Modbus TCP PN CPU English

SIMATIC
SIMATIC Modbus/TCP Communication

via the integrated PN interface of the PLC
Manual
Preface, Table of Contents

Product Description
Getting Started
Commissioning
Parameterization
Licensing
FB MODBUSPN
Additional Blocks
Diagnosis
Sample Application
SIMATIC S7
SIMATIC Modbus/TCP
Communication via the
integrated PN interface of the PLC
Manual
Appendices
Literature
Glossary
Edition 2.7
Safety Precautions and

Warnings
This manual contains warnings, which you should note for your own safety as well as
for the prevention of damage to property. These warnings are indicated by means of a
warning triangle and are displayed as follows in accordance with the level of danger:
__________________________________________________________________
Danger
indicates that loss of life, severe personal injury or substantial damage
will result if proper precautions are not taken.
__________________________________________________________________
__________________________________________________________________
Warning
indicates that loss of life, severe personal injury or substantial damage can result if proper
precautions are not taken.
__________________________________________________________________
__________________________________________________________________
Caution
indicates that minor personal injury or property damage can result if proper precautions are
not taken.
__________________________________________________________________
__________________________________________________________________
Note
represents an important information especially significant to the product, handling of the
product or a specific part of this documentation.
__________________________________________________________________
Qualified
Personnel
The start-up and the operation of the device may only be carried out by qualified
personnel. Qualified personnel in the sense of the security advices of this manual are any
persons authorized to commission, ground and label devices, systems and electric circuits.
Use as prescribed
Please note:
_________________________________________________________________________
Warning
This device may only be used for applications as prescribed in the catalogue and the
technical description. Furthermore, they may only be used in conjunction with third-party
devices and components recommended and authorized by Siemens.
A successful and safe operation of this product is depends on proper transport, and correct
storage, installation and assembly as well as careful operation and maintenance.
SIMATIC and SIMATIC NET are registered trademarks of SIEMENS AG.

Trademarks
Copyright
Since any other brand names in this manual may refer to trademarks, the use of these
names by third parties for their own purposes may infringe the rights of the owner.
Siemens AG 2008-20013 All Rights Reserved
Passing on and reproducing this document as well as using and

disclosing its contents is prohibited unless an explicit permission is
given. Offenders will be liable for damages. All rights reserved, especially
in the case of patent grant or registration of a utility model or design.
Siemens AG
Industry Sector
Industry Automation Division / Industrial Automation Systems
Factory Automation
I IA AS FA DH FTH 6
Postfach 23 55, D- 90713 Frth
Exclusion of Liability
We have checked the contents of this document with regard to its
conformity with the described hardware and software. Deviations,
however, cannot be excluded. Therefore, we cannot guarantee its
complete conformity. The information in this document is checked
regularly and necessary corrections are contained in subsequent
versions. We will be grateful for any suggestions for improvement.
Technical data subject to change.
Preface
Preface
Purpose of the
Manual
The information in this manual allows you to set up and put in operation the
connection between a PLC with integrated PN interface and a device that
supports the Modbus/TCP protocol.
Contents of the
Manual
This manual describes the function of the Modbus function block and its
parameterization.
The manual contains the following topics:
Production description
Getting Started
Commissioning
Parameterization
Licensing
Function block MODBUSPN
Diagnosis
Sample application
Scope of this
Manual
This manual is valid for the following software:

Product
Identification number
From version
Modbus/TCP PN CPU
2XV9 450-1MB02
2.6.1
FB 102 MODBUSPN
3.7
FB 103 TCP_COMM
3.2
FB 104 MOD_CLI
1.6
FB 105 MOD_SERV
1.5
Note
This manual contains the FB description valid at the time of publication.
Modbus/TCP communication via the integrated PN interface of the CPU

2XV9450-1MB02; Manual edition 2.7
Preface
Additional
Sources of
Information
All additional information concerning PN PLCs and IM 151-8 PN/DP CPU

(Startup, commissioning etc.) can be found in the manuals
SIEMENS
SIMATIC S7-300
CPU 31xC and CPU 31x: Installation
Operating Instructions
A5E00105491-07
SIEMENS
SIMATIC S7-300
CPU 31xC and CPU 31x, Technical Specifications
Manual
A5E00105474-07
SIEMENS
SIMATIC S7-400
Automation System S7-400 Hardware and Installation
A5E00850740-01
SIEMENS
SIMATIC S7-400
S7-400 Automation System, CPU Specifications
Manual
A5E00850746-06
SIEMENS
SIMATIC
Distributed I/Os ET 200S
Interface Module IM151-8 PN/DP CPU
Manual
A5E02049033-01
SIEMENS
Product Information on
CPU314C-2 PN/DP, 6ES7314-6EH04-0AB0
CPU315-2 PN/DP, 6ES7315-2EH13-0AB0
CPU315F-2 PN/DP, 6ES7315-2FH13-0AB0
CPU317-2 PN/DP, 6ES7317-2EK13-0AB0
CPU317F-2 PN/DP, 6ES7317-2FK13-0AB0
CPU317-2 DP, 6ES7317-2AJ10-0AB0
CPU317F-2 DP, 6ES7317-6FF03-0AB0
CPU319-3 PN/DP, 6ES7318-3EL00-0AB0
CPU319F-3 PN/DP, 6ES7318-3FL00-0AB0
A5E01103134-03
SIMATIC
Windows Automation Center RTX
WinAC RTX 2008
A5E00486536-02
SIMATIC
WinAC RTX 2009
A5E00486536-03
Preface
SIMATIC
WinAC RTX (F) 2010
A5E00486536-04
Additional information concerning STEP7 can be found in the following
manuals:
SIEMENS
SIMATIC Software
Base software for S7 and M7
STEP7 user manual
C79000-G7000-C502-..
SIEMENS
SIMATIC Software
System software for S7-300/400
System and standard functions
Reference manual C79000-G7000-C503-02
Additional
Questions
For further questions regarding the use of the FBs described in this manual,
please contact your Siemens partner who provided you with this function
block.
Terminology
This document uses the term PN PLC. The descriptions apply to PN PLCs
of series 314C, 315, 317, 319, 412, 414 and 416 as well as IM 151-8 PN/DP
CPU and WinAC RTX.
Scope of
Application
The function block described in this manual establishes a connection

between a PN PLC and third-party MODBUS devices.

Table of Contents
Table of Contents
1
Product Description ................................................................................................... 1-1

1.1
Field of Applications ...................................................................................... 1-1
1.2
Hardware and Software Requirements .......................................................... 1-1
Getting Started ........................................................................................................... 2-1
Commissioning .......................................................................................................... 3-1
3.1
Installing the Library on the STEP7 PG/-PC .................................................. 3-1
3.2
PLC Assigning the IP Address .................................................................... 3-2
3.3
Insertion of the Function Blocks into the Program .......................................... 3-4
3.4
Multiple Connections via Port 502 ................................................................. 3-5
Parameterization of the Modbus Communication.................................................... 4-1

4.1
Parameterization with the Wizard .................................................................. 4-2
4.2
Editing the Parameterization ......................................................................... 4-3
Licensing .................................................................................................................... 5-1
Function Block MODBUSPN ..................................................................................... 6-1
6.1
Functionality of the FB .................................................................................. 6-1
6.2
Parameters of the Function Block MODBUSPN ............................................ 6-5
6.3
Example of Address Mapping ...................................................................... 6-12
6.4
Data and Standard Functions used by the FB .............................................. 6-15
6.5
Renaming / Rewiring Standard Functions .................................................... 6-17
Additional Blocks....................................................................................................... 7-1

7.1
Add-On for CFC ............................................................................................ 7-1
7.2
Job List for Cyclical Telegram Transfer ......................................................... 7-2
Diagnosis ................................................................................................................... 8-1

8.1
Diagnosis via the Display Elements of the PLC ............................................. 8-2
8.2
Verification by the FB MODBUSPN ............................................................... 8-3

Table of Contents
8.3
Diagnosis Messages of the FB MODBUSPN ................................................. 8-6
8.4
Diagnosis Messages of Called Blocks ......................................................... 8-12
8.5
Diagnosis Messages of SFC24 .................................................................... 8-12
Sample Application .................................................................................................... 9-1

9.1
Example project in AWL................................................................................ 9-1
9.2
Example project in CFC ................................................................................ 9-3
Literature ....................................................................................................................... 1

ii
Product Description
Product Description
1.1
Field of Applications
Placement in the
System Environment
The function block described here is a software product for PLCs with
integrated PN interface of Simatic S7-300, S7-400 and IM 151-8 PN/DP
CPU.
Function of the
FBs
These function blocks enable communication between a Simatic PLC with

integrated PN interface and a device that supports the Modbus/TCP protocol.
Data transmission is carried out in accordance with the client-server principle.
The SIMATIC S7 can act as both client and server during the data
transmission.
Use of Port
Number 502
In general, the protocol uses the port 502. This port number has been
released for all PN PLCs with the corresponding firmware version. You can
find the information about the released port numbers on the internet:
http://support.automation.siemens.com/WW/view/en/34010717.
With specific CPUs it is possible to use multiple connections via port 502 to
different clients simultaneously.
In section 3.4 Multiple Connections via Port 502 you can find technical
details regarding this matter.
1.2
Hardware and Software Requirements
Usable Modules
You can find the latest hardware requirements on the internet:

www.siemens.com/s7modbus.
Software Versions
The usage of the FB MODBUSPN is possible with STEP7 Version 5.5 or

higher.

