s7300400 CM PTP Programming Manual en-US en-US

___________________
PtP communication instructions used withPreface

distributed I/O of
an S7-300/400 ___________________
Documentation guide 1
___________________
Introduction 2
SIMATIC Programming -
___________
3
communication using
instructions
ET 200MP/ET 200SP
PtP communication instructions ___________________
4
Error messages
used with distributed I/O of an
S7‑300/400
___________________
Service & Support A
Programming Manual
01/2013
A5E31625081-AA
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by personnel qualified for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.
Siemens AG A5E31625081-AA Copyright © Siemens AG 2013.

Industry Sector Ⓟ 12/2012 Technical data subject to change All rights reserved
Postfach 48 48
90026 NÜRNBERG
GERMANY
Preface
Purpose of the documentation

This documentation provides important information on programming the point-to-point
communication modules of the ET 200MP and ET 200SP in an S7-300/400 system with the
instructions developed for TIA-Portal V12 (distributed use).
Basic knowledge required

The following knowledge is required in order to understand the documentation:
● General knowledge of automation technology
● Knowledge of the industrial automation system SIMATIC
● Knowledge about the use of Windows-based computers
● Proficiency with STEP 7
Validity of the documentation

This documentation is valid for the following point-to-point communication modules
● CM PtP RS232 BA (6ES7540-1AD00-0AA0) communication module
● CM PtP RS422/485 BA (6ES7540-1AB00-0AA0) communication module
● CM PtP RS232 HF (6ES7541-1AD00-0AB0) communication module
● CM PtP RS422/485 HF (6ES7541-1AB00-0AB0) communication module
● CM PtP (6ES7137-6AA00-0BA0) communication module
Conventions
The term "CPU" is used in this manual to refer to both the CPUs of the S7-300/400 and the
interface modules of the distributed I/O system.
Please also observe notes labeled as follows:
Note
The notes contain important information on the product described in the documentation, on
the handling of the product or on part of the documentation to which particular attention
should be paid.
PtP communication instructions used with distributed I/O of an S7‑300/400

Programming Manual, 01/2013, A5E31625081-AA 3
Preface
Recycling and disposal

The products can be recycled due to their low pollutant content. For environmentally
compliant recycling and disposal of your old device, please contact a company certified for
the disposal of electronic waste.
Additional assistance
● Information about the Technical support (http://www.siemens.com/automation/support-
request) available can be found in the appendix to this documentation.
● The range of technical documentation for the individual SIMATIC products and systems
can be found on the SIMATIC Portal (http://www.siemens.com/simatic-tech-doku-portal).
● The online catalog and the ordering system are available in the Catalog
(http://mall.automation.siemens.com).
Note on IT security
Siemens offers IT security mechanisms for its automation and drive product portfolio in order
to support the safe operation of the plant/machine. We recommend that you inform yourself
regularly on the IT security developments regarding your products. You can find information
on this on the Internet (http://support.automation.siemens.com).
You can register for a product-specific newsletter here.
For the safe operation of a plant/machine, however, it is also necessary to integrate the
automation components into an overall IT security concept for the entire plant/machine,
which corresponds to the state-of-the-art IT technology. You can find information on this on
the Internet (http://www.siemens.com/industrialsecurity).
Products used from other manufacturers should also be taken into account here.

4 Programming Manual, 01/2013, A5E31625081-AA
Table of contents
Preface ...................................................................................................................................................... 3
1 Documentation guide................................................................................................................................. 7
2 Introduction................................................................................................................................................ 9
2.1 Convention .....................................................................................................................................9
2.2 Overview of instructions.................................................................................................................9
3 Programming - communication using instructions.................................................................................... 13
3.1 Point-to-point................................................................................................................................13
3.1.1 Overview PtP communication ......................................................................................................13
3.1.2 Using the instructions...................................................................................................................16
3.1.3 Shared parameters for point-to-point operations .........................................................................18
3.1.4 Port_Config: Configure PtP communication port .........................................................................20
3.1.5 Send_Config: Configure PtP sender............................................................................................23
3.1.6 Receive_Config: Configure PtP recipient.....................................................................................25
3.1.7 P3964_Config: Configuring the 3964(R) protocol ........................................................................30
3.1.8 Send_P2P: Sending data.............................................................................................................32
3.1.9 Using LENGTH and BUFFER parameters in communication operations ...................................34
3.1.10 Receive_P2P: Receiving data......................................................................................................35
3.1.11 Receive_Reset: Clear receive buffer ...........................................................................................36
3.1.12 Signal_Get: Read status ..............................................................................................................37
3.1.13 Signal_Set: Set accompanying signals........................................................................................38
3.1.14 Get_Features: Get extended functions ........................................................................................39
3.1.15 Set_Features: Set extended functions.........................................................................................40
3.2 Modbus ........................................................................................................................................41
3.2.1 Overview of the Modbus RTU communication ............................................................................41
3.2.2 Modbus_Comm_Load: Configure communication module for Modbus .......................................43
3.2.3 Modbus_Master: Communicate as Modbus master ....................................................................46
3.2.4 Modbus_Slave: Communicate as Modbus slave .........................................................................53
3.2.5 Frame structure............................................................................................................................58
3.3 USS..............................................................................................................................................65
3.3.1 Overview of USS communication ................................................................................................65
3.3.2 Requirements for using the USS protocol ...................................................................................67
3.3.3 USS_Port_Scan: Communication by means of a USS network ..................................................71
3.3.4 USS_Drive_Control: Preparing and displaying data for the drive ................................................74
3.3.5 USS_Read_Param: Read data from drive ...................................................................................77
3.3.6 USS_Write_Param: Change data in drive....................................................................................79
3.3.7 General information on drive setup..............................................................................................81
4 Error messages ....................................................................................................................................... 85
A Service & Support.................................................................................................................................. 101
Glossary ................................................................................................................................................ 105
Index...................................................................................................................................................... 109

Table of contents

Documentation guide 1
Introduction
This modular documentation of the SIMATIC products covers diverse topics concerning your
automation system.
The complete documentation for the S7-300/400, ET 200MP/SP systems consists of the
relevant operating instructions, manuals and product information.
Overview of documentation on the topic of point-to-point communication

The table below includes additional documentation which amends this description.
Subject Documentation Important contents

System System manual ET 200SP distributed I/O • Application planning
system
• Installing
(http://support.automation.siemens.com/WW/vi
ew/en/58649293) • Connecting
System manual ET 200MP distributed I/O • Addressing
system • Commissioning
ew/en/59193214) • Maintenance
Communication Function manual Communication • Basics of serial
(http://support.automation.siemens.com/WW/vi communication
ew/en/59192925)
• Data transmission functions
• Diagnostic functions
Device manual CM PtP RS232 BA • Product overview
communication module
• Connecting
ew/en/59057152) • Assigning parameters
Device manual CM PtP RS232 HF • Programming
communication module • Diagnostics
ew/en/59057160)
Device manual CM PtP RS422/485 BA
ew/en59057390)
Device manual CM PtP RS422/485 HF
ew/59061372)
Device manual CM PtP communication module
ew/en/59061378)

Documentation guide
Subject Documentation Important contents

System Function manual System diagnostics For S7-1500, ET 200MP,
diagnostics (http://support.automation.siemens.com/WW/vi ET 200SP:
ew/en/59192926)
• Diagnostic evaluation
Hardware/software
Setup Function manual EMC/EMI compatible • Basics
installation of control systems
• Electromagnetic
ew/en/59193566) compatibility
• Lightning protection
SIMATIC Manuals
The latest manuals of SIMATIC products are available on the Internet
(http://www.siemens.com/automation/service&support) and can be downloaded free of
charge.

Introduction 2
2.1 Convention
TIA Portal terminology
Note
TIA Portal terminology is used in this documentation.
• Instruction
For the description of the blocks for point-to-point, Modbus and USS, this means that the
differentiation between FB and SFB and between FC and SFC familiar to you from the
S7-300/400 environment is no longer relevant and reference is now made only to
instructions.
All instructions are no longer dependent on the CPU used, but rather can be used both
for S7-300/400 (distributed in an ET 200MP/SP) and for S7-1500 (central and
distributed).
• Communication module
For the description of the devices, this means that the term "communication processor"
familiar to you from the S7-300/400 environment is replaced by "communication module".
2.2 Overview of instructions
Note
Use of the instructions
In order to be able to use the instructions described below in an S7-300/400-Umfeld
(distributed in an ET 200MP/SP), you need to have integrated the required library in your
STEP 7 (SIMATIC Manager) via a HSP (Hardware Support Package).
The following libraries are available:
• Punkt-zu-Punkt: PtP Communication, PtP_Comm
• Modbus (RTU): MODBUS ( RTU ), MODBUS_(RTU)
• USS: USS Communication, USS_Comm

Introduction
Overview of the instructions

The communication protocols are implemented on the communication module. The protocol
is used to adapt the interface of the communication module to the interface of the
communication partner.
Communication between the CPU, the communication module and a communication partner
takes place by means of special instructions and protocols that support the corresponding
communication modules.
The instructions form the software interface between the CPU and the communication
module. They must be called cyclically from the user program. Data transmission takes place
across several cycles.
Table 2- 1 Instructions for PtP
Instruction Meaning
Port_Config The instruction Port_Config allows you to dynamically assign basic interface
(Page 20) parameters.
Send_Config The instruction Send_Config (send configuration) allows you to dynamically
(Page 23) assign send parameters of a port.
Receive_Config The instruction Receive_Config (receive configuration) allows you to dynamically
(Page 25) assign receive parameters of a port.
P3964_Config The instruction P3964_Config (protocol configuration) allows you to dynamically
(Page 30) assign the parameters of the 3964(R) procedure.
Send_P2P The instruction Send_P2P allows you to send data to a communication partner.
(Page 32)
Receive_P2P The instruction Recveive_P2P allows you to receive data from a communication
(Page 35) partner.
Receive_Reset The instruction Receive_Reset allows you to clear the receive buffer of the
(Page 36) communication module.
Signal_Get The instruction Signal_Get allows you to read the RS232 accompanying signals.
(Page 37)
Signal_Set The instruction Signal_Set allows you to set the RS232 accompanying signals.
(Page 38)
Get_Features The instruction Get_Features allows you to read the extended functions
(Page 39) supported by the communication module.
Set_Features The instruction Set_Features allows you to activate the extended functions
(Page 40) supported by the communication module.

Introduction
Table 2- 2 Instructions for USS
Instruction Meaning
USS_Port_Scan The instruction USS_Port_Scan allows you to communicate by means of the
(Page 71) USS network.
USS_Drive_Control The instruction USS_Drive_Control allows you to swap data with the drive.
(Page 74)
USS_Read_Param The instruction USS_Read_Param allows you to read parameters from the
(Page 77) drive.
USS_Write_Param The instruction USS_Write_Param allows you to change parameters in the
(Page 79) drive.
Table 2- 3 Instructions for Modbus
Instruction Meaning
Modbus_Comm_Load The instruction Modbus_Comm_Load allows you to configure the port of
(Page 43) the communication module for Modbus RTU. .
Modbus_Master The instruction Modbus_Master allows you to communicate as Modbus
(Page 46) master by means of the PtP port.
Modbus_Slave The instruction Modbus_Slave allows you to communicate as Modbus
(Page 53) slave by means of the PtP port.

Introduction

Programming - communication using instructions 3
3.1 Point-to-point
3.1.1 Overview PtP communication

STEP 7 has extended instructions that the user program can use for point-to-point
communication via a protocol specified in the user program. These instructions can be
divided into two categories:
● Configuration instructions
● Communication instructions
Note
CPU quantity structures
The point-to-point instructions communicate with the communication modules by reading or
writing data records.
When using the instructions, you should therefore check the quantity structure of the CPU for
reading and writing data records.
If multiple instructions need to read or write data records simultaneously on a CPU, there
may need to be a gap between the calls of each instruction by the user program.
Configuration instructions
Before the user program can start the PtP communication, the communication interface and
the parameters for sending and receiving of data must be configured.

Programming - communication using instructions
3.1 Point-to-point
The interface configuration and the data configuration can be set for each CM in the device
configuration or with the following instructions of your user program:
● Port_Config (Page 20)
● Send_Config (Page 23)
● Receive_Config (Page 25)
● P3964_Config (Page 30)
NOTICE
Device configuration <-> Configuration instructions
The device configuration parameters are transferred to the CM upon each Power On of the
CPU (return of voltage).
The parameters of the configuration instructions are transferred to the CM as defined in
your user program.
The parameters of the device configuration are not synchronized with the parameters of the
configuration instructions, i.e. the parameters of the configuration instructions are not
applied to the CPU device configuration.
With your user program, you determine which parameters apply in the CM and when.
Communication instructions
The user program uses the instructions for point-to-point communication to send data to and
receive data from the communication interfaces. The CMs send data to and receive data
from the communication stations. The protocol is located in a buffer that is received from or
sent to a specific communication interface.
● Send_P2P (Page 32)
● Receive_P2P (Page 35)
Note
Data consistency
If the data to be sent is to be transmitted consistently, it may not be changed after the
positive edge at the REQ parameter until DONE has been set by the Send_P2P parameter.
If the receive data is to be read consistently, it may only be evaluated when NDR = true.
The receive buffer can be reset with additional instructions and special RS232 signals can
be queried and set.
● Receive_Reset (Page 36)
● Signal_Get (Page 37)
● Signal_Set (Page 38)

3.1 Point-to-point
The following instructions let you read or write extended functions, as long as these are
supported by the module.
● Get_Features (Page 39)
● Set_Features (Page 40)
All PtP instructions are asynchronous, i.e. the user program is not paused until the
instruction has been completed. The instruction must therefore be called until the output
parameter DONE indicates that execution is complete.
The user program can determine the send and receive status with the help of the query
architecture. Send_P2P and Receive_P2P can be run at the same time. The communication
modules buffer the send and receive data as required until a module-specific maximum
buffer size has been reached.
Note
Resolution of bit times
The number of bit times is specified with the configured data transmission rate for different
parameters. Specifying the parameter in bit times makes it independent of the data
transmission rate. All parameters with units of bit times can be specified with a maximum
number of 65535. However, the maximum time period that can be measured by a CM is 8
seconds.

3.1 Point-to-point
3.1.2 Using the instructions

The point-to-point instructions must be called cyclically to query received data. The query of
the send process signals to the user program when transmission is complete.
Depending on the data volume, data transmission may take place over several calls
(program cycles).
A command which is processed with DONE = TRUE or NDR = TRUE has been executed
without errors.
Note
STATUS backup
The parameters DONE, NDR, ERROR and STATUS are only available for one block cycle.
To display the STATUS, you should therefore copy STATUS to a free data area.
Master
Typical sequence for a master:
1. The Send_P2P instruction triggers transmission to the CM.
Data transmission is initiated by a positive edge at the REQ input.
2. The Send_P2P instruction is executed in subsequent cycles to query the status of the
transmission process.
3. When the Send_P2P instruction signals that transmission is complete, the user code can
prepare the receipt of the answer.
4. The Receive_P2P instruction is run repeatedly to query an answer. If the CM has
acquired response data, the Receive_P2P instruction copies the response to the CPU
and signals that new data has been received.
5. The user program can process the response.
6. Back to step 1 and repetition of the cycle.

3.1 Point-to-point
Slave
Typical sequence for a slave:
1. The user program runs the Receive_P2P instruction in each cycle.
2. If the CM has received a request, the Receive_P2P instruction signals that new data is
available, and the request is copied to the CPU.
3. The user program processes the request and creates a response.
4. The response is returned to the master with the Send_P2P instruction.
5. Run Send_P2P repeatedly to ensure that the send process is actually taking place.
6. Back to step 1 and repetition of the cycle.
The slave must ensure that Receive_P2P is called up often enough so that a transmission
can be received by the master before it cancels the process due to a timeout while waiting
for the response. To do so, the user program Receive_P2P can be called from within a cycle
OB whose cycle time is sufficiently short so that the master can receive a transmission
before the timeout setting expires. If the OB cycle time is set so that two runs can take place
during the timeout setting of the master, the user program can receive all transmissions
without any losses.

3.1 Point-to-point
3.1.3 Shared parameters for point-to-point operations
Table 3- 1 General input parameters of the PtP instructions
Parameters Description
REQ Data transmission is initiated by a positive edge at the REQ input. Another edge at REQ may
only be created after the command has been completed (DONE or ERROR). Data transmission
can take several calls (program cycles), depending on the data volume.
When you add a PtP instruction to your program, STEP 7 will prompt you to specify the instance
DB (or to have STEP 7 create a corresponding instance DB). Use a unique DB for each PtP
instruction call.
PORT A port address is assigned during configuration of the communication module. The PORT
parameter communicates assignment to a specific communication module to the instruction.
You can select a symbolic name for the standard port after the configuration. The assigned CM
port value is the "Hardware ID" property of the device configuration with S7-1200/1500 and the
"Input address" with S7-300/400. The symbolic port name is assigned in the symbol table.
The output parameters DONE, NDR, ERROR and STATUS of the PtP instructions indicate
the execution status of the PtP functions.
Table 3- 2 Output parameters DONE, NDR, ERROR and STATUS
Parameters Data type Standard Description

DONE Bool FALSE Set to TRUE for one cycle to indicate that the last request was
completed with errors; otherwise FALSE.
NDR Bool FALSE Set to TRUE for one cycle to indicate that new data has been
received; otherwise FALSE.
ERROR Bool FALSE Set to TRUE for one cycle to indicate that the last request was
completed with errors; the corresponding error code can be found
in STATUS; otherwise FALSE.
STATUS Word 0 or 0x7000 Result status:
• If the bit DONE or NDR is set, STATUS is set to 0/0x700 or to
a specific error code.
• If the bit ERROR is set, STATUS displays an error code.
• If none of the bits listed above is set, the instruction can return
status results that describe the current status of the function.
The value in STATUS is valid until you call this instruction again
(with one and the same port address).

