SS200S e

Contents
SIMATIC Serial Interface Module ET 200S

Manual
Overview Serial Interface Module Modbus/USS Index
1 2 3
This manual is part of the documentation package with the order number: 6ES7151-1AA00-8BA0
Edition 10/2001
A5E00124881-01
Safety Guidelines
This manual contains notices intended to ensure personal safety, as well as to protect the products and connected equipment against damage. These notices are highlighted by the symbols shown below and graded according to severity by the following texts:
! ! !
Danger
indicates that death, severe personal injury or substantial property damage will result if proper precautions are not taken.
Warning
indicates that death, severe personal injury or substantial property damage can result if proper precautions are not taken.
Caution
indicates that minor personal injury can result if proper precautions are not taken.
Caution
indicates that property damage can result if proper precautions are not taken.
Notice
draws your attention to particularly important information on the product, handling the product, or to a particular part of the documentation.
Qualified Personnel
Only qualified personnel should be allowed to install and work on this equipment. Qualified persons are defined as persons who are authorized to commission, to ground and to tag circuits, equipment, and systems in accordance with established safety practices and standards.
Correct Usage
Note the following:
Warning
This device and its components may only be used for the applications described in the catalog or the technical description, and only in connection with devices or components from other manufacturers which have been approved or recommended by Siemens. This product can only function correctly and safely if it is transported, stored, set up, and installed correctly, and operated and maintained as recommended.
Trademarks
SIMATIC, SIMATIC HMI and SIMATIC NET are registered trademarks of SIEMENS AG. Third parties using for their own purposes any other names in this document which refer to trademarks might infringe upon the rights of the trademark owners. Copyright W Siemens AG 2001 All rights reserved The reproduction, transmission or use of this document or its contents is not permitted without express written authority. Offenders will be liable for damages. All rights, including rights created by patent grant or registration of a utility model or design, are reserved. Siemens AG Bereich Automatisierungs- und Antriebstechnik Geschaeftsgebiet Industrie-Automatisierungssysteme Postfach 4848, D- 90327 Nuernberg Siemens Aktiengesellschaft Disclaim of Liability We have checked the contents of this manual for agreement with the hardware and software described. Since deviations cannot be precluded entirely, we cannot guarantee full agreement. However, the data in this manual are reviewed regularly and any necessary corrections included in subsequent editions. Suggestions for improvement are welcomed. Siemens AG 2001 Technical data subject to change. A5E00124881-01
Contents
1 2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Serial Interface Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11 2.12 2.13 2.14 3 Product Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brief Explanation of Commissioning the Serial Interface Module . . . . . . . Block Diagram with Terminal Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . RS-232C Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RS-422/485 Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Basic Principles of Serial Data Transmission . . . . . . . . . . . . . . . . . . . . . . . . Data Transmission With the 3964(R) Procedure . . . . . . . . . . . . . . . . . . . . . Data Transmission with the ASCII Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring and Parameterizing the Serial Interface Module . . . . . . . . . . . Communication Using Function Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Startup Features and Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reference Data for Masters Other than S7-PROFIBUS . . . . . . . . . . . . . . . Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Technical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 2-1 2-2 2-6 2-14 2-20 2-21 2-22 2-32 2-41 2-52 2-58 2-76 2-79 2-92 2-99 3-1 3-2 3-5 3-5 3-10 3-13 3-14 3-14 3-14 3-15 3-15 3-16 3-16 3-18 3-18 3-18 3-27 3-30
Modbus/USS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 3.2 3.2.1 3.2.2 3.2.3 3.3 3.3.1 3.3.2 3.3.3 3.3.4 3.3.5 3.3.6 3.4 3.4.1 3.4.2 3.4.3 3.4.4 Product Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Terminal Assignment Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Terminal Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RS-232C Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RS-422/485 Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Modbus Transmission Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Slave Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Master and Slave Function Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Field DATA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message End and CRC Check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exception Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Modbus Master Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Usable Interfaces and Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Transfer for ET 200S Modbus Master . . . . . . . . . . . . . . . . . . . . . . . . . Configuring and Setting Parameters for the Modbus Master . . . . . . . . . . . Function Codes Used by the Modbus Master . . . . . . . . . . . . . . . . . . . . . . . .
Serial Interface Module ET 200S A5E00124881-01
iii
Contents
3.4.5 3.4.6 3.4.7 3.4.8 3.4.9 3.4.10 3.4.11 3.4.12 3.4.13 3.4.14 3.4.15 3.4.16 3.5 3.5.1 3.5.2 3.5.3 3.5.4 3.5.5 3.5.6 3.5.7 3.5.8 3.5.9 3.5.10 3.5.11 3.5.12 3.5.13 3.5.14 3.5.15 3.5.16 3.5.17 3.5.18 3.5.19 3.5.20 3.6 3.6.1 3.6.2 3.6.3 3.6.4 3.6.5 3.7 3.7.1 3.7.2 3.7.3 3.7.4 3.7.5 3.7.6 3.7.7 3.7.8 3.7.9
Function Code 01 - Read Output Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 02 - Read Input Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 03 - Read Output Registers . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 04 - Read Input Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 05 - Force Single Coil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 06 - Preset Single Register . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 07 - Read Exception Status . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 08 - Loop Back Diagnostic Test . . . . . . . . . . . . . . . . . . . . . . Function Code 11 - Fetch Communications Event Counter . . . . . . . . . . . . Function Code 12 - Fetch Communications Event Log . . . . . . . . . . . . . . . . Function Code 15 - Force Multiple Coils . . . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 16 - Preset Multiple Registers . . . . . . . . . . . . . . . . . . . . . . . Modbus Slave Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Components of the Modbus Slave Data Link . . . . . . . . . . . . . . . . . . . . . . . . Data Transfer for ET 200S Modbus Slave . . . . . . . . . . . . . . . . . . . . . . . . . . Data Areas in the SIMATIC CPU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring the Parameters for the Data Link . . . . . . . . . . . . . . . . . . . . . . . Slave Function Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 01 - Read Coil (Output) Status . . . . . . . . . . . . . . . . . . . . . . . Function Code 02 - Read Input Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 03 - Read Output Registers . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 04 - Read Input Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 05 - Force Single Coil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 06 - Preset Single Register . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 08 - Loop Back Diagnostic Test . . . . . . . . . . . . . . . . . . . . . . Function Code 15 - Force Multiple Coils . . . . . . . . . . . . . . . . . . . . . . . . . . . . Function Code 16 - Preset Multiple Registers . . . . . . . . . . . . . . . . . . . . . . . Bit-Oriented Function Code Conversions . . . . . . . . . . . . . . . . . . . . . . . . . . . Register-Oriented Function Code Conversions . . . . . . . . . . . . . . . . . . . . . . Enable/ Disable Write Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Conversion of Modbus Addresses for Bit Functions . . . . . . . . . . . . . . . . . . Conversion of Modbus Addresses for Register Functions . . . . . . . . . . . . . Limits for Write Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Diagnostic Information of the Status LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . Structure of the Function Block Diagnostic Messages . . . . . . . . . . . . . . . . PROFIBUS Slave Diagnosis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Modbus Slave Diagnostic Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . USS Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . USS Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuration and Parameterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Functional Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . FC17 S_USST: Transmitting Data to a Slave . . . . . . . . . . . . . . . . . . . . . . . . FC18 S_USSR: Receiving Data from a Slave . . . . . . . . . . . . . . . . . . . . . . . FC19 S_USSI: Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Net Data DB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Parameter Sets DB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Communication Processor DB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3-31 3-32 3-33 3-33 3-34 3-35 3-36 3-36 3-37 3-38 3-39 3-40 3-41 3-41 3-42 3-43 3-45 3-48 3-49 3-52 3-55 3-58 3-61 3-63 3-65 3-66 3-68 3-71 3-71 3-73 3-74 3-79 3-82 3-84 3-84 3-85 3-94 3-94 3-96 3-99 3-99 3-100 3-101 3-103 3-106 3-109 3-112 3-118 3-120
iv
Contents
3.8 3.8.1 3.8.2 3.8.3 3.8.4 3.9
Start-up Characteristics and Operating Modes of the ET 200S Serial Interface Modbus/USS Driver . . . . . . . . . . . . . . . . . . . . . . . Loading the Configuration and Parameter Assignment Data . . . . . . . . . . . Operating Modes of the ET 200S Serial Interface Modbus/USS Module . Start-up Characteristics of the ET 200S Serial Interface Modbus/USS Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Behavior of the ET 200S Serial Interface Modbus/USS Module on Operating Mode Transitions of the CPU . . . . . . . . . . . . . . . . . . . . . . . . .
3-121 3-121 3-122 3-122 3-123
Technical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-125
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Index-1
Contents
vi
Overview
How the Manual is Structured

This manual complements the Distributed I/O Device manual. It contains descriptions of the ET 200S modules that are particularly suited for use in certain processes.
How to Find Your Way Around

At the beginning of each chapter you will find a Product Overview, which lists the features and applications of the module described. You will also find the order number of the module and the name and release of the software required. The Internet address where the current DDB file is stored is also provided. In each chapter you will then find a section with the heading Brief Instructions on Commissioning followed by the name of the relevant module. These brief instructions tell you in a series of short steps how to install and configure the module, how to integrate it in your use program, and how to test it in your user program.
Index
The index contains keywords that come up in the manual.
1-1
Overview
1-2
Serial Interface Module
Chapter Overview
This chapter describes the ET 200S serial interface module, the communication protocols supported by the module, the parameter assignment of the module and its integration in the ET 200S distributed I/O system. This document covers the following topics:
Section 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11 2.12 2.13 2.14 Product Overview
Description
Page 2-2 2-6 2-14 2-20 2-21 2-22 2-32 2-41 2-52 2-58 2-76 2-79 2-92 2-99
Brief Explanation of How to Commission the Serial Interface Module Block Diagram with Terminal Assignment RS-232C Interface RS-422/485 Interface Basic Principles of Serial Data Transmission Data Transmission with the 3964(R) Procedure Data Transmission with the ASCII Driver Configuring and Parameterizing the Serial Interface Module Communication Using Function Blocks Startup Features and Modes Reference Data for Masters Other than S7 PROFIBUS Diagnostics Technical Specifications
You will find detailed information on the hardware configuration, setup, wiring, commissioning, diagnostics, and the technical specifications of the ET 200S distributed I/O system in the Distributed I/O Device manual.
2-1
2.1
Product Overview
Order Number
6ES7 138-4DF00-0AB0
Product Description
The ET 200S serial interface module is a plug-in module belonging to the ET 200S product series. It provides access to serial communication by means of three hardware interfaces (RS-232C, RS-422, and RS-485) and two software protocols (ASCII and 3964(R)). You can use the ET 200S interface module to exchange data between programmable logic controllers or computers by means of a point-to-point connection. All communication occurs by means of serial asynchronous transfers. You select the type of communication when you parameterize the module in the STEP 7 hardware configuration program or in another configuration application. The following four versions of the module are displayed in the hardware catalog: ASCII (8B) ASCII (4B) 3964R (8B) 3964R (4B) 8-byte data transmission increases the throughput but requires more I/O memory on the ET 200S rack. Four-byte data transmissions require less I/O memory on the ET 200S rack, but offer lower throughput. The module variant is based on your application requirements.
2-2
Functionality of the ET 200S Serial Interface Module

The ET 200S serial interface module offers the following functions: Integrated interface to RS-232C, RS-422 or RS-485 A transmission rate of up to 19.2 kbps, half-duplex Integration of the following transmission protocols in the module firmware 3964(R) procedure ASCII driver The functionality of the drivers is based on the parameter assignment of the module. Table 2-1 lists the functions of the individual driver interfaces.
Table 2-1 Functions of the Drivers of the ET 200S Serial Interface Module Function ASCII driver Use of RS-232C auxiliary signals Control/reading of RS-232C auxiliary signals with FBs Flow control with RTS/CTS Flow control with XON/XOFF 3964(R) procedure RS-232C Yes Yes Yes Yes Yes Yes RS-422 Yes No No No Yes Yes RS-485 Yes No No No No No
2-3
Communication
The ET 200S serial interface module permits point-to-point connection with different Siemens modules and non-Siemens products including: SIMATIC S5 by means of the 3964(R) driver with the corresponding interface module on the S5 side Siemens data acquisition terminals of the ES 2 family by means of the 3964(R) driver MOBY I (ASM 420/421, SIM), MOBY L (ASM 520), and ES 030K by means of the 3964(R) driver SIMOVERT and SIMOREG (USS protocol) by means of the ASCII driver (ET 200S SI RS 422/485) with the corresponding protocol adjustment with a STEP 7 program PCs by means of the 3964(R) procedure (there are development tools for this for programming on a PC: PRODAVE DOS 64R (6ES5 897-2UD11) for MS-DOS, PRODAVE WIN 64R (6ES5 897-2VD01) for Windows or ASCII driver) Barcode readers by means of the 3964(R) driver or ASCII driver Non-Siemens programmable logic controllers by means of the 3964(R) drivers or ASCII driver Additional devices with simple protocol structures by means of the corresponding protocol adjustment with the ASCII driver Additional devices that also have a 3964(R) driver
LEDs
The following status LEDs are on the front panel of the ET 200S interface module: SF TX RX (red) Error LED
(green) Interface sends (green) Interface receives
The modes and errors indicated by these LEDs are described in Section 2.13.
2-4
Front Panel
Figure 2-1 shows the labeling on the front panel of the ET 200S SI interface module.
SERIAL INTERFACE SF
RS232 MODE 1 TXD 2 RTS 3 DTR 4 DCD 5 RXD 6 CTS 7 DSR 8 PE RS422 MODE 1 TXD(B) 2 TXD(A) 5 RXD(B) 6 RXD(A) 8 PE RS485 MODE 1 T/RXD(A) 2 T/RXD(B) 8 PE
X2 3 4 TX RX
6ES7 1384DF00-0AB0
Figure 2-1 Labeling on the Front Panel of the ET 200S Serial Interface Module
2-5
2.2
Brief Explanation of Commissioning the Serial Interface Module
Introduction
Using an example, this brief explanation tells you how to send and receive data between serial interface modules, how to set up a functioning application, how the basic operations of the serial interface module (hardware and software) work, and how to test the hardware and software. In this example we run two ET 200S serial interface modules in RS-232C ASCII mode.
Requirements
The following requirements must be met: You have to commission an ET 200S station on an S7 station with a DP master. You will need the following components: Two TM-E15S24-01 terminal modules Two ET 200S serial interface modules The necessary wiring material
2-6
Installation, Wiring, and Fitting

Install and wire the two TM-E15S24-01 terminal modules (see Figure 2-2). Connect the two ET 200S serial interface modules with the terminal modules. (You can find a detailed description of this in Chapter 5 of the Distributed I/O) manual.
SERIAL INTERFACE SF
SERIAL INTERFACE SF
ET 200S serial interface module
TX
RX
6ES7 1384DF00-0AB0
Wiring for RS-232C serial communication

1 5 5 2 6 3 7 4 NC 8 3 NC 4 8 2 7 1 6 TXD RTS DTR DCD RXD CTS DSR PE
TX
RX
6ES7 1384DF00-0AB0
TXD TM-E15S24-01 RTS terminal module DTR DCD
RXD CTS DSR PE
Figure 2-2 Terminal Assignment for the Example
2-7
Configuration
You begin by adapting the hardware configuration to your existing ET 200S station. 1. Open the corresponding project in SIMATIC Manager, and call up the configuration table in HWCONFIG. 2. Select the ET 200S serial interface module (6ES7 138-4DF00-0AB0 ASCII (8B)) in the hardware catalog, and drag this number to the slot at which you have installed your first module. 3. Double-click this number to open the DP Slave Properties dialog box. 4. Open the Address/ID tab. You will find the start address here for the slot in which you have inserted the module. Make a note of this address for subsequent programming. 5. Repeat this step for the second module. 6. Open the Parameter Assignment tab. You will find the default settings for the module. Assign parameters to the two modules in accordance with Table 2-2. 7. Download the configuration to the CPU in STOP mode by choosing the PLC Download menu command.
Table 2-2 Parameter Assignment for the Sample Application Parameters Group diagnosis Interface Receive line initial state Transmission rate Data bits Stop bits Parity Data flow control (default setting) Indicator for end of receive message frame Character delay time (ms) End-of-text character 1 End-of-text character 2 Number of characters received Dynamic Message frame buffer Prevent message frame buffer overwrite Delete receive buffer at startup Disable RS232-C R(A)5V / R(B)0V 4800 8 1 None None Expiration of character delay time 10 3 0 100 Disable Yes Yes Value
2-8
Creating the User Program

To create a user program in STEP 7 for this example, copy FB3 P_SEND and FB2 P_RCV from the library that is included in the delivery package of this module. For the program, you will also have to create an instance DB for each of the individual FBs when you enter them. Make sure that you enter the addresses as listed in the section on hardware configuration. Enter the following program in OB1 (see Figure 2-3). The outputs of FB3 and FB2 are stored because they are only available for one cycle. (In the example, the module to be sent is at address 256, and the module to be received is at address 264. Make sure that you use your configured addresses.)
2-9
DB3 FB3 EN M0.0 M0.1 256 14 2 24 M1.0 REQ R LADDR DB_NO DBB_NO LEN M1.1 S M4.6 S MOVE ENO OUT MW16 ENO DONE ERROR STATUS M1.0 M4.5 MW10
M4.5
M1.0 EN M4.5 MW10 IN
DB2 FB2 EN M0.0 M0.1 264 15 0 M1.2 EN_R R LADDR DB_NO DBB_NO M1.3 S M4.4 S MOVE ENO OUT MOVE ENO OUT MW20 MW18 ENO NDR ERROR LEN STATUS M1.2 M4.3 MW12 MW14
M4.3
M1.2 EN M4.3 MW12 IN
EN MW14 IN
Figure 2-3 Sample Program for the Sample Application
2-10
Create the DB14 as a global DB in accordance with Table 2-3.

Table 2-3 Address 0.0 +0.0 Message =26.0 DB14 for the Sample Application Name Type STRUCT STRING[24] END_STRUCT Message with 24 characters Initial Value
Create the DB15 as a global DB in accordance with Table 2-4.

Table 2-4 Address 0.0 +0.0 Message *1.0 =200.0 DB15 for the Sample Application Name Type STRUCT ARRAY[1..200] CHAR END_STRUCT Initial Value
Save the blocks, and download them to the CPU.
2-11
Testing the Sample Program

Proceed as follows to test the program for the sample application: 1. Select the Block container in your project. 2. Choose the Insert S7 Block > Variable Table menu command to insert the VAT 1 variable table, and then confirm with OK. 3. Open the VAT 1 variable table, and choose the Insert Block... menu command. Enter the following values in the various fields: As of Address DB15.DBW0 Number 14 Status Format CHAR Confirm with OK. 4. Enter the following values before the DB15.DBW0: M0.0 M0.1 M1.1 M4.6 MW16 M1.3 M4.4 MW18 MW20 Send/receive job Reset Send terminated Send error Send status Receive new data Receive error Receive length Receive status
5. Switch to online by choosing the PLC Connect to Configured CPU menu command. 6. Switch monitoring on by choosing the Variable Monitor menu command. 7. Switch the CPU to RUN mode. 8. Reset the following bits in the Modify Value column to 0: Transmission terminated (M1.1) Send error (M4.6) Receive new data (M1.3) Receive error (M4.4) 9. Change the following bits in the Change Value column in the specified order: 1) Bit for reset M0.1 = set 1 2) Bit for reset M0.1 = reset 0 3) Bit for send/receive job M0.0 = reset 0 (if not already at 0) 4) Bit for send/receive job M0.0 = set 1
2-12
You Can Now: See that the bit for transmission terminated (M1.1) and the bit for receiving new data (M1.3) are set. See that the two error bits have been reset and that the two status words are at 0. See that DB15 contains the expected characters in DBW0..DBW22 and that the expected receive length is 24 (W#16#18).
2-13
2.3
Block Diagram with Terminal Assignment
Wiring Rules
The cables (terminals 1 to 8) must be shielded. The shield must be supported at both ends. Use shield contact elements to do this (see the section on ET 200S accessories in the ET 200S Distributed I/O Device manual).
Terminal Assignment for RS-232C Communication

Table 2-5 shows the terminal assignment for the ET 200S serial interface module when the RS-232C communication protocol is set.
Table 2-5 Terminal Assignment for the ET 200S Serial Interface Module for RS-232C Communication View Terminal Assignment Terminals 1 5 2
TXD RTS DTR DCD
1 5
Remarks Mode: half-duplex and full-duplex TXD RXD RTS CTS DTR DSR PE Transmitted Data Received Data Request To Send Clear To Send Data Terminal Ready Data Set Ready Ground
RXD CTS DSR PE
6 3 7 4 8
DCD Data Carrier Detect
2-14
Terminal Assignment for RS-422 Communication

Table 2-6 shows the terminal assignment for the ET 200S serial interface module when the RS-422 communication protocol is set.
Table 2-6 Terminal Assignment for the ET 200S Serial Interface Module for RS-422 Communication View Terminal Assignment
Note: Add a terminating resistor of approx. 330 with cables over 50 m in length to ensure problem-free data transfer. RXD (B) TXD (B) TXD (A)
1 5
Remarks Mode: half-duplex Terminals 1 5 2 6 8 TXD (B) RXD (B) TXD (A) RXD (A) PE Ground
RXD (B) RXD (A) RXD (A)
PE
Terminal Assignment for RS-485 Communication

Table 2-7 shows the terminal assignment for the ET 200S serial interface module when the RS-485 communication protocol is set.
Table 2-7 Terminal Assignment for the ET 200S Serial Interface Module for RS-485 Communication View Terminal Assignment Remarks Mode: half-duplex
Note: Add a terminating resistance of approx. 330 with cables over 50 m in length to ensure problem-free data transfer. R/T (A) R/T (A) R/T (B)
1 5
Terminals 1 2 8 R/T (A) R/T (B) PE Ground
R/T (B)
PE
2-15
Terminal Assignment of the RS-232C Connecting Cable for the 9-pin Connector
Figure 2-4 shows the cable connections for RS-232C point-to-point communication between the ET 200S serial interface module and a communication partner with a 9-pin D connection socket. On the ET 200S side, the signal wires are connected to the correspondingly numbered terminals. Use a 9-pin subminiature D connection socket on the communication partner.
ET 200S SI Communication partner with 9-pin connection
RXD
TXD
TXD
RXD
2 6 7 3 4 8
RTS CTS DSR DTR DCD PE (Ground)
CTS RTS DTR DSR DCD PE
8 7 4 6 1 5
Shield contact
LIYCY 7 x 0.14 cable type (Belden 8104 or equivalent)
Housing shield
Figure 2-4 Terminal Assignment of the RS-232C Connecting Cable for the 9-pin Connector
2-16
Terminal Assignment of the RS-232C Connecting Cable for the 25-pin Connector
Figure 2-5 shows the cable connections for RS-232C point-to-point communication between the ET 200S serial interface module and a communication partner with a 25-pin D connector. On the ET 200S side, the signal wires are connected to the correspondingly numbered terminals. Use a 25-pin subminiature D connector on the communication partner.
ET 200S SI
Communication partner with 25-pin connector
RXD
TXD
TXD
RXD
2 6 7 3 4 8
5 4 20 6 8 7
Shield contact
LIYCY 7 x 0.14 cable type (Belden 8104 or equivalent)
Housing shield
Figure 2-5 Terminal Assignment of the RS-232C Connecting Cable for the 25-Pin Connector
2-17
Terminal Assignment of the RS-422 Connecting Cable for the 15-Pin Connector
Figure 2-6 shows the cable connections for RS-422 point-to-point communication between the ET 200S serial interface module and a communication partner with a 15-pin D connector. On the ET 200S side, the signal wires are connected to the correspondingly numbered terminals. Use a 15-pin subminiature D connector on the communication partner.
ET 200S SI
Communication partner with 15-pin connector
2 1 Sender 6 5 Recipient 8
TXD(A) TXD (B)
RXD(A) RXD (B)
4 11 Recipient 2 9 Sender 8
RXD(A) RXD(B)
TXD(A) TXD(B)
PE
GND
Shield LIYCY 3 x 2 x 0.14 cable type. (Belden 8103 or equivalent) T(A)/T(B) and R(A)/R(B) twisted pair Housing shield
Shield contact
Figure 2-6 Terminal Assignment of the RS-422 Connecting Cable for the 15-Pin Connector
Note Add a terminating resistor of approx. 330 (see Figure 2-6) to ensure problemfree data transfer. The maximum length of this type of cable at 19.200 bps is 1200 m.
2-18
Terminal Assignment of the RS-485 Connecting Cable for the 15-Pin Connector
Figure 2-7 shows the cable connections for RS-485 point-to-point communication between the ET 200S serial interface module and a communication partner with a 15-pin D connector. On the ET 200S side, the signal wires are connected to the correspondingly numbered terminals. Use a 15-pin subminiature D connector on the communication partner.
ET 200S SI
Communication partner with 15-pin connector 1 2 T(A) T(B) R(A) R(B) PE R(A) R(B) GND
Shield LIYCY 3 x 2 x 0.14 cable type. (Belden 8102 or equivalent) R(A)/R(B) twisted pair Housing shield
T(A) T(B)
2 9 Sender 4 11 Recipient 8
Sender 1 2 Recipient 8
Shield contact
Figure 2-7 Terminal Assignment of the RS-485 Connecting Cable for the 15-Pin Connector
Note Add a terminating resistor of approx. 330 (see Figure 2-6) to ensure problemfree data transfer. The maximum length of this type of cable at 19.200 bps is 1200 m.
2-19
2.4
RS-232C Interface
Definition
The RS-232C interface is a voltage interface used for serial data transmission in compliance with the RS-232C standard.
Features
The RS-232C interface has the following features:
Type: Front connector: RS-232C signals: Transmission speed: Cable length: Standards: Degree of protection:
Voltage interface 8-pin standard terminal connector of the ET 200S TXD, RXD, RTS, CTS, DTR, DSR, DCD, GND Maximum 19.2 kbps (3964(R) procedure) Maximum 19.2 kbps (ASCII driver) Maximum 15 m, LIYCY 7 x 0.14 DIN 66020, DIN 66259, EIA RS-232C, CCITT V.24/V.28 IP 20
RS-232C Signals
The table below describes the RS-232C signals.
Signal TXD RXD RTS CTS
Designation Transmitted Data Received Data Request To Send Clear To Send
Meaning Transmit data; transmit line is held in the idle state on logic 1. Receive data; receive line must be held on logic 1 by the communication partner. ON: ET 200S SI is clear to send. OFF: ET 200S SI is not sending. The communication partner can receive data from the ET 200S. The interface module is expecting this as a response to RTS (ON). ON: The ET 200S SI is energized and ready for operation. OFF: The ET 200S SI is deenergized and not ready for operation.
DTR
Data Terminal Ready
DSR
Data Set Ready
ON: The communication partner is energized and ready for operation. OFF: The communication partner is deenergized and not ready for operation.
DCD
Data Carrier Detect
Carrier signal when a modem is connected.

