Modbus TCP Client V82 en

Application Description  01/2017
Modbus/TCP
Standardized and redundant
Communication of PCS 7 with
Third-Party Systems
SIMATIC PCS 7
https://support.industry.siemens.com/cs/ww/en/view/75867147
Warranty and liability
Warranty and liability
Note The Application Examples are not binding and do not claim to be complete
regarding the circuits shown, equipping and any eventuality. The Application
Examples do not represent customer-specific solutions. They are only intended
to provide support for typical applications. You are responsible for ensuring that
the described products are used correctly. These Application Examples do not
relieve you of the responsibility to use safe practices in application, installation,
operation and maintenance. When using these Application Examples, you
recognize that we cannot be made liable for any damage/claims beyond the
liability clause described. We reserve the right to make changes to these
Application Examples at any time without prior notice.
If there are any deviations between the recommendations provided in these
Application Examples and other Siemens publications – e.g. Catalogs – the
contents of the other documents have priority.
We do not accept any liability for the information contained in this document.
Any claims against us – based on whatever legal reason – resulting from the use of
the examples, information, programs, engineering and performance data etc.,
described in this Application Example shall be excluded. Such an exclusion shall
not apply in the case of mandatory liability, e.g. under the German Product Liability
Act (“Produkthaftungsgesetz”), in case of intent, gross negligence, or injury of life,
body or health, guarantee for the quality of a product, fraudulent concealment of a
 Siemens AG 2017 All rights reserved
deficiency or breach of a condition which goes to the root of the contract

(“wesentliche Vertragspflichten”). The damages for a breach of a substantial
contractual obligation are, however, limited to the foreseeable damage, typical for
the type of contract, except in the event of intent or gross negligence or injury to
life, body or health. The above provisions do not imply a change of the burden of
proof to your detriment.
Any form of duplication or distribution of these Application Examples or excerpts
hereof is prohibited without the expressed consent of the Siemens AG.
Security Siemens provides products and solutions with industrial security functions that
informa- support the secure operation of plants, systems, machines and networks.
tion In order to protect plants, systems, machines and networks against cyber
threats, it is necessary to implement – and continuously maintain – a holistic,
state-of-the-art industrial security concept. Siemens’ products and solutions only
form one element of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems,
machines and networks. Systems, machines and components should only be
connected to the enterprise network or the internet if and to the extent necessary
and with appropriate security measures (e.g. use of firewalls and network
segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be
taken into account. For more information about industrial security, please visit
http://www.siemens.com/industrialsecurity.
Siemens’ products and solutions undergo continuous development to make them
more secure. Siemens strongly recommends to apply product updates as soon
as available and to always use the latest product versions. Use of product
versions that are no longer supported, and failure to apply latest updates may
increase customer’s exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial
Security RSS Feed under http://www.siemens.com/industrialsecurity.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 2
Table of contents
Table of contents
Warranty and liability ................................................................................................... 2
1 Description of the task and the solution ......................................................... 4
1.1 Task ...................................................................................................... 4
1.2 Solution................................................................................................. 4
2 General library information .............................................................................. 6
2.1 Setup .................................................................................................... 6
2.2 Mode of operation ................................................................................ 7
2.3 Technical specifications ....................................................................... 8
2.4 Modbus/TCP variants ........................................................................... 9
2.5 Ordering and scope of delivery .......................................................... 11
2.6 Installation .......................................................................................... 11
2.7 Licensing ............................................................................................ 12
2.7.1 Licensing Modbus CP ........................................................................ 12
2.7.2 Missing or erroneous licensing ........................................................... 15
2.8 Requirements ..................................................................................... 16
2.8.1 Hardware requirements ...................................................................... 16
2.8.2 Software requirements ....................................................................... 16
3 PCS 7 Modbus/TCP ......................................................................................... 17
3.1 Address mapping of the function block MODBUSCP ........................ 20
3.2 Installation of the Modbus library ....................................................... 23
4 Configuration ................................................................................................... 24
4.1 Assigning parameters to the CP ........................................................ 24
4.2 Assigning parameters to to the link partner ........................................ 25
4.3 Configuration of the CPU and of the link partners ............................. 26
4.3.1 Configuration of a red. CPU and red. Link Partner ............................ 26
4.3.2 Network setup in NetPro .................................................................... 30
4.4 Configuration of a red. CPU and a single link partner ........................ 31
4.4.1 Configuration of the communication connections .............................. 31
4.4.2 Network setup in NetPro .................................................................... 34
4.5 Entry of the blocks into the master data library .................................. 34
4.6 CFC engineering ................................................................................ 36
4.6.1 Version A: Allocation blocks for global data blocks ............................ 38
4.6.2 Version B: Data collector blocks with instance data blocks ............... 44
4.6.3 Modbus telegram management ......................................................... 46
5 Diagnostics ...................................................................................................... 57
6 Hardware changes during operation in the H-system ................................. 67
7 Renaming and rewiring of Function Blocks ................................................. 68
7.1 Renaming ........................................................................................... 69
7.2 Rewiring.............................................................................................. 69
8 Performance ..................................................................................................... 72
9 Appendix .......................................................................................................... 76
9.1 Service and Support ........................................................................... 76
9.2 Links and Literature ............................................................................ 77
9.3 Change documentation ...................................................................... 77
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 3
1 Description of the task and the solution

1.1 Task
MODBUS is a communication protocol that is used worldwide, is open to all users
and supported by many manufacturers.
The requirement to link third-party systems via Modbus with SIMATIC PCS 7 arises
in particular in the event of the:
 expansion or upgrading of existing systems
 coupling of controllers and systems of different manufacturers (also in the
course of constructing new systems)
Modbus is based on client/server architecture (also called master/slave
architecture), which is implemented in various ways within PCS 7.
Selection depends on the one hand on the supported Modbus protocols (TCP or
PtP) of the systems and controllers that are planned to communicate with one
another. On the other hand the connection type, which communication partner is
the client or server, results from the system interconnection.
1.2 Solution
The purpose of this is to introduce you to a Modbus/TCP library that is available in
different versions and by means of which you can connect third-party systems via
Modbus/TCP to PCS 7.
This solution is suitable in particular for the expansion or upgrading of existing
systems with SIMATIC automation systems and for the coupling of controllers and
systems from different manufacturers.
The general description is followed by a configuration example that describes in full
the Modbus/TCP client solution for the redundant connection of third-party systems
to PCS 7 via Industrial Ethernet.
The Modbus/TCP library "Modbus/TCP RED V2" is used for this purpose.
Figure 1-1
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 4
Customer benefits
The following configuration example enables you to significantly reduce your
planning costs with PCS 7 standard resources, while improving performance.
You can use this solution for re-engineering as well as for integration into existing
projects.
The required hardware and software products are all made by Siemens and
guarantee the accustomed compatibility, up-to-dateness and upgrade options.
The PCS 7 and Modbus standards have been resolutely taken into consideration.
When using the Modbus library you also get the following benefits:
 Easy connection of systems of different manufacturers to PCS 7 via Industrial
Ethernet
 Gradual and therefore low-cost expansion or modernization of existing systems
over the entire life cycle
 Assured Siemens support
 No specific Modbus know-how required
 Engineering in the accustomed PCS 7 environment
 Function block library with online help (F1) in German and English
 Setup in German and English
Core contents of the application description

 Advantages
 Hardware and software required
 Installation and setup
 Configuration
 Performance data
Validity
The Modbus blocks described and used in this application description have been
released for PCS 7 V7 and PCS 7 V8.
The description and screenshots of the configuration example described were
prepared with PCS 7 V8.2.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 5
2 General library information

2.1 Setup
Communication with the Modbus/TCP nodes is performed via a communications
processor (CP) or via the integrated PN interface of the SIMATIC CPU. A SIMATIC
CPU can communicate simultaneously with several Modbus/TCP nodes,
depending on the number of connection resources of the CPU.
The Modbus/TCP libraries "SIMATIC Modbus/TCP CP" and "Redundant V2"

support the following CPs:
 S7 300: CP 343-1
 S7 400: CP 443-1
Note Use is possible only on CPs that support the AG_CNTRL function.
Modbus/TCP PN CPU, Modbus/TCP PN Red and Modbus/TCP SENTRON PAC

support the following CPUs:

ET 200 - IM 151-8 PN/DP CPU

– IM 154-8 PN/DP CPU
 S7 300/400 - CPU 314C-2 PN/DP
– CPU 315-2 PN/DP
– CPU 317-2 PN/DP
– CPU 319-3 PN/DP
– CPU 412-2 PN
– CPU 414-3 PN/DP
– CPU 416-3 PN/DP
 S7-400 H
(only SIMATIC Modbus/TCP PN CPU and SIMATIC Modbus/TCP PN Red)
– CPU 412-5H
– CPU 414-5H
– CPU 416-5H
– CPU 417-5H
– CPU 410-5H
 Soft PLC
(only SIMATIC Modbus/TCP PN CPU)
– SIMATIC WinAC RTX
 SENTRON PAC
(for SIMATIC Modbus/TCP SENTRON PAC)
– PAC 3200, from FW V2.2.1
– PAC 4200, from FW V1.5.1
The Modbus/TCP products have been released for standard CPUs, for F-CPUs,
and for (PN)-(H) CPUs.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 6
2.2 Mode of operation

The Modbus block operates on the client/server principle. The client is the active
communication node and the server the passive communication node. Data is
interchanged between the communication partners by means of various function
codes. The automation system (AS) can be both the client and the server in the
transfer process. In the initialization phase it is predefined onto which data blocks
the Modbus registers and bit values will be mapped.
In cyclic mode a distinction is made between client and server functionality:

 If the automation system is working as a client, when a command is activated
a Modbus telegram is generated from the specified actual parameters and sent
to the link partner via the TCP/IP connection. After the response telegram has
been received and the data has been successfully checked, the required action
— such as reading or writing data — is performed. Any errors that that have
occurred during evaluation or processing are indicated on the Modbus block.
 If the automation system is operating as a server, the Modbus block waits for
a request telegram from the client. If a telegram is received from the client,
it is checked and evaluated. After successful checking, the response telegram
is generated and the required action — such as reading or writing data — is
performed. A processed request or any errors that have occurred during
evaluation are indicated on the Modbus block.
TCP connections are set up for Modbus communication between the SIMATIC
stations and other Modbus nodes. The standard functions of the SIMATIC NET
library are used in that process:
 AG_(L)SEND and AG_(L)RECV for CP versions
 TSEND and TRECV for PN-CPU versions
All Modbus blocks are multi-instance capable.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 7
2.3 Technical specifications