1-1
Product Description
Memory
requirements
The FB MODBUSPN requires ca. 8 kbyte work memory and ca. 9 kbyte load
memory.
The FB MOD_CLI requires ca. 9 kbyte work memory and ca. 10 kbyte load
memory.
The FB MOD_SERV requires ca. 9 kbyte work memory and ca. 10 kbyte load
memory.
The FB TCP_COMM requires ca. 2 kbyte work memory and ca. 2 kbyte load
memory.

1-2
Getting Started
Getting Started
Procedure
1. Install Modbus/TCP PN CPU and insert the Modbus function blocks into
your SIMATIC project.
=> Section 3.1 to 3.3
2. Parameterize the connection parameters regarding your requirements
(IP-address, port number, etc.).
=> Section 4.1 and 4.2
3. Parameterize the Parameter-DBs MODBUS_PARAM regarding your
requirements (client/server, connect at start-up, register numbers,
DB numbers, etc.).
=> Section 4.1 and 4.2
4. Call the Modbus block FB102 in the required OBs.
=> Section 6.1
5. Parameterize the Modbus block for initialization and runtime.
=> Section 6.2
6. Load the user program into the PLC and license the Modbus block for this
CPU.
=> Section 5
.

2-1
Commissioning
Commissioning
General
Information
The information below on STEP7 refers to Version 5.5. In later versions, the
sequences, names and directories might be different.
Requirements
Knowledge of AWL and basic knowledge of STEP7 and PLC is required.
3.1
Installing the Library on the STEP7 PG/-PC
What We Provide
The attached CD contains a setup which installs the library

Modbus_PN_CPU, the sample projects and the manuals in English and
German in the corresponding STEP7 directories.
The manuals are also available as PDF files on CD.
Requirements
STEP7 has to be installed.
Installation
Insert your Modbus CD into the CD ROM drive and follow the instructions
which are displayed automatically by the installation program step by step. If
the installation program does not start automatically, please proceed as
follows:
1. In the Windows Explorer, navigate to the CD ROM drive. Open the setup
directory and double-click on Setup.EXE to start the installation.
2. Follow the instructions which are displayed by the installation program
step by step.
Now you can find
the library in
\Program Files\Siemens\Step7\S7libs,
the sample project in \Program Files\Siemens\Step7\Examples,

the manual in
\Program
Files\Siemens\Step7\S7manual\S7Comm,
the software registration form in
\Program Files\Siemens\Step7\S7libs\Modbus_PN_CPU.
To initially access the Modbus library, use the browse function of the Open
dialog for libraries.
The manual can be accessed via short cut under \Program Files \Siemens\
Documentation as well.

3-1
Commissioning
3.2
PLC Assigning the IP Address
Introduction
Each node on the Ethernet network is identified by an internationally unique

address. This so-called MAC address is preset by the manufacturer and
cannot be changed.
Following the steps below, you can assign an IP address in the Ethernet to
this physical address.
In this example, a PLC 317-2 PN/DP is inserted.
Procedure
Before the configuration, it is necessary to create a new S7 project with

STEP7.
1. Open HWConfig
The PLC 317-2 PN/DP is inserted in slot 2 and the properties dialog
box of the PN-IO interface X2 is mapped.
2. A double click on line X2 opens the properties dialog of the PN IO

interface.

3-2
Commissioning
3. Enter the IP address and the subnet mask.

To establish a connection via a router, enter the address of the router
as well.
4. Click on "New" to assign a name for a new Industrial Ethernet subnet.

Confirm your entries with "OK".
Result: You created a new Industrial Ethernet subnet.
5. Click on the "OK" button.
Result: The properties window of the PN IO interface of the PLC 3172 PN/DP closes.

3-3
Commissioning
3.3
Insertion of the Function Blocks into the Program
Content of the
MODBUS library
The following blocks are required for the Modbus communication:

MODBUSPN
MOD_CLI
MOD_SERV
TCP_COMM
The blocks have to be copied from the library into your project.
Additionally, the library contains the parameter data block MODBUS_PARAM
as a draft. It can be inserted into your project for assistance purposes.
Blocks of the
Standard Library
The following blocks are required for the Modbus communication:

TSEND (FB63)
TRCV (FB64)
TCON (FB65)
TDISCON (FB66).
You can find these blocks in Standard Library
They have to be inserted into your project.
Communication Blocks.
Please note that the following versions of the FBs are a requirement for the
faultless function of the FB MODBUSPN:
TSEND
TRCV
TCON
TDISCON
Restart in
Commissioning
V2.1
V2.2
V2.4
V2.1
During commissioning arranging several CPU restarts after changing the

initialization parameters can be complicated. By setting the static parameter
Init_Start manually, the restart part in the modbus block can be processed.
The manual initialization can only be done when there is no job active. For a
correct initialization all initialization parameters must be parameterized in the
cyclical OB.

3-4
Commissioning
3.4
Multiple Connections via Port 502
General
Some CPUs are able to multiplex TCP connections. In doing so several

Modbus clients can establish a connection via port 502. The CPU acts as
Modbus server.
Here you can find information which CPU and which firmware release
supports multiple connections via port 502:
www.siemens.com/s7modbus
Requirements
To use this functionality, the parameterization must be carried out as follows:

CPU is server
port 502 as local port
unspecified TCP connection
passive connection establishment
Number of
Released
Connections
The maximum number of Modbus clients that can be connected to port 502
of the CPU is CPU-specific and can be found in the technical data of the
CPU.
Programming
For each client that should be connected to port 502 of the server, 1 unique
connection is needed in the parameter data block. Furthermore in the S7
program 1 Modbus block instance is needed for each client.

3-5
Parameterisation of the Modbus Communication
Parameterization of the Modbus Communication
General
Information
For the communication via the integrated PN interface of the PLC, a network
configuration in NetPro is not necessary. The connections are established
and terminated by means of the function blocks TCON (FB65) und TDISCON
(FB66).
Several connections to different communication partners can be
parameterized and established at the same time. The maximal number of
coexistent connections depends on the PLC.
Connection
Description DB
MODBUS_PARAM
The parameters to establish a connection and to execute the Modbus

communication are defined as a structure in a parameter DB called
MODBUS_PARAM. At first the connection parameters are defined,
subsequently the Modbus parameters are defined.
For each logical connection, a separate structure is required. This structure
contains the connection parameters of both communication partners and the
Modbus parameters. For each additional connection a new structure for
connection parameters and Modbus parameters is needed. This structure can
either be part of a newly created parameter DB or of an existing one that is
expanded.
The parameter data block can contain parameter information of all defined
connections. It is also possible to use a separate parameter data block for
each connection.
A prepared structure is part of the library MODBUS_PN_CPU and can be
used as a sample.
Structure of DB MODBUS_PARAM:
Address
Name
STRUCT
+0.0
+64.0
Connection 1: Connection parameters

Connection 1: Modbus parameters
END_STRUCT
STRUCT
+650.0
Connection 2: Connection parameters
+714.0
Connection 2: Modbus parameters

END_STRUCT
...
...
STRUCT
650*i
650*i+64
Connection i+1: Connection parameters

Connection i+1: Modbus parameters
END_STRUCT

4-1
Connection
Parameters
The parameters of the connection are defined in the first block, e.g. the used
local interface and the IP address of the communication partner. The
functions TCON and TDISCON can establish and terminate a connection by
means of these parameters. The detailed structure can be found in section
4.2.
The structure of the connection parameter block is obligatory und may not be
changed. Otherwise it becomes impossible to establish a connection.
Modbus
Parameters
The Modbus parameters define the mode of communication and the address
reference, e.g. how many register or bit areas are mapped to which DB and
the differentiation between the S7 acting as server or as client. The structure
of the parameter DB has to remain unchanged to ensure proper
communication.
Alternatives for
Parameterization
There are two alternatives for a parameterization of the connection and

Modbus parameters. The first one is to use a Wizard, which offers an easy
way to setup the connection parameters. The second possibility is to edit the
parameters in the structure in the data block with the editor of STEP7.
The two opportunities are described in detail in the following sections 4.1 and
4.2.
4.1
Parameterization with the Wizard
General
Information
With the wizard ModbusTCP Wizard you can easily parameterize the
connection parameters as well as the Modbus parameters in the parameter
data block MODBUS_PARAM. The complete structure (connection
parameters and Modbus parameters) is created.
It is recommended to use the wizard for the parameterization of the block
MODBUS_PARAM.
You can find the wizard at

http://support.automation.siemens.com/WW/view/en/31535566.
.

4-2
4.2
Editing the Parameterization
Procedure
Copy DB2 of the library Modbus_PN_CPU and insert it in your project. If the
number is already used, rename the DB.
The parameter of data block MODBUS_PARAM must not be changed during
runtime. It is necessary to restart the PLC after the modification of
MODBUS_PARAM.
Structure and
Adaption of
Connection
Parameters
For each logical connection one structure is required.
block_length
This parameter describes the length of the connection parameters and must
not be changed.
Fixed value:
id
W#16#40
A connection ID is assigned to each logical connection. This ID must be

unique within the complete parameter data block and has to be
parameterized during the call of FB MODBUSPN. It is used for the internal
calls of the T blocks (TCON, TSEND, TRCV and TDISCON).
Value range:
W#16#1 to W#16#FFF

4-3
connection_type
The structure of the connection is defined here. It is used by the function

TCON when establishing the connection. The value depends on the PLC.
TCP (compatibility mode):
TCP:
B#16#01 with CPU315 and 317 <= FW V2.3

B#16#11 with CPU315 and 317 >= FW V2.4,
IM 151-8 PN/DP CPU, CPU314C, CPU319,
CPU412, CPU414, CPU416 and WinAC RTX
The values vary depending on the used firmware. You can find further
information on the internet:
http://support.automation.siemens.com/WW/view/en/24294554
active_est
This parameter defines the way the connection is established (active or

passive). The Modbus client performs an active connection establishment
while the Modbus server establishes passive connections.
Active connection establishment:
Passive connection establishment:
local_device_id
TRUE
FALSE
The local_device_id defines the IE interface of the used PN PLC. The

following values are necessary for the different PLC types.
IM 151-8 PN/DP CPU, WinAC RTX, IF 1
CPU314C, CPU315 or 317
CPU319
CPU412, CPU414 or CPU416
WinAC RTX, IF 2
WinAC RTX, IF3
WinAC RTX, IF4
local_tsap_id_len
B#16#1
B#16#2
B#16#3
B#16#5
B#16#6
B#16#B
B#16#F
The length of the parameter local_tsap_id (= local port number) is defined.

