Application description 11/2015

Modbus/TCP Communication
S7-300 / S7-400 CPU, ET 200S CPU and STEP 7 V5.5

https://support.industry.siemens.com/cs/ww/en/view/109479369
 Warranty and Liability

Warranty and Liability

Note The sample applications are not binding and do not claim to be complete
regarding the circuits shown, equipment and any eventuality. The sample
applications do not represent customer-specific solutions. They are only intended
to provide support for typical applications. You are responsible for ensuring that
the described products are used correctly. These sample applications do not
relieve you of the responsibility to use safe practices in application, installation,
operation and maintenance. When using these sample applications, you
recognize that we cannot be made liable for any damage/claims beyond the
liability clause described. We reserve the right to make changes to these sample
applications at any time without prior notice.
If there are any deviations between the recommendations provided in these
sample applications and other Siemens publications – e.g. Catalogs – the
contents of the other documents have priority.

We do not accept any liability for the information contained in this document.

Any claims against us – based on whatever legal reason – resulting from the use of
the examples, information, programs, engineering and performance data etc.,
described in this sample application shall be excluded. Such an exclusion shall not
apply in the case of mandatory liability, e.g. under the German Product Liability Act
(“Produkthaftungsgesetz”), in case of intent, gross negligence, or injury of life, body
Siemens AG 2015 All rights reserved

or health, guarantee for the quality of a product, fraudulent concealment of a

deficiency or breach of a condition which goes to the root of the contract
(“wesentliche Vertragspflichten”). The damages for a breach of a substantial
contractual obligation are, however, limited to the foreseeable damage, typical for
the type of contract, except in the event of intent or gross negligence or injury to
life, body or health. The above provisions do not imply a change of the burden of
proof to your detriment.

Any form of duplication or distribution of these sample applications or excerpts

hereof is prohibited without the expressed consent of Siemens AG.

Security Siemens provides products and solutions with industrial security functions that
Informati support the secure operation of plants, solutions, machines, equipment and/or
on networks. They are important components in a holistic industrial security
concept. With this in mind, Siemens’ products and solutions undergo continuous
development. Siemens recommends strongly that you regularly check for
product updates.
For the secure operation of Siemens products and solutions, it is necessary to
take suitable preventive action (cell protection concept, for example) and
integrate each component into a holistic, state-of-the-art industrial security
concept. Third-party products that may be in use should also be considered.
For more information about industrial security, visit
http://www.siemens.com/industrialsecurity.
To stay informed about product updates as they occur, sign up for a product-
specific newsletter. For more information, visit
http://support.industry.siemens.com.

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 2
 Contents

Contents
Warranty and Liability ................................................................................................. 2
1 Task ..................................................................................................................... 4
2 Solution............................................................................................................... 5
2.1 Overview............................................................................................... 5
2.2 Hardware and Software Components .................................................. 6
2.2.1 Validity .................................................................................................. 6
2.2.2 Components Used ................................................................................ 6
3 Description of the Modbus/TCP Protocol ....................................................... 9
4 Function ............................................................................................................ 10
4.1 Functions ............................................................................................ 10
4.2 Blocks Utilized .................................................................................... 10
4.3 OB100 ................................................................................................ 13
4.4 FC1 "MODBUS_COMMUNICATION" ................................................ 13
4.5 FC2 "DEVICE_HANDLING" ............................................................... 13
5 Change the Number of Modbus Devices....................................................... 15
5.1 Block Changes ................................................................................... 15
6 History............................................................................................................... 19
Siemens AG 2015 All rights reserved

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 3
 1 Task

1 Task
Introduction
Data is to be exchanged between a PN CPU and multiple communication partners.
The CPU has a limited number of connection resources for this.
Simultaneous communication with all partners is not possible if the number of
Modbus/TCP communication partners exceeds the number of available
communication resources.