3.1 Point-to-point
Table 3- 3 COM_RST in/out parameter
Parameters Data type Standard Description

COM_RST Bool FALSE Initialization of the instruction
You initialize the instruction with TRUE. COM_RST is then reset to
FALSE.
Note: You must set COM_RST to TRUE during startup and should
not subsequently change the parameter (that is, do not assign a
value when you call the instruction). COM_RST is reset by the
instruction following initialization of the instance DB.
Note
Please note that the parameters DONE, NDR, ERROR and STATUS are only set for one
cycle.
Table 3- 4 Shared error codes
Error code Description

0x0000 No error
0x7000 Function not active
0x7001 Initial call after request started.
0x7002 Subsequent call after request started.
0x8x3A Invalid pointer in parameter x
Table 3- 5 Shared error classes of the STATUS parameter
Description of the class Error classes Description

Port configuration 0x81Ax For the description of frequent errors in the interface
configuration
Send configuration 0x81Bx For the description of errors in the send configuration
Receive configuration 0x81Cx For the description of errors in the receive configuration
Sending 0x81Dx For the description of runtime errors during sending
Receiving 0x81Ex For the description of runtime errors during receiving
RS232 accompanying signals 0x81Fx For the description of errors in connection with signal processing

3.1 Point-to-point
3.1.4 Port_Config: Configure PtP communication port
Description
The Port_Config instruction (port configuration) allows you to change parameters such as the
data transmission rate in runtime using your program.
Port_Config configuration changes are saved on the CM and not in the CPU. The
parameters saved in the device configuration are restored when the CPU is switched on
again.
Parameters
Parameters Decla- Data type Standard Description

ration S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE Activates the configuration change upon a positive edge
of this input.
PORT IN PORT Word 0 The CM port value can be found in the "Hardware ID"
(UInt) property of the device configuration (S7-1200/1500)
(input address; S7-300/400) once you have installed and
configured the CM. The symbolic port name is assigned
in the "System constants" tab of the PLC tag table.
PROTOCOL IN UInt Word 0 Protocol
• 0 = point-to-point communication protocol (Freeport)
• 1 = 3964(R) protocol
• 2-n = reserved
BAUD IN UInt Word 6 Data transmission rate of the port:
• 1 = 300 Bit/s
• 2 = 600 Bit/s
• 3 = 1200 Bit/s
• 4 = 2400 Bit/s
• 5 = 4800 Bit/s
• 6 = 9600 Bit/s
• 7 = 19200 Bit/s
• 8 = 38400 Bit/s
• 9 = 57600 Bit/s
• 10 = 76800 Bit/s
• 11 = 115200 Bit/s

3.1 Point-to-point

ration S7- S7-
1200/1500 300/400/
WinAC
PARITY IN UInt Word 1 Parity of the port:
• 1 = no parity
• 2 = even parity
• 3 = odd parity
• 4 = mark parity
• 5 = space parity
• 6 = any
DATABITS IN UInt Word 1 Bits per character:
• 1 = 8 data bits
• 2 = 7 data bits
STOPBITS IN UInt Word 1 Stop bits:
• 1 = 1 stop bit
• 2 = 2 stop bits
FLOWCTRL IN UInt Word 1 Flow control:
• 1 = no flow control
• 2 = XON/XOFF
• 3 = Hardware RTS always ON
• 4 = Hardware RTS switched
• 5 = Hardware RTS always ON, ignore DTR/DSR
XONCHAR IN Char 11H Specifies the character which serves as XON character.
It is typically a DC1 character (11H). This parameter is
only evaluated when flow control is active.
XOFFCHAR IN Char 13H Specifies the character which serves as XOFF
character. It is typically a DC3 character (13H). This
parameter is only evaluated when flow control is active.
WAITIME IN UInt Word 2000 Specifies how long to wait for an XON character after
receipt of an XOFF character or how long to wait for
CTS = ON after CTS = OFF (between 0 and 65535 ms).
This parameter is only evaluated when flow control is
active.
MODE IN USInt Byte 0 Operating mode
Valid operating modes are:
• 0 = full duplex (RS232)
• 1 = full duplex (RS422) four-wire mode (point-to-
point)
• 2 = full duplex (RS422) four-wire mode (multipoint
master)
• 3 = full duplex (RS422) four-wire mode (multipoint
slave)
• 4 = half duplex (RS485) two-wire mode

3.1 Point-to-point

ration S7- S7-
1200/1500 300/400/
WinAC
LINE_PRE IN USInt Byte 0 Receive line initial state
Valid initial states are:
• 0 = "no" initial state
• 1 = signal R(A)=5 V, signal R(B)=0 V (break
detection):
Break detection is possible with this initial state.
Can only be selected with: "Full duplex (RS422) four-
wire mode (point-to-point connection)" and "Full
duplex (RS422) four-wire mode (multipoint slave)".
• 2 = signal R(A)=0 V, signal R(B)=5 V:
This default setting corresponds to the idle state (no
active send operation). No break detection is
possible with this initial state.
CABLE_BRK IN USInt Byte 0 Break detection
The following settings are valid:
• 0 = break detection deactivated
• 1 = break detection activated
COM_RST IN/OUT --- Bool FALSE Initialization of the Port_Config instruction
The instruction is initialized with 1. The instruction then
resets COM_RST to 0.
DONE OUT Bool FALSE TRUE for one cycle after the last request was completed
without errors
ERROR OUT Bool FALSE TRUE for one cycle after the last request was completed
with errors
STATUS OUT Word 16#7000 Error code (see Error messages (Page 85))

3.1 Point-to-point
3.1.5 Send_Config: Configure PtP sender
Description
The Send_Config instruction (send configuration) allows you to change serial transmission
parameters in runtime using your program. Any data pending in a CM is deleted when
Send_Config is executed.
Send_Config configuration changes are saved on the CM and not in the CPU. The
again.
Parameters
Parameters Declara- Data type Standard Description

tion S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE Activates the configuration change upon a positive edge
at this input.
(input address; S7-300/400) once you have configured
the CM. The symbolic port name is assigned in the
"System constants" tab of the PLC tag table. In S7
300/400/WinAC systems, the input address assigned in
HWCN must be assigned to the CM port.
RTSONDLY IN UInt Word 0 Number of milliseconds to wait after activation of RTS
before a transmission of send data is started. This
parameter is only valid if the hardware flow control is
active. The valid range is 0 to 65535 ms. The value 0
deactivates the function.
RTSOFFDLY IN UInt Word 0 Number of milliseconds to wait after transmission of
send data before RTS is deactivated: This parameter is
only valid if the hardware flow control is active. The valid
range is 0 to 65535 ms. The value 0 deactivates the
function.
BREAK IN UInt Word 0 This parameter specifies that a BREAK is to be sent at
the start of each frame for the specified number of bit
times. The maximum is 65535 bit times. The value 0
deactivates the function.
IDLELINE IN UInt Word 0 This parameter specifies that the line is to remain in idle
for the specified number of bit times prior to the start of
each frame. The maximum is 65535 bit times. The value
0 deactivates the function.
USR_END IN STRING[2] 0 Input of end delimiters.
No more than 2 end delimiters can be configured.
All data including the end delimiter(s) is sent,
independent of the configured frame length.

3.1 Point-to-point

tion S7- S7-
1200/1500 300/400/
WinAC
APP_END IN STRING[5] 0 Input of characters to be appended.
You can append up to 5 characters.
COM_RST IN/OUT --- Bool FALSE Initialization of the Send_Config instruction
You initialize the instruction with TRUE. The instruction
then resets COM_RST to FALSE.
without errors
with errors

3.1 Point-to-point
3.1.6 Receive_Config: Configure PtP recipient
Description
The Receive_Config instruction (receive configuration) allows you to change serial receive
parameters in runtime using your program. This instruction configures the conditions that
mark the start and the end of received data. Any data pending in a CM is deleted when
Receive_Config is executed.
Port_Config configuration changes are saved on the CM and not in the CPU. The
again.
Parameters
Para- Declaration Data type Standard Description

meters S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE Activates the configuration change upon a positive edge at
this input.
(UInt) property of the device configuration once you have
installed and configured the CM. The symbolic port name
is assigned in the "System constants" tab of the PLC tag
table.
Receive_C IN Variant Any - The data structure of Receive_Conditions specifies the
onditions start and end conditions used to identify the start and end
of a frame.
COM_RST IN/OUT --- Bool FALSE Initialization of the Receive_Konfig instruction
without errors
with errors
Start conditions for the Receive_P2P instruction

The Receive_P2P instruction uses the configuration specified in the device configuration or
by the Receive_Config instruction to determine the start and end of point-to-point
communication frames. The start of the frame is defined by the start conditions. The frame
start can be determined using one or more start conditions. If multiple start conditions are
specified, all conditions must be met for data transmission to start.

3.1 Point-to-point
Data type structure of the Receive_Conditions parameter, part 1 (start conditions)
Table 3- 6 Structure of Receive_Conditions for start conditions
Parameters Declaration Data type Standard Description

START.START IN Word 02H Specifying the start condition
COND
• 01H - detection of the start character
• 02H - Any character
• 04H - detection of a line break
• 08H - detection of an idle line
• 10H - detection of start sequence 1
The start conditions can be combined by adding the values
together.
START.IDLETI IN Word 28H The number of bit times required in the idle state for a new frame
ME start to be detected (default value: W#16#28). Only in connection
with condition "Line in idle".
0 to FFFF
START.START IN Byte 02H The start character for the condition "Start character". (default
CHAR value: B#16#2)
START.SEQ[1]. IN Byte 0 Start sequence 1, deactivate/activate comparison for each
CTL character: (default value: B#16#0)
These are the activation bits for each character of the start
character string.
• 01H - character 1
When a bit is deactivated for a specific character, this means that
each character in this position in the character string represents a
valid start character string (e.g. 1FH = all 5 characters interpreted).
START.SEQ[1]. IN Char[5] 0 Start sequence 1, start character (5 characters).
STR[1] ..
START.SEQ[1].
STR.[5]
START.SEQ[2]. IN Byte 0 Start sequence 2, ignore/compare control for each character.
CTL Default value: B#16#0)
STR[1] ..
START.SEQ[2].
STR.[5]
CTL Default value: B#16#0

3.1 Point-to-point

STR[1] ..
START.SEQ[3].
STR.[5]
CTL Default value: B#16#0
START.SEQ[4]. IN Char[5] 0 Start sequence 4, start character (5 characters),
STR[1] ..
START.SEQ[4].
STR.[5]
Example
Have a look at the following received data in hexadecimal coding: "68 10 aa 68 bb 10 aa 16".
The configured start character strings are available in the following table. Start character
strings are evaluated once the first character 68H has been successfully received. After the
fourth character has been successfully received (the second 68H), start condition 1 has been
met. Once the start conditions have been met, the evaluation of the end conditions starts.
Processing of the start character string can be canceled due to different errors in parity,
framing or time intervals between characters. These errors prevent receipt of the data
because the start condition has not been met.
Table 3- 7 Start conditions
Start condition First character First character +1 First character +2 First character +3 First character +4
1 68H xx xx 68H xx
2 10H aaH xx xx xx
3 dcH aaH xx xx xx
4 e5H xx xx xx xx
End conditions for the Receive_P2P instruction

The end of a frame is defined by the first occurrence of one or more configured end
conditions.
You can configure the end conditions either in the properties of the communication interface
in the device configuration, or with the Receive_Config instruction. The receive parameters
(start and end conditions) are reset to the settings in the device configuration each time the
CPU is switched on. When the STEP 7 user program executes Receive_Config, the settings
are set to the parameters of Receive_Config.

3.1 Point-to-point
Data type structure of the Receive_Conditions parameter, part 2 (end conditions)
Table 3- 8 Structure of Receive_Conditions for end conditions

END.ENDCOND IN Word 0 This parameter specifies the condition for the frame end:
• 01H - response timeout
• 02H - message timeout
• 04H - character delay time
• 08H - maximum frame length
• 10H - read message length from message (N+LEN+M)
• 20H - end sequence
• 40H - fixed frame length
END.FIXLEN IN Word 1 Fixed frame length: Only used if the end condition "Fixed
length" has been selected.
1 to 4000 bytes (depending on module)
END.MAXLEN IN Word 1 Maximum frame length: Only used if the end condition
"Maximum length" has been selected.
END.N IN Word 0 Byte position of the length field in the frame. Only used with
end condition N+LEN+M.
END.LENGTHSIZE IN Word 0 Size of the byte field (1, 2, or 4 bytes). Only used with end
condition N+LEN+M.
END.LENGTHM IN Word 0 Enter the number of characters after the length field that are
not included in the value of the length field. This entry is only
used with end condition N+LEN+M. 0 to 255 bytes
END.RCVTIME IN Word 200 Specify the wait time for the first received character. The
receive instruction is terminated with an error if a character is
not received within the specified time. This information is used
only with the condition "Response time". (0 to 65535 ms).
Note: This parameter cannot be used as sole end criterion but
only in connection with at least one other end condition.
END.MSGTIME IN Word 200 Specify how long to wait for receipt of the complete frame
after receipt of the first character. This parameter is only used
if the condition "After frame time limit elapses" has been
selected. (0 to 65535 ms)
END.CHARGAP IN Word 12 Enter the number of bit times between characters. If the
number of bit times between characters exceeds the specified
value, the end condition has been met. This information is
used only with the condition "Character interval". (0 to 65535
bit times)

3.1 Point-to-point

END.SEQ.CTL IN Byte 0 Character string 1, ignore/compare control for each character:
These are the activation bits for each character of the end
character string. Character 1 is bit 0, character 2 is bit 1, ...,
character 5 is bit 4. If a bit is deactivated for a specific
character, this means that each character represents a
congruence at this position of the character string.
END.SEQ.STR[1] IN Char[5] 0 Character string 1, start character (5 characters)
..
END.SEQ.STR[5]
Table 3- 9 General parameters of the Receive_P2P instruction

GENERAL.MBUF_ IN Byte 255 Specifies the number of frames that are to be buffered in the
SIZE receive buffer of the CM.
Any frames received after the number of frames to be saved
has been exceeded will be discarded. (1 to 255 frames)
GENERAL.OW_PR IN Byte 0 Activates the no overwriting function of the buffered frame
OT when the CM receives a new frame and the receive buffer of
the CM has not yet been read. This step prevents already
buffered received frames from being lost.
• 0 - not activated
• 1 - activated
GENERAL.CLR_M IN Byte 0 Activates deletion of the receive buffer during CPU startup.
BUF The receive buffer is automatically deleted when the CPU
switches from STOP to RUN. The receive buffer only contains
frames received after CPU startup.
• 1 - activated

3.1 Point-to-point
3.1.7 P3964_Config: Configuring the 3964(R) protocol
Description
The P3964_Config instruction (protocol configuration) allows you to change protocol
parameters for 3964(R), such as character delay time, priority and block check, in runtime
using your program.
P3964_Config configuration changes are saved on the CM and not in the CPU. The
again.
Parameters

tion S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE Activates the configuration change upon a positive
edge at this input.
(input address; S7-300/400) once you have installed
and configured the CM. The symbolic port name is
assigned in the "System constants" tab of the PLC
tag table.
BCC IN SInt Byte 1 Activates/deactivates the use of the block check
• 0 = without block check
• 1 = with block check
Priority IN SInt Byte 1 Selection of the priority
• 0 = low priority
• 1 = high priority
CharacterDelayTime IN UInt Word DCH Setting the character delay time (depending on the
set data transmission rate) (default value: 220 ms)
1 to 65535 ms
AcknDelayTime IN UInt Word 7D0H Setting the acknowledgment delay time (depending
on the set data transmission rate) (default value:
2000 ms)
1 to 65535 ms
BuildupAttempts IN SInt Byte 6H Setting the number of connection attempts
1 to 255
RepetitionAttempts IN SInt Byte 6H Setting the number of transmission attempts
1 to 255
COM_RST IN/OUT --- Bool FALSE Initialization of the P3964_Config instruction
You initialize the instruction with TRUE. The
instruction then resets COM_RST to FALSE.

3.1 Point-to-point

tion S7- S7-
1200/1500 300/400/
WinAC
DONE OUT Bool FALSE TRUE for one cycle after the last request was
completed without errors
ERROR OUT Bool FALSE TRUE for one cycle after the last request was
completed with errors

3.1 Point-to-point
3.1.8 Send_P2P: Sending data
Description
The Send_P2P instruction (send point-to-point data) starts the transmission of data and
transmits the contents of the assigned buffer to the communication module. The CPU
program continues to run while the CM sends the data at the assigned data transmission
rate. Only one send instruction per communication module may be pending at any time. The
CM will output an error if a second Send_P2P instruction is executed when the CM is already
sending a frame.
Parameters

S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE Enable requested transmission at positive edge of this
enable input. This transmits the contents of the buffer to
the point-to-point communication interface.
(S7-300/400; input address) once you have installed and
configured the CM. The symbolic port name is assigned in
the "System constants" tab of the PLC tag table.
BUFFER IN Variant Any 0 This parameter points to the start address of the send
buffer.
Note:
Boolean data and Boolean fields are not supported.
LENGTH IN UInt Word 0 Length in bytes of the data to be transferred
COM_RST IN/OUT --- Bool FALSE Initialization of the Send_P2P instruction
without errors
with errors

3.1 Point-to-point
Parameters
If a send instruction is in progress, the status of outputs DONE and ERROR will be FALSE.
At the end of a send instruction, the DONE or the ERROR output is set to TRUE to signal the
status of the send instruction. The error code at the STATUS output can be evaluated when
the status of ERROR is TRUE.
The instruction outputs the status 16#7001 when the communication interface accepts the
send data. Subsequent executions of Send_P2P output the value 16#7002 if the CM is still
sending. At the end of the send instruction, the CM outputs the status 16#0000 for the send
instruction (if no errors have occurred). Subsequent executions of Send_P2P with REQ = 0
output the status 16#7000 (free).
The diagram below shows the relationship between the output values and REQ. It is based
on the assumption that the instruction is called cyclically to check the status of the send
process (indicated by the STATUS values).
The figure below shows how the DONE and STATUS parameters are only valid for one cycle
if a pulse is pending on the REQ line (for one cycle) to trigger the send instruction.
The figure below shows the relationship between the DONE, ERROR and STATUS
parameters in the event of an error.
The DONE, ERROR and STATUS values are only valid until Send_P2P is executed again by
the same instance DB.