0
2
rem_subnet_id_
len
This parameter is currently not used. Please assign the value B#16#0.
rem_staddr_len
The length of rem-staddr, i.e. the IP address of the communication partner, is

defined here. If an unspecified connection is to be used, no IP address is
required for the partner.
Unspecified connection:
Specified connection:
rem_tsap_id_len
B#16#0
B#16#4
This parameter defines the length of rem_tsap_id, the port number of the
remote communication partner.
next_staddr_len
2
0
This parameter defines the length of next_staddr as the distinction between

the communication running via an external CP or via the integrated PN
interface of the PLC.
PN interface of the PLC:
B#16#0

4-4
local_tsap_id
This parameter defines the local port number. The representation depends on
the parameter connection_type. The value range depends on the PLC. The
port number has to be unique within the PLC.
With connection_type B#16#01
local_tsap_id[1]
low byte of the local port number in hexadecimal
local_tsap_id[2]
high byte of the local port number in hexadecimal
local_tsap_id[3-16]
B#16#00
local_tsap_id[1]
high byte of the local port number in hexadecimal
local_tsap_id[2]
low byte of the local port number in hexadecimal
local_tsap_id[3-16]
B#16#00
rem_subnet_id
This parameter is currently not used. Please assign the value B#16#0.
rem_staddr
In this array of bytes, the IP address of the remote communication partner is

defined. When an unspecified connection is used, no IP address has to be
entered. The representation depends on the parameter connection_type.
Example: IP address 192.168.0.1:
rem_staddr[1] =
B#16#01 (1),
rem_staddr[2] =
B#16#00 (0),
rem_staddr[3] =
B#16#A8 (168),
rem_staddr[4] =
B#16#C0 (192),
rem_staddr[5-6]=
B#16#00 (reserved)
rem_staddr[1] =
B#16#C0 (192),
rem_staddr[2] =
B#16#A8 (168),
rem_staddr[3] =
B#16#00 (0),
rem_staddr[4] =
B#16#01 (1),
rem_staddr[5-6]=
B#16#00 (reserved)
rem_tsap_id
This parameter defines the remote port number. The representation depends
on the parameter connection_type. The value range depends on the PLC.
local_tsap_id[1]
low byte of the remote port number in hexadecimal
local_tsap_id[2]
high byte of the remote port number in hexadecimal
local_tsap_id[3-16]
B#16#00
local_tsap_id[1]
high byte of the remote port number in hexadecimal
local_tsap_id[2]
low byte of the remote port number in hexadecimal
local_tsap_id[3-16]
B#16#00
next_staddr
This parameter defines rack and slot of the corresponding CP. When using
the integrated PN interface of the PLC, assign 0 to this parameter.
next_staddr[1-6]
spare
B#16#00
Reserved; assign 0 to this parameter.

4-5
Adaption of the
Modbus
Parameters
The Modbus parameters in the block MODBUS_PARAM define the mode of

operation of the Modbus communication and the address reference of
Modbus addresses and SIMATIC addresses.
server_client
TRUE: S7 is server
FALSE: S7 is client
single_write
In operating mode S7 is client and single_write = TRUE write requests with

length 1 are carried out with the function codes 5 and 6.
With single_write = FALSE all write requests use the function codes 15 and
16.

4-6
connect_at_
startup
This parameter defines the point in time at which the connection is being
established.
FALSE: establish connection when ENQ_ENR=TRUE
TRUE: establish connection immediate after PLC start-up
When connect_at_startup = TRUE, the first request should be started after
the connection was established (CONN_ESTABLISHED = TRUE) or an error
has been reported respectively (ERROR =TRUE).
8 Data Areas
8 data areas are available to map the Modbus addresses in the S7 storage.
At least the first data area has to be defined. The other 7 data areas are
optional. Depending on the type of request, these memory areas are read or
written.
With one request, only one DB can be accessed. Even if consecutive register
numbers or coils are located in two different DBs, two requests are necessary
to access them both. This has to be taken into account during the
parameterization.
It is possible to map more Modbus values (registers or coils) in one data
block than could be processed with one telegram.
data_type_x
db_x
The parameter data_type_x defines the MODBUS data type which is to be

mapped with this definition.
If data_type_x is set to 0, this data area is not used
Identifie
r
Data type
Area not used
Coils
Bit
Inputs
Bit
Holding Register
Word
Input Register
Word
Size
The parameter db_x defines the number of the data block in which the
consecutively defined MODBUS registers or bits are mapped.
0 cannot be used as DB number since it is reserved for system functions.
db_x
DB-Number
1 - 65535 (W#16#0001 to W#16#FFFF)
The data block must be longer by 2 bytes than it is necessary for the
parameterized data. The last 2 bytes are required for internal purposes.

4-7
start_x
end_x
Start_x specifies the first register or bit address, which is stored in the data
block word 0 of the DB. End_x defines the address of the last MODBUS
address.
When accessing registers, the number of the data block word of the S7 DB in
which the last register is mapped, can be calculated with the following
formula:
DBW number = (end_x start_x)
When accessing coils or inputs, the number of the data element of the S7 DB
in which the last bit is mapped, can be calculated with the following formula:
DBB number = (end_x start_x +7) / 8
The defined memory areas must not overlap. The parameter end_x must not
be smaller than start_x. In case of an error occurring, the initialization of the
FB is stopped with an error. When start_x is equal to end_x, one Modbus
address (1 register or 1 bit) is allocated.
In section 6.3 you can find an example of the mapping of the MODBUS
addresses to S7 memory areas.
start_x, end_x
MODBUS address
0 to 65535 (W#16#0000 to W#16#FFFF)
internal_send_
buffer
This array is used internally for message data within the FB. Accessing or
changing the array is inadmissible.
internal_recv_
buffer
This array is used internally for the received data within the FB. Accessing or
changing the array is inadmissible.

4-8
Licensing
Licensing
General
The block MODBUSPN must be licensed for each CPU individually. The
licensing takes place in two steps: reading the IDENT_CODE and declaring
the registration key REG_KEY. The OB121 must be available in the CPU.
Read the
IDENT_CODE
To read the IDENT_CODE please proceed as follows:

1. Parameterize the block in the cyclic OB (OB1 or cyclic interrupt OB)
and in OB100 according to your requirements. Transfer the program
to the PLC and turn it to RUN mode.
2. Open the instance DB of the block MODBUSPN. Data block ->
Open Online to open the DB.
Monitoring the block via the button

is insufficient.
5-1
Licensing
3. The output IDENT_CODE shows an 18 character string.

Copy this string per copy/paste from the DB and insert it in the form
SOFTWARE REGISTRATION FORM. This form is stored in the
library path
..\Program Files\Siemens\Step7\S7LIBS\Modbus_PN_CPU
during installation and is also available on the installation CD.
Insert the License-No. of the product package into the form.
4. Send this form as Service Request to Customer Support.

Hereupon you will receive the registration key for your PLC.
5. Note for usage in CFC: The CFC editor can show only a limited
number of characters in online view. The complete IDENT_CODE is
shown in tooltip of the output parameter.

5-2
Licensing
Declaration of the
Registration Key
REG_KEY
The registration key REG_KEY must be declared for each call of the block
MODBUSPN.
The registration key REG_KEY should be stored in a global DB. Via this
global DB all MODBUSPN blocks can receive the registration key (See also
the following example).
Please proceed as follows to declare the registration key REG_KEY:
1. Copy the prepared license block DB3 of the library
Modbus_PN_CPU into your project. If the DB number is already
used in your project, rename the license DB.
2. Open the license DB and copy the 17 digit registration key you
received to the column Initial value.
3. Declare the registration key in the data block as initial value to

avoid a repeated insertion after reloading the PLC. For this purpose,
switch to the data view via the menu View -> Data View. Using the
menu Edit > Initialize Data Block, all values of the column initial
value are copied to actual values.
4. Assign the value DB3.REG_KEY to the parameter REG_KEY of the
block MODBUSPN in the cyclical OB.
5. Transfer the changed blocks to the PLC. The registration key can be
set at runtime. A STOP -> RUN transition is not necessary.
The block is now licensed for this CPU.

5-3
Licensing
Missing or Wrong
Licensing
When the registration key is missing or a wrong one is detected, the SF LED
(S7-300 and IM151-8) or the INTF LED (S7-400) of the CPU is flashing. A
cyclic error message regarding the missing license is displayed in the
diagnostic buffer, too. The error number of the missing license is
W#16#A090.
_____________________________________________________________
Warning
The CPU will turn to STOP mode, if the OB121 is not available.
_____________________________________________________________
Modbus communication is carried out even with a missing or wrong

registration key, but the output STATUS_MODBUS is set to W#16#A090 no
valid license.

