance DB. This instance DB is created by STEP7 at the first call of the FB. The instance data block contains parameters of type Input, Output, Input/Output as well as static variables needed for its execution. These variables are non-volatile and keep its validity between FB calls. The variables control the internal process flow of the FB. Required memory of the instance-DBs: Instance-DB MODB4H work memory 3022 Byte load memory 4524 Byte
Instance DB
Local Variables
The FB requires 44 Bytes of local variables. Additionally AG_LSEND or AG_LRECV require local variables, up to 58 bytes, depending on the used function block. That gives a maximum of 102 Bytes of local data for a FB MODB4H-call. The function block uses up to 5 timers to realize the monitoring time. The number of the used timers can be parameterized. Other programs must not use this timers. The function block does not use any flags. The function block uses the blocks AG_LSEND and AG_LRECV from the SIMATIC_NET library for the data transfer between CPU and CP. The following versions of the FCs are tested with the FB and released for the communication: FC50 AG_LSEND Version 3.0 FC60 AG_LRECV Version 3.0
Timers
Flags Standard-FCs for Data Transfer
4-20
Funktionsbaustein MODBUS
SFCs and FCs for Miscellaneous Functions
The FB MODB4H uses the following SFCs from the standard library: SFC6 RD_SINFO FC40 TIM_S5TI
The block MODB4H executes multiple calls of MODB4. In MODB4 the following system functions are called: SFC6 RD_SINFO SFC24 TEST_DB FC50 AG_LSEND FC60 AG_LRECV
With SFC6 the FB checks if it was called from OB100 or a cyclical OB and decides this way if the initialization part or the cyclic part should be executed. The conversion of the data format TIME to S5TIME is done with SFC40.
A call of SFC24 determines, whether the DB specified in DB_x is available at runtime and has the required length.
Additional Information
The parameter TI, which exists in both function blocks MODBUS and MODB4H as input respectively output, is operated internally in MODB4H and is incremented in mode S7 is client with each new request. In the operation mode S7 is Client FB MODB4H tries to send the telegram successively over one of the 4 configured connections. Thereby the order is 0A, 0B, 1B and 1A. If a telegram is successfully transferred over one of the connections, this one is marked as active and the following transmission is carried out via this connection. In case of a connection error at the active connection the FB tries to send the telegram successively via all configured connections. Error 8304: When the connection from the CP to the communication partner is interrupted, the interruption is recognized by the CP and error number 8304 stored. When a communication request is activated, first error code 8304 is returned even if the connection is available again, because this error code is still stored. This is a given system characteristics of the CP. When the MODBUS function block returns ERROR=TRUE and STATUS=8304, the communication request should be activated once again.
4-21
Diagnostics
Diagnostics
The diagnostic functions of the CP443 allow you fast failure localization. The following diagnostic features are available: Diagnostics via the display elements of the CP Diagnostics via the STATUS output of the MODB4H function block.
Diagnostic Function
Display Elements (LED)
The display elements inform you about the operating mode or about the failure conditions of the CP. The display elements give you an overview of internal failures, external failures and interface specific failures. For error diagnostics, the MODB4H function block has a STATUS output. By reading the STATUS output you get a general indication of failures that have occurred during the communication. The STATUS parameter can be evaluated in the users program.
STATUS Output of the MODBUS FB
5.1
Diagnostics via the Display Elements of the CP

The display elements of the CP give you information on the module status. There are two types of display functions: Group Error Displays - INTF Internal failure - EXTF External failure Special Displays CP 443-1: - TXD A telegram is being sent via the interface. - RXD A telegram is being received via the interface. A detailed description of the display elements can be found in the device manual of the CP.
Display Functions
5-1
Diagnostics
5.2
Verification by the FB MODB4/MODB4H