3.1 Point-to-point
3.1.9 Using LENGTH and BUFFER parameters in communication operations
Interaction of LENGTH and BUFFER parameters for Send_P2P

The minimum data size sent by the Send_P2P instruction is one byte. The BUFFER
parameter specifies the size of the data to be sent. You cannot use the data type Bool or
arrays of the Bool type for the BUFFER parameter.
Table 3- 10 LENGTH parameter
LENGTH Description
>0 Transfers the configured number of bytes.
=0 Transfers the entire contents of the send buffer addressed with BUFFER.
If BUFFER points to a string, the entire string contents will be transferred except for the bytes with
the maximum and actual length.
Table 3- 11 BUFFER parameter
BUFFER Description
Elementary data type When sending: The LENGTH value must include the byte size of this data type.
Example: For a Word value, the LENGTH must be two. For a DWord value or Real value, the
LENGTH must be four.
Structure For optimized memory: The maximum possible BUFFER length is 1024 Byte.
For sending: The LENGTH value can include a byte size smaller than the complete byte length of
the structure; in this case, only the first LENGTH bytes of the structure from BUFFER are sent.
Array For optimized memory: If the array data type is not equal to Byte, Word or DWord, the maximum
possible buffer length is 1024 Byte.
For sending: The LENGTH value must include a byte size smaller than the complete byte length of
the array; this byte size is a multiple of the byte size of the data element. Example: The LENGTH
parameter of an array of the Word type must be a multiple of two and a multiple of four for an array
of the Real type. If LENGTH is specified, the number of array elements is transmitted in LENGTH
bytes. If BUFFER contains an array with 15 DWord elements (a total of 60 Bytes), for example,
and you specify LENGTH = 20, the first five DWord elements from the array will be transmitted.
String The LENGTH parameter includes the number or characters to be sent. Only the characters of the
String are transmitted. The bytes with the maximum and actual length of the String are not sent.

3.1 Point-to-point
3.1.10 Receive_P2P: Receiving data
Description
The Receive_P2P instruction (receive data using point-to-point communication) checks the
frames received in the CM. If a frame is available, it is transmitted from the CM to the CPU.
A receive error is indicated at the STATUS parameter.
Parameters

meters S7- S7-
1200/1500 300/400/
WinAC
configured the CM . The symbolic port name is assigned
in the "System constants" tab of the PLC tag table.
BUFFER IN Variant Any 0 This parameter points to the start address of the receive
buffer. This buffer must be large enough to receive the
maximum frame length.
Note:
Boolean data or Boolean fields are not supported.
COM_RST IN/OUT --- Bool FALSE Initialization of the Receive_P2P instruction
LENGTH OUT UInt Word 0 Length of the frame received in bytes
NDR OUT Bool FALSE TRUE for one cycle if new data is available and the
instruction has been completed without errors.
ERROR OUT Bool FALSE TRUE for one cycle once the instruction has been
completed with an error.
The error code at the STATUS output can be evaluated when the status of ERROR is TRUE.
The STATUS value provides the reason for terminating the receive operation in the CM. This
is usually a positive value which indicates that the receive operation has been successful
and which frame criterion has been detected. If the STATUS value is negative (the most
significant bit of the hexadecimal value is set), the receive operation was terminated due to
an error condition, such as a parity, framing or overflow error.
Each PtP communication interface can buffer a module-specific maximum number of bytes.
If more than one frame is available in the CM, the Receive_P2P instruction will output the
oldest available frame. Once the oldest frame has been fetched, the second-oldest frame
becomes the oldest.

3.1 Point-to-point
3.1.11 Receive_Reset: Clear receive buffer
Description
The Receive_Reset instruction (reset receiver) clears the receive buffer in the CM.
Parameters

meters S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE Activates clearing of the receive buffer with positive edge
of this enable input
COM_RST IN/OUT --- Bool FALSE Initialization of the Receive_Reset instruction
DONE OUT Bool FALSE TRUE for one cycle means that the last request was
completed without errors.
ERROR OUT Bool FALSE TRUE means that the last request was completed with
errors. If this output is TRUE, the STATUS output will
contain the corresponding error codes.

3.1 Point-to-point
3.1.12 Signal_Get: Read status
Description
The Signal_Get instruction (get RS232 signals) reads the current states of the RS232
accompanying signals and displays them at the corresponding instruction outputs.
Parameters

meters S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE Get RS232 signal states with positive edge at this input
COM_RST IN/OUT --- Bool FALSE Initialization of the Signal_Get instruction
NDR OUT Bool FALSE TRUE for one cycle if the RS232 accompanying signals
have been read and the instruction has been completed
without errors.
completed with an error
DTR OUT Bool FALSE Data terminal ready, module ready (output)
DSR OUT Bool FALSE Data record ready, communication station ready (input)
RTS OUT Bool FALSE Send request, module ready to send (output)
CTS OUT Bool FALSE Ready to send, communication station can receive data
(input)
DCD OUT Bool FALSE Data storage medium detected, signal level received
(always False, not supported)
RING OUT Bool FALSE Call display, message of incoming call (always False, not
supported)

3.1 Point-to-point
3.1.13 Signal_Set: Set accompanying signals
Description
The Signal_Set instruction (set RS232 signals) allows you to set the states of the RS232
communication signals.
This function is only valid for RS232 CM.
Parameters

meters S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE The instruction for setting the RS232 signals is started
with a positive edge at this input.
SIGNAL IN Byte 0 Selection of the signal to be set (more than one possible):
• 01H = RTS
• 02H = DTR
• 04H = DSR
RTS IN Bool FALSE Send request, module ready to send
Set this value at the output (TRUE or FALSE), default
value: FALSE
DTR IN Bool FALSE Data terminal ready, module ready
Set this value at the output (TRUE or FALSE), default
value: FALSE
DSR IN Bool FALSE Data record ready (only for the DCE interface type), not
used.
COM_RST IN/OUT --- Bool FALSE Initialization of the Signal_Set instruction
without errors
with errors

3.1 Point-to-point
3.1.14 Get_Features: Get extended functions
Description
If supported by the module, you can use the Get_Features instruction (get extended
functions) to get information on the ability of the module to support CRC and to generate
diagnostic messages.
Parameters

S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE The instruction to get extended functions is started upon a
positive edge at this input.
COM_RST IN/OUT --- Bool FALSE Initialization of the Get_Features instruction
NDR OUT Bool FALSE TRUE for one cycle if new data is available and the
instruction has been completed without errors
MODBUS_ OUT Bool FALSE Modbus CRC support
CRC
DIAG_ALA OUT Bool FALSE Generation of diagnostic messages
RM

3.1 Point-to-point
3.1.15 Set_Features: Set extended functions
Description
If supported by the module, you can use the Set_Features instruction (set extended
functions) to activate CRC support and the generation of diagnostic messages.
Parameters
Parameters Declaratio Data type Standard Description

n S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE The instruction to set extended functions is started upon a
positive edge at this input.
EN_MODBUS IN Bool FALSE Activate Modbus CRC support
_CRC
EN_DIAG_AL IN Bool FALSE Activate generation of diagnostic messages
ARM
COM_RST IN/OUT --- Bool FALSE Initialization of the Set_Features instruction
DONE OUT Bool FALSE TRUE for one execution once the last request is
completed without errors

3.2 Modbus
3.2 Modbus
3.2.1 Overview of the Modbus RTU communication
Modbus RTU communication

Modbus RTU (Remote Terminal Unit) is a standard protocol for communication in the
network and uses the RS232 or RS422/485 connection for serial data transmission between
Modbus devices in the network.
Modbus RTU uses a master/slave network in which all communication is triggered by a
single master device while the slaves can only respond to the request of the master. The
master sends a request to a slave address and only the slave with this slave address
responds to the command.
Exception: Modbus slave address 0 sends a broadcast frame to all slaves (without slave
response).
Modbus function codes

● A CPU that is operated as a Modbus RTU master can read and write data and I/O states
in a Modbus RTU slave connected by means of a communication connection.
● A CPU operated as a Modbus RTU slave allows a Modbus RTU master connected over a
communication connection to read and write data and I/O states in its own CPU.
Table 3- 12 Functions for reading data: Reading distributed I/O and program data
Modbus function code Functions for reading the slave (server) - standard addressing
01 Read output bits: 1 to 1992 bits per request
02 Read input bits: 1 to 1992 bits per request
03 Read holding register: 1 to 124 words per request
04 Read input words: 1 to 124 words per request
Table 3- 13 Functions for writing data: Changing distributed I/O and program data
Modbus function code Functions for writing in the slave (server) - standard addressing
05 Write one output bit: 1 bit per request
06 Write one holding register: 1 word per request
15 Write one or several output bits: 1 to1960 bits per request
16 Write one or several holding registers: 1 to 122 words per request

3.2 Modbus
● The Modbus function codes 08 and 11 offer diagnostic information for communication of
the slave device.
● Modbus slave address 0 sends a broadcast frame to all slaves (without slave response;
for function codes 5, 6, 15, 16).
Table 3- 14 Station addresses in the Modbus network
Station Address
RTU station Standard station address 1 to 247 and 0 for broadcast
Extended station address 1 to 65535 and 0 for broadcast
Modbus memory addresses

The number of Modbus memory addresses that is actually available depends on the CPU
version and the available work memory.
Modbus RTU instructions in your program

● Modbus_Comm_Load: You need to run Modbus_Comm_Load to set up PtP parameters
such as data transmission rate, parity and data flow control. Once you have configured
the communication module for the Modbus RTU protocol, it can only be used by the
Modbus_Master instruction or the Modbus_Slave instruction.
● Modbus_Master: The CPU can be used as Modbus RTU master device with the Modbus
master instruction for communication with one or more Modbus slave devices.
● Modbus_Slave: The CPU can be used as Modbus RTU slave device with the Modbus
slave instruction for communication with one Modbus master device.

3.2 Modbus
3.2.2 Modbus_Comm_Load: Configure communication module for Modbus
Description
The Modbus_Comm_Load instruction configures a communication module for
communication by means of the Modbus-RTU protocol. An instance data block is
automatically assigned when you add the Modbus_Comm_Load instruction in your program.
Parameters
Parameters Declara Data type Standard Description

tion S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE The instruction is started by a positive edge (0 to 1).
PORT IN Port Laddr 0 The CM port value can be found in the "Hardware ID"
property of the device configuration once you have
table.
BAUD IN UDInt DWord 6 Selection of the data transmission rate:
1 = 300, 2 = 600, 3 = 1200, 4 = 2400, 5 = 4800, 6 = 9600,
7 = 19200, 8 = 38400, 9 = 57600, 10 = 76800, 11 =
115200 bit/s. All other values are invalid.
PARITY IN UInt Word 1 Selection of parity:
• 0 – None
• 1 – Odd
• 2 – Even
FLOW_CTRL IN UInt Word 0 Selection of flow control:
• 0 – (default) no flow control
• 1 – Hardware flow control with RTS always ON (not
with RS485-CMs)
• 2 – Hardware flow control switched with RTS
RTS_ON_DLY IN UInt Word 0 Selection RTS ON delay:
• 0 – (default) No delay from "RTS active" until the first
character of the frame is sent.
• 1 to 65535 – Delay in milliseconds from "RTS active"
until the first character of the frame is sent (does not
apply with RS485 CMs). RTS delays must be used
independently of the FLOW_CTRL selection.

3.2 Modbus
Parameters Declara Data type Standard Description

tion S7- S7-
1200/1500 300/400/
WinAC
RTS_OFF_DLY IN UInt Word 0 Selection RTS OFF delay:
• 0 – No delay after transmission of last character until
"RTS inactive"
• 1 to 65535 – Delay in milliseconds after transmission of
last character until "RTS inactive" (does not apply with
RS485 ports). RTS delays must be used independently
of the FLOW_CTRL selection.
RESP_TO IN UInt Word 1000 Response timeout:
5 ms to 65535 ms - Time in milliseconds that
Modbus_Master waits for a response from the slave. If the
slave does not respond within this period, Modbus_Master
repeats the request or terminates the request with an error
if the specified number of repetitions (see below, RETRIES
parameter) has been sent.
MB_DB IN/OUT MB_BASE - A reference to the instance data block of the
Modbus_Master or Modbus_Slave instructions.
The MB_DB parameter must be switched with the (static
and therefore not visible in the instruction) MB_DB
parameter of the Modbus_Master or Modbus_Slave
instruction.
COM_RST IN/OUT --- Bool FALSE Initialization of the Modbus_Comm_Load instruction
DONE OUT Bool FALSE The DONE bit is TRUE for one cycle after the last request
is completed without errors.
ERROR OUT Bool FALSE The ERROR bit is TRUE for one cycle after the last
request is completed with an error. The error code in the
STATUS parameter is only valid in the cycle in which
ERROR = TRUE.
Modbus_Comm_Load is executed to configure a port for the Modbus RTU protocol. Once
you have configured the port for the Modbus RTU protocol, it can only be used by the
Modbus_Master or Modbus_Slave instructions.
You have to run Modbus_Comm_Load for the configuration of each communication port that
is to be used for Modbus communication. You must assign a unique Modbus_Comm_Load
instance DB to each port that you use. Only run Modbus_Comm_Load again if you need to
change communication parameters, such as data transmission rate or parity.
For example, an instance data block is assigned to the instruction if you add Modbus_Master
or Modbus_Slave to your program. You need to connect the MB_DB parameter of instruction
Modbus_Comm_Load to the MB_DB parameter of instruction Modbus_Master or
Modbus_Slave.

3.2 Modbus
Modbus_Comm_Load data block variables

The table below shows the public static tags in the instance DB of Modbus_Comm_Load that
you can use in your program.
Table 3- 15 Static tags in the instance DB
Tag Data Standard Description

type
ICHAR_GAP Word 0 Delay for character spacing between characters. This parameter is specified in
milliseconds and increases the anticipated period between the received
characters. The corresponding number of bit times for this parameter is added
to the Modbus default value of 35 bit times (3.5 character times).
RETRIES Word 2 The number of repeated attempts that the master executes before the error
code 0x80C8 for "No response" is returned.
EN_DIAG_ALARM Word 0 Activate diagnostics interrupt:
• 1 - activated
MODE USInt 0 Operating mode
• 1 = full duplex (RS422) four-wire mode (point-to-point)
• 2 = full duplex (RS422) four-wire mode (multipoint master)
• 3 = full duplex (RS422) four-wire mode (multipoint slave)
LINE_PRE USInt 0 Receive line initial state
• 1 = signal R(A)=5 V, signal R(B)=0 V (break detection):
Can only be selected with: "Full duplex (RS422) four-wire mode (point-to-
point connection)" and "Full duplex (RS422) four-wire mode (multipoint
slave)".
This default setting corresponds to the idle state (no active send
operation). No break detection is possible with this initial state.

