S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

SIMATIC
S7-300/400 Tips
Group
6

Topic
S7-300 as Modbus Host

Overview
This Applications Tip describes a method for getting an S7-300 family PLC to act as a Modbus RTU host device. This tip will not work for S7-400 PLCs because the current versions of the CP441 card (6ES7 441-1AA00-0AE0 and 6ES7 441-2AA0-0AE0) do not support the ASCII driver. Hardware Requirements: S7-300 PLC. The Modbus host code will not fit in a S7-312 (the size of the Modbus and CP340 interface code and instance DBs is about 9 KBytes). A S7-313 will work, but a S7314 or 315 is recommended. CP 340 Point-to-Point Communications Processor Supported Functions: Modbus Function 3 - Read Holding Registers Modbus Function 16 - Preset Multiple Registers Both of these functions map Modbus holding registers starting at Modbus address 40001 into a single S7 data block for each Modbus secondary. PLC Resources Used: 9 KBytes PLC work memory for code and instance DBs. This does not include the register storage DB for each Modbus secondary, which will use another 80+ bytes per secondary. Timer 0, used to detect communications timeouts in polling.

Configuring the CP340

To work with the Modbus communications software, the CP340 card must be configured to use the ASCII driver. You do this using the STEP 7 Hardware Configuration utility. Once the CP340 card is added to your S7-300 rack, double-click on the card to set its properties. STEP 7 will open a window where you can set the CP340 properties.

Copyright 1997 by SIEMENS Status: 3/97

page 1 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Click on the Parameters button, and STEP 7 will open a CP340 protocol selection window (you must have the Point-to-Point configuration software installed for this to work).

Copyright 1997 by SIEMENS Status: 3/97

page 2 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Select ASCII in the protocol list, then double-click on the Protocol icon (the box with an envelope in it) to set the port parameters.

Copyright 1997 by SIEMENS Status: 3/97

page 3 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

For the End Code of a Receive Message Frame, select On Expiry of Character Delay Time. Set the Character Delay Time to the time it takes to transmit 4 characters at the selected baud rate. For 9600 baud, this is about 4 ms. Set the baud rate and character frame parameters to those used by your Modbus host device. Click on the Transmission tab in the Protocol window.

In the Data Flow Control field, select None. In order to get finer control of the RTS/CTS timing, we will be handling flow control within our PLC program. Click on the Receiving Data tab.

Copyright 1997 by SIEMENS Status: 3/97

page 4 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Set the checkbox for Delete CP Receive Buffer at Start-Up, and reset the checkbox for Prevent Overwriting. Press the OK button to accept the port parameters, the select the FileSave menu item in the CP340 Parameterization window. Close the CP340 Parameterization window, the press OK in the CP340 Properties window to accept the module configuration.

Copyright 1997 by SIEMENS Status: 3/97

page 5 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Installing the Modbus Software

Before installing the Modbus blocks, you must first copy the CP340 interface blocks into your program. These blocks, FB2, FB3, FC5, and FC6, are located in the CP340 library that was installed when you installed the CP340 configuration software. Drag these blocks from the library AP-off folder to your programs AP-off folder. The Modbus software is distributed as a STEP 7 import file. blocks: This file contains the following

FC1 Modbus CRC calculation function FB4 Modbus host Preset Multiple Registers function FB5 Modbus host Read Holding Registers function FB8 Modbus poll scheduler - polls up to 10 secondaries FB9 Modbus poll sequence function (write then read from single secondary) DB1 Table of pre-calculated CRC partial sums, used in CRC calculation. DB8 FB8 and FB9 instance data block DB12 P_RCV (CP340 receive function) instance data block DB13 P_SEND (CP340 send function) instance data block DB14 FB4 instance data block DB15 FB5 instance data block DB91..DB100 Data to/from Modbus secondary 1..10 To install these blocks into your program, right-click on the SO folder in the destination program. On the pop-up menu, select External Source File.

STEP 7 will open a file selection dialog. Select the modhost.awl import file, and press the Open button. The modhost source file has now been added to the SO folder. Right-click on the modhost source file, and select Compile from the pop-up menu.

Copyright 1997 by SIEMENS Status: 3/97

page 6 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

STEP 7 will open the LAD/STL editor to compile the source file. The compile may generate a few warning messages: ignore these. Close the LAD/STL editor. Click on the AP-off folder: the modbus blocks have been added to your program.

Copyright 1997 by SIEMENS Status: 3/97

page 7 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Using the Modbus Driver

The Modbus host driver is designed to exchange data with up to 10 Modbus secondaries. As frequently as possible, the driver writes a block of 20 registers to then reads a block of 20 registers from each Modbus secondary. The station addresses of the secondaries must be in the range 1..10. The Modbus host driver is invoked by adding a call to FB8 to your OB1 code.

You may need to change some of the default configuration values in DB8 to reflect your PLC and Modbus network configuration:
Location DB8.DBW0 Description MaxAddr - the highest Modbus secondary address to be polled. Must be in range 1..10. This keeps the driver from trying to poll all 10 possible secondaries if you have less than 10 on your network. Enable1 - boolean set TRUE to enable polling Modbus address 1. The EnableN bits let you selectively enable and disable polling individual stations. You might want to disable polling if a station is taken down for servicing, etc. to prevent communications timeouts from slowing down your polling. Enable2 - boolean set TRUE to enable polling address 2. Enable3 - boolean set TRUE to enable polling address 3. Enable4 - boolean set TRUE to enable polling address 4. Enable5 - boolean set TRUE to enable polling address 5. Enable6 - boolean set TRUE to enable polling address 6. Enable7 - boolean set TRUE to enable polling address 7. Enable8 - boolean set TRUE to enable polling address 8. Enable9 - boolean set TRUE to enable polling address 9. Enable10 - boolean set TRUE to enable polling address 10. LADDR - the starting I/O address of your CP340 card. Default Value 1

DB8.DBX2.0

TRUE

DB8.DBX2.1 DB8.DBX2.2 DB8.DBX2.3 DB8.DBX2.4 DB8.DBX2.5 DB8.DBX2.6 DB8.DBX2.7 DB8.DBX3.0 DB8.DBX3.1 DB8.DBW58

TRUE TRUE TRUE TRUE TRUE TRUE TRUE TRUE TRUE 256

Copyright 1997 by SIEMENS Status: 3/97

page 8 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
Secondary Address 1 2 3 4 5 6 7 8 9 10

S7-300 as Modbus Host

Data Block DB91 DB92 DB93 DB94 DB95 DB96 DB97 DB98 DB99 DB100

Tip No. 6

The Modbus Host driver maps registers from each secondary into a separate Data Block.

Each secondary data block is organized as 40 16-bit registers. The first 20 registers are read from Modbus addresses 40001..40020 in the secondary. The last 20 registers are written to Modbus addresses 40021..40040 in the secondary.