Parameter group DB_x, STAT_x, END_x. (x = 1 to 8) 1. With DB_x = 0 the register area is disabled and not verified further. At least one area for each holding and input register must be enabled. 2. Test END_x >= START_x 3. Register addresses that are defined in two DB_x lead to an error message (register overlap). Parameter CHECK_REG and CHECK_LEN depending on SO_TIME o With SO_TIME > 0 the parameters CHECK_REG and CHECK_LEN are verified, whether they are defined in the DB areas.
During start up
Evaluation of the monitoring time MONITOR and SO_TIME CP is Server: UNIT is within the allowed range of values. Configuring of default connection 0A
Errors during start up provoke the ERROR bit to remain set. In the cyclical operation no requests are executed. A correction of the parameterization and a STOP RUN transition of the CPU are necessary. Cyclical Operation CP is Client Verification when the FB is called: Range of values START_ADRESS Range of values LENGTH At the execution of a request, it is checked whether the data block that is specified by the register address is available and has the necessary length. Receipt of the response telegram within the monitoring time The monitoring time can also elapse if less data than specified in the MODBUS telegram header is received. Subsequent failures with loss of telegrams can occur. The comletion of the previous job is checked, when a new job is started with ENQ_ENR = TRUE.
Verification in the response telegram: Received transaction identifier is equal to the sent one. Protocol identifier = 0
5-2
Diagnostics
Length is between 3 and 253 Besides the length in the header of the response telegram is checked for plausibility regarding the request. UNIT sent is equal to the received one FC sent is equal to the received one Response is an Exception Code Telegram For read requests, the number of registers in the request telegram, length in the header and byte count in the telegram must match. For write requests it is verified that start address and number of registers match with the request telegram.
Cyclical Operation CP is Server
Receipt of the second part of the request telegram within the monitoring time The monitoring time also can elapse if less data than specified in the MODBUS telegram header is received. Subsequent failures can occur with loss of telegrams. Checking whether the cyclical monitoring time SO_TIME has elapsed Protocol Identifier = 0 Length between 6 and 207 Additional the length in the header of the response telegram is checked for plausibility regarding the telegram data. Received FC is verified. If the FC is not equal to 03 or 16 an exception telegram is sent. For write requests, the length in the header, the number of registers and the byte count in the telegram must match. The number of registers is verified. If the number is too large an exception telegram is sent. Access to write protected area: Send exception telegram At the execution of a request, it is checked whether the data block that is specified by the register address is present and has the necessary length. In case of an error an exception telegram is sent.
5-3
Diagnostics
Lost Synchronization
The lost synchronization described below can only occur when the communication partner has extreme malfunctions or there are serious interferences on the transmission line. In order to read a MODB4H specific telegram header, the function block MODBUS starts an AG_RECV with 6 bytes length. With the length in the telegram header another AG_RECV is started. If the length in the telegram header is not equal to the actual number of bytes sent to the CP (which is a serious failure), the CP resolves this situation as follows: 1. More data as specified in the header is received: The next AG_RECV gets data that are not compliant with the MODBUS specific header. This leads to after effects like wrong TI or PI, data is interpreted as a length specification, the length used by FB/AG_RECV is wrong. 2. Less data as specified in the header is received: The activated AG_RECV returns no ready signal and the monitoring time MONITOR elapses. The activated AG_RECV has only received a part of the data, therefore it is still in the receiving state. This AG_RECV cannot be cancelled. More data has to be received in order to be synchronized again. In operating mode CP is client the request of the FB MODB4H is cancelled with ERROR. Another FB request can be activated. The response data is received with the old AG_RECV. Receiving must continue until the expected amount of data has been received. Multiple requests, which all end with the status monitoring time elapsed, might be necessary to regain synchronization. In the operating mode CP is server the expected amount of data must be reached with request telegrams of the client. Multiple error messages No response from server might occur at the client. When the old AG_RECV ends, the FB reads a single byte in order to receive a possible telegram fragment from the CP. The reading is observed with the monitoring time MONITOR as well. When the monitoring time elapses it is assumed that the synchronization has been regained. The normal operation of the FB MODB4H is continued. 3. The announced amount of data does not match the request telegram (CP is client): The FB MODB4H receives the announced amount of data and ignores it. ERROR and STATUS return an error code. The above mentioned function of the FB is necessary because neither the TCP/IP connection nor the activated AG_RECV can be cancelled.
5-4
Diagnostics
5.3
Diagnostic Messages of the FB MODB4H

The error messages are displayed at the status output of the FB MODB4H. STATUS is valid when ERROR is TRUE. Below you will find a list of FB specific error messages. The FBs MODB4 and MODB4H uses the standard functions SFC6, SFC24, FC40, FC50 and FC60. The error messages of these blocks are passed on to STATUS without any changes. In the diagnostics buffer or in the online help of SIMATIC Manager you will find further details on these error messages, as well as in the SIMATIC STEP7 NCM S7 Industrial Ethernet Manual.
Messages at the STATUS Output of the FB Error Messages of the called SFCs and FCs
Error messages of FB MODB4H STATUS Event text

(Hex)
Remedy Correct the parameterization Extend the DB. CP is Client: Correct the parameters START_ADDRESS or LENGTH
A002 A003
The parameter END_x is less than START_x. The DB, to which MODBUS addresses shall be mapped, is too short. Minimum length: ( END_x START_x + 1 ) 2 Other possible reasons: Wrong initialization parameter (CP is client)
CP is Server: Wrong address area in the request telegram of Modify the request of the client. the client (CP is server) Correct the parameters.
A004
Applies only with CP is client: Both parameters INPUT_HOLDING and WRITE_READ are set. It is not possible to write input registers.
A005
CP is client: An invalid value for the parameter LENGTH is given. CP is Server: The number of registers in the request telegram is invalid. Range of values: 1 to 125 for read, 1 to 100 for write.
CP is Client: Correct the parameter LENGTH. CP is Server: Modify the number of registers in the request telegram. CP is Client: Correct the parameters combination START_ADDRESS, LENGTH. CP is Server: Modify the request of the client or correct the parameterization of DB_x. Correct the parameterization.
A006
The given range of registers does not exist in DB_1 to DB_8.
A007
CP is client: An invalid monitoring time MONITOR is parameterized. Range of values: 1 to 999.
5-5
Diagnostics
Error messages FB MODB4H STATUS Event text

