Based on the S7-300/400 Ethernet module CP343-1 &CP443-1 Modbus TCP used in STEP7 Door (V6.0)

1 Overview of Modbus TCP communication

MODBUS TCP is a simple, vendor-neutral derivative of the MODBUS family of communication protocols for managing and controlling automation devices, and it obviously covers the purpose of MODBUS messages in the "Intranet" and "Internet" environments that use TCP/IP. The most common use of the protocol is for services such as PLCS and gateways connecting to other simple domain buses or I/O modules.

MODBUS TCP enables MODBUS_RTU to run on Ethernet. MODBUS TCP uses TCP/IP and Ethernet to transmit MODBUS packets between sites. MODBUS TCP combines Ethernet physical networking with the networking standard TCP/IP and data representation with MODBUS as the application protocol standard. MODBUS TCP communication packets are encapsulated in Ethernet TCP/IP packets. Unlike the traditional serial port mode, MODBUS TCP inserts a standard MODBUS message into the TCP message without the data checksum address.

1.1 Ethernet reference model for communication

The Modbus TCP transmission process uses Layer 5 of the TCP/IP Ethernet reference model:

Layer 1: The physical layer provides the physical interface of the device and is compatible with the commercially available media/network adapter.

The second layer: the data link layer, formats the signal to the source/destination hardware address data frame.

Layer 3: The network layer implements packets with 32-bit IP addresses.

The fourth layer: the transport layer, to achieve reliable connection, transmission, error checking, retransmission, port service, transmission scheduling.

Layer 5: Application layer, Modbus protocol packets.

1.2 Modbus TCP Data frame

Modbus data is transmitted over TCP/IP Ethernet and supports Ethernet II and 802.3 frame formats. The Modbus TCP data frame consists of three parts: packet header, function code and data. The Modbus Application Protocol (MBAP) packet header is divided into four domains. Total 7 bytes.

1.3 Port Number for Modbus TCP

(1) When PLC is used as Modbus server, Port 502 communication port is used according to default protocol, and any communication port is set in the Modus client program.

(2) When PLC is used as Modbus client, it is not necessary to set the local port number; If you want to specify a client port number, you are advised to start with 2000 to avoid conflicts with other communication protocols.

2 Overview of Modbus TCP communication on the S7-300/400 Ethernet module

This document applies to SIMATIC S7-300, S7-400 CPU with Ethernet module CP343-1 or CP443-1 software products. The instructions allow communication between S7-300, S7-400 systems with Ethernet modules CP343-1 or CP443-1 and devices that support the Modbus TCP protocol.

Data transmission is carried out according to the client-server principle. SIMATIC S7 can be used as a client or server during transfer.

2.1 Software and Hardware

When Modbus TCP commands are used in STEP7 software, the Modbus TCP CP instruction library needs to be installed before SIMATIC S7-300, S7-400 CPU with Ethernet module CP343-1 or CP443-1 can communicate with the communication partners that support Modbus TCP. As shown in Figure 2-1:

2.2 Modbus TCP CP V6.0 Software Option Package

When the software package is installed and integrated into Step7, you can find the block library, routines, and English manual in the corresponding directory of the Step7 installation file, as shown in the following figure. In the actual debugging process of the project, since the functions of the example program are relatively perfect, you can directly use the example program and modify the corresponding parameters according to the actual situation of the project. Can save a lot of parameter setting time.

3 Configure the Ethernet module as the Modbus TCP Server to communicate with the communication partner

The following uses the S7-300 single-site system and Modscan32 software as an example to describe how to configure the S7-300 single-site system as the Modbus TCP Server through the Ethernet module CP343-1 to communicate with Modscan32 as a Client.

3.1 Configuring Hardware

Create a new project (project name: MB_TCP_CP_V60) in STEP7.

3.2 Adding a TCP Connection

On the Hardware Configuration page, click "Configure Network" under Options to enter the network configuration page.

Next, select CPU, and in the table below, right-click and select "Insert New Connection" to add the TCP connection.

The communication partner is Unspecified and the connection type is TCP connection.

Select the local connection resource number (default ID=1) and PLC as the server. Note that "Active connection establishment" is not checked.

Click the "Addresses" page and set the local port number to 502.

3.3 Routine Description

Open the routine and copy all program Blocks (do not copy System data) from site SIMATIC 300 (Server) to the blocks of site SIMATIC 300 (1) of new project MB_TCP_CP_V60.

(1) Open OB1 and view the command "MODBUSCP"

The Modbus TCP command is invoked in the OB1 organizational block of the project,

The following are some pin descriptions (for other pin information, please see the instruction library manual) :

id: indicates the ID of the configured connection in Configure Network. The connection ID is the unique identification of the connection between the CPU and the connection partner through the CP. Enter the number for the connection configuration here. This parameter ranges from 1 to 64.

db_param: parameter data block that contains modbus data parameters for the modbus block instance. The CPU determines the value range of this parameter. DB number 0 is reserved for the system and cannot be used. Enter the DB number "DBxy" in plain text format. If multiple connections are to be implemented, the parameter data block can contain the parameters required for all connections in order.

REG_KEY_DB: Registration key used for authorization.

MONITOR: Monitoring time MONITOR is used to monitor incoming data from connection partners. The time format T# is used to specify the monitoring time. It is recommended that the monitoring time be about 1.5s.

In "S7 as server" mode, the input of the second part of the frame is monitored by MONITOR time. If the monitoring time is exceeded, an error is reported. This time is calculated from the receipt of the MODBUS/TCP specific packet header and ends when the request is fully received.

Init: initializes the Modbus block when there is a rising edge in the parameter. Initialization can only be performed if no jobs are currently running. This condition must be ensured in the program by ENQ_ENR = FALSE and BUSY = FALSE.

(2) Parameter data block DB2

Parameter data block DB2 (name MODBUS_PARAM_CP). This parameter DB block is used to set the modbus data area.

Notice To modify Data in the DB block, switch the DB block to Data view and modify the DB block in the Actual value column.

In this example, you need to change DB2 ID2_ID to 16#1 according to the connection Settings in Figure 3-7. To facilitate the mapping of subsequent communication test addresses, change the start and end addresses of the modbus register to 16#0 and 16#1F3 respectively.

3.4 Communication Test

Download the project to the CPU, open the Modsan32 application, the following to the hold register as an example to introduce the communication test process.

First, select connect under the Connection menu for ModScan32 and set the IP address and port number for ModScan32 to access the PLC as the server side.

Finally, set the start address and length of Modbus to be accessed in Modscan32 software (in this test, Modscan32 uses data type 3 and the start address of the access hold register is 10 words of 40001), establish a communication connection with PLC, and carry out data reading.

You can view the communication status in the network configuration window.

Some considerations for using the function block "MODBUSCP" :

1) The S7-300CPU supports communication with multiple Modbus clients through the function block "MODBUSCP" of the Ethernet module CP343-1. The number supported depends on the number of TCP connections supported by the CP343-1. The function block "MODBUSCP" must be invoked once for each client connection. Parameters such as background data block, ID, and port number must be unique.

2) The S7-300CPU can be used as the Server and Client of Modbus TCP through the Ethernet module CP343-1.

3) The S7-300CPU supports multiple protocols through the Ethernet module CP343-1, which can run PROFINET, TCP/IP, S7 and other protocols in addition to Modbus TCP.

4 Configure the Ethernet module as the Modbus TCP Client to establish communication with the communication partner

The following uses the S7-300 single-site system and ModSim32 software as an example to describe how to configure the S7-300 single-site system as the Modbus TCP Client through the Ethernet module CP343-1 to communicate with Modsim32 as the Server.