2XV9450-1MB00 2XV9450-1MB02 2XV9450-1MB11
Description SIMATIC Modbus/TCP SIMATIC Modbus/TCP SIMATIC Modbus/TCP
CP for NCM_CP PN CPU Red V2 for S7-400
H-system
License Single license on CD Single license on CD Single license on CD
Client/server
functionality
•/• •/• •/•
Function codes 1, 2, 3, 4, 5, 6, 15 and 1, 2, 3, 4, 5, 6, 15 and 16 1, 2, 3, 4, 5, 6, 15 and
16 16
Modbus address area 0 – 65535 0 – 65535 0 – 65535
Read register 125 125 125
Write register 123 123 123
Read bits 2000 2000 2000
Write bits 1968 1968 1968
Multi-instance capable
• • •
Max. number  CPU-dependent  Number of block  CPU-dependent
of parallel block calls  Client: calls unlimited  Client:
No block call  Number of No block call
command limit; simultaneously set command limit;

max. number of up connections is max. number of
simultaneously CPU-dependent simultaneously
active blocks active blocks
limited by the CPU limited by the CPU
(AG_SEND/AG_R (AG_SEND/AG_R
ECV) ECV)
 Server:  Server:
Limited by the Limited by the
max. number of max. number of
AG_SEND/AG_RE AG_SEND/AG_R
CV calls of the ECV calls of the
CPU CPU
Connection Static connections over Dynamic connections Static connections over
configuration NetPro over TCON and NetPro
TDISCON
Communication AG_(L)SEND/ TSEND/ AG_(L)SEND/
AG_(L)RECV TRCV AG_(L)RECV
RAM requirement 16 KB 19 KB 20 KB
FB (client/server)
IDB approx. 1 KB approx. 1 KB approx. 1 KB
Use possible in
CFC/PCS7
• • •
Use with older CPs - - -
that do not support
AG_CNTRL
Multiplexing of TCP CP-dependent - CP-dependent
connections
Redundancy - - Single-sided or double-
functionality sided redundancy
Use of flag/timer - - -
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 8
2.4 Modbus/TCP variants

There are several versions of the Modbus/TCP library, these being modified for
use on different CPU types and communication interfaces.
In addition, corresponding library variants are available for server operation,
for client operation and for redundant connection.
In addition to the Modbus/TCP library, which is subject to charges, allocation
blocks for the preproduced solution and a block for the job list are available for
downloading. These blocks can be adapted to meet project requirements (open
source).
Refer to the following table for the Modbus/TCP library variant that matches your
operating range.
Table 2-1
Product Description License Order number
Modbus/TCP CP Modbus communication  Single license 2XV9 450-1MB00
via CP  Valid for 1 CPU
 Independent of the
number of inserted
CPs and
connected devices
Modbus/TCP RED V2 Redundant Modbus  Single license 2XV9450-1MB11
communication via CPs  Valid for 1 pair
for S7-400(H) and of CPUs in an
S7-300 H-system
or
1 single CPU with
CPs
 Independent of the
number of inserted
CPs or connected
devices
Modbus/TCP PN CPU Modbus communication  Single license 2XV9450-1MB02
via the integrated  Valid for 1 CPU
PROFINET interface
 Independent of
the number of
connected devices
Modbus/TCP PN RED Redundant  Single license 6676-6MB10-0AX0
Modbus/TCP  Valid for 1 pair
communication via the of CPUs in an
integrated PROFINET H-system or
interface of S7-400(H) a single CPU
and S7-300 CPU
 Independent of
the number of
connected devices
Modbus/TCP 20 Communication via the  Single license 6AV6676-6MA30-0AX0
SENTRON PAC integrated PROFINET  Valid for 1 CPU
interface for reading out
 For the connection
values from SENTRON
of a maximum of
PAC 3200 devices
20 PAC devices
and SENTRON PAC
4200 devices
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 9
Product Description License Order number

values from SENTRON
PAC 3200 devices of a maximum of
100 PAC devices
and SENTRON PAC
4200 devices
values from SENTRON
PAC 3200 devices of a maximum of
512 PAC devices
and SENTRON PAC
4200 devices
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 10
2.5 Ordering and scope of delivery

You can purchase the Modbus/TCP library variants (including licenses) from the
Siemens Industry Mall.
The following are included in the scope of delivery:

 Library with the corresponding Modbus driver blocks
 Online help (F1)
 Manual (PDF format) in German and English
You can download the above mentioned unlicensed Modbus/TCP library versions
via the following link. In addition, the open source allocation blocks, the open
source job list block and the relevant documentation are available for downloading.
Furthermore, you will find there further information on the Modbus versions,
ordering information and the scopes of delivery:
https://mall.industry.siemens.com/mall/en/WW/Catalog/Products/10165502?tree=C
atalogTree
Note For runtime operation the downloaded Modbus/TCP library variants require
licenses that are separately obtainable from the Industry Mall.
2.6 Installation
Scope of delivery
The installation CD includes die library "Modbus_TCP_CP_Red300_400", sample
projects and the manuals in German and English.
After running the setup program, you will find these components by following these
paths:
 Library
\Program Files\Siemens\Step7\S7libs
 Sample projects
\Program Files\Siemens\Step7\Examples
 Manuals
\Program Files\Siemens\Step7\S7manual\S7Comm
When you open the Modbus Library for the first time, use the function "Browse" in
the open dialogue to access the library "Modbus_TCP_CP_Red300_400" in the
Siemens directory "S7libs".
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 11
There are four folders in the "Modbus_TCP_CP_Red300_400" library:

 S7 300 Client
 S7 300 Server
 S7 400 Client
 S7 400 Server
Make sure that you take the blocks from the corresponding folder, depending on
your CPU type (series S7-300 or S7-400) and the architecture used (server or
client).
CAUTION The blocks in the S7 folders for the CPU series S7-300 and S7-400 have the
same FB numbers.
Make sure that the correct blocks are used in the correct CPU.
2.7 Licensing
2.7.1 Licensing Modbus CP
The Modbus driver block "MODBUSCP" is subject to licensing. This licensing must
be performed individually for each CPU.
The licensing is performed by means of the following steps:

 Readout of the IDENT_CODE
 Pasting into the "SOFTWARE REGISTRATION FORM"
 Transmission of the form by way of a support request to Customer Support
www.siemens.de/industry/supportrequest
 Receipt of the activation key
 Entry of the activation key REG_KEY
Entry of the activation key requires the presence of OB121.
Procedure
IDENT_CODE readout
1. Assign parameters to the block MODBUSCP to match your requirements in
a cyclic OB (OB1 or cyclic interrupt OB) and in OB100.
2. Load the program into the CPU and set the CPU to RUN.
3. Open the instance DB of the Modbus/TCP block.
Open the DB online via the menu item "Data block > Open online". "Block
monitor" via the button is not sufficient.
CAUTION In the event of a direct readout at the Modbus driver block, not all characters are
displayed.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 12
4. An 18-character string is displayed at the output IDENT_CODE.

5. Copy this string from the DB and paste it into the SOFTWARE
REGISTRATION FORM. Upon installation this form is stored in the library path
\Program Files\Siemens\Step 7\S7LIBS\Modbus_TCP_CP and is also on the
installation CD.
6. Enter in the form the license number from the product packaging.
Figure 2-1
7. Send the form by way of a support request to Customer Support

(https://support.industry.siemens.com). You will then receive the activation key
for your CPU.
Entering the activation key REG_KEY

The activation key REG_KEY must be provided at each MODBUSCP block call.
The REG_KEY should be stored in a global data block, via which all MODBUSCP
blocks receive the necessary activation key.
The following work operations are an example:
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 13
1. Copy the preproduced licensing block DB3 from the library "Modbus_TCP_CP"
into your project. If the DB number is already being used in the project, the
license DB can be renamed.
CAUTION Make sure that you select DB3 from the corresponding library folder, for
example, "S7 400 Client".
2. Open the license DB and copy the provided 17-character activation key by
copy & paste into the "Start value" column.
Figure 2-2
In order that the activation key REG_KEY does not have to be re-entered after
reloading the CPU, it must be permanently entered in the data block.
3. To do so, switch to the DB data view by way of the menu item "View" > "Data
view".
Via the menu command "Edit > Initialize data block" all values in the "Initial
value" column are applied in the "Actual value" column.
4. Enter the value "DB3.REG_KEY" in the cyclic OB at the parameter REG_KEY
of the MODBUSCP block.
5. Load the modified blocks into the CPU.
Input of the REG_KEY activation key can take place at runtime. A switch from
"STOP > RUN" is not required.
Result
The Modbus/TCP module is now licensed for this CPU, the output bit LICENSED is
TRUE.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 14
2.7.2 Missing or erroneous licensing
 In the case of an S7-400 CPU: LED INTF

 In the case of an S7-300 CPU: LED SF
If no activation key or a wrong one is entered, the LED INTF on CPU S7-400 or the
LED SF on CPU S7-300 flashes once per minute and an entry is written cyclically
in the diagnostic buffer regarding the missing license.
CAUTION The cyclic entries burden the diagnostic buffer
The error number for a missing license is W #16 #A090.