(Hex)
Remedy Verify error messages at the communication partner. Check if the communication partner needs a special unit identifier. Verify the data of the communication partner with the help of a telegram trace. CP is server: Ensure that the parameterized monitoring time MONITOR is shorter than the monitoring time MONITOR of the client. This is necessary to remove corrupt data from the CP. Verify the data of the communication partner with the help of a telegram trace. CP is client: Verify the data of the communication partner with the help of a telegram trace. CP is Server : The FB MODB4H supports the function codes 03, 04 and 16.
A008
Monitoring time MONITOR elapsed when AG_RECV waits for receipt. E.g. connection is not established. Partner is not ready. As an after effect the loss of synchronization can occur, which leads to a loss of telegrams.
A009
A Protocol Identifier not equal to 0 was received, or if CP is client: The received transaction identifier TI is not equal to the sent one. This error can also indicate an unsuccessful attempt for synchronization. This error may occur once, when CPU Restart is executed during data transfer. In that case the CP turns over old data to the CPU.
A00A
CP is client: The received UNIT is not equal to the sent one. CP is client: Received function code is not equal to the sent one. CP is server: An invalid Function Code was received.
A00B
A00C
The received byte count does not match the number of Verify the data of the registers. communication partner with the help of a telegram trace. The register address in the response telegram is not equal to the one in the request telegram (only if CP is client). Verify the data of the communication partner with the help of a telegram trace.
A00D
A00E
The length indicated in the MODBUS specific telegram Verify the data of the header does not match the number of registers or the communication partner with the byte count in the telegram. The FB receives all data help of a telegram trace. and ignores them. As an after effect a loss of synchronization might occur. CP is server Attempt to write on a write protected area. Modify the request of the client or correct the parameterization.
A00F A010
In the parameterized area DB_1 to DB_8 a DB number Correct the parameterization. is used twice.
5-6
Diagnostics
Error messages the FB MODB4H STATUS Event text

(Hex)
Remedy Verify the data of the communication partner with the help of a telegram trace. Check the error message of the communication partner and verify the data with a telegram trace if needed. Correct the parameterization. The data areas must not contain any overlapping register areas.
A01A
Corrupt data or wrong length in header: Byte 4 of the prefix is not equal to 0 The CP has received invalid data which could not be assigned. The CP has lost synchronization and needs data from the communication partner to finish the active AG_RECV. The parameterized DB_1 and DB_2 overlap. The parameterized DB_1 and DB_3 overlap. The parameterized DB_1 and DB_4 overlap. The parameterized DB_1 and DB_5 overlap. The parameterized DB_2 and DB_3 overlap.. The parameterized DB_2 and DB_4 overlap. The parameterized DB_2 and DB_5 overlap. The parameterized DB_3 and DB_4 overlap. The parameterized DB_3 and DB_5 overlap. The parameterized DB_4 and DB_5 overlap. The parameterized DB_6 and DB_7 overlap. The parameterized DB_6 and DB_8 overlap. The parameterized DB_7 and DB_8 overlap. The connection 0A is not initialized. SO_TIME is parameterized, but the parameter CHECK_LEN is not set to a value from 1 to 125. The parameters CHECK_START and CHECK_LEN lead to a register area which is not parameterized in DB_x. CP is client: A request was initiated prior to the completion of the previous one.
A01E
A012 A013 A014 A015 A023 A024 A025 A034 A035 A045 A067 A068 A078 A080 A081 A082
Parameterize the default connection 0A. Correct the parameterization. Correct the parameterization. The CHECK parameters have to be parameterized in the DB area. Wait with the initiation of a new request until the previous one was finished either with DONE/NDR = TRUE or ERROR = TRUE. Correct the parameterization. With next transferred data telegram SO_TIME is retriggered and the error code is deleted. The communication partner does not support the requested function.
A083
A084 A085
An invalid SO_TIME is parameterized. Range of values is 1 to 999. The switch-over time (SO_TIME) elapsed for all configured connection. The reception of a telegram is monitored via all parameterized connections. An exception telegram with exception code 1 was received (only if CP is client)
A091
5-7
Diagnostics
Error messages the FB MODB4H STATUS Event text

(Hex)
Remedy Correct LENGTH or START_ADDRESS at the call of the FB. Check the error message of the communication partner. Check the error message of the communication partner. Check the error message of the communication partner and verify the data with a telegram trace if needed.
A092
An exception telegram with exception code 2 was received (only if CP is client) An attempt to an invalid or non existing address at the communication partner was made.
A093 A094 A095
An exception telegram with exception code 3 was received (only if CP is client) An exception telegram with exception code 4 was received (only if CP is client) An exception telegram with an unknown exception code was received (only if CP is client).
5-8
Diagnostics
5.4
Diagnostic Messages of included FCs/SFCs
Error messages of included FCs/SFCs STATUS Event text

(Hex)
Remedy See online help (SIMATIC manager -> mark block -> key F1 > Ethernet -> see also -> code evaluation ) See online help (SIMATIC manager -> mark block -> key F1 > Ethernet -> see also -> code evaluation ) Correct the parameterization. Use the ID of NetPro and work with only 1 instance DB.
7xxx
For detailed information please refer to the online help of SIMATIC Manager.
8xxx
For detailed information please refer to the online help of SIMATIC Manager.
8186
ID parameter invalid This error code is also reported, when MODB4H is called with different instance DBs in cyclical OB and OB100.
5.5
Diagnostic Messages of SFC24
Error messages of SFC24 STATUS Event text

(Hex)
Remedy Choose a valid DB number. All data blocks that are specified in DB_x must be created and copied into the CPU. DB must not be created as UNLINKED.
80A1 80B1
DB Number = 0 or too large for the CPU The DB does not exist in the CPU.
80B2
DB UNLINKED
5-9
Application Sample
Application Sample MODB4H