Copyright 1997 by SIEMENS Status: 3/97

page 9 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Modbus Driver Program

Note: In the interest of brevity, I have left the instance and secondary data blocks out of the program listing. To see a listing of these blocks, open modhost.awl with a text editor.
FUNCTION FC 1: VOID TITLE =Calculate CRC of Modbus message //This FC calculates the CRC of the specified msg, using the table lookup method. //The message should be in Modbus RTU format, with Address and Function as //the first 2 bytes, and the CRC as the last 2 bytes. The message len field //should include the address, function, data, and crc fields. //The FC will replace the existing CRC with the CRC that it calculates, then //return with stat=TRUE if the original CRC = the calculated CRC. AUTHOR : mmckay FAMILY : CP340 NAME : mod_crc VERSION : 1.0

VAR_INPUT msg_db : INT := 1; //DB number containing message msg_dbb : INT := 1; //byte in msg_db where msg starts msg_len : INT ; //message length in bytes crctbl : INT ; //DB # containing precalculated crc partial sums END_VAR VAR_OUTPUT stat : BOOL ; //status output: TRUE = crc good END_VAR VAR_TEMP msgCrc : INT ;//initial msg CRC crcIndex : DWORD ; //bit index of CRC in msg DB charNdx : DWORD ; //bit index of current msg character crcAccum : INT ; //crc accumulator tblNdx : DWORD ; db_no : INT ; index : INT ; END_VAR BEGIN NETWORK TITLE =Open Data Blocks //DI = modbus message block //DB = crc table block L #crctbl; T #index; OPN DB [#index]; //open our data blocks. DI=msg, DB=crctbl L #msg_db; T #db_no; OPN DI [#db_no]; NETWORK TITLE =Check message length //If the message length is < 4, then the modbus message is invalid L DBW 0; L 4; >=I ; SAVE ; Copyright 1997 by SIEMENS Status: 3/97 page 10 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
BEC ; NETWORK TITLE =Save initial CRC

S7-300 as Modbus Host

Tip No. 6

L #msg_len; //convert length to bit index of crc L #msg_dbb; //..bit index = (length - crc_len + msg_start) * 8 +I ; //.. = (msg_len -2 + msg_dbb) << 3 L 2; -I ; SLD 3; T #crcIndex; L DIW [#crcIndex]; T #msgCrc; NETWORK TITLE =initialization for loop L #msg_dbb; //point index to first character SLD 3; T #charNdx; L W#16#FFFF; //set crc accumulator to FFFF T #crcAccum; m001: L #crcAccum; //calculate crc table index L W#16#FF; AW ; L DIB [#charNdx]; XOW ; SLW 4; T #tblNdx; L #crcAccum; //calculate new crcAccum value L W#16#FF00; AW ; SRW 8; L DBW [#tblNdx]; XOW ; T #crcAccum; L #charNdx; //increment character index L 8; +D ; T #charNdx; L #crcIndex; //check for done <D ; JC m001; L #crcAccum; //byte swap crc accumulator CAW ; T #crcAccum; T DIW [#crcIndex]; //store new CRC in msg NETWORK TITLE =Compare new & old CRC L #msgCrc; L #crcAccum; ==I ; = #stat; END_FUNCTION DATA_BLOCK DB 1 Copyright 1997 by SIEMENS Status: 3/97 page 11 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
AUTHOR : mmckay FAMILY : cp340 NAME : crctbl VERSION : 1.0

S7-300 as Modbus Host

Tip No. 6

STRUCT w : ARRAY [0 .. 255 ] OF WORD ; END_STRUCT ; BEGIN w[0] := W#16#0; w[1] := W#16#C0C1; w[2] := W#16#C181; w[3] := W#16#140; w[4] := W#16#C301; w[5] := W#16#3C0; w[6] := W#16#280; w[7] := W#16#C241; w[8] := W#16#C601; w[9] := W#16#6C0; w[10] := W#16#780; w[11] := W#16#C741; w[12] := W#16#500; w[13] := W#16#C5C1; w[14] := W#16#C481; w[15] := W#16#440; w[16] := W#16#CC01; w[17] := W#16#CC0; w[18] := W#16#D80; w[19] := W#16#CD41; w[20] := W#16#F00; w[21] := W#16#CFC1; w[22] := W#16#CE81; w[23] := W#16#E40; w[24] := W#16#A00; w[25] := W#16#CAC1; w[26] := W#16#CB81; w[27] := W#16#B40; w[28] := W#16#C901; w[29] := W#16#9C0; w[30] := W#16#880; w[31] := W#16#C841; w[32] := W#16#D801; w[33] := W#16#18C0; w[34] := W#16#1980; w[35] := W#16#D941; w[36] := W#16#1B00; w[37] := W#16#DBC1; w[38] := W#16#DA81; w[39] := W#16#1A40; w[40] := W#16#1E00; w[41] := W#16#DEC1; w[42] := W#16#DF81; w[43] := W#16#1F40; w[44] := W#16#DD01; w[45] := W#16#1DC0; Copyright 1997 by SIEMENS Status: 3/97 page 12 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
w[46] := W#16#1C80; w[47] := W#16#DC41; w[48] := W#16#1400; w[49] := W#16#D4C1; w[50] := W#16#D581; w[51] := W#16#1540; w[52] := W#16#D701; w[53] := W#16#17C0; w[54] := W#16#1680; w[55] := W#16#D641; w[56] := W#16#D201; w[57] := W#16#12C0; w[58] := W#16#1380; w[59] := W#16#D341; w[60] := W#16#1100; w[61] := W#16#D1C1; w[62] := W#16#D081; w[63] := W#16#1040; w[64] := W#16#F001; w[65] := W#16#30C0; w[66] := W#16#3180; w[67] := W#16#F141; w[68] := W#16#3300; w[69] := W#16#F3C1; w[70] := W#16#F281; w[71] := W#16#3240; w[72] := W#16#3600; w[73] := W#16#F6C1; w[74] := W#16#F781; w[75] := W#16#3740; w[76] := W#16#F501; w[77] := W#16#35C0; w[78] := W#16#3480; w[79] := W#16#F441; w[80] := W#16#3C00; w[81] := W#16#FCC1; w[82] := W#16#FD81; w[83] := W#16#3D40; w[84] := W#16#FF01; w[85] := W#16#3FC0; w[86] := W#16#3E80; w[87] := W#16#FE41; w[88] := W#16#FA01; w[89] := W#16#3AC0; w[90] := W#16#3B80; w[91] := W#16#FB41; w[92] := W#16#3900; w[93] := W#16#F9C1; w[94] := W#16#F881; w[95] := W#16#3840; w[96] := W#16#2800; w[97] := W#16#E8C1; w[98] := W#16#E981; w[99] := W#16#2940; w[100] := W#16#EB01; w[101] := W#16#2BC0; Copyright 1997 by SIEMENS Status: 3/97