2-20
2.5
RS-422/485 Interface
Definition
The RS-422/485 interface is a differential voltage interface used for serial data transmission in compliance with the RS-422/485 standard.
Features
The RS-422/485 interface has the following features:
Type: Front connector: RS-422 signals: RS-485 signals: Transmission speed: Cable length: Standards: Degree of protection:
Differential voltage interface 8-pin standard terminal connector of the ET 200S TXD (A), RXD (A), TXD (B), RXD (B), GND R/T (A), R/T (B), GND Maximum 19.2 kbps (3964(R) procedure) Maximum 19.2 kbps (ASCII driver) Maximum 1200 m, LIYCY 7 x 0.14 EIA RS-422/485, CCITT V.11/V.27 IP 20
2-21
2.6
Basic Principles of Serial Data Transmission
Point-to-Point Connection
For the exchange of data between two or more communication partners, various networking possibilities are available. The simplest form of data interchange is via a point-to-point connection between two communication partners. In a point-to-point connection the serial interface module forms the interface between a programmable controller and a communication partner. Data is transmitted serially using the ET 200S serial interface module.
Serial Data Transmission

In serial transmission, the individual bits of each byte of information are transmitted one after the other in a fixed order. The ET 200S serial interface module handles data transmission with the communication partner independently by means of the serial interface. To do this, the module has two different drivers for bidirectional data transfer. ASCII driver 3964(R) procedure
Bidirectional Data Transfer - Modes

The ET 200S has two modes for bidirectional data transfer: Half-duplex operation (3964(R) procedure, ASCII driver) Data is exchanged between the communication partners but only in one direction at a time. In half-duplex operation, therefore, at any one time, data is being either sent or received. The exception to this may be individual control characters for data flow control (e.g. XON/XOFF), which can also be sent while data is being received or received while data is being sent. Full-duplex operation (ASCII driver) Data is exchanged between the communication partners in both directions at the same time. Full-duplex operation means that you can send and receive data at the same time. Each communication partner must be able to send and receive simultaneously. Table 2-8 lists the modes for data transfer for the interface types with ASCII drivers.
2-22
Table 2-8
Data Transfer Modes for the ET 200S Serial Interface Module Data Transfer RS-232C Yes Yes RS-422 Yes Yes RS-485 Yes Not possible
Half-duplex Full-duplex
Agreements
Agreements must be made reached between the two communication partners before serial data transmission can take place. These include: Transmission rate (baud rate) Character and acknowledgment delay times Parity Number of data bits Number of stop bits Number of setup and transmission attempts Sections 2.7 and 2.8 describe the role played by these agreements in the various transmission procedures, and how they are parameterized.
Character Frame
The data between the ET 200S serial interface module and a communication partner is transferred via the serial interface in a 10-bit or 11-bit character frame. Three data formats are available for each character frame. You can parameterize the required format in STEP 7.
2-23
10-Bit Character Frame

Figure 2-8 shows the three data formats of the10-bit character frame.
7 data bits: 1 start bit, 7 data bits, 2 stop bits Signal state 1 1 Signal state 0
1 start bit 2 stop bits 7 data bits
9 10
7 data bits: 1 start bit, 7 data bits, 1 parity bit, 1 stop bit Signal state 1 1 Signal state 0
1 parity bit 1 start bit 7 data bits 1 stop bit 1 stop bit Serial Interface Module ET 200S A5E00124881-01
9 10
8 data bits: 1 start bit, 8 data bits, 1 stop bit Signal state 1 1 Signal state 0
1 start bit 8 data bits
9 10
Figure 2-8 10-Bit Character Frame
2-24
11-Bit Character Frame

Figure 2-9 shows the three data formats of the11-bit character frame.
7 data bits: 1 start bit, 7 data bits, 1 parity bit, 2 stop bits Signal state 1 1 Signal state 0
1 start bit 1 parity bit 1 parity bit 7 data bits 2 stop bits 2 stop bits 1 stop bit
9 10 11
8 data bits: 1 start bit, 8 data bits, 1 parity bit, 1 stop bit Signal state 1 1 Signal state 0
9 10 11
8 data bits: 1 start bit, 8 data bits, 2 stop bits Signal state 1 1 Signal state 0
9 10 11
Figure 2-9 11-Bit Character Frame
2-25
Character Delay Time

Figure 2-10 shows the maximum time permitted between two characters received within a message frame. This is the character delay time.
Signal
nth character
(n + 1)th character Character delay time
1 Time t Figure 2-10 Character Delay Time
ISO 7-Layer Reference Model for Data Transmission

When data is transmitted, all communication partners involved must follow fixed rules for handling and implementing the data traffic. The ISO has defined a 7-layer model, which is recognized as the basis for a worldwide standardization of transmission protocols for computer-to-computer communication.
2-26
Protocol
When data is transmitted, all communication partners involved must follow fixed rules for handling and implementing the data traffic. Such rules are called protocols. A protocol defines the: Mode Half-duplex or full-duplex mode Initiative Which communication partners can initiate data transmission and under what conditions? Control characters Which control characters are to be used for data transmission? Character frame Which character frame is to be used for data transmission? Data backup The data backup procedure to be used Character delay time The time period within which an incoming character must be received Transmission speed Defined in bits per second (bps)
2-27
ISO 7-Layer Reference Model

The reference model defines the external behavior of the communication partners. Each protocol layer, except for the lowest one, is embedded in the next one down. The individual layers are as follows: 1. Physical layer Physical conditions for communication, such as the transmission medium and transmission rate 2. Data link layer Security procedure for the transmission Access modes 3. Network layer Network connections Addressing for communication between two partners 4. Transport layer Error-detection procedure Debugging Handshake 5. Session layer Setup and termination of data transmission Session 6. Presentation layer Conversion of the standard form of data representation of the communication system into a device-specific form (data interpretation rules) 7. Application layer Defining the communication task and the functions it requires
Processing the Protocols

The sending communication partner runs through the protocols from the highest layer (no. 7 - application layer) to the lowest (no. 1 - physical layer), while the receiving partner processes the protocols in the reverse order, i.e. starting with layer 1. Not all protocols have to take all 7 layers into account. If the sending and receiving partners both use the same protocol, layer 6 can be omitted.
2-28
Transmission Integrity
Transmission integrity plays an important role in the transmission of data and in selection of the transmission procedure. Generally speaking, the more layers of the reference model are applied, the greater the transmission integrity.
Supported Protocols
Figure 2-11 shows how the ASCII and 3964(R) protocols supported by the ET 200S serial interface module fit into the ISO reference model.
Layer 2
The data bytes are transmitted with 3964(R). Start and stop bits are added; in the event of an error the transmission may be repeated.
Layer 1
The physical transmission of the data bytes is defined.
Figure 2-11 How the Supported Protocols Fit into the ISO Reference Model
ASCII driver
Physical layer
3964(R)
Data link layer
2-29
Transmission Integrity with the ASCII Driver:

Follow the guidelines below to increase the data integrity when using the ASCII driver: Apart from the use of the parity bit (which can also be deselected, depending on the character frame setting), there are no further steps to ensure data integrity for data transfer with the ASCII driver. This means that data transmission by means of the ASCII driver is very efficient as far as the data throughput rate is concerned, but complete data integrity is not guaranteed. Using the parity bit ensures that the inversion of a bit in a character to be transmitted can be detected. If two or more bits of a character are inverted, this error can no longer be detected. To increase transmission integrity, a checksum and length specification for a message frame can be employed. These measures must be implemented by the user. A further increase in data integrity can be achieved by means of acknowledgment message frames in response to send or receive message frames. This is also the case with high-level protocols for data communication (see the ISO 7-layer reference model).
Transmission Integrity with 3964(R)

The 3964(R) procedure offers increased data integrity: The hamming distance in the case of 3964(R) is 3. The hamming distance is a measurement of the integrity of the data transmission. The 3964(R) procedure ensures high transmission integrity on the data line. This high integrity is achieved by means of a fixed message-frame setup and cleardown as well as the use of a block check character (BCC). Two different procedures for data transmission can be used, either with or without a block check character: Data transmission without a block check character: 3964 Data transmission with a block check character: 3964(R) In this manual, the designation 3964(R) is used when descriptions and notes refer to both data transmission procedures.
2-30
Performance Limits with 3964(R)

Further processing of the send/receive data by the PLC program in the communication partner is not guaranteed. You can only ensure this by using a programmable acknowledgment mechanism. The block check of the 3964R procedure (EXOR logic operation) cannot detect missing zeros (as whole characters) because a zero in the EXOR logic operation does not affect the result of the calculation. The loss of a whole character (this character must then be a zero) is very improbable, but can occur, for example, when the transmission conditions are very poor. You can protect a transmission against such errors by sending the length of the data message along with the data itself, and having the length checked at the other end.
2-31
2.7
Data Transmission With the 3964(R) Procedure

The 3964(R) procedure controls data transmission in the case of a point-to-point connection between the ET 200S module and a communication partner. In addition to the physical layer (layer 1), the 3964(R) procedure also incorporates the data link layer (layer 2).
Control Characters
During data transmission, the 3964(R) procedure adds control characters to the user data (data link layer). These control characters allow the communication partner to check whether the data has arrived complete and without errors. The 3964(R) procedure analyzes the following control characters: STX Start of Text; Start of the character string to be transmitted DLE Data Link Escape; Data transmission changeover ETX End of Text; End of the character string to be transmitted BCC NAK Block Check Character (only with 3964R); Negative Acknowledge;
Note If DLE is transmitted as an information string, it is sent twice so that it can be distinguished from the control character DLE during connection setup and cleardown on the send line (DLE duplication). The recipient then reverses the DLE duplication.
Priority
With the 3964(R) procedure, one communication partner must be assigned a higher priority and the other partner a lower priority. If both partners issue a send job at the same time, the partner with the lower priority defers its send job.
2-32
Block Checksum
In the case of the 3964R transmission protocol, data integrity is increased by the additional sending of a block check character (BCC) (see Figure 2-12).
Message frame STX Data DLE ETX BCC
02H 30H 31H 32H 10H 03H 20H 30 31 XOR 32 XOR 10 XOR 03 XOR BCC Figure 2-12 Block Checksum = = = = = = = = = 0011 0011 0000 0011 0011 0001 0010 0000 0010 2 0000 0001 0001 0010 0011 0000 0011 0011 0000 0
The block checksum is the even longitudinal parity (EXOR logic operation of all data bytes) of a sent or received block. It starts with the first user data byte (first byte of the message frame) after connection setup, and ends after DLE ETX at connection cleardown.
Note If DLE duplication occurs, the DLE character is accounted for twice in the BCC calculation.
2-33
Sending Data with 3964(R)

Figure 2-13 shows the transmission sequence when data is sent with the 3964(R) procedure.
ET 200S SI
Communication partner
Start ID (02H) Pos. acknowledgement (10H) 1st data byte 2nd data byte
STX DLE 1st byte 2nd byte
Connection setup
S S
S S
User data
nth data byte End code (10H) End code (03H) 3964(R) only Pos. acknowledgement (10H)
nth byte DLE ETX BCC DLE
Connection cleardown
Figure 2-13 Data Traffic when Sending with the 3964(R) Procedure
Establishing a Send Connection

To establish the connection, the 3964(R) procedure sends the control character STX. If the communication partner responds with the DLE character before the acknowledgment delay time (ADT) expires, the procedure switches to send mode. If the communication partner answers with NAK or with any other control character (except for DLE), or the acknowledgment delay time expires without a response, the procedure repeats the connection setup. After the parameterized number of unsuccessful setup attempts, the procedure aborts the connection setup and sends the NAK character to the communication partner. The system program reports the error to the P_SEND function block (STATUS output parameter).
Send Data
If a connection is successfully established, the user data contained in the output buffer of the ET 200S is sent to the communication partner with the selected transmission parameters. The partner monitors the intervals between incoming characters. The interval between two characters must not exceed the character delay time.
2-34
Releasing a Send Connection

If the communication partner sends the NAK control character during an active transmission, the procedure aborts its transmission of the block and tries again as described above. If a different character is sent, the procedure first waits for the character delay time to expire and then sends the NAK character to change the mode of the communication partner to idle. Then the procedure starts to send the data again with the connection setup STX. Once the contents of the buffer have been sent, the procedure adds the characters DLE, ETX, and in the case of 3964(R) only the block checksum BCC as the end code, and waits for an acknowledgment character. If the communication partner sends the DLE character within the acknowledgment delay time, the data block has been received without errors. If the communication partner responds with NAK, any other character (except DLE) or a damaged character, or if the acknowledgment delay time expires without a response, the procedure starts to send the data again with the connection setup STX. After the defined number of attempts to send the data block, the procedure stops trying and sends an NAK to the communication partner. The system program reports the error to the P_SEND function block (STATUS output parameter).
Receiving Data with 3964(R)

Figure 2-14 shows the transmission sequence when data is received with the 3964(R) procedure.
Connection setup STX DLE 1st byte 2nd byte
ET 200S SI
Start ID (02H) Pos. acknowledgement (10H) 1st data byte 2nd data byte
User data
S S
S S
nth data byte End code (10H) End code (03H) 3964R only Pos. acknowledgement (10H)
Figure 2-14 Data Traffic When Receiving with the 3964(R) Procedure
2-35
Establishing a Receive Connection

In idle mode, when there is no send job to be processed, the procedure waits for the communication partner to establish the connection. If the procedure receives any control character except for STX or NAK in idle mode, it waits for the character delay time to expire, then sends the character NAK.
Receiving Data
If the procedure receives the STX character and it has an empty receive buffer available, it responds with DLE. Incoming receive characters are now stored in the receive buffer. If two consecutive DLE characters are received, only one of these is stored in the receive buffer. After each receive character, the procedure waits out the character delay time for the next character. If this period expires before another character is received, an NAK is sent to the communication partner. The system program reports the error to the P_RCV function block (STATUS output parameter). If no empty receive buffer is available during a connection setup with STX, a wait time of 400 ms is started. If there is still no empty receive buffer after this time has elapsed, the system program reports the error (error message at the STATUS output of the FB). The procedure sends an NAK and returns to idle mode. Otherwise, the procedure sends a DLE and receives the data as described above.
2-36
Cleardown of a Connection for Receiving

If transmission errors occur during receiving (lost character, frame error, parity error, etc.), the procedure continues to receive until the connection is cleared down, then an NAK is sent to the communication partner. A repetition is then expected. If the block still cannot be received without error after the number of transmission attempts specified at parameter assignment, or if the communication partner does not start the repetition within a block wait time of 4 s, the procedure aborts the receive operation. The system program reports the error to the P_RCV function block (STATUS output parameter). If the 3964(R) proceduredetects the string DLE ETX, it stops receiving and sends DLE for a block received without error to the communication partner. If the block is damaged it sends an NAK. A repetition is then expected. If the 3964(R) procedure detects the string DLE ETX BCC, it terminates reception. It compares the received BCC with the internally calculated longitudinal parity. If the BCC is correct and no other receive errors have occurred, the 3964(R) procedure sends a DLE and returns to idle mode. If the BCC is errored or a different receive error occurs, an NAK is sent to the communication partner. A repetition is then expected. Note As soon as it is ready, the 3964(R) procedure sends a single NAK to the communication partner to set the latter to idle.
2-37
Handling Errored Data

Figure 2-15 shows how errored data is handled with the 3964(R) procedure.
Receiving data Start ID (02H) Pos. acknowledgement (10H) STX DLE
ET 200S SI
Connection setup
1st data byte
1st byte
S S S
S S S
nth data byte
nth byte
User data
End code (10H) End code (03H) 3964R only Pos. acknowledgement (15H)
DLE ETX BCC NAK T New setup attempt
Connection setup
Figure 2-15 Data Traffic When Errored Data Is Received
When DLE, ETX, and BCC are received, the ET 200S module compares the BCC of the communication partner with its own internally calculated value. If the BCC is correct and no other receive errors occur, the ET 200S modules responds with DLE. Otherwise, the module responds with NAK and waits for a new attempt for the block wait time (T) of 4 seconds. If, after the parameterized number of transmission attempts, the block cannot be received, or if no further attempt is made within the block wait time, the ET 200S aborts the receive operation.
2-38
Initialization Conflict
Figure 2-16 shows the transmission sequence during an initialization conflict.
ET 200S SI (Low priority)

Start code (02H) Start code (02H) Pos. acknowledgement (10H) 1st data byte 2nd data byte STX STX DLE 1st byte 2nd byte
Communication partner (higher priority)

Connection setup
S S
S S
User data
nth data byte End code (10H) End code (03H) 3964(R) only Pos. acknowledgement (10H) 2nd setup attempt
Start code (02H) Pos. acknowledgement (10H)
STX DLE
Connection setup
Figure 2-16 Data Traffic During an Initialization Conflict
If a device responds to the communication partners send request (character STX) within the acknowledgment delay time (ADT) by sending the character STX instead of the acknowledgment DLE or NAK, an initialization conflict occurs. Both devices want to execute a send job. The device with the lower priority withdraws its send job and responds with the character DLE. The device with the higher priority sends its data in the manner described above. Once the connection has been cleared down, the lower-priority device can execute its send job. To be able to resolve the initialization conflict, you must parameterize the communication partners with different priorities.
2-39
Procedure Error
The procedure detects both errors which are caused by the communication partner and errors caused by faults on the line. In both cases, the procedure makes repeated attempts to send/receive the data block correctly. If this is not possible within the maximum number of retries set (or if a new error status occurs), the procedure aborts send or receiving. It reports the error number of the first detected error and returns to idle mode. These error messages are displayed in the STATUS output of the FB. If the system program regularly reports an error number at the STATUS output of the FB for send and receive repetitions, this indicates that there are occasional problems affecting the data traffic. The large number of retries compensates for this, however. In this case you are advised to check the transmission line for possible sources of interference, because frequent repetitions reduce the user-data rate and integrity of the transmission. The disturbance could also be caused, however, by a malfunction on the part of the communication partner. When there is a break in the receive line, a BREAK status (BREAK indication by means of the diagnostic interrupt of the ET 200S module) is reported (see Section 2.13). No repeat is started. The BREAK status is automatically reset as soon as the connection is restored on the line. For every detected transmission error (lost character, frame or parity error), a standard number is reported, regardless of whether the error was detected during sending or receiving of a data block. The error is only reported, however, following unsuccessful repetitions.
2-40
2.8
Data Transmission with the ASCII Driver
Introduction
The ASCII driver controls data transmission by means of a point-to-point connection between the ET 200S SI module and a communication partner. This driver contains the physical layer (layer 1 of the ISO reference model.) The structure of the message frames is left open because the S7 user passes on the complete send message frame to the ET 200S SI module. For the receive direction, the end criterion of a message must be parameterized. The structure of the send message frames may differ from that of the receive message frames. The ASCII driver allows data of any structure (all printable ASCII characters as well as all other characters from 00 through FFH (in the case of character frames with 8 data bits) or from 00 through 7FH (in the case of character frames with 7 data bits)) to be sent and received.
Sending Data with the ASCII Driver

When you send data, you specify the number of user data bytes to be transferred in the LEN parameter when you call the P_SEND function block. The user data must contain any start and end characters required. When you work with the end criterion Expiration of character delay time when receiving data, the ASCII driver pauses between two message frames when sending. You can call the P_SEND FB at any time, but the ASCII driver does not begin its output until a period longer than the parameterized character delay time has elapsed since the last message frame was sent.
Note When XON/XOFF flow control is parameterized, the user data must not contain any of the parameterized XON or XOFF characters. The default settings are DC1 = 11H for XON and DC3 = 13H for XOFF.
2-41
Send Data
Figure 2-17 shows the sequence during the send operation.
Waiting for send job Request processed
Send request arrived
Sending user data
The amount of data to be sent is taken from the LEN parameter on the P_SEND FB.
Figure 2-17 Sequence of a Send Operation
Receiving Data with the ASCII Driver

For data transmission using the ASCII driver you can choose between three different end criteria. The end criterion defines when a complete message frame is received. The possible end criteria are as follows: Expiration of character delay time The message frame has neither a fixed length nor a defined end-of-text character; the end of the message is defined by a pause on the line (expiration of character delay time). Table 2-9 (Page 2-43) lists the minimum values of the individual transmission rates. On receipt of end-of-text character The end of the message frame is marked by one or two defined end-of-text characters. On receipt of fixed number of characters The length of the receive message frames is always identical.
2-42
Code Transparency
The code transparency of the procedure depends on the selection of the parameterized end criterion and the flow control: With one or two end-of-text characters Not code-transparent When the end criterion is the character delay time or a fixed message frame length Code-transparent Code-transparent operation is not possible when XON/XOFF flow control is used. Code-transparent means that any character combination can occur in the user data without the end criterion being detected.
Minimum Character Delay Time Based on the Transmission Rate

The minimum value for the character delay time depends on the transmission rate. Table 2-9 lists the minimum character delay time in ms for the different transmission rates.
Table 2-9 Minimum Character Delay Time Minimum Character Delay Time 4 ms 4 ms 9 ms 18 ms 34 ms 68 ms 134 ms 364 ms
Transmission Rate 19,200 9600 4800 2400 1200 600 300 110
2-43
End Criterion - Expiration of Character Delay Time

When data is received, the end of the message frame is detected when the character delay time expires. The receive data is accepted by the CPU using the P_RCV function block. In this case, the character delay time must be set such that it reliably expires between two consecutive message frames. However, it should be long enough so that the end of the message frame is not falsely identified whenever the communication partner takes a send pause within a message frame. Table 2-9 (Page 2-43) lists the minimum values of the different transmission rates. Figure 2-18 shows the receive sequence with the Expiration of character delay time end criterion.
End criterion for message frame identified, error entry follows
Wait for character
Message frame buffered
Character arrived
Character received with character delay time monitoring
Error when receiving (not a character delay time error)
Message frame complete (character delay time expired)
Wait for character delay time. Reject received characters
Enter message frame in receive buffer
Enter error in receive buffer
Figure 2-18 Sequence of Receive Operation with End Criterion Expiration of Character Delay Time
2-44
End Criterion - End-of-Text Character

When data is received, the end of the message frame is detected when the parameterized end-of-text character(s) arrive. The received data, including end-of-text characters, is accepted by the CPU by means of the P_RCV function block. If the character delay time expires during the receive operation, the receive operation is terminated. An error message is issued, and the message frame fragment is discarded. If you are working with end-of-text characters, transmission is not code-transparent, and you must make sure that the end code(s) are not included in the user data. Figure 2-19 shows the receive operation with the end-of-text character end criterion.
End criterion for message frame identified, error entry made
Wait for character
Character arrived
Receive character with end check and character delay time
Error receiving data Message frame complete Wait for valid end code Enter message frame in receive buffer Character delay time expired Enter error in receive buffer
Figure 2-19 Sequence of Receive Operation with End-of-Text Character End Criterion
2-45
End Criterion - Fixed Message Frame Length

When data is received, the end of the message frame is detected when the parameterized number of characters has been received. The received data is accepted by the CPU by means of the P_RCV function block. If the character delay time expires before the parameterized number of characters has been reached, the receive operation is terminated. An error message is issued, and the message frame fragment is discarded. Figure 2-20 illustrates the receive operation with the fixed message frame length end criterion.
End criterion for message frame identified, error entry made
Wait for character
Character arrived
Character received with length check and character delay time
Message frame complete
Error receiving data
Wait for parameterized number of characters
Enter message frame in receive buffer Character delay time expired Enter error in receive buffer
Figure 2-20 Sequence of Receive Operation with End Criterion Fixed Message Frame Length
2-46
Receive Buffer of the ET 200S Module

The receive buffer of the ET 200S interface module is 1024 bytes in size. At parameter assignment, you can specify whether the receive buffer should be deleted at startup and whether the overwriting of data in the receive buffer should be prevented. You can also enable or disable the backup function for received message frames. The receive buffer of the ET 200S SI serial interface module is a cyclic buffer: If several message frames are entered in the receive buffer of the ET 200S SI module, the following applies: The oldest message frame of the ET 200S SI module is transferred to the CPU. If you only ever want to send the most recent message frame to the CPU, you must disable dynamic message frames and deactivate overwrite protection.
Note If the constant reading out of the receive data in the user program is interrupted for a while, you may find that when the receive data is requested again, the CPU receives an old message frame from the ET 200S module first before it receives the most recent one. The old message frame is the one that was on its way between the ET 200S SI and CPU or that had already been received when transmission was interrupted.
You can find further information on receive buffers in Section 2.11.
2-47
RS-232C Auxiliary Signals

The ET 200S SI module supports the following RS-232 auxiliary signals: DCD DTR DSR RTS CTS (Input) Data carrier detect; (Output) Data terminal ready; ET 200S SI is ready for operation. (Input) Data set ready; Communication partner is ready for operation (Output) Request to send; ET 200S SI is clear to send. (Input) Clear to send; Communication partner can receive data from the ET 200S SI module (Response to RTS = ON of the ET 200S SI)
After the ET 200S modules has been powered up, the output signals are OFF (inactive). You can parameterized the way in which the DTR/DSR and RTS/CTS control signals are used with the parameterization interface or with functions (FCs) in the user program.
Operating RS-232C Auxiliary Signals

The RS 232C auxiliary signals can be operated as follows: Using parameterized automatic operation of all RS 232C auxiliary signals Using parameterized data flow control (RTS/CTS) Using the V24_STAT and V24_SET function blocks (FBs)
Note When automatic operation of the RS 232C auxiliary signals is parameterized, neither data flow control using RTS/CTS or control of RTS and DTR using the V24_SET FB is possible. When data flow control with RTS/CTS is parameterized, it is not possible to control RTS using the V24_SET FB. On the other hand, it is always possible to read all the RS 232C auxiliary signals using the V24_STAT FB.
The following sections explain the main principles of controlling and evaluating the RS-232C auxiliary signals.
2-48
Automatic Operation of the RS-232C Auxiliary Signals

Automatic operation of the RS-232C auxiliary signals in ET 200S SI module is implemented as follows: As soon as the ET 200S SI module has been put into a mode with automatic operation of RS-232C auxiliary signals (as a result of parameterization), it puts the RTS line to OFF and the DTR line to ON (ET 200S SI is ready for operation). Sending and receiving message frames is only possible once the DTR line is set to ON. As long as DTR is OFF, not data will be received by means of the RS-232C interface. A send job is interrupted with the corresponding error message. If a send job is queuing, RTS is set to ON and the parameterized data output waiting time is started. After the data output time has expired and when CTS = ON, the data is sent by means of the RS 232C interface. If during the send operation, CTS is not set to ON during the data output waiting time, or if CTS changes during the send operation to OFF, the send job is interrupted and a corresponding error message is generated. After the data has been sent, the RTS line is set to off after the parameterized RTS transfer time. The ET 200S SI module doesnt wait for CTS to change to OFF. Receiving data by means of the RS-232C interface is possible, as soon as the DSR line is set to ON. If it appears that the receive buffer of the ET 200S SI module might overrun, there is no response from the ET 200S SI module. When DSR = ON changes to OFF, an active send job as well as an operation to receive data with an error message is interrupted.
Note When automatic operation of the RS 232C auxiliary signals is parameterized, neither data flow control using RTS/CTS or control of RTS and DTR using the V24_SET FB is possible.
2-49
Timing Diagram
Figure 2-21 illustrates the timing of a send job.
RTS
ON OFF ON OFF 1 0 t Request to send: RTS = ON Partner: CTS = ON Data output waiting time expired: Send Data output waiting time Sending ended RTS transfer time expired Partner: CTS = OFF
CTS
TXD
RTS transfer time
Figure 2-21 Timing Diagram for the Automatic Operation of RS-232C Auxiliary Signals
2-50
Data Flow Control/Handshake Procedures

Handshaking controls the data flow between two communication partners. Handshaking ensures that data is not lost in transmissions between devices that work at different speeds. The two following procedures can be defined: Software handshaking (e.g. XON/XOFF) Hardware handshake (e.g. RTS/CTS) Data flow control of the ET 200S SI module is implemented in the following way: As soon as the ET 200S SI module is switched by parameterization to a mode with flow control, it sends the XON character or sets the RTS line to ON. When the parameterized number of message frames is reached, or alternatively 50 characters before the receive buffer overflows (size of the receive buffer: 1024 bytes), the ET 200S SI module send the XOFF character or sets the RTS line to OFF. If the communication partner continues to send data regardless of this, the receive buffer overflows and an error message is generated. The data received in the last message frame is discarded. As soon as a message frame is fetched by the S7 CPU and the receive buffer is ready to receive, the ET 200S SI sends the XON character or sets the RTS line to ON. If the ET 200S SI module receives the XOFF character or if the CTS control signal is set to OFF, the ET 200S SI module interrupts the send operation. If neither an XON character is received nor is CTS set to ON before a parameterized time has elapsed, the transmission is aborted and an appropriate error message (0708H) is generated on the STATUS output of the function block.
Reading/Controlling Using the V24_STAT and V24_SET FBs