5-4
Function Block MODBUSPN
6.1
Functionality of the FB
General
Information
The function block MODBUSPN enables a communication link between a

PLC with integrated PN interface and a partner which supports Modbus/TCP.
The function codes 1, 2, 3, 4, 5, 6, 15 and 16 are supported.
Depending on the parameterization, the FB can be operated either in client or
in server mode.
The block MODBUSPN calls the blocks MOD_CLI (FB104), MOD_SERV
(FB105) and TCP_COMM (FB103) internally. The block MOD_CLI comprises
the function of a Modbus client, the block MOD_SERV executes the function
of a Modbus server and the block TCP_COMM handles the connection
management.
The blocks provide the following functions:
Connection and data handling by means of T blocks of the standard
library
Generation of MODBUS-specific telegram header before sending
Verification of the MODBUS-specific telegram header when receiving
Verification whether the memory areas requested by the client exist
Generation of exception telegrams when errors occur (only when S7
is in server mode)
Data transfer to and from the parameterized DB
Time monitoring of the data reception as well as connection
establishment and termination
Verification of the registration key
Online Help
The SIMATIC Manager provides an online help for the function block
MODBUSPN. Mark the FB and press F1 so that he online help is displayed.
It contains the main information on the FB.

6-1
Call of the FB
For a correct program sequence the function block MODBUSPN has to be

called in 2 organization blocks:
OB100 Start-Up and Cyclic OB (OB1 or cyclic interrupt OB, e.g.
OB35)
The subordinate blocks of the Modbus library MOD_CLI, MOD_SERV and
TCP_COMM must not be called additionally in an organization block.
A coexistent call of FB MODBUSPN in OB1 and a cyclic interrupt OB, e.g.
OB35 is not permissible.
The OB121 must be available in the CPU. You will find more information
regarding this matter in section 5 Licensing.
Start-up of the FB
The function block MODBUSPN is unconditionally called once in OB100.

The initialization parameters must be set according to the station
configuration.
The initialization parameters are copied into the instance DB.
The runtime parameters are not evaluated during the start-up.
The values of the parameter data block MODBUS_PARAM are
evaluated.
Cyclical Operation
of the FB
In case of cyclical operation, the FB MODBUSPN is called in OB1 or in a

cyclic interrupt OB.
Corresponding to the runtime parameters, the functions of the
function block are activated.
While a request is being processed, changes to the runtime
parameters are ignored.
In the cyclical operation mode, initialization parameters are ignored.
OB121
Programming
Error
If the block has not been licensed yet, the OB121 is called.
____________________________________________________________
Warning
The CPU will turn to STOP mode, if the OB121 is not available.
_____________________________________________________________

6-2
Connection
Handling
Active connection establishment is initiated by the Modbus client. The

relevant information is read from the connection parameters of DB
MODBUS_PARAM.
A parameter of the connection parameter block (active_est) defines whether
the PLC performs active or passive connection establishment.
During runtime the function TCON establishes the connection to the
communication partner for both types of connections, active and passive.
The point in time at which the connection is established is defined in DB
MODBUS_PARAM (parameter connect_at_startup).
The termination of the connection is defined with the parameter
DISCONNECT of FB MODBUSPN.
Multiple
Communication
Partners
A PN PLC can establish multiple connections to various communication

partners. To ensure a proper operation and data transfer, a strict division of
the different connections to the corresponding communication partners is
inevitable.
Correspondingly, there are the following requirements for each connection:
one connection parameter block and the related Modbus parameter
in DB MODBUS_PARAM
call of FB MODBUSPN in OB100
call of FB MODBUSPN in OB1 or cyclic interrupt OB
In this case, the calls of the FB MODBUSPN in the OB100 and in the OB1
receive the same instance DB for one connection. A different instance DB is
required for each additional connection.

6-3
Initiate Request
S7 is Client
A rising edge at the trigger input ENQ_ENR initiates a request. Depending on

the input parameters UNIT, DATA_TYPE, START_ADDRESS, LENGTH, TI
and WRITE_READ, a MODBUS request telegram is generated and sent to
the partner station via the TCP/IP connection. The client waits for the
parameterized monitoring time RECV_TIME for a response from the server.
When the monitoring time elapses (no response from the server), the
activated request is terminated with an error. A new request can be initiated.
After the receipt of the response telegram, a validity check is carried out. If
the result is positive, the necessary actions are taken and the request is
terminated without error. The output DONE_NDR is set. When an error is
recognized during verification, the request is terminated with an error, the
ERROR bit is set and an error number is returned at the output STATUS.
Activation of the
Function Block
S7 is Server
With the signal TRUE at the trigger input ENQ_ENR, the FB is ready to
receive a request telegram from the client. The server remains passive and
waits for a telegram from the client. The received telegram is verified. If the
verification result is positive, the response telegram is sent. The completed
transmission is reported to the user by setting the DONE_NDR bit. At this
point, the completed function is indicated at the outputs UNIT, DATA_TYPE,
START_ADDRESS, LENGTH, TI and WRITE_READ.
An erroneous request telegram causes an error message and the ERROR bit
is set. The error number is returned in STATUS_MODBUS. The request of
the client is not executed. Depending on which error occurred, an exception
telegram is sent to the client.

6-4
6.2
Parameters of the Function Block MODBUSPN
Parameter
Decl. Type
Description
ID
IN
Connection ID, must be identical to the

associated parameter id in the parameter
DB MODBUS_PARAM
WORD
Value range
Init
1 to 4095
yes
W#16#1 to
W#16#FFF
DB_PARAM
IN
BLOCK_ Number of the parameter DB

DB
depending on
PLC
yes
RECV_TIME
IN
TIME
T#20ms
to
T#+24d20h31
m23s647ms
no
T#20ms
to
T#+24d20h31
m23s647ms
no
TRUE
FALSE
no
TRUE
FALSE
no
Character
no
Monitoring Time: wait for data from

communication partner
Shortest adjustable time: 20 ms.
CONN_TIME
IN
TIME
Monitoring Time: wait for establishing or

termination of the connection
Shortest adjustable time: 100 ms.
KEEP_ALIVE
IN
TIME
Not used
ENQ_ENR
IN
BOOL
S7 is Client:
Initiate request at positive edge
S7 is Server:
Ready to receive at TRUE signal
DISCONNECT
IN
BOOL
S7 is Client:
TRUE: connection is terminated after
reception of response
S7 is Server:
TRUE: connection is terminated when
ENQ_ENR = FALSE
REG_KEY
IN
LICENSED
OUT BOOL
BUSY
STRING
[17]
OUT BOOL
Registration key to activate the license

License state of the function block:
Block is licensed
Block is not licensed
no
TRUE
FALSE
Operating state of the T functions

(TCON, TDISCON, TSEND or TRCV)
no
Job processing
TRUE
No job processing active
FALSE
CONN_
ESTABLISHED
OUT BOOL
Connection established
Connection terminated
TRUE
FALSE
no
DONE_NDR
OUT BOOL
S7 is Client:
TRUE: Active request finished without
errors
TRUE
FALSE
no
S7 is Server:
TRUE: Request from the client was
executed and answered

6-5
Parameter
Decl. Type
Description
ERROR
OUT BOOL
Value range
Init
An error has occurred
TRUE
no
No error has occurred
FALSE
STATUS_
MODBUS
OUT WORD
Error number for protocol errors when

evaluating a Modbus telegram
0 to FFFF
no
STATUS_
CONN
OUT WORD
Error number for connection errors

during execution of the T blocks
(TCON, TSEND, TRCV, TDISON)
0 to FFFF
no
STATUS_FUNC
OUT STRING
[8]
Name of the function, which causes the

error at STATUS_MODBUS or
STATUS_CONN
Character
no
IDENT_CODE
OUT STRING
[18]
Identification for licensing

Please order your registration key
REG_KEY with this identification string.
Character
no
UNIT
IN/
BYTE
OUT
Unit Identifier
(INPUT if in CLIENT mode, OUTPUT if
in SERVER mode)
0 to 255
no
IN/
BYTE
OUT
Data type to be accessed:

in SERVER mode)
DATA_TYPE
Coils
Inputs
Holding registers
Input registers
START_
ADDRESS
IN/
WORD
OUT
MODBUS start address

in SERVER mode)
LENGTH
IN/
WORD
OUT
Number of values to be processed

in SERVER mode)
TI
WRITE_ READ
B#16#0 to
B#16#FF
no
1
2
3
4
0 to 65535
no
Coils
Reading function
Writing function
1 to 2000
1 to 1968
Inputs
Reading function
1 to 2000
Holding Register
Reading function
Writing function
1 to 125
1 to 123
Input Register
Reading function
1 to 125
IN/
WORD
OUT
Transaction Identifier
in SERVER mode)
0 to 65535
IN/
BOOL
OUT
Write access or
Read access
in SERVER mode)
TRUE
FALSE

no
W#16#0000 to
W#16#FFFF
no
W#16#0 to
W#16#FFFF
no
6-6
General
Information
The parameters of the FB MODBUSPN can be divided into two groups:

Initialization parameters
Runtime parameters
Initialization parameters are evaluated only during the call of OB100 and
are adopted into the instance DB. They are marked with yes in the column
INIT in the table displayed above.
A modification of the initialization parameters during run mode has no
impact. After a modification of these parameters (e.g. during the test phase),
the instance DB must be initialized again via a STOP
RUN transition of
the PLC.
Runtime parameters can by modified during the cyclical operation. In the
mode S7 is client, it is not advisable to modify the input parameters while a
request is active. Wait with the next request and the change of the
parameters until the previous request ends with DONE_NDR or ERROR.
In the operation mode S7 is server, the output parameters may only be
evaluated when DONE_NDR is TRUE.
The output parameters are displayed dynamically, i.e. they are only
available for one PLC cycle. They have to be copied to an additional
memory area if you need to process them or to display the values in a VAT
(STEP7 variable table).
Range of Values
For the range of values of the different parameters, PLC-specific restrictions

must be taken into consideration.