S7-300 as Modbus Host

Tip No. 6

page 13 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
w[102] := W#16#2A80; w[103] := W#16#EA41; w[104] := W#16#EE01; w[105] := W#16#2EC0; w[106] := W#16#2F80; w[107] := W#16#EF41; w[108] := W#16#2D00; w[109] := W#16#EDC1; w[110] := W#16#EC81; w[111] := W#16#2C40; w[112] := W#16#E401; w[113] := W#16#24C0; w[114] := W#16#2580; w[115] := W#16#E541; w[116] := W#16#2700; w[117] := W#16#E7C1; w[118] := W#16#E681; w[119] := W#16#2640; w[120] := W#16#2200; w[121] := W#16#E2C1; w[122] := W#16#E381; w[123] := W#16#2340; w[124] := W#16#E101; w[125] := W#16#21C0; w[126] := W#16#2080; w[127] := W#16#E041; w[128] := W#16#A001; w[129] := W#16#60C0; w[130] := W#16#6180; w[131] := W#16#A141; w[132] := W#16#6300; w[133] := W#16#A3C1; w[134] := W#16#A281; w[135] := W#16#6240; w[136] := W#16#6600; w[137] := W#16#A6C1; w[138] := W#16#A781; w[139] := W#16#6740; w[140] := W#16#A501; w[141] := W#16#65C0; w[142] := W#16#6480; w[143] := W#16#A441; w[144] := W#16#6C00; w[145] := W#16#ACC1; w[146] := W#16#AD81; w[147] := W#16#6D40; w[148] := W#16#AF01; w[149] := W#16#6FC0; w[150] := W#16#6E80; w[151] := W#16#AE41; w[152] := W#16#AA01; w[153] := W#16#6AC0; w[154] := W#16#6B80; w[155] := W#16#AB41; w[156] := W#16#6900; w[157] := W#16#A9C1; Copyright 1997 by SIEMENS Status: 3/97

S7-300 as Modbus Host

Tip No. 6

page 14 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
w[158] := W#16#A881; w[159] := W#16#6840; w[160] := W#16#7800; w[161] := W#16#B8C1; w[162] := W#16#B981; w[163] := W#16#7940; w[164] := W#16#BB01; w[165] := W#16#7BC0; w[166] := W#16#7A80; w[167] := W#16#BA41; w[168] := W#16#BE01; w[169] := W#16#7EC0; w[170] := W#16#7F80; w[171] := W#16#BF41; w[172] := W#16#7D00; w[173] := W#16#BDC1; w[174] := W#16#BC81; w[175] := W#16#7C40; w[176] := W#16#B401; w[177] := W#16#74C0; w[178] := W#16#7580; w[179] := W#16#B541; w[180] := W#16#7700; w[181] := W#16#B7C1; w[182] := W#16#B681; w[183] := W#16#7640; w[184] := W#16#7200; w[185] := W#16#B2C1; w[186] := W#16#B381; w[187] := W#16#7340; w[188] := W#16#B101; w[189] := W#16#71C0; w[190] := W#16#7080; w[191] := W#16#B041; w[192] := W#16#5000; w[193] := W#16#90C1; w[194] := W#16#9181; w[195] := W#16#5140; w[196] := W#16#9301; w[197] := W#16#53C0; w[198] := W#16#5280; w[199] := W#16#9241; w[200] := W#16#9601; w[201] := W#16#56C0; w[202] := W#16#5780; w[203] := W#16#9741; w[204] := W#16#5500; w[205] := W#16#95C1; w[206] := W#16#9481; w[207] := W#16#5440; w[208] := W#16#9C01; w[209] := W#16#5CC0; w[210] := W#16#5D80; w[211] := W#16#9D41; w[212] := W#16#5F00; w[213] := W#16#9FC1; Copyright 1997 by SIEMENS Status: 3/97

S7-300 as Modbus Host

Tip No. 6

page 15 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
w[214] := W#16#9E81; w[215] := W#16#5E40; w[216] := W#16#5A00; w[217] := W#16#9AC1; w[218] := W#16#9B81; w[219] := W#16#5B40; w[220] := W#16#9901; w[221] := W#16#59C0; w[222] := W#16#5880; w[223] := W#16#9841; w[224] := W#16#8801; w[225] := W#16#48C0; w[226] := W#16#4980; w[227] := W#16#8941; w[228] := W#16#4B00; w[229] := W#16#8BC1; w[230] := W#16#8A81; w[231] := W#16#4A40; w[232] := W#16#4E00; w[233] := W#16#8EC1; w[234] := W#16#8F81; w[235] := W#16#4F40; w[236] := W#16#8D01; w[237] := W#16#4DC0; w[238] := W#16#4C80; w[239] := W#16#8C41; w[240] := W#16#4400; w[241] := W#16#84C1; w[242] := W#16#8581; w[243] := W#16#4540; w[244] := W#16#8701; w[245] := W#16#47C0; w[246] := W#16#4680; w[247] := W#16#8641; w[248] := W#16#8201; w[249] := W#16#42C0; w[250] := W#16#4380; w[251] := W#16#8341; w[252] := W#16#4100; w[253] := W#16#81C1; w[254] := W#16#8081; w[255] := W#16#4040; END_DATA_BLOCK

S7-300 as Modbus Host

Tip No. 6

FUNCTION_BLOCK FB 4 TITLE =Modbus Host Write multiple registers (function 16) //On rising edge of "Write", send Preset Multiple Registers command to selected //Modbus secondary. Calling parameters are: // // clock = S7-300 clock memory byte, used for timing // LADDR = I/O address of CP340 card // MOD_ADDR = Modbus secondary address to talk to // DATA_DB = data block where Modbus secondary's data is stored // CRCTBL_DB = data block number where CRC partial sums are stored // Rsp_Time = time (in 1/10 second intervals) that we will wait for secondary // to respond before we will time out and declare an error. Copyright 1997 by SIEMENS Status: 3/97 page 16 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

// Write = send modbus frame on rising edge. Abort write if trailing edge // before response received from secondary. // WR_Start = Modbus register offset (0..size of DATA_DB/2) where start of // data to write to secondary is found. Secondary will store the // data at the corresponding address in its memory. // WR_Length = number of 16-bit Modbus registers to write. // cmplt = set when write operation has completed, or an error occurs. // WR_Status = indicates completion status back to calling block. Values are: // 0 = no error // 1 = already communications in progress // 3 = timeout on write operation // 4 = WR_Start illegal // 5 = WR_Length illegal // 6 = P_RCV error // 7 = response timeout // 8 = error response from secondary // 9 = bad CRC from secondary AUTHOR : mmckay FAMILY : CP340 NAME : modWrite VERSION : 1.0