Using the V24_STAT function block, the status of each RS-232C auxiliary signal can be determined. It is possible with the V24_SET function block to control the DTR and RTS output signals. In Section 2.10, you will find information on how to use function blocks as an interface between the CPU and the ET 200S SI module.
2-51
2.9
Configuring and Parameterizing the Serial Interface Module
Configuring the Serial Interface Module

If you communicate with the ET 200S SI interface module with an S7 master by means of a PROFIBUS network, you work in the hardware configuration in STEP 7 to set up the module in the PROFIBUS network and to set the communication parameters of the module. If you select the ET 200S SI module in the hardware catalog and insert it in the ET 200S basics in the configuration of the network, the order number of the module, the number of the slot as well as the addresses of inputs and outputs are automatically transferred to the configuration table. You can then call up the properties dialog box of the ET 200S SI module and set the type of communication and other parameters.
Assigning Parameters to the ASCII Driver

Table 2-10 lists the parameters that can be set for the ASCII driver of the serial interface module.
Table 2-10 Parameters for the ASCII Driver Description Value Range Default Value No
Parameters Diagnostic interrupt Interface type
Specify whether the module should gene- No rate a diagnostic interrupt if a serious error Yes occurs. Specify the electrical interface to be used (see Sections 2.4 and 2.5).
RS-232C RS-232C RS-422 (full-duplex) RS-485 (half-duplex) R(A) 5V / R(B) 0V R(A) 0V / R(B) 5V R(A) 5V / R(B) 0V
Half duplex and full duplex Receive line initial state Data flow control (with preset parameters; change defaults in the user program)
Specify the initial state of the receive line in RS-422 and RS-485 modes. Not in RS-232C mode. You can send and receive data with data flow control. Data transmission is synchronized using data flow control, if one communication partner works faster than the other. Select the type of data flow control and set the corresponding parameters (see Section 2.8). Note: Data flow control with the RS 485 interface is not possible. Data flow control with RTS/CTS and automatic handling of the V24 signals is only possible with the RS-232C interface.
None XON/OFF RTS/CTS Automatic operation of the V.24 signals
None
2-52
Table 2-10
Parameters for the ASCII Driver, continued Description Value Range 110 300 600 1200 2400 4800 9600 19200 7 8 1 2 Default Value 9600
Parameters
Transmission rate Select the speed of data transmission in bits per second.
Data bits Stop bits
Select the number of bits to which a character is mapped. Select the number of stop bits appended during transmission to every character to be sent to indicate the end of the character. The sequence of the data bits can be extended by one character, so that the parity bit can be accepted. The additional value (0 or 1) puts the value of all the bits (data bits and parity bit) in a defined state. None: Data is sent without the parity bit. Odd: The parity bit is set so that the overall number of data bits (including the parity bit) is odd along with the signal state 1. Even: The parity bit is set so that the overall number of data bits (including the parity bit) is even along with the signal state 1. Any: The signal state of the parity bit is not relevant. Parity is not checked when data is received, but it is always set to 0 when data is sent.
8 1
Parity
None Odd Even Any
Even
2-53
Table 2-10
Parameters for the ASCII Driver, continued Description If data is transmitted with the ASCII driver, the end of the receive message frame can be recognized in three different ways. You can select one of the three transmission modes here and enter the specific parameters. Note: If the character delay time expires while data is being received, the receive operation is prematurely aborted in all three modes. The message frame is discarded except in Expiration of character delay time mode. Expiration of character delay time The end of the message frame is detected when the parameterized character delay time expires. On receipt of end-of-text character: The end of the message frame is detected when the defined end-of-text character(s) are received. On receipt of fixed number of characters The end of the message frame is detected by the parameterized message frame length. All the message frames that are to be received, have the same length. The maximum interval between two characters being received. 1 You can define a maximum of two end-oftext characters to receive data with endof-text characters. The selected end-oftext characters limit the length of the message frame. You can define a maximum of two end-oftext characters to receive data with endof-text characters. The selected end-oftext characters limit the length of the message frame. Second end code, if specified. Value Range Default Value
Parameters Indication of end of receive message frame
Expiration of charac- Expiration of chater delay time racter delay time On receipt of end-oftext character On receipt of fixed number of characters
Expiration of character delay time, ms End-of-text character 1 2
4 to 65535 ms
4 ms
With 7 data bits:3 1 to 7FH With 8 data bits:3 1 to FFH With 7 data bits:3 0 to 7FH With 8 data bits:3 0 to FFH
End-of-text character 2 2
Message frame length on receipt4
Specify the frame length if data with fixed 1 to 200 bytes number of characters is to be received. The frame length must correspond exactly to the number of data bytes to be received by the communication partner.
100
2-54
Table 2-10
Parameters for the ASCII Driver, continued Description Value Range Default Value Activated
Parameters Dynamic message frame
When receiving messages, you can speActivated cify whether only one message should be Disabled backed-up or whether the messages should be dynamically backed-up. Activating dynamic message frames will allow the module to back-up several messages of varying lengths. The buffer concerned is a cyclic buffer. If the buffer is full, the oldest message is overwritten unless the parameter for preventing the overwriting of the buffer is activated. In this case the most recent message is discarded. In both cases a diagnostic interrupt indicates that data has been lost. This parameter prevents back-up mesNo sage frames from being overwritten, if the Yes module receives a new message frame, but the contents of the receive buffer have not yet been deleted. This parameter prevents old message frames being deleted. Specify whether the receive buffer of the module should be automatically deleted when the CPU changes from STOP to RUN (CPU startup). In this way, you can make sure that the receive buffer of the module only receives message frames that were received after CPU startup. No Yes
Prevent overwriting of buffer
Yes
Delete SI receive buffer at startup
Yes
1 2 3 4
The shortest character delay time is based on the transmission rate. See Table 2-9 (Page 2-43). Can only be set if the end criterion is an end-of-text character. Depending on the parameterization of the character frame (7 or 8 data bits). Can only be set if the end criterion is a fixed message frame length.
Assigning Parameters for the Driver for the 3964(R) Protocol

Table 2-11 lists the parameters that can be set for the 3964(R) protocol of the serial interface module.
Table 2-11 Driver Parameters for the 3964(R) Protocol Description Value Range Default Value No
Parameters Diagnostic Interrupt Interface type Receive line initial state
Specify whether the module should gene- No rate a diagnostic interrupt if a serious error Yes occurs. Specify the electrical interface to be used (see Sections 2.4 and 2.5.) Specify the initial state of the receive line in RS-422 mode. Not in RS-232C mode. RS-232C RS-422 R(A) 5V / R(B) 0V R(A) 0V / R(B) 5V
RS-232C R(A) 5V / R(B) 0V
2-55
Table 2-11
Driver Parameters for the 3964(R) Protocol, continued Description Value Range Default Value Block check
Parameters Protocol mode
Specify whether the data should be sent No block check with a block character check (BCC) to inBlock check crease data integrity. The block check character is the even longitudinal parity (EXOR logic operation of all data bytes) of a sent or received block. If a communication partner detects a block check character when receiving the data, it compares the BCC with the internally calculated longitudinal parity. If the block check character is faulty, there is a wait of 4 seconds (block wait time), and data transmission is then repeated. If, after the parameterized number of transmission attempts, the data block cannot be received, or if no further attempt is made within the block wait time, the receive operation is aborted. 110 300 600 1200 2400 4800 9600 19200 7 8 1 2
Transmission rate Select the speed of data transmission in bits per second.
9600
Data bits Stop bits
Select the number of bits to which a character is mapped. Select the number of stop bits appended during transmission to every character to be sent to indicate the end of the character. A character can be added to the sequence of data bits so that the parity bit can be included. The additional value (0 or 1) puts the value of all the bits (data bits and parity bit) in a defined state. None: Data is sent without the parity bit. Odd: The parity bit is set so that the total number of data bits (including the parity bit) with the signal state 1 is odd. Even: The parity bit is set so that the total number of data bits (including the parity bit) along with the signal state 1 is even. Any: The signal state of the parity bit is not relevant. Parity is not checked when data is received, but it is always set to 0 when data is sent.
8 1
Parity
None Odd Even Any
Even
2-56
Table 2-11
Driver Parameters for the 3964(R) Protocol, continued Description The maximum interval between the receipt of two characters. Set the shortest character delay time for your application. Remember that the character delay time must have a certain minimum value, depending on the transmission rate. Value Range 20 to 655350 ms in 10 ms increments Default Value 220 ms
Parameters Character delay time (ms)
Acknowledgment delay time (ms)
Specify the maximum time that can expire 10 to 655350 ms in before an acknowledgment is received 10 ms increments from the communication partner when the connection is set up and cleared. Remember that the acknowledgment delay time must have a certain minimum value, depending on the transmission rate. Specify the number (n) of attempts made to set up a connection. (After n failed attempts, the function is aborted and the error is displayed in the STATUS output of the P_SEND function block.) Specify the number (n) of attempts made to transmit a message frame. (After n failed attempts at sending the message frame without errors, the function is aborted, and the error is displayed in the STATUS output of the P_SEND function block.) Possible reasons for abortion: Parity error BCC error, parity error Different parameter assignment of the communication partners (transmission rate, Parity, character frame, block check character, different protocols, for example) 1 to 255
2000 ms (550 ms without block check)
Setup attempts
Transmission attempts
1 to 255
Priority
If both partners issue a send job at the High same time, the partner with the lower prio- Low rity will defer its send job. You must assign one communication partner a higher priority and the other partner a lower priority in data transmission. Specify whether the receive buffer of the module should be automatically deleted when the CPU changes from STOP to RUN (CPU startup). In this way, you can make sure that the receive buffer of the module only receives message frames that were received after CPU startup. No Yes
Low
Delete SI receive buffer at startup
Yes
2-57
2.10
Communication Using Function Blocks
Overview
Communication between the CPU, ET 200S SI, and a communication partner takes place by means of the function blocks and the protocols of the ET 200S SI module. (You will find information on communicating with non-Siemens CPUs (non-S7) in Section 2.12.) The function blocks form the software interface between the CPU and the ET 200S SI serial interface module. They must be called cyclically from the user program.
Setting Up Communication with the CPU

Each time the CPU is started up, the ET 200S SI module is assigned the current parameters by the system service of the CPU. After the connection between the CPU and the ET 200S SI module has been set up, the ET 200S SI module must be initialized. Each function block has its own startup mechanism. Before jobs can be actively processed, the associated startup procedure must be completed. The ET 200S SI module can trigger a diagnostic interrupt in the CPU. The operating system provides the user with 2 bytes of interrupt information. The user must program the evaluation of interrupt information (OB82). It is not permissible to call the function blocks in the process or diagnostic interrupt program. In the function blocks the interrupts are not disabled. The protocol changeover occurs in the ET 200S SI module. Depending on the selected protocol (3964(R) procedure or ASCII driver), the interface of the ET 200S SI module is adjusted to the interface of the communication partner.
Function Blocks of the ET 200S SI Module

The S7-300 programmable logic controller provides you with a number of function blocks that initiate and control communication between the CPU and the ET 200S SI serial interface module in the user program. Table 2-12 lists the FBs used by the ET 200S SI module.
2-58
Table 2-12 FB FB2 FB3 FB4 FB5 FB6 FB7 FB8
Function Blocks of the ET 200S SI Module Meaning The P_RCV function block allows you to receive data from a communication partner and store it in a data block. The P_SEND function block allows you to send all or part of a data block to a communication partner.
Name P_RCV P_SEND
V24_STAT The V24_STAT function block allows you to read the signal states at the RS-232C interface of the ET 200S SI module. V24_SET F_XON F_RTS F_V24 The V24_SET function block allows you to set/reset the outputs of the RS-232C interface of the ET 200S SI module. The F_XON function block allows you to set additional parameters if the module was parameterized for XON/XOFF flow control. The F_RTS function block allows you to set additional parameters if the module was parameterized for the RTS/CTS flow control. The F_V24 function block allows you to set additional parameters if the module was parameterized for the automatic operation of V.24 signals.
FB3 P_SEND:
Sending Data to a Communication Partner
The P_SEND FB transmits a data block from a data block, specified by the DB_NO, DBB_NO, and LEN parameters, to the ET 200S SI module. The P_SEND FB is called cyclically and statically (without conditions) for data transmission or alternatively in a time-controlled program. The data transmission is initiated by a positive edge at the REQ input. A data transmission operation can run over several calls (program cycles), depending on the amount of data involved. The P_SEND FB can be called cyclically with the signal state 1 at the R parameter input. This terminates transmission to the ET 200S SI and resets the P_SEND FB to its initial state. Data that has already been received by the ET 200S SI is still sent to the communication partner. If the signal state 1 is at the R input statically, this means that sending is deactivated. The address of the ET 200S SI module to be addressed is specified in the LADDR parameter. The DONE output indicates that the job has been completed without errors. ERROR indicates whether an error has occurred. In the event of an error, the corresponding event number is displayed in STATUS (see Section 2.13). If no error has occurred, STATUS has the value 0. DONE and ERROR/STATUS are also output at RESET of the P_SEND FB (see Figure 2-22 on page 2-62). In the event of an error, the binary result BR is reset. If the block is terminated without errors, the binary result has the status 1.
2-59
Note The P_SEND function block does not have a parameter check. If there are invalid parameters, the CPU branches to STOP mode. Before an initiated job can be processed by the ET 200S SI module after the CPU has changed from STOP to RUN, the CPU startup mechanism of the ET 200S module for the P_PRINT FB must be completed (see Page 2-58). Any jobs initiated in the meantime do not get lost. It is transferred to the ET 200S SI module on completion of startup coordination.
FB3 Call
STL Representation CALL P_SEND, I_SEND REQ: = R: = LADDR: = DB_NO: DBB_NO: LEN: DONE: ERROR: STATUS: = = = = = = LAD Representation I_SEND P_SEND EN REQ R LADDR DB_NO DBB_NO LEN ENO DONE ERROR STATUS
Note The parameters EN and ENO are only present in the graphical representation (LAD or FBD). To process these parameters, the compiler uses the binary result BR. The binary result is set to signal state 1 if the block was terminated without errors. If there was an error, the BR is set to 0.
Assignment in the Data Area

The P_SEND FB works with an instance DB (I_SEND). The DB number is specified in the call. The data in the instance DB cannot be accessed.
Note Exception: In the event of an error, STATUS == W#16#1E0F, you can consult the SFCERR variable for more details of the error (see Section 2.13). This error variable can only be loaded via symbolic access to the instance DB.
2-60
Parameters of FB3 P_SEND

Table 2-13 lists the parameters of P_SEND (FB3).
Table 2-13 Name REQ R LADDR DB_NO DBB_NO LEN DONE1 ERROR1 STATUS1
1 The
FB3: Parameters of P_SEND Type INPUT INPUT INPUT INPUT INPUT INPUT OUTPUT OUTPUT OUTPUT Data Type BOOL BOOL INT INT INT INT BOOL BOOL WORD Description Initiates job at positive edge Aborts job Base address of the ET 200S SI module Data block number Data byte number Data length Job completed without errors Job completed with errors Error specification Current job is aborted. Sending is blocked. The base address is taken from STEP 7. Send DB no.: CPU-specific (zero is not permitted) 0 v DBB_NO v 8190 send data as of data word 1 v LEN v 200, specified in number of bytes STATUS parameter == 16#00 STATUS parameter contains error information If ERROR == 1, STATUS parameter contains error information Permitted Values, Comment
DONE parameter is available for one CPU cycle after a correct send job.
2-61
Time Sequence Chart for FB3 P_SEND

Figure 2-22 illustrates the behavior of the DONE and ERROR parameters depending on how the REQ and R inputs are wired.
REQ
DONE
ERROR Completion without errors Error Completion without errors Error Completion with errors 1st /n. part of SEND RESET transmitted RESET transmitted
Figure 2-22 Time Sequence Chart for FB3 P_SEND
Note The REQ input is edge-triggered. A positive edge at the REQ input is sufficient. It is not necessary for the RLO (result of logical operation) to be at 1 during the whole transmission.
2-62
SEND job not executed (sending deactivated)
Send job
FB2 P_RCV: Receiving Data from a Communication Partner

The P_RCV FB transmits data from the ET 200S SI module to an S7 data area, specified by the DB_NO and DBB_NO parameters. The P_RCV FB is called cyclically for data transmission or, alternatively, statically in a time-controlled program (without conditions). With the (static) signal state 1 at the EN_R parameter, the check as to whether data is to be read by the ET 200S SI module is enabled. An active transmission can be aborted with the signal state 0 at the EN_R parameter. The aborted receive job is terminated with an error message (STATUS output). Receiving is deactivated as long as the EN_R parameter has the signal state 0. A data transmission operation can run over several calls (program cycles), depending on the amount of data involved. If the function block detects the signal state 1 at the R parameter, the current send job is aborted and the P_RCV FB is set to the initial state. Receiving is deactivated as long as the R parameter has the signal state 1. When the signal state 0 returns, the aborted message frame is received again from the beginning. The address of the ET 200S SI module to be addressed is specified in the LADDR parameter. The NDR output indicates that the job has been completed without errors (all data read). ERROR indicates whether an error has occurred. In the event of an error, the corresponding error number is displayed in STATUS (see Section 2.13). If the receive buffer is more than two-thirds full, STATUS receives a warning after each P_RCV call if ERROR is not set. If there are no errors or warnings, STATUS has the value 0. NDR and ERROR/STATUS are also output when the P_RCV FB is reset (LEN parameter == 16#00) (see Figure 2-23 on page 2-66). In the event of an error, the binary result BR is reset. If the block is terminated without errors, the binary result has the status 1.
Note The P_RCV function block does not have a parameter check. If there are invalid parameters, the CPU switches to STOP mode. Before an initiated job can be received by the ET 200S SI module after the CPU has changed from STOP to RUN, the CPU startup mechanism of the ET 200S module for the P_RCV FB must be completed (see page 2-58).
2-63
FB 2 Call
STL Representation CALL P_RCV, I_RCV EN_R: = R: = LADDR: = DB_NO: DBB_NO: NDR: ERROR: LEN: STATUS: = = = = = = LAD Representation I_RCV P_RCV EN EN_R R LADDR DB_NO DBB_NO ENO NDR ERROR LEN STATUS

The P_RCV FB works with an instance DB (I_RCV). The DB number is specified in the call. The data in the instance DB cannot be accessed.
Note Exception: In the event of an error, STATUS == W#16#1E0D, you can consult the SFCERR variable for more details of the error (see Section 2.13). This error variable can only be loaded via symbolic access to the instance DB.
2-64
Parameters of FB2 P_RCV

Table 2-14 lists the parameters of P_RCV (FBs).
Table 2-14 Name EN_R R LADDR DB_NO DBB_NO NDR1 ERROR1 LEN1 STATUS1
1 The
FB2: Parameters of the P_RCV Type INPUT INPUT INPUT INPUT INPUT OUTPUT OUTPUT OUTPUT OUTPUT Data Type BOOL BOOL INT INT INT BOOL BOOL INT WORD Description Enables reading of data Aborts job Base address of the ET 200S SI module Data block number Data byte number Job completed without errors, data accepted Job completed with errors Length of message frame received Error specification Current job is aborted. Receiving is disabled. The base address is taken from STEP 7. Receive DB No.: CPU-specific, zero is not allowed 0 v DBB_NO v 8190 receive data as of data word STATUS parameter == 16#00 STATUS parameter contains error information 1 v LEN v 200, specified in number of bytes If ERROR == 1, STATUS parameter contains error information Permitted Values, Comment
DONE parameter is available for one CPU cycle after a correct receive job!
2-65
Time Sequence Chart for the P_RCV FB2

Figure 2-23 illustrates the behavior of the NDR, LEN, and ERROR parameters, depending on how the EN_R and R inputs are wired.
EN_R
NDR
ERROR
Completion without errors
RESET Completion without errors ERROR
LEN (length)
Completion with errors
Figure 2-23 Time Sequence Chart for FB2 P_RCV
Note The EN_R input must be set statically to 1. During the entire receive job, the EN_R parameter must be supplied with RLO 1 (result of logic operation).
2-66
Completion with errors
Receiving disabled
Enable receipt
No receipt
Receiving
Receiving
Functions for the Parameter Assignment of Options for Data Flow Control
If you use the ET 200S serial interface module with an S7 CPU and configure the module with the STEP 7 hardware configuration program, you can select a method for data flow control from the following options: None XON/XOFF RTS/CTS Automatic operation of the V.24 signals Additional parameters can be set for each of these options. These additional parameters have default values that are typical and appropriate for most applications. You can, however, change these parameters using the user program and the following function blocks.
FB6 F_XON:
Setting the Characters for XON/XOFF
The F_XON function block allows you to set additional parameters (see Table 2-15) if the module was parameterized for XON/XOFF flow control.
STL Representation CALL REQ: R: LADDR: F_XON, I_XON = = =
LAD Representation I_XON F_XON EN REQ R LADDR ENO DONE ERROR STATUS
XON: = XOFF: = WAIT_FOR_XON: = DONE: = ERROR: STATUS: = =
XON XOFF WAIT_FOR_XON

The P_XON FB works with an instance DB (I_XON). The DB number is specified in the call. The data in the instance DB cannot be accessed.
2-67
FB6 Parameters
Table 2-15 lists the parameters of FB6.
Table 2-15 Name REQ R LADDR XON XOFF WAIT_FOR _XON DONE1 ERROR1 STATUS1 FB6: Parameters of F_XON Type INPUT INPUT INPUT INPUT INPUT INPUT OUTPUT OUTPUT OUTPUT Data Type BOOL BOOL INT BYTE BYTE TIME BOOL BOOL WORD Description Initiates job at positive edge Aborts job Base address of the ET 200S SI module XON character XOFF character Waiting time for XON to XOFF Job completed without errors Job completed with errors Error specification Current job is aborted. Sending is blocked. The base address is taken from STEP 7. 0 to 7FH (7 data bits) 0 to FFH (8 data bits) 0 to 7FH (7 data bits) 0 to FFH (8 data bits) 20 ms to 10 min 55 s 350 ms STATUS parameter == 16#00; STATUS parameter contains error information If ERROR == 1, STATUS parameter contains error information 11 (DC1) 13 (DC3) 2s Permitted Values, Comment Default
1 The
DONE parameter is available for one CPU cycle after a correct job.
2-68
FB7 F_RTS:
Setting the Parameters for RTS/CTS
The F_RTS function block allows you to set additional parameters (see Table 2-16) if the module was parameterized for RTS/CTS flow control.
STL Representation CALL REQ: R: LADDR: F_RTS, I_RTS = = =
LAD Representation I_RTS F_RTS EN REQ R LADDR WAIT_FOR_CTS ENO DONE ERROR STATUS
WAIT_FOR_CTS: = DONE: = ERROR: = STATUS: =

The P_RTS FB works with an instance DB (I_RTS). The DB number is specified in the call. The data in the instance DB cannot be accessed.
2-69
FB7 Parameters
Table 2-16 Name REQ R LADDR WAIT_FOR _CTS DONE1 ERROR1 STATUS1 FB7: Parameters of F_RTS Type INPUT INPUT INPUT INPUT OUTPUT OUTPUT OUTPUT Data Type BOOL BOOL INT TIME BOOL BOOL WORD Description Initiates job at positive edge Aborts job Base address of the ET 200S SI module Waiting time for CTS = ON Job completed without errors Job completed with errors Error specification Current job is aborted. Sending is blocked. The base address is taken from STEP 7. 20 ms to 10 min 55 s 350 ms STATUS parameter == 16#00; STATUS parameter contains error information If ERROR == 1, STATUS parameter contains error information 2s Permitted Values, Comment Default
1 The
FB8 F_V24: Setting the Parameters for Automatic Operation of the RS-232C Auxiliary Signals
The F_V24 function block allows you to set additional parameters (see Table 18) if the module is parameterized for automatic operation of the RS-232C auxiliary signals.
STL Representation CALL REQ: R: LADDR: F_V24, I_V24 = = =
LAD Representation I_V24 F_V24 EN REQ R LADDR TIME_RTS_OFF DATA_WAIT_TIME ENO DONE ERROR STATUS
TIME_RTS_OFF: = DATA_WAIT_TIME: = DONE: = ERROR: = STATUS: =
2-70

The P_V24 FB works with an instance DB (I_V24). The DB number is specified in the call. The data in the instance DB cannot be accessed.
FB8 Parameters
Table 2-17 Name REQ R LADDR TIME_RTS _OFF FB8 Parameters of F_V24 Type INPUT INPUT INPUT INPUT Data Type BOOL BOOL INT TIME Description Initiates job at positive edge Aborts job Base address of the ET 200S SI module Time that has to elapse before RTS is deactivated Time that has to be waited until the partner sets CTS = ON after RTS has been set. Job completed without errors Job completed with errors Error specification Current job is aborted. Sending is blocked. The base address is taken from STEP 7. 0 ms to 10 min 55 s 350 ms 10 ms Permitted Values, Comment Default
DATA_ INPUT WAIT_TIME
TIME
0 ms to 10 min 55 s 350 ms
10 ms
DONE1 ERROR1 STATUS1
OUTPUT OUTPUT OUTPUT
BOOL BOOL WORD
STATUS parameter == 16#00; STATUS parameter contains error information If ERROR == 1, STATUS parameter contains error information
1 The
2-71
Reading and Controlling RS-232C Auxiliary Signals

To read and control RS-232C auxiliary signals, you can use the function block FB4 V24_STAT to check the interface states and FB V24_SET to set/reset the interface outputs.
FB4 V24_STAT: Checking the Interface State of the ET 200S SI Module

The V24_STAT FB reads the RS-232C auxiliary signals of the ET 200S SI module and makes them available to the user in the block parameters. The V24_STAT FB is called statically and cyclically (without conditions) for data transmission or alternatively in a time-controlled program. The RS-232C auxiliary signals are updated each time the function is called (cyclic polling). The address of the ET 200S SI module to be addressed is specified in the LADDR parameter.
FB4 Call
STL Representation CALL V24_STAT, I_STAT REQ: = R: = LADDR: = DONE: ERROR: STATUS: DTR_OUT: DSR_IN: RTS_OUT: CTS_IN: DCD_IN: = = = = = = = = LAD Representation I_STAT V24_STAT EN REQ R LADDR ENO DONE ERROR STATUS DTR_OUT DSR_IN RTS_OUT CTS_IN DCD_IN
2-72

The V24_STAT FB works with an instance DB (I_STAT). The DB number is specified in the call. The data in the instance DB cannot be accessed.
Note A minimum pulse duration is required to detect a change in signal. The relevant variables are the CPU cycle time, the update time to the ET 200S SI module, and the response time of the communication partner.
Parameters of FB4 V24_STAT

Table 2-18 lists the parameters of the V24_STAT function block (FB4).
Table 2-18 Name REQ R LADDR DONE1 ERROR1 STATUS1 FB4 Parameters of the V24_STAT Type INPUT INPUT INPUT OUTPUT OUTPUT OUTPUT Data Type BOOL BOOL INT BOOL BOOL WORD Description Initiates job at positive edge Aborts job Base address of the ET 200S SI module Indicates that the FB is finished Job completed with errors Error specification Current job is aborted. Sending is blocked. The base address is taken from STEP 7. (Output ET 200S SI) STATUS parameter contains error information If ERROR == 1, STATUS parameter contains error information (Output ET 200S SI) Permitted Values, Comment
DTR_OUT1
OUTPUT
BOOL
Data terminal ready, ET 200S SI is ready for operation. Data set ready, communication partner is ready for operation. Request to send, ET 200S SI is clear to send. Clear to send, communication partner can receive data from the ET 200S SI module (response to RTS = ON of the ET 200S SI) Data carrier detect
DSR_IN1
OUTPUT
BOOL
(Input ET 200S SI)
RTS_OUT1 CTS_IN1
OUTPUT OUTPUT
BOOL BOOL
(Output ET 200S SI) (Input ET 200S SI)
DCD_IN1
1 The
OUTPUT
BOOL
(Input ET 200S SI)
2-73
FB5 V24_SET: Setting/Resetting the Interface Outputs of the ET 200S SI Module

You can set and reset the interface outputs by means of the corresponding parameter inputs of the V24_SET FB. The V24_STAT function block is called statically (without conditions) in the cycle or alternatively in a time-controlled program. The address of the ET 200S SI module to be addressed is specified in the LADDR parameter.
STL Representation CALL REQ R LADDR: RTS: DTR: DONE: ERROR: STATUS: V24_SET, I_SET = = = = = = = =
LAD Representation I_SET V24_SET EN REQ R LADDR RTS DTR ENO DONE ERROR STATUS
Note The parameters EN and ENO are only present in the graphical representation (LAD or FBD). To process these parameters, the compiler uses the binary result BR. The binary result is set to the signal state 1 if the block was terminated without errors. If there was an error, the BR is set to 0.