In the case of a missing or wrong activation key, the Modbus communication is
processed but W#16#A090 "No valid license available" is always displayed at the
STATUS_x outputs. If this error code is displayed despite the activation key being
entered, it must be checked whether FC10 "EQ_STRING" has been inserted into
the project.
CAUTION If OB121 is missing in the controller, the CPU is set to STOP status.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 15
2.8 Requirements
2.8.1 Hardware requirements
The AG_CNTRL block from the library SIMATIC_NET_CP is integrated into the
Modbus driver block and is for the purpose of releasing and re-establishing existing
connections.
However, older CPs or older firmware statuses do not support the AG_CNTRL
block and therefore do not support the Modbus driver block either.
Refer to the following table for which CPs and firmware statuses support the
Modbus driver block.
Table 2-2
Type Order number Firmware version
CP343-1 Lean 6GK7343-1CX10-0XE0 ≥ 2.1
CP343-1 6GK7343-1EX21-0XE0 ≥ 1.0.17
CP343-1 6GK7343-1EX30-0XE0 ≥ 2.0.16
CP343-1 Advanced 6GK7343-1GX21-0XE0 ≥ 1.0.24
CP443-1 Advanced 6GK7443-1EX40-0XE0 ≥ 2.2.35

CP443-1 Advanced 6GK7443-1EX41-0XE0 ≥ 1.0.24
CP343-1 Lean 6GK7343-1CX10-0XE0 ≥ 2.2
CP343-1 6GK7343-1EX30-0XE0 ≥ 2.2
CP343-1 Advanced 6GK7343-1GX30-0XE0 ≥ 1.0.23
CP343-1 Advanced 6GK7343-1GX31-0XE0 ≥ 3.0
CP443-1 6GK7443-1EX20-0XE0 ≥ 1.0.26
CP443-1 6GK7443-1EX30-0XE0 ≥ 3.0
2.8.2 Software requirements
The following software components are required for the redundant Modbus link
presented in this section:
 Library "Modbus/TCP Redundant V2. 1"
 SIMATIC PCS 7 from V7.0
 Library "SIMATC NET"
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 16
3 PCS 7 Modbus/TCP
3 PCS 7 Modbus/TCP
The Modbus/TCP library, product blocks, interface blocks and the template
presented are based on practical experience and analyses.
In addition to the product block MB_REDCL, utility blocks are at your disposal in
the form of open source blocks. You can adapt these to your project requirements
and supplement them.
Thanks to the provision of the Modbus library, the open source blocks and the
present application you save analysis costs, development work, and engineering
time.
Figure 3-1
SEND_B MB_REDCL MB_DIAG RECV_B
SEND_I RECV_I
SEND_R Job_List RECV_R
Job_List
SEND_W RECV_W
Modbus/TCP
Modbus/TCP Master Driver
Master-Treiber Modbus Auxiliary Block
Modbus-Hilfsbaustein
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 17
3 PCS 7 Modbus/TCP
A PCS 7 measuring point for a redundant Modbus/TCP client coupling consists of

four block types:
 Interface blocks (SEND and RECEIVE)
 Modbus driver
 Job_list block
 Message block
Interface blocks (add-on Modbus blocks)

The send blocks prepare the data provided by the CFC charts or data blocks for
the communication data block.
The data stored in the data block can be represented in a convenient form on the
CFC charts via the interface blocks.
Both the receive and send blocks are available for the data types bool, real, integer
and word.
Modbus driver for redundant communication (MB_REDCL)

The function block MB_REDCL fulfills the following tasks:
 Coordination of the connection(s) over which the telegrams are sent.
 Monitoring of all configured connections via AG_CNTRL

 Execution of the Transaction Identifier (TI)
The function block MB_REDCL allows communication between a CP443-1 and
CP343-1 and a partner that supports the open Modbus/TCP protocol to be set up
in a redundant system. Function codes 1, 2, 3, 4, 5, 6, 15 and 16 are supported.
In this case the block functions as a Modbus client, i.e. as an active partner, and
can process a maximum of 4 telegram jobs.
You can find detailed block and function descriptions on the installation DVD and
after installation via the following path:
\Program Files\Siemens\Step7\S7manual\S7Comm
Note The block MB_REDCL is usable only for the client application.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 18
3 PCS 7 Modbus/TCP
Job_list block
With the job list block "Job_List", there is the possibility of consecutively processing
several Modbus/TCP telegrams with little programming effort.
The following functions are available:
 Status message for timeouts
 Entire job list can be processed time-controlled
 Job list can be cancelled at any time
 Jobs can be skipped temporarily
You can find detailed block and function descriptions in the description "Additional
Modbus blocks" via the following link:
Message block
The message block includes an Alarm_8P via which the error numbers of the
Modbus driver block are combined with the message texts of the message list and
displayed.
This way not only the error numbers, but also the explanatory texts are displayed
on the message bar.
Detailed block and function descriptions

You can find detailed block and function descriptions in the manual "SIMATIC
Modbus/TCP communication using CP 343-1 and CP 443-1", "Additional Modbus
Blocks" via the following link:
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 19
3 PCS 7 Modbus/TCP
3.1 Address mapping of the function block MODBUSCP

Modbus/TCP addresses
In the case of the present Modbus/TCP library the data are transferred in a series
of memory areas that consist of different data types. The differentiation between
these memory areas takes place via the register or bit addresses.
The following Modbus data types are supported:
 Coils
 Input register
 Holding register coil
Thus, for example, the holding register with offset 0 is designated as register 40001
(memory type 4xxxx, reference 0001). The function module MODBUSCP uses
the actually transmitted Modbus/TCP address for its parameters start_x and
START_ADDRESS. Transmission can be effected with any function code
register/bit addresses from 0000H to FFFFH.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 20
3 PCS 7 Modbus/TCP
Example
Table 3-1
Address Symbol name Data type Start value Comment
+6.0 ID_1_data_type_1 BYTE B#16#3 Holding register
+8.0 ID_1_db_1 WORD W#16#B DB 11
+10.0 ID_1_start_1 WORD W#16#0 Start address: 0
+12.0 ID_1_end_1 WORD W#16#1F3 End address: 499
+14.0 ID_1_data_type_2 BYTE B#16#3 Holding register
+16.0 ID_1_db_2 WORD W#16#C DB 12
+18.0 ID_1_start_2 WORD W#16#2D0 Start address: 720
+20.0 ID_1_end_2 WORD W#16#384 End address: 900
+22.0 ID_1_data_type_3 BYTE B#16#4 Input register
+24.0 ID_1_db_3 WORD W#16#D DB 13
+26.0 ID_1_start_3 WORD W#16#2D0 Start address: 720
+28.0 ID_1_end_3 WORD W#16#3E8 End address: 1000
+30.0 ID_1_data_type_4 BYTE B#16#0 Not used
+32.0 ID_1_db_4 WORD W#16#0 0
+34.0 ID_1_start_4 WORD W#16#0 0

+36.0 ID_1_end_4 WORD W#16#0 0
+38.0 ID_1_data_type_5 BYTE B#16#1 Coils
+40.0 ID_1_db_5 WORD W#16#E DB 14
+42.0 ID_1_start_5 WORD W#16#280 Start address: 640
+44.0 ID_1_end_5 WORD W#16#4E2 End address: 1250
+46.0 ID_1_data_type_6 BYTE B#16#2 Inputs
+48.0 ID_1_db_6 WORD W#16#F DB 15
+50.0 ID_1_start_6 WORD W#16#6A4 Start address: 1700
+52.0 ID_1_end_6 WORD W#16#8FC End address: 2300
+54.0 ID_1_data_type_7 BYTE B#16#1 Coils
+56.0 ID_1_db_7 WORD W#16#10 DB 16
+58.0 ID_1_start_7 WORD W#16#6A4 Start address: 1700
+60.0 ID_1_end_7 WORD W#16#8FC End address: 2300
+62.0 ID_1_data_type_8 BYTE B#16#0 Not used
+64.0 ID_1_db_8 WORD W#16#0 0
+66.0 ID_1_start_8 WORD W#16#0 0
+68.0 ID_1_end_8 WORD W#16#0 0
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 21
3 PCS 7 Modbus/TCP
Figure 3-2
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 22
3 PCS 7 Modbus/TCP
3.2 Installation of the Modbus library

Requirement
PCS 7 must be installed.
Procedure
1. Insert the Modbus/TCP CD into the CD-ROM drive of your programming
device/PC.
If the setup program does not start automatically, install as follows:
– In Windows Explorer select the CD-ROM drive.
– Open the directory "Setup"
– Start the file "Simatic S7 ModbusTCP CP V5.0.exe"
2. Follow the on-screen instructions of the installation program step by step.
The installation procedure installs the following components:

 The library "Modbus_TCP_CP"
\Program Files\Siemens\Step 7\S7LIBS
 Two sample projects
\Program Files\Siemens\Step 7\EXAMPLES

 The Programming Manual
\Program Files\Siemens\Step 7\S7MANUAL\S7Comm
 A software registration form
\Program Files\Siemens\Step 7\S7LIBS\Modbus_TCP_CP
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 23
4 Configuration
4 Configuration
4.1 Assigning parameters to the CP
Switch to assignment of parameters to the CP in HW Config and perform the
following steps:
1. In HW Config open the properties of the first CP.
2. Click the "Properties" button.
3. Switch to the "Parameters" tab.
4. Select the following subnet and IP address:
– IP no.: 192.168.0.11
– Subnet: 255.255.255.0
5. Repeat steps 1 through 4 and select the following subnet and IP address:
– IP no.: 192.168.0.12
– Subnet: 255.255.255.0
Figure 4-1
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 24
4 Configuration
4.2 Assigning parameters to to the link partner

To assign parameters to the link partner, switch to NetPro and perform the
following steps:
1. In the catalog, "Stations", select the "Other Station" and drag it into the Netpro
configuration window.
2. Open the properties of the "Other Station" and switch to the "Interfaces" tab.
3. Actuate the button "New" and in the window that then appears select "Industrial
Ethernet". Confirm with "OK".
Figure 4-2
4. Assign an IP address, in the example 192.168.0.11 for the primary interface,

which is located in the same subnet as the link partner station. The subnet
mask must match the subnet mask of the partner station.
5. Select the corresponding subnet that makes the connection between the
CP interface and the link partner interface.
6. For a redundant connection repeat steps 3 through 5 and assign an IP address
for the redundant interface, in this example 192.168.0.12, which is located in
the same subnet as the link partner station. The subnet mask must match the
subnet mask of the partner station.
Figure 4-3
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 25
4 Configuration
4.3 Configuration of the CPU and of the link partners

In Section 4.3 both the configuration of a redundant CPU with redundant link
partners (Section 4.3.1) and the configuration of a red. CPU with a single link
partner (4.3.2) are described
4.3.1 Configuration of a red. CPU and red. Link Partner
Note The configuration of a redundant CPU with a link partner that has no redundant
communications processor is described in Section 3.7 "Configuration of a red.
CPU and link partner with only one communications processor
Configuration of the communication connections

The CPs represent the links for a redundancy between an H-system and
a communication partner connected over Industrial Ethernet. For the double-sided
redundant connection, connection configurations must be made for the respective
interfaces with the link partner.
Figure 4-4
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 26
4 Configuration
IP addresses 192.168.0.11 and 192.168.0.12 are assigned to the H-system in this

example.
Port number 2000 can be used for accessing node A of the link partner both
for CP0 and CP1, because the IP addresses of the two CPs are different
(connections 0A and 1A).
The same port number can also be used for accessing node B of the
communication partner for both CPs: 2001 (connections 0B and 1B).
In this example the partner station has the IP addresses 192.168.0.21 and
192.168.22.
The same port number can be used for node A and node B to access CP0 of the
H-system: 501 (connections 0A and 0B).
You can also use the same port number to access CP1 of the H-system. 502
(connections 1A and 1B).
1. Select the first CPU of the H-system in NetPro.