VAR_INPUT clock : BYTE ; //CPU clock memory byte LADDR : INT ; //CP340 PW address MOD_ADDR : INT := 1; //Modbus slave address to write to DATA_DB : BLOCK_DB ; //network data storage CRCTBL_DB : INT := 1; //DB # of precalculated CRC lookup table Rsp_Time : INT := 100; //Response timeout preset in 0.1 sec intervals Write : BOOL ; //do write on rising edge WR_Start : INT ; //register (word) index of start of write in DATA_DB WR_Length : INT := 1; //length of write in words END_VAR VAR_OUTPUT cmplt : BOOL ; //write complete flag WR_Status : INT ; //write error indicator, valid if cmplt=TRUE END_VAR VAR in_send : BOOL ; //write in progress flag wr_os : BOOL ; //Write input one-shot wt4Rsp : BOOL ; //waiting for response from slave send_os : BOOL ; done_os : BOOL ; //flowDone rising edge clk_os : BOOL ; //10 Hz clock rising edge abort : BOOL ; //Write abort detection oneshot msg : ARRAY [0 .. 255 ] OF //Modbus frame buffer BYTE ; tmr : INT ; //response timer current value END_VAR VAR_TEMP new_write : BOOL ; //new write request dummy : BOOL ; //don't care output flowSend : BOOL ; startSend : BOOL ; commDone : BOOL ; //P_SEND completed sending frame Copyright 1997 by SIEMENS Status: 3/97 page 17 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

rspDone : BOOL ; //P_RCV has new response rspErr : BOOL ; //P_RCV error rspTO : BOOL ; //response timeout crcOK : BOOL ; //response CRC good CTS : BOOL ; //state of RS-232 CTS line from modem doCRC : BOOL ; //time to check response CRC msgLen : INT ; //Modbus frame length in bytes commStat : WORD ; //P_SEND status word DBlen : INT ; //length of DATA_DB WR_End : INT ; //end register of write cnt : INT ; //data counter msgDB : INT ; //msg DB number index : DINT ; END_VAR BEGIN NETWORK TITLE =If "Write" turned off, then abort operation A #Write; FN #abort; A #in_send; JNB _001; L 3; T #WR_Status; SET ; SAVE ; CLR ; _001: A BR; R #in_send; NETWORK TITLE =New write Request ? A #Write; FP #wr_os; = #new_write; R #cmplt; NETWORK TITLE =If not writing, then done. AN #new_write; AN #in_send; SAVE ; BEC ; NETWORK TITLE =new write ignored if already write in progress //WR_Status values: //0 = no error //1 = already communications in progress //3 = timeout on write operation //4 = WR_Start illegal //5 = WR_Length illegal //6 = P_RCV error //7 = response timeout //8 = error response from secondary //9 = bad CRC from secondary A #new_write; Copyright 1997 by SIEMENS Status: 3/97 page 18 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
A #in_send; JNB _002; L 1; T #WR_Status; SET ; SAVE ; CLR ; _002: A BR; SAVE ; BEC ; NETWORK TITLE =Get size of DATA_DB

S7-300 as Modbus Host

Tip No. 6

OPN #DATA_DB; //open data DB L DBLG; //get DATA_DB block length T #DBlen; NETWORK TITLE =Calculate last register in write //WR_Start and WR_Length are word values, so we need to multiply by 2 to get byte //values so that we can compare WR_End with DBlen. A( ; A #new_write; JNB _003; L #WR_Length; L #WR_Start; +I ; T #WR_End; AN OV; SAVE ; CLR ; _003: A BR; ) ; JNB _004; L #WR_End; L 2; *I ; T #WR_End; _004: NOP 0; NETWORK TITLE =Check WR_Start for legal range A( A( A A( L L <I ) O A A( L L >I ) ; ; #new_write; ; #WR_Start; 0; ; ; ; #new_write; ; #WR_End; #DBlen; ; ; page 19 / 45 Modhost_.doc Version 1.0

Copyright 1997 by SIEMENS Status: 3/97

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

) ; JNB _005; L 4; T #WR_Status; SET ; SAVE ; CLR ; _005: A BR; ) ; S #cmplt; R #new_write; NETWORK TITLE =Check WR_Length to make sure it won't overflow the buffer A #new_write; A( ; L #WR_Length; L 123; >I ; ) ; JNB _006; L 5; T #WR_Status; SET ; SAVE ; CLR ; _006: A BR; S #cmplt; NETWORK TITLE =If WR_Start or WR_Length error, then done A #cmplt; SAVE ; BEC ; NETWORK TITLE =If new write, initialize state flags A( ; A #new_write; JNB _007; L 0; T #WR_Status; SET ; SAVE ; CLR ; _007: A BR; ) ; S #in_send; R #wt4Rsp; R #cmplt; NETWORK TITLE =If time to transmit write frame, assert RTS A #in_send; = L 18.0; BLD 103; Copyright 1997 by SIEMENS Status: 3/97 page 20 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
A #in_send; AN #wt4Rsp; = L 18.1; BLD 103; A #in_send; JNB _008; CALL FC 6 ( LADDR DTR RTS

S7-300 as Modbus Host

Tip No. 6

:= #LADDR, := L 18.0, := L 18.1);

_008: NOP 0; NETWORK TITLE =After RTS asserted, wait for CTS before transmitting A #in_send; JNB _009; CALL FC 5 ( LADDR DTR_OUT DSR_IN RTS_OUT CTS_IN DCD_IN RI_IN

:= #LADDR, := #dummy, := #dummy, := #dummy, := #CTS, := #dummy, := #dummy);

_009: NOP 0; NETWORK TITLE =Once the modem has returned CTS, then time to send write frame A #in_send; AN #wt4Rsp; AN #new_write; A #CTS; = #flowSend; NETWORK TITLE =Flow control is ready for us to transmit the Modbus frame A #flowSend; FP #send_os; = #startSend; NETWORK TITLE =Get message DB number L DINO; T #msgDB; NETWORK TITLE =Build Modbus frame A #startSend; JCN sk15; L #MOD_ADDR; //secondary network address T #msg[0]; L 16; //Modbus function code 16 T #msg[1]; L #WR_Start; //register address hi byte Copyright 1997 by SIEMENS Status: 3/97 page 21 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

SRW 8; T #msg[2]; L #WR_Start; //register addreee lo byte L 255; AW ; T #msg[3]; L #WR_Length; //write length hi byte SRW 8; T #msg[4]; L #WR_Length; //write length lo byte L 255; AW ; T #msg[5]; L #WR_Length; //data length in bytes SLW 1; T #msg[6]; T #cnt; OPN #DATA_DB; L P#31.0; //***hard coded offset*** T #index; L #WR_Start; //init bit pointer to data SLW 4; LAR1 ; mov: L DBB [AR1,P#0.0]; //copy data to buffer T DIB [#index]; +AR1 P#1.0; //increment pointers by 1 byte L #index; L P#1.0; +D ; T #index; L #cnt; //decrement byte counter DEC 1; T #cnt; L 0; >I ; JC mov; L #msg[6]; //get frame data byte count L 9; //add frame overhead +I ; T #msgLen; CALL FC 1 (//go calculate crc for frame msg_db := #msgDB, msg_dbb := 24,//*** hard coded offset *** msg_len := #msgLen, crctbl := #CRCTBL_DB, stat := #dummy); sk15: NOP 0; NETWORK TITLE =Send Modbus frame to CP340 card A #flowSend; = L 18.0; BLD 103; AN #in_send; = L 18.1; Copyright 1997 by SIEMENS Status: 3/97 page 22 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

BLD 103; A #in_send; JNB _00a; CALL FB 3 , DB 13 ( REQ := L 18.0, R := L 18.1, LADDR := #LADDR, DB_NO := #msgDB, DBB_NO := 24, LEN := #msgLen, DONE := #commDone, ERROR := #dummy, STATUS := #commStat); _00a: NOP 0; NETWORK TITLE =Wait up to 10 seconds for response A #commDone; A #flowSend; FP #done_os; JNB _00b; L #Rsp_Time; T #tmr; SET ; SAVE ; CLR ; _00b: A BR; S #wt4Rsp; NETWORK TITLE =Waiting for response A #wt4Rsp; = L 18.0; BLD 103; A #new_write; = L 18.1; BLD 103; A #in_send; JNB _00c; CALL FB 2 , DB 12 ( EN_R := L 18.0, R := L 18.1, LADDR := #LADDR, DB_NO := #msgDB, DBB_NO := 24, NDR := #rspDone, ERROR := #rspErr, LEN := #msgLen, STATUS := #commStat); _00c: NOP 0; NETWORK TITLE =...but not too long A #wt4Rsp; //time active only if waiting page 23 / 45 Modhost_.doc Version 1.0