3.2 Modbus
3.2.3 Modbus_Master: Communicate as Modbus master
Description
The Modbus_Master instruction communicates as Modbus master via a port configured by
the Modbus_Comm_Load instruction. An instance data block is automatically assigned when
you add the Modbus_Master instruction in your program. The MB_DB parameter of the
Modbus_Comm_Load instruction must be connected to the (static) MB_DB parameter of the
Modbus_Master instruction.
Parameters

tion S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool FALSE FALSE = no request
TRUE = request to send data to the Modbus slave
MB_ADDR IN UInt Word - Modbus RTU station address:
Standard addressing range (1 to 247 and 0 for Broadcast)
Extended addressing range (1 to 65535 and 0 for
Broadcast)
The value 0 is reserved for the broadcast of a frame to all
Modbus slaves. Only the Modbus function codes 05, 06,
15 and 16 are supported for the broadcast.
MODE IN USInt Byte 0 Mode selection: Specifies the type of request (read, write
or diagnostics). Additional information is available in the
table of Modbus functions below.
DATA_ADDR IN UDInt DWord 0 Start address in the slave: Specifies the start address of
the data that is accessed in the Modbus slave. The valid
addresses are listed in the table of Modbus functions
below.
DATA_LEN IN UInt Word 0 Data length: Specifies the number of bits or words this
instruction is to access. The valid lengths are listed in the
table of Modbus functions below.
COM_RST IN/OUT --- Bool FALSE Initialization of the Modbus_Master instruction
You initialize the instruction with TRUE. The instruction
then resets COM_RST to FALSE.
DATA_PTR IN/OUT Variant Any - Data pointer: Points to the flag or DB address for the data
to be written or read.
DONE OUT Bool FALSE The DONE bit is TRUE for one cycle after the last request
BUSY OUT Bool - • FALSE – no command active for Modbus_Master
• TRUE – command for Modbus_Master in progress

3.2 Modbus

tion S7- S7-
1200/1500 300/400/
WinAC
request is completed with an error. The error code in the
STATUS parameter is only valid in the cycle in which
ERROR = TRUE.
STATUS OUT Word 0 Error code (see Error messages (Page 85))
Tags in the data block of the Modbus master

The table below shows the public static tags in the instance DB of Modbus_Master that you
can use in your program.
Tag Data type Standard Description

Blocked_Proc_Timeout Real 0.5 Duration (in seconds) for which to wait for a blocked Modbus
master instance before this instance is removed as ACTIVE. This
may happen, for example, if a master request was output and the
program then stops to call the master function before it has
completely finished the request. The time value must be greater
than 0 and less than 55 seconds to avoid an error to occur.
See also "Rules for communication by the Modbus-Master" and
"Calling theModbus_Master instruction with different parameter
settings".
Extended_Addressing Bool FALSE Configures the slave station address as single or double byte.
• FALSE = one-byte address; 0 to 247
• TRUE = two-byte address (corresponds to extended
addressing);
0 to 65535

3.2 Modbus

Compatibility_Mode 1) Bool FALSE Compatibility mode with CP 341 and CP 441-2 with driver for
Modbus RTU and ET 200SP 1SI for Modbus.
The default value is 0.
• FALSE = as per Modbus specifications, not compatible
• TRUE = compatible
– For FC1 and FC2: The data read from the received frame is
written word for word to the addressed CPU memory and
exchanged byte by byte.
If the number of bits to be transmitted is not a multiple of
16, the bits which are not relevant will be set to null in the
last word.
– For FC15: The words to be transmitted are read word by
word from the addressed memory and written byte by byte
to the send frame.
If the number of bits to be transmitted is not a multiple of 8,
the bits in the last byte which are not relevant are read
unchanged from the addressed memory and entered in the
send frame.
MB_DB MB_BASE - The MB_DB parameter of the Modbus_Comm_Load instruction
must be connected to this MB_DB parameter of the
Modbus_Master instruction.
1) The PtP communication modules respond as defined in the Modbusspecification. To retain what was the standard
CP 341, CP 441-2and ET 200SP 1SI response for Modbus, use the "Compatibility_Mode" parameter.
You program can write values to the Blocked_Proc_Timeout and Extended_Addressing

variables to control the Modbus master operations.

3.2 Modbus
Rules for communication by the Modbus-Master

● Modbus_Comm_Load must be run to configure a port so that the Modbus_Master
instruction can communicate with this port.
● A port which is to be used as Modbus master must not be used by Modbus _Slave. You
can use one or several instances of Modbus_Master 1) with this port. But all versions of
the Modbus_Master must use the same instance DB for the port.
● The Modbus instructions do not use communication alarm events to control the
communication process. Your program must query the Modbus_Master instruction for
completed commands (DONE, ERROR).
● We recommend to call all executions of Modbus_Master for a specific port from a
program cycle OB. Modbus master instructions can only be executed in one program
cycle or in one cyclical/time-controlled processing level. They may not be processed in
different processing levels. The priority interruption of a Modbus master instruction by
another Modbus master instruction in a processing level with higher priority results in
improper operation. Modbus master instructions may mot be processed in startup,
diagnostic or time error levels.
1)"Instance of Modbus master" here means a call of the Modbus_Master instruction with the
same interconnection with a Modbus_Comm_Load instruction and the same setting for the
MB_ADDR, MODE, DATA_ADDR and DATA_LEN parameters.
Example
Modbus_Master is called with MODE=0 and DATA_ADDR=10
This command is now active until it is completed with DONE=1 or ERROR=1, or until the
watchdog time configured at the Blocked_Proc_Timeout parameter has expired. If a new
command is started after the watchdog time expires and before the previous command has
been completed, the previous command will be aborted without an error message.
If, while this command is running, the instruction is now called a second time with the same
instance data but differentMODE and DATA_ADDR parameter settings, this second call will
be terminated with ERROR=1 and STATUS=8200.
Calling the Modbus_Master instruction with different parameter settings

If multiple calls of the Modbus_Master instruction with different settings for MB_ADDR,
MODE, DATA_ADDR or DATA_LEN are placed in your program, you must ensure that only
one of these calls is active at any given time. Otherwise, the error message 0x8200 will be
output (interface is busy with an ongoing request).
If a call cannot be processed in full, the watchdog is activated by the Blocked_Proc_Timeout
parameter and terminates the ongoing command.
REQ parameter
FALSE = no request; TRUE = request to send data to the Modbus slave
Enable requested transmission at a positive edge of this enable input. This transmits the
contents of the buffer to the point-to-point communication interface.

3.2 Modbus
You use the DATA_ADDR and MODE parameters to select the Modbus function code.
DATA_ADDR (Modbus start address in the slave): Specifies the start address of the data
that is accessed in the Modbus slave.
The Modbus_Master instruction uses the MODE input instead of a function code input. The
combination of MODE and DATA_ADDR specifies the function code that is used in the
actual Modbus frame. The table below shows how the MODE parameter, the Modbus
function code and the Modbus address range in DATA_ADDR are related.
Table 3- 17 Modbus functions
MODE DATA_ADDR (Modbus DATA_LEN Modbus function Operation and data

address) (data length) code
0 Bits per request 01 Read output bits:
1 to 9999 1 to 2000/1992 1 0 to 9998
0 Bits per request 02 Read input bits:
10001 to 19999 1 to 2000/1992 1 0 to 9998
0 Words per request 03 Read holding register:
40001 to 49999 1 to 125/124 1 0 to 9998
400001 to 465535 1 to 125/124 1 0 to 65534
0 Words per request 04 Read input words:
30001 to 39999 1 to 125/124 1 0 to 9998
1 Bits per request 05 Write one output bit:
1 to 9999 1 0 to 9998
1 1 word per request 06 Write one holding register:
40001 to 49999 1 0 to 9998
400001 to 465535 1 0 to 65524
1 Bits per request 15 Write multiple output bits:
1 to 9999 2 to 1968/1960 1 0 to 9998
1 Words per request 16 Write multiple holding registers:
40001 to 49999 2 to 123/122 0 to 9998
400001 to 465534 2 to 123/122 1 0 to 65534
22 Bits per request 15 Write one or several output bits:
1 to 9999 2 to 1968/1960 1 0 to 9998
22 Words per request 16 Write one or several holding
registers:
40001 to 49999 1 to 123 0 to 9998
400001 to 465535 1 to 122 1 0 to 65534
11 Both operands DATA_ADDR and DATA_LEN, of the 11 Read status word and event
Modbus_Master are ignored in this function. counter of the slave
communication. The status word
indicates busy (0 – not busy,
0xFFFF - busy). The event counter
is incremented for each successful
processing of a frame.

3.2 Modbus
MODE DATA_ADDR (Modbus DATA_LEN Modbus function Operation and data

address) (data length) code
80 1 word per request 08 Check slave status with data
diagnostic code 0x0000 (loopback
test – slave returns an echo of the
request)
- 1 -
81 1 word per request 08 Reset slave event counter using
data diagnostic code 0x000A
- 1 -
3 to 10, - - Reserved
12 to
79,
82 to
255
1 In extended addressing, see the Extended_Adressingparameter, the maximum data length is shorter by 1 byte or
1 word depending on the data type of the function.
2 MODE 2 allows you to write one or more output bits and one or more holding registers using the Modbus functions 15
and 16.
MODE 1 uses the Modbus functions 5 and 6 to write 1 output bit and 1 holding register, and Modbus functions 15 and
16 to write multiple output bits and multiple holding registers.
DATA_PTR parameter
The DATA_PTR parameter points to the DB or flag address in which to write or from which to
read. If you use a data block, you must create a global data block that provides the data
memory for read and write processes on Modbus slaves.
Note
S7-1200/1500 - The data block addressed using DATA_PTR must support direct addressing
The data block must permit direct (absolute) and symbolic addressing.

3.2 Modbus
Data block structures for the DATA_PTR parameter

● These data types apply for reading words in the Modbus address range (DATA_PTR)
30001 to 39999, 40001 to 49999 and 400001 to 465535 and for writing words in the
Modbus address range (DATA_PTR parameter) 40001 to 49999 and 400001 to 465535.
– Standard array of data types WORD, UINT or INT
– Named structure of the WORD, UINT or INT type in which each element has a unique
name and a 16-bit data type.
– Named complex structure in which each element has a unique name and a 16-bit or
32-bit data type.
● For reading and writing bits for the Modbus address range (DATA_PTR parameter)
00001 to 09999 and reading bits from 10001 to 19999.
– Standard field from Boolean data types.
– Named Boolean structure from uniquely named Boolean variables.
● It is not essential, but nevertheless advisable, to allocate each Modbus_Master instruction
its own separate memory area. The reason for this is that data destruction is far more
likely if multiple Modbus_Master instructions are reading and writing in the same memory
area.
● It is not necessary for the data areas for DATA_PTR to be located in the same global
data block. You can create a data block with several areas for Modbus read processes, a
data block for Modbus write processes or a data block for each slave station.
See also
Modbus_Slave: Communicate as Modbus slave (Page 53)

3.2 Modbus
3.2.4 Modbus_Slave: Communicate as Modbus slave
Description
The Modbus_Slave instruction allows your program to communicate as Modbus slave via a
PtP port of a CM (RS422/485 or RS232). STEP 7 automatically generates an instance DB
when you add the instruction. The MB_DB parameter of the Modbus_Comm_Load
instruction must be connected to the (static) MB_DB parameter of the Modbus_Slave
instruction.
Parameters

tion S7- S7-
1200/1500 300/400/
WinAC
MB_ADDR IN UInt Word - Station address of the Modbus slave:
Standard addressing range (1 to 247)
Extended addressing range (0 to 65535)
Note: 0 is the broadcast address
COM_RST IN/OUT --- Bool FALSE Initialization of the Modbus_Slave instruction
MB_HOLD_REG IN/OUT Variant Any - Pointer to the Modbus holding register DB: The Modbus
holding register may be the memory area of the flags or
a data block.
NDR OUT Bool FALSE New data available:
• 0 – No new data
• 1 – Indicates that new data was written by the
Modbus master
The NDR bit is TRUE for one cycle after the last request
DR OUT Bool FALSE Read data:
• 0 – No data read
• 1 – Indicates that data was read by the Modbus
master
The DR bit is TRUE for one cycle after the last request is
completed without errors.
request is completed with an error. If the execution was
terminated with an error, the error code in the STATUS
parameter is only valid in the cycle in which ERROR =
TRUE.
STATUS OUT Word 0 Error code (see Error messages (Page 85))

3.2 Modbus
The function codes of the Modbus communication (1, 2, 4, 5 and 15) can read and write bits
and words directly in the process image of the inputs and in the process image of the outputs
of the CPU. The MB_HOLD_REG parameter must be defined as data type greater than one
byte for these function codes. The table below shows the sample assignment of Modbus
addresses to the process image in the CPU.
Table 3- 18 Assignment of Modbus addresses to the process image
Modbus functions S7-1200

Code Function Data area Address area Data area CPU address
01 Read bits Output 0 to 8191 Process image of outputs O0.0 to O1023.7
02 Read bits Input 0 to 8191 Process image of inputs I0.0 to I1023.7
04 Read words Input 0 to 511 Process image of inputs IW0 to IW1022
05 Write bit Output 0 to 8191 Process image of outputs O0.0 to O1023.7
15 Write bits Output 0 to 8191 Process image of outputs O0.0 to O1023.7
Table 3- 19 Assignment of Modbus addresses to the process image
Modbus functions S7-1500 / S7-300 / S7-400

Code Function Data area Address area Data area CPU address
01 Read bits Output 0 to 9998 Process image of outputs O0.0 to O1248.6
02 Read bits Input 0 to 9998 Process image of inputs I0.0 to I1248.6
04 Read words Input 0 to 9998 Process image of inputs IW0 to IW19996
05 Write bit Output 0 to 9998 Process image of outputs O0.0 to O1248.6
15 Write bits Output 0 to 9998 Process image of outputs O0.0 to O1248.6
Note
The available address area may be smaller, depending on the memory configuration of the
CPU.
The function codes of the Modbus communication (3, 6, 16) use a Modbus holding register
which is an address area in the memory area of the flags or a data block. The type of hold
register is specified by the MB_HOLD_REG parameter of the Modbus_Slave instruction.
Note
S7-1200/1500 - type of data block MB_HOLD_REG
The data block with Modbus holding register must permit direct (absolute) and symbolic
addressing.

3.2 Modbus
Table 3- 20 Diagnostic functions
Modbus diagnostic functions of S7-1200 Modbus_Slave

Function codes Subfunction Description
08 0000H Output request data of echo test: The Modbus_Slave instruction returns the echo of a
received data word to the Modbus master.
08 000AH Clear communication event counter: The Modbus_Slave instruction clears the
communication event counter used for Modbus function 11.
11 Call communication event counter: The Modbus_Slave instruction uses an internal
communication event counter to detect the number of successful Modbus read and
Modbus write requests that are sent to the Modbus slave. The counter is not
incremented for function 8, function 11 and broadcast requests. It is also not
incremented for requests that result in communication errors (for example, parity or
CRC errors).
The Modbus_Slave instruction supports broadcast write requests from Modbus masters as
long as the requests include access to valid addresses. Modbus_Slave generates error code
0x8188 for function codes that are not supported by the broadcast function.
Variables of the Modbus slave

This table below shows the public static tags in the instance data block of Modbus_Slave
that you can use in your program.
Table 3- 21 Variables of the Modbus slave

HR_Start_Offset Word 0 Specifies the start address of the Modbus holding register (default =
0)
Extended_Addressing Bool FALSE Extended addressing, configures slave addressing as single or
double byte
(0 = single byte address, 1 = double byte address, default = 0)
Request_Count Word 0 The number of all requests received by this slave
Slave_Message_Count Word 0 The number of requests received for this specific slave
Bad_CRC_Count Word 0 The number of received requests that have a CRC error
Broadcast_Count Word 0 The number of received broadcast requests
Exception_Count Word 0 Modbus-specific errors that require a returned exception
Success_Count Word 0 The number of received requests without protocol errors for this
specific slave
MB_DB MB_BAS - The MB_DB parameter of the Modbus_Comm_Load instruction must
E be connected to this MB_DB parameter of the Modbus_Master
instruction.
You program can write values to the HR_Start_Offset and Extended_Addressing variables
and control the Modbus slave operations. The other variables can be read to monitor the
Modbus status.

3.2 Modbus
Rules for Modbus slave communication

● Modbus_Comm_Load must be run to configure a port so that the Modbus_Slave
instruction can communicate by means of this port.
● If a port is to respond as slave to a Modbus master, this port may not be programmed
with the Modbus_Master instruction.
● Only one instance of Modbus_Slave can be used with a specific port; otherwise you may
encounter unexpected behavior.
● The Modbus instructions do not use communication alarm events to control the
communication process. Your program must control the communication process by
querying the Modbus_Slave instruction for completed send and receive processes.
● The Modbus_Slave instruction must be executed regularly with a frequency that allows a
timely response to incoming requests of a Modbus master. We recommend executing
Modbus_Slave in each cycle from a program cycle OB. Modbus_Slave can be executed
from a cyclic interrupt OB but we do not recommend it, because excessive time delays in
the interrupt program can temporarily block the execution of other interrupt programs.
Time control of the Modbus signal

Modbus_Slave must be executed regularly to receive each request of the Modbus master
and respond accordingly. The frequency with which Modbus_Slave is executed depends on
the timeout value specified for the response by the Modbus master. This can be seen in the
figure below.
5HVSRQVH
WLPHRXWSHULRG
$'5 )& 'DWD &5& $'5
0DVWHUVHQGV 6ODYHVHQGV
6WDUW 5HVSRQVH 6WDUW

&5& LQWHUYDO FKDUDFWHUWLPHV GHOD\WLPH $'5 )& 'DWD &5& LQWHUYDO
The timeout period for the RESP_TO response is the time a Modbus master waits for the
beginning of a response from a Modbus slave. This period is not defined by the Modbus
protocol, but by a parameter of the Modbus_Comm_Load instruction. As both receiving and
sending a frame requires multiple calls of the Modbus_Slave instruction (at least three), you
should execute Modbus_Slave at least twelve times during the timeout period for the
response of the Modbus master so that the Modbus slave receives and sends data twice as
many times as specified by the timeout period.

3.2 Modbus
HR_Start_Offset
The Modbus holding register addresses start at 40001 or 400001. These addresses
correspond to the start address of the holding register in the target system memory.
However, you can configure the HR_Start_Offset tag to set a start address other than 40001
or 400001 for the Modbus holding register.
You can, for example, configure a holding register with start at MW100 and a length of 100
words. With an offset of 20, you can enter a holding register start address of 40021 instead
of 40001. Each address under 40021 and above 400119 results in an addressing error.
Table 3- 22 Example: addressing the Modbus holding register when DATA_PTR is a pointer to MW100
HR_Start_Offset Address Minimum Maximum

0 Modbus address (word) 40001 40099
S7-1500 address MW100 MW298
20 Modbus address (word) 40021 40119
S7-1500 address MW100 MW298
HR_Start_Offset is a word value which specifies the start address of the Modbus holding
register and is saved in the Modbus_Slave instance data block. You select this public static
tag by means of the parameter drop-down list once you have added Modbus_Slave in your
program.
If you have added Modbus_Slave to an LAD network, for example, you can go to a previous
network and assign the value HR_Start_Offset using the move command. The value must be
assigned prior to execution of Modbus_Slave.
Enter Modbus slave tag using the standard DB name:
1. Position the cursor in the parameter field OUT1 and enter the character m.
2. Select the required instance DB of the Modbus_Slave instruction from the drop-down list.
3. Position the cursor to the right of the DB name (after the quotation mark) and enter a
point.
4. Select "Modbus_Slave_DB.HR_Start_Offset" in the drop-down list.