Description of the automation task

Only one connection resource of the PN CPU is to be used to read data from
multiple communication partners via Modbus/TCP.
In this example the PN CPU communicates with 3 Modbus devices via one
connection resource.
Siemens AG 2015 All rights reserved

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 4
 2 Solution

2 Solution
2.1 Overview
Diagram
The figure below shows the major components of the solution.
Figure 2-1

CPU 314C-2 PN/DP

Modbus client

L+ M L+ M L+ M

Modbus server Modbus server Modbus server

1 2 3

PN PN PN
Siemens AG 2015 All rights reserved

Industrial Ethernet

Description
For the data exchange the PN CPU acts as Modbus client and the 3
communication partners act as Modbus servers. As Modbus client the PN-CPU
establishes the connections one after the other to the Modbus devices and reads
out data.
1. The PN CPU establishes the connection to the first Modbus device. When the
connection has been established successfully, the data is read out of that
device and written to a data block (DB). The connection is then disconnected
so that it can be established to the second Modbus device.
2. The PN CPU establishes the connection to the second Modbus device. When
the connection has been established successfully, the data is read out of that
device and written to a data block (DB). The connection is then disconnected
so that it can be established to the third Modbus device.
3. The PN CPU establishes the connection to the third Modbus device. When the
connection has been established successfully, the data is read out of that
device and written to a data block (DB). The connection is then disconnected
so that it can be established again to the first Modbus device.

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 5
 2 Solution

Advantages
Only one connection resource is used in the PN CPU.
The PN CPU can communicate with more Modbus devices than there are
connection resources.

Limitation
This sample application is designed as an aid when using the software "SIMATIC
Modbus/TCP PN-CPU" (article number 2XV9450-1MB02).
Further information about Modbus/TCP in the SIMATIC environment is available
here:
SIMATIC Modbus/TCP
Since the sample application is designed as an aid for more complex
communication applications, we will not deal with the parameterization of a
Modbus/TCP connection.
The parameterization of a Modbus/TCP connection is described in the manual of
the software "SIMATIC Modbus/TCP PN-CPU".

NOTE The sample application uses the “SIMATIC Modbus/TCP PN-CPU” software
package. The “SIMATIC Modbus/TCP PN-CPU” software package needs a
license. As long as the “MODBUSPN” block isn`t licensed the SF-LED of the
CPU is blinking and the value 16#A090 (hex) is shown on the “STATUS”
Siemens AG 2015 All rights reserved

parameter of the “MODBUSPN” block as well as in the diagnostic buffer.

The sample application can also be used without license with all functions.

2.2 Hardware and Software Components

2.2.1 Validity

This application is valid for

STEP 7 V5.5
S7-300 / S7-400 PN CPUs
ET 200S PN CPU

2.2.2 Components Used

The application has been created with the components below.

Hardware components
Table 2-1
Component Qty. Article number Note
PS 307 10A 1 6ES7307-1KA00-0AA0
CPU 314C-2 PN/DP 1 6ES7314-6EH04-0AB0 Alternatively you can also use
other PN CPUs of S7-300,
S7-400 and ET 200S

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 6
 2 Solution

Software Components
Table 2-2
Component Qty. Article number Note
STEP 7 V5.5 1 6ES7810-4CC10-0YE5
SIMATIC 1 2XV9450-1MB02 You can download the
Modbus/TCP block library and manuals
PN-CPU V2.6.1 at this link:
Entry ID: 103473853
Siemens AG 2015 All rights reserved

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 7
 2 Solution

Component Qty. Article number Note

Modbus TCP 1 Optional: Recommended for
Wizard V1.4 configuring the parameter
data block
Download:
Entry ID: 31535566

Sample files and projects

Below is a list of all the files and projects used in this example.
Table 2-3
Component Note
109479369_ModbusTCP_Communication_v10.zip This packed file contains
the STEP 7 project.
109479369_ModbusTCP_Communication_v10_e.pdf This document.
Siemens AG 2015 All rights reserved

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 8
 3 Description of the Modbus/TCP Protocol

3 Description of the Modbus/TCP Protocol

Overview
Modbus/TCP is a communication protocol based on the client/server architecture.
An exact description of the protocol is available in the Modbus specifications which
you can download here http://www.modbus.org.