2. Add a new connection to the NetPro configuration table.
3. Select "Other Station" as the connection partner.
4. Select the connection "TCP connection".
5. Click the "OK" button.
The properties window of the connection opens:

Figure 4-5
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 27
4 Configuration
6. Assign an ID on the "General" tab The ID is randomly selectable.

7. Under "Name:" assign a meaningful name in order to be able to identify your
TCP connection in the network.
Figure 4-6
Note The block parameters "Connection ID" (Local ID) and "Loading address" will be
needed later for parameter assignment to the Modbus driver.
8. The checkbox "Active connection establishment" must be enabled.

9. Actuate the "Route..." button and under "Remote" select the first port of the
third-party station (server).
10. Switch to the "Addresses" tab.
11. Assign the following port numbers and make sure that the corresponding IP
numbers are selected:
Table 4-1
Local Remote
IP address 192.168.0.11 192.168.0.21
Port number 2000 501
Note The IP addresses in this dialog are not editable. If an incorrect IP address is
displayed, exit the dialog by actuating the "OK" button and re-assign the ports
of the third-party station.
12. Click on "OK" to exit the dialog.

13. Add a second connection to the same CPU (steps 1 through 8).
14. On the tab "General" click on the "Route..." button.
15. Select the second port of the third-party station.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 28
4 Configuration

Assign the following port numbers and make sure that the corresponding IP
Table 4-2
Local Remote
IP address 192.168.0.11 192.168.0.22

18. Highlight the second CPU and add a new connection
(steps 2 through 8).
20. Select the first port of the third-party station.
Assign the following port numbers and ensure that the corresponding IP
numbers are selected.
Table 4-3
Local Remote
IP address 192.168.0.12 192.168.0.21

23. Highlight the second CPU again and add a second new connection (steps 2
through 8).
24. On the "General" tab, click the "Route…" button.
25. Select the second port of the third-party station.
Assign the following port numbers and ensure that the corresponding IP
numbers are selected.
Table 4-4
Local Remote
IP address 192.168.0.12 192.168.0.22
Note If required, you can adapt the port numbers on the "Addresses" tab.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 29
4 Configuration
4.3.2 Network setup in NetPro
Requirement
For the following application description a PCS 7 project with a redundant
automation system and a CP 443-1 are required.
For better understanding the CP 443-1 should have the following IP numbers and
subnets:
 First CP 443-1
IP no.: 192.168.0.11
Subnet: 255.255.255.0
 Second CP 443-1
IP no.: 192.168.0.12
Subnet: 255.255.255.0
Sample project
The supplied sample project is a multiproject "MB_TCP_CP_RED_CFC" with four
user projects for the corresponding application areas:
 H double-sided (client)
 H double-sided (server)
 H single-sided (client)
 H single-sided (server)
There are pre-engineered Modbus typicals (CFC charts) within the individual user
projects.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 30
4 Configuration
4.4 Configuration of a red. CPU and a single link partner

4.4.1 Configuration of the communication connections
The CPs represent the links for a redundancy between an H-system and
a communication partner connected over Industrial Ethernet. For the one-sided
redundant connection, connection configurations must be made for the respective
interfaces with the link partner.
Figure 4-7
IP addresses 192.168.0.11 and 192.168.0.12 are assigned to the H-system in this

example.
Port number 2000 can be used for accessing the link partner both for CP0 and
CP1, because the IP addresses of the two CPs are different (connections 0A
and 1A).
In this example the partner station has the IP address 192.168.0.21.
1. Select the first CPU of the H-system in NetPro.

2. Add a new connection to the NetPro configuration table.
3. Select "Other Station" as the connection partner.
4. Select the connection "TCP connection".
5. Click the "OK" button.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 31
4 Configuration
The properties window of the connection opens:
Figure 4-8
6. Assign an ID on the "General" tab The ID is randomly selectable.

7. Under "Name:" assign a meaningful name in order to be able to identify your
TCP connection in the network.
Figure 4-9
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 32
4 Configuration
Note The block parameters "Connection ID" (Local ID) and "Loading address" will be
needed later for parameter assignment to the Modbus driver.
8. The checkbox "Active connection establishment" must be enabled.

9. Actuate the "Route..." button and under "Remote" select the port of the third-
party station (server).
11. Assign the following port numbers and make sure that the corresponding IP
Table 4-5
Local Remote
IP address 192.168.0.11 192.168.0.21
Note The IP addresses in this dialog are not editable. If an incorrect IP address is
displayed, exit the dialog by actuating the "OK" button and re-assign the ports
of the third-party station (steps 2 through 8).

13. Select the second CPU and add a new connection.
15. Select the port of the third-party station.
Assign the following port numbers and make sure that the corresponding IP
Table 4-6
Local Remote
IP address 192.168.0.12 192.168.0.21
Note If required, you can adapt the port numbers on the "Addresses" tab.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 33
4 Configuration
4.4.2 Network setup in NetPro
Requirement
For the following application description a PCS 7 project with a redundant
automation system and a CP 443-1 are required.
For better understanding the CP 443-1 should have the following IP numbers and
subnets:
 First CP 443-1
IP no.: 192.168.0.11
Subnet: 255.255.255.0
 Second CP 443-1
IP no.: 192.168.0.12
Subnet: 255.255.255.0
Sample project
The supplied sample project is a multiproject "MB_TCP_CP_RED_CFC" with four
user projects for the corresponding application areas:
 H double-sided (client)
 H double-sided (server)
 H single-sided (client)
 H single-sided (server)
There are pre-engineered Modbus typicals (CFC charts) within the individual user
projects.
4.5 Entry of the blocks into the master data library

Entry of the Modbus blocks
CAUTION Check whether the following function block numbers (FB no.) and data block
numbers (FC no.) are populated in your project and in the master data library:
 FB909
 FB908
 DB3
If the block and DB numbers are assigned, perform rewiring in the master data
library (see Section 7 "Renaming and rewiring of Function Blocks").
If the numbers are not used, proceed further.
Open the library "Modbus_TCP_CP_Red300_400" and copy from the folder

"S7 400 Client" the following blocks into your master data library:
 FB909 (MB_REDCL)
 FB908 (MB_CPCLI)
 DB3 (LICENSE_DB)
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 34
4 Configuration
Entry of the SIMATIC_NET_CP blocks

The Modbus blocks use the functions "AG_LSEND and AG_LRECV.
CAUTION Check whether the following function numbers (FC no.) are populated in your
project:
 FC50
 FC60
If the function numbers are assigned, perform rewiring in the master data library
(see Section 7 "Renaming and rewiring of Function Blocks").
If the numbers are not used, proceed with the engineering.
CAUTION The use of OpenModbus/TCP Redundant V2. 1 requires the blocks AG_LSEND
and AG_LRECV from the SIMATIC NET library from version V3. 1 onwards.
Which PCS 7 versions of this are affected and how you update these SIMATIC
NET blocks is described in Section Fehler! Verweisquelle konnte nicht
gefunden werden. "Fehler! Verweisquelle konnte nicht gefunden werden.".
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 35
4 Configuration
4.6 CFC engineering

This application example describes a finished Modbus/TCP solution that is
subdivided on a CFC chart into three chart partitions:
Figure 4-10
Table 4-7
CFC chart Description
partition
Send data
Receive data
Modbus telegram management

 Modbus driver
 Job list
 Diagnostics
In this section, the Modbus/TCP solution is described in detail by means of a step-

by-step guide.
Depending on the project requirements, two access options to the send and
receive buffers (CFC chart partitions 1 and 2) are available. In the case of version
A the accesses are via global DBs, while in the case of variant B they are via
instance DBs.
The Modbus telegram management (CFC chart partition 3) is analogous for both
versions in terms of function and differs only in terms of the preparation of the user
data.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 36
4 Configuration
Version A: Allocation blocks for global data blocks

In version A the data to be sent and received are transmitted via global DBs.
Only Modbus data type 3 (holding register; word) is supported. Sending of the data
types bool, integer and real is also possible. These are converted into words before
sending. Version A is recommended especially for mixed data formats in a DB and
for large data volumes. Receive allocation blocks contain the PCS 7 quality codes
and in the fault scenario or a connection fault, substitute values can be offered.
Creation of the global data blocks is performed manually in accordance with project
requirements.
Version B: Data collector blocks with instance data blocks

In version B the data to be sent and received are transmitted via the instance DBs.
The sending and receiving of data in the formats bool, integer, real, and word are
supported (Modbus data types 1 (coils; bool), 2 (inputs; bool), 3 (holding register;)
(word) and 4 (input register)). In this process it is not possible to mix the data in an
instance DB. Only words or only real data or only integers or only bool data can
be sent and received by means of each instance DB. The send and receive
engineering takes place exclusively in the CFC environment.
Table 4-8
Version A Version B
Data blocks Global DB Instance DB

Data volume Large data volumes Small data volumes
Modbus data 3 (holding register; word) 1 (coils; bool)
types 2 (inputs; bool)
3 (holding register; word)
4 (input register)
Formats Bool, real and int Bool, int, real, and word
These are converted into words Remain in the original format for
before sending. sending.
Send/receive: 16 bool each Send/receive: 80 bool each
Send/receive: 10 int each Send/receive: 125 int each
Send/receive: 10 real each Send/receive: 63 real each
Send/receive:
124 word received,
123 word sent
Mixed mode The data formats in a DB can be Mixed mode is not possible.
mixed. Only bool or only real or only int or
only word is possible for each DB.
Substitute values Only for the receive blocks Not available
PCS 7 quality PCS 7 standard Not available
code
Send and receive CFC engineering + manual Only CFC engineering
engineering creation of the data blocks.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 37
4 Configuration
Note The flow sequence in the CFC charts must be adapted manually.
1. Send allocation blocks
2. Job_list
3. MB_REDCL
4. Receive allocation blocks
4.6.1 Version A: Allocation blocks for global data blocks
Allocation blocks
The allocation blocks are the interfaces for the user program. They enable access
to the data to be sent or received of the send or receive memories of global data
blocks.
Send allocation blocks