Copyright 1997 by SIEMENS Status: 3/97

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

JNB sk20; L P#0.0; //pointer to bit 0 of clock LAR1 ; A DIX [AR1,P#0.0]; FP #clk_os; //get rising edge JNB sk20; L #tmr; //decrement timer L 1; -I ; T #tmr; L 0; //timer elapsed? <=I ; SAVE ; CLR ; sk20: A BR; = #rspTO; //timeout flag NETWORK TITLE =timeout on response A #rspTO; JNB _00d; L 7; T #WR_Status; SET ; SAVE ; CLR ; _00d: A BR; S #cmplt; NETWORK TITLE =Error in P_RCV A #rspErr; A #wt4Rsp; JNB _00e; L 6; T #WR_Status; SET ; SAVE ; CLR ; _00e: A BR; S #cmplt; NETWORK TITLE =If we have a new response, then check its CRC A #rspDone; A #wt4Rsp; AN #cmplt; = #doCRC; NETWORK TITLE =Check response CRC A #doCRC; JNB _00f; CALL FC 1 ( msg_db msg_dbb

:= #msgDB, := 24, page 24 / 45 Modhost_.doc Version 1.0

Copyright 1997 by SIEMENS Status: 3/97

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
msg_len crctbl stat

S7-300 as Modbus Host

:= #msgLen, := #CRCTBL_DB, := #crcOK);

Tip No. 6

_00f: NOP 0; NETWORK TITLE =Response CRC bad A #doCRC; AN #crcOK; JNB _010; L 9; T #WR_Status; SET ; SAVE ; CLR ; _010: A BR; S #cmplt; NETWORK TITLE =If CRC OK, then check for wrong Modbus Function code in response A #doCRC; AN #cmplt; A( ; L #msg[1]; //response Modbus function code L 16; //code we sent <>I ; //if different, then error ) ; JNB sk26; L 8; //bad response error code T #WR_Status; SET ; SAVE ; CLR ; sk26: A BR; S #cmplt; NETWORK TITLE =Done A #rspDone; A #wt4Rsp; O #cmplt; S #cmplt; R #in_send; R #wt4Rsp; END_FUNCTION_BLOCK FUNCTION_BLOCK FB 5 TITLE =Modbus Read Holding Registers command (function code 3) //On rising edge of "Read", send Read Holding Registers command to selected //Modbus secondary. Calling parameters are: // // clock = S7-300 clock memory byte, used for timing // LADDR = I/O address of CP340 card // MOD_ADDR = Modbus secondary address to talk to // DATA_DB = data block where Modbus secondary's data is stored Copyright 1997 by SIEMENS Status: 3/97 page 25 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

// CRCTBL_DB = data block number where CRC partial sums are stored // Rsp_Time = time (in 1/10 second intervals) that we will wait for secondary // to respond before we will time out and declare an error. // Read = send read request on rising edge. Abort read if trailing edge // before response received from secondary. // RD_Start = Modbus register offset (0..size of DATA_DB/2) in DATA_DB where // data from the secondary is to be stored. Data will be from the // corresponding Modbus address in the secondary. // RD_Length = number of 16-bit Modbus registers to write. // cmplt = set when rad operation has completed, or an error occurs. // RD_Status = indicates completion status back to calling block. Values are: // 0 = no error // 1 = already communications in progress // 3 = timeout on read operation // 4 = RD_Start illegal // 5 = RD_Length illegal // 6 = P_RCV error // 7 = response timeout // 8 = error response from secondary // 9 = bad CRC from secondary AUTHOR : mmckay FAMILY : CP340 NAME : modRead VERSION : 1.0

VAR_INPUT clock : BYTE ; //CPU clock memory byte LADDR : INT ; //CP340 PW address MOD_ADDR : INT := 1; //Modbus slave address to read DATA_DB : BLOCK_DB ; //network data storage CRCTBL_DB : INT := 1; //DB # of precalculated CRC lookup table Rsp_Time : INT := 100; //response timeout preset in 0.1 sec intervals Read : BOOL ; //do read on rising edge RD_Start : INT ; //register (word) index of start of read RD_Length : INT := 1;//length of read in words END_VAR VAR_OUTPUT cmplt : BOOL ; //read complete flag RD_Status : INT ; //read error indicator, valid if cmplt=TRUE END_VAR VAR in_send : BOOL ; //read in progress flag rd_os : BOOL ; //read input one-shot wt4Rsp : BOOL ; //waiting for response from slave send_os : BOOL ; sent : BOOL ; //P_SEND has been called with frame done_os : BOOL ; //flowDone rising edge clk_os : BOOL ; //10 Hz clock risign edge CTS : BOOL ; //CP340 CTS status abort : BOOL ; //one-shot detecting abort of operation msg : ARRAY [0 .. 255 ] OF //Modbus frame buffer BYTE ; tmr : INT ; //response timer current value END_VAR VAR_TEMP Copyright 1997 by SIEMENS Status: 3/97 page 26 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

new_read : BOOL ; //new read request dummy : BOOL ; //dummy output coil flowSend : BOOL ; //time to send read request startSend : BOOL ; //rising edge of flowSend commDone : BOOL ; //P_SEND completed sending frame rspDone : BOOL ; //P_RCV has new response rspErr : BOOL ; //P_RCV error rspTO : BOOL ; //response timeout crcOK : BOOL ; //response CRC good doCRC : BOOL ; //checking CRC msgLen : INT ; //Modbus frame length in bytes commStat : WORD ; //P_SEND status word DBlen : INT ; //length of DATA_DB RD_End : INT ; //end register of read cnt : INT ; //data counter msgDB : INT ; //msg DB number index : DINT ; //data output pointer END_VAR BEGIN NETWORK TITLE =If caller turns off Read before complete, then abort error A #Read; FN #abort; A #in_send; JNB _001; L 3; T #RD_Status; SET ; SAVE ; CLR ; _001: A BR; R #in_send; NETWORK TITLE =new read request ? A #Read; FP #rd_os; = #new_read; R #cmplt; NETWORK TITLE =if not reading, then done AN #new_read; AN #in_send; SAVE ; BEC ; NETWORK TITLE =new read ignored if already in progress //RD_Status values: //0 = no error //1 = already communications in progress //3 = timeout on Modbus transaction //4 = RD_Start illegal //5 = RD_Length illegal //6 = P_RCV error Copyright 1997 by SIEMENS Status: 3/97 page 27 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