Communication procedure
Modbus/TCP communication runs as follows:
1. The Modbus client sends a request message to a Modbus server.
2. The Modbus server replies with a reply message containing the requested data
or acknowledges receipt of the request message.
Siemens AG 2015 All rights reserved

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 9
 4 Function

4 Function
Only one parameter data block is required for communication with 3 Modbus
devices and this contains the parameters for the first Modbus device.
The IP addresses for communication with the other Modbus devices are changed
by the program during runtime.
It is best to use the Modbus/TCP Wizard for easy setting of the Parameter DB.

4.1 Functions
The S7 program implements the following functions:
Initialization of the MODBUSPN block
Establishment and disconnection of the connections to the Modbus devices
Read-out of data from the devices and storage in data blocks
Error evaluation

4.2 Blocks Utilized

The table below shows the blocks used in this sample application.
Table 4-1
Siemens AG 2015 All rights reserved

Block Symbolic name Function

OBs
OB1 CYCL_EXC Cyclic program processing,
Call of FC1
OB100 COMPLETE_RESTART Startup OB for restart
Initialization of the Modbus block
Definition of the IP addresses for
the Modbus devices
OB121 PROG_ERR Programming error OB
FBs
FB63 TSEND Communication blocks from the library
FB64 TRCV "Standard Library > Communication
Blocks"
FB65 TCON
FB66 TDISCON
FB102 MODBUSPN Blocks for Modbus communication from
the library "Modbus_PN_CPU"
FB103 TCP_COMM
FB104 MOD_CLI
FB105 MOD_SERV
FCs
FC1 MODBUS_COMMUNICATION Call of the Modbus block (FB102)
Call of the evaluation (FC2)

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 10
 4 Function

Block Symbolic name Function

FC2 DEVICE_HANDLING Storage of read-out data in the DB
Checking and error handling
Setting of the IP addresses for the
next device
DBs
DB2 MODBUS_PARAM Parameterization for communication
DB3 LICENSE_DB License key
DB4 CONTROL_STATUS Data for controlling communication
DB5 DEVICE_STATUS Display of Modbus devices
DB11 DATA_AREA Reception buffer for the Modbus data
DB21 DATA_DEVICE_1 Data of the first Modbus device
DB22 DATA_DEVICE_2 Data of the second Modbus device
DB23 DATA_DEVICE_3 Data of the third Modbus device
DB102 IDB_MODBUSPN Instance data block of FB102
"MODBUSPN"
Siemens AG 2015 All rights reserved

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 11
 4 Function

Figure 4-1

MOD_
SERV TSEND
(FB105)
(FB63)

MODBUS TCP- TRCV

OB1 FC1 PN COMM
(FB102) (FB103) (FB64)

MOD_ TCON
CLI
(FB104) (FB65)

TDIS
MODBUS CON
_PARAM (FB66)
(DB2)

LICENSE_
DB (DB3)
Siemens AG 2015 All rights reserved

DATA_
AREA
(DB11)

IDB_
MODBUS
PN DB102

DEVICE_
HANDLIN
G (FC2)

DATA_
DEVICE_1
(DB21)

DATA_
DEVICE_2
(DB22)

DATA_
DEVICE_3
(DB23)

User program Library blocks System blocks

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 12
 4 Function

4.3 OB100
Function
The OB100 is called when the CPU is restarted.
The IP addresses of the 3 Modbus devices are stored in the data block
DEVICE_STATUS (DB5). Then the Modbus block FB102 "MODBUSPN" is
initialized. If initialization is error-free, the call cycle is started. If initialization has
errors, the STATUS is stored and no call cycle is started.