6-7
ID
To each connection between the PN PLC and a communication partner a

connection ID is assigned. When operating various connections an individual
ID is required for each logical connection. This connection ID is defined in the
connection parameter block, which is part of the parameter data block
MODBUS_PARAM. The connection ID unambiguously specifies the
connection between the PLC and the communication partner. The ID can be
set to values between 1 and 4095.
The connection ID defined in the connection parameter block has to be
entered here and must be unique within the PLC.
DB_PARAM
The parameter DB_PARAM assigns the number of the data block

MODBUS_PARAM. This parameter data block includes the connection
parameters and the Modbus-specific parameters, which are necessary for the
communication between the PN PLC and the Modbus device.
This parameter is declared in plain text: DBxy.
The range of values for this parameter depends on the PLC. 0 cannot be
used as a DB number since it is reserved for system functions.
The parameter data block can contain a sequence of parameters for several
connections. It is also possible to use different parameter data blocks for
multiple connections.
RECV_TIME
The monitoring time RECV_TIME observes the data input from the
communication partner. The shortest adjustable time is 20 ms.
In the operating mode S7 is client, an indication RECV_TIME < 20 ms
causes an error message and the request is rejected. When the time
RECV_TIME elapses, the active request is cancelled with an error.
In the operating mode S7 is server, an indication RECV_TIME < 20 ms
causes the use of the default time of 1,2s. If the monitoring time elapses, an
error is reported. The RECV_TIME monitors the duration of the TCP stream.
The interval between two requests is not taken into consideration.
CONN_TIME
The monitoring time CONN_TIME observes the connection establishment

and the connection termination. The shortest adjustable time is 100 ms.
When CONN_TIME elapses, the corresponding error code is displayed at the
output STATUS_CONN.
In the operating mode S7 is server, an indication CONN_TIME < 100 ms
causes the use of the default time 5s. This is also true for the operating mode
S7 is client with connect_at_startup = TRUE.
During cyclic operation in the operating mode S7 is client,
CONN_TIME < 100ms causes an error message and the request is rejected.

6-8
ENQ_ENR
Operating mode S7 is Client:

The data transfer is initiated with a rising edge at the input. The request
telegram is generated with the values of the input parameters UNIT,
DATA_TYPE, START_ADDRESS, LENGTH, TI and WRITE_READ. A new
request may only be initiated when the previous one is ended with
DONE_NDR or ERROR.
If the connection is not established (CONN_ESTABLISHED = FALSE), the
connection establishment is carried out first and then the data transfer takes
places.
Operating mode S7 is Server:
The FB is activated with a TRUE signal at the input. Telegrams from the
client can be received.
If the connection is not established (CONN_ESTABLISHED = FALSE), the
connection establishment is activated.
When the parameter ENQ_ENR turns from TRUE to FALSE, the connection
may be terminated depending on the parameter DISCONNECT.
With a FALSE signal at the input and an established connection, data is
received from the client and discarded.
DISCONNECT
In the operating mode S7 is client, the parameter DISCONNECT = TRUE

indicates that the connection is terminated after the completed data transfer.
In the operating mode S7 is server, the parameter DISCONNECT = TRUE
indicates that the connection is terminated when the parameter ENQ_ENR is
set to FALSE.
This parameter is a runtime parameter and can be set optionally according to
your requirements.
REG_KEY
The block MODBUSPN must be licensed for each CPU individually to permit
a correct program sequence.
With the registration key REG_KEY the block MODBUSPN is licensed and
the Modbus communication runs without any restraint.
You can find further information in section 5 Licensing.
LICENSED
If this output is TRUE, then the Modbus block is licensed on this CPU. If the
output is FALSE, none or a faulty license string was entered.
BUSY
If this output is TRUE, one of the T functions TCON, TDISCON, TSEND or

TRCV is running.
CONN_
ESTABLISHED
CONN_ESTABLISHED indicates that a connection to the communication

partner is established and data can be transferred.
If CONN_ESTABLISHED is set to FALSE, the connection to the
communication partner is not established.

6-9
DONE_NDR
The parameter DONE_NDR indicates an error-free execution of the request.

In the operating mode S7 is Client, the activated request was executed
without an error. With a reading function, the response data from the server
has already been entered into the DB. With a writing function, the response to
the request telegram has been received from the server.
In the operating mode S7 is Server, this output indicates a telegram
exchanged without errors. In the parameters UNIT, DATA_TYPE,
START_ADDRESS, LENGTH, TI and WRITE_READ the request parameters
of the client are displayed. These outputs are only available and valid as long
as DONE_NDR is TRUE.
ERROR
When this output is set, an error was recognized.

In the operating mode S7 is Client, the activated request was ended with an
error. The error number is displayed in the STATUS_MODBUS or
STATUS_CONN output.
In the operating mode S7 is Server, an error was detected at a request
telegram of the client or when sending a response telegram. The error
number is displayed in the STATUS_MODBUS or STATUS_CONN output.
STATUS_MODBUS
When ERROR is TRUE, the STATUS_MODBUS output displays the error

number regarding the processing of Modbus telegrams. The error numbers
are described in section 8.
STATUS_CONN
When ERROR is TRUE, the STATUS_CONN output displays the error

number regarding the processing of the T functions. The error numbers are
described in section 8 and in the STEP7 online help of the functions TCON,
TDISCON, TSEND and TRCV.
Status information like job processing active is provided by
STATUS_CONN as well. In this case, the ERROR bit is set to FALSE.
STATUS_FUNC
This parameter shows the name of the function, which caused the error
occurred.
IDENT_CODE
With the identification string IDENT_CODE you can order the registration
key. After start-up of the PLC an 18 character string is displayed.
UNIT
The parameter UNIT, Unit Identifier, describes the unambiguous assignment

of the communication partner. If multiple serial devices are connected to a
TCP converter, it is required to address them by using their unique UNIT
number.
In mode S7 is Client, the parameter UNIT is an input parameter. This input
has to be set according to your requirements. The FB copies this value to the
request telegram and verifies it when receiving the respond telegram.
In mode S7 is Server, the parameter UNIT is an output parameter. The FB
copies this value from the request telegram to the respond telegram. The
output is set with the received value when the job is finished without an error.

6-10
DATA_TYPE
The parameter DATA_TYPE defines which Modbus data type is to be

accessed with the current job. The following data types are available:
Coils
Inputs
Holding Register
Input Register
B#16#1
B#16#2
B#16#3
B#16#4
In the operating mode S7 is Client, DATA_TYPE is an input parameter. In

the operating mode S7 is Server, DATA_TYPE is an output parameter.
The different data types are related directly to the used function codes.
Data type
START_ADDRESS
DATA_
TYPE
Function
Length
single_
write
Function
code
Coils
read
any
irrelevant
Coils
write
TRUE
Coils
write
FALSE
15
Coils
write
>1
irrelevant
15
Inputs
read
any
irrelevant
Holding Register
read
any
irrelevant
Holding Register
write
TRUE
Holding Register
write
FALSE
16
Holding Register
write
>1
irrelevant
16
Input Register
read
any
irrelevant
The parameter START_ADDRESS specifies the first MODBUS address that

is read or written.
In the operating mode S7 is Client, this is an input parameter. In the
operating mode S7 is Server, this is an output parameter.
LENGTH
The parameter LENGTH specifies the number of MODBUS values that are
read or written.
With a reading function, a maximum of 125 registers or 2000 bits is possible
per telegram. With a writing function, a maximum of 123 registers or 1968
bits is possible.
For each telegram, all registers or bits have to be in the same DB.

6-11
The parameter TI (Transaction Identifier) is copied by the server from the

request telegram to the respond telegram according to the MODBUS
specification.
TI
In the operating mode S7 is Client, this is an input parameter. The FB copies

this value to the request telegram and verifies it when receiving the respond
telegram.
In the operating mode S7 is Server, this is an output parameter. The FB
copies this value from the request telegram into the respond telegram.
The Transaction Identifier is used for the identification of telegrams and the
unambiguous allocation of the requests to the corresponding responds. The
FB MODBUSPN can only perform this function properly if the TI is changed
with each transaction. Only a change of the TI ensures a reliable operation of
the FB.
Therefore, we recommend increment the TI by 1 with any request.
WRITE_READ
This parameter defines whether a reading or writing function is to be carried

out. If the value of the input/output is FALSE, the reading mode is specified.
The value TRUE specifies the writing mode.
Holding Registers and Coils are readable and writeable. Inputs and Input
Registers are only readable.
6.3
Example of Address Mapping
Interpretation of
MODBUS Register
Addresses
The MODBUS data model is based on a series of storage areas with distinct
properties. Some systems, e.g. MODICON PLCs, distinguish these areas by
the register or bit addresses. The Holding Register with offset 0, for example,
is called 40001 (memory type 4xxxx, reference 0001).
A potential source of confusion is the varying interpretation of the register
address in different manuals. Sometimes the register or bit address is defined
as the address of the application layer and in other manuals it is the actually
transferred address.
The FB MODBUSPN uses the register or bit address transferred for its
parameters start_x, end_x and START_ADDRESS. Therefore, it is possible
to use register or bit addresses from von 0000H to FFFFH for each function
code.