Blocks are available for the allocation of 10 real, 10 int and 16 bool values into the
transmit buffer.
Figure 4-11
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 38
4 Configuration
Receive allocation blocks

The receive allocation blocks operate under control, i.e. only if the receive function
block sets the output "New data received" to 1, do the allocation blocks output the
data. In addition, there is a possibility of offering substitute values in the event of
an error (for example, if there is a disconnection). The receive allocation blocks
include PCS 7 quality codes.
Blocks are available for the output of 10 real, 10 int and 16 bool values from the
receive buffer.
Figure 4-12
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 39
4 Configuration
Creation of the global data block

In version A the data (bool, real, int) are converted to word format.
In this example:
 16 bool  into a coils array (1 word)
 10 integers  into an int array (10 words)
 10 real  into a real array (10 words)
CAUTION In addition to the user data, the global DB requires two bytes (1 word) for internal
processing. This word must not be changed
Maximum user data per job (in this example):
Receive: 248 bytes  DB length = 250 bytes
Send: 246 bytes  DB length = 248 bytes
1. Configure the global send data block in accordance with the following
illustration. In the Comment column you can see the referencing between
the bus and the Modbus application addresses (holding register).
Figure 4-13: Send referencing between bus and Modbus application addresses
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 40
4 Configuration
2. Configure the global receive data blocks in accordance with the following
illustration. In the Comment column you can see the referencing between
the bus and the Modbus application addresses (holding register).
Table 4-9: Send referencing between the bus and Modbus application addresses
Insertion of the send blocks and connection

1. After creation of the global data blocks, open an CFC chart.
2. Drag the following blocks into CFC chart partition 1:
Table 4-10
Quantity Block name Rename as Description
4 SND_BIT P01_SND10B Send blocks for bool
P02_SND10B
P03_SND10B
P04_SND10B
4 SND_INT P05_SND10I Send blocks for integer
P06_SND10I
P07_SND10I
P08_SND10I
4 SND_REAL P09_SND10R Send blocks for real
P10_SND10R
P11_SND10R
P12_SND10R
3. Link the SOURCE inputs of the blocks with the corresponding arrays of the
global send data block.
4. Set the ACTIVE inputs to 1.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 41
4 Configuration
5. Adjust the length of the global data block at the DB_LEN inputs. As all blocks
access the same global data block in this example, the value for each block is
the same.
246 bytes user data + 2 bytes for internal processing = 248 bytes.
Note No substitute values can be offered at the send block.
Figure 4-14
Insertion of the receive blocks and connection

1. Drag the following blocks into CFC chart partition 2:
Table 4-11
Quantity Block name Rename as Description
4 RCV_BIT P01_RCV10B Receive blocks for bool
P02_RCV10B
P03_RCV10B
P04_RCV10B
4 RCV_INT P05_RCV10I Receive blocks for integer
P06_RCV10I
P07_RCV10I
P08_RCV10I
4 RCV_REAL P09_RCV10R Receive blocks for real
P10_RCV10R
P11_RCV10R
P12_RCV10R
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 42
4 Configuration
6. Link the SOURCE inputs of the blocks to the corresponding arrays of the global
receive data block.
7. Set the ACTIVE inputs to 1.
8. Adjust the length of the global data block at the DB_LEN inputs. As all blocks
access the same global data block in this example, the value for each block is
the same.
248 bytes of user data + 2 bytes for internal processing = 250 bytes.
9. Via the inputs SUBS_ON0 through SUBSONx you can enable for each
individual value substitute offering in the event of an error.
Figure 4-15
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 43
4 Configuration
4.6.2 Version B: Data collector blocks with instance data blocks
Insertion of the receive blocks and connection

1. Open a CFC chart.
2. Drag the following blocks into your CFC chart:
Table 4-12
Quantity Block name Rename as Max. values Description
0 MB_OUT_B Block not being 80 bool Receive blocks
used for bool
0 MB_OUT_I Block not being 125 integer Receive blocks
used for integer
0 MB_OUT_R Block not being 63 real Receive blocks
used for real
1 MB_OUT_W P02_RCV125W 125 words Receive blocks
for words
Note The OUT blocks read the data from the data block and are therefore the receive
blocks.
3. Link the IDB outputs of the blocks to the input db_x of the block MB_REDCL.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 44
4 Configuration
Figure 4-16
Insertion of the send blocks and connection

1. Drag the following blocks into your CFC chart:
Table 4-13
Quantity Block name Rename as Max. values Description
1 MB_IN_B P01_SND80B 80 bool Send blocks for
bool
0 MB_IN_I Block not being 125 integer Send blocks for
used integer
0 MB_IN_R Block not being 63 real Send blocks for
used real
1 MB_IN_W P02_SND125W 125 words Send blocks for
word
Note The IN blocks forward the data to the data block and are therefore the send
blocks.
4. Link the IDB outputs of the blocks to the input db_x of the block MB_REDCL.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 45
4 Configuration
Figure 4-17
4.6.3 Modbus telegram management
In CFC chart partition 3, Modbus message management is configured with the

three blocks Job_List, MB_REDCL and DIAG.
The concept of Modbus communication is explained diagrammatically below and
the block module parameter assignments are described in detail.
Figure 4-18
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 46
4 Configuration
MB_REDCL
The inputs and outputs of the Modbus driver are described in detail in the following
table.
The following table is a component part of the manual:
"SIMATIC Modbus/TCP Redundant Communication Over CP443-1 in an
H-System"
Table 4-14:
Inputs/outputs Description
id_0_a A connection ID is assigned for each connection configured in NetPro.
id_1_a The connection ID describes precisely the connection of the CPU via
id_0_b the CP to the link partner.
id_1_b
The number from the connection configuration must be entered here.
The value range for this parameter is CPU-dependent.
 id_0_a designates the connection from CP0 to the link

partner/node A
 id_1_a designates the connection from CP1 to the link
partner/node A
 id_0_b designates the connection from CP0 to the link

partner/node B
 id_1_b designates the connection of CP1 to the link partner/node B
Connection 0A is the default connection and it is imperative that it is

configured.
If the link partner is set up as a standalone partner, only the parameters

id_0_a and id_1_a are needed.
laddr_cp0 The parameters laddr_cp0 and laddr_cp1 designate the input
laddr_cp1 addresses of CP0 and CP1 from HW Config (input address).
The configured value must be entered here.
The value range for this parameter is CPU-dependent.

check_conn_cycle By means of this parameter it is predefined at what time interval the
configured connections to AG_CNTRL will be checked. The time
can be set in the seconds raster. The default value is 30 seconds.
The results of the connection test are displayed at the STATUS
outputs.
If use_all_conn = FALSE, the monitoring can be switched off with the

setting 0 seconds.
If check_conn_cycle = 0 is parameterized, it is not possible to detect

a connection error via this connection without any message traffic.
It is recommended that this parameter is populated with > 0 ms.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 47
4 Configuration
use_all_conn This parameter specifies via how many connections the Modbus
telegrams are to be sent. If FALSE, the Modbus telegrams are sent via
1 connection only. If the parameter is TRUE, the Modbus telegrams are
sent via all configured connections.
single_write Function codes 5 and 6 are used for write jobs with a length 1 where
the parameter single_write = TRUE. Function codes 15 and 16 are
used for all write jobs where single_write = FALSE.
Init Manual initialization of the Modbus block is possible where parameter
Init = TRUE. Initialization can be performed only if no job is in progress.
This must be ensured in the program with ENQ = FALSE and BUSY =
FALSE. In the case of manual initialization it must be ensured that the
initialization parameters are configured in the cyclic OB.
Note
With manual initialization the configured connections are re-established
from time to time.
data_type_x It is specified by parameter data_type_x which Modbus data types are
mapped in this data block. If the value 0 is entered in data_type_x,
the corresponding data area will not be used.
db_x The parameter db_x defines the data block in which the Modbus
registers or bit values defined below are mapped. The DB number 0
is not allowed because it is reserved for the system.
The data blocks must be 2 bytes longer than is required for the Modbus
values. The last word is used for internal purposes and is not allowed
to be changed.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 48
4 Configuration
start_x start_x specifies the first Modbus address that is mapped in data word
0 of the DB.
The maximum number of Modbus addresses that can be mapped in

the DB is calculated during start-up from the size of the DB.
For register accesses the last Modbus address is calculated in

accordance with the following formula:
Last Modbus address in the DB =
(DB length [in bytes] - 2) / 2 + start_x - 1
For bit accesses the last Modbus address in the DB is calculated in

accordance with the following formula:
Last Modbus address in the DB =
(DB length [in bytes]- 2) * 8 + start_x - 1
Note
The defined data areas are not allowed to overlap.
MONITOR The monitoring time MONITOR monitors the receipt of data from the
link partner on the currently active connections. The shortest settable

time is 20 ms. A monitoring time of approx. 1.5 seconds is
recommended.
The receipt of the complete response telegram is monitored by the time

MONITOR. If the monitoring time is exceeded, the activated job is
terminated with errors. The time is started after completed sending
of the request telegram and after receipt of the complete data.
REG_KEY The block must be licensed on each CPU. The block is licensed and
Modbus communication can be used without restrictions once the
activation key has been correctly entered via this parameter.
ENQ Data transfer is initiated with a positive edge. The request telegram is
generated with the values of the UNIT, WRITE_READ, DATA_TYPE,
START_ADDRESS and LENGTH input parameters. A new job cannot
be sent until the previous job has been completed with DONE or
ERROR.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 49
4 Configuration
DATA_TYPE The DATA_TYPE parameter indicates which Modbus data type is
being processed with the current telegram. The following values are
allowed:
 Coils B#16#1
 Inputs B#16#2
 Holding register B#16#3
 Input registers B#16#4
The various data types are directly related to the function codes used.
START_ADDRESS The parameter START_ADDRESS specifies the first MODBUS

address that will be written or read.
LENGTH The parameter LENGTH specifies the number of Modbus values that
will be written or read.
For read functions, a maximum of 125 registers for the holding and
input registers are possible per telegram. A maximum of 2000 bits is
possible for coils and inputs. For write functions, there is a maximum
of 123 registers for holding registers and a maximum of 1968 bits for
coils. The registers or bit values processed by a request telegram must
be within one DB.
WRITE_READ This parameter defines whether a read or a write function is to be
executed. If the input has the value FALSE, it is a read function.
The value TRUE defines a write function.
LICENSED If this output is set to TRUE, the Modbus block is licensed on this CPU.
If the output has the status FALSE, no license string or an erroneous
license string is entered.
BUSY If this output is set, AG_LSEND or AG_LRECV is active.
DONE The activated job has been completed error-free on at least one
connection. In the case of a read function the response data from the
server have already been entered in the DB. In the case of a write
function the response to the request telegram has been received from
the server.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 50
4 Configuration
ERROR If this output is set, an error has been detected on all active
connections.
use_all_conn = FALSE:
In the event of a protocol error, ERROR is set immediately. In the event
of a connection error, all configured connections are checked and
ERROR is not set until all connections have errors.
use_all_conn = TRUE:
If this output is set, an error has been detected on all configured
connections.
The error numbers are displayed at the STATUS outputs.