4.4 FC1 "MODBUS_COMMUNICATION"

FC1 is called in OB1. The Modbus block FB102 "MODBUSPN" for cyclic message
processing is called in this FC.
Evaluation is then performed with FC2 "DEVICE_HANDLING".

4.5 FC2 "DEVICE_HANDLING"

Parameter description
The addresses of the parameters are transferred to FC2. The values are specified
as pointers.
Siemens AG 2015 All rights reserved

Table 4-2
Parameter Data type Description
STATUS_FUNC ANY "STATUS_FUNC" variable of the data type
String[8] from address 18.0 in DB4
"CONTROL_STATUS"
DEVICE_START_ADR Pointer Array of the Modbus device in DB5
"DEVICE_STATUS"
DEVICE_STAT_FUNC ANY Address of the "STATUS_FUNC" variable of
the data type String[8] in DB5
"DEVICE_STATUS"
NEXT_DEVICE_IP ANY Address of the "IP_address" variable of the
data type ARRAY[1..6] of byte in DB5
"DEVICE_STATUS"
REM_STADDR ANY Address of the "rem_staddr" variable in DB2
"MODBUS_PARAM"
DATA_AREA ANY Address of the receive DB DB11
"DATA_AREA"
DATA_DEVICE ANY Address of the data block DB2x
"DATA_DEVICE_x"

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 13
 4 Function

Function
The FC "DEVICE_HANDLING" processes the data of the connected Modbus
device.
In the case of an error-free job the received data is copied to the corresponding
data block DB2x "DATA_DEVICE_X".
If an error occurs during communication, the error information is stored in the array
of the device concerned in DB5 "DEVICE_STATUS".
Then the parameters for the device to be read next are defined and a new job is
triggered.
Siemens AG 2015 All rights reserved

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 14
 5 Change the Number of Modbus Devices

5 Change the Number of Modbus Devices

The S7 program was created for communication with 3 Modbus devices. However,
you can change the number of Modbus devices to suit your requirements.
For this you follow the instructions below.

5.1 Block Changes

DB4 "CONTROL_STATUS"
DB4 "CONTROL_STATUS" contains the data for controlling Modbus
communication.
Change the number of Modbus devices in the parameter "Count_of_Devices".
Figure 5-1
Siemens AG 2015 All rights reserved

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 15
 5 Change the Number of Modbus Devices

DB5 "DEVICE_STATUS"
DB5 "DEVICE_STATUS" contains an array with a data structure for each of the
Modbus devices. The size of the array must correspond to the number of Modbus
devices.
Change the size of the array as necessary in the parameter "Count_of_Devices".
Figure 5-2

DBx "DATA_DEVICE_x"
For each device there must be a separate Modbus data block in which the received
Siemens AG 2015 All rights reserved

data is stored. Create a separate data block for each additional device.
Figure 5-3

OB100
In OB100 the IP addresses of the Mod
bus devices are stored in data block DB5 "DEVICE_STATUS".

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 16
 5 Change the Number of Modbus Devices

Copy the marked area and insert it in the OB for each device that is connected in
addition.
Figure 5-4
Siemens AG 2015 All rights reserved

FC1 "MODBUS_COMMUNICATION"
FC1 "MODBUS_COMMUNICATION" contains a jump list for the call of FC2
"DEVICE_HANDLING". Each Modbus device requires a call of FC2
"DEVICE_HANDLING" to which the device-specific data are transferred.
Extend the jump list by the number of additional devices.

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 17
 5 Change the Number of Modbus Devices

Figure 5-5
Siemens AG 2015 All rights reserved

Note The "Current_Device_Number" parameter is counted up continuously. For this

reason each Modbus device must also have a consecutive number.

Copy a network in which FC2 "DEVICE_HANDLING" is called and change the

transfer parameters accordingly.

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 18
 6 History

Figure 5-6
Siemens AG 2015 All rights reserved

6 History
Table 6-1
Version Date Change
V1.0 09/2015 First edition

Modbus/TCP Communication
Entry ID: 109479369, V1.0, 11/2015 19