The following simple programming example illustrates the use of FB MODB4H. The S7 program is for information purposes only and is not to be understood as a solution for a customer specific installation configuration.
General Information
Example Project on the CD
On the CD you can find an extensive example project, which offers all varieties of parameterization possibilities for the Simatic stations. S7-H-Station is client or server Single-sided or double-sided redundancy
Simatic Stations in the Example Project
The example project consists of the following Simatic stations: Block / Station Name H Double-sided (Client) H Double-sided (Server) H Single-sided (Client) H Single-sided (Server) x x Single-sided Double-sided x x x x Client x x Server
6-1
Application Sample
Programming Example
The programming example consists of the blocks: Start-Up OB100 Cyclic program processing OB1 with call of FB 1733 Work-DB for job trigger e.g. with variable table Data blocks for register values
Used Blocks
The subsequent listed blocks are used in the printed programming example. This block numbers are also used in the provided example project for S7 stations with FB MODB4H.
Block
OB 1 OB 100 FB 1733 FB 1734 DB 100 DB 222 DB 11 DB 12 DB 13 DB 16 DB 17
Symbol
Comment
Cyclic program processing Start-Up OB for Re-Start FB MODB4H FB MODB4 for internal calls Instance-DB for FB MODB4H Work-DB CONTROL_DAT for FB MODB4H Register -DB for memory area 1 Register -DB for memory area 2 Register -DB for memory area 3 Register -DB for memory area 6 Register -DB for memory area 7
6-2
Application Sample
6.1
Programming Example CP is Client