//7 = response timeout //8 = error response from secondary //9 = bad CRC from secondary A #new_read; A #in_send; JNB _002; L 1; T #RD_Status; SET ; SAVE ; CLR ; _002: A BR; SAVE ; BEC ; NETWORK TITLE =Get size of DATA_DB OPN #DATA_DB; //open network data DB L DBLG; //and record DB length T #DBlen; L DINO; //get message buffer DB number T #msgDB; NETWORK TITLE =Calculate last register in read //RD_Start and RD_Length are word values, so we need to multiply by 2 to get byte //values so that we can compare RD_End with DBlen. A( ; A #new_read; JNB _003; L #RD_Length; L #RD_Start; +I ; T #RD_End; AN OV; SAVE ; CLR ; _003: A BR; ) ; JNB _004; L #RD_End; L 2; *I ; T #RD_End; _004: NOP 0; NETWORK TITLE =Check RD_Start for legal range A( A( A A( L L <I ) O ; ; #new_read; ; #RD_Start; 0; ; ; ; page 28 / 45 Modhost_.doc Version 1.0

Copyright 1997 by SIEMENS Status: 3/97

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

A #new_read; A( ; L #RD_End; L #DBlen; >I ; ) ; ) ; JNB _005; L 4; T #RD_Status; SET ; SAVE ; CLR ; _005: A BR; ) ; S #cmplt; R #new_read; NETWORK TITLE =Check RD_Length to make sure it won't overflow the buffer A #new_read; A( ; L #RD_Length; L 125; >I ; ) ; JNB _006; L 5; T #RD_Status; SET ; SAVE ; CLR ; _006: A BR; S #cmplt; NETWORK TITLE =If error, then done A #cmplt; SAVE ; BEC ; NETWORK TITLE =If new read, initialize state flags A( ; A #new_read; JNB _007; L 0; T #RD_Status; SET ; SAVE ; CLR ; _007: A BR; ) ; S #in_send; R #wt4Rsp; R #cmplt; Copyright 1997 by SIEMENS Status: 3/97 page 29 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

NETWORK TITLE =If time to transmit read request, assert RTS A #in_send; = L 18.0; BLD 103; A #in_send; AN #wt4Rsp; = L 18.1; BLD 103; A #in_send; JNB _008; CALL FC 6 ( LADDR DTR RTS

:= #LADDR, := L 18.0, := L 18.1);

_008: NOP 0; NETWORK TITLE =After RTS asserted, wait for CTS before transmitting CALL FC 5 ( LADDR DTR_OUT DSR_IN RTS_OUT CTS_IN DCD_IN RI_IN

:= #LADDR, := #dummy, := #dummy, := #dummy, := #CTS, := #dummy, := #dummy);

NOP 0; NETWORK TITLE =Once the modem has returned CTS, then time to send read command A #in_send; AN #wt4Rsp; AN #new_read; A #CTS; = #flowSend; NETWORK TITLE =Flow control is ready for us to transmit the Modbus frame A #flowSend; FP #send_os; = #startSend; NETWORK TITLE =Build Modbus Read Request A #startSend; JCN sk14; L #MOD_ADDR; //secondary network address T #msg[0]; L 3; //Modbus function code 3 T #msg[1]; L #RD_Start; //register address hi byte SRW 8; Copyright 1997 by SIEMENS Status: 3/97 page 30 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

T #msg[2]; L #RD_Start; //register address lo byte L 255; AW ; T #msg[3]; L #RD_Length; //read length hi byte SRW 8; T #msg[4]; L #RD_Length; //read length lo byte L 255; AW ; T #msg[5]; L 8; //frame length T #msgLen; CALL FC 1 (//go calculate CRC for frame msg_db := #msgDB, msg_dbb := 24,//*** hard coded offset *** msg_len := #msgLen, crctbl := #CRCTBL_DB, stat := #dummy); sk14: NOP 0; NETWORK TITLE =Send Modbus frame to CR340 card A #flowSend; = L 18.0; BLD 103; A #wt4Rsp; = L 18.1; BLD 103; A #in_send; JNB _009; CALL FB 3 , DB 13 ( REQ := L 18.0, R := L 18.1, LADDR := #LADDR, DB_NO := #msgDB, DBB_NO := 24, LEN := #msgLen, DONE := #commDone, ERROR := #dummy, STATUS := #commStat); _009: NOP 0; NETWORK TITLE =Wait for specified time for response from secondary. A #commDone; A #flowSend; FP #done_os; JNB _00a; L #Rsp_Time; T #tmr; SET ; SAVE ; Copyright 1997 by SIEMENS Status: 3/97 page 31 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
CLR ; _00a: A BR; S #wt4Rsp; NETWORK TITLE =Waiting for response

S7-300 as Modbus Host

Tip No. 6

A #wt4Rsp; = L 18.0; BLD 103; AN #in_send; = L 18.1; BLD 103; A #in_send; JNB _00b; CALL FB 2 , DB 12 ( EN_R := L 18.0, R := L 18.1, LADDR := #LADDR, DB_NO := #msgDB, DBB_NO := 24, NDR := #rspDone, ERROR := #rspErr, LEN := #msgLen, STATUS := #commStat); _00b: NOP 0; NETWORK TITLE =...but not too long A #wt4Rsp; //timer active only if waiting JNB sk19; L P#0.0; //pointer to bit 0 of clock LAR1 ; A DIX [AR1,P#0.0]; //get 10 Hz square wave FP #clk_os; //get 10 Hz pulse JNB sk19; L #tmr; //on 10 Hz pulse, decrement timer current L 1; -I ; T #tmr; L 0; //timer elapsed ? <=I ; SAVE ; CLR ; sk19: A BR; = #rspTO; //elapsed -> timeout NETWORK TITLE =timeout on response A #rspTO; JNB _00c; L 7; T #RD_Status; SET ; SAVE ; CLR ; Copyright 1997 by SIEMENS Status: 3/97 page 32 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
_00c: A BR; S #cmplt; NETWORK TITLE =Error from P_RCV A #rspErr; A #wt4Rsp; JNB _00d; L 6; T #RD_Status; SET ; SAVE ; CLR ; _00d: A BR; S #cmplt; NETWORK TITLE =Time to check CRC ? A #rspDone; A #wt4Rsp; AN #cmplt; = #doCRC; NETWORK TITLE =Check Response CRC A #doCRC; JNB _00e; CALL FC 1 ( msg_db msg_dbb msg_len crctbl stat

S7-300 as Modbus Host

Tip No. 6

:= #msgDB, := 24, := #msgLen, := #CRCTBL_DB, := #crcOK);

_00e: NOP 0; NETWORK TITLE =Response CRC bad A #doCRC; AN #crcOK; JNB _00f; L 9; T #RD_Status; SET ; SAVE ; CLR ; _00f: A BR; S #cmplt; NETWORK TITLE =if CRC ok, then check response's Modbus function code A AN A( L L #doCRC; #cmplt; ; #msg[1]; //response Modbus function code 3; //code we sent page 33 / 45 Modhost_.doc Version 1.0