The V24_SET FB works with an instance DB (I_SET). The DB number is specified in the call. The data in the instance DB cannot be accessed.
2-74
Parameters of FB5 V24_SET

Table 2-19 lists the parameters of the V24_SET FB (FB5).
Table 2-19 Name REQ R LADDR RTS DTR FB5: Parameters of V24_SET Type INPUT INPUT INPUT INPUT INPUT Data Type BOOL BOOL INT BOOL BOOL Description Initiates job at positive edge Aborts job Base address of the ET 200S SI module Request to send, ET 200S SI is clear to send. Data terminal ready, ET 200S SI is ready for operation. Indicates that the FB is finished Job completed with errors Error specification Current job is aborted. Sending is blocked. The base address is taken from STEP 7. (Control output ET 200S SI) (Control output ET 200S SI) Permitted Values, Comment

1 The
BOOL BOOL WORD
(Output ET 200S SI) STATUS parameter contains error information If ERROR == 1, STATUS parameter contains error information
2-75
2.11
Startup Features and Modes
Modes of the ET 200S SI Serial Interface Module

The ET 200S SI module has the following modes: STOP: When the ET 200S SI module is in STOP mode, no protocol driver is active, and all the send and receive jobs are negatively acknowledged by the CPU. The ET 200S SI module remains in STOP until the cause for the STOP has been eliminated (a wire break or invalid parameter, for example). Reparameterization: When you reparameterize the ET 200S SI module, the protocol driver is initialized. The SF LED is on during reparameterization. Sending and receiving are not possible, and send and receive frames stored in the ET 200S SI module are lost when the driver is restarted. Communication between the ET 200S SI module and the CPU is restarted (current message frames are aborted). Once reparameterization has been completed, the ET 200S SI module is in RUN mode and is ready to send and receive. RUN: The ET 200S SI module processes the send jobs of the CPU. The frames received from the communication partner are made available to be picked up by the CPU.
Startup Characteristics of the ET 200S SI Module

Startup consists of two phases: Initialization: As soon as there is voltage to the ET 200S SI module, the serial interface is initialized and waits for parameterization data from the CPU. Parameter Assignment At parameter assignment the ET 200S SI module receives the module parameters assigned to the current slot with STEP 7.
2-76
Behavior of the ET 200S SI Module During Mode Transitions of the CPU

After the ET 200S SI module has started up, all the data between the CPU and ET 200S SI is exchanged by means of the function blocks. CPU STOP: Communication via PROFIBUS is not possible in CPU STOP. Any active data transmission between the module and the CPU, including both send and receive jobs, is terminated and the connection is reestablished. With the ASCII driver and parameterization without flow control, data transfer at the RS-232C interface of the ET 200S SI module is continued. In other words, the current send job is completed. Receive message frames are received at the ASCII driver until the receive buffer is full. CPU startup: At startup the CPU transfers parameters to the ET 200S SI module. You can automatically delete the receive buffer of the ET 200 S SI at CPU startup by means of the appropriate parameter assignment. CPU RUN: When the CPU is in RUN mode, there are no restrictions on sending and receiving. In the first FB cycles following the CPU restart, the ET 200S SI module and the corresponding FBs are synchronized. Only then will a new P_SEND or P_RCV FB be executed.
Points to Note When Sending Message Frames

Message frames can only be sent in CPU RUN mode. If the CPU goes into STOP mode during data transmission from the CPU to the module, the P_SEND FB reports the error (05) 02H after the restart. To stop this happening, the user program can call the P_SEND FB with the RESET input from the startup OB. Note The ET 200S SI module only sends data to the communication partner once it has received all the data from the CPU.
2-77
Points to Note When Receiving Message Frames

You can specify whether or not the module receive buffer is to be deleted at startup with STEP 7. If you specify that it should be, the receive buffer of the ET 200S SI module is automatically deleted when the CPU changes from STOP to RUN mode. If you specify that it should not, the number of message frames you specify will be stored in the receive buffer of the ET 200S SI module. If the CPU goes into STOP mode during data transmission from the CPU to the ET 200S SI module, the FB reports the error (05) 02H after the restart. To stop this happening, the user program can call the P_SEND FB with the RESET input from the startup OB. If you specify that the ET 200S SI receive buffer is not to be deleted at startup, the message frame is transferred again from the module to the CPU.
2-78
2.12
Reference Data for Masters Other than S7-PROFIBUS
Data Transfer Between the DP Master and the ET 200S SI Module

The ET 200S SI module is configured for data transmission of 4 or 8 bytes, input or output, with consistency over the whole length. The ET 200S SI module uses the 4- or 8-byte input/output memory for data transmission to and from the CPU via PROFIBUS-DP transmission media. The CPU can write data to the inputs and outputs at any time in the following way and also read data from the inputs and outputs: The CPU transmits a job to the ET 200S SI module in the first byte of the output memory of the module. The ET 200S SI module accepts the job by transferring the job code to the input memory. The CPU exchanges data with segments of 3 or 7 bytes (as many segments as are required, depending on the I/O size) until all the job data is transferred. The first byte of the segment is a coordination byte that synchronizes the transfer of each segment between the CPU and the ET 200S SI module (see Figure 2-24). The remaining bytes of the I/O memory contain the job data.
The CPU transfers data to the ET 200S SI module in the following way: Byte 0 1 2 S S S S N Contents Coordination byte Data byte 0 Data byte 1 S S S S Data byte n
The ET 200S SI module transfers data to the CPU in the following way: Byte 0 1 2 S S S S N Contents Coordination byte Data byte 0 Data byte 1 S S S S Data byte
n = 3 or 7, depending on the module variant selected in the configuration
Figure 2-24 Data Transfer Between the CPU and the ET200S SI Module
2-79
Description of the Coordination Byte

Table 2-20 describes the contents of the coordination byte (byte 0), which synchronizes data transmission between the CPU and the ET 200S SI serial interface module.
Table 2-20 Contents of Coordination Byte 0 for Data Transmission Description Bit 7 Res. 6 5 Job code 4 3 Error 2 1 0 Execution number
Byte Segment Output byte written by the CPU Bit 7 Job code Execution number
Reserved Set by the CPU to initiate a job Send job: Incremented by the CPU by 1 when the CPU sends another segment to the ET 200S SI module...or Receive job: Accepted each time by input byte 0 of the CPU when the CPU receives a new segment in the correct order from the interface module. Indicates the last valid execution number when the error bit is set. (The value goes from 1 to 7.)
Error
Set by the CPU to indicate that a segment was not received in the correct order. The execution number field indicates the last valid execution number. Bit 7 Res. 6 5 Job code 4 3 Error 2 1 0 Execution number
Job byte written by the ET 200S SI module Bit 7 Job code Execution number
Reserved Accepted by the ET 200S SI module to acknowledge that the job has been accepted. Send job: Accepted each time by output byte 0 of the module when the module receives a new segment in the correct order from the CPU. Indicates the last valid execution number when the error bit is set. Receive job: Incremented by the module by 1, when the module sends another segment to the CPU. (The value goes from 1 to 7.)
Error
Set by the module to indicate that a segment was not received in the correct order. The execution number field indicates the last valid execution number.
2-80
Job Code Definitions

Table 2-21 lists the jobs in accordance with the allocation of bits 4 to 6 in coordination byte 0.
Table 2-21 Bits 6 5 4 000 001 010 011 100 101 110 111 Job Codes Hex. Value 0H 1H 2H 3H 4H 5H 6H 7H Idle state Send Receive Read V.24 signal state Write V.24 signals Transfer parameters: With this job you can set additional parameters that are not specified in the DDB file. Reserved Job end acknowledgment Definition
Rules for Writing Job Codes

The following rules apply to the writing of job codes in the coordination byte when the CPU and the ET 200S SI module can synchronize data transfer: Before the user program of the CPU can write a job code to the output coordination byte, it must see an idle code from the input coordination byte of the ET 200S SI module. Before the user program of the CPU can then write the first segment to output byte 1..n, it must see the job acknowledgment code (that is, the accepted job code) in the input coordination byte of the module. If the user program sees job acknowledgment codes other than the one sent by the program, it cannot write to output byte 0..n until it has again seen an idle code from the input coordination byte of the ET 200S SI module. This situation can occur, for example, if two separate jobs are executed in the same cycle, both jobs see the idle code, and both write a different job code to the output byte. Because of the asynchronous cycle between the CPU cycle and the PROFIBUS-DP cycle, it is not certain that the job will reach the module first. Each job must therefore be able to wait for the end of the other job before it is executed itself.
Status Word Definitions

In the examples of data transmission shown on the following pages, the ET 200S SI module uses bytes 1 and 2 for the status report in some of the responses to the CPU. Table 2-28 (starts on page 2-93) lists the status words and definitions.
2-81
Order of the Bytes in the Word

In the case of all 16-bit words (status and length, for example), the byte with the highest value is sent first in data transmission between the CPU and the ET 200S SI module.
Example of Data Being Sent from the CPU to the Module

Table 2-22 shows the example of a CPU sending a message with the first 22 characters of the alphabet. The I/O memory has 8 bytes. The DP cycle is approximately the same as the CPU cycle so that there is a latency time of one cycle when the module responds with the execution number.
Table 2-22 CPU Cycle 1st Example of Sending CPU Writes to ET 200S SI User program sees the following idle code of the module: CPU Reads ET 200S SI
Byte
0 00H
3 xxH
4 xxH
5 xxH Irrelevant
6 xxH
7 xxH
nnnnH Status
Job ackn.
CPU writes send job: Byte 0 1 2 10H Job 2nd xxH xxH
3 xxH
4 xxH
5 xxH
6 xxH
7 xxH
Irrelevant
User program is still reading the idle code of the module:
00H Job ackn.
nnnnH Status
xxH
xxH
xxH Irrelevant
xxH
xxH
CPU repeats send job: 10H Job 3rd xxH xxH xxH xxH xxH xxH xxH
Irrelevant
User program reads the following response of the module:
10H Job ackn.
nnnnH Status
xxH
xxH
xxH Irrelevant
xxH
xxH
CPU sends 1st segment: 11H Job 0016H Send length a b c Data d e
2-82
Table 2-22 CPU Cycle 4th
Example of Sending, continued CPU Writes to ET 200S SI User program reads the following response of the 10H xxH module (send and execution numbers are still Job ackn. at 0, which indicates the latency time of the module response): CPU Reads ET 200S SI
xxH
xxH
xxH
xxH
xxH
xxH
Irrelevant
CPU sends 2nd segment since no error was indicated: 12H Job 5th User program reads the following response of the module: f g h i Data j k l
11H Job ackn.
xxH
xxH
xxH
xxH Irrelevant
xxH
xxH
xxH
CPU sends 3rd segment since no error was indicated and the execution is correct: 13H Job 6th User program reads the following response of the module: m n o p Data q r s
12H Job ackn.
xxH
xxH
xxH
xxH Irrelevant
xxH
xxH
xxH
CPU sends 4th segment since no error was indicated and the execution is correct: 14H Job 7th t u Data v xxH xxH xxH xxH
Irrelevant
13H Job ackn.
xxH
xxH
xxH
xxH Irrelevant
xxH
xxH
xxH
CPU waits at 4th segment for acknowledgement: 14H Job t u Data v xxH xxH xxH xxH
Irrelevant
2-83
Table 2-22 CPU Cycle 8th
Example of Sending, continued CPU Writes to ET 200S SI User program reads the following response of the module: CPU Reads ET 200S SI
14H Job ackn.
xxH
xxH
xxH
xxH Irrelevant
xxH
xxH
xxH
CPU sends nothing new (outputs remain the same) and waits for the last acknowledgment of the module; it is indicated that the message was sent to the communication partner.
14H Job nth
u Data
xxH
xxH
xxH
xxH
Irrelevant
Several CPU cycles later the user program sees the 74H following response of the module: Job ackn.
nnnnH Status
xxH
xxH
xxH Irrelevant
xxH
xxH
CPU writes the idle code to the job and terminates the job.
Example of Data Being Received from the Module to the CPU

Table 2-23 shows an example of how the CPU receives a message from the serial interface module. The I/O memory has 8 bytes. The DP cycle is shorter than the CPU cycle. This means there is not latency time in the module.
Table 2-23 CPU Cycle n Example of Receiving CPU Writes to ET 200S SI CPU Reads ET 200S SI
The user program reByte 0 1 2 3 4 5 6 7 ads the idle code of the 00H nnnnH xxH xxH xxH xxH xxH module in several cycles until the status Job ackn. Status Irrelevant indicates that a received message is 0000H = no received message available Status: 0001H = received message available available: 0B01H = receive buffer is more than two-thirds full. CPU writes receive job: Byte 0 1 2 20H Job xxH xxH 3 xxH 4 xxH 5 xxH 6 xxH 7 xxH
Irrelevant
2-84
Table 2-23 CPU Cycle
Example of Receiving, continued CPU Writes to ET 200S SI CPU Reads ET 200S SI
Next cy- User program reads the cle (n + 1) following response of the module (module acknowledges receipt, responds with the first 21H segment, and increments the execution Job ackn. number):
0006H Length
c Data
CPU writes job to acknowledge the 1st segment: 21H Job Next cy- User program reads the cle (n + 2) 2nd segment of the module: xxH xxH xxH xxH xxH xxH xxH
Irrelevant
22H
xxH
xxH
xxH
xxH
xxH
xxH
Job ackn. Data
Irrelevant
CPU writes job to acknowledge the 2nd segment: 22H Job xxH xxH xxH xxH xxH xxH xxH
Irrelevant
Next cy- Module returns to idle cle (n + 3) state after the first 00H nnnnH receive transaction is completed. Job ackn. StatusUS CPU terminates the job.
xxH
xxH
xxH Irrelevant
xxH
xxH
Example of Reading the V.24 Signal Status

Table 2-24 shows an example of how the CPU reads the status of the V.24 signals from the serial interface module. The I/O memory has 8 bytes.
2-85
Table 2-24 CPU cycle 1st
Example of Reading the V.24 Signal Status CPU writes to ET 200S SI User program reads the idle code of the module: CPU reads ET 200S SI
Byte
0 00H
3 xxH
4 xxH
5 xxH Irrelevant
6 xxH
7 xxH
nnnnH Status
Job ackn.
CPU writes the job to read the V.24 signal status: Byte 0 1 2 3 4 5 6 30H Job 2nd User program reads the following response of the module: xxH xxH xxH xxH xxH xxH
7 xxH
Irrelevant
31H Job ackn.

MSB 00
nnnnH Signals
xxH
xxH
xxH Irrelevant
xxH
xxH
LSB 0 0 0 DCD CTS RTS DSR DTR 7 6 5 4 3 2 1 0
CPU writes the acknowledgement and accepts the execution number. 31H Job 3rd xxH xxH xxH xxH xxH xxH xxH
Irrelevant
Module returns to idle state after the first 00H transaction is completed. Job ackn. CPU terminates the job.
nnnnH Status
xxH
xxH
xxH Irrelevant
xxH
xxH
Example of Writing V.24 Signals

Table 2-25 shows an example of how the CPU writes the V.24 signals in the serial interface module. The I/O memory has 8 bytes.
2-86
Example of Writing V.24 Signals CPU writes to ET 200S SI User program reads the idle code of the module: CPU reads ET 200S SI
Byte
0 00H
3 xxH
4 xxH
5 xxH Irrelevant
6 xxH
7 xxH
nnnnH Status
Job ackn.
CPU writes the job to write the V.24 signals: Byte 0 1 2 3 4 5 40H Job nnnnH
Signal states MSB 00
6 xxH
7 xxH
xxH
xxH
xxH Irrelevant
LSB 0 0 0 DCD CTS RTS DSR DTR 7 6 5 4 3 2 1 0
2nd
40H Job ackn.
nnnnH Status
xxH
xxH
xxH Irrelevant
xxH
xxH
CPU writes the idle state to the output byte: 00H Job 3rd xxH xxH xxH xxH xxH xxH xxH
Irrelevant
User program reads the following response of the module (module returns to 00H the idle state at the end of the operation). Job ackn.
nnnnH Status
xxH
xxH
xxH Irrelevant
xxH
xxH
CPU writes the idle code to the job and terminates the job.
Parameters for Data Flow Control

The job code for the transfer of parameters (1 0 1 in Table 2-21) with the ASCII driver allows you to set additional parameters. This depends on which type of data flow control is selected in the DDB file. The three types of data flow control are described in Table 2-26.
2-87
Table 2-26
Parameters for Data Flow Control Parameter Value Range for Data Flow Control with XON/XOFF
Byte 1 2 and 3 4 5 6 and 7
Description Parameter block number Length XON character XOFF character Waiting time for XON to XOFF 20H 0004H
Value Range
Default Value
0004H 11 (DC1) 13 (DC3) 200 (2000 ms)
0 to 127 (7 data bits) 0 to 255 (8 data bits) 0 to 127 (7 data bits) 0 to 255 (8 data bits) 20 to 655350 in 10 ms increments
Parameter Value Range for Data Flow Control with RTS/CTS Byte 1 2 and 3 4 and 5 Description Parameter block number Length Waiting time for CTS = ON 21H 0002H 20 to 655350 in 10 ms increments 0002H 200 (2000 ms) Value Range Default Value
Parameter Value Range for the Automatic Operation of RS-232C Auxiliary Signals Byte 1 2 and 3 4 and 5 6 and 7 Description Parameter block number Length Time for RTS = OFF after the transfer Waiting time for CTS = ON after RTS = ON 22H 0004H 0 to 655350 in 10 ms increments 0 to 655350 in 10 ms increments 0004H 1 (10 ms) 1 (10 ms) Value Range Default Value
Sample Sequence for XON/XOFF

Table 2-27 shows an example of how the CPU sets the XON/XOFF parameters. The I/O memory has 4 bytes.
2-88
Sample Sequence for XON/XOFF CPU writes to ET 200S SI User program sees the following idle code of the module: Byte 0 00H Job ackn. Byte 0 50H Job 1 xxH 2 xxH Irrelevant 3 xxH Job: Send parameter code (1 0 1 or 5H) plus execution number 0 50H Job ackn. CPU sends 1st segment because the job has been accepted. 51H Job 20H Data flow 0004H Send length Job: Continue the parameters and increment the execution number Data flow: code for data flow parameters 51H Job ackn. CPU sends 2nd segment since no error was indicated: 52H Job 0BH DC1 0DH DC3 00H Waiting time for XON to XOFF - msB xxH xxH Irrelevant xxH xxH xxH Irrelevant xxH CPU reads ET 200S SI 1 nnnnH Status 2 3 xxH Irrelevant
2nd
User program sees the following response of the module:
3rd
4th
52H Job ackn.
xxH
xxH Irrelevant
xxH
CPU sends 3rd segment since no error was indicated: 53H Job C8H Waiting time for XON to XOFF - LSB xxH xxH
Irrelevant
2-89
Table 2-27 CPU cycle 5th
Sample Sequence for XON/XOFF, continued CPU writes to ET 200S SI User program sees the following response of the module: CPU reads ET 200S SI
53H Job ackn.
xxH
xxH Irrelevant
xxH
CPU repeats 3rd segment and waits for job acknowledgment. 53H Job C8H Waiting time for XON to XOFF - LSB xxH xxH
Irrelevant
6th
73H Job ackn.
nnnnH Status
xxH Irrelevant
CPU writes the idle code to the job and terminates the job. 00H Job xxH xxH Irrelevant xxH
Error Conditions
The serial interface module issues an error in response to the following conditions: If the send job is longer than 200 bytes, the module responds with a job end acknowledgment, and the status word contains the error code. The CPU then writes an idle code to the job and terminates the job. If a receive job has been sent to the module, and the received message contains an error, the module accepts the receive job code with the execution number zero, and the status word contains the error code. The CPU then writes an idle code to the job and terminates the job. If a receive job has been sent to the module and no received message is available, the module accepts the receive job code with the execution number zero, and the status word contains the value 0101H. This isnt an error condition but it does prevent the module being disabled in receive job mode and waiting for a receive message, thus enabling send jobs to be executed. The CPU writes an idle code to the job and terminates the job.
2-90
Exceptions
As already mentioned, a particular operation (a send job, for example) cannot be initiated in the user program before the module is in the idle state. After a job has been sent, the operation must wait until the module has accepted the job code before the operation in question can be executed. In the case of operations with segmenting during execution, the following exceptions may occur:
Note In the following descriptions of a send or parameter assignment operation, the sender refers to the CPU and the recipient to the serial interface module. In the case of a receive operation, the sender refers to the serial interface module and the recipient to the CPU.
Error: The sender monitors the error bit of the recipient for a segmented operation. If the error bit is set, the sender sends the segments again, starting with the next segment after the number reported by the recipient. Execution number not in the correct order: If the recipient receives a segment during a segmented operation with an execution number that is not the previous execution number + 1, it must report an error and the last execution number received in the response. Modified job code: If the recipient receives a segment with a job code that differs from the code with which the segmented operation began, and if it is not 000 or 111, the recipient ignores the other code and discards the associated data. If the recipient receives a segment with the job code of the idle state during a segmented operation, the operation is aborted and the idle state is adopted without an error bit being set. If the recipient receives a segment with the job code of the job end acknowledgment during a segmented operation, the operation is aborted and the idle state is adopted without an error bit being set. If during a segmented operation the sender receives a response with another job code, the message must be aborted. The idle code is then set again, the module must go into the idle state, and the operation must be executed again.
2-91
2.13
Diagnostics
Overview
The diagnostic functions of the ET 200S SI module permit you to locate errors quickly even during operation. The following diagnostic options are available: Diagnosis via the status LEDs on the front panel of the ET 200S SI module Diagnosis via the STATUS output of the function blocks Diagnosis via PROFIBUS slave diagnosis
Diagnostic Information via Status LEDs

The following status LEDs are on the front panel of the ET 200S interface module: TX RX SF (green) (green) (red) Lights up when the module sends data via the interface Lights up when the module receives data via the interface Indicates one of the possible errors:
Hardware fault Firmware error Parameter assignment error Wire break or loose cable between the module and the communication partner Only detected in the case of RS-422 interface connections when the initial state of the receive line is R(A) 5V/R(B) 0V. Communication error (parity, frame error, buffer overflow)
2-92
Structure of the Diagnostic Messages of the Function Blocks

Every function block has a STATUS parameter for error diagnostics. Each STATUS message number always has the same meaning, irrespective of which function block is used. Figure 2-25 shows the structure of the STATUS parameter.
Bit no. 15 STATUS Reserve Event class Event number (Error number) 13 12 8 7 0
Figure 2-25 Structure of the STATUS Parameter
Example: Figure 2-26 shows the contents of the STATUS parameter in the event of a job being aborted for a cold restart, warm restart or rest (1EH event class, event number 0DH).
In the event of a job being aborted due to a cold restart, warm restart or reset 24 STATUS X X X 1 1 1 1 20 27 0 0 0 0 0 1 1 0 20 1
Reserve
Event class 1EH
Event number 0DH
Figure 2-26 Example: STATUS Parameter for Event Class 1EH, Event 0DH
Diagnostic Messages of the Function Blocks