The blocks are listed as follows: Block OB 1 OB 100 DB 222 Comment Cyclic Program Processing Start-Up OB for Re-start work-DB "CONTROL DAT" for FB MODB4H Start-Up-OB Initialization of FB MODB4H AUF "CONTROL_DAT" L T L T L T L T L T L T L T L T L T L T L T L T L T L T 1 "CONTROL DAT".ID_0_A 3 "CONTROL DAT".ID_1_A 8183 "CONTROL DAT".LADDR_0 8182 "CONTROL DAT".LADDR_1 0 "CONTROL DAT".SO_TIME 11 "CONTROL DAT".DB_1 1 "CONTROL DAT".START_1 500 "CONTROL DAT".END_1 12 "CONTROL DAT".DB_2 501 "CONTROL DAT".START_2 600 "CONTROL DAT".END_2 13 "CONTROL DAT".DB_3 601 "CONTROL DAT".START_3 700 "CONTROL DAT".END_3 //DB 222 //from NETPRO
Programming Example
Start-Up
OB100
//from NETPRO
//from HW-Config
//from HW-Config
//no cyclical telegrams
//first memory area //Registernumber 1 to 500
//second memory area //Registernumber 501 to 600
//third memory area //Registernumber 601 to 700
6-3
Application Sample
L T T T L T T T L T L T L T L T L T L T L T T T
0 "CONTROL DAT".DB_4 "CONTROL DAT".START_4 "CONTROL DAT".END_4 0 "CONTROL DAT".DB_5 "CONTROL DAT".START_5 "CONTROL DAT".END_5 16 "CONTROL DAT".DB_6 1 "CONTROL DAT".START_6 500 "CONTROL DAT".END_6 17 "CONTROL DAT".DB_7 1001 "CONTROL DAT".START_7 1100 "CONTROL DAT".END_7 0 "CONTROL DAT".DB_8 "CONTROL DAT".START_8 "CONTROL DAT".END_8
//fourth memory area //not used
//fifth memory area //not used
//sixth memory area //Registernumber 1 to 500
//seventh memory area //Registernumber 1001 to 1100
//eighth memor area //not used
CLR = "CONTROL DAT".SERVER_CLIENT L T L T L T 0 "CONTROL DAT".CKECK_REG 1 "CONTROL DAT".CKECK_LEN 1 "CONTROL DAT".CKECK_LEN
//CP ist Client //start modbus register for //cyclical telegrams //count of modbus registers for //cyclical telegrams //Unit number for //cyclical telegrams
CALL "MODB4H" , "MODB4H_DAT" ID_0_A :="CONTROL DAT".ID_0_A ID_1_A :="CONTROL DAT".ID_1_A ID_0_B := ID_1_B := LADDR_0 :="CONTROL DAT".LADDR_0 LADDR_1 :="CONTROL DAT".LADDR_1 TIMER_NR_0A := TIMER_NR_1A := TIMER_NR_0B := TIMER_NR_1B := MONITOR := SO_TIMER :=T5 //nonattached timer SO_TIME :="CONTROL DAT".SO_TIME DB_1 :="CONTROL DAT".DB_1 START_1 :="CONTROL DAT".START_1 END_1 :="CONTROL DAT".END_1 DB_2 :="CONTROL DAT".DB_2 START_2 :="CONTROL DAT".START_2 END_2 :="CONTROL DAT".END_2
6-4
Application Sample
DB_3 START_3 END_3 DB_4 START_4 END_4 DB_5 START_5 END_5 DB_6 START_6 END_6 DB_7 START_7 END_7 DB_8 START_8 END_8 WRITE_PROTECT1 WRITE_PROTECT2 WRITE_PROTECT3 WRITE_PROTECT4 WRITE_PROTECT5 ENQ_ENR SERVER_CLIENT CHECK_REG CHECK_LEN CHECK_UNIT FREE_CODE_0 FREE_CODE_1 LICENSED CP1_ACTIVE C_B_ACTIVE DONE_NDR ERROR STATUS CODE_0 CODE_1 START_ADDRESS LENGTH WRITE_READ INPUT_HOLDING UNIT
:="CONTROL DAT".DB_3 :="CONTROL DAT".START_3 :="CONTROL DAT".END_3 :="CONTROL DAT".DB_4 :="CONTROL DAT".START_4 :="CONTROL DAT".END_4 :="CONTROL DAT".DB_5 :="CONTROL DAT".START_5 :="CONTROL DAT".END_5 :="CONTROL DAT".DB_6 :="CONTROL DAT".START_6 :="CONTROL DAT".END_6 :="CONTROL DAT".DB_7 :="CONTROL DAT".START_7 :="CONTROL DAT".END_7 :="CONTROL DAT".DB_8 :="CONTROL DAT".START_8 :="CONTROL DAT".END_8 := := := := := := :="CONTROL DAT".SERVER_CLIENT := "CONTROL DAT".CHECK_REG := "CONTROL DAT".CHECK_LEN := "CONTROL DAT".CHECK_UNIT := := := := := := :="CONTROL DAT".ERROR :="CONTROL DAT".STATUS := := := := := := :=
6-5
Application Sample
Cyclic Program
OB1
Cyclic-OB
OPN "CONTROL DAT" CALL "MODB4H" , "MODB4H_DAT" ID_0_A := ID_1_A := ID_0_B := ID_1_B := LADDR_0 := LADDR_1 := TIMER_NR_0A :=T1 //nonattached Timer TIMER_NR_1A :=T2 //nonattached Timer TIMER_NR_0B := TIMER_NR_1B := MONITOR :=CONTROL DAT".MONITOR SO_TIMER := SO_TIME := DB_1 := START_1 := END_1 := DB_2 := START_2 := END_2 := DB_3 := START_3 := END_3 := DB_4 := START_4 := END_4 := DB_5 := START_5 := END_5 := DB_6 := START_6 := END_6 := DB_7 := START_7 := END_7 := DB_8 := START_8 := END_8 := WRITE_PROTECT1 := WRITE_PROTECT2 := WRITE_PROTECT3 := WRITE_PROTECT4 := WRITE_PROTECT5 := ENQ_ENR :="CONTROL DAT".ENQ_ENR SERVER_CLIENT := CHECK_REG := CHECK_LEN := CHECK_UNIT := FREE_CODE_0 := FREE_CODE_1 := LICENSED := CP1_ACTIVE := "CONTROL DAT".CP1_ACTIVE
C_B_ACTIVE
:= "CONTROL DAT".C_B_ACTIVE
6-6
Application Sample
DONE_NDR ERROR STATUS CODE_0 CODE_1 START_ADDRESS LENGTH WRITE_READ INPUT_HOLDING UNIT A R
:="CONTROL DAT".DONE_NDR :="CONTROL DAT".ERROR :="CONTROL DAT".STATUS := := :="CONTROL DAT".START_ADDRESS :="CONTROL DAT".LENGTH :="CONTROL DAT".WRITE_READ :="CONTROL DAT".INPUT_HOLDING :="CONTROL DAT".UNIT
"CONTROL DAT".ENQ_ENR "CONTROL DAT".ENQ_ENR
//reset trigger //job finished without error //trigger new job //job finished with error //put your error handling here //wait until job finished
A "CONTROL DAT".DONE_NDR FP #EDGE JC TRIG A "CONTROL DAT".ERROR
BEU TRIG: SET = "CONTROL DAT".ENQ_ENR
//trigger //initialize values for a //new job here
6-7
Application Sample
6.2
Programming Example CP is Server