3.2 Modbus
3.2.5 Frame structure
Extended_Addressing
You access the Extended_Addressing tag as described for the HR_Start_Offset reference,
except that the Extended_Addressing tag is a Boolean value.
You can configure a single byte (Modbus standard) or a double byte for addressing the
Modbus slave. Extended addressing is used to address more than 247 devices in a single
network. If you decide to use extended addressing, you can address up to 65535 addresses.
The following example shows a frame of the Modbus function 1.
Table 3- 23 Slave address with one byte (Byte 0)
Function 1 Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5

Request Slave E code Start address Data
address
Valid response Slave E code Length Data...
address
Error message Slave 0xxx E code
address
Table 3- 24 Slave address with two bytes (Byte 0 and Byte 1)
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6

Request Slave address E code Start address Data
Valid response Slave address E code Length Data...
Error message Slave address 0xxx E code
Frame description
Data traffic between master and slave / slave and master starts with the slave address,
following by the function code. The data is then transferred. The structure of the data field
depends on the function code used. The CRC check is transmitted at the end of the frame.

3.2 Modbus
Function code 1 - This function allows individual output bits to be read
Table 3- 25 FC 1 - Read output bits
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5

Query Slave address Function code Start address Number of outputs
Valid response Slave address Function code Length 1 Output data 3)
Error message Slave address 0x81 E code 2 ---
1 Length: If there is a remainder when the number of outputs is divided by 8, the number of bytes must be increased by 1.
2 E code: 01 or 02 or 03 or 04
3 The output data can comprise multiple bytes

Query Slave address Function Start address Number of outputs
code
Valid Slave address Function Length 1 Output data
response code
Error Slave address 0x81 E code 2 ---
message
1 Length: If there is a remainder when the number of outputs is divided by 8, the number of bytes must be increased by 1.
2 E code: 01 or 02 or 03 or 04
3 The output data can comprise multiple bytes
Function code 2 - This function allows individual input bits to be read
Table 3- 26 FC 2 - Read input bits

Query Slave address Function code Start address Number of inputs
Valid response Slave address Function code Length 1 Input data
1 Length: If there is a remainder when the number of inputs is divided by 8, the number of bytes must be increased by 1.
2 E code: 01 or 02 or 03 or 04

Query Slave address Function Start address Number of inputs
code
Valid Slave address Function Length 1 Input data
response code
message
1 Length: If there is a remainder when the number of inputs is divided by 8, the number of bytes must be increased by 1.
2 E code: 01 or 02 or 03 or 04

3.2 Modbus
Function code 3 - This function allows individual registers to be read
Table 3- 27 FC 3 - Read holding register

Query Slave address Function code Start address Number of registers
Valid response Slave address Function code Length 1 Register data
1 Length: Number of bytes
2 E code: 01 or 02 or 03 or 04

Query Slave address Function Start address Number of registers
code
Valid Slave address Function Length 1 Register data
response code
message
1 Length: Number of bytes
2 E code: 01 or 02 or 03 or 04
Function code 4 - This function allows individual registers to be read
Table 3- 28 FC 4 - Read input words

Query Slave address Function code Start address Number of input words
Valid response Slave address Function code Length 1 Input data
1 Length: 2 * number of input words
2 E code: 01 or 02 or 03 or 04

Query Slave address Function Start address Number of input words
code
Valid Slave address Function Length 1 Input data
response code
message
1 Length: 2 * number of input words
2 E code: 01 or 02 or 03 or 04

3.2 Modbus
Function code 5 - This function can set or delete individual bits
Table 3- 29 FC 5 - Write an output bit

Query Slave address Function code Start address Value
Valid response Slave address Function code Length Value
1 E code: 01 or 02 or 03 or 04

Query Slave address Function Start address Value
code
Valid Slave address Function Length Value
response code
message
1 E code: 01 or 02 or 03 or 04
Function code 6 - This function allows individual registers to be written
Table 3- 30 FC 6 - Write holding register

Query Slave address Function code Address Tabs
Valid response Slave address Function code Address Tabs
1 E code: 01 or 02 or 03 or 04

Query Slave address Function Address Tabs
code
Valid Slave address Function Address Tabs
response code
message
1 E code: 01 or 02 or 03 or 04

3.2 Modbus
Function code 8 - This function is used to check the communication connection
Table 3- 31 FC 8 - Slave status

Query Slave address Function code Diagnostic code Test value
Valid response Slave address Function code Diagnostic code Test value
1 E code: 01 or 03 or 04

Query Slave address Function Diagnostic code Test value
code
Valid Slave address Function Diagnostic code Test value
response code
message
1 E code: 01 or 03 or 04
Function code 11 - This function can read 2 bytes of "Status word" and 2 bytes of "Event counter"
Table 3- 32 FC 11 - Event counter for slave communication

Query Slave address Function code ---
Valid response Slave address Function code State Event counter
Error message Slave address 0x8B E code 1 ---
1 E code: 01 or 04

Query Slave address Function ---
code
Valid Slave address Function State Event counter
response code
Error Slave address 0x8B E code 1 ---
message
1 E code: 01 or 04

3.2 Modbus
Function code 15 - This function allows multiple bits to be written
Table 3- 33 FC 15 - Write one/multiple output bits
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte n

Query Slave Function Start address Number of output Byte Value
address code words counter 1
Valid Slave Function Start address Number of output ---
response address code words
Error Slave 0x8F E code 2 ---
message address
1 Byte counter: If there is a remainder when the number of bytes is divided by 8, the number of bytes must be increased
by 1.
2 E code: 01 or 02 or 03 or 04
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Byte n
Query Slave address Function Start address Number of output Byte Value
code words counter 1
Valid Slave address Function Start address Number of output ---
response code words
Error Slave address 0x8F E code 2 ---
message
1 Byte counter: If there is a remainder when the number of bytes is divided by 8, the number of bytes must be increased
by 1.
2 E code: 01 or 02 or 03 or 04

3.2 Modbus
Function code 16 - This function allows individual or multiple registers to be written
Table 3- 34 FC 16 - Write one/multiple holding registers
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte n

Query Slave Function Start address Number of registers Byte Value
address code counter 1
Valid Slave Function Start address Number of registers ---
response address code
Error Slave 0x90 E code 2 ---
message address
1 Byte counter: Number of registers * 2
2 E code: 01 or 02 or 03 or 04
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Byte n
Query Slave address Function Start address Number of registers Byte Value
code counter 1
Valid Slave address Function Start address Number of registers ---
response code
message
1 Byte counter: Number of registers * 2
2 E code: 01 or 02 or 03 or 04

3.3 USS
3.3 USS
3.3.1 Overview of USS communication
USS communication
The USS instructions control the operation of drives which support the protocol of the
universal serial interface (USS). You can communicate with several drives by means of
RS485 connections and the USS instructions with the PtP communication modules. Each
RS485 port can operate up to 16 drives.
The USS protocol uses a master-slave network for communication via a serial bus. The
master uses an address parameter to send data to a selected slave. A slave cannot send
without having first received a send request. Communication between individual slaves is not
possible. USS communication takes place in half-duplex mode. The figure below shows a
network diagram for a sample application with 16 drives.
1 2
&38 &0

① CPU
② CM
③ USS drives in a USS network
Figure 3-1 Wiring example with S7-1500 communication module
Note
Communicating with a drive using RS232
In principle, CM PtP RS232 BA and CM PtP RS232 HF can also be used to communicate
with a drive. However, only one drive can be connected to an RS232 port.

3.3 USS
USS instructions in your program

● The instruction USS_Port_Scan allows you to communicate via a communication module
with up to 16 drives using a USS network (must be called cyclically).
There is only one USS_Port_Scan instruction per PtP communication port in the program,
and it controls transmission to all drives.
● USS_Drive_Control: The instruction USS_Drive_Control allows you to prepare the send
data from USS_Port_Scan for a drive and display its receive data.
USS_Drive_Control configures the data to be sent and evaluates the data received in a
previous request from USS_Port_Scan.
● USS_Read_Param: The instruction USS_Read_Param allows you to read parameters
from a drive.
● USS_Write_Param: The instruction USS_Write_Param allows you to change parameters
in a drive.

3.3 USS
3.3.2 Requirements for using the USS protocol

The four USS instructions use 2 FBs and 2 FCs to support the USS protocol. For each USS
network, one instance data block (DB) is used for USS_Port_Scan and one instance data
block for all calls of USS_Drive_Conrol.
,QVWDQFH'% &RPPXQLFDWLRQ
6HQGB33 PRGXOH
866B3RUWB6FDQ 0DVWHU
5HFHLYHB33
,QVWDQFH'%
866B'ULYHB&RQWURO
'ULYH B&RQILJ
866
866B'ULYHB&RQWURO 'ULYH
'ULYH
866
'ULYH

866
'ULYH
866B'ULYHB&RQWURO
'ULYH
866B5HDGB3DUDP
866B:ULWHB3DUDP
Figure 3-2 USS program sequence
All drives (max. 16) that are connected to one RS485 port are part of the same USS
network. All drives that are connected to another RS485 port are part of a different USS
network. Each USS network is managed using a unique instance data block for all
USS_Drive_Control instructions and one further instance data block for the USS_Port_Scan
instruction. All instructions that are part of a USS network must share this instance data
block for USS_Drive_Conrol. The instructions USS_Port_Scan, USS_Read_Param and
USS_Write_Param have the parameter USS_DB for this function; this parameter must be
connected to the (static) USS_DB parameter of the instance DB of the USS_Drive_Control
instruction.
● The instructions USS_Drive_Control and USS_Port_Scan are function blocks (FB). If you
add the USS_Drive_Control or USS_Port_Scan instruction to the programming editor, you
will be prompted to assign a DB for this FB in the "Call options" dialog. If it is the first
USS_Drive_Control instruction in this program for this USS network, you can apply the
DB standard assignment (or change the name, if necessary) and the new DB will be
created for you. If, however, it is not the first USS_Drive_Control instruction for this drive,
you will need to select the DB which has already been assigned to this USS network from
the drop-down list in the "Call options" dialog.
● The USS_Port_Scan and USS_Read_Param instructions are functions (FCs). No DB is
assigned when you add these FCs in the editor. If you add these FCs or the instruction
USS_Port_Scan in the editor, you will need to assign the USS_DB parameter of the
corresponding USS_Drive_Controlinstance DB to the USS_DB input of these instructions.
Double-click the parameter field and click the symbol to display the available DBs. Enter
a period "." and select the parameter USS_DB from the drop-down list.

3.3 USS
● TheUSS_Port_Scan function controls communication between the CPU and the drives
via the point-to-point (PtP) RS485 communication port. A communication with the drive is
processed every time you call this function. Your program must call this function fast
enough so that the drives do not signal a timeout. To ensure a constant time response for
frame communication, you should call this instruction in a cyclic interrupt OB.
● The USS_Drive_Control instruction gives your program access to a specified drive in the
USS network. Its inputs and outputs correspond to the states and operating functions of
the drive. If there are 16 drives in your network, you must call USS_Drive_Control at least
16 times in your program, i.e. once for each drive.
You should only call the USS_Drive_Control instruction from a cyclic OB.
● The operating parameters of the drive are read and written with the USS_Read_Param
and USS_Write_Param functions. These parameters control the internal operation of the
drive. See the drive manual for a definition of these parameters. Your program may
include any number of these functions, but only one read or write request may be active
for a drive at any particular time. You may only call the USS_Read_Param and
USS_Write_Param functions from the cycle OB of a main program.
NOTICE
USS instruction calls
Only ever call USS_Drive_Control, USS_Read_Param or USS_Write_Param from a cycle
OB of the main program. The USS_Port_Scan instruction function can be called from any
OB, but it is usually called from a cyclic interrupt OB.
Do not use the USS_Drive_Control, USS_Read_Param or USS_Write_Param instruction in
an OB with a higher priority than the corresponding USS_Port_Scan instruction. For
example, do not add USS_Port_Scan to the main program or USS_Read_Param to a cyclic
interrupt OB. You may encounter unexpected errors if the execution of USS_Port_Scan is
interrupted by another instruction.

3.3 USS
Calculating time for communication with the drive

Communication with the drive takes place asynchronously to the cycle of the S7-1500. The
S7-1500 usually runs through several cycles before communication with a drive is complete.
To ensure that the watchdog set for the drive is not triggered, the send frames must be sent
to the drive within the watchdog time. You must allow for the number of any retries which
may be needed to complete the transaction if communication errors occur. By default, up to
2 retries are made for each transaction with the USS protocol.
The time interval between two send frames is calculated as follows:
(N * 5 * cycle time + 2 * frame runtime) * number of retries + (received frame timeout) *
(number of retries - 1)
N Number of drives in this network

Factor 5 5 cycles are needed for sending and receiving frames.
Cycle time Max. cycle time of the cyclic interrupt OB in which the
USS_Port_Scan instruction is called.
2 * frame time Once each for sending and receiving
Frame runtime Frame time = (number of characters per frame) * (11 Bit per
character) / (data transmission rate in Bit/s)
Number of retries 3

3.3 USS
The following times apply for "Received frame timeout"

BAUD = 115200:
Receive_Conditions.END.RCVTIME := 25;
Receive_Conditions.END.MSGTIME := 25;
ELSIF BAUD = 57600 THEN
Example:
5 drives
Data transmission rate = 9600 bps
28 characters per frame
Cycle time = 0.020 sec
Time interval = (5 * 5 * 0.02 sec + 2 * 28 * 11 / 1200 sec) * 3 = 1.69 sec
The watchdog for the drive needs to be set to approx. 2 seconds in this case.

3.3 USS
3.3.3 USS_Port_Scan: Communication by means of a USS network
Description
The USS_Port_Scan instruction processes communication via a USS network. STEP 7
generates the DB automatically when you add the instruction.
Note
Changing use of the communication module
If you want to use the communication module for the USS protocol after using it for Modbus,
you will first need to switch the power off and back on (to reset the Modbus_Comm_Load
settings).
Parameters

meters S7- S7-
1200/1500 300/400/
WinAC
PORT IN Port Word 0 The CM port value can be found in the "Hardware ID"
property of the device configuration once you have
table.
BAUD IN DInt 9600 Data transmission rate for USS communication
The following are valid:
• 1200 Bit/s
• 2400 Bit/s
• 4800 Bit/s
• 9600 Bit/s
• 19200 Bit/s
• 38400 Bit/s
• 57600 Bit/s
• 115200 Bit/s
USS_DB INOUT USS_BASE – The USS_DB parameter must be connected to the (static)
USS_DB parameter of the instance DB which is
generated and initialized when you add a
USS_Drive_Control instruction to your program.
COM_RST INOUT --- Bool FALSE Initialization of the USS_Port_Scan instruction

3.3 USS

meters S7- S7-
1200/1500 300/400/
WinAC
ERROR OUT Bool FALSE If TRUE, this output indicates that an error has occurred
and that output STATUS applies.
STATUS OUT Word 0 The status value of the request shows the result of the
cycle or initialization. Additional information is available for
some status codes in the "USS_Extended_Error" tag (see
Error messages (Page 85)).
There is only one USS_Port_Scan instruction per PtP communication port in the program
and each call of this instruction controls a transmission to or from all drives in this network.
All USS functions assigned to one USS network and one PtP communication port must use
the same instance DB.
Your program must execute the USS_Port_Scan instruction often enough to prevent a
timeout in the drive (see Requirements for using the USS protocol (Page 67) "Calculating
time for communication with the drive").
The USS_Port_Scan instruction is usually called from a cyclic interrupt OB to prevent drive
timeouts and to have the last USS data updates available for calls of USS_Drive_Control
.

3.3 USS
USS_Port_Scan data block tags

The table below shows the public static tags in the instance DB of USS_Port_Scan that you
can use in your program.

MODE USInt 4 Operating mode
• 1 = full duplex (RS422) four-wire mode (point-to-point)
• 2 = full duplex (RS422) four-wire mode (multipoint master)
• 3 = full duplex (RS422) four-wire mode (multipoint slave)
LINE_PRE USInt 2 Receive line initial state
• 1 = signal R(A)=5 V, signal R(B)=0 V (break detection):
Can only be selected with: "Full duplex (RS422) four-wire mode (point-to-
point connection)" and "Full duplex (RS422) four-wire mode (multipoint
slave)".
This default setting corresponds to the idle state (no active send
operation). No break detection is possible with this initial state.
RETRIES_MAX SInt/Byte 2 Number of retries when communication errors occur.
You can use this parameter to set the number of send retries for a request
frame if the response frame is not received within the set time.

3.3 USS
3.3.4 USS_Drive_Control: Preparing and displaying data for the drive
Description
The instruction USS_Drive_Control prepares send data for the drive and evaluates the drive
response data. You need to use a separate instance of the instruction for each drive, and all
USS functions assigned to one USS network and one PtP communication port must use the
same instance DB. You must enter the DB name when you add the first USS_Drive_Control
instruction. You then refer to this DB that was created when the first instruction was added.
STEP 7 automatically creates the DB when you add the instruction.
Parameters

tion S7- S7-
1200/1500 300/400/
WinAC
RUN IN Bool FALSE Start bit of the drive: If this parameter is TRUE, this input
allows you to operate the drive with the preset speed. If
RUN changes to FALSE during operation of the drive, the
motor will coast to a standstill. This behavior differs from
disconnection of the power supply (OFF2) and braking of
the motor (OFF3).
OFF2 IN Bool FALSE "Coast to standstill" bit: If this parameter is FALSE, this bit
will cause the drive to coast to a standstill without braking.
OFF3 IN Bool FALSE Fast stop bit: If this parameter is FALSE, this bit will cause
a fast stop by braking the drive.
F_ACK IN Bool FALSE Error acknowledgment bit: This bit resets the error bit of a
drive. The bit is set after clearing the error and the drive
detects this way that the previous error no longer has to be
reported.
DIR IN Bool FALSE Direction control of the drive: This bit is set if the drive is to
run forward (if SPEED_SP is positive).
DRIVE IN USInt Byte 1 Address of the drive: This input is the address of the USS
drive. The valid range is between drive 1 and drive 16.
PZD_LEN IN USInt Byte 2 Word length: This is the number of PZD data words. Valid
values are 2, 4, 6 or 8 words. The default value is 2.
SPEED_SP IN Real 0.0 Speed setpoint: This is the speed of the drive as a
percentage of the configured frequency. A positive value
means that the drive runs forward (if DIR is true). The valid
range is 200.00 to -200.00.
CTRL3 IN Word 0 Control word 3: Value that is written to a user-defined
parameter of the drive. You have to configure it in the drive
(optional parameter).