STATUS_0A, When ERROR is set the outputs STATUS_x indicate the error number
STATUS_1A, and when ERROR is not set the status information for the
STATUS_0B, corresponding connection.
STATUS_1B
The error numbers and status information are described in Section 5
"Diagnostics".
IDENT_CODE After start-up of the CPU, an 18-digit identification code is shown at this
parameter, by means of which the licensing key (activation key) for

Modbus communication is applied for.
RedErrS7 Output RedErrS7 = TRUE indicates a redundancy error on the
SIMATIC side.
In the case of single-sided redundancy, this means that the CP0 or
CP1 connection has failed. In the case of double-sided redundancy, it
means that both CP0 connections or both CP1 connections have failed.
RedErrDev Output RedErrDev = TRUE indicates a redundancy error on the link
partner side.
In the case of single-sided redundancy, this means that the connection
from junction A to the CP0 or CP1 connection has failed. In the case
of double-sided redundancy, it means that both connections to node A
or both connections to node B of the link partner have failed.
TotComErr TotComErr output value with TRUE indicates a complete loss of
communication, i.e. all configured connections are disturbed.
Init_Error If an error has occurred during manual initialization, this is indicated
by Init_Error = TRUE.
Init_Status The output Init_Status indicates the error number when Init_Error is
set.
Job_List
The inputs, outputs, status displays and error displays are described in detail in the
following tables.
These tables are a component part of the manual:
“Job_List, data collector and allocation blocks for convenient use of the
Modbus/TCP blocks".
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 51
4 Configuration
Table 4-15: Input parameters

Parameter Data type Description
CYCLICAL TIME > 0 ms: Cyclic processing of the job list
DONE BOOL Feedback message of the Modbus/TCP block that
the last job was able to be executed error-free
ERROR BOOL Feedback message of the Modbus/TCP block that
the last job was completed with errors
Job1_DATA_TYPE BYTE 1. Job: Data type, 0 = no processing
Job1_START_ADDRESS WORD 1. Job: Start address
Job1_LENGTH WORD 1. Job: Length
Job1_WRITE_READ BOOL 1. Job: Write/read

ABORT BOOL TRUE: Cancellation of the current processing of the
job list
Table 4-16: Output parameters

Parameter Data type Description
QENQ BOOL Job start for the Modbus/TCP block
QDATA_TYPE BYTE DATA_TYPE of the current job
QSTART_ADDRESS WORD START_ADDRESS of the current job
QLENGTH WORD LENGTH of the current job
QWRITE_READ BOOL WRITE_READ of the current job
BUSY BOOL Job list is being executed
STATUS WORD Block status information
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 52
4 Configuration
Table 4-17: Status and error display

Status Meaning Notes
16#A089 The set cycle time has expired, while The job list will be reprocessed
the processing list is still running. immediately after completion of the
last job.
The diagrammatic representation shows the principle of the Modbus configuration:
Figure 4-19
In its standard form the Modbus driver MB_REDCL is able to process up to four
telegrams.
The data type is predefined and the start address of the communications registers
and the data buffer used (DB) are specified.
The accesses to the Modbus offsets of the registers are parameterized via the job
list. In addition, the length and the number of written and read registers are
defined.
The command to read or write is specified via WRITE_READ.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 53
4 Configuration
Linking of the blocks

1. Drag the following blocks into your CFC chart partition 3:
Table 4-18
Quantity Block name Rename as... Description
1 Job_List Order list Job management
1 MB_REDCL MODREDCL Modbus/TCP driver block
1 DIAG Status and error messages
Note You can obtain the DIAG block and this document on the following page:
2. Link the blocks in accordance with the following table:
Table 4-19
Job_List MB_REDCL
Outputs Inputs
QENQ  ENQ
QDATA_TYPE  DATA_TYPE
QSTART_ADDRESS  START_ADDRESS
QLENGTH  LENGTH
Inputs Outputs
DONE  DONE
ERROR  ERROR
Table 4-20
MB_REDCL DIAG
Outputs Inputs
STATUS_0A  STATUS_0A
STATUS_0B  STATUS_0B
ERROR  ERROR
RedErrS7  RedErrS7
RedErrDev  RedErrDev
TotComErr  TotComErr
Table 4-21
MB_REDCL RCV_BIT, RCV_INT, RCV_REAL
Outputs Inputs
ERROR  INVALID
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 54
4 Configuration
Note Ensure that the blocks Job_List and MB_REDCL are integrated into OB100
(restart/warm boot).
In addition, comply with the block sequence.
Note A text library is supplied with the DIAG block.

This text library assigns the corresponding event descriptions to the hexadecimal
statuses and error messages.
The errors, including statuses [hex], are thus shown in WinCC and the
corresponding error descriptions in plain text.
Assigning parameters to to the MB_REDCL

1. At id_0_a of the block MB_REDCL enter a 1 for the first connection.
Figure 4-20
4. At input laddr_cp of the block MB_REDCL enter the ladder address. You will
find this in NetPro in the connection properties.
5. At input use_all_conn enter a 1 for sending the telegram via all configured
connections.
6. At input data_type enter a 3 for data type 3 (words).
7. At input db_1 assign a 21 (hex 15) for the DB number.
8. At input start_1 enter a 0 for the first Modbus register of the data block (DB).
Jobs 2 through 4 are not taken into consideration in this example.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 55
4 Configuration
Assigning parameters to the Job_List
Figure 4-21
1. Set input EN of the block Job_List to 1 in order to enable the block.

2. At the input CYCLICAL enter the time [in ms] in which the job list is to be
processed.
3. At input Job1_DATA_TYPE enter a 3 for data type 3 (word).
4. At input Job1_START_ADDRESS enter the job start address onto the
predefined area in the data block.
5. At input Job1_LENGTH enter the job length of the area.
6. At input Job1_WRITE_READ select whether read or write is to be performed.
7. Jobs 2 through 5 are not used in this example.
Note For unused jobs enter a 0 at input Job_Data_Type.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 56
5 Diagnostics
5 Diagnostics
The Modbus driver MB_REDCL monitors the four possible communication
connections. The error messages are displayed at the four status outputs
STATUS_0A through STATUS_1B in hexadecimal format.
After linking to the open source block MB_DIAG, in the event of an error
the configured message texts are displayed automatically in the runtime.
You can download this open source block and the relevant text table on
the following page:
http://support.automation.siemens.com/WW/view/en/75867147.
1. Download the block MB_DIAG and the relevant text table.
Note The text table is an example and can be adapted to the project requirements.
A list of all messages that the Modbus driver block MB_REDCL comprises is
provided at the end of this section.
Figure 5-1
2. Store the text table in your project in the "text libraries".

3. Integrate the block MB_DIAG into your master data library and insert the block
MB_DIAG into your CFC chart.
4. Create at least the connections from table 4-1 for redundant link partners.
Create at least the connections from table 4-2 for single link partners.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 57
5 Diagnostics
Table 5-1
Redundant communication partners
MB_REDCL MB_DIAG Description
STATUS_1A  STATUS_1A Monitoring of the four possible communication
STATUS_0B  STATUS_0B connections.
ERROR  ERROR There is an error on all active connections.

RedErrS7  RedErrS7 Redundancy error on the SIMATIC side
RedErrDev  RedErrDev Redundancy error on the link partner side
TotComErr  TotComErr Complete loss of communication; all configured
connections are disturbed.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 58
5 Diagnostics
Single link partner

MB_REDCL MB_DIAG Description
STATUS_0A  STATUS_0A Monitoring of the two connections from a

STATUS_1A  STATUS_1A redundant AS to a single link partner
ERROR  ERROR There is an error on all active connections.