The blocks are listed as follows: Block OB 1 OB 100 DB 222 Comment Cyclic Program Processing Start-Up OB for Re-start work-DB "CONTROL DAT" for FB MODB4H Start-Up-OB Initialization of FB MODB4H OPN "CONTROL DAT" L T L T L T L T L T L T L T L T L T L T L T L T L T L T 1 "CONTROL DAT". ID_0_A 3 "CONTROL DAT". ID_1_A 8183 "CONTROL DAT".LADDR 8182 "CONTROL DAT".LADDR 0 "CONTROL DAT".SO_TIME 11 "CONTROL DAT".DB_1 1 "CONTROL DAT".START_1 500 "CONTROL DAT".END_1 12 "CONTROL DAT".DB_2 501 "CONTROL DAT".START_2 600 "CONTROL DAT".END_2 13 "CONTROL DAT".DB_3 601 "CONTROL DAT".START_3 700 "CONTROL DAT".END_3 //DB 222 //from NETPRO connection table
Programming Example
Start-Up
OB100
//from NETPRO connection table
//from HW Config
//from HW Config
//no cyclical telegrams
//first memory area //Register 1 to 500
//second memory area //Register 501 to 600
//third memory area //Register 601 to 700
6-8
Application Sample
L T T T L T T T L T L T L T L T L T L T L T T T
0 "CONTROL DAT".DB_4 "CONTROL DAT".START_4 "CONTROL DAT".END_4 0 "CONTROL DAT".DB_5 "CONTROL DAT".START_5 "CONTROL DAT".END_5 16 "CONTROL DAT".DB_6 1 "CONTROL DAT".START_6 500 "CONTROL DAT".END_6 17 "CONTROL DAT".DB_7 1001 "CONTROL DAT".START_7 1100 "CONTROL DAT".END_7 0 "CONTROL DAT".DB_8 "CONTROL DAT".START_8 "CONTROL DAT".END_8
//fourth memory area //not used
//fifth memory area //not used
//sixth memory area //Registernumber 1 to 500
//seventh memory area //Registernumber 1001 to 1100
//eighth memory area //not used
CLR WRITE_PROTECT1 WRITE_PROTECT2 WRITE_PROTECT3 WRITE_PROTECT4 WRITE_PROTECT5
:=FALSE :=FALSE :=FALSE :=FALSE :=FALSE
SET = "CONTROL DAT".SERVER_CLIENT
//CP is server
CALL "MODB4H" , "MODB4H_DAT" ID_0_A :="CONTROL DAT".ID_0_A ID_1_A :="CONTROL DAT".ID_1_A ID_0_B := ID_1_B := LADDR_0 :="CONTROL DAT".LADDR_0 LADDR_1 :="CONTROL DAT".LADDR_1 TIMER_NR_0A := TIMER_NR_1A := TIMER_NR_0B := TIMER_NR_1B := MONITOR := SO_TIMER :=T5 SO_TIME :="CONTROL DAT".SO_TIME DB_1 :="CONTROL DAT".DB_1 START_1 :="CONTROL DAT".START_1 END_1 :="CONTROL DAT".END_1 DB_2 :="CONTROL DAT".DB_2 START_2 :="CONTROL DAT".START_2 END_2 :="CONTROL DAT".END_2
6-9
Application Sample
DB_3 START_3 END_3 DB_4 START_4 END_4 DB_5 START_5 END_5 DB_6 START_6 END_6 DB_7 START_7 END_7 DB_8 START_8 END_8 WRITE_PROTECT1 WRITE_PROTECT2 WRITE_PROTECT3 WRITE_PROTECT4 WRITE_PROTECT5 ENQ_ENR SERVER_CLIENT CHECK_REG CHECK_LEN CHECK_UNIT FREE_CODE_0 FREE_CODE_1 LICENSED CP1_ACTIVE C_B_ACTIVE DONE_NDR ERROR STATUS CODE_0 CODE_1 START_ADDRESS LENGTH WRITE_READ INPUT_HOLDING UNIT A JC "CONTROL DAT".ERROR ERR
:="CONTROL DAT".DB_3 :="CONTROL DAT".START_3 :="CONTROL DAT".END_3 :="CONTROL DAT".DB_4 :="CONTROL DAT".START_4 :="CONTROL DAT".END_4 :="CONTROL DAT".DB_5 :="CONTROL DAT".START_5 :="CONTROL DAT".END_5 :="CONTROL DAT".DB_6 :="CONTROL DAT".START_6 :="CONTROL DAT".END_6 :="CONTROL DAT".DB_7 :="CONTROL DAT".START_7 :="CONTROL DAT".END_7 :="CONTROL DAT".DB_8 :="CONTROL DAT".START_8 :="CONTROL DAT".END_8 :=CONTROL DAT".WRITE_PROTECT1 :=CONTROL DAT".WRITE_PROTECT2 :=CONTROL DAT".WRITE_PROTECT3 :=CONTROL DAT".WRITE_PROTECT4 :=CONTROL DAT".WRITE_PROTECT5 := :="CONTROL DAT".SERVER_CLIENT := := := := := := := := := :="CONTROL DAT".ERROR :="CONTROL DAT".STATUS := := := := := := := //INIT completed with error //cyclic operation doesnt //make sense //INIT completed without //enable data transfer
SET = "CONTROL DAT".ENQ_ENR BEU ERR:
//put your error handling here
6-10
Application Sample
Cyclic Program
OB1
Cyclic-OB
OPN "CONTROL DAT" CALL "MODB4H" , "MODB4H_DAT" ID_0_A := ID_1_A := ID_0_B := ID_1_B := LADDR_0 := LADDR_1 := TIMER_NR_0A :=T1 //nonattached Timer TIMER_NR_1A :=T2 //nonattached Timer TIMER_NR_0B := TIMER_NR_1B := MONITOR :=CONTROL DAT".MONITOR SO_TIMER := SO_TIME := DB_1 := START_1 := END_1 := DB_2 := START_2 := END_2 := DB_3 := START_3 := END_3 := DB_4 := START_4 := END_4 := DB_5 := START_5 := END_5 := DB_6 := START_6 := END_6 := DB_7 := START_7 := END_7 := DB_8 := START_8 := END_8 := WRITE_PROTECT1 := WRITE_PROTECT2 := WRITE_PROTECT3 := WRITE_PROTECT4 := WRITE_PROTECT5 := ENQ_ENR :="CONTROL DAT".ENQ_ENR SERVER_CLIENT := CHECK_REG := CHECK_LEN := CHECK_UNIT := FREE_CODE_0 := FREE_CODE_1 := LICENSED := CP1_ACTIVE := "CONTROL DAT".CP1_ACTIVE C_B_ACTIVE := "CONTROL DAT".C_B_ACTIVE
6-11
Application Sample
DONE_NDR ERROR STATUS CODE_0 CODE_1 START_ADDRESS LENGTH WRITE_READ INPUT_HOLDING UNIT
:="CONTROL DAT".DONE_NDR :="CONTROL DAT".ERROR :="CONTROL DAT".STATUS := := :="CONTROL DAT".START_ADDRESS :="CONTROL DAT".LENGTH :="CONTROL DAT".WRITE_READ :="CONTROL DAT".INPUT_HOLDING :="CONTROL DAT".UNIT
6-12
A Literature
MODBUS IDA MODBUS APPLICATION PROTOCOL SPECIFICATION V1.1b, December 28, 2006
http://www.modbus-IDA.org
OPEN MODBUS / TCP Redundant communication via CP443-1 in H-systems 2XV9450-1MB01; Manual edition 1.1
Glossary
A
Address The address identifies a physical storage location. If the address is known, the operand stored there can be directly accessed. An automation system is a programmable logic controller that contains at least a CPU, different input and output devices as well as HMI devices.
Automation System
B
Baud Rate Block Call - > transmission rate A block call occurs when program processing branches to the called block Block parameters are variables within multiple-use blocks, which are replaced with actual values when the relevant block is called. Blocks are elements of the user program which are defined by their function, structure, or purpose. With STEP7 there are Bus Segment Code blocks (FB, FC, OB, SFB, SFC) Data blocks (DB, SDB) User-defined data types (UDT)
Block Parameter
Blocks
Part of a -> subnet. Subnets can consist of bus segments and connectivity devices such as repeaters and bridges. Segments are transparent for addressing.
C
Client A client is a device or, in general terms, an object that requests a service from a -> server. Communications processors are modules for point-to-point connections and bus connections. The configuration is the set up of individual modules of the PLC in the configuration table.
Communications Processor
Configuration
Connection Parameterization The specification of a connection ID in the system function block. With the help of a connection ID the system function blocks can communicate between two communication points. CP Communications Processor. Module for communications tasks.
CPU
Central processing unit of the S7 programmable logic controller with control and arithmetic unit, memory, operating system, and interfaces to I/O modules. Cyclic Redundancy-Check = Checksum which guarantees a high probability of error recognition. The cycle time is the time the CPU needs to execute the user program once. In cyclic program processing, the user program is executed in a constantly repeating program loop, called a cycle.
CRC
Cycle Time
Cyclic Program Processing
D