3.3 USS

tion S7- S7-
1200/1500 300/400/
WinAC
COM_RST IN/OUT --- Bool FALSE Initialization of the USS_Drive_Control instruction
NDR OUT Bool FALSE New data available: If this parameter is true, the bit signals
that data of a new communication request is available at
the output.
ERROR OUT Bool FALSE Error occurred: If TRUE, this indicates that an error has
occurred and output STATUS applies. All other outputs are
set to zero in the event of an error. Communication errors
are only signaled at the ERROR and STATUS outputs of
the USS_Port_Scan instruction.
STATUS OUT Word 0 The status value of the request shows the result of the
cycle. This is not a status word output by the drive (see
Error messages (Page 85)).
RUN_EN OUT Bool FALSE Operation enabled: This bit signals if the drive is running.
D_DIR OUT Bool FALSE Drive direction: This bit signals if the drive is running
forward.
• 0 – forward
• 1 – backward
INHIBIT OUT Bool FALSE Drive blocked: This bit signals the status of the block bit for
the drive.
• 0 – not blocked
• 1 – blocked
FAULT OUT Bool FALSE Drive error: This bit signals that an error occurred in the
drive. You must remedy the fault and set the F_ACK bit to
clear this bit.
SPEED OUT Real 0.0 Actual value drive speed (scaled value of status word 2 of
the drive): This is the speed of the drive as a percentage of
the configured speed.
STATUS1 OUT Word 0 Status word 1 of the drive
This value includes fixed status bits of a drive.

3.3 USS

tion S7- S7-
1200/1500 300/400/
WinAC
This value includes a user-definable status word of the
drive.
drive.
drive.
drive.
drive.
drive.
When the initial execution of USS_Drive_Control takes place, the drive specified by the USS
address (DRIVE parameter) is initialized in the instance DB. After initialization, subsequent
USS_Port_Scan instructions can start communication with the drive from this drive number.
If you change the drive number, you must first switch the CPU to STOP and then back to
RUN to initialize the instance DB. The input parameters are configured in the USS send
buffer and any outputs are read from a "previous" valid response buffer. USS_Drive_Control
only configures the data to be sent and evaluates data received in a previous request.
You can control the direction of rotation of the drive using either the D_IR input (Bool) or the
sign (positive or negative) at the SPEED_SP input (Real). The table below explains how
these inputs work together to determine the direction of rotation of the drive, provided the
motor rotates forward.
Table 3- 36 Interaction of SPEED_SP and DIR parameters
SPEED_SP DIR Direction of rotation of the drive

Value > 0 0 Backward
Value > 0 1 Forward
Value < 0 0 Forward
Value < 0 1 Backward

3.3 USS
3.3.5 USS_Read_Param: Read data from drive
Description
The USS_Read_Param instruction reads a parameter from a drive. All USS functions
assigned to one USS network and one PtP communication port must use the instance data
block of the USS_Drive_Control instruction. USS_Read_Param must be called from a cycle
OB of the main program.
Parameters

meters
S7- S7-
12001500 300/400/
WinAC
REQ IN Bool – A positive edge at REQ creates a new read request.
DRIVE IN USInt Byte – Address of the drive: DRIVE is the address of the USS
PARAM IN UInt – Parameter number: PARAM specifies which drive
parameter is written. The range for this parameter is
between 0 and 2047. With some drives, the most
significant byte of the INDEX parameter can be used to
access parameter values greater than 2047. Additional
information on access to an extended range is available in
your drive manual.
INDEX IN UInt – Parameter index: INDEX specifies the drive parameter
index which will be written to. It is a 16-bit value in which
the least significant bit is the actual index value with a
range from (0 to 255). The drive can also use the most
significant byte, which is drive-specific. Additional
information is available in your drive manual.
USS_DB parameter of the instance DB which is generated
and initialized when you add a USS_Drive_Control
instruction to your program.
DONE1 OUT Bool FALSE If this parameter is TRUE, the previously requested value
of the read parameter is available at the VALUE output.
This bit is set when the USS_Drive_Control instruction
recognizes the read response of the drive. This bit is reset
the next time USS_Read_Param is called.
ERROR OUT Bool FALSE Error occurred: If TRUE, ERROR indicates that an error
has occurred and that the STATUS applies. All other
outputs are set to zero in the event of an error.
Communication errors are only signaled at the ERROR
and STATUS outputs of the USS_Port_Scan instruction.

3.3 USS

meters
S7- S7-
12001500 300/400/
WinAC
STATUS OUT Word 0 STATUS specifies the result of the read request.
Additional information is available for some status codes
in the "USS_Extended_Error" tag (see Error messages
(Page 85)).
VALUE OUT Variant Any – This is the value of the parameter that was read and is
(Word, Int, (Word, only valid if the DONE bit is true.
UInt, Int, UInt,
DWord, DWord,
DInt, DInt,
UDInt, UDInt,
Real) Real)
1 The DONE bit indicates that valid data has been read out of the referenced motor drive and transmitted to the CPU. It
does not indicate that the USS library is able to read out an additional parameter immediately. An empty read request
must be sent to the motor drive and acknowledged by the instruction before the parameter channel is freed up for use
by the respective drive. The immediate call of USS_Read_Param or USS_Write_Param for the specific motor drive
results in error 0x818A.

3.3 USS
3.3.6 USS_Write_Param: Change data in drive
Note
For EEPROM write instructions (EEPROM in a USS drive):
Keep the number of EEPROM write operations to a minimum in order to maximize the
EEPROM service life.
Description
The USS_Write_Param instruction changes a parameter in the drive. All USS functions
assigned to one USS network and one PtP communication port must use the instance data
block of the USS_Drive_Control.
USS_Write_Param must be called from the cycle OB of a main program.
Parameters
Table 3- 37 Data types for the parameters

meters S7- S7-
1200/1500 300/400/
WinAC
REQ IN Bool – A positive edge at REQ creates a new write request.
DRIVE IN USInt Byte – Address of the drive: DRIVE is the address of the USS
PARAM IN UInt – Parameter number: PARAM specifies which drive
parameter is written. The range for this parameter is
between 0 and 2047. With some drives, the most
significant byte of the INDEX parameter can be used to
access parameter values greater than 2047. Additional
information on access to an extended range is available in
your drive manual.
INDEX IN UInt – Parameter index: INDEX specifies the drive parameter
index which will be written to. It is a 16-bit value in which
the least significant bit is the actual index value with a
range of (0 to 255). The drive can also use the most
significant byte, which is drive-specific. Additional
information is available in your drive manual.
EEPROM IN Bool – Save in EEPROM of the drive: If TRUE, the transaction of
a parameter for writing to the drive is saved in the
EEPROM of the drive. If FALSE, the value written will only
be saved temporarily and will be lost the next time you
switch on the drive.

3.3 USS

meters S7- S7-
1200/1500 300/400/
WinAC
VALUE IN Variant Any – Value of the parameter in which you want to write. It must
(Word, Int, (Word, Int, be valid with a positive edge of REQ.
UInt, UInt,
DWord, DWord,
DInt, DInt,
UDInt, UDInt,
Real) Real)
USS_DB parameter of the instance DB which is
generated and initialized when you add a
USS_Drive_Control instruction to your program.
DONE1 OUT Bool FALSE If TRUE, DONE indicates that the VALUE input has been
written to the drive. This bit is set when the
USS_Drive_Control d instruction recognizes the write
response of the drive. This bit is reset the next time
USS_Write_Paramis called.
ERROR OUT Bool FALSE If TRUE, ERROR indicates that an error has occurred and
that the STATUS applies. All other outputs are set to zero
in the event of an error. Communication errors are only
signaled at the ERROR and STATUS outputs of the
USS_Port_Scan instruction.
STATUS OUT Word 0 STATUS specifies the result of the write request.
Additional information is available for some status codes
in the "USS_Extended_Error" tag (see Error messages
(Page 85)).
1 The DONEbit indicates that valid data has been read out of the referenced motor drive and transmitted to the CPU. It
does not indicate that the USS library is able to read out an additional parameter immediately. An empty write request
must be sent to the motor drive and acknowledged by the instruction before the parameter channel is freed up for use
by the respective drive. The immediate call of USS_Read_Param or USS_Write_Param FC for the specific motor drive
results in error 0x818A.

3.3 USS
3.3.7 General information on drive setup
General requirements for drive setup

● You will need to configure the use of 4 PIV words (ParameterIDValue) for the drives.
● The drives can be configured for 2, 4, 6 or 8 PZD words (process data area).
● The number of PZD words in the drive must correspond to the PZD_LEN input of the
USS_Drive_Control instruction of the drive.
● The data transmission rate for all drives must correspond to the bps input of the
USS_Port_Scan instruction.
● The drive must be set up for remote control.
● USS must be specified for the frequency setpoint at the COM connection of the drive.
● 1 to 16 must be specified for the drive address. This address must correspond to the
DRIVE input at the USS_Drive_Control block of the drive.
● The use of the polarity of the drive setpoint must be set up for direction control of the
drive.
● The RS485 network must have been properly terminated.
Connecting a MicroMaster drive

The information on SIEMENS MicroMaster drives is used as an example. The setup
instructions for other drives are included in the drive manual.
If you want to connect a series 4 MicroMaster drive (MM4), insert the ends of the RS485
cable into the two screwless pressure clamps for USS operation. You can connect the
S7-1200/1500 to the MicroMaster drive using the conventional PROFIBUS cable and the
plug connectors.
NOTICE
If you connect devices that do not have the same reference voltage, you may create
unwanted currents in the connection cable.
These unwanted currents may cause communication errors or damages in the devices.
Make sure that all devices you connect with a communication cable either have the same
reference conductor in the circuit or are electrically disconnected to prevent the occurrence
of unwanted currents. The shielding must be connected to the ground or pin 1 of the 9-pin
plug connector. The wiring terminal 2-0V of the MicroMaster drive should be connected to
the ground.
Insert the two wires at the other end of the RS485 cable into the terminal block of the MM4
drive. To create a cable connection at the MM4 drive, remove the drive cover(s) to gain
access to the terminal blocks. The MM4 drive System Manual includes a detailed description
on how to remove the cover(s) on your specific drive.

3.3 USS
The connections on the terminal block are numbered consecutively. At the S7-1200/1500
end, use a PROFIBUS connection plug and connect terminal A of the cable to terminal 15 of
the drive (for an MM420) or terminal 30 of the drive (for an MM440). Connect terminal B (P)
A (N) of the connector to terminal 14 (for an MM420) or to terminal 29 (for an MM440).
If the S7-1200/1500 is a terminating station in the network or a point-to-point connection, you
must use terminals A1 and B1 (not A2 and B2) of the plug connector, as these terminals
provide termination settings (for example, with the DP plug connector
6ES7972-0BA40-0X40).
NOTICE
Fitting the drive covers
Make sure that you install the drive covers carefully once again before you connect the
power supply of the device.
If the drive is configured as terminating MM420

station in the network, the terminating P 14
resistors must be connected with the 120 Ω
corresponding terminals. This figure shows N 15
1.5 kΩ
470 Ω
examples for the connections of the MM4 0V 2
drive for termination.
+10 V 1
MM440
P 29
120 Ω
N 30
1.5 kΩ
470 Ω
0V 2
+10 V 1

3.3 USS
Setup of the MM4 drive

Before you connect a drive to the S7-1200/1500, make sure that the drive has the following
system parameters. Use the drive keyboard to set the parameters:
1. Reset the drive to the factory settings (optional). P0010 = 30

P0970 = 1
If you skip step 1, make sure that these USS PZD length = P2012 index 0 = (2, 4, 6
parameters are set to the specified values: or 8)
USS PKW length = P2013 index 0 = 4
2. Activate the read/write access for all parameters P0003 = 3
(expert mode).
3. Check the motor settings of your drive. The P0304 = rated motor voltage (V)
settings depend on the respective motor. P0305 = rated motor current (A)
Parameter P010 must be set to 1 before you can P0307 = rated motor power (W)
set parameters P304, P305, P307, P310 or
P0310 = rated motor frequency (Hz)
P311 (fast commissioning mode). Once you
have set the parameters, set parameter P010 to P0311 = rated motor speed
0. Parameters P304, P305, P307, P310 and
P311 can only be changed in fast
commissioning mode.
4. Set the local/remote mode. P0700 index 0 = 5
5. Set the frequency setpoint of the COM P1000 index 0 = 5
connection to USS.
6. Acceleration time (optional) P1120 = (0 to 650.00)
Time in seconds that the motor needs to
accelerate to maximum frequency.
7. Ramp-down time (optional) P1121 = (0 to 650.00)
Time in seconds that the motor needs to
decelerate to a complete stop.
8. Set the reference frequency of the serial P2000 = (1 to 650 Hz)
connection:
9. Set the USS normalization: P2009 index 0 = 0
10. Set the bps for the RS-485 serial interface: P2010 index 0 = 4 (2400 Bit/s)
5 (4800 Bit/s)
6 (9600 Bit/s)
7 (19200 Bit/s
8 (38400 Bit/s)
9 (57600 Bit/s)
12 (115200 Bit/s)
11. Enter the slave address. P2011 index 0 = (0 to 31)
Each drive (up to 31) can be operated by means
of the bus.

3.3 USS
12. Specify the timeout value for the serial P2014 index 0 = (0 to 65535 ms)
connection. 0 = timeout deactivated
This is the maximum permitted interval between
two incoming data frames. This function turns off
the inverter in case of a communication failure.
The time measurement starts once a valid frame
has been received. If no additional data frame is
received during the specified time, the inverter
turns off and displays error code F0070. If you
set the value to zero, the control is turned off.
13. Transmit the data from RAM to EEPROM: P0971 = 1 (start transmission). Save the
changes to the parameter settings in
EEPROM.

Error messages 4
Overview of error messages - PtP
The error messages are output at the STATUS output of an instruction and can be evaluated
there or processed in the user program.
Error code Description Remedy

0x0000 No error -
RECEIVE status and error codes
0x0094 frame end identified based on the "Receipt of -
fixed/maximum frame length"
0x0095 frame end identified based on "Message timeout" -
0x0096 frame end identified based on expiration of the -
"Character delay time"
0x0097 The frame was aborted because the maximum -
response time was reached.
0x0098 frame end identified based on the fulfillment of the -
"Read message length from message" conditions
0x0099 frame end identified based on the receipt of the "End -
sequence"
SEND status and error codes
0x7000 Block idle -
0x7001 Initial call for a new frame: Data transmission initiated -
0x7002 Interim call: Data transmission running -
0x8085 Invalid length Select a suitable frame length.
The following are valid (depending on the module):
1-1024/2048/4096 (Byte)
0x8088 The specified length exceeds the range set in the Change the range in the receive buffer or select a
receive buffer. frame length which corresponds to the range set in
Note: If the data type STRING has been specified at the receive buffer.
the BUFFER parameter, this error code will also The following are valid (depending on the module):
appear if the current string is shorter than the length 1-1024/2048/4096 (Byte)
specified at the LENGTH parameter.
RECEIVE status and error codes
0x8088 The number of characters received exceeds the Select a suitable frame length.
number specified at the BUFFER parameter. The following are valid (depending on the module):
1-1024/2048/4096 (Byte)

Error messages

Error message codes of the special functions
0x818F Incorrect parameter number setting (with USS only) Select a suitable parameter number (PARAM).
The following numbers are valid: 0-2047
0x8190 Incorrect setting of the CRC calculation Select a suitable value for the CRC calculation.
The following are valid: deactivated or activated.
Check whether the module addressed supports CRC
calculation.
0x8191 Incorrect setting of the diagnostic error interrupt Select a suitable value for "Diagnostic error
interrupt".
The following are valid: Diagnostic error interrupt
deactivated or diagnostic error interrupt activated.
Check whether the module addressed supports the
generation of diagnostic interrupts.
Error message codes of the "Port configuration"
0x81A0 The module does not support this protocol. Select a valid protocol for the module (PROTOCOL).
0x81A1 The module does not support this data transmission Select a valid data transmission rate for the module
rate. (BAUD).
0x81A2 The module does not support this parity setting. Select a suitable value for "Parity" (PARITY).
• None (1)
• Even (2)
• Odd (3)
• Mark (4)
• Space (5)
• Any (6)
0x81A3 The module does not support this number of data Select a suitable value for "Number of data bits"
bits. (DATABITS).
• 7 (2)
• 8 (1)
0x81A4 The module does not support this number of stop bits. Select a suitable value for "Number of stop bits"
(STOPBITS).
• 1 (1)
• 2 (2)
0x81A5 The module does not support this type of data flow Select a valid data flow control for the module
control. (FLOWCTRL).
0x81A7 Invalid valid for XON or XOFF Select suitable values for XON (XONCHAR) and
XOFF(XOFFCHAR).
Valid range of values: 0...255

Error messages

0x81AA Invalid operating mode Valid operating modes are:
• Full duplex (RS232) (0)
• Full duplex (RS422) four-wire mode (point-to-
point) (1) / (CM PtP (ET 200SP))
• Full duplex (RS422) four-wire mode (multipoint
master) (2)/ (CM PtP (ET 200SP))
• Full duplex (RS422) four-wire mode (multipoint
slave) (3)
• Half duplex (RS485) two-wire mode (4)
0x81AB Invalid receive line initial state Valid initial states are:
• "No" default setting (0)
• Signal R(A)=5 V, signal R(B)=0 V (break
detection) (1):
Can only be selected with: "Full duplex (RS422)
four-wire mode (point-to-point connection)" and
"Full duplex (RS422) four-wire mode (multipoint
slave)".
• Signal R(A)=0 V, signal R(B)=5 V (2): This
default setting corresponds to the idle state (no
active send operation).
0x81AC Invalid value for "Break detection" Select a suitable value for "Break detection". The
following are valid:
• Break detection deactivated (0)
• Break detection activated (1).
0x81AF The module does not support this protocol. Select a valid protocol for the module.
Error codes of the "Send configuration"
0x81B5 More than two end delimiters or Select suitable values for "End delimiter" and "End
end sequence > 5 characters sequence".
• deactivated (0),
• 1 (1) or 2 (2) end delimiters
or
• deactivated (0),
• 1 (1) up to 5 (5) characters for the end sequence.
0x81B6 Send configuration rejected because the 3964(R) Make sure that no send configuration is transmitted
protocol was selected if the 3964(R) protocol is set.