6-12
Example:
Parameterization
of the Memory
Areas
Address Mapping
data_type_1
db_1
start_1
end_1
data_type_2
db _2
start _2
end _2
data_type_3
db _3
start _3
end _3
data_type_4
db _4
start _4
end _4
data_type_5
db _5
start _5
end _5
data_type_6
db _6
start _6
end _6
data_type_7
db _7
start _7
end _7
data_type_8
db _8
start _8
end _8
B#16#3
W#16#B
W#16#0
W#16#1F3
B#16#3
W#16#C
W#16#2D0
W#16#384
B#16#4
W#16#D
W#16#2D0
W#16#3E8
B#16#0
0
0
0
B#16#1
W#16#E
W#16#280
W#16#4E2
B#16#2
W#16#F
W#16#6A4
W#16#8FC
B#16#1
W#16#10
W#16#6A4
W#16#8FC
B#16#0
0
0
0
Holding Register
DB 11
Start address: 0
End address: 499
Holding Register
DB 12
Start address: 720
End address: 900
Input Register
DB 13
Start address: 720
End address: 900
Not used
0
0
0
Coils
DB 14
Start address: 640
End address: 1250
Inputs
DB 15
Start address:1700
End address: 2300
Coils
DB 16
Start address: 1700
End address: 2300
Not used
0
0
0
The following diagram shows a comparison of the SIMATIC memory area

and the Modbus-typical register oriented storage arrangement. The diagram
is based on the parameterization in the table above.
In Modbus device: The Modbus addresses printed in black refer to the Data
Link Layer and the ones printed in grey refer to the Application Layer.
In SIMATIC: The SIMATIC addresses in the first column are the offset in the
DB. Additionally, you can find the Modbus register numbers in the square
brackets.

6-13
SIMATIC
Modbus decive
Coils (from 00001)
0
00001
...
640
00641
641
00642
...
1250
01251
...
1700
01701
...
Inputs (from 10001)
0
2300
02301
2301
02302
10001
...
1700
11701
1701
11702
...
2300
12301
2301
12302
Input Register
(from 30001)
0
30001
30002
...
720
30721
721
30722
...
Holding Register
(from 40001)
0
40001
40002
1000
31001
1001
31002
...
499
40500
500
40501
501
40502
...
720
40721
...
900
40901
901
40902

6-14
6.4
Data and Standard Functions used by the FB
Instance DB
The function block MODBUS stores its data in an instance DB. This instance
DB is created by STEP7 when initially calling the FB.
The instance data block contains parameters of the types input, output and
input/output as well as static variables required for its execution. These
variables are remanent and keep their validity between FB calls. The
variables control the internal process flow of the FB.
Required memory of the instance-DBs:
Instance-DB
work memory
load memory
MODBUSPN
ca. 1,5 kByte
ca. 3 kByte
Local Variables
A total of max. 156 bytes of local data is needed for one FB MODBUSPN
call.
Parameter DB
The connection- and Modbus-specific parameters are stored in the parameter

data block MODBUS_PARAM.
Timers
The FB does not use any timers.
Flags
The function block does not use any flags.
Standard FBs for

Connection
Handling
The function block TCP_COMM, called by MOD_CLI and MOD_SERV, uses

the blocks TCON and TDISCON of the standard library to establish and
terminate the connection between the PLC and the communication partner.
Standard FBs for

Data Transfer
The function block TCP_COMM, called by MOD_CLI and MOD_SERV, uses

the blocks TSEND and TRCV of the standard library for the data transfer
between the PLC and the communication partner.
MODBUSPN:
SFCs for
Miscellaneous
Functions
The FB MODBUSPN uses the following SFCs from the standard library:
SFC6 RD_SINFO
SFC20 BLKMOV
SFC24 TEST_DB
SFC51 RDSYSST
SFC52 WR_USMSG

6-15
MOD_CLI and
MOD_SERV:
SFCs for
Miscellaneous
Functions
The FBs MOD_CLI and MOD_SERV use the following SFCs from the
standard library:
TCP_COMM:
SFCs for
Miscellaneous
Functions
The FB TCP_COMM uses the following SFB from the standard library in
addition to the T-blocks:
SFC20 BLKMOV
SFC24 TEST_DB
SFB4 TON

6-16
6.5
Renaming / Rewiring Standard Functions
Inducement
If the numbers of the standard functions are already assigned within your
project or if the number interval is reserved for a different application (e.g.
CFC), it is possible to rename the internally called function blocks FB63,
FB64, FB65 and FB66 of FB TCP_COMM or the function blocks
MODBUSPN, MOD_CLI, MOD_SERV und TCP_COMM.
It is not possible to rename the system functions SFC6, SFC20, SFC24,
SFC51, SFC52 and SFB4.
Behavior
A set of rules concerning the function block numbering have to be considered

when rewiring function blocks in SIMATIC STEP 7 Manager:
If you want to rewire the blocks of the Modbus library, the following sequence
is required:
1. FB102 MODBUSPN in a higher FB number
2. FB103 TCP_COMM
3. FB104 MOD_CLI
FB105 MOD_SERV
4. FB63 TSEND
FB64 TRCV
FB65 TCON
FB66 TDISCON
It is not necessary to rewire all blocks. Even if you want to rewire only some
of the blocks, you must follow the mentioned sequence.
Renaming
To rename the blocks proceed as described subsequently:

1. Get the information about the used operand by clicking "Options >
Reference data > Display".
2. Set the operand priority in the object properties of the block folder to
"Absolute value".
3. Select the Blocks folder in the SIMATIC Manager and call the function
"Options > Rewire", in order to rewire the operands into free areas.
4. To be able to keep on using the symbolism in diagnostics tools, add
the modifications to the symbol table supplementary.
The modifications can be verified by clicking "Options > Reference data >
Display".

6-17
Additional Blocks
Additional Blocks
7.1
Add-On for CFC
General
The add-on offers the possibility to configure Modbus registers/bits in data

collector FBs instead of global DBs. The send buffer and receive buffer for
the values can be placed in the CFC chart per Drag & Drop.
Application Sample
The data collector FBs are located in the CFC chart. The output IDB is
connected to the DB parameters db_1 to db_8 of the parameter data block. In
CFC it is not possible to address an element in a STRUCT with the symbolic
name, so the absolute address of db_x needs to be entered, e.g.
MODBUS_PARAM.DBW68.
With this configuration the Modbus values can be connected directly from the
channel blocks to the data collector FB.
You can find the additional blocks and a detailed description here:
www.siemens.com/s7modbus or contact the Customer Support.

7-1
Additional Blocks
7.2
Job List for Cyclical Telegram Transfer
General
By means of the block Job_List it is possible to generate a list of jobs, which

are executed cyclically.
Application Sample
You can find the additional block and a detailed description here:
www.siemens.com/s7modbus or contact the Customer Support.

7-2
Diagnosis
Diagnosis
Diagnostic
Function
The diagnostic functions of the PN PLC enable a fast localization of errors.

The following diagnostic features are available:
Diagnosis via the display elements of the PLC
Diagnosis via the STATUS_MODBUS and STATUS_CONN output of the
MODBUSPN function block.
Display Elements
(LED)
The display elements inform you about the operating mode or about the error
conditions of the PLC. The display elements provide an overview of internal
errors, external errors and interface-specific errors.
STATUS Outputs
of the
FB MODBUSPN
For an error diagnosis, the MODBUSPN function block has 3 STATUS

outputs.
When reading the STATUS_MODBUS output, you are provided with a
general indication of errors that occurred during the Modbus-specific telegram
processing.
The STATUS_CONN output displays status information and error codes with
regard to the processing of the T functions.
The output STATUS_FUNC shows the name of the function, which caused
the error at STATUS_MODBUS or STATUS_CONN.
When reading the STATUS outputs, you are provided with a general
indication of errors that occurred during the telegram processing and
connection handling. The STATUS parameters can be evaluated in the user
program.

8-1
Diagnosis
8.1
Diagnosis via the Display Elements of the PLC
Display Functions
The display elements of the PLC provide information on the status of the
component. There are two types of display functions:
Group Error Displays
PN CPU 300 and IM 151-8 PN/DP CPU
- SF
Group error
When this LED is flashing, the Modbus block has not been licensed yet.
PN-CPU 400
- INTF
Internal error
When this LED is flashing, the Modbus block has not been licensed yet.
Special Displays
PN CPU 300, PN CPU 400 and IM 151-8 PN/DP CPU:
- RX/TX a telegram is transferred via the integrated interface
A detailed description of the display elements can be found in the device

manual of the PLC.