Table 2-28 describes the event classes, the definitions of the event numbers, and the recommended remedy for each error condition.
Table 2-28 Diagnostic Messages in the STATUS Parameter
Event Class 5 (05H): Error while processing CPU job Event Number (05) 02H Event The job is not permitted in this mode of the ET 200S SI module (the device interface is not parameterized, for example). Invalid message frame length What to Do Evaluate the diagnostic interrupt, and eliminate the error accordingly. The message frame is longer than 200 bytes. The rest of the message frame (> 200 bytes) is still being received by the ET 200S SI module, and the first segment of the message frame is therefore discarded. Select a smaller message frame length. Either change the parameters of the function block (FB6 F_XON, FB7 F_RTS, FB8 F_V24) or change the data flow control of the ET 200S SI module in the hardware configuration so that they correspond.
(05) 0EH
(05) 50H
The request to update the parameters is invalid for the current data flow control of the ET 200S SI module.
2-93
Table 2-28 Event Number (05) 51H
Diagnostic Messages in the STATUS Parameter, continued Event Frame execution error in communication between the ET 200S SI module and the programmable logic controller. The error occurred when a received message frame of the ET 200S SI module was transferred to the programmable logic controller. With 3964(R) only: Error during connection setup: After STX was sent, NAK or any other code (except for DLE or STX) was received. With 3964(R) only: Acknowledgment delay time exceeded: After STX was sent, no response came from the partner within acknowledgment delay time. With 3964(R) only: Termination by partner: During the current send operation, one or more characters were received by the partner. What to Do The module and the programmable logic controller have aborted the transfer. Repeat the receive job; the ET 200S SI module sends the received message again.
Event Class 7 (07H): Send Error (07) 02H Check for malfunctioning of the partner device, possibly using an interface test device (FOXPG) switched into the transmission line. The partner device is too slow or not ready to receive, or there is a break in the transmission line, for example. Check for malfunctioning of the partner device, possibly using an interface test device (FOXPG) switched into the transmission line. Check whether the partner is also indicating an error, possibly because not all the transmission data has arrived (e.g. due to a break in the send line) or due to serious faults or because the partner device has malfunctioned. Check for malfunctioning of the partner device, possibly using an interface test device (FOXPG) switched into the transmission line. Check whether the partner is also indicating an error, possibly because not all the transmission data has arrived (e.g. due to a break in the send line) or due to serious faults or because the partner device has malfunctioned. Check for malfunctioning of the partner device, possibly using an interface test device (FOXPG) switched into the transmission line. Check whether the partner is also indicating an error, possibly because not all the transmission data has arrived (e.g. due to a break in the send line) or due to serious faults or because the partner device has malfunctioned. Check for malfunctioning of the partner device, possibly using an interface test device (FOXPG) switched into the transmission line.
(07) 03H
(07) 04H
(07) 05H
With 3964(R) only: Negative acknowledgment during sending
(07) 06H
With 3964(R) only: Error at end of connection: Partner rejected message frame at end of connection with NAK or a random string (except for DLE), or Acknowledgment code (DLE) received too early.
2-94
Table 2-28
Diagnostic Messages in the STATUS Parameter, continued
Event Class 7 (07H): Send Error (07) 07H With 3964(R) only: Acknowledgment delay time exceeded at end of connection or response monitoring time exceeded after send message frame: After connection cleardown with DLE ETX, no response received from partner within acknowledgment delay time. With ASCII driver only: The waiting time for XON or CTS = ON has elapsed. With 3964(R) only: Initialization conflict cannot be solved because both partners have high priority. With 3964(R) only: Initialization conflict cannot be solved because both partners have low priority. With 3964(R) only: Error during connection setup: In idle mode, one or more random codes (other than NAK or STX) were received, or After an STX was received, the partner sent more codes without waiting for the response DLE. After power on of the partner: While the partner is being activated, the module receives an undefined code. With 3964(R) only: Logical error during receiving: After DLE was received, a further random code (other than DLE or ETX) was received.
Partner device faulty or too slow. If necessary, use an interface test device switched into the transmission line to check.
(07) 08H
The communication partner has a fault, is too slow or is switched offline. Check the communication partner or, if necessary, change the parameterization. Change the parameterization.
(07) 0BH
(07) 0CH
Change the parameterization.
Event Class 8 (08H): Receive Error (08) 02H Check for malfunctioning of the partner device, possibly using an interface test device (FOXPG) switched into the transmission line.
(08) 05H
Check whether the partner DLE in the message frame header and in the data string is always in duplicated or the connection is cleared down with DLE ETX. Check for malfunctioning of the partner device, possibly using an interface test device (FOXPG) switched into the transmission line. Partner device faulty or too slow. Check for malfunctioning of the partner device, possibly using an interface test device (FOXPG) switched into the transmission line.
(08) 06H
Character delay time exceeded: Two successive characters were not received within the character delay time, or With 3964(R) only: 1st character after sending of DLE during connection setup was not received within the character delay time. With 3964(R) only: Impermissible message frame length: A message frame of length 0 was received.
(08) 07H
Receipt of a message frame of length 0 is not an error. Check why the communication partner is sending frames without user data.
2-95
Table 2-28
Event Class 8 (08H): Receive Error (08) 08H With 3964(R) only: Error in block check character (BCC) Internally calculated value of BCC does not match BCC received by partner at end of connection. With 3964(R) only: The number of repeat attempts must be set immediately. Check whether the connection is subject to serious disturbances; in this case, you may also occasionally see error codes. Check for malfunctioning of the partner device, possibly using an interface test device (FOXPG) switched into the transmission line. Parameterize the same block wait time in the communication partner as in the module. Check for malfunctioning of the communication partner, possibly by using the interface test device switched into the transmission line. The P_RCV FB must be called more frequently.
(08) 09H
(08) 0AH
There is no free receive buffer available: No empty receive buffer was available to receive the data.
Event Class 8 (08H): Receive Error (08) 0CH Transmission error: Transmission error (parity error, stop bit error, overflow error) detected. With 3964(R) only: If this occurs during a send or receive operation, repetitions are initiated. If a faulty character is received in idle mode, the error is reported immediately so that disturbances on the transmission line can be detected early. If the SF LED (red) is on, there is an interruption on the connecting cable between the two communication partners. BREAK: The receive line to the partner is interrupted. With ASCII driver only: Parity error If the SF LED (red) is on, there is an interruption on the connecting cable between the two communication partners. With ASCII driver only: Character frame error If the SF LED (red) is on, there is an interruption on the connecting cable between the two communication partners. With ASCII driver only: More characters were received after the module had sent XOFF or set CTS to OFF Disturbances on the transmission line cause message frame repetitions, thus lowering user data throughput. Danger of an undetected error increases. Correct fault by changing system setup or line installation. Check the connecting cable of the communication partners, or check whether both devices have the same setting for the transmission rate, parity, and number of stop bits.
(08) 0DH (08) 10H
Reestablish the connection, or switch the partner on. Check the connecting cable of the communication partners, or check whether both devices have the same setting for the transmission rate, parity, and number of stop bits. Correct by changing system setup or line installation. Check the connecting cable of the communication partners, or check whether both devices have the same setting for the transmission rate, parity, and number of stop bits. Correct fault by changing system setup or line installation. Reparameterize the communication partner, or read the data of the module more quickly.
(08) 11H
(08) 12H
2-96
Table 2-28
Event Class 8 (08H): Receive Error (08) 18H With ASCII driver only: DSR = OFF or CTS = OFF The DSR or CTS signals are switched to OFF by the partner before or during a send operation. Check the control of the RS-232C auxiliary signals at the partner.
Event Class 30 (1EH): Errors in Communication Between the Module and the CPU (1E) 0DH (1E) 0EH Job aborted due to a cold restart, warm restart, or reset Static error during the call of the DP_RDDAT SFC. You can evaluate the return value (RET_VAL) of the SFC in the SFCERR variable in the instance DB. Static error during the call of the DP_WRDAT SFC. You can evaluate the return value (RET_VAL) of the SFC in the SFCERR variable in the instance DB. Load the SFCERR variable from the instance DB.
(1E) 0FH
Load the SFCERR variable from the instance DB.
(1E) 10H
Static error when the RD_LGADR SFC was Load the SFCERR variable from the instance called. The return value RET_VAL of the SFC DB. is available made for evaluation in the SFCERR variable in the instance DB. Parameter out of range. Change the input of the function block so that it is within the valid range.
(1E) 20H (1E) 41H
Impermissible number of bytes set in the LEN Keep to the value range of 1 to 200 bytes. parameter of the FBs.
Event Class 11 (0BH): Warning (0B) 01H Receive buffer is more than two-thirds full.
Calling the SFCERR Variable

You can obtain further information on errors 14 (1E 0EH) and 15 (1E 0FH) in event class 30 by means of the SFCERR variable. You can load the SFCERR variable from the instance DB belonging to the corresponding function block. The error messages entered in the SFCERR variable are described in the section on the system functionsDPRD_DAT and SFC15 DPWR_DAT in the System Software for S7 300/400, System and Standard Functions Reference Manual.
2-97
PROFIBUS Slave Diagnosis

The slave diagnosis complies with the EN 50170, Volume 2, PROFIBUS standard. Depending on the DP master, it can be read out with STEP 5 or STEP 7 for all DP slaves complying with the standard. The PROFIBUS slave diagnosis comprises the module diagnosis, the module status, and the channel-specific diagnosis. You can find detailed information on the DP slave diagnosis in the chapter entitled Commissioning and Diagnostics in the ET 200S Distributed I/O Device manual. Channel-specific diagnosis: The channel-specific diagnosis provides information on channel errors of modules and begins after the module status. Table 2-29 lists the types of channel-specific errors.
Table 2-29 Types of Channel Errors of the ET 200S Serial Interface Module Meaning Wire broken or disconnected. What to Do Check the wiring to the terminals. Check the cable to the partner.
Error Type 00110: Wire break 00111: Overflow 01000: Underflow
Buffer overflow; message length over- The P_RCV FB must be called more flow frequently. 3964(R) only: Message with a length of 0 sent. Internal module error occurred. Parameters have not been assigned to the module. Frame error, parity error Check why the communication partner is sending frames without user data. Replace the module. Correct the parameter assignment. Check the communication settings.
01001: Error 10000: Parameter assignment error 10110: Message error
2-98
2.14
Technical Specifications
Technical Specifications of the Protocols and Interface

Table 2-30 General Technical Specifications of the ET 200S Module General Technical Specifications Display elements LEDs: green, TX (send) green, RX (receive) red, SF (system error)
Protocol drivers supplied Transmission rates with 3964(R) protocol Transmission rates with ASCII drivers Character frame (10 bits or 11 bits)
3964(R) driver ASCII driver 110, 300, 600, 1200, 2400, 4800, 9600, 19,200 bits per second (half-duplex) 110, 300, 600, 1200, 2400, 4800, 9600, 19,200 bits per second (full-duplex) Number of bits per character: 7 or 8 Number of start/stop bits: 1 or 2 Parity: none, even, odd, any
Memory requirements of the standard blocks (FBs)
Sending and receiving: Approx. 4300 bytes
Technical Specifications of the RS-232C Interface Interface RS-232C signals RS-232C, 8 terminals TXD, RXD, RTS, CTS, DTR, DSR, DCD, PE All the above are electrically separated from the internal power supply of the ET 200S module. Maximum transmission distance 15 m
Technical Specifications of the RS-422/485 Interface Interface RS-422 signals RS-485 signals RS-422, 5 terminals RS-485, 3 terminals TXD (A), RXD (A), TXD (B), RXD (B), PE R/T (A), R/T (B), PE All the above are electrically separated from the internal power supply of the ET 200S module. Maximum transmission distance 1200 m
2-99
Dimensions and Weight Dimensions W H T (in mm) Weight 15 x 81 x 52 Approx. 50 g Data for Specific Modules RS-232C Status, Interrupts, Diagnostics Status display Diagnostic functions Green LED (TX) Green LED (RX)
Group error display Diagnostic information

can be displayed Outputs Output, RS-232C range
Red SF LED Possible
Number of inputs Number of outputs

RS-422
4 3 1 1 1 Max. 15 m Max. 1200 m IEC 801-5
Max. 10 V Max. 2500 pF Yes Approx. 60 mA Max. 25 V
Number of input pairs Number of output pairs

RS-485
Number of I/O pairs

Cable length
For capacitive load Short-circuit protection Short-circuit current Voltage on the outputs or inputs to PE (ground)
Shielded (RS-232C) Shielded (RS-422/485)

Degree of protection1
Output, RS-422/485 Load resistance Min. 50 k Yes Approx. 60 mA
Voltage, Currents, Potentials Rated supply voltage of the electronics (L+) 24 VDC Yes
Short-circuit protection Short-circuit current

1
Reverse polarity protection Isolation
External protection equipment is required in the input wiring of the user voltage: Lightning conductor, standard top-hat rail adapter Lightning conductor, protective module type KTAD-24V
Between channels and

backplane bus
Yes Yes
Between channels and

power supply of the electronics
Between the channels Between the channels

and PROFIBUS-DP Insulation tested with
No Yes
Channels against backplane bus and load voltage L+
500 VDC
Load voltage L+ against

backplane bus Current source
500 VAC
From the backplane bus From supply voltage L+

Power dissipation of the module
Maximum 10 mA Max. 120 mA, Typ. 50 mA Typically 1.2 W
2-100
Modbus/USS
3
Description Product Overview Terminal Assignment Diagrams Modbus Transmission Protocol Modbus Master Driver Modbus Slave Driver Diagnostics USSMaster Start-up Characteristics and Operating Modes of the ET 200S Serial Interface Modbus/USS Driver Technical Specifications Page 3-2 3-5 3-14 3-18 3-41 3-84 3-99 3-121 3-125
Chapter Overview
Section 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9
You will find detailed information on the hardware configuration, setup, wiring, commissioning, diagnostics, and the technical specifications of the ET 200S distributed I/O system in the Distributed I/O Device manual.
3-1
Modbus/USS
3.1
Product Overview
ET 200S Serial Interface Modbus/USS Module Order Number

6ES7 138-4DF10-0AB0
Description
The ET 200S Serial Interface Modbus/USS Module is a plug-in module in the ET 200S family and provides serial communication access using three hardware interfaces (RS-232C, RS-422, and RS-485) and two software protocols: Modbus USS Master The ET 200S Serial Interface Modbus/USS module allows you to exchange data between programmable controllers (PLCs) or computers by means of a point-to-point connection. All communications occur by way of serial asynchronous transfers. You select the communication mode when you assign the module parameters within the Hardware Configuration of STEP 7 or your non-S7 configuration application. The module appears in the hardware catalog in the following six versions: Modbus Master (8 Byte) Modbus Master (4 Byte) Modbus Slave (8 Byte) Modbus Slave (4 Byte) USS Master (8 Byte) USS Master (4 Byte) Eight-byte data transfers maximize throughput efficiency but take up more I/O space on the ET 200S rack. Four-byte data transfers take up less I/O space on the ET 200S rack but provide less throughput efficiency. The choice of module version depends upon your application requirements.
3-2
Modbus/USS
Figure 1-1 shows the ET 200S Serial Interface Modbus/USS module.
Serial Interface Modbus/USS
SF
RS232 MODE 1 TXD 2 RTS 3 DTR 4 DCD 5 RXD 6 CTS 7 DSR 8 PE RS422 MODE 1 TXD(B) 2 TXD(A) 5 RXD(B) 6 RXD(A) 8 PE RS485 MODE 1 T/RXD(A) 2 T/RXD(B) 8 PE
X2 3 4 TX RX
6ES7138-4DF10 -0AB0
Figure 3-1 ET 200S Serial Interface Modbus/USS Module
The ET 200S Serial Interface Modbus/USS Module provides the following functions: Integrated serial interface according to RS-232C, RS-422, or RS-485 Transmission rate up to 38.4 Kbaud, half-duplex Integration of the following transmission protocols in the module firmware: Modbus Master driver Modbus Slave driver USS Master driver
3-3
Modbus/USS
Module parameterization determines the functionality of the drivers. Table 3-1 lists the functions of each selected driver interface.
Table 3-1 Functions of the Modbus/USS Module Drivers Function Modbus drivers Automatic use of RS 232C signals USS Master driver RS-232C Yes Yes No RS-422 Yes No No RS-485 Yes No Yes
Table 1-2 provides a short description of the modules status LEDs.

Table 3-2 LEDs SF TX RX LEDs Description This LED (red) indicates a fault condition This LED (green) indicates that the interface is transmitting. This LED (green) indicates that the interface is receiving.
3-4
Modbus/USS
3.2
Terminal Assignment Diagrams
3.2.1
Terminal Assignment
Wiring Guidelines
The cables (terminals 1 through 8) must be shielded and the shield must be supported at both ends. Use the shield contact elements for this purpose. For information about these elements, refer to the ET 200S Accessories section in the ET 200S Distributed I/O Device Manual .
Terminal Assignment for RS-232C Communications

You can create a point-to-point connection with a slave system. Auxiliary channels of the RS-232C interface are not supported. Table 2-1 shows the terminal assignment of the ET 200S Serial Interface Modbus/USS Module when RS-232C communications protocol is selected.
Table 3-3 Terminal Assignment for RS-232C Communications View Terminal Assignment Terminals 1 5 2
TXD RTS DTR DCD
1 5
Remarks Mode: Full-duplex TXD RXD RTS CTS DTR DSR PE Transmitted data Received data Request to send Clear to send Data terminal ready Data set ready Ground
RXD CTS DSR PE
6 3 7 4 8
DCD Data carrier detect
3-5
Modbus/USS
Terminal Assignment for RS-422 Communications

You can create a point-to-point connection with a slave system. Table 2-2 shows the terminal assignment of the ET 200S Serial Interface Modbus/USS Module when RS-422 communications protocol is selected.
Table 3-4 Terminal Assignment for RS-422 Communications View Terminal Assignment Remarks Mode: Full-duplex Terminals
Note: In the case of cables longer than 50 m, attach a terminating resistor of approximately 330 as shown for trouble-free data traffic. RXD (B) TXD (B) TXD (A)
1 5
1 5 2 6 8
TXD (B) RXD (B) TXD (A) RXD (A) PE Ground
RXD (B) RXD (A) RXD (A)
PE
Terminal Assignment for RS-485 Communications

You can create a multi-point connection (network) connecting up to 32 slaves with one master system.The driver of the module switches the receive 2-wire line between send and receive. Table 2-3 shows the terminal assignment of the ET 200S Serial Interface Modbus/USS Module when RS-485 communications protocol is selected.
Table 3-5 Terminal Assignment for RS-485 Communications View Terminal Assignment Remarks Mode: Full-duplex Terminals
Note: In the case of cables longer than 50 m, attach a terminating resistor of approximately 330 as shown for trouble-free data traffic. R/T (A) R/T (A) R/T (B)
1 5
1 2 8
R/T (A) R/T (B) PE Ground
R/T (B)
PE
3-6
Modbus/USS
RS-232C to 9-Pin Connector Cable Pin-out

Figure 2-1 shows the line connections for RS-232C point-to-point communications between the module and a communication slave with a 9-pin D female connector. At the ET 200S side, the signal wires are connected to the correspondingly numbered terminals. At the communication slave, use a 9-pin sub D-shell female connector.
ET 200S Modbus/USS Master Module
Communication slave with 9-Pin Connector
RXD
TXD
TXD
RXD
2 6 7 3 4 8
8 7 4 6 1 5
Shield contact
Cable type LIYCY 7 x 0.14 (Belden 8104 or equivalent)
Casing shield
Figure 3-2
RS-232C Connecting Cable to 9-Pin Connector (1 master, 1 slave system)
3-7
Modbus/USS
RS-232C to 25-Pin Connector Cable Pin-out

Figure 2-2 shows the line connections for RS-232C point-to-point communications between the module and a communication slave with a 25-pin D male connector. At the ET 200S side, the signal wires are connected to the correspondingly numbered terminals. At the communication slave, use a 25-pin sub D-shell male connector.
ET 200S Modbus/USS Master Module
RXD
TXD
TXD
RXD
2 6 7 3 4 8
5 4 20 6 8 7
Shield contact
Cable type LIYCY 7 x 0.14 (Belden 8104 or equivalent)
Casing shield
Figure 3-3
RS-232C Connecting Cable to 25-Pin Connector (1 master, 1 slave system)
3-8
Modbus/USS
RS-422 to 15-Pin Connector Cable Pin-out

Figure 2-3 shows the line connections for RS-422 communications between the module and a communication slave with a 15-pin D male connector. At the ET 200S side, the signal wires are connected to the correspondingly numbered terminals. At the communication slave, use a 15-pin sub D-shell male connector.
ET 200S Serial Interface Modbus/USS Master Module
2 1 Sender 6 5 Receiver 8
TXD(A) TXD(B)
RXD(A) RXD(B)
4 11 Receiver 2 9 Sender 8
RXD(A) RXD(B)
TXD(A) TXD(B)
PE
GND
Shield Cable type LIYCY 3 x 2 x 0.14. (Belden 8103 or equivalent) T(A)/T(B) and R(A)/R(B) twisted-pair Casing shield
Shield contact
Figure 3-4
RS-422 Connecting Cable to 15-Pin Connector (1 master, 1 slave system)
Note For cables longer than 50m, attach a terminating resistor of approximately 330 , for trouble-free data traffic. See Figure 2-4. The maximum length of this cable type at 38400 baud is 1200m.
3-9
Modbus/USS
RS-485 to 15-Pin Connector Cable Pin-out

Figure 2-4 shows the line connections for RS-485 communications between the module and a communication slave with a 15-pin D male connector. At the ET 200S side, the signal wires are connected to the correspondingly numbered terminals. At the communication slave, use a 15-pin sub D-shell male connector.
ET 200S Serial Interface Modbus/USS Master Module
Communication slave with 15-Pin Connector 2 9 Sender 4 11 Receiver 8
1 2 Sender 1 2 Receiver 8
T(A) T(B) R(A) R(B) PE R(A) R(B) GND

Shield
T(A) T(B)
Shield contact
Cable type LIYCY 3 x 2 x 0.14. (Belden 8102 or equivalent) R(A)/R(B) twisted-pair
Casing shield
Figure 3-5
RS-485 Connecting Cable to 15-Pin Connector (1 master, 1 slave system)
Note For cables longer than 50m, attach a terminating resistor of approximately 330 , for trouble-free data traffic. See Figure 2-5. The maximum length of this cable type at 38400 baud is 1200m.
3.2.2
RS-232C Interface
The RS-232C interface is a voltage interface used for serial data transmission in compliance with the RS-232C standard. Table 2-4 shows the properties for RS-232C.
3-10
Modbus/USS
Table 3-6
Signals of the RS-232C Interface Description Voltage interface Standard ET 200S 8-position terminal connector TXD, RXD, RTS, CTS, DTR, DSR, DCD, GND Up to 38.4 Kbaud Up to 15m, cable type LIYCY 7 x 0.14 DIN 66020, DIN 66259, EIA RS-232C, CCITT V.24/V.28 IP 20
Property Type Front connector RS-232C signals Transmission Rate Cable Length Standards Protection
RS-232C Signals
The Modbus/USS module supports the RS-232C signals (see Table 2-5).
Table 3-7 Signal TXD RXD RTS CTS Signals of the RS-232C Interface Designation Transmitted Data Received Data Request To Send Clear To Send Meaning Transmission line is held on logic 1 in idle state. Receive line must be held on logic 1 by communications partner. On: Module is ready to send. Off: Module does not send. Communication partner can receive data from ET 200S. Serial Interface module expects the signal as a response to RTS On. On: Module is active and ready for operation. Off: Module is not active and not ready for operation. DSR Data Set Ready On: Comm partner is active and ready for operation. Off: Comm partner is not active and not ready for operation. DCD Data Carrier Detect Carrier signal when connecting a modem.
DTR
Data Terminal Ready
3-11
Modbus/USS
Automatic Use of the Secondary Signals The automatic use of the RS-232C secondary signals on the module is implemented as follows: As soon as the module is switched by means of parameterization to an operating mode with automatic use of the RS-232C secondary signals, it switches the RTS line to OFF and the DTR line to ON (module ready for use). Message frames cannot be sent and received until the DTR line is set to ON. As long as DTR remains set to OFF, no data is received via the RS-232C interface. If a send request is made, it is aborted with an error message. When a send request is made, RTS is set to ON and the parameterized data output waiting time starts. When the data output time elapses and CTS = ON, the data is sent via the RS-232C interface. If the CTS line is not set to ON within the data output time so that data can be sent, or if CTS changes to OFF during transmission, the send request is aborted and an error message generated. After the data is sent, the RTS line is set to OFF after the parameterized time to RTS OFF has elapsed. The ET 200S does not wait for CTS to change to OFF. Data can be received via the RS-232C interface as soon as the DSR line is set to ON. If the receive buffer of the module threatens to overflow, the module does not respond. A send request or data receipt is aborted with an error message if DSR changes from ON to OFF.
Note Automatic use of the RS-232C secondary signals is only possible in half-duplex mode.
Note The time to RTS OFF must be set in the parameterization interface so that the communication partner can receive the last characters of the message frame in their entirety before RTS, and thus the send request, is taken away. The data output waiting time must be set so that the communication partner can be ready to receive before the time elapses.
3-12
Modbus/USS
Time Diagram for Secondary Signals Figure 2-5 illustrates the chronological sequence of a send request:
RTS
ON OFF ON OFF 1 0 t Send request: RTS = ON Partner: CTS = ON Data output waiting time elapsed: Send Data output waiting time Transmission terminated Time to RTS OFF elapsed Partner: CTS = OFF Time to RTS OFF
CTS
TXD
Figure 3-6 Time Diagram for Automatic Use of the RS-232C Secondary Signals
3.2.3
RS-422/485 Interface
The RS-422/485 interface is a voltage-difference interface used for serial data transmission in compliance with the RS-422/485 standard. Table 2-6 shows the properties for the RS-422/485 interface.
Table 3-8 RS 422/485 Interface Properties Description Voltage-difference interface Standard ET 200S 8-position terminal connector TXD (A) , RXD (A) , TXD (B), RXD (B), GND R/T (A), R/T (B), GND Up to 38.4 Kbaud Up to 1200m, cable type LIYCY 7 x 0.14 EIA RS-422/485, CCITT V.11/V.27 IP 20
Property Type Front connector RS-422 signals RS-485 signals Transmission Rate Cable Length Standards Protection
3-13
Modbus/USS
3.3
Modbus Transmission Protocol
3.3.1
Message Structure
The data exchange Master-Slave and/or Slave-Master begins with the Slave Address and is followed by the Function Code. Then the data are transferred. The data exchange Master-Slave and/or Slave-Master has the following elements: SLAVE ADDRESS FUNCTION CODE DATA CRC CHECK Modbus Slave Address Modbus Function Code Message Data: Byte_Count, Coil_Number, Data Message Checksum
The structure of the data field depends on the function code used. The CRC check is transmitted at the end of the message. Table 3-1 shows the components of the message structure.
Table 3-9 Message Structure FUNCTION Byte DATA n Byte CRC CHECK 2 Byte
ADDRESS Byte
3.3.2
Slave Address
The slave address can be within the range 1 to 255. The address is used to address a defined slave on the bus.
Broadcast Message The master uses slave address zero to address all slaves on the bus.
Note Broadcast Messages are only permitted in conjunction with Function Codes 05, 06, 15, and 16.
A Broadcast Message is not followed by a reply message from the slave.
3-14
Modbus/USS
3.3.3
Master and Slave Function Codes

The function code defines the meaning as well as the structure of a message. Table 3-2 lists the Function Codes and their availability in both Master and Slave.
Table 3-10 Master and Slave Function Codes Function Code 01 02 03 04 05 06 07 08 11 12 15 16 Description Read Coil Status Read Input Status Read Holding Registers Read Input Registers Force Single Coil Preset Single Register Read Exception Status Loop Back Test Fetch Communications Event Counter Fetch Communications Event Log Force Multiple Coils Preset Multiple Registers Master n n n n n n n n n n n n n n n Slave n n n n n n
3.3.4
Data Field DATA

The data field DATA is used to transfer the following function code-specific data: Byte count Coil Start Address Register Start Address Number of Coils Number of Registers
3-15
Modbus/USS
3.3.5
Message End and CRC Check

Message end is identified by means of the CRC 16 checksum consisting of 2 bytes. It is calculated by the following polynominal: x16 + x15 + x2 + 1 The first byte to be transferred is the low byte and is followed by the high byte. When no transmission takes place during the time period required for the transmission of three and a half characters (3.5 times character delay time), the Modbus/USS module recognizes a message end. This message end time-out depends on the transmission rate. After completion of the message end time-out, the reply message received by the slave is evaluated, and its format is checked. See Table 3-3.
Table 3-11 Message End Transmission Rate 38400 bps 19200 bps 9600 bps 4800 bps 2400 bps 1200 bps 600 bps 300 bps Time-out 4 ms 4 ms 4 ms 8 ms 16 ms 32 ms 64 ms 128 ms
3.3.6
Exception Responses
On recognition of an error in the request message from the master (such as Register Address Illegal), the slave performs the following actions: The slave sets the highest value bit in the function code of the reply message. The slave transmits one byte of error code (Exception Code) to describe the reason for the error.
3-16
Modbus/USS
Exception Code Message

The error code reply message from the slave has, for example, the following structure: slave address 5, function code 5, exception code 2.
Reply Message from Slave EXCEPTION_CODE_xx 05H 85H 02H xxH xxH Slave Address Function Code Exception Code (1 to 7) CRC Check Code Low CRC Check Code High
Upon receipt of an error code reply message by the driver, the current job is completed with error. An error number corresponding to the received error code (Exception Code 1-7) is also entered in the SYSTAT area. No entry is made in a S_RCV destination data block. Table 3-4 lists the error codes that are sent by the module.
Table 3-12 Error Codes Exception Code 01 02 Description Illegal Function Illegal Data Address Possible Cause Illegal function code received Access to a SIMATIC area which is not enabled (see parameter assignment -areas, limitation) Length greater 2040 bits or 127 registers, data field not FF00 or 0000 for FC05, diagnostics subcode <> 0000 for FC08. Initialization by Modbus communications FB not yet carried out or FB reports error Error during data transfer module CPU (for example, DB does not exist, maximum transferable data length exceeded (block size CPU <->module)
03
Illegal Data Value
04
Failure in Associated Device
3-17
Modbus/USS
3.4
Modbus Master Driver
3.4.1
Usable Interfaces and Protocols

You can use either RS-232 or RS-422/485 (X27) interfaces for the module. With this driver, it is possible to use the RS-422/485 interface in both 2-wire operation and 4-wire operation. In 2-wire operation it is possible to connect as many as 32 slaves to one master in half-duplex operation. This creates a multi-point connection (network). In 4-wire operation (RS-422), you can have only 1 master and 1 slave in half-duplex operation.
3.4.2
Data Transfer for ET 200S Modbus Master