RedErrS7  RedErrS7 Redundancy error on the SIMATIC side
RedErrDev  RedErrDev Redundancy error on the link partner side
TotComErr  TotComErr Complete loss of communication; all configured
connections are disturbed.
Figure 5-2
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 59
5 Diagnostics
5. The multiple message reporting of an error that is still active can be prevented
by way of the input parameter "Ctime". The error message is then not reported
again until the error has been non-active for at least the time period "Ctime".
This way you prevent a flood of messages. This function is deactivated by
the input 0.
6. Highlight the block MB_DIAG and open its properties.
7. Click the button "Messages...".
8. Under "Event" you can enter the message texts directly or you can open via this
the message texts from the text table.
Figure 5-3
The error numbers and message texts are determined and represented on the
basis of the text table; see the following example:
Figure 5-4
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 60
5 Diagnostics
Error messages
The following table shows the assignment of the hexadecimal messages to
the plain text messages that you can insert into the downloadable text table.
Table 5-2
Error messages from MB_REDCL and MB_REDSV
Status [hex] Event text Remedy
A002 The start_x check indicated errors. Contact Product Support.
A003 A DB onto which the Modbus Extend the DB.
addresses are to be mapped is too
short. Minimum length in bytes: CP is client:
- for registers: Correct the job parameter START_
(START_ADDRESS – start_x + ADDRESS or LENGTH.
LENGTH) * 2 + 2
for bit values: CP is server:
(START_ADDRESS – start_x + Change the request of the client.
LENGTH) / 8 + 2
CP is client:
Incorrect call parameters.
CP is server:
Incorrect address area in the client's
request telegram.
A004 Only CP is client: Correct the call parameters.
An invalid combination of Only data types 1 and 3 can be
DATA_TYPE and WRITE_READ has written.
been specified.
A005 CP is client: CP is client:
A non-permitted value has been Correct the parameter LENGTH.
entered at the parameter LENGTH.
CP is server: CP is server:
The number of registers/bits in the Change the quantity in the request
request telegram is not permitted. telegram.
The CP responds with an exception
telegram.
Range of values:
Read coils/inputs: 1 to 2000
Write coils: 1 to 1968
Read registers: 1 to 125
Write holding
register: 1 to 123
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 61
5 Diagnostics

A006 The range specified via CP is client:
DATA_TYPE, START_ADDRESS Correct the parameter assignment
and LENGTH does not exist in combination DATA_TYPE,
data_type_1 through data_type_4. START_ADDRESS and LENGTH.
The CP responds with an exception Change the client request or correct
telegram. the parameter assignment at
data_type_x.
A007 CP is client: Correct the parameter assignment.
An invalid monitoring time on the
MONITOR has been parameterized.
A value ≥ 20 ms must be entered.
A008 Within the parameterized MONITOR Check the settings and, where
monitoring time the enabled applicable, the error messages of
AG_RECV reports no reception, for the link partner. Check whether the
example connection not established, communication partner might possibly
partner not ready. require a specific UNIT identifier.
The connection will be released and

re-established.
A009 CP is client: Check the data of the link partner with
The transaction identifier received the aid of a message recording.
(TI) is not the same as the one sent.

re-established.
A00A CP is client: Check the data of the link partner with
The UNIT received is not the same the aid of a message recording.
as the one sent.

re-established.
A00B CP is client: CP is client:
The function code received is not Check the data of the link partner with
the same as the one sent. the aid of a message recording.
An invalid function code has been Change the request of the client.
received. The CP responds with The Modbus FB processes the
an exception telegram. function codes 1, 2, 3, 4, 5, 6, 15
and 16.
re-established.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 62
5 Diagnostics

A00C The number of bytes received does Check the data of the link partner with
not match the number of registers. the aid of a message recording.
The CP responds with an exception
telegram.

re-established.
A00D Only if CP is client: The register/bit Check the data of the link partner with
address or the number of the aid of a message recording.
registers/bits in the response
telegram is not the same as that in
the request message.
A00E The length specification in the Check the data of the link partner with
Modbus-specific telegram does not the aid of a message recording.
match the specifications of the
number of registers/bits or of the
number of bytes in the telegram.
The FB discards the data.

re-established.
A00F A protocol identifier not equal to 0 Check the data of the link partner with
has been received. the aid of a message recording.

re-established.
A010 A DB number has been assigned Correct the parameter assignment at
twice for the parameters db_1 db_x.
through db_4.
A011 An invalid value has been specified Correct the call parameters.
at the input parameter DATA_TYPE
(permitted values: 1‒4).
A012 The parameterized areas Correct the parameter assignment.
data_type_1 and data_type_2 The data areas are not allowed to
overlap. have common registers.
A013 The parameterized areas
data_type_1 and data_type_3 ─
overlap.
overlap.
A019 One of the parameters db_x has Correct the parameter assignment at
been set to 0, although the relevant db_x to > 0.
data_type_x is parameterized with >
0. DB0 is not allowed to be used,
because it is reserved for the system.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 63
5 Diagnostics

A01A Incorrect length in header: Check the data of the link partner with
3 to 253 bytes are permitted. the aid of a message recording.
re-established.
A01B CP is server and function code 5: Check the data of the link partner with
Invalid status received for coil. the aid of a message recording.
A01E Invalid data have been received that Check the error messages of the link
could not be assigned. partner.
Where applicable, check the data by
The connection will be released and means of a message recording.
re-established.
A01F The FB MB_REDCL or MB_REDSV Contact Product Support.
is in an operating state that is not
permitted.
A020 No monitoring time or one that is too Correct the parameter assignment.
short is configured for AG_CNTRL at
check_conn_cycle. Client:
If use_all_conn = TRUE, a monitoring
time > 1 s must be parameterized.
Server:
A monitoring time > 1 s must be
parameterized.
A023 The parameterized areas Correct the parameter assignment.
data_type_2 and data_type_3 The data areas are not allowed to
overlap each other. have common registers.
overlap one another.
overlap one another.
A07A A non-permitted value has been Correct the parameter assignment at
specified at parameter id_x (value input id_x.
range from 1 to 64).
A07C A non-permitted value has been Correct the parameter assignment at
specified at parameter data_type_x data_type_x.
(permitted values are 0 to 4).
A07D The parameter data_type_1 does not Correct the parameter assignment at
contain an entry. The parameter area data_type_1.
is the initial area and must be
parameterized.
A07E The number of the instance DB of the Correct the parameter assignment at
block MB_REDCL or MB_REDSV db_x.
has been specified at db_x.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 64
5 Diagnostics

A080 In OB100 and in the cyclic The Modbus block must be called in
organization block (OB), different the start-up OB and in the cyclic OB
instance DBs have been used for the with the same instance DB.
Modbus block.
A081 Only if CP is client and function code Check the data of the link partner with
5: The response telegram data do the aid of a message recording.
not echo the request.
A082 Only if CP is client and function code Check the data of the link partner with
6: The register value received is not the aid of a message recording.
the same as the one sent.
A083 CP is client: A new job has been Do not trigger a new job until the
triggered while the previous job is still previous job has been completed with
running. The job will not be executed. DONE = TRUE or ERROR = TRUE.
Wait with the initialization until there
Manual block initialization attempted is no longer a job in progress.
while a job is still in progress.
A085 An internal error has occurred in the Check whether there have been any
licensing check on account of an unauthorized write accesses to the
unauthorized write access. license DB. The REG_KEY structure
must not be changed. Contact

Product Support in the event of any
problems.
A090 The Modbus block is not yet Read out the IDENT_CODE
licensed for this CPU. This is status identification string for this CPU and
information. The ERROR bit is not request the registration key.
set. Modbus communication will also
run unlicensed.
A091 Only if CP is client: The link partner does not support the
An exception telegram with exception requested function.
code 1 has been received in
response.

re-established.
A092 Only if CP is client: Correct the LENGTH or
An exception telegram with exception START_ADDRESS for the FB call.
code 2 has been received in
response. Access to a non-existent
or invalid address has been
performed by the link partner.
A093 Only if CP is client: The link partner cannot process the
An exception telegram with exception message received (for example,
code 3 has been received in it does not support the requested
response. length).
A094 Only if CP is client: In its current status the link partner
An exception telegram with exception cannot process the message
code 4 has been received in received.
response.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 65
5 Diagnostics

A095 Only if CP is client: Check the link partner's error
An exception telegram with an messages and, where applicable,
unknown exception code has been check the data by means of
received in response. a message recording.
A0FF At present the connection is not Check the connections. Where
ready for communication. applicable, correct the value at
check_conn_cycle. The error can
also occur, if a CP is used that
does not support the AG_CNTRL.
FFFF The connection is not configured. If this connection is to be used, it
must be configured in start-up at id_x
and laddr_x.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 66
6 Hardware changes during operation in the H-system
6 Hardware changes during operation in the

H-system
The functionality "hardware changes during operation" is available directly in the
H-system without any additional settings.
There are some systems that must not be shut down during operation.
The reasons for this are, for example, the complexity of the automated process or
high restarting costs. Nevertheless, expansion or modification may be required.
Using H-CiR (Configuration in RUN), it is possible to make certain configuration
changes to the hardware configuration in the operating status RUN.
H-CiR cannot be used until the function is enabled in HW Config and has been
loaded once by way of an AS STOP.
You will find a detailed description of the possible hardware changes for an
H-system in the manual "SIMATIC Process Control System PCS 7 Engineering
System (V8.1)"
Communication delays
A communication delay can occur, if hardware changes are loaded into an
H-system during operation.
The communication delay with H-CiR depends on the current process status,
the communication load, and the system parameters.
The maximum permissible communication delay can be set in the properties of
the CPU under "H parameters". The delay times can be calculated on the basis
of the system parameters.
Note Perform H-CiR only in non-critical processes statuses.

The necessity for H-CiR can be reduced by configuring reserve I/O modules and
installing resistances at the inputs and outputs in order to prevent diagnostic
messages.
You will find further information on hardware changes during operation in the
system manual "SIMATIC Fault-tolerant systems S7-400H":
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 67
7 Renaming and rewiring of Function Blocks

If the numbers of the standard functions are already being used in a project or the
number range is reserved for other applications, the internally called functions
FC50, FC60 or the function blocks MB_REDCL, MB_REDSV, MB_CPCLI and
MB_CPSRV can be rewired.
Rewired means that not only are the function block numbers changed, but also
the internal calls that call these blocks or functions.
MB_REDCL / MB_RESV
The function blocks MB_REDCL (FB909) and MB_REDSV (FB907) of the Modbus
library internally call the function blocks MB_CPCLI (FB908) or MB_CPSRV
(FB906), which are also a component part of the Modbus library.
In addition MB_CPCLI or MB_CPSRV each call the blocks AG_LSEND (FC50)
and AG_LRECV (FC60), which are a component part of the SIMATIC NET library.
The function code names FC50 and FC60 are frequently populated by other
functions (for example, I/O modules), so that in the event of careless copying of
the Modbus library blocks the latter are overwritten and malfunctions can occur
as a result.
Figure 7-1
FB Call FC Call
FB 909 FB 908 FC 50
FC 60
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 68
Table 7-1
Scenario Action
5. The FB and FC numbers are not used in No action is required.
your project. Function blocks and function codes can be
copied into the project.
6. The FB numbers are used in your project, Rename either the function blocks in the
but the FC numbers called are not yet project or the function blocks to be added.
populated.  See Section 7.1 "Renaming"
7. The FB numbers are not used in your The FC blocks can be renamed in the
project, but the FC numbers called are project:
used by other functions.  See Section 7.1 "Renaming"
The FC blocks can not be renamed in the
project because they are called by other
FBs and FCs:
 See Section 7.2 "Rewiring"
8. Both the FB numbers and the FC Neither the function blocks nor the function
numbers are used in your project. codes can be renamed in the project:
 See Section 7.2 "Rewiring"
7.1 Renaming
You can perform renaming, if the add-on blocks do not call any additionally
provided function blocks (FBs) or functions (FCs) that have the same numbers
as have already been assigned for other FBs/FCs in your project.
1. Rename your blocks in the add-on library.
2. Adapt these changes in the symbol table.
3. Copy the blocks into your project.
7.2 Rewiring
The rewiring ensures that the internal fixed code calls are also adapted by certain
FBs or FCs.
Sequence
The following sequence must be complied with when rewiring the blocks from the
Modbus library:
1. FC50 AG_LSEND
FC60 AG_LRECV
2. FB908 MB_CPCLI
FB906 MB_CPSRV
3. FB909 MB_REDCL
FB907 MB_REDSV
CAUTION Not all functions or function blocks have to be rewired.