Error messages

Error codes of the "Receive configuration"
0x81C0 Invalid start condition Select a suitable start condition.
• Send break before frame start
• Send Idle Line.
0x81C1 Invalid end condition or no end condition selected Select a suitable end condition (see Auto-Hotspot).
0x81C3 Invalid value for "Maximum message length" Select a suitable value for "Maximum message
length" (MAXLEN).
Valid range of values (depending on the module):
1-1024/2048/4096 (Byte)
0x81C4 Invalid value for "Offset of the length specification in Select a suitable value for "Offset of the length
the message" specification in the message".
Valid range of values (depending on the module):
1-1024/2048/4096 (Byte)
0x81C5 Invalid value for "Size of length field" Select a suitable value for "Size of length field"
(LENGTHSIZE).
Valid range of values in bytes:
• 1 (1)
• 2 (2)
• 4 (4)
0x81C6 Invalid value for "Number of characters not counted in Select a suitable value for "Number of characters not
length specification" counted in length specification" (LENGTHM).
Valid range of values: 0 to 255 (bytes)
0x81C7 The total of "Offset in the message + size of length Select a suitable value for "Offset in message", "Size
field + number of characters not counted" is greater of length field" and "Number of characters not
than the maximum frame length counted".
Valid range of values:
• Offset in the message (depending on the
module):
0-1024/2048/4096 (Byte)
• Size of length field: 1, 2, or 4 (bytes)
• Number of characters not counted: 0 to 255
(bytes)
0x81C8 Invalid value for "Response timeout" Select a suitable value for "Response timeout".
Valid range of values: 1-65535 (ms)
0x81C9 Invalid value for "Character delay time" Select a suitable value for "Character delay time".
Valid range of values: 1-65535 (bit times)
0x81CB frame end sequence is activated, but no character is Activate one or several characters for the check.
activated for the check
0x81CC frame start sequence is activated, but no character is Activate one or several characters for the check.
activated for the check

Error messages

0x81CD Invalid value for "Prevent overwriting" Select a suitable value for "Prevent overwriting".
• Prevent overwriting is deactivated (0) or
• Prevent overwriting is activated (1)
0x81CE Invalid value for "Clear receive buffer on startup" Select a suitable value for "Clear receive buffer on
startup".
• Clear receive buffer at startup is deactivated (0)
• Clear receive buffer at startup is activated (1)
SEND status and error codes
0x81D0 Receiving send request during runtime of a send Make sure that you do not receive an additional
command send request during runtime of a send command.
0x81D1 The waiting time for XON or CTS = ON has expired. The communication partner has a fault, is too slow
or is offline. Check the communication partner or
change the parameters, if necessary.
0x81D2 "Hardware RTS always ON": Send command aborted Check the communication partner. Make sure that
due to change from DSR = ON to OFF DSR is ON for the entire duration of transmission.
0x81D3 Send buffer overflow / send frame too long Select a shorter frame length.
1-1024/2048/4096 (bytes)
0x81D5 Transmission aborted due to parameter changes, Check the parameter assignment, for wire break,
detected wire break, or because CPU in STOP and the CPU status.
0x81D6 Transmission canceled because end identifier was Check the parameter assignment of the end
not received characters and the frame of the communication
partner.
0x81D7 Communication error between the user program and Check the communication (e.g., matching the
module sequence number).
0x81D8 Transmission attempt rejected because module is not Configure the module.
configured
Error codes of the receive configuration
0x81E0 Frame aborted: Send buffer overflow / send frame too Increase the call rate for the receive function in the
long user program or configure communication with data
flow control.
0x81E1 Frame aborted: Parity error Check the connection line of the communication
partners, or verify that both devices are configured
for the same data transmission rate, parity and stop
bit number.
0x81E2 Frame aborted: Character frame error Check the settings for start bit, data bits, parity bit,
data transmission rate, and stop bit(s).
0x81E3 Frame aborted: Character overflow error Firmware error: Please contact Customer Support.
0x81E4 Frame aborted: The total length of "Offset in the Select a suitable value for offset in message, size of
message + size of the length field + number of the length field, and number of characters not
characters not counted" is greater than the receive counted.
buffer
0x81E5 Frame aborted: Break Receive line to partner is interrupted.
Reconnect or switch on partner.

Error messages

0x81E6 Maximum number of "Buffered received frames" In the user program call the instruction more often or
exceeded configure a communication with data flow control or
increase the number of buffered frames.
0x81E8 Frame aborted: The character delay time has expired Partner device faulty or too slow. Check this, if
before the message end criterion was detected required, using an interface tester that is
interconnected in the transmission line.
0x81E9 Modbus CRC error (only communication modules Checksum error of the Modbus frame. Check the
which support Modbus) communication partner.
0x81EA Modbus frame too short (only communication Minimum length of Modbus frame not met. Check
modules which support Modbus) the communication partner.
0x81EB Frame aborted: Maximum frame length reached Select a shorter frame length at the communication
partner.
1-1024/2048/4096 (Byte)
Check the parameters for end of frame detection.
Error codes V24 accompanying signals
0x81F0 The module does not support V24 accompanying You have tried to set accompanying signals for a
signals module that does not support V24 accompanying
signals. Make sure that this is an RS232 module or
that RS232 mode (ET 200SP) is set.
0x81F1 No operation of the V24 accompanying signals The V24 accompanying signals cannot be operated
manually if hardware data flow control is active.
0x8201 1) BUFFER is a pointer to an invalid data type Enter a pointer to one of the following data types:
DB, BOOL, BYTE, CHAR, WORD, INT, DWORD,
DINT, REAL, DATE, TIME_OF_DAY, TIME,
S5TIME, DATE_AND_TIME, STRING
0x8225 BUFFER points to an optimized memory area greater Enter a pointer to an area with a maximum length of:
than 1 kB
• Optimized memory area: 1 kByte
or
• Non-optimized area: 4 kByte
BUFFER points to an optimized memory area and the
Note: If the pointer points to an optimized memory
receive length is greater than the area addressed by
area, do not send more than 1 kByte.
BUFFER.
0x8229 1) BUFFER is a pointer to BOOL with a number of bits If you are using a pointer to BOOL, the number of
not equal to n * 8 bits must be a multiple of 8.
Error codes, general
0x8280 Negative acknowledgment when reading module Check the input at the PORT parameter
You will find more detailed information on error
causes in the RDREC.STATUS static parameters
and in the description of the SFB RDREC.
0x8281 Negative acknowledgment when writing module Check the input at the PORT parameter
causes in the WRREC.STATUS static parameters
and in the description of the SFB WRREC.
0x8282 Module not available Check the input at the parameter PORT and ensure
that the module can be reached.

Error messages

0x82C1 Invalid value for "Buffered received frames". Select a suitable value for "Buffered received
frames".
Valid range of values: 1-255
0x82C2 Receive configuration rejected because the 3964(R) Make sure that no receive configuration is sent if the
protocol was selected 3964(R) protocol is set.
0x8301 1) BUFFER is a pointer to an invalid data type Select a valid data type.
The following are valid: DB, BOOL, BYTE, CHAR,
WORD, INT, DWORD, DINT, REAL, DATE,
TIME_OF_DAY, TIME, S5TIME, DATE_AND_TIME,
STRING
0x8322 Range length error when reading a parameter Check the input at the BUFFER parameter
0x8324 Range error when reading a parameter Check the input at the BUFFER parameter
0x8328 Setting error when reading a parameter Check the input at the BUFFER parameter
Error codes of the send configuration
0x8328 1) BUFFER is a pointer to BOOL with a number of bits If you are using a pointer to BOOL, the number of
not equal to n * 8 bits must be a multiple of 8.
0x8332 Invalid data block at the Receive_Conditions Check the input at the Receive_Conditions
parameter parameter
0x833A The designation of the data block at the BUFFER Check the input at the BUFFER parameter
parameter refers to a data block which is not loaded.
0x8351 Invalid data type Check the input at the BUFFER parameter
0x8352 1) Receive_Conditions does not point to a data block Check the pointer to Receive_Conditions
0x8353 1) Receive_Conditions does not point to a structure of Check the pointer to Receive_Conditions
the type Receive_Conditions
Error codes 3964(R) protocol
0x8380 Parameter assignment error: Invalid value for Select a suitable value for "Character delay time"
"Character delay time". (CharacterDelayTime).
0x8381 Parameter assignment error: Invalid value for Select a suitable value for "Response timeout"
"Response timeout". (AcknDelayTime).
0x8382 Parameter assignment error: Invalid value for Select a suitable value for "Priority" (Priority).
"Priority". The following are valid:
• High (1)
• Low (0)
0x8383 Parameter assignment error: Invalid value for "Block Select a suitable value for "Block check" (BCC).
check" The following are valid:
• With block check (1)
• Without block check (0)
0x8384 Parameter assignment error: Invalid value for Select a suitable value for "Connection attempts"
"Connection attempts". (BuildupAttempts).

Error messages

0x8385 Parameter assignment error: Invalid value for Select a suitable value for "Transmission attempts"
"Transmission attempts". (RepetitionAttempts).
0x8386 Runtime error: Number of connection attempts Check the interface cable and the transmission
exceeded parameters.
Also check whether the receive function is
configured correctly at the partner device.
0x8387 Runtime error: Number of transmission attempts Check the interface cable, the transmission
exceeded parameters and the configuration of the
0x8388 Runtime error: Error at the "Block check character" Check whether the connection is seriously disrupted;
The internally calculated value of the block check in this case you may also occasionally see error
character does not correspond to the block check codes. Check for proper function at the partner
character received by the partner at the connection device, possibly by using an interface test device
end. that is switched into the transmission line.
0x8389 Runtime error: Invalid character received while The send request of the communication partner
waiting for free receive buffer (STX, 02H) is only answered with DLE when the
receive buffer is empty. No additional character may
be received before this (except STX again).
Check for proper function at the partner device,
possibly by using an interface test device that is
switched into the transmission line.
0x838A Runtime error: Logical error during receiving. Check whether the partner DLE in the frame header
Another character (other than DLE, ETX) was and in the data string is always in duplicate or the
received after receipt of DLE. connection is released with DLE ETX. Check for
proper function at the partner device, possibly by
using an interface test device that is switched into
the transmission line.
0x838B Runtime error: Character delay time exceeded Partner device too slow or faulty.
Verify by using an interface test device that is
switched into the transmission line, if necessary.
0x838C Runtime error: Wait time for free receive buffer has In the user program call the instruction more often or
started configure a communication with data flow control.
0x838D Runtime error: frame repetition does not start within 4 Check the communication partner. A received frame
s after NAK that is possibly corrupted must be repeated by the
partner within 4 seconds.
0x838E Runtime error: In idle mode, one or several Check for proper function of the partner device,
characters (other than NAK or STX) were received. possibly using an interface test device that is
switched into the transmission line.
0x838F Runtime error: Initialization conflict - Both partners Set the "Low" priority at one of the partners
have set high priority
0x8391 Parameter assignment error: 3964 configuration data If the Freeport protocol is set, make sure that no
rejected because Freeport is set 3964 parameter assignment data is sent.
1) Only with instructions for S7-300/400 CPUs

Error messages
Overview of error messages - Modbus

0x0000 No error -
Configuration error of the interface - Modbus_Comm_Load
0x8181 The module does not support this data transmission Select a valid data transmission rate for the module
rate. at the BAUD parameter.
0x8182 The module does not support this parity setting. Select a suitable value for "Parity" at the PARITY
parameter.
• None (1)
• Even (2)
• Odd (3)
• Mark (4)
• Space (5)
• Any (6)
0x8183 The module does not support this type of data flow Select a valid data flow control for the module at the
control. FLOW_CTRL parameter.
0x8184 Invalid value for "Response timeout". Select a valid value for "Response timeout" at the
RESP_TO parameter.
0x8280 Negative acknowledgment when reading module Check the input at the PORT. parameter
causes in the static parameters
Send_Config.RDREC.STATUS,
Receive_Config.RDREC.STATUS or
RDREC.STATUS, and in the description of the SFB
RDREC.
0x8281 Negative acknowledgment when writing module Check the input at the PORT. parameter
Send_Config.WRREC.STATUS,
Receive_Config.WRREC.STATUSor
WRREC.STATUS , and in the description of the SFB
WRREC.
0x8282 Module not available Check the input at the parameter PORT and ensure
that the module can be reached.

Error messages

Configuration error - Modbus_Slave
0x8186 Invalid slave address Select a suitable slave address at the MB_ADDR
parameter.
The following are valid: 1-247 at standard address
range;
1-65535 at extended address area
(0 is reserved for broadcast)
0x8187 Invalid value at the MB_HOLD_REG parameter Select a suitable value for the holding register at the
MB_HOLD_REG parameter.
0x8188 Invalid operating mode or broadcast Select the
(MB_ADDR = 0) and parameter MODE ≠ 1 value 1 for MODE in broadcast operating mode or
select a different operating mode.
0x818C The pointer to an MB_HOLD_REG area must be a Select a valid value for the pointer to the
data block or a flag area. MB_HOLD_REG area.
Send_P2P.RDREC.STATUS or
Receive_P2P.RDREC.STATUS, and in the
description of the SFB RDREC.
Send_P2P.WRREC.STATUS or
Receive_P2P.WRREC.STATUS, and in the
description of the SFB WRREC.
0x8452 1) MB_HOLD_REG is not a pointer to a DB or a flag Check the pointer MB_HOLD_REG
area
0x8453 1) MB_HOLD_REG is not a pointer of type BOOL or Check the pointer MB_HOLD_REG
WORD
0x8454 1) The area addressed by MB_HOLD_REG is longer Check the pointer MB_HOLD_REG
than the DB, or the area addressed is too small for
the number of data bytes to be read or written.
0x8455 1) MB_HOLD_REG points to a write-protected DB Check the pointer MB_HOLD_REG
0x8456 1) Error during instruction execution. The cause of the Determine the value of the SFCSTATUS parameter.
error is shown in the static parameter STATUS. Check what this means in the description for SFC51,
STATUS parameter.

Error messages

Configuration error - Modbus_Master
0x8180 Invalid value for MB_DB parameter The value configured for MB_DB (instance data DB)
at the Modbus_Comm_Load instruction is not valid.
Check the interconnection of the
Modbus_Comm_Load instruction and its error
messages.
0x8186 Invalid station address Select a suitable station address at the MB_ADDR
parameter.
The following are valid: 1-247 at standard address
range;
1-65535 at extended address area
(0 is reserved for broadcast)
0x8188 Invalid operating mode or broadcast (MB_ADDR = 0) Select the value 1 for MODE in broadcast operating
and parameter MODE ≠ 1 mode or select a different operating mode.
0x8189 Invalid data address Select a suitable value for the data address at the
DATA_ADDR parameter.
See description Modbus_Master (Page 46) in the
Info system
0x818A Invalid length Select a suitable data length at the DATA_LEN
parameter.
Info system
0x818B Invalid valid for DATA_PTR Select a suitable value for the data pointer at the
DATA_PTR parameter (flag or DB address).
Info system
0x818C Interconnection error of the DATA_PTR parameter Check the interconnection of the instruction.
0x818D The area addressed by DATA_PTR is Check the pointer DATA_PTR
longer than the DB, or the area addressed
is too small for the number of data bytes to be read
or written.
Send_P2P.WRREC.STATUS,
Receive_P2P.WRREC.STATUS or Receive_Reset,
and in the description of the SFB WRREC.