Data transfer between the module and the CPU is carried out by FBs S_SEND and S_RCV. FB S_SEND is activated by an edge at input REQ, when data output is required. FB S_RCV is made ready to receive by EN_R=1. A S_RCV is required for all reading function codes.
FB3 S_SEND: Sending Data to a Communication Partner

The execution of a Modbus Master request requires the activation of both FB S_SEND and S_RCV. FB S_SEND is activated by an edge at input REQ, when data output to the module is required. FB S_RCV is made ready to receive data from the module by EN_R=1. A S_RCV is required for all reading function codes. Figure 4.1 shows the overall behavior of the S_SEND and S_RCV parameters when a Modbus request is performed.
3-18
Modbus/USS
S_SEND REQ
S_SEND DONE
S_SEND ERROR Data to Slave
Data from Slave
S_RCV EN_R
S_RCV NDR
S_RCV ERROR Successful response from slave No response from slave
Figure 3-7 Time Sequence Chart for Modbus Request
The data transmission is initiated by a positive edge at the REQ input. A data transmission operation can run over several calls (program cycles), depending on the amount of data involved. The S_SEND FB can be called in the cycle with the signal state 1 at the parameter input R. This aborts the transmission to the module and sets the S_SEND FB back to its initial state. Data that has already been received by the module is still sent to the communication partner. If the R input is statically showing the signal state 1, this means that sending is deactivated. The LADDR parameter specifies the address of the ET 200S Serial Interface to be addressed. The DONE output shows request completed without errors. ERROR indicates whether an error has occurred. If there was an error, the corresponding event number is displayed in STATUS. If there were no errors, STATUS has the value 0. DONE and ERROR/STATUS are also output when the S_SEND FB is reset. In the event of an error, the binary result BR is reset. If the block is terminated without errors, the binary result has the status 1. Table 4-1 shows the STL and LAD representations of FB3 S_SEND.
3-19
Modbus/USS
Note The function block S_SEND does not have a parameter check. If there are invalid parameters, the CPU branches to the STOP mode. Before the module can process an activated request after the CPU has changed from STOP to RUN mode, the ET 200S-CPU start-up mechanism of the S_SEND FB must be completed. Any requests initiated in the meantime are not lost, but are transmitted once the start-up coordination with the module is finished.
Calling FB3
Table 3-13 STL and LAD representations of FB3 S_SEND
STL Representation CALL REQ: R: LADDR: DB_NO: DBB_NO: LEN: DONE: ERROR: STATUS: S_SEND, I_SEND = = = = = = = = =
LAD Representation I_SEND S_SEND EN REQ ENO DONE ERROR STATUS
R
LADDR DB_NO DBB_NO LEN
Assignment in the Data Area The S_SEND FB works with an instance DBI_SEND, whose number is specified in the call. The data in the instance DB cannot be accessed.
3-20
Modbus/USS
Note Exception: If the error STATUS==W#16#1E0F occurs, you can consult the SFCERR variable for more information on the error. This error variable can only be loaded via a symbolic access to the instance DB.
FB3 S_SEND Parameters Table 4-2 lists the parameters of S_SEND (FB3).
Table 3-14 FB3: S_SEND Parameters Name REQ R Type INPUT INPUT Data Type BOOL BOOL Description Initiates request with positive edge Aborts request Current request is aborted and sending is blocked. The basic address is taken from STEP 7. Send DB No.; CPU-specific, (zero is not allowed) 0 DBB_NO 8190 Transmitted data as of data word LEN INPUT INT Data length 1 LEN 200, specified in number of bytes STATUS parameter = = 16#00 STATUS parameter contains error details If ERROR = = 1, STATUS parameter contains error details Permitted Values, Comment
LADDR DB_NO
INPUT INPUT
INT INT
Basic address of ET 200S Serial Interface Data block number
DBB_NO
INPUT
INT
Data byte number
BOOL BOOL WORD
Request completed without errors Request completed with errors Error Specification
1 After
a correct send request, this parameter is available for one CPU cycle.
3-21
Modbus/USS
Time Sequence Chart for FB3 S_SEND Figure 4-2 illustrates the behavior of the parameters DONE and ERROR, depending on how the REQ and R inputs are wired.
REQ
DONE
ERROR Completion with error 1st/nth part of SEND RESET transmitted RESET transmitted Completion without error Completion without error
Sending request
Figure 3-8
Time Sequence Chart for FB3 P_SEND
Note The REQ input is edge-triggered. A positive edge at the REQ input is adequate. It is not required that the RLO (result of logical operation) is 1 during the whole transmission procedure.
3-22
SEND request not executed (sending deactivated)
Modbus/USS
FB2 S_RCV: Receiving Data from a Communication Partner The S_RCV FB transmits data from the module to an S7 data area specified by the parameters DB_NO and DBB_NO. The S_RCV FB is called statically (without conditions) for data transmission in the cycle or alternatively in a time-controlled program. With the (static) signal state 1 at parameter EN_R, the software checks whether data can be read by the ET 200S Serial Interface. An active transmission can be aborted with signal state 0 at the EN_R parameter. The aborted receive request is terminated with an error message (STATUS output). Receiving is deactivated as long as the EN_R parameter shows the signal state 0. A data transmission operation can run over several calls (program cycles), depending on the amount of data involved. If the function block recognizes signal state 1 at the R parameter, then the current transmission request is aborted and the S_RCV FB is set to the initial state. Receiving is deactivated as long as the R parameter shows the signal state 1. If signal state 0 returns, the aborted message frame is received again from the beginning. The LADDR parameter defines the ET 200S Serial Interface to be addressed. The NDR output shows request completed without errors/data accepted (all data read). ERROR indicates whether an error has occurred. If there was an error, the corresponding error number is displayed under STATUS when the receive buffer is more than 2/3 full. STATUS contains a warning after each S_RCV call when ERROR is not set. If there were no errors or warnings, STATUS has the value of 0. NDR and ERROR/STATUS are also output when the S_RCV FB is reset (parameter LEN = = 16#00). In the event of an error, the binary result BR is reset. If the block is terminated without errors, the binary result has the status 1. Table 4-3 shows the STL and LAD representations of FB2 S_RCV.
Note The function block S_RCV does not have a parameter check. If there are invalid parameters, the CPU can branch to STOP mode. Before the module can receive a request after the CPU has changed from STOP to RUN mode, the ET 200S-CPU start-up mechanism of the S_RCV FB must be completed.
3-23
Modbus/USS
Table 3-15 STL and LAD representations of FB2 S_RCV
STL Representation CALL S_RCV, I_RCV EN_R: R: LADDR: DB_NO: DBB_NO: NDR: ERROR: LEN: STATUS: = = = = = = = = =
LAD Representation I_RCV S_RCV EN EN_R R LADDR DB_NO DBB_NO ENO NDR ERROR LEN STATUS
Assignment in the Data Area The S_RCV FB works with an instance DBI_RCV, whose number is specified in the call. The data in the instance DB cannot be accessed. Table 4-4 shows the parameters for FB2 S_RCV.
Note Exception: If the error STATUS = = W#16#1E0D occurs, you can consult the SFCERR variable for more details of the error. This error variable can only be loaded via a symbolic access to the instance DB.
3-24
Modbus/USS
Table 3-16 FB2: S_RCV Parameters Name EN_R R LADDR DB_NO Type INPUT INPUT INPUT INPUT Data Type BOOL BOOL INT INT Description Enables data read Aborts request Basic address of ET 200S Serial Interface Data block number Active request is aborted and receiving is blocked. The basic address is taken from STEP 7. Receive DB No.; CPU-specific, (zero is not allowed) 0 DBB_NO 8190 Received data as of data word NDR1 OUTPUT BOOL Request completed without errors, data accepted Request completed with errors Length of message frame received Error Specification STATUS parameter = 16#00 STATUS parameter contains error details 1 LEN 200, specified in number of bytes If ERROR = = 1, STATUS parameter contains error details = Permitted Values, Comment
DBB_NO
INPUT
INT
Data byte number
ERROR1 LEN1
OUTPUT OUTPUT
BOOL INT
STATUS1
OUTPUT
WORD
1 After
a correct receive request, this parameter is available for one CPU cycle.
3-25
Modbus/USS
Time Sequence Chart for FB2 S_RCV Figure 4-3 illustrates the behavior of the parameters NDR, LEN and ERROR, depending on how the EN_R and R inputs are wired.
EN_R
NDR
ERROR
Completion without error
LEN (length)
Receiving deactivated
Completion with error
Figure 3-9
Time Sequence Chart for FB2 P_RCV
Note The EN_R must be set to statical 1. During the receive request, the EN_R parameter must be supplied with RLO 1 (result of logic operation).
3-26
Completion with error
RESET Completion without error
Enable receive
No receive
Receiving
Receiving
Modbus/USS
3.4.3
Configuring and Setting Parameters for the Modbus Master
Configuring the Modbus Module

If you are using an S7 master to communicate with the module over a PROFIBUS network, then you will use the hardware configuration application in STEP 7 to configure the module in the PROFIBUS network and to set the module communication parameters. When you select Modbus Master in the hardware catalog and insert the module into the ET 200S base on the network configuration, the module order number, slot number, and input/output addresses are automatically added to the configuration table. You can then access the properties dialog for the Modbus Master and select the communication mode and other parameters.
Setting Parameters for the Master Driver

Table 3-17 lists the parameters that can be selected for the Modbus Master driver mode of the module.
Table 3-17 Modbus Master Driver Parameters Parameter Diagnostic Alarm Description Specify if the module generates a diagnostic alarm if a serious error occurs. Specify the electrical interface to be used. No Yes RS-232C RS-422 (full-duplex) RS-485 (half-duplex) Half-Duplex Receive For RS-422 and RS-485 modes, Line Initial State specify the initial state of the receive line. Not used for RS-232C mode. Data Flow Control (with default parameters; change default values in user program) You can send and receive data with data flow control, which synchronizes data transmission when one communication partner works faster than the other. Select the type of data flow control and set the associated parameters. Note: Data flow control is not possible with the RS-485 interface. Data flow control with Automatic use of the V.24 Signals is only possible with the RS-232C interface. R(A) 5V / R(B) 0V R(A) 0V / R(B) 5V None Automatic use of the V.24 signals None R(A) 5V / R(B) 0V RS-232C Value Range Default Value No
Interface Type
3-27
Modbus/USS
Table 3-17 Modbus Master Driver Parameters, continued Parameter Transmission Rate Description Select the speed of data transmission in bits per second. Value Range 110 300 600 1200 2400 4800 9600 19200 38400 1 2 None Odd Even Even Default Value 9600
Stop Bits
Select the number of stop bits that are appended to each character to signal the end of a character transmission. The sequence of the data bits can be extended to include another bit, the parity bit. The addition of its value (0 or 1) brings the value of all the bits (data bits and parity bit) up to a defined status. None: Data is sent without a parity bit. Odd: The parity bit is set such that the total number of data bits (including the parity bit) with signal state 1 is odd. Even: The parity bit is set such that the total number of data bits (including the parity bit) with signal state 1 is even.
Parity
Response Time
The time allowed for the reply from the slave. Normal Operation Interference Suppression
50 ms to 655,000 ms Normal Interference Suppression 1 to 10 No Yes
2,000 ms
Operating Mode
Normal
Character Delay Multiple
Uses a character delay time multiple from 1-10.
1 Yes
Delete Serial Specify whether the receive buffer of Interface Receive the Serial Interface is to be deleted Buffer during Startup automatically when the CPU changes from STOP -> RUN mode (CPU start-up). You can thus ensure that in the Serial Interface receive buffer only message frames which were received after the CPU start-up can be fetched.
3-28
Modbus/USS
Half-Duplex (RS422) Four-Wire Operation In this operating mode, data are sent via the transmission line T(A),T(B) and received via the receiving line R(A),R(B). Error handling is carried out in accordance with the function set at the Driver Operating Mode parameter (Normal or Interference Suppression). Half-Duplex (RS485) Two-Wire Operation In this operating mode, the driver switches the 2-wire receiving line R(A),R(B) of the interface from send to receive operation. In this operating mode, all recognized transmission errors and/or BREAK before and after receive messages are ignored. BREAK level during message pauses is also ignored. The beginning of the receive message from the slave is recognized by means of the correctly-received slave address. The setting R(A) 0V, R(B) 5V (High) is recommended as the preset for the receiving line. Half-Duplex Receive Line Initial State This parameter specifies the initial state of the receive line for RS-422 and RS-485 modes. It is not used for RS-232C mode. Presetting of the Receiving Line: Presetting R(A) 5V, R(B) 0V (BREAK) The two-wire line R(A),R(B) is preset by the module as follows: R(A) --> +5V, R(B) --> 0V (VA - VB +0.3V).
This means that BREAK level occurs on the module in the event of a line break. Presetting R(A) 0V, R(B) 5V (High) The two-wire line R(A),R(B) is preset by the module as follows: R(A) --> 0V, R(B) --> +5V (VA - VB -0.3V).
This means that HIGH level occurs on the module in the event of a line break (and/or when it is idle, that is, when no slave is transmitting). The line status BREAK cannot be recognized. Transmission Rate The maximum transmission rate is the speed of data transmission in bits per second (bps). The maximum transmission rate of the module is 38400 bps in half-duplex operation. Data Bits The amount of data bits describes how many bits represent a character to be transmitted. The setting must always be 8 data bits. An 11-bit character frame must always be used; if you select none parity, then you must select 2 stop bits. Stop Bits The amount of stop bits defines the smallest possible time interval between two characters to be transmitted. An 11-bit character frame must always be used; if you select none parity, then you must select 2 stop bits. Parity The parity bit is for data safety. Depending on parameter assignment, it completes the amount of transmitted data bits to either an even or an odd number. If none parity is selected, then no parity bit is transmitted. This reduces the safety of data transmission. An 11-bit character frame must always be used. If you select none parity, then you must select 2 stop bits.
3-29
Modbus/USS
Response Time The reply monitoring time is the time the master spends waiting for a reply message from the slave after output of a request message. Normal Operation In this operating mode, all recognized transmission errors and/or BREAK before and after receive messages from the slave result in an appropriate error message. Interference Suppression If BREAK is recognized on the receiving line at the start of the receive message, or if the module interface block notices transmission errors, the driver considers the received message to be faulty and ignores it. The start of the receive message from the slave is recognized by the correctly received slave address. Transmission errors and/or BREAK are also ignored when they occur after the end of the receive message (CRC code). Character Delay Multiplier If a link partner cannot meet the time requirements of the Modbus specification, it is possible to multiply the character delay time tZVZ by means of multiplication factor fMUL. The character delay time should only be adjusted if the link partner cannot meet the required times. The resulting character delay time tZVZ is calculated as follows: tZVZ = tZVZ_TAB tZVZ_TAB fMUL
* fMUL
: Table value for tZVZ : Multiplication factor
3.4.4
Function Codes Used by the Modbus Master

Table 4-6 lists the function codes that are supported by the Modbus Master driver.
Table 3-18 Modbus Master Driver Parameters Function Code 01 Description Read output status Function in SIMATIC S7 Read bit-by-bit Read bit-by-bit Read bit-by-bit (16 bit interval) Read bit-by-bit (16 bit interval) 02 Read input status Read bit-by-bit Read bit-by-bit 03 04 05 Read output registers Read input registers Force single coil Read word-by-word Read word-by-word Write bit-by-bit Write bit-by-bit 06 Preset single register Write word-by-word Memory bits M Outputs Q Timers T Counters C Memory bits M Inputs I Data block DB Data block DB Memory bits M Outputs Q Data block DB
3-30
Modbus/USS
Table 3-18 Modbus Master Driver Parameters, continued Function Code 07 08 11 12 15 Description Read exception status Loop back diagnostic test Fetch communications event counter Fetch communications event log Force multiple coils Function in SIMATIC S7 Read bit-by-bit Read 2 words Read 70 bytes Write bit-by-bit (1...2040 bits) Write bit-by-bit (1...2040 bits) 16 Preset Multiple Registers Write word-by-word (1...127 registers) 8 bits status Event status and counter Event log Memory bits M Outputs Q Data block DB
3.4.5
Function Code 01 - Read Output Status

Function Start Address Amount of Bits LEN in Bytes This function serves to read individual bits from the slave. The parameter bit start address is not checked by the driver and is sent unchanged. Any value between 1 and 2040 is permitted as the amount of bits (number of coils). 6
SEND Source DB Structure of SEND Source Area:

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Bit Start Address Bit Amount BYTE BYTE WORD INT Type Start Value B#16#5 B#16#1 W#16#0040 16 Comment Slave Address Function Code Bit Start Address Amount of Bits
3-31
Modbus/USS
RCV Destination DB
Contents of RCV Destination Area:
Address +0.0 Name data[1] Type WORD Actual Value W#16#1701 Comment Data
The driver enters the data of the reply message into the destination DB word by word. The first received byte is entered as the Low Byte of the first word data[1], the third received byte as the Low Byte of the second word data[2] and so on. If a quantity of less than 9 bits was read or if only one Low Byte was read, the value 00H is entered into the remaining High Byte of the last word.
3.4.6
Function Code 02 - Read Input Status

Function Start Address Amount of Bits LEN in Bytes This function serves to read individual bits from the slave. The parameter bit start address is not checked by the driver and is sent unchanged. Any value between 1 and 2040 is permitted as the amount of bits (number of coils). 6

RCV Destination DB
Address +0.0 +2.0 Name data[1] data[2] Type WORD WORD Actual Value W#16#2604 W#16#0048 Comment Data Data
The driver enters the data of the reply message into the destination DB word by word. The first received byte is entered as the Low Byte of the first word data[1], the third received byte as the Low Byte of the second word data[2], and so on. If a quantity of less than 9 bits was read or if only one Low Byte was read, the value 00H is entered into the remaining High Byte of the last word.
3-32
Modbus/USS
3.4.7
Function Code 03 - Read Output Registers

Function Start Address Amount of Bits LEN in Bytes This function serves to read individual registers from the slave. The parameter Register Start Address is not checked by the driver and is sent unchanged. A maximum of 127 registers (1 register = 2 bytes) can be read. 6

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Register Start Address Register Amount BYTE BYTE WORD INT Type Start Value B#16#5 B#16#3 W#16#0040 2 Comment Slave Address Function Code Register Start Address Amount of Registers
RCV Destination DB
Address +0.0 +2.0 Name data[1] data[2] Type WORD WORD Actual Value W#16#2123 W#16#2527 Comment Data Data
3.4.8
Function Code 04 - Read Input Registers

Function Start Address Amount of Bits LEN in Bytes This function serves to read individual registers from the slave. The parameter Register Start Address is not checked by the driver and is sent unchanged. A maximum of 127 registers (1 register = 2 bytes) can be read. 6
3-33
Modbus/USS

RCV Destination DB
Address +0.0 +2.0 +4.0 Name data[1] data[2] data[3] Type WORD WORD WORD Actual Value W#16#2123 W#16#2527 W#16#3536 Comment Data Data Data
3.4.9
Function Code 05 - Force Single Coil

Function Bit Address Bit Status This function serves to set or delete individual bits in the slave. The parameter Bit Address is not checked by the driver and is sent unchanged. The following two values are valid as the Bit Status: FF00H set bit 0000H delete bit. 6
LEN in Bytes SEND Source DB
Structure of SEND Source Area:

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Bit Address Bit State BYTE BYTE WORD WORD Type Start Value B#16#5 B#16#5 W#16#0019 W#16#FF00 Comment Slave Address Function Code Bit Address Bit Status
The slave must return the request message to the master unchanged (Echo).
3-34
Modbus/USS
RCV Destination DB
Address +0.0 +1.0 +2.0 +4.0 Name Address Function Bit Address Bit State BYTE BYTE WORD WORD Type Actual Value B#16#5 B#16#5 W#16#0019 W#16#FF00 Comment Slave Address Function Code Bit Address Bit Status
3.4.10
Function Code 06 - Preset Single Register

Function Register Address Register Value LEN in Bytes This command serves to overwrite a slave register with a new value. The parameter Register Address is not checked by the driver and is sent unchanged. Any value can be used as the Register Value. 6

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Reg Address Reg Value BYTE BYTE WORD WORD Type Start Value B#16#5 B#16#6 W#16#0180 W#16#3E7F Comment Slave Address Function Code Register Address Register Value
RCV Destination DB Contents of RCV Destination Area:

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Reg Address Reg Value BYTE BYTE WORD WORD Type Actual Value B#16#5 B#16#6 W#16#0180 W#16#3E7F Comment Slave Address Function Code Register Address Register Value
3-35
Modbus/USS
3.4.11
Function Code 07 - Read Exception Status

Function This command serves to read 8 event bits of the connected slave. The start bit number of the event bit is determined by the connected device and does not therefore have to be specified by the SIMATIC user program. 2

Address +0.0 +1.0 Name Address Function BYTE BYTE Type Start Value B#16#5 B#16#7 Comment Slave Address Function Code

Address +0.0 Name data[1] Type WORD Actual Value W#16#3Exx Comment Data
The driver enters the individual bits of the reply message into the High Byte in the destination DBdata[1]. The Low Byte of data[1] remains unchanged. Value 1 is displayed as the length in parameter. The receive length will always be one.
3.4.12
Function Code 08 - Loop Back Diagnostic Test

Function Diagnostic Code Test Value LEN in Bytes This function serves to check the communications connection. Only Diagnostic Code 0000 is supported with this function code. The only permissible value for the parameter Diagnostic Code is 0000. Any value can be used as the Test Value. 6
3-36
Modbus/USS

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Diag Code Reg Value BYTE BYTE WORD WORD Type Start Value B#16#5 B#16#8 B#16#0000 B#16#A5C3 Comment Slave Address Function Code Diagnostic Code Test Value
RCV Destination DB
Address +0.0 +1.0 +2.0 +4.0 Name Address Function Diag Code Test Value BYTE BYTE WORD WORD Type Actual Value B#16#5 B#16#8 B#16#0000 B#16#A5C3 Comment Slave Address Function Code Diagnostic Code Test Value
3.4.13
Function Code 11 - Fetch Communications Event Counter

Function LEN in Bytes This function code serves to read a Status Word (2 bytes long) and an Event Counter (2 bytes long) from the slave. 2

Address +0.0 +1.0 Name Address Function BYTE BYTE Type Start Value B#16#5 B#16#0B Comment Slave Address Function Code
RCV Destination DB
Address +0.0 +2.0 Name data[1] data[2] Type WORD WORD Actual Value W#16#FEDC W#16#0108 Comment Status Word Event Counter
3-37
Modbus/USS
3.4.14
Function Code 12 - Fetch Communications Event Log

Function This function code serves to read the following: --2 Byte Status Word --2 Byte Event Counter --2 Byte Message Counter and --64 Byte Event Bytes from the slave. LEN in Bytes 2

Address +0.0 +1.0 Name Address Function BYTE BYTE Type Start Value B#16#5 B#16#0C Comment Slave Address Function Code
RCV Destination DB
Address +0.0 +2.0 +4.0 +6.0 +7.0 : +68.0 +69.0 Name data[1] data[2] data[3] bytedata[1] bytedata[2] : bytedata[63] bytedata[64] BYTE BYTE B#16#C2 B#16#D3 Type WORD WORD WORD BYTE BYTE Actual Value W#16#8765 W#16#0108 W#16#0220 B#16#01 B#16#12 Comment Status Word Event Counter Message Counter Event Byte 1 Event Byte 2 : Event Byte 63 Event Byte 64
3-38
Modbus/USS
3.4.15
Function Code 15 - Force Multiple Coils

Function Start Address Amount of Bits This function code serves to change up to 2040 bits in the slave. The parameter Bit Start Address is not checked by the driver and is sent unchanged. Any value between 1 and 2040 is permitted as the amount of bits (number of coils). This indicates how many bits in the slave should be overwritten. The parameter Byte Counter in the request message is generated by the driver based on the transferred parameter Amount of Bits. >6

Address +0.0 +1.0 +2.0 +4.0 +6.0 Name Address Function Bit Start Address Bit Amount coil_state[1] BYTE BYTE WORD INT WORD Type Start Value B#16#5 B#16#0F W#16#0058 10 W#16#EFCD Comment Slave Address Function Code Bit Start Address Amount of Bits Status Coil 5FH..58H/57H..5 0H
RCV Destination DB
Address +0.0 +1.0 +2.0 +4.0 Name Address Function Bit Address Bit Amount BYTE BYTE WORD INT Type Actual Value B#16#5 B#16#F W#16#0058 10 Comment Slave Address Function Code Bit Address Amount of Bits
The driver sends the data from the source destination DB word-by-word. The High Byte (byte 1) of the DB word location EF will be sent first then the Low Byte (byte 0) of the DB word location CD. If an odd number of bytes are sent then the last byte is the High Byte (byte 1).
3-39
Modbus/USS
3.4.16
Function Code 16 - Preset Multiple Registers

Function Start Address Amount of Registers LEN in Bytes Function Code 16 serves to overwrite up to 127 registers in the slave with one request message. The parameter Register Start Address is not checked by the driver and is sent unchanged. A maximum of 127 registers (1 register = 2 bytes) can be read. The parameter Byte Counter in the request message is generated by the driver based on the transferred parameter Amount of Registers. >6

Address +0.0 +1.0 +2.0 +4.0 +6.0 +8.0 +10.0 Name Address Function Register Start Address Register Amount reg_data[1] reg_data[2] reg_data[3] BYTE BYTE WORD INT WORD WORD WORD Type Start Value B#16#5 B#16#10 W#16#0060 3 W#16#41A1 W#16#42A2 W#16#43A3 Comment Slave Address Function Code Register Start Address Amount of Registers Register Data Register Data Register Data

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Register Start Address Register Amount BYTE BYTE WORD INT Type Actual Value B#16#5 B#16#10 W#16#0060 3 Comment Slave Address Function Code Register Start Address Amount of Registers
3-40
Modbus/USS
3.5
Modbus Slave Driver
3.5.1
Components of the Modbus Slave Data Link

The supplied data link converts data access of the Modbus protocol to the specific memory areas of the SIMATIC S7 CPU.
Data Structures
Prior to project configuration of your S7 data structures, you should ensure that they are compatible with the user programs of the Modbus Master systems.
Modbus Slave Data Link

The Modbus Slave data link for the module consists of two parts: Modbus Slave Driver Modbus Communications Function Block for the SIMATIC S7 CPU Modbus Slave Communications FB In addition to the Modbus slave driver, the Modbus slave data link requires a special Communications FB in the S7 CPU. The Modbus communications FB processes all functions necessary for the data link. The FB81(S_MODB) receives the Modbus protocol and converts the Modbus addresses in the SIMATIC memory areas. FB81(S_MODB) must be called in the cyclic program of the user program. The Modbus communications FB uses an instance block as the work area.
3-41
Modbus/USS
3.5.2
Data Transfer for ET 200S Modbus Slave

The execution of a Modbus Slave request requires the activation of FB S_MODB cyclically in the user program. S_MODB receives the request from the ET200S Serial Interface module, executes the request, and returns the response to the module. Communication between the PLC CPU and the module is carried out by the S_SEND and S_RCV Function Blocks which are called from S_MODB. After each restart of the CPU, the user program must carry out an initialization of the Modbus communications FB. Initialization is activated with a rising edge at input START. The FB records the sizes of the I, Q, M, T, and C operand areas of the CPU in the instance data block of the FB. At the successful completion of initialization, the FB set the START_OK output. An initialization error is signaled by the START_ERROR output. In this case Modbus communication is not possible and all requests from the Modbus Master are answered with an Exception Code message. S_MODB uses a Modbus Data Conversion Table located in a Data Block to map Modbus addresses to SIMATIC S7 PLC memory areas. Input parameter OB_MASK can be used to instruct the Modbus FB to mask I/O access errors. In the event of a write access to non-existent I/O, the CPU does not go to STOP or call the error OB. The access error is recognized by the FB and the function is ended with an error response to the Modbus Master.
STL Representation CALL S_MODB, I_MODB LADDR START_TIMER START_TIME DB_NO OB_MASK START START_FM NDR START_OK = = = = = = = = = EN LADDR START_TIMER LAD Representation I_MODB S_MODB ENO NDR START_OK
START_TIME START_ERROR DB_NO OB_MASK START START_FM ERROR_NR ERROR_INFO
START_ERROR = ERROR_NR ERROR_INFO = =
3-42
Modbus/USS
3.5.3
Data Areas in the SIMATIC CPU
Modbus Data Conversion Table