8-2
Diagnosis
8.2
Verification by the FB MODBUSPN
During Start-up
Unambiguousness of the id parameter in the connection parameters

of DB MODBUS_PARAM
Parameter group data_type_x, db_x, start_x, end_x. (x = 1 to 8)
1. With data_type_x = 0 the Modbus area is disabled and not
further verified. At least the first area (_1) has to be
parameterized.
2. Validity check of data_type_x
3. db_x <> 0
4. DB length: db_x >= (end_x start_x) + 2 byte
5. Test end_x >= start_x
6. Modbus addresses for the same data type defined in two
db_x lead to an error message (address overlap).
Errors during start-up provoke the ERROR bit to remain set. In the cyclical
operation no requests are executed. A correction of the parameterization and
a STOP
RUN transition of the PLC are necessary.
Cyclical Operation
S7 is Client
Verification when the FB is called:

Valid registration key
DB MODBUS_PARAM is available with the necessary length
Range of values of monitoring time RECV_TIME and CONN_TIME
Range of values of START_ADRESS
Range of values of LENGTH
When executing a request, there also is a check whether the data
block specified by the register or bit address is available and has the
necessary length. The DB number must not be 0 and/or identical to
the number of MODBUS_PARAM or the instance DB.
Receipt of the response telegram within the monitoring time
The monitoring time can also elapse if less data than specified in the
MODBUS telegram header is received. Subsequent errors with loss
of telegrams can occur.

8-3
Diagnosis
Verification in the response telegram:

Received transaction identifier is equal to the sent one.
Protocol identifier = 0
Length is between 3 and 253
Additionally, the length in the header of the response telegram is
checked for plausibility regarding the request.
Sent Unit identifier is equal to the received one
Sent FC is equal to the received one
Response is an exception code telegram
For write requests, the start address and number of registers/bits
have to match with the request telegram.
FC 5 or FC 6:
Echo in the respond is equal to the request
Cyclical Operation
S7 is Server
Valid registration key

Receipt of the second part of the request telegram within the
monitoring time
The monitoring time can also elapse if less data than specified in the
MODBUS telegram header is received. Subsequent errors with loss
of telegrams can occur.
Protocol Identifier = 0
Length between 6 and 207
Received function code is verified. If the function code is not equal to
1, 2, 3, 4, 5, 6, 15 or 16 an exception telegram is sent.
For write requests, the length in the header, the number of registers
or bits and the byte count in the telegram must match.
The number of registers or bits is verified. If the number is too large,
an exception telegram is sent.
During the execution of a request, there is also a check whether the
data block specified by the register or bit address is available and has
the necessary length. The DB number must not be 0 or identical to
the number of MODBUS_PARAM or the instance DB. In case of an
error, an exception telegram is sent.

8-4
Diagnosis
Termination of the
Connection in
Case of Error
In special error situations, the FB terminates the connection:

Monitoring time for connection establishment exceeded
Monitoring time for receive exceeded
PI <> 0
received TI different to sent TI
Length in the header does not match the length information in the
telegram

8-5
Diagnosis
8.3
Diagnosis Messages of the FB MODBUSPN
Messages at the
STATUS Outputs
of the FB
The block MOBUSPN has 3 status outputs: STATUS_MODBUS,

STATUS_CONN and STATUS_FUNC.
STATUS_MODBUS displays the error numbers and status information
regarding the processing of Modbus telegrams, whereas STATUS_CONN
displays the error numbers regarding the connection handling.
STATUS_FUNC shows the name of the function, which caused the error.
STATUS is valid when ERROR is TRUE. Below you can find a list of FBspecific error messages.
Error Messages of
the Called SFCs
and FBs
The FBs MODBUSPN, MOD_CLI and MOD_SERV use the standard

functions SFC6, SFC20, SFC24, SFC51 und SFC52. The error messages of
these blocks are passed on to STATUS_MODBUS without any changes.
The block TCP_COMM, called by MOD_CLI or MOD_SERV, uses the
standard blocks SFB4, FB63, FB64, FB65 and FB66. The error messages of
these blocks are passed on to STATUS_CONN without any changes.
For further details on the error messages, please consult the diagnosis buffer
or the online help of the SIMATIC Manager.
Error messages of FB MODBUSPN at the output STATUS_MODBUS

STATUS Event text
Remedy
(Hex)
A001
The parameter data block MODBUS_PARAM is too

short.
Correct the length of

MODBUS_PARAM
A002
The parameter end_x is less than start_x.
Correct the parameterization in

DB MODBUS_PARAM
A003
The DB to which MODBUS addresses shall be mapped

is too short.
Minimum length:
- register values (end_x - start_x + 1) * 2 + 2
- bit values (end_x - start_x ) / 8 + 1 + 2
Extend the DB.

S7 is Client: Correct the
parameters START_ADDRESS
or LENGTH
Other possible reasons:
S7 is Server:
Modify the request of the client.
S7 is client: Wrong initialization parameter

S7 is server: Wrong address area in the request
telegram of the client. The S7 sends an
exception telegram.
A004
Applies only if S7 is client:

An invalid combination of DATA_TYPE and
WRITE_READ is given.
Correct the parameters. Only

data type 1 or 3 can be written.

8-6
Diagnosis
Error messages of FB MODBUS MODBUSPN at the output STATUS_MODBUS

STATUS Event text
Remedy
(Hex)
A005
S7 is client:
An invalid value for the parameter LENGTH is given.
S7 is Server:
The number of registers/bits in the request telegram is
invalid. The S7 sends an exception telegram.
Range of values:
Read coils/inputs: 1 to 2000
Write coils: 1 to 1968
Read registers: 1 to 125
Write holding registers: 1 to 123
A006
The given range of registers defined with DATA_TYPE,

START_ADDRESS and LENGTH does not exist in
data_type_1 to data_type_8.
S7 is server:
The S7 sends an exception telegram.
S7 is Client:
Correct the parameter
LENGTH.
S7 is Server:
Modify the number in the
request telegram.
S7 is Client:
Correct the parameter
combination DATA_TYPE,
START_ADDRESS, LENGTH.
S7 is Server:
Modify the request of the client
or correct the parameterization
in the MODBUS_PARAM.
A007
Only if S7 is client:
Correct the parameterization.
An invalid monitoring time RECV_TIME or CONN_TIME
is parameterized.
The RECV_TIME has to be at least 20 ms, CONN_TIME
100ms
A009
The received transaction identifier TI is not equal to the
sent one.
The connection is terminated.
A00A
The received UNIT is not equal to the sent one.
A00B
S7 is client:
Received function code is not equal to the sent one.
S7 is server:
An invalid function code was received.
The S7 sends an exception telegram.
S7 is client:
Verify the data of the
communication partner with the
help of a telegram trace.
S7 is server:
The FB MODBUS only
supports the function codes 1,
2, 3, 4, 5, 6, 15 and 16.
A00C
The received byte count does not match the number of

registers.


A00D
The register or bit address respectively the number of
registers or bits in the response telegram is not equal to
the one in the request telegram.
A00E
The length indicated in the MODBUS-specific telegram

header does not match the number of registers/bits or
the byte count in the telegram. The FB ignores all data.


8-7
Diagnosis

STATUS Event text
Remedy
(Hex)
A00F
A protocol identifier <> 0 was received.


A010
In the parameters db_1 to db_8 a DB number is used

twice.

DB MODBUS_PARAM.
A011
An invalid value for DATA_TYPE is given (Value range:

1 to 4).
Correct the parameters.
A012
The parameterized areas data_type_1 and data_type_2

overlap.

DB MODBUS_PARAM.
A013

overlap.
A014

overlap.
The data areas must not

contain any overlapping
register areas.
A015

overlap.
A016

overlap.
A017

overlap.
A018

overlap.
A019
0 is assigned to one of the parameters db_x while the

DB MODBUS_PARAM.
according data_type_x is <> 0.
DB 0 cannot be used; it is reserved for system functions.
A01A
Wrong length in the Modbus header (1 to 253 byte are

valid).

A01B
S7 is server and function code 5:

An invalid value for coils was received.
S7 sends an exception telegram.

A023

overlap.

DB MODBUS_PARAM
A024

overlap.
A025

overlap.

register areas.
A026

overlap.
A027

overlap.
A028

overlap.
A034

overlap.

8-8
Diagnosis

STATUS Event text
Remedy
(Hex)
A035

overlap.

DB MODBUS_PARAM
A036

overlap.
A037

overlap.

register areas.
A038

overlap.
A045

overlap.
A046

overlap.
A047

overlap.
A048

overlap.
A056

overlap.
A057

overlap.
A058

overlap.
A067

overlap.
A068

overlap.
A078

overlap.
A079
The connection ID of parameter ID is not defined in DB

MODBUS_PARAM.
A07A
An invalid value ID is parameterized. Range of values is

1 to 4095.
A07B
The parameter ID exists twice in the parameter DB.
A07C
An invalid value data_type_x was given. The value

range is 0 to 4.
A07D
Parameter data_type_1 is not defined. The parameter

area _1 is the default area and must be defined.
A07E
The DB number of db_x is identical to the number of the

parameter DB MODBUS_PARAM or to the instance DB.
A07F
The data block defined at DB_PARAM is no parameter

DB for Modbus communication. The length information
in DBW0 was changed or a wrong DB was defined.
Correct the parameterization at

the input ID.

DB MODBUS_PARAM.
Correct the parameterization at

the input DB_PARAM.

8-9
Diagnosis

STATUS Event text
Remedy
(Hex)
A080
The parameter DB_PARAM was changed without a

restart of the CPU.
This error code is also reported, when FB MODBUSPN
is called with different instance DBs in OB1 or cyclic
interrupt OB and OB100.
DB_PARAM is an initialization
parameter. Restart the CPU
after changing this parameter.
A081
Only if S7 is client and function code 5:

The received coil status is not equal to the sent one.

A082
Only if S7 is client and function code 6:

The received register value is not equal to the sent one.

A083
A request was initiated prior to the completion of the
previous one.
Wait with the initiation of a new

request until the previous one
was finished either with
DONE_NDR = TRUE or
ERROR = TRUE.
This is a status information. The bit ERROR is not set.