Even if only some of these blocks are rewired, this sequence must be complied
with.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 69
Step-by-step instructions
In this example, new numbers are assigned for the following FBs and FCs.
Table 7-2
Block name from library from to
MB_REDCL Modbus/TCP FB909  FB1000
MB_REDSV Modbus/TCP FB907  FB999
MB_CPCLI Modbus/TCP FB908  FB1001
MB_CPSRV Modbus/TCP FB906  FB998
AG_LSEND SIMATIC NET FC50  FC550
AG_LRECV SIMATIC NET FC60  FC660
To rewire, proceed as follows:

1. Create a new PCS 7-program.
2. Copy the following Modbus/TCP and SIMATIC NET blocks into your new PCS 7
program:
– MB_REDCL
– MB_REDSV
– MB_CPCLI
– MB_CPSRV
– AG_LSEND
– AG_LRECV
9. Select the folder "Blocks" and select "Rewire" in the context menu.
Figure 7-2
10. An empty table appears.

In the first column enter the FB and FC numbers that you would like to rewire.
Enter the new FB and FC numbers in the second column.
Click the "OK" button to confirm the changes.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 70
Figure 7-3
11. Check the result.

To do so, highlight the changed block and open its properties. Switch to the
"Calls" tab. The called blocks are listed on this tab.
12. Copy the blocks into your actual project.
Figure 7-4
FB Call FC Call
FB 909 FB 908 FC 50
FB 1009 FB 1008 FC 550
FC 60
FC 660
Note With this method all other add-on libraries can be implemented in the PCS 7
project independently of their FB/FC numbers.
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 71
8 Performance
8 Performance
List below are the hardware and software items used by means of which the
performance measurements have been made:
 S7 412-5H PN/DP
 CPU 412-5HK06-0AB0 (firmware V6.0.1)
 CP 443-1EX20-0EX0 (firmware V2.0.57)
 PCS 7 V8.0 Upd1
Scenario 1
In the first scenario, two MB_REDCL blocks are configured for the first test case;
one block for sending and one block for receiving the data. One job is processed
per send and receive block (up to 4 jobs are possible). Each job uses a separate
data block (DB). The jobs are processed via two Job_List blocks.
For the first measurement 124 words are received and 123 words are sent.
For the second measurement the two MB_REDCL blocks and the two Job_List
blocks are copied and pasted. As a result, double the number of words are
received and sent (248 words/246 words).
Two further MB_REDCL blocks and two Job_List blocks are copied at a time for
each further measurement.
1. Measurement
2 * MB_REDCL + 2 * Job_List
2 * data blocks (1 * for send; 1 * for receive)
Receive 124 words and send 123 words
2. Measurement
3. Measurement
4. Measurement
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 72
8 Performance
Figure 8-1
Table 8-2
Scenario 1
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 73
8 Performance
Scenario 2A
In scenario 2A, two MB_REDCL blocks are configured; one block for sending and
one block for receiving. Each block can process up to 4 jobs. Each job requires
a data block (DB). The jobs are processed via two Job_List blocks.
In the first measurement 124 words are read and 123 words are sent via one job.
In the second measurement, within the MB_REDCL block a second job is
parameterized and via the latter 124 words are also read and 123 words sent, so
that in total the read and sent words are doubled. The number of MB_REDCL and
number of Job_List blocks are maintained, however, the number of data blocks is
increased to 2.
Parameterized again in the third measurement is an additional job that also reads
124 words and sends 123 words.
Parameterized again in the fourth measurement is an additional job that reads
124 words and sends 123 words.
1. Measurement
2. Measurement
3. Measurement
4. Measurement
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 74
8 Performance
Figure 8-3
Measurement
Measurement
Measurement
Measurement
Job 1
Job 2
Job 3
Job 4
Table 8-4
Scenario 2A
Scenario 2B
Scenario 2B is analogous to the first measurement from scenario 2A, however, the
data volume that is received and sent via one job (1 DB) is increased to 496/492
words.
Measurement
Figure 8-5
Job 1
Measurement
Table 8-6
Scenario 2B
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 75
9 Appendix
9 Appendix
9.1 Service and Support
Industry Online Support
Do you have questions or need assistance?
Using the Industry Online Support, you have round-the-clock access to expertise
spanning the entire range of service and support, as well as to our services.
The Industry Online Support is the central address for information about our
products, solutions and services.
Product information, manuals, downloads, FAQs and application examples –
all information can be accessed with just a few mouse clicks:
https://support.industry.siemens.com/
Technical Support
The Siemens Industry Technical Support offers you fast and competent support
for any technical queries you may have with a number of tailor-made solutions –
ranging from basic support to individual support contracts.
Please send any queries to Technical Support via Web form:
www.siemens.en/industry/supportrequest
Range of services
Our range of services includes the following:
 Product training courses
 Plant data services
 Spare parts services
 Repair services
 On-site and maintenance services
 Retrofitting and modernization services
 Service programs and contracts
You can find detailed information on our range of services in the service catalog:
https://support.industry.siemens.com/cs/sc
Industry Online Support App

The "Siemens Industry Online Support" app provides you with optimum support,
including while on the road. The app is available for Apple iOS, Android and
Windows Phone:
https://support.industry.siemens.com/cs/ww/en/sc/2067
Contact partners
If you want to request on-site service or need spare parts, please get in touch with
your local Siemens representative, who will put you in contact with the responsible
service center. You can find your contact partner in the contact database:
www.siemens.com/yourcontact
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 76
9 Appendix
9.2 Links and Literature

Table 9-1
Nr. Topic
\1\ Siemens Industry Online Support
http://support.industry.siemens.com
\2\ Download page for this entry
https://support.industry.siemens.com/cs/ww/en/75867147
9.3 Change documentation

Table 9-2
Version Date Change
V1.0 09/2013 First edition
V1.1 09/2015 Update and supplements
V1.2 02/2016 Update and supplements
V1.3 01/2017 Update
Modbus/TCP
Entry ID: 75867147, V1.3, 01/2017 77

Modbus TCP Client V82 en

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Modbus TCP Client V82 en

Uploaded by

Copyright:

Available Formats

Application Description  01/2017

Warranty and liability

deficiency or breach of a condition which goes to the root of the contract

1 Description of the task and the solution

Core contents of the application description

2 General library information

The Modbus/TCP libraries "SIMATIC Modbus/TCP CP" and "Redundant V2"

Modbus/TCP PN CPU, Modbus/TCP PN Red and Modbus/TCP SENTRON PAC

ET 200 - IM 151-8 PN/DP CPU

2.2 Mode of operation

In cyclic mode a distinction is made between client and server functionality:

2.3 Technical specifications

command limit; simultaneously set command limit;

2.4 Modbus/TCP variants

Product Description License Order number

2.5 Ordering and scope of delivery

The following are included in the scope of delivery:

There are four folders in the "Modbus_TCP_CP_Red300_400" library:

be performed individually for each CPU.

The licensing is performed by means of the following steps:

Entry of the activation key requires the presence of OB121.

4. An 18-character string is displayed at the output IDENT_CODE.

7. Send the form by way of a support request to Customer Support

Entering the activation key REG_KEY

2.7.2 Missing or erroneous licensing

 In the case of an S7-400 CPU: LED INTF

CAUTION The cyclic entries burden the diagnostic buffer

The error number for a missing license is W #16 #A090.

CP443-1 Advanced 6GK7443-1EX40-0XE0 ≥ 2.2.35

2.8.2 Software requirements

SEND_B MB_REDCL MB_DIAG RECV_B

SEND_R Job_List RECV_R

A PCS 7 measuring point for a redundant Modbus/TCP client coupling consists of

Interface blocks (add-on Modbus blocks)

Modbus driver for redundant communication (MB_REDCL)

 Monitoring of all configured connections via AG_CNTRL

Detailed block and function descriptions

3.1 Address mapping of the function block MODBUSCP

+34.0 ID_1_start_4 WORD W#16#0 0

3.2 Installation of the Modbus library

The installation procedure installs the following components:

\Program Files\Siemens\Step 7\EXAMPLES

4.2 Assigning parameters to to the link partner

4. Assign an IP address, in the example 192.168.0.11 for the primary interface,

4.3 Configuration of the CPU and of the link partners

4.3.1 Configuration of a red. CPU and red. Link Partner

Configuration of the communication connections

IP addresses 192.168.0.11 and 192.168.0.12 are assigned to the H-system in this

1. Select the first CPU of the H-system in NetPro.

The properties window of the connection opens:

6. Assign an ID on the "General" tab The ID is randomly selectable.

8. The checkbox "Active connection establishment" must be enabled.

12. Click on "OK" to exit the dialog.

16. Switch to the "Addresses" tab.

17. Click on "OK" to exit the dialog.

22. Click on "OK" to exit the dialog.

27. Click on "OK" to exit the dialog.

4.3.2 Network setup in NetPro

4.4 Configuration of a red. CPU and a single link partner

IP addresses 192.168.0.11 and 192.168.0.12 are assigned to the H-system in this

1. Select the first CPU of the H-system in NetPro.

The properties window of the connection opens:

6. Assign an ID on the "General" tab The ID is randomly selectable.