Data Block (DB) These are blocks containing data and parameters with which the user program works. Unlike all other blocks, data blocks do not contain instructions. They are subdivided into global data blocks and instance data blocks. The data held in the data blocks can be accessed absolutely or symbolically. Complex data can be stored in structured form. Data types allow users to define how the value of a variable or constant is to be used in the user program. They are classified into elementary and structured data types. The default setting is a basic setting which is always used if no other value is specified. Every CPU has a diagnostic buffer, in which detailed information on diagnostic events are stored in the order in which they occur. Diagnostic events are, for example, errors on a module or system errors in the CPU, which are caused by, say, a program error or by operating mode transitions. The diagnostics functions cover the entire system diagnosis and include detection, analysis and reporting of errors within the automation system. Downloading means loading objects (e.g. code blocks) from the programming device into the load memory of the CPU.
Data Type
Default Setting
Diagnostic Buffer
Diagnostic Event
Diagnostic Functions
Download
F
Function Block (FB) Function blocks are components of the user program and, in accordance with the IEC standard, are blocks with memory. The memory for the function block is an assigned data block, a so called instance data block. Function blocks can be parameterized but can also be used without parameters.
H
Hardware Hardware is the term given to all the physical and technical equipment of a PLC.
I
Industrial Ethernet Instance Data Block A LAN system complying with IEEE 802.3 (ISO 8802-2) An instance data block is a block assigned to a function block and contains data for this special function block. On the interface module the physical conversion of signals takes place. By exchanging the pluggable interface module you can adapt the communications processor to the physical interface of the communications partner. Interrupt is a name for a break of the program processing in the processor of an automation system by an external alarm.
Interface Module
Interrupt
M
MAC-Address Address to distinguish between different stations connected to a common transmission medium (Industrial Ethernet).
Media Access Control (MAC) Mechanisms for controlling access by a station to a common transmission medium shared with other stations. Module Modules are pluggable printed circuit boards for programmable logic controllers Module parameters are used to set the module behaviors. A distinction is made between static and dynamic module parameters.
Module Parameters
N
NCM S7 for Industrial Ethernet Configuration software for configuration and diagnostic functions on an Ethernet CP.
O
Online / Offline Online means that a data connection exists between PLC and programming device. Offline means that no such data connection exists. STEP7 allows you to display contextual help texts on the screen while working with the programming software. An operand is part of a STEP7 instruction and states with what the processor is to do something. It can be both absolutely and symbolically addressed. The SIMATIC S7 programmable controllers have three different operating modes: STOP, START UP and RUN. The functionality of the CPUs varies in the individual operating modes. The operating system of the CPU organizes all functions and operations of the CPU which are not connected to a specific control task.
Online Help
Operand
Operating Mode
Operating System of the CPU
P
Parameter Parameters are values that can be assigned. A distinction is made between block parameters and module parameters. Parameterization means setting the behavior of a module. The execution of a data interchange operation according to a specific protocol is called a procedure. This is a special memory area in the PLC. At the beginning of the cyclic program, the signal states of the input modules are transferred to the process image input table. At the end of the cyclic program, the process image of the outputs is transferred to the output modules as output signals. The communications partners involved in a data interchange must abide by fixed rules for handling and implementing the data traffic. These rules are called protocols.
Parameterization Procedure
Process image
Protocol
R
Rack A rack is a rail containing slots for mounting modules.
S
Server A server is a device, or in general terms, an object that provides certain services. A service is started at the instigation of a -> client. Software is the term given to all programs used on a computer system. These include the operating system and the user programs. The operating mode START UP is active when the CPU transits from operating mode STOP to operating mode RUN. STEP7 is the programming software of SIMATIC S7. A subnet is part of a -> network whose parameters must be matched. The subnet includes bus components and all the attached stations. Subnets can, for example, be connected together by -> gateways to form a network. A system consists of several subnets with unique subnet numbers. A subnet consists of several stations with unique -> MAC addresses. System blocks differ from the other blocks in that they are already integrated into the S7-400 system and are available for already defined system functions. They are classified into system data blocks, system functions, and system function blocks. System functions are software modules without memory which are already integrated into the operating system of the S7-CPU and can be called by the user as required.
Software
START UP
STEP7 Subnet
System Block
System Function (SFC)
System Function Block (SFB) System function blocks are software modules with memory which are already integrated into the operating system of the S7-CPU and can be called up by the user as required.
T
Tool A tool is a piece of software that is capable of accessing operating system functions in a programming device. According to DIN 44302, this is the number of binary decisions transmitted per time unit. The unit is bps. he set or selected transmission rate depends on various conditions, for example the distance across
Transmission Rate
U
Upload Uploading means loading objects (e.g. code blocks) from the load memory of the CPU into the programming device. The user program contains all instructions and declarations for signal processing, by means of which a system or a process can be controlled. The user program for SIMATIC S7 is structured and is divided into smaller units called blocks.
User Program
V
Variable A variable is an operand (e.g. E 1.0) which can have a symbolic name and can therefore also be addressed symbolically.
W
Work Memory The work memory is a RAM on the CPU which the processor accesses while processing the user program.
Customer Support
Siemens AG Industry Sector I IS IN E&C Werner-von-Siemens-Str. 60 91052 Erlangen Tel: (0 91 31) 7-46111 Fax: (0 91 31) 7-44757 Mail:[email protected]
http://www.siemens.com/s7modbus
Siemens Aktiengesellschaft
nderungen vorbehalten
Stand: 03/2009