Error messages

Communication errors - Modbus_Master and Modbus_Slave
0x80 D1 The waiting time for XON or CTS = ON has expired. The communication partner has a fault, is too slow
or is offline. Check the communication partner or
change the parameters, if necessary.
0x80D2 "Hardware RTS always ON": Send command aborted Check the communication partner. Make sure that
due to change from DSR = ON to OFF DSR is ON for the entire duration of transmission.
0x80E0 Frame aborted: Send buffer overflow / send frame too In the user program call the instruction more often or
long configure a communication with data flow control.
0x80E1 Frame aborted: Parity error Check the connection line of the communication
partners, or verify that both devices are configured
for the same data transmission rate, parity and stop
bit number.
0x80E2 Frame aborted: Character frame error Check the settings for start bit, data bits, parity bit,
data transmission rate, and stop bit(s).
0x80E3 Frame aborted: Character overflow error Check the number of data in the frame of the
0x80E4 Frame aborted: Maximum frame length reached Select a shorter frame length at the communication
partner.
1-1024/2048/4096 (bytes)
Communication error - Modbus_Master
0x80C8 The slave does not respond within the set time Check the data transmission rate, parity and wiring
of the slave.
0x8200 The interface is busy with an ongoing request. Repeat the command later. Make sure that there are
no commands still running before you start a new
one.
Protocol error - Modbus_Slave (only communication modules that support Modbus)
0x8380 CRC error Checksum error of the Modbus frame. Check the
0x8381 The function code is not supported or is not supported Check the communication partner and make sure
for broadcast. that a valid function code is sent.
0x8382 Invalid length information in the request frame Select a suitable data length at the DATA_LEN
parameter.
0x8383 Invalid data address in the request frame Select a suitable value for the data address at the
DATA_ADDR parameter.
0x8384 Invalid data value error in the request frame Check the data value in the request frame of the
Modbus master
0x8385 The diagnostic value is not supported by the Modbus The Modbus slave only supports the diagnostic
slave (function code 08) values 0x0000 and 0x000A.

Error messages

Protocol error - Modbus_Master (only communication modules that support Modbus)
0x8380 CRC error Checksum error of the Modbus frame. Check the
0x8381 Response frame from Modbus Slave with the Check the communication partner and make sure
following error message: The function code is not that a valid function code is sent.
supported.
0x8382 Response frame from Modbus Slave with the Select a suitable data length.
following error message: Invalid length
0x8383 Response frame from Modbus Slave with the Select a suitable value for the data address at the
following error message: Invalid data address in the DATA_ADDR parameter.
request frame
0x8384 Response frame from Modbus Slave with the Check the request frame to the Modbus slave.
following error message: Data value error
0x8385 Response frame from Modbus Slave with the Modbus slaves only support the diagnostic values
following error message: The diagnostic value is not 0x0000 and 0x000A.
supported by the Modbus slave
0x8386 The returned function code does not match the Check the response frame and the addressing of the
requested function code. slave.
0x8387 A slave that was not requested answers Check the response frame of the slave. Check the
address settings of the slave.
0x8388 Error in the response of the slave to a write request. Check the response frame of the slave.
0x8828 1) DATA_PTR points to a bit address which is not equal Check the pointer DATA_PTR
to n * 8
0x8852 1) DATA_PTR is not a pointer to a DB or a flag area Check the pointer DATA_PTR
0x8853 1) DATA_PTR is not a pointer of type BOOL or WORD Check the pointer DATA_PTR
0x8855 1) DATA_PTR points to a write-protected DB Check the pointer DATA_PTR
0x8856 1) Error during call of SFC51 Call the Modbus_Master instruction again
Error - Modbus_Slave (only communication modules that support Modbus)
0x8428 1) MB_HOLD_REG points to a bit address which is not Check the pointer MB_HOLD_REG
equal to n * 8
0x8452 1) MB_HOLD_REG is not a pointer to a DB or a flag Check the pointer MB_HOLD_REG
area
0x8453 1) MB_HOLD_REG is not a pointer of type BOOL or Check the pointer MB_HOLD_REG
WORD
0x8454 1) The area addressed by MB_HOLD_REG is longer Check the pointer MB_HOLD_REG
than the DB, or the area addressed is too small for
the number of data bytes to be read or written.
0x8455 1) MB_HOLD_REG points to a write-protected DB Check the pointer MB_HOLD_REG
0x8456 1) Error during call of SFC51 Call the Modbus_Slave instruction again
1) Only with instructions for S7-300/400CPUs

Error messages
Overview of error messages - USS

0x0000 No error -
0x8180 Length error in response of drive Check the response frame of the drive.
0x8181 Data type error Select a suitable data type.
• Real
• Word
• Double word
0x8182 Data type error: "Double word" or "Real" may not be Check the response frame of the drive.
returned for the "Word" request.
0x8183 Data type error: "Word" may not be returned for the Check the response frame of the drive.
"Double word" or "Real" request.
0x8184 Checksum error in response of drive Check the drive and the communication connection.
0x8185 Addressing error Valid drive address range: 1 to 16
0x8186 Setpoint error Valid setpoint range: -200 % to +200 %
0x8187 Incorrect drive number returned Check the response frame of the drive.
0x8188 Invalid PZD length Permitted PZD lengths: 2, 4, 6 words
0x8189 The module does not support this data transmission Select a valid data transmission rate for the module.
rate.
0x818A A different request for this drive is currently active. Repeat the parameter read or write command later.
0x818B The drive does not respond. Check the drive.
0x818C The drive responds with an error message to a Check the response frame of the drive. Check the
parameter request. parameter request.
0x818D The drive responds with an access error message to Check the response frame of the drive. Check the
a parameter request. parameter request.
0x818E The drive was not initialized. Check the user program and make sure that the
USS_Drive_Control instruction is called for this drive.

Error messages

Port_Config.RDREC.STATUS,
Send_Config.RDREC.STATUS ,
Receive_Config.RDREC.STATUS ,
Port_Config.WRREC.STATUS,
Send_Config.WRREC.STATUS ,
Receive_Config.WRREC.STATUS ,
description of the SFB WRREC.
1) Only with instructions for S7-300/400 CPUs

Error messages

Service & Support A
7HFKQLFDO 7UDLQLQJ
&RQVXOWLQJ
7HF
LQH KQ
2QO RUW 6XS LFDO
X S S SRUW
6
6HUYLFH
VUW
6XSSRUW
)LH LFH
6HUYLFH
3D
6H
(QJLQHHULQJ
UH
UY
OG
3URJUDPV 6XSSRUW
D
6S
5HSDLU6HUYLFHV
0RGHUQL]DWLRQ 2SWLPL]DWLRQ
6HUYLFHV 6HUYLFHV
Unmatched complete service for the entire life cycle

For machine manufacturers, solution providers and plant operators: The service offering
from Siemens Industry Automation and Drive Technologies includes comprehensive services
for a wide range of different users in all sectors of the manufacturing and process industry.
To accompany our products and systems, we offer integrated and structured services that
provide valuable support in every phase of the life cycle of your machine or plant – from
planning and implementation through commissioning as far as maintenance and
modernization.
Our Service & Support accompanies you worldwide in all matters concerning automation and
drive technology from Siemens. We provide direct on-site support in more than 100 countries
through all phases of the life cycle of your machines and plants.
You have an experienced team of specialists at your side to provide active support and
bundled know-how. Regular training courses and intensive contact among our employees –
even across continents – ensure reliable service in the most diverse areas.

Service & Support
Online Support
The comprehensive online information platform supports you in all aspects of our Service &
Support at any time and from any location in the world.
You can find Online Support at the following address on the Internet
(http://www.siemens.com/automation/service&support).
Technical Consulting
Support in planning and designing your project: From detailed actual-state analysis,
definition of the goal and consultation on product and system questions right through to the
creation of the automation solution.
Technical Support
Expert advice on technical questions with a wide range of demand-optimized services for all
our products and systems.
You can find Technical Support at the following address on the Internet
(http://www.siemens.com/automation/support-request).
Training
Extend your competitive edge – through practical know-how directly from the manufacturer.
You can find the training courses at the following address on the Internet
(http://www.siemens.com/sitrain).
Engineering Support
Support during project engineering and development with services fine-tuned to your
requirements, from configuration through to implementation of an automation project.
Field Service
Our Field Service offers you services for commissioning and maintenance – to ensure that
your machines and plants are always available.
Spare parts
In every sector worldwide, plants and systems are required to operate with constantly
increasing reliability. We will provide you with the support you need to prevent a standstill
from occurring in the first place: with a worldwide network and optimum logistics chains.
Repairs
Downtimes cause problems in the plant as well as unnecessary costs. We can help you to
reduce both to a minimum – with our worldwide repair facilities.

Service & Support
Optimization
During the service life of machines and plants, there is often a great potential for increasing
productivity or reducing costs.
To help you achieve this potential, we are offering a complete range of optimization services.
Modernization
You can also rely on our support when it comes to modernization – with comprehensive
services from the planning phase all the way to commissioning.
Service programs
Our service programs are select service packages for an automation and drives system or
product group. The individual services are coordinated with each other to ensure smooth
coverage of the entire life cycle and support optimum use of your products and systems.
The services of a service program can be flexibly adapted at any time and used separately.
Examples of service programs:
● Service contracts
● Plant IT Security Services
● Life Cycle Services for Drive Engineering
● SIMATIC PCS 7 Life Cycle Services
● SINUMERIK Manufacturing Excellence
● SIMATIC Remote Support Services
Benefits at a glance:
● Reduced downtimes for increased productivity
● Optimized maintenance costs due to a tailored scope of services
● Costs that can be calculated and therefore planned
● Service reliability due to guaranteed response times and spare part delivery times
● Customer service personnel will be supported and relieved of additional tasks
● Comprehensive service from a single source, fewer interfaces and greater expertise
Contact
At your service locally, around the globe: your partner for consultation, sales, training,
service, support, spare parts... for the entire range of products from Industry Automation and
Drive Technologies.
You can find your personal contact in our contacts database on the Internet
(http://www.siemens.com/automation/partner).

Service & Support

Glossary
Automation system
An automation system is a programmable logic controller consisting of at least one CPU,
various input and output modules, and operating and monitoring devices.
Communication module
Communication modules are used for point-to-point connections and bus links.
Configuring
Configuring refers to the configuration of separate modules of an automation system in the
configuration table.
CPU
Central Processing Unit = Central module of the automation system that consists of the
control and computing units, memory, system program, and interfaces to the I/O modules.
CTS
Clear to send. The communication partner is ready to receive data.
Cycle time
The cycle time is the time that the CPU requires to process the user program once.
Cyclic program processing

In cyclic program processing the user program runs in program loop, or cycle, that is
constantly repeated.
Default setting
The default setting is a reasonable basic setting that can be used whenever no other value is
specified.
Diagnostic events
Diagnostics events are, for example, module errors or system errors in the CPU that may be
caused by a program error.

Glossary
Diagnostic functions
The diagnostic functions cover the entire system diagnostics and include the recognition,
interpretation and reporting of errors within the automation system.
Diagnostics buffer
Memory area in which detailed information on all diagnostics events is entered based on the
order of their occurrence.
Hardware
Hardware is the entire physical and technical equipment of a automation system.
Module parameters
Module parameters are values with which the behavior of the module can be set.
Online/Offline
When you are online there is a data connection between the automation system and
programming device, when you are offline there is no data connection between them.
Parameter assignment
Parameter assignment refers to the setting of a module's behavior.
Parameters
Parameters are values that can be allocated. There are two different types of parameters:
block parameters and module parameters.
Point-to-point communication
In point-to-point communication the communication processor forms the interface between a
programmable logic controller and a communication partner.
Procedure
Procedure refers to the process of a data transmission according to a specific protocol.
Protocol
All communication partners involved in data transmission must follow fixed rules for handling
and implementing the data traffic. Such rules are called protocols.

Glossary
Receive line initial state

The initial state of the receive line for RS422 and RS485 mode:
● enables break detection (wire break)
● ensures a defined level on the receive line while it is not sending.
RTS
Request to send. The communication module is ready to send.
Software
Software refers to the entirety of all programs that are used on a computing system. The
operating system and user programs belong to this.
User program
The user program contains all instructions and declarations for processing the signals used
for controlling a system or a process. In SIMATIC S7 the user program is structured and
divided into small units, the blocks.
USS
The USS® protocol (universal serial interface protocol) defines an access method based on
the master-slave principle for communication by means of a serial bus. The point-to-point
connection is included as a subset in this protocol.
XON/XOFF
Software data flow control with XON/XOFF. You can configure the characters for XON and
XOFF (any ASCII character). The user data may not contain these characters.

Glossary

Index
USS_Read_Param, 77
USS_Write_Param, 79
Interface configuration
Instructions, 14
B
BUFFER parameter, Send_P2P, 34
L
LENGTH parameter, Send_P2P, 34
C
Library for the USS protocol
Communication General information on drive setup, 81
Query architecture, 16 Overview, 65
Communication interfaces Requirements for use, 67
Programming, 13 USS_Drive_Control, 74
Communication module (CM) USS_Port_Scan, 71
Data reception, 35 USS_Read_Param, 77
Programming, 13 USS_Write_Param, 79
D M
Data transmission, trigger, 32 Modbus
Modbus_Comm_Load, 43
Modbus_Slave, 46, 53
F Modbus_Comm_Load, 11, 43
Modbus_Master, 11
Frame configuration
Modbus_Slave, 11, 46, 53
Instructions, 14
P
G
P3964_Config, 10
Get_Features, 10
P3964_Config (protocol configuration), 30
Global library
Parameter configuration
Overview of the USS protocol, 65
LENGH and BUFFER for Send_P2P, 34
Point-to-point programming, 13
Port_Config, 10
I
Port_Config (port configuration), 20
Instructions Programming
P3964_Config (protocol configuration), 30 PtP instructions, 13
Port_Config (port configuration), 20 PtP communication
Receive_Config (receive configuration), 25 Programming, 13
Receive_P2P (receive point-to-point data), 35 PtP error classes, 19
Receive_Reset (reset receiver), 36 PtP instructions return values, 18
Send_Config (send configuration), 23
Send_P2P (send point-to-point data), 32
Signal_Get (get RS232 signals), 37 Q
Signal_Get (set RS232 signals), 38
Query architecture, 16
USS_Drive_Control, 74
Query architecture master, 16
USS_Port_Scan, 71

Index
Query architecture slave, 17
R
Receive_Config, 10
Receive_Config (receive configuration), 25
Receive_P2P, 10
Receive_P2P (receive point-to-point data), 35
Receive_Reset, 10
Receive_Reset (reset receiver), 36
Return values
PtP instructions, 18
Return values receive runtime, 35
S
Send_Config, 10
Send_Config (send configuration), 23
Send_P2P, 10
Send_P2P (send point-to-point data), 32
LENGH and BUFFER parameters, 34
Set_Features, 10
Shared PtP parameter errors, 19
Signal_Get, 10
Signal_Get (get RS232 signals), 37
Signal_Get (set RS232 signals), 38
Signal_Set, 10
U
USS_Drive_Control, 11, 66, 74
USS_Port_Scan, 11, 66, 71
USS_Read_Param, 11, 66, 77
USS_Write_Param, 11, 66, 79


s7300400 CM PTP Programming Manual en-US en-US

Uploaded by

Copyright:

Available Formats

s7300400 CM PTP Programming Manual en-US en-US

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

s7300400 CM PTP Programming Manual en-US en-US

Uploaded by

Copyright:

Available Formats

___________________

 PtP communication instructions used withPreface

Siemens AG A5E31625081-AA Copyright © Siemens AG 2013.

Purpose of the documentation

Basic knowledge required

Validity of the documentation

PtP communication instructions used with distributed I/O of an S7‑300/400

Recycling and disposal

PtP communication instructions used with distributed I/O of an S7‑300/400

PtP communication instructions used with distributed I/O of an S7‑300/400

PtP communication instructions used with distributed I/O of an S7‑300/400

Overview of documentation on the topic of point-to-point communication

Subject Documentation Important contents

PtP communication instructions used with distributed I/O of an S7‑300/400

Subject Documentation Important contents

PtP communication instructions used with distributed I/O of an S7‑300/400

TIA Portal terminology

2.2 Overview of instructions

PtP communication instructions used with distributed I/O of an S7‑300/400

Overview of the instructions

Table 2- 1 Instructions for PtP

PtP communication instructions used with distributed I/O of an S7‑300/400

Table 2- 2 Instructions for USS

Table 2- 3 Instructions for Modbus

PtP communication instructions used with distributed I/O of an S7‑300/400

PtP communication instructions used with distributed I/O of an S7‑300/400

3.1.1 Overview PtP communication

PtP communication instructions used with distributed I/O of an S7‑300/400

PtP communication instructions used with distributed I/O of an S7‑300/400

PtP communication instructions used with distributed I/O of an S7‑300/400

3.1.2 Using the instructions

PtP communication instructions used with distributed I/O of an S7‑300/400

PtP communication instructions used with distributed I/O of an S7‑300/400

3.1.3 Shared parameters for point-to-point operations

Table 3- 1 General input parameters of the PtP instructions

Table 3- 2 Output parameters DONE, NDR, ERROR and STATUS

Parameters Data type Standard Description

PtP communication instructions used with distributed I/O of an S7‑300/400

Table 3- 3 COM_RST in/out parameter

Parameters Data type Standard Description

Table 3- 4 Shared error codes

Error code Description

Table 3- 5 Shared error classes of the STATUS parameter

Description of the class Error classes Description

PtP communication instructions used with distributed I/O of an S7‑300/400

3.1.4 Port_Config: Configure PtP communication port

Parameters Decla- Data type Standard Description

PtP communication instructions used with distributed I/O of an S7‑300/400

Parameters Decla- Data type Standard Description

PtP communication instructions used with distributed I/O of an S7‑300/400

Parameters Decla- Data type Standard Description

PtP communication instructions used with distributed I/O of an S7‑300/400

3.1.5 Send_Config: Configure PtP sender

Parameters Declara- Data type Standard Description

PtP communication instructions used with distributed I/O of an S7‑300/400

Parameters Declara- Data type Standard Description

PtP communication instructions used with distributed I/O of an S7‑300/400

3.1.6 Receive_Config: Configure PtP recipient

Para- Declaration Data type Standard Description

PtP communication instructions used withPreface