The Modbus address in the messages is interpreted by the FB81(S_MODB) in an S7 way and transformed in the SIMATIC memory area. Access to the individual SIMATIC memory areas can be specified by the user by means of passing a DB as an input to FB81(S_MODB). See Table 5-1.
Table 3-19 Conversion Table Address Name Type Initial Value Actual Value W#16#0 Comment Applicable Function Code 01
0.0
aaaaa
WORD W#16#0
Modbus Address Start Modbus Address End M Memory Modbus Address Start Modbus Address End Q output Modbus Address Start Modbus Address End Timer Memory
2.0
bbbbb
WORD W#16#0
W#16#7F7
4.0 6.0
uuuuu ccccc
WORD W#16#0 WORD W#16#0
W#16#1F4 W#16#7F8
01
8.0
ddddd
WORD W#16#0
W#16#FEF
10.0 12.0
ooooo eeeee
W#16#15 W#16#FF0
01
14.0
fffff
WORD W#16#0
W#16#17E7
16.0
ttttt
WORD W#16#0
W#16#28
3-43
Modbus/USS
Address
Name
Type
Initial Value
Actual Value W#16#17E8
Comment
Applicable Function Code 01
18.0
ggggg
WORD W#16#0
Modbus Address Start Modbus Address End Counter Memory Modbus Address Start Modbus Address End M Memory Modbus Address Start Modbus Address End I Input DB
20.0
hhhhh
WORD W#16#0
W#16#1FDF
22.0 24.0
zzzzz kkkkk
W#16#28 W#16#1FE0
02
26.0
lllll
WORD W#16#0
W#16#27D7
02
28.0 30.0
vvvvv nnnnn
W#16#320 W#16#27D8
02 02
32.0
rrrrr
WORD W#16#0
W#16#2FCF
02
34.0 36.0
sssss DB_Number _FC_03_06_ 16 DB_Number _FC_04 DB_Min
W#16#11 W#16#6
02 03, 06, 13
38.0 40.0
W#16#2 W#16#1
DB Min. DB Number Used Max. DB Number Used Min. M Memory Used Max. M Memory Used Min. Q Memory Used Max. Q Memory Used
04 Limits
42.0
DB_Max
WORD W#16#0
W#16#6
Limits
44.0
M_Min
WORD W#16#0
W#16#1F4
Limits
46.0
M_Max
WORD W#16#0
W#16#4B0
Limits
48.0
Q_Min
WORD W#16#0
W#16#0
Limits
50.0
Q_Max
WORD W#16#0
W#16#64
Limits
3-44
Modbus/USS
3.5.4
Configuring the Parameters for the Data Link

The following parameters and operating modes must be set for the driver using the hardware configuration. Transmission rate, parity Slave address of the module Operating mode (Normal, Interference Suppression) Multiplication factor for character delay time The parameters listed below must be set using the input DB to FB81(S_MODB). Address areas for Function Codes 01, 05, 15 Address areas for Function Code 02 Base DB number for Function Codes 03, 06, 16 Base DB number for Function Code 04 Limits for write-only access
Setting Parameters for the Slave Driver

Table 5-2 lists the parameters that can be selected for the ASCII driver mode of the module.
Table 3-20 Modbus Slave Driver Parameters Parameter Diagnostic Alarm Description Specify if the module generates a diagnostic alarm if a serious error occurs. Specify the electrical interface to be used. No Yes RS-232C RS-422 (full-duplex) RS-485 (half-duplex) Half-Duplex Receive For RS-422 and RS-485 modes, Line Initial State specify the initial state of the receive line. Not used for RS-232C mode. Data Flow Control (with default parameters; change default values in user program) You can send and receive data with data flow control, which synchronizes data transmission when one communication partner works faster than the other. Select the type of data flow control and set the associated parameters. Note: Data flow control is not possible with the RS-485 interface. Data flow control with Automatic use of the V.24 Signals is only possible with the RS-232C interface. R(A) 5V / R(B) 0V R(A) 0V / R(B) 5V None Automatic use of the V.24 signals None R(A) 5V / R(B) 0V RS-232C Value Range Default Value No
Interface Type
3-45
Modbus/USS
Table 3-20 Modbus Slave Driver Parameters, continued Parameter Transmission Rate Description Select the speed of data transmission in bits per second. Value Range 110 300 600 1200 2400 4800 9600 19200 38400 1 2 None Odd Even Even Default Value 9600
Stop Bits
Select the number of stop bits that are appended to each character to signal the end of a character transmission. The sequence of the data bits can be extended to include the parity bit. The addition of its value (0 or 1) brings the value of all the bits (data bits and parity bit) up to a defined status. None: Data is sent without a parity bit. Odd: The parity bit is set such that the total number of data bits (including the parity bit) with signal state 1 is odd. Even: The parity bit is set such that the total number of data bits (including the parity bit) with signal state 1 is even.
Parity
Slave Address Operating Mode
Own slave address of the module. Normal Operation Interference Suppression
1-255 Normal Interference Suppression 1 to 10 No Yes
222 Normal
Character Delay Multiple
Uses a character delay time multiple from 1-10.
1 Yes
Delete Serial Specify whether the receive buffer of Interface Receive the Serial Interface is to be deleted Buffer during Startup automatically when the CPU changes from STOP -> RUN mode (CPU start-up). You can thus ensure that in the Serial Interface receive buffer only message frames which were received after the CPU start-up can be fetched.
1
The shortest possible character delay time depends on the baud rate.
3-46
Modbus/USS
Transmission Rate The transmission rate is the speed of data transmission in bits per second (bps). The transmission rate of the module is 38400 bps in half-duplex operation. Data Bits The number of data bits describes how many bits represent a character to be transmitted. The setting must always be 8 data bits for this driver. An 11-bit character frame must always be used; if you select none parity, then you must select 2 stop bits. Stop Bits The number of stop bits defines the smallest possible time interval between two characters to be transmitted. An 11-bit character frame must always be used; if you select none parity, then you must select 2 stop bits. Parity The parity bit is for data safety; depending upon parameter assignment, it completes The number of transmitted data bits to either an even or an odd number. If None parity is selected, then no parity bit is transmitted. This reduces the safety of data transmission. An 11-bit character frame must always be used; if you select none parity, then you must select 2 stop bits. Slave Address Here you can specify the Modbus Slave address, to which the module should reply. The module only replies to messages where the received slave address is identical to the parameterized slave address. Messages to other slaves are not checked and not replied to. Normal Operation In this operating mode, all recognized transmission errors and/or BREAK before and after receive messages from the slave result in an appropriate error message. Interference Suppression If BREAK is recognized on the receiving line at the start of the receive message, or if the module interface block notices transmission errors, the driver considers the received message to be faulty and ignores it. The start of the receive message from the slave is recognized by means of the correctly-received slave address. Transmission errors and/or BREAK are also ignored when they occur after the end of the receive message (CRC code). Character Delay Multiplier If a link partner cannot meet the time requirements of the Modbus specification, it is possible to multiply the character delay time tZVZ by means of multiplication factor fMUL. The character delay time should only be adjusted if the link partner cannot meet the required times. The resulting character delay time tZVZ is calculated as follows: tZVZ tZVZ_TAB fMUL = tZVZ_TAB
* fMUL
=Table value for tZVZ = Multiplication factor
3-47
Modbus/USS
3.5.5
Slave Function Codes

The Modbus Slave Driver supports the function codes listed in Table 5-3.
Table 3-21 Slave Function Codes Function Code 01 Description Read coil status Function in SIMATIC S7 Read bit-by-bit Read bit-by-bit Read bit-by-bit (16 bit interval) Read bit-by-bit (16 bit interval) 02 Read input status Read bit-by-bit Read bit-by-bit 03 04 05 Read holding registers Read input registers Force single coil Read word-by-word Read word-by-word Write bit-by-bit Write bit-by-bit 06 08 15 Preset single register Loop back test Force multiple coils Write word-by-word Write bit-by-bit (1...2040 bits) Write bit-by-bit (1...2040 bits) 16 Preset multiple (holding) registers Write word-by-word (1...127 registers) Memory bits M Outputs Q Timers T Counters C Memory bits M Inputs I Data block DB Data block DB Memory bits M Outputs Q Data block DB Memory bits M Outputs Q Data block DB
All Modbus addresses listed in Table 5-3 refer to the transmission message level and do not refer to the user level in the Modbus master system.This means that the Modbus addresses in the transmission messages begin with 0000 Hex.
3-48
Modbus/USS
3.5.6
Function Code 01 - Read Coil (Output) Status

Function Request Message Reply Message LEN in Bytes This function enables the Modbus master system to read individual bits from the SIMATIC memory areas listed below.
ADDR ADDR FUNC FUNC start_address start_address bit_number n Byte DATA CRC CRC
start_address
The Modbus bit address start_address is interpreted by the driver. For example, the FB81(S_MODB) checks that start_address is located within one of the areas which were specified in the conversion DB for FC 01, 05, 15 (from/to : Memory Bits, Outputs, Timers, Counters).
If Modbus bit address start_address is located in area From aaaaa to bbbbb From ccccc to ddddd From eeeee to fffff From ggggg to hhhhh Access is made to the following SIMATIC memory area Commence at memory bit Commence at output Commence at timer Commence at counter M uuuuu.0 Q ooooo.0 T ttttt C zzzzz
The address calculation for access (address conversion) is carried out as follows:
Access beginning with SIMATIC Memory byte Output byte Timer Counter Conversion Formula =((start_address- aaaaa) =((start_address- ccccc) =((start_address- eeeee) =((start_address- ggggg) / 8) / 8) / 16) / 16) + uuuuu + ooooo + ttttt + zzzzz
Access to Memory Bits and Outputs When accessing SIMATIC areas Memory Bits and Outputs, the remaining Rest Bit_Number is calculated and used to address the relevant bit within the first/last memory or output byte Access to Timers and Counters With the address calculation, it must be possible to divide the result either (start_address - eeeee) or (start_address - ggggg) by 16 without having a remainder (access word-by-word only starting from word limit).
3-49
Modbus/USS
bit_number
Values between 1 and 2040 are permitted as the bit_number (number of coils). This number of bits is read. When accessing SIMATIC areas Timers and Counters, it must be possible to divide the bit_number by 16 (access word-by-word only).
Application Example
Example for Conversion of Modbus Addressing:
Conversion of Modbus Addressing for Function Codes FC 01, 05, 15 Modbus address in transmission message From From From From 0 to 2048 to 4096 to 4608 to 2047 2559 4607 5119 SIMATIC memory area Commence at memory bit Commence at output Commence at timer Commence at counter M 1000.0 Q 256.0 T 100 C 200

RCV Destination DB
Address +0.0 Name Data[1] Type WORD Actual Value W#16#1701 Comment Data
The driver enters the data of the reply message into the destination DB word-by-word. The first received byte is entered as the Low Byte of the first word Data[1], the third received byte as the Low Byte of the second word Data[2], and so on. If a quantity of less than 9 bits was read or if only one Low Byte was read, the value 00H is entered into the remaining High Byte of the last word.
3-50
Modbus/USS
Address Calculation: The Modbus address start_address 0040 Hex (64 decimal) is located in the Memory Bit area:
Memory byte =((start_address- aaaaa) =((64 =1008; - 0) / 8) / 8) + uuuuu + 1000
The remaining Rest Bit_Number results in:

Rest-Bit_No. =((start_address- aaaaa) =((64 = 0; -0 ) % % 8) 8) [Modulo 8]
Access is made starting from bit M 1008.0 up to and including M 1011.7. Number of Bits: The number of Modbus bits bit_number 0020 Hex (32 decimal) means that 32 Bits = 4 Bytes should be read. Table 5-3 shows additional examples for accessing data.
Table 3-22 Additional Examples for Accessing Data start_address Hex Decimal 0000 0021 0400 0606 0840 09E4 1010 10C0 1200 13E0 0 33 1024 1542 2112 2532 4112 4288 4608 5088 Mem. bit Mem. bit Mem. bit Mem. bit Output Output Timers Timers Counters Counters Access Calculation ((0 -0) ((33 ((1024 ((1542 ((2112 ((2532 ((4112 ((4288 ((4608 ((5088 - 0) -0) -0) / 8) +1000 / 8) +1000 / 8) +1000 / 8) +1000 Address ->M1000.0 ->M1004.1 ->M1128.0 ->M1192.6 ->Q264.0 ->Q316.4 ->T 101 ->T112 ->C200 ->C230
-2048) / 8) +256 -2048) / 8) +256 -4096) / 16) +100 -4096) / 16) +100 -4608) / 16) +200 -4608) / 16) +200
3-51
Modbus/USS
3.5.7
Function Code 02 - Read Input Status

Function Request Message Reply Message LEN in Bytes This function enables the Modbus master system to read individual bits from the SIMATIC memory areas listed below.
ADDR ADDR FUNC FUNC start_address Byte_count n bit_number n Byte DATA CRC CRC
start_address
The Modbus bit address start_address is interpreted by the driver as follows: The driver checks whether start_address is located within one of these areas, which was entered in the Conversion DB for FC 02 (from / to : memory bits, inputs).
If Modbus bit address start_address is located in area From kkkkk to lllll From nnnnn to rrrrr access is made to the following SIMATIC memory area Commence at memory bit Commence at input M vvvvv.0 I sssss. 0
Access beginning with SIMATIC Memory byte Input byte Conversion Formula =((start_address- kkkkk) =((start_address- nnnnn) / 8) / 8) + vvvvv + sssss
Access to Memory bits and Inputs When accessing SIMATIC areas Memory Bits and Inputs, the remaining Rest Bit_Number is calculated and used to address the relevant bit within the first/last memory or input byte.
bit_number
Any value from 1 to 2040 is allowed as the bit_number (number of coils). This number of bits is read.
3-52
Modbus/USS
Application Example Example for Conversion of Modbus Addressing Assignment:

Conversion of Modbus Addressing for Function Codes FC 02 Modbus address in transmission message From 0 to 4095 5119 SIMATIC memory area Commence at memory bit Commence at input M 2000.0 I 128.0
From 4096 to

RCV Destination DB
Address +0.0 +2.0 Name Data[1] Type WORD WORD Actual Value W#16#2604 W#16#0048 Comment Data Data
Data[2]
The driver enters the data of the reply message into the destination DB word-by-word. The first received byte is entered as the Low Byte of the first word Data[1], the third received byte as the Low Byte of the second word Data[2], and so on. If a quantity of less than 9 bits was read or if only one Low Byte was read, the value 00H is entered into the remaining High Byte of the last word.
3-53
Modbus/USS
Address Calculation: The Modbus address start_address 1030 Hex (4144 decimal) is located in the area inputs:
Input byte =((start_address- nnnnn) =((4144 =134; - 4096) / 8) / 8) + sssss + 128
The remaining Rest Bit_Number has the following result:

Rest Bit_No. =((start_address- aaaaa) =((4144 = 0; % 8) 8) [Modulo 8]
- 4096 ) %
Access is made starting from input I 134.0 up to and including I 136.7. Number of bits: The number of Modbus bits bit_number 0018 Hex (24 decimal) means that 24 bits = 3 bytes should be read. Table 5-4 shows additional examples for accessing data.
Table 3-23 Additional Examples for Accessing Data start_address Hex decimal 0000 0071 0800 0D05 1000 10A4 0 113 2048 3333 4096 4260 Mem. bit Mem. bit Mem. bit Mem. bit Input Input ((0 ((113 Access Calculation -0) -0) / 8) +2000 / 8) +2000 / 8) +2000 / 8) +2000 Address ->M2000.0 ->M2014.1 ->M2256.0 ->M2416.5 ->I 128.0 ->I 148.4
((2048 -0) ((3333 -0) ((4096 ((4260
-4096) / 8) +128 -4096) / 8) +128
3-54
Modbus/USS
3.5.8
Function Code 03 - Read Output Registers

Function Request Message This function enables the Modbus master system to read data words from a data block.
ADDR FUNC FUNC start_register register_number CRC n/2-Register DATA (High, Low) CRC
Reply Message A DDR LEN in Bytes 6
Byte_count n
start_address
The Modbus register address start_register is interpreted by the driver as follows:
For further address generation, the FB81(S_MODB) uses the base DB number (from DB xxxxx) entered in the Conversion DB for FC 03, 06, 16. The address calculation for access (address conversion) is carried out in two steps as follows:
Access to SIMATIC Data block DB (resulting DB) Data word DBW Conversion Formula =(base DB number xxxxx+start_register offset_DB_No.) =(start_register word_No. *2
Calculation Formula for start_register

Providing the resulting DB to be read is known, the Modbus address start_register required in the master system can be calculated in accordance with the following formula: start_register = ((resulting DB - base DB number) * 512) + (data word_DBW / 2)
This is based on even numbered data word numbers only. register_number Any value from 1 to 127 is permitted as the register_number (number of registers). This Number of registers is read.
3-55
Modbus/USS
Application Example
Conversion of Modbus Addressing for Function Codes FC 03, 06, 16 Modbus Address in Transmission Message 0 SIMATIC Memory Area Commencing at data block (base DB number) DB 800

RCV Destination DB
Address +0.0 +2.0 Name Data[1] Data[2] Type WORD WORD Actual Value W#16#2123 Comment Data Data
W#16#2527
Address Calculation: The Modbus address start_register 0050 Hex (80 decimal) is interpreted as follows:
Data block DB (resulting DB)
=(base DB Number xxxxx + start_registerOffset_DB_No.) =(800 + 0) =800 ;
3-56
Modbus/USS
Data word DBW
=(start_register word_No.* 2) =(80 =60 ; * 2)
Access is made to DB 800, data word DBW 160. Number of Registers: The number of Modbus registers register_number 0002 Hex (2 decimal) means 2 registers = 2 data words are read. Table 5-5 shows additional examples for accessing data.
Table 3-24 Additional Examples for Accessing Data start_register start_register Hex 0000 01F4 0200 02FF 0300 03FF 0400 Base DB_No. Offset DB_No. Word Number Hex 000 1F4 000 0FF 100 1FF 000 Decimal 0 500 0 255 256 511 0 Result DB Decimal 800 800 801 801 801 801 802 DBW Decimal 0 1000 0 510 512 1022 0
Decimal Decimal Decimal 0 500 512 767 768 1023 1024 800 800 800 800 800 800 800 0 0 1 1 1 1 2
3-57
Modbus/USS
3.5.9
Function Code 04 - Read Input Registers

Function Request Message This function enables the Modbus master system to read data words from a data block.
A DDR FUNC FUNC start_register Byte_count n register_number CRC n/2-Register DATA (High, Low) CRC
Reply Message A DDR LEN in Bytes 6
start_address
The Modbus register address start_register is interpreted by the driver as follows:
For further address generation, the FB81(S_MODB) uses the base DB number (from DB xxxxx) entered in the Conversion DB for FC 04. The address calculation for access (address conversion) is carried out in two steps as follows:
Access to SIMATIC Data block DB (resulting DB) Data word DBW Conversion Formula =(base DB number xxxxx offset_DB_No.) =(start_register word_No. +start_register *2)
Providing the resulting DB to be read is known, the Modbus address start_register required in the master system can be calculated in accordance with the following formula: start_register = ((resulting DB - base DB number) * 512) + (data word_DBW / 2)
This is based on even-numbered data word numbers only. register_number Any value from 1 to 127 is permitted as the register_number (number of registers). This Number of registers is read.
3-58
Modbus/USS
Application Example
Conversion of Modbus Addressing for Function Codes FC 04 Modbus Address in Transmission Message 0 SIMATIC Memory Area commencing at data block (base DB number) DB 900

Address +0.0 +1.0 +2.0 +4.0 Name address function register start address register amount BYTE BYTE WORD INT Type Start Value B#16#5 B#16#4 W#16#0050 3 Comment Slave Address Function Code Register Start Address Amount of Registers
RCV Destination DB
Address +0.0 +2.0 +4.0 Name Data[1] Data[2] Data[3] Type WORD WORD WORD Actual Value W#16#2123 W#16#2527 W#16#3536 Comment Data Data Data
3-59
Modbus/USS
Address Calculation: The Modbus address start_register 02C0 Hex (704 decimal) is interpreted as follows:
Data block DB (resulting DB)
=(base DB Number xxxxx + start_registerOffset_DB_No.) =(900+ 0) =901;
Data word DBW
=(start_register word_No.* 2) =(192 =384; * 2)
Access is made to DB 901, data word DBW 384. Number of Registers: The number of Modbus registers register_number 0003 Hex (3 decimal) means 3 registers = 3 data words are read. Table 5-6 shows additional examples for accessing data.
Table 3-25 Additional Examples for Accessing Data
start_register start_register Hex 0000 0064 00C8 0190 1400 1464 14C8 Base DB_No. Offset DB_No. Word Number Hex 000 064 0C8 190 000 064 0C8 Decimal 0 100 200 400 0 100 200 Result DB Decimal 900 900 900 900 910 910 910 DBW Decimal 0 200 400 800 0 200 400
Decimal Decimal Decimal 0 100 200 400 5120 5220 5320 900 900 900 900 900 900 900 0 0 0 0 10 10 10
3-60
Modbus/USS
3.5.10
Function Code 05 - Force Single Coil

Function Request Message Reply Message LEN in Bytes 6 This function enables the Modbus master system to write a bit into the SIMATIC memory areas of the CPU as listed below.
ADDR FUNC coil_address DATAon/off CRC
ADDR
FUNC
coil_address
DATAon/off
CRC
coil_address
The Modbus bit address coil_address is interpreted by the driver as follows: The FB81(S_MODB) checks whether coil_address is located within one of these areas, which was entered in the Conversion DB for FC 01, 05, 15 (from / to : memory bits, outputs, timers, counters).
If Modbus bit address start_address is located in area from aaaaa to bbbbb from ccccc to ddddd access is made to the following SIMATIC memory area commencing from memory bit commencing from output M uuuu.0 Q oooo.0
The address calculation for access (address conversion) is carried out in two steps as follows:
Access beginning with SIMATIC Memory byte Output Byte Conversion Formula =((start_address- ccccc) =((start_address aaaaa) / 8) / 8) + ooooo + uuuuu
Access to Memory bits and Outputs When accessing SIMATIC areas memory bits and outputs, the remaining Rest Bit_number is calculated and used to address the relevant bit within the memory or output byte. Access to Timers and Counters Access to SIMATIC areas timers and counters is not permitted with function code FC 05 and is rejected by the driver with an error message. DATA on/off
The following two values are permitted as DATA on/off: FF00H = set bit. 0000H = delete bit.
3-61
Modbus/USS
Application Example
Conversion of Modbus Addressing for Function Codes FC 01, 05, 15 Modbus Address in Transmission Message from from 0 to 2048 to 2047 2559 SIMATIC memory area Commencing at memory bit Commencing at output M 1000.0 Q 256.0

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Bit address Bit state BYTE BYTE WORD WORD Type Start Value B#16#5 B#16#5 W#16#0019 W#16#FF00 Comment Slave Address Function Code Bit Address Bit Status
The slave must return the request message to the master unchanged (Echo).
RCV Destination DB
Address +0.0 +1.0 +2.0 +4.0 Name Address Function Bit Address Bit State BYTE BYTE WORD WORD Type Actual Value B#16#5 B#16#5 W#16#0019 W#16#FF00 Comment Slave Address Function Code Bit Address Bit Status
Address Calculation: The Modbus address coil_address 0809 Hex (2057 decimal) is located in the area outputs:
Output byte =((coil_address- ccccc) =((2057 =257 - 2048) / 8) / 8) + ooooo + 256
The remaining Rest Bit_number has the following result:

Rest Bit_No. =((coil_address- ccccc)) =((2057 =1; -2048) % % 8) 8) [Modulo 8]
Access is made to output Q 257.1. Further Examples For further access examples to memory bits and outputs, please refer to FC 01.
3-62
Modbus/USS
3.5.11
Function Code 06 - Preset Single Register

Function Request Message Reply Message LEN in Bytes 6 This function enables the Modbus master system to write a data word in a data block of the CPU.
ADDR FUNC start_register DATA value (High, Low) DATA value (High, Low) CRC
ADDR
FUNC
start_register
CRC
start_register The Modbus register address start_register is interpreted by the driver as follows:
For further address generation, the FB81(S_MODB) uses the base DB number (commencing at DB xxxxx) entered in the Conversion DB for FC 03, 06, 16. The address calculation for access (address conversion) is carried out in two steps as follows:
Access to SIMATIC Data Block DB (resulting DB) Data Word DBW Conversion Formula =(Base DB Number xxxxx+start_registerOffset_DB_no.) =(start_register-word_No.*2)
Providing the resulting DB to be read is known, the Modbus address start_register required in the master system can be calculated in accordance with the following formula: start_register =((resulting DB - base DB number) * 512) + (data word_DBW / 2) This is based on even-numbered data numbers only. DATA Value Any value can be used as the DATA value (register value). Application Example for Parameter Assignment:
Conversion of Modbus Addressing for Function Codes FC 03, 06, 16 Modbus Address in Transmission Message 0
SIMATIC Memory Area Commencing at data block (Base DB Number) DB 800
3-63
Modbus/USS

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Reg Address Reg value BYTE BYTE WORD WORD Type Start Value B#16#5 B#16#6 W#16#0180 W#16#3E7F Comment Slave Address Function Code Register Address Register Value

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Reg Address Reg Value BYTE BYTE WORD WORD Type Actual Value B#16#5 B#16#6 W#16#0180 W#16#3E7F Comment Slave Address Function Code Register Address Register Value
Address Calculation The Modbus address start_register 0180 Hex (384 decimal) is interpreted:
Data Block DB
(resulting DB)
=(base-DB-Number xxxxx+start_register-Offset_DB_No.) =(800 + 0) = 800 ;
Data Word DBW
=(start_register-word_No.* 2) =(384 * 2) = 768 ;
Access is made to DB 800, data word DBW 768.
Further Examples
For further access examples please, refer to FC 03.
3-64
Modbus/USS
3.5.12
Function Code 08 - Loop Back Diagnostic Test

This function serves to check the communications connection. It does not effect the S7 CPU, nor the user programs, nor user data. The received message is independently returned to the master system by the driver. ADDR FUNC Diagnostic Code (High, Low) Diagnostic Code (High, Low) Test Data Test Data CRC
Function
Request Message Reply Message Diagnostic Code Test Data LEN in Bytes
ADDR
FUNC
CRC
Only Diagnostic Code 0000 is supported. Any value (16 bit). 6
Application Example SEND Source DB Structure of SEND Source Area:

Address +0.0 +1.0 +2.0 +4.0 Name Address Function Diag Code Reg Value BYTE BYTE WORD WORD Type Start Value B#16#5 B#16#8 B#16#0000 B#16#A5C3 Comment Slave Address Function Code Diagnostic Code Test Value
RCV Destination DB
Address +0.0 +1.0 +2.0 +4.0 Name Address Function Diag Code Test Value BYTE BYTE WORD WORD Type Actual Value B#16#5 B#16#8 B#16#0000 B#16#A5C3 Comment Slave Address Function Code Diagnostic Code Test Value
3-65
Modbus/USS
3.5.13
Function Code 15 - Force Multiple Coils