Copyright 1997 by SIEMENS Status: 3/97

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

<>I ; ) ; JNB sk24; L 8; //bad response error code T #RD_Status; SET ; SAVE ; CLR ; sk24: A BR; S #cmplt; NETWORK TITLE =Good Response, so store response data A #doCRC; AN #cmplt; JCN sk25; OPN #DATA_DB; L #RD_Start; //build pointer to data destination SLD 4; T #index; L P#27.0; //pointer to msg[3] = start of data LAR1 ; L #RD_Length; //init byte counter SLW 1; T #cnt; mv25: L DIB [AR1,P#0.0]; //copy byte from buffer to DATA_DB T DBB [#index]; L #index; //increment pointers L P#1.0; +D ; T #index; +AR1 P#1.0; L #cnt; //decrement byte counter L 1; -I ; T #cnt; L 0; >I ; JC mv25; sk25: NOP 0; NETWORK TITLE =Done A #rspDone; A #wt4Rsp; O #cmplt; S #cmplt; R #in_send; R #wt4Rsp; END_FUNCTION_BLOCK FUNCTION_BLOCK FB 9 TITLE = //This function block polls a single remote PLC. Each remote PLC has a data //block associated with it, that contains data read and written to the remote //PLC. This FB writes data from the DB to the remote PLC, then reads data from Copyright 1997 by SIEMENS Status: 3/97 page 34 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

//remote PLC into the DB. Each of these DB's is currently organized as follows: // DBn.DBW0..38 contains the first 20 modbus holding registers read from the // remote PLC // DBn.DBW40..78 contains 20 words of data written to modbus registers 20..39 // in the remote PLC. //If there is an error in communications, this FB will return ReadStatus and/or //WriteStatus <> 0. Possible error codes are: // 0 = no error // 1 = already communications in progress // 3 = timeout on Modbus send/recieve // 4 = illegal Modbus register address // 5 = illegal read/write length // 6 = recieve error reported by CP340 card // 7 = timeout on modbus response // 8 = error response from remote PLC // 9 = bad CRC from remote PLC // //Once this FB has completed polling a remote PLC, it sets PollDone to tell the //calling block to advance to the next remote PLC. //If a Modbus transaction does not complete within 5 seconds (including both send //and recieve), the transaction is aborted with an error code of 3, and the next //modbus transaction is started. No retry attempts are made, since if one poll //is missed, the data will be exchanged in the next poll. AUTHOR : mmckay FAMILY : CP340 NAME : PollRTU VERSION : 0.1

VAR_INPUT ModAddr : INT := 1; //Modbus Address RTUData : BLOCK_DB ; //Modbus data for RTU END_VAR VAR_OUTPUT PollDone : BOOL ; ReadStatus : INT ; WriteStatus : INT ; END_VAR VAR LADDR : INT := 256; //CP340 I/O address inPoll : BOOL ; newPoll : BOOL ; ReadWrite : BOOL ; WriteDone : BOOL ; ReadDone : BOOL ; StartWrite : BOOL ; StartRead : BOOL ; END_VAR VAR_TEMP toggle : BOOL ; timeout : BOOL ; END_VAR BEGIN NETWORK TITLE =Detect the start of each Modbus transaction

Copyright 1997 by SIEMENS Status: 3/97

page 35 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

A #ReadWrite; FP #StartWrite; O( ; A #ReadWrite; FN #StartRead; ) ; = #toggle; NETWORK TITLE =Timeout on Modbus Transaction //If 5 seconds elapse without a new Modbus transaction starting, then abort the //current transaction (it's locked up somehow) and start a new one. AN #toggle; L S5T#5S; SD T 0; A #toggle; R T 0; NOP 0; NOP 0; A T 0; = #timeout; NETWORK TITLE =First write new data to remote PLC A #ReadWrite; = L 1.0; BLD 103; CALL FB 4 , DB 14 ( clock := MB 100, LADDR := #LADDR, MOD_ADDR := #ModAddr, DATA_DB := #RTUData, CRCTBL_DB := 1, Rsp_Time := 20, Write := L 1.0, WR_Start := 20, WR_Length := 20, cmplt := #WriteDone, WR_Status := #WriteStatus); NOP 0; NETWORK TITLE =After write complete, read RTU data A( ; O #WriteDone; O #timeout; ) ; A #ReadWrite; R #ReadWrite; R #timeout; NETWORK TITLE =Then read new data from remote PLC AN #ReadWrite; = L 1.0; BLD 103; Copyright 1997 by SIEMENS Status: 3/97 page 36 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

CALL FB 5 , DB 15 ( clock := MB 100, LADDR := #LADDR, MOD_ADDR := #ModAddr, DATA_DB := #RTUData, CRCTBL_DB := 1, Rsp_Time := 20, Read := L 1.0, RD_Start := 0, RD_Length := 20, cmplt := #ReadDone, RD_Status := #ReadStatus); NOP 0; NETWORK TITLE =After read, done with poll A( ; O #ReadDone; O #timeout; ) ; AN #ReadWrite; S #ReadWrite; = #PollDone; END_FUNCTION_BLOCK FUNCTION_BLOCK FB 8 TITLE =Modbus Remote PLC poll scheduler //This function block schedules polling for up to 10 remote PLC's. The polling is //done in a round-robin fashion, starting at Modbus address 1 and going to MaxAddr, //then re-starting back at 1. MaxAddr can be set to any value between 1 and 10 //(inclusive). To support more than 10 Remote PLC's, this FB will have to be //changed to make more calls to FB9, and more DB's to store the remote PLC data //will need to be added to the program. This FB maps each remote PLC's data into //a separate data block as follows: // Remote PLC 1 - DB91 Remote PLC 6 - DB96 // Remote PLC 2 - DB92 Remote PLC 7 - DB97 // Remote PLC 3 - DB93 Remote PLC 8 - DB98 // Remote PLC 4 - DB94 Remote PLC 9 - DB99 // Remote PLC 5 - DB95 Remote PLC 10 - DB100 // //All remote PLC's must have unique Modbus addresses in the range 1..MaxAddr. If //the addresses are not unique, or if a remote PLC is to be offline for a while, //you can disable polling the remote PLC by setting the Enable bit corresponding //to the remote PLC to FALSE. For example, to disable polling remote PLC #4, set //Enable4 to FALSE. AUTHOR : mmckay FAMILY : CP340 NAME : ModPoll VERSION : 0.1

VAR MaxAddr : INT := 1; //last modbus address in system Enable1 : BOOL := TRUE; //enable bits for RTU's Enable2 : BOOL := TRUE; Copyright 1997 by SIEMENS Status: 3/97 page 37 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Enable3 : BOOL := TRUE; Enable4 : BOOL := TRUE; Enable5 : BOOL := TRUE; Enable6 : BOOL := TRUE; Enable7 : BOOL := TRUE; Enable8 : BOOL := TRUE; Enable9 : BOOL := TRUE; Enable10 : BOOL := TRUE; PollDone1 : BOOL ; PollDone2 : BOOL ; PollDone3 : BOOL ; PollDone4 : BOOL ; PollDone5 : BOOL ; PollDone6 : BOOL ; PollDone7 : BOOL ; PollDone8 : BOOL ; PollDone9 : BOOL ; PollDone10 : BOOL ; NextPoll : BOOL ; Poll1 : BOOL ; Poll2 : BOOL ; Poll3 : BOOL ; Poll4 : BOOL ; Poll5 : BOOL ; Poll6 : BOOL ; Poll7 : BOOL ; Poll8 : BOOL ; Poll9 : BOOL ; Poll10 : BOOL ; CurRTU : INT := 1; //Current RTU Modbus address RStat1 : INT ; RStat2 : INT ; RStat3 : INT ; RStat4 : INT ; RStat5 : INT ; RStat6 : INT ; RStat7 : INT ; RStat8 : INT ; RStat9 : INT ; RStat10 : INT ; WStat1 : INT ; WStat2 : INT ; WStat3 : INT ; WStat4 : INT ; WStat5 : INT ; WStat6 : INT ; WStat7 : INT ; WStat8 : INT ; WStat9 : INT ; WStat10 : INT ; PollRTU : FB 9; END_VAR BEGIN NETWORK TITLE =Select Remote PLC to Poll //CurRTU contains a number between 1 and MaxAddr. Whenever FB9 completes polling Copyright 1997 by SIEMENS Status: 3/97 page 38 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