A084
The character string for identification IDENT_CODE

could not be determined.
Please contact the Product

Support.
A085
An error occurred during the license handling.
Verify the project if there is any

invalid write access to the
license DB. Please contact the
Product Support.
A086
A write operation was executed into a write protected

data block.
Delete the write protection of

the data block or use another
DB.
A090
The block MODBUSPN is not licensed for this CPU.

This is a status information. The bit ERROR is not set.
The Modbus communication runs without a license as
well.
Read the identification string

IDENT_CODE for this CPU and
order the registration key.
See also section 5 Licensing.
A091
An exception telegram with exception code 1 was

received (only if S7 is client)
The communication partner

does not support the requested
function.
A092

Correct LENGTH or
START_ADDRESS at the call
of the FB.
An attempt to an invalid or non existing address at the

communication partner was made.
A093

The communication partner

cannot process the received
request (e.g. does not support
the requested length).
A094

The communication partner is

in a state, in which the received
request cant be processed.
A095
An exception telegram with an unknown exception code

was received (only if S7 is client).
Check the error message of the

communication partner and
verify the data with a telegram
trace if needed.

8-10
Diagnosis
Error messages of FB MODBUSPN at the output STATUS_CONN

STATUS Event text
Remedy
(Hex)
A100
The monitoring time CONN_TIME or RECV_TIME was Check the parameterization of

the connection.
exceeded when executing a job.
When RECV_TIME is exceeded, the connection is
terminated.
A101
The monitoring time of TDISCON is exceeded.
Please contact the product

support.

8-11
Diagnosis
8.4
Diagnosis Messages of Called Blocks
Error messages of SFC 6 and SFC 20 at the output STATUS_MODBUS

STATUS Event text
Remedy
(Hex)
7xxx
For detailed information please refer to the online help See online help (SIMATIC
of SIMATIC Manager.
manager -> mark block -> key
F1)
8xxx
of SIMATIC Manager.
F1)
Error messages of FB 63, FB 64, FB 65 and FB 66 at the output STATUS_CONN

STATUS Event text
Remedy
(Hex)
7xxx
of SIMATIC Manager.
F1)
8xxx
of SIMATIC Manager.
F1)
8.5
Diagnosis Messages of SFC24
Error messages of SFC24 at the output STATUS_MODBUS

STATUS Event text
Remedy
(Hex)
80A1
DB Number = 0 or too large for the PLC
Choose a valid DB number.

Use the same IDB for the call of
MODBUSPN in OB1 or cyclic
interrupt OB and OB100.
80B1
The DB does not exist in the PLC.
All data blocks that are specified

in DB_x must be created and
copied into the PLC.
80B2
DB UNLINKED
DB must not be created as

UNLINKED.

8-12
Application Sample
Sample Application
General
Information
With the installation 2 sample projects are stored in \Program

Files\Siemens\Step7\Examples.
sample project MB_PN_CPU written in STL and
sample project MB_PN_CPU_CFC written in CFC.
The S7 programs are for information purposes only and are not to be
understood as a solution for a customer specific installation configuration.
Example Project
on the CD
On the CD you can find an extensive example project which offers all
varieties of parameterization possibilities for the Simatic stations.
Simatic Station is S7-300, S7-400 or IM 151-8 PN/DP CPU
Simatic Station is client or server
9.1
Example project in AWL
Programming
Example
The programming example consists of the blocks:

Start-Up OB100 with call of FB102
OB121 programming error
Cyclic program processing OB1 with call of FB102
Global DBs for job trigger e.g. with variable table and for licensing
Data blocks for register values and bit values

9-1
Application Sample
Overview
Used Blocks
This block numbers are used in the provided example project.

Block
Symbol
Comment
OB 1
CYCL_EXC
cyclic program processing
OB 100
COMPLETE RESTART
start-up OB for restart
OB 121
PROG_ERR
programming error OB
FB 102
MODBUSPN
FB MODBUSPN
FB 103
TCP_COMM
FB TCP_COMM
FB 104
MOD_CLI
FB MOD_CLI
FB 105
MOD_SERV
FB MOD_SERV
DB 1
CONTROL_DAT
work DB CONTROL DAT for FB

MODBUSPN
DB 2
MODBUS_PARAM
parameter DB PARAM_DB for FB

MODBUSPN
DB 3
LICENSE_DB
license data block for FB MODBUSPN
DB 11
Holding Register Area
value DB for area 1
DB 12
Holding Register Area2
value DB for area 2
DB 13
Input Register Area
value DB for area 3
DB 14
Coils Area
value DB for area 5
DB 15
Inputs Area
value DB for area 6
DB 16
Coils Area 2
value DB for area 7
DB 102
IDB_MODBUS
instance DB for FB MODBUSPN

9-2
Application Sample
9.2
Example project in CFC
Overview
Used Blocks
The following blocks are used in the provided sample project.

Block
Symbol
Comment
FB 99
Save_STATUS
Error buffer
FB 102
MODBUSPN
FB MODBUSPN
FB 103
TCP_COMM
FB TCP_COMM
FB 104
MOD_CLI
FB MOD_CLI
FB 105
MOD_SERV
FB MOD_SERV
DB 1
MEMORY_DB
For server: Memory-DB
DB 2
MODBUS_PARAM
parameter DB PARAM_DB for FB

MODBUSPN
DB 3
LICENSE_DB
license data block for FB MODBUSPN
DB 11
Holding Register Area
value DB for area 1
DB 12
Holding Register Area2
value DB for area 2
DB 13
Input Register Area
value DB for area 3
DB 14
Coils Area
value DB for area 5
DB 15
Inputs Area
value DB for area 6
DB 16
Coils Area 2
value DB for area 7

9-3
A Literature
MODBUS
Organization
MODBUS APPLICATION PROTOCOL SPECIFICATION

V1.1b3, April 26, 2012
http://www.modbus.org

Literature - 1
Customer Support
Siemens AG
Industry Sector
Industry Automation Division / Industrial Automation Systems
Factory Automation
I IA AS FA
Phone: +49 (0)911 895 7 222
Customer Support
http://www.siemens.com/s7modbus
Siemens Aktiengesellschaft
Subject to change without notice

release: 07/2014

Modbus TCP PN CPU English

Uploaded by

Copyright:

Available Formats

Modbus TCP PN CPU English

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Modbus TCP PN CPU English

Uploaded by

Copyright:

Available Formats

What safety precautions are mentioned in the document?

What safety precautions are mentioned in the document?

What components are used in the sample Modbus/TCP application?

What components are used in the sample Modbus/TCP application?

SIMATIC

SIMATIC Modbus/TCP Communication

Preface, Table of Contents

Safety Precautions and

SIMATIC and SIMATIC NET are registered trademarks of SIEMENS AG.

Siemens AG 2008-20013 All Rights Reserved

Passing on and reproducing this document as well as using and

This manual is valid for the following software:

Modbus/TCP communication via the integrated PN interface of the CPU

All additional information concerning PN PLCs and IM 151-8 PN/DP CPU

The function block described in this manual establishes a connection

Modbus/TCP communication via the integrated PN interface of the CPU

Product Description ................................................................................................... 1-1

Field of Applications ...................................................................................... 1-1

Hardware and Software Requirements .......................................................... 1-1

Getting Started ........................................................................................................... 2-1

Commissioning .......................................................................................................... 3-1

Installing the Library on the STEP7 PG/-PC .................................................. 3-1

PLC Assigning the IP Address .................................................................... 3-2

Insertion of the Function Blocks into the Program .......................................... 3-4

Multiple Connections via Port 502 ................................................................. 3-5

Parameterization of the Modbus Communication.................................................... 4-1

Parameterization with the Wizard .................................................................. 4-2

Editing the Parameterization ......................................................................... 4-3

Licensing .................................................................................................................... 5-1

Function Block MODBUSPN ..................................................................................... 6-1

Functionality of the FB .................................................................................. 6-1

Parameters of the Function Block MODBUSPN ............................................ 6-5

Example of Address Mapping ...................................................................... 6-12

Data and Standard Functions used by the FB .............................................. 6-15

Renaming / Rewiring Standard Functions .................................................... 6-17

Additional Blocks....................................................................................................... 7-1

Add-On for CFC ............................................................................................ 7-1

Job List for Cyclical Telegram Transfer ......................................................... 7-2

Diagnosis ................................................................................................................... 8-1

Diagnosis via the Display Elements of the PLC ............................................. 8-2

Verification by the FB MODBUSPN ............................................................... 8-3

Modbus/TCP communication via the integrated PN interface of the CPU

Diagnosis Messages of the FB MODBUSPN ................................................. 8-6

Diagnosis Messages of Called Blocks ......................................................... 8-12

Diagnosis Messages of SFC24 .................................................................... 8-12

Sample Application .................................................................................................... 9-1

Example project in AWL................................................................................ 9-1

Example project in CFC ................................................................................ 9-3

Modbus/TCP communication via the integrated PN interface of the CPU

These function blocks enable communication between a Simatic PLC with

Hardware and Software Requirements

You can find the latest hardware requirements on the internet:

The usage of the FB MODBUSPN is possible with STEP7 Version 5.5 or

Modbus/TCP communication via the integrated PN interface of the CPU

Modbus/TCP communication via the integrated PN interface of the CPU

Modbus/TCP communication via the integrated PN interface of the CPU

Knowledge of AWL and basic knowledge of STEP7 and PLC is required.

Installing the Library on the STEP7 PG/-PC

The attached CD contains a setup which installs the library

STEP7 has to be installed.