Open Modbus TCP For NCM - CP Redundant English

Uploaded by

Copyright:

Available Formats

Open Modbus TCP For NCM - CP Redundant English

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Open Modbus TCP For NCM - CP Redundant English

Uploaded by

Copyright:

Available Formats

SIMATIC OPEN MODBUS / TCP Redundant Communication via CP443-1 in H-Systems

Preface, Table of Contents Product Description Mounting

OPEN MODBUS / TCP Redundant Communication via CP443-1 in HSystems

FB MODB4H Diagnostics Application Sample Appendices Literature Glossary

Safety Precautions and Warnings

Copyright Siemens AG 2004-2008 All Rights Reserved

Exclusion from Liability

Contents of the Manual

How to Access the Information in this Manual

Additional Sources of Information

Placement in the System Environment

Function of the FBs

TCP/IP with CP443-1

Hardware and Software Prerequisites

Usable Modules for MODB4H

Knowledge of AWL and basic knowledge of STEP7 and PLC.

Installing the Library on the STEP7 PG/-PC

What We Provide You

Configuration of the Communication Link

Parameterization of the Communication Partner

Configure Network in mode CP is Client

Object Properties of the Connection

In the register Addresses the port numbers are defined.

Unspecified Connection with CP is server

Click on OK and the inputs are accepted.

Insertion of the Function Blocks into the Program

Content of MODBUS library

Insertion of the MODB4H FB

Insertion of the Communication Blocks

Insertion of the Conversion Block

Start_up Characteristics of CP443

Renaming of Standard Functions

Function Block MODB4H

Function Block MODB4H for Redundancy

Single sided redundancy

Double sided redundancy

Function Block MODB4H

Configuration of the Redundant Communication

Function Block MODB4H

Example: Single Sided Redundancy

Function Block MODB4H

Example: Double Sided Redundancy

Function Block MODB4H

Function Block MODB4H

Cyclical Operation of the FB

Initiate Request CP is Client

Function Block MODB4H

Activation of the Function Block CP is Server

Data Transfer CPU CP

TCP/IP with CP443-1

Function Block MODB4H

Connection Monitoring Using Cyclic Telegrams

Function Block MODB4H

Parameters of the Function Block MODB4H

WORD WORD TIMER TIMER TIMER TIMER INT

Function Block MODB4H

Value range 1 to 65535

Last MODBUS register address

First MODBUS register address