//a remote PLC, CurRTU is incremented (wrapping back to 1 after MaxAddr). //When CurRTU = the remote PLC number and the remote PLC polling is enabled, then //it is time to poll that PLC. A #Enable1; A( ; L #CurRTU; L 1; ==I ; ) ; = #Poll1; NETWORK TITLE =Poll Current remote PLC A #Poll1; JNB _007; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 1, := DB 91, := #PollDone1, := #RStat1, := #WStat1);

_007: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable2; A( ; L #CurRTU; L 2; ==I ; ) ; = #Poll2; NETWORK TITLE =Poll Current remote PLC A #Poll2; JNB _008; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 2, := DB 92, := #PollDone2, := #RStat2, := #WStat2);

_008: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable3; A( ; L #CurRTU; L 3; ==I ; ) ; = #Poll3; Copyright 1997 by SIEMENS Status: 3/97 page 39 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
NETWORK TITLE =Poll Current remote PLC A #Poll3; JNB _009; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

S7-300 as Modbus Host

Tip No. 6

:= 3, := DB 93, := #PollDone3, := #RStat3, := #WStat3);

_009: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable4; A( ; L #CurRTU; L 4; ==I ; ) ; = #Poll4; NETWORK TITLE =Poll Current remote PLC A #Poll4; JNB _00a; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 4, := DB 94, := #PollDone4, := #RStat4, := #WStat4);

_00a: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable5; A( ; L #CurRTU; L 5; ==I ; ) ; = #Poll5; NETWORK TITLE =Poll Current remote PLC A #Poll5; JNB _00b; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus

:= 5, := DB 95, := #PollDone5, := #RStat5, page 40 / 45 Modhost_.doc Version 1.0

Copyright 1997 by SIEMENS Status: 3/97

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
WriteStatus

S7-300 as Modbus Host

:= #WStat5);

Tip No. 6

_00b: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable6; A( ; L #CurRTU; L 6; ==I ; ) ; = #Poll6; NETWORK TITLE =Poll Current remote PLC A #Poll6; JNB _00c; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 6, := DB 96, := #PollDone6, := #RStat6, := #WStat6);

_00c: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable7; A( ; L #CurRTU; L 7; ==I ; ) ; = #Poll7; NETWORK TITLE =Poll Current remote PLC A #Poll7; JNB _00d; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 7, := DB 97, := #PollDone7, := #RStat7, := #WStat7);

_00d: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable8; A( ; L #CurRTU; L 8; Copyright 1997 by SIEMENS Status: 3/97 page 41 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
==I ; ) ; = #Poll8; NETWORK TITLE =Poll Current remote PLC A #Poll8; JNB _00e; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

S7-300 as Modbus Host

Tip No. 6

:= 8, := DB 98, := #PollDone8, := #RStat8, := #WStat8);

_00e: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable9; A( ; L #CurRTU; L 9; ==I ; ) ; = #Poll9; NETWORK TITLE =Poll Current remote PLC A #Poll9; JNB _015; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 9, := DB 99, := #PollDone9, := #RStat9, := #WStat9);

_015: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable10; A( ; L #CurRTU; L 10; ==I ; ) ; = #Poll10; NETWORK TITLE =Poll Current remote PLC A #Poll10; JNB _016; CALL #PollRTU ( ModAddr

:= 10, page 42 / 45 Modhost_.doc Version 1.0

Copyright 1997 by SIEMENS Status: 3/97

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip
RTUData PollDone ReadStatus WriteStatus

S7-300 as Modbus Host

:= DB 100, := #PollDone10, := #RStat10, := #WStat10);

Tip No. 6

_016: NOP 0; NETWORK TITLE =Detect poll completion //If either FB9 returns PollDone, or the EnableN bit for the remote PLC is not //set, then it is time to advance to the next remote PLC. A( ; O #PollDone1; ON #Enable1; ) ; A #Poll1; O ; A( ; O #PollDone2; ON #Enable2; ) ; A #Poll2; O ; A( ; O #PollDone3; ON #Enable3; ) ; A #Poll3; O ; A( ; O #PollDone4; ON #Enable4; ) ; A #Poll4; O ; A( ; O #PollDone5; ON #Enable5; ) ; A #Poll5; O ; A( ; O #PollDone6; ON #Enable6; ) ; A #Poll6; O ; A( ; O #PollDone7; ON #Enable7; ) ; A #Poll7; O ; A( ; O #PollDone8; ON #Enable8; ) ; Copyright 1997 by SIEMENS Status: 3/97 page 43 / 45 Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

A #Poll8; O ; A( ; O #PollDone9; ON #Enable9; ) ; A #Poll9; O ; A( ; O #PollDone10; ON #Enable10; ) ; A #Poll10; = #NextPoll; NETWORK TITLE =Done with poll, so increment RTU address A #NextPoll; JNB _017; L #CurRTU; L 1; +I ; T #CurRTU; _017: NOP 0; NETWORK TITLE =After last RTU, wrap back to first A #NextPoll; A( ; L #CurRTU; L #MaxAddr; >I ; ) ; JNB _018; L 1; T #CurRTU; _018: NOP 0; END_FUNCTION_BLOCK

Copyright 1997 by SIEMENS Status: 3/97

page 44 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip General Notes

S7-300 as Modbus Host

Tip No. 6

The SIMATIC S7-300/400 Application Tips are provided to give users of the S7-300 and S7-400 some indication as to how, from the view of programming technique, certain tasks can be solved with this controller. These instructions do not purport to cover all details or variations in equipment, nor do they provide for every possible contingency. Use of the S7-300/400 Application Tips is free. Siemens reserves the right to make changes in specifications shown herein or make improvements at any time without notice or obligation. It does not relieve the user of responsibility to use sound practices in application, installation, operation, and maintenance of the equipment purchased. Should a conflict arise between the general information contained in this publication, the contents of drawings or supplementary material, or both, the latter shall take precedence. Siemens is not liable, for whatever legal reason, for damages or personal injury resulting from the use of the application tips. All rights reserved. Any form of duplication or distribution, including excerpts, is only permitted with express authorization by SIEMENS.

Copyright 1997 by SIEMENS Status: 3/97

page 45 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.