Function Request Message Reply Message LEN in Bytes This function enables the Modbus master system to write several bits in the SIMATIC memory areas listed below.
ADDR FUNC start_ address ADDR FUNC quantity byte_count n DATA n quantity CRC
start_address
CRC
>6
start_address The Modbus bit address start_address is interpreted by the driver as follows: The FB81(S_MODB) checks if start_address is located within one of the areas which were entered in the Conversion DB for FC 01, 05, 15 (from/to : memory bits, outputs, timers, counters).
If Modbus bit address start_address is located in area From aaaaa to bbbbb From ccccc to ddddd access is made to the following SIMATIC memory area Commencing from memory bit Commencing at output M uuuu.0 Q ooooo.0
Access beginning with SIMATIC Memory byte Output byte Conversion Formula =((start_address- ccccc) =((start_address- aaaaa) / 8) / 8) +ooooo + uuuuu
Access to Memory Bits and Outputs When accessing SIMATIC areas memory bits and outputs, the remaining Rest Bit_Number is calculated and used to address the relevant bit within the memory or output byte. Access to Timers and Counters Access to SIMATIC areas timers and counters is not permitted with function code FC 15 and is rejected by the driver with an error message. Quantity Any value between 1 and 2040 is permitted as the quantity (Number of bits).
3-66
Modbus/USS
DATA
Bit status (any values) are contained in the DATA field.
Application Example
Conversion of Modbus Addressing for Function Codes FC 01, 05, 15 Modbus Address in Transmission Message From From 0 to 2048 to 2047 2559 SIMATIC memory area Commencing at memory bit Commencing at output M 1000.0 Q 256.0
Action The Modbus master system wants to write the following bit status on to memory bits M 1144.0 ... M 1144.7 and M 1145.0 ... M 1145.3:
Memory bit M 1144 7 ON 6 ON 5 OFF 4 OFF 3 ON 2 ON 1 OFF 0 Bit ON
Memory bit M 1145
7 -
6 -
5 -
4 -
3 ON
2 OFF
1 OFF
0 Bit ON

Address +0.0 +1.0 +2.0 +4.0 +6.0 Name Address Function Bit Start Address Bit Amount coil_state[1] BYTE BYTE WORD INT WORD Type Start Value B#16#5 B#16#0F W#16#0058 10 W#16#EFCD Comment Slave Address Function Code Bit Start Address Amount of Bits Status Coil 5FH..58H/57H..5 0H
3-67
Modbus/USS
Address Calculation The Modbus address coil_address 0480 Hex (1152 decimal) is located in the memory bit area:
Memory byte =((start_address- aaaaa) =((1152 =1144; - 0) / 8) / 8) + uuuuu + 1000
The remaining Rest Bit_Number has the following result:

Rest-Bit_No =((start_address - aaaaa)) =((1152 = 0; -0) % % 8) 8) [Modulo 8]
Access is made to memory bits commencing at M 1144.0.
Further Examples For further access examples to memory bits and outputs, please refer to FC 01.
3.5.14
Function Code 16 - Preset Multiple Registers

Function Request Message Reply Message LEN in Bytes This function code enables the Modbus master system to write several data words in a data block of the SIMATIC CPU.
ADDR FUNC start_ register quantity byte count_n quantity nDATA CRC (High, Low) CRC
ADDR
FUNC
start_register
>6
3-68
Modbus/USS
start_register The Modbus register address start_register is interpreted by the driver as follows:
For further address generation, the FB81(S_MODB) uses the Base DB number (commencing at DB xxxxx) entered in the Conversion DB FC 03, 06, 16 during parameter assignment. The address calculation for access (address conversion) is carried out in two steps as follows:
Access to SIMATIC Data block DB (resulting DB) Data word DBW Conversion Formula =(Base DB Number xxxxx +start_registerOffset_DB_No.) =(start_register word_No.* 2)
Providing the resulting DB to be written to is known, the Modbus address start_register required in the master system can be calculated in accordance with the following formula: start_register ((resulting DB - base-DB-number) * 512) + (data word_DBW / 2) This is based on even-numbered data word numbers only. Quantity Any value between 1 and 127 is permitted as the quantity (Number of registers). =
DATA (High, Low)

Any value can be used as DATA (High, Low) (register value). The Modbus master system wants to write values CD09 Hex, DE1A Hex, EF2B Hex to data words DBW 100, DBW 102, DBW 104 of DB 800. Application Example
Conversion of Modbus Addressing for Function Codes FC03, 06, 16 Modbus Address in Transmission Message 0 SIMATIC memory area from data block (base DB Number) DB 800
3-69
Modbus/USS

Address +0.0 +1.0 +2.0 +4.0 +6.0 +8.0 +10.0 Name Address Function Register Start Address Register Amount reg_data[1] reg_data[2] reg_data[3] BYTE BYTE WORD INT WORD WORD WORD Type Start Value B#16#5 B#16#10 W#16#0060 3 W#16#41A1 W#16#42A2 W#16#43A3 Comment Slave Address Function Code Register Start Address Amount of Registers Register Data Register Data Register Data
Address Calculation The Modbus Address start_register 0032 Hex (50 decimal) is interpreted:
Data Block DB (resulting DB)
=(base-DB-Number xxxxx+start_register-Offset_DB_No.) =(800 + 0) = 800 ;
Data Word DBW
= (start_register-word_No.* 2) =(50 = 100; * 2)
Access is made to DB 800, data word DBW 100 .
Further Examples For further access examples, please refer to FC 03.
3-70
Modbus/USS
3.5.15
Bit-Oriented Function Code Conversions
Function Code 02
The bit-oriented function code 02 permits read-only access to the SIMATIC memory areas memory bits, and inputs. You can use the Conversion DB to specify from/to which Modbus address access is made to memory bits and inputs. Furthermore, it is possible to assign a certain data element at which access in the SIMATIC memory area is to commence. The Modbus address areas and SIMATIC memory areas of FC 02 may be selected independently from those of FC 01, 05, and 15.
Table 3-26 Address Areas Modbus Address in Transmission Message From kkkkk To lllll From nnnnn To rrrr Inputs Memory bits SIMATIC Memory Area Commence at M vvvv.0 Commence at I sssss.0
3.5.16
Register-Oriented Function Code Conversions
Function Codes 03, 06, 16

The register-orientated function codes 03, 06, and 16 permit read and write access to the SIMATIC memory area data blocks. Calculation of the required data block number is carried out in two steps. 1) You can use the parameter assignment tool to specify a base DB number. This base DB is the first DB which can be accessed. 2) The Modbus Start_Register address (Register Number) transmitted in the message is interpreted as follows:
3-71
Modbus/USS
Resulting DB Number The resulting DB number which is then accessed is calculated as follows: Base DB number + Offset DB number. This means that it is possible to access a data block area consisting of 128 consecutive data blocks within the entire addressable data block area (65535 DBs).
Word Number in DB
Via the word number it is possible to address the area from DBW 0 to DBW 1022 within each data block. The DBs which are normally organized in bytes are in this instance interpreted by the driver word-by-word as follows.
Function Code 04
The register-orientated function code 04 permits read-only access to the SIMATIC memory area data blocks. The mode and operation of this access is described in function codes 03, 06, and 16. Function code 04 has its own base DB number available for free parameter assignment with the conversion DB. This will enable you to select a second independent area consisting of 128 DBs. These DBs have read-only access.
3-72
Modbus/USS
3.5.17
Enable/ Disable Write Access
Function Codes 05, 06,15, 16

For the write function codes 05, 06, 15, and 16, it is possible to disable or limit access to the relevant SIMATIC memory areas. You can use the Conversion DB to specify an area which enables write access from the Modbus master system. If the master tries to access any SIMATIC memory areas which are outside the enabled area, then access is denied by means of an error message (exception). Table 5-9 shows Enable Write Access.
Table 3-27 Enable Write Access 38.0 40.0 DB_Number _FC_04 DB_Min WORD W#16#0 WORD W#16#0 W#16#2 W#16#1 DB Min. DB Number Used Max. DB Number Used Min. M Memory Used Max. M Memory Used Min. Q Memory Used Max. Q Memory Used 04 Limits
42.0
DB_Max
WORD W#16#0
W#16#6
44.0
M_Min
WORD W#16#0
W#16#1F4
46.0
M_Max
WORD W#16#0
W#16#4B0
48.0
Q_Min
WORD W#16#0
W#16#0
50.0
Q_Max
WORD W#16#0
W#16#64
3-73
Modbus/USS
3.5.18
Conversion of Modbus Addresses for Bit Functions
Function Codes 01, 05, 15

The bit-oriented function codes 01, 05, and 15 allow both read and write access to the SIMATIC memory areas memory bits, outputs, timers, counters; Timers and counters are read-only with FC01. You can use the conversion DB to specify from/to which Modbus address access is made to memory bits, outputs, timers, and counters. Furthermore, it is possible to assign a certain data element at which access in the SIMATIC memory area is to commence.
Overview of FC 01, 05, 15

Conversion of Modbus Addressing for FC 01, 05, 15 Parameter DB SIMATIC Area Memory Bits Modbus Address in transmission message (Bit number) SIMATIC memory area Memory bits (Memory bits) SIMATIC Area Outputs Modbus Address in transmission message (Bit number) SIMATIC memory area Outputs (Output byte number) SIMATIC Area Timers Modbus Address in transmission message (Bit Number) SIMATIC memory area Timers (Timer Number) SIMATIC Area Counters From eeee To ffff Commence at To ttttt from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus Address Including this Modbus Address Commence at this timer (= 16 bit word) From cccc To dddd Commence at Q ooooo.0 from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus Address Including this Modbus Address Commence at this output byte Commence at M uuuuu.0 From aaaa To bbbb from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus address Including this Modbus address Commence at this memory byte Input Meaning
3-74
Modbus/USS
Conversion of Modbus Addressing for FC 01, 05, 15 Modbus Address in transmission message (Bit Number) SIMATIC memory area Counter (Counter number) From gggg To hhhh Commence at C zzzzz from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus Address Including this Modbus Address Commence at this counter (= 16 bit word)
From/To Modbus Address

You can use the From address to set the Modbus address which is the start of the appropriate area; for example, memory bits, outputs, etc. (= first bit number of area). You can use the To address to set the Modbus address which is the end of the appropriate area; for example, memory bits, outputs, etc. (= last bit number of area). The From/To addresses refer to the Modbus address in the transmission message (bit numbers commencing at 0) for function codes FC 01, 05, and 15. The individual From/To areas must not overlap. Gaps between the individual From/To areas are permitted.
Commence At SIMATIC Memory Area

You can use the Commence At input to specify the start of the SIMATIC area where the From / To Modbus area is displayed (= first memory byte-, output byte-/ timer-/ counter number of SIMATIC area).
Example of FC 01, 05, 15

Conversion of Modbus Addressing for FC 01, 05, 15 Parameter DB SIMATIC Area Memory Bits Modbus Address in transmission message (Bit number) SIMATIC memory area Memory bits (Memory bits) SIMATIC Area Outputs Commence at M 1000.0 From 0 To 2047 from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus address Including this Modbus address Commence at this memory byte Input Meaning
3-75
Modbus/USS
Conversion of Modbus Addressing for FC 01, 05, 15 Modbus Address in transmission message (Bit number) SIMATIC memory area Outputs (Output byte number) SIMATIC Area Timers Modbus Address in transmission message (Bit Number) SIMATIC memory area Timers (Timer Number) SIMATIC Area Counters Modbus Address in transmission message (Bit Number) SIMATIC memory area Counter (Counter number) from 4256 to 4415 commence at C 120 from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus Address Including this Modbus Address Commence at this counter (= 16 bit word) From 4096 To 4255 Commence at T 100 from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus Address Including this Modbus Address Commence at this timer (= 16 bit word) From 2048 To 2559 Commence at Q 256.0 from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus Address Including this Modbus Address Commence at this output byte
The Modbus addresses from 0 to 2047 access the SIMATIC memory bits commencing at memory bit M 1000.0; in other words, length of area = 2048 bits = 256 bytes, which means last memory bit = M 1255.7. The Modbus addresses from 2048 to 2559 access the SIMATIC outputs commencing at output Q 256.0; in other words, length of area = 512 bits = 64 bytes, which means last output bit = Q 319.7. The Modbus addresses from 4096 to 4255 access the SIMATIC timers commencing at timer T 100; in other words, length of area = 160 bits = 10 words, this means last timer = T 109. The Modbus addresses from 4256 to 4415 access the SIMATIC counters commencing at counter C 120; in other words, length of area = 160 bits = 10 words, this means last counter = C 129.
3-76
Modbus/USS
Overview of FC02
Conversion of Modbus Addressing for FC 02 Parameter DB SIMATIC Area Memory Bits Modbus address in transmission messages (Bit number) SIMATIC memory area memory bits SIMATIC Area Inputs Modbus address in transmission message (Bit number) SIMATIC memory area Inputs (Input byte number) From To Commence at I from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus address Including this Modbus address Commence at this input byte Commence at From from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus address Including this Modbus address Commence at this memory byte Input Meaning
To
From/To Modbus Address

You can use the From address to set the Modbus address which is the start of the appropriate area such as memory bits, inputs (= first bit number of area). You can use the To address to set the Modbus address which is the end of the appropriate area (= last bit number of area). The From/To addresses refer to the Modbus address in the transmission message (bit numbers commencing at 0) for function code FC 02. The individual From/To areas must not overlap. Gaps between the individual From/To areas are permitted.
Commence At SIMATIC Memory Area

You can use the Commence At input to specify the start of the SIMATIC area where the From/To Modbus area is displayed (= first memory byte-, input byte number of SIMATIC area).
3-77
Modbus/USS
Example of FC 02
Conversion of Modbus Addressing for FC 02 Parameter DB SIMATIC Area Memory Bits Modbus address in transmission messages (Bit number) SIMATIC memory area memory bits SIMATIC Area Inputs Modbus address in transmission message (Bit number) SIMATIC memory area Inputs (Input byte number) From 4096 To 5119 Commence at I 128.0 from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus address Including this Modbus address Commence at this input byte Commence at M 0.0 From 0 from 0 to 65535(decimal) from 0 to 65535(decimal) from 0 to 65535(decimal) Starting with this Modbus address Including this Modbus address Commence at this memory byte Input Meaning
To 4095
The Modbus addresses from 0 to 4095 access the SIMATIC memory bits commencing at memory bit M 0.0 such as: length of area = 4096 bits = 512 bytes, which means last memory bit = M 511.7. The Modbus addresses from 4096 to 5119 access the SIMATIC inputs commencing at input I 128.0 such as: length of area = 1024 bits = 128 bytes, which means last input bit = I 255.7.
Note The input of value commence at memory bit is completely independent of input commence at memory bit for function codes 01, 05, and 15. This means that with Function Code 02 it is possible to use a second SIMATIC memory bits area (read-only), which is completely independent from the first.
3-78
Modbus/USS
3.5.19
Conversion of Modbus Addresses for Register Functions
Overview of FC 03,06, 16
Conversion of Modbus Addressing for FC 03, 06, 16 Parameter DB SIMATIC Area Data Blocks Modbus Address= 0 in transmission message (register number) means access to: SIMATIC memory area Data Block Commence at DB from 1 to 65535(decimal) Commence at this data block Commence at DBW 0 (= base DB number) Input Meaning
commence at DB
You can use the Commence at DB input to specify the first data block of the SIMATIC area which is to be accessed (= base DB Number). This DB is accessed when the register number of the Modbus message has value 0, starting at data word DBW 0. Higher Modbus register numbers access the following data words / data blocks. Up to 127 successive DBs can be addressed. The driver interprets bits 9 -15 of the Modbus register number for the access of the individual successive DBs.
3-79
Modbus/USS
Application Example
Conversion of Modbus Addressing for FC 03, 06, 16 Parameter DB SIMATIC Area Data Blocks Modbus Address= 0 in transmission message (register number) means access to: SIMATIC memory area Data Block Commence at DB 800 from 1 to 65535(decimal) Commence at this data block Commence at DBW 0 (as base DB number) Input Meaning
You can use Modbus register address 0 to access data block 800 commencing at DBW 0 in the SIMATIC system. Higher Modbus register addresses ( 512, etc.) access the following DBs such as DB 801 and so on.
Overview of FC 04
Conversion of Modbus Addressing for FC 04 Parameter DB SIMATIC Area Data Blocks Modbus Address=0 in transmission message(register number) means access to: SIMATIC memory area Data Blocks Commence at DB from 1 to 65535(decimal) Commence at this data block Commence at DBW 0 (as base DB number) Input Meaning
Commence at DB You can use the Commence at DB input to specify the first data block of the SIMATIC area which is to be accessed (= base DB Number). This DB is accessed when the register number of the Modbus message has value 0, starting at data word DBW 0. Higher Modbus register numbers access the following data words / data blocks. Up to 127 successive DBs can be addressed. The driver interprets bits 9-15 of the Modbus register number for the access of the individual successive DBs.
3-80
Modbus/USS
Note The input of value commence at DB is completely independent of input Commence at DB for function codes 03, 06, and 16. This means that with FC 04 it is possible to use a second SIMATIC data block area (read-only), which is completely independent from the first.
Example of FC 04
Conversion of Modbus Addressing for FC 04 Parameter DB SIMATIC Area Data Blocks Modbus Address=0 in transmission message(register number) means access to: SIMATIC memory area Data Blocks Commence at DB 1200 from 1 to 65535(decimal) Commence at this data block Commence at DBW 0 (as base DB number) Input Meaning
You can use Modbus register address 0 to access data block 1200 commencing at DBW 0 in the SIMATIC system. Higher Modbus register addresses ( 512, 1024, etc.) access the following DBs such as DB 1201, 1202 and so on.
3-81
Modbus/USS
3.5.20
Limits for Write Functions
Overview of FC 05, 06, 15, 16

SIMATIC Limits for Write Access (FC 05, 06, 16) Parameter DB Data blocks DB: Resulting DB number DB MIN DB MAX Input from 1 to 65535 from 1 to 65535 Meaning First enabled DB Last enabled DB MAX=0 all DBs disabled Memory bits M (Memory byte number) M MIN M MAX from 0 to 65535 from 1 to 65535 First enabled memory byte Last enabled memory byte MAX=0 all memory bits disabled Outputs Q (Output byte number) Q MAX from 1 to 65535 Q MIN from 0 to 65535 First enabled output byte Last enabled output byte MAX=0 all outputs disabled
MIN/MAX SIMATIC Memory Area

For the write function codes, it is possible to specify lower and upper access limits (MIN/MAX). Write access is permitted within this enabled area only. If the value for the upper limit is 0, it means that the entire area is disabled. When selecting the size of the enabled area, remember which CPU it refers to. If the master attempts a write access to an area which is outside the upper / lower limit, this is rejected by the module with an error message. The MIN/MAX values for the data block area must be specified as resulting DB numbers.
3-82
Modbus/USS
Application Example for FC 05, 06, 16

SIMATIC Limits for Write Access (FC 05, 06, 16) Parameter DB Data blocks DB: Resulting DB number MIN 600 MAX 699 Input 1 to 65535 1 to 65535 Meaning First enabled DB Last enabled DB MAX=0 all DBs disabled Memory bits M (Memory byte number) MIN 1000 MAX 1127 0 to 65535 1 to 65535 First enabled memory byte Last enabled memory byte MAX=0 all memory bits disabled Outputs Q (Output byte number) MAX 319 1 to 65535 MIN 256 0 to 65535 First enabled output byte Last enabled output byte MAX=0 all outputs disabled
SIMATIC data blocks DB 600 to DB 699 can be accessed with write function codes (FC 06, 16). SIMATIC memory bytes MB 1000 to MB 1127 (FC 05, 15) can be accessed with write function codes. SIMATIC outputs output bytes QB 256 to QB 319 (FC 05, 15) can be accessed with write function codes.
3-83
Modbus/USS
3.6
Diagnostics
3.6.1
Diagnostic Information of the Status LEDs

The following status LEDs are located on the front panel of the ET 200S Serial Interface Modbus/USS Module: TX (green): Lights up when ET 200S Serial Interface Modbus/USS Module is sending data over the interface RX (green): Lights up when ET 200S Serial Interface Modbus/USS Module is receiving data over the interface SF (red): Indicates one of the following possible faults:
Hardware fault Firmware fault Parameterization error(s) Wire break or disconnected cable between the ET 200S Serial Interface Modbus/USS Module and the communication partner: detected only when using RS-422 interface connections with Receive Line Initial State parameter = R(A) 5V / R(B) 0V. Communication errors (parity, framing errors, buffer overflow)
3-84
Modbus/USS
3.6.2
Structure of the Function Block Diagnostic Messages

Every function block has a STATUS parameter for error diagnostics. Regardless of which function block is used, the STATUS message numbers always have the same meaning. Figure 3-10 shows the structure of the STATUS parameter.
Bit No. 15 STATUS
13 12
Reserve
Event class
Event number (Error number)
Figure 3-10
Structure of the STATUS Parameter
Example: Figure 3-11 shows the contents of the STATUS parameter for the event Request aborted due to complete restart, restart, or reset (event class 1EH, event number 0DH).
Event: Request aborted due to complete restart, restart, or reset 24 STATUS x x x 1 1 1 1 20 27 0 0 0 0 0 1 1 0 20 1
Reserve Figure 3-11
Event class: 1EH
Event number: 0DH
Example: STATUS Parameter for Event Class 1EH, Event 0DH
Diagnostic Messages of the Function Blocks

Tables 6-1 and 6-2 describe the event classes, the event number definitions, and the recommended corrective actions for each error condition.
Calling the SFCERR Variable

The SFCERR variable contains more information on errors 14 (1E 0EH) and 15 (1E 0FH) in event class 30. Load the SFCERR variable from the instance DB that relates to the corresponding function block. Error messages entered in the SFCERR variable are described in the section on the system functions SFC14 DPRD_DAT and SFC15 DPWR_DAT in the System Software for S7-300/400, System and Standard Functions reference manual.
3-85
Modbus/USS
Event Class 5 (05H): Error while processing CPU request Event Number (05) 02H 2 Event Number (Decimal) Event Corrective Action
Request not permitted in this operating mode of the ET 200S Serial Interface Modbus/USS Module (for example, device interface is not parameterized). Invalid message frame length.
Analyze diagnostics alarm and recover error accordingly. The message frame is greater than 200 bytes in length. The rest of the message frame (> 256 bytes) is received by the ET 200S Serial Interface Modbus/USS Module, and the first part of the message frame is rejected. Select a smaller message frame length.
(05) 0EH
14
(05) 51H
81
Frame sequence error when ET 200S Serial Interface Modbus/USS Module communicated with CPU. Error occurred during a receive message transfer from the ET 200S Serial Interface Modbus/USS Module to the CPU.
The module and CPU aborted the transfer. Retry the receive job; the ET 200S Serial Interface Modbus/USS Module will re-send the receive message.
3-86
Modbus/USS
Event Class 8 (08H): Receive Error Event Number (08) 06H 6 Event Number (Decimal) Event Corrective Action
Character delay time exceeded;two Partner device too slow successive characters were not received or faulty. Check for within character delay time. malfunction at partner device, possibly using an interface test device which is switched into the transmission line. Overflow of receive buffer in Master during reception of the reply message. Transmission error (parity error, stop bit error, overflow error) detected. Check protocol settings for the slave. Faults on the transmission line cause message frame repetitions and lower user data throughput. Danger of an undetected error increases. Correct fault by changing system setup or line installation. Check connecting cable of communications partner or check whether both devices have same setting for baud rate, parity and number of stop bits.
08 0Ah (08) 0CH
10 12
(08) 0DH
13
BREAK: Receive line to partner is interrupted. Parity error: If SF (red) LED is lit up, there is a break on the line between the two communications partners.
Reconnect line or switch partner on again. Check connecting cable of communications partner or check whether both devices have same setting for baud rate, parity and number of stop bits. Change your system setup or the line routing.
(08) 10H
16
3-87
Modbus/USS
Event Class 8 (08H): Receive Error Event Number (08) 11H 17 Event Number (Decimal) Event Corrective Action
Character frame error: If SF (red) LED is lit up, there is a break on the line between the two communications partners.
Check connecting cable of communications partner or check whether both devices have same setting for baud rate, parity and number of stop bits. Change your system setup or the line routing.
(08) 12H
18
More characters were received after the Serial Interface had set CTS to OFF.
Reparameterize communications partner or read data from Serial Interface more quickly. Check if transmission line is interrupted (interface analyzer may be required). Check if the protocol parameters transmission rate, amount of data bits, parity, and amount of stop bits have the same settings in module and the link partner. Check if the value for the reply monitoring time set with PtP_PARAM is big enough. Check if the specified slave address exists.
08 30H
48
Master: A request message has been sent and the reply monitoring time has elapsed without the start of a reply message being recognized.
Slave:Broadcast not allowed with this function code.
The Modbus master system is allowed to use Broadcast only for the function codes enabled for this purpose.
3-88
Modbus/USS
Event Class 8 (08H): Receive Error Event Number 08 31H 49 Event Number (Decimal) Event Corrective Action
Master: The first character in the reply message from the slave is different from the slave address sent in the request message (for operating mode Normal).
The wrong slave has replied. Check if the transmission line is interrupted (interface analyzer may be required). This function code cannot be used for this driver. Limit maximum amount of bits to 2040, maximum amount of registers to 127. Access to SIMATIC timers/counters only in 16 bit intervals. Correct amount of bits/ registers or byte_count. Only use codings 0000Hex or FF00Hex for FC05. Only use subcode 0000Hex for FC08. Check CRC checksum generation by Modbus master system. Increase the time-out to the slave reply message for the Modbus master system.
Slave: Received function code not allowed. 08 32H 50 Maximum amount of bits or registers exceeded, or amount of bits cannot be divided by 16 when accessing SIMATIC memory areas Timers or Counters.
08 33H
51
Amount of bits or registers for function codes FC 15/16 and message element byte_count do not match. Illegal bit coding recognized for set bit / reset bit. Illegal diagnostic subcode ( 0000Hex) recognized for function code FC 08 Loop Back Test. The internally-generated value of the CRC 16 checksum does not match the received CRC checksum. Message sequence error: The Modbus master system sent a new request message before the last reply message was transferred by the driver.
08 34H
52
08 35H
53
08 36H
54
08 37H
55
3-89
Modbus/USS
Event Class 14 (0EH) General Processing Errors <Parameter Assignment> Event Number 0E20H 32 Event Number (Decimal) Event Corrective Action
For this data link, the amount of data bits Correct parameter must be set to 8. assignment of the The driver is not ready to run. driver. The multiplication factor set for the character delay time is not within the value range of 1 to 10. The driver is operating with a default setting of 1. The operating mode set for the driver is illegal. Normal operation or Interference Suppression must be specified. The driver is not ready to run. Master: An illegal value for the reply monitoring time has been set: Valid values are 50 to 655000ms. The driver is not ready to run. Correct parameter assignment of the driver. Correct parameter assignment of the driver.
0E21H
33
0E22H
34
0E23H
35
Correct parameter assignment of the driver.
Slave: An illegal value has been set for the slave address. Slave address 0 is not allowed. The driver is not ready to run. 0E2EH 46 An error occurred when reading the interface parameter file. The driver is not ready to run.
Correct parameter assignment of the driver. Restart Master (Mains_ON)
Event Class 14 (0EH) General Processing Errors <Processing of a S_SEND Job> Event Number 0E 40 H 0E 41H 64 65 Event Number (Decimal) Event Value specified for LEN at S_SEND too small. Corrective Action Minimum length is 2 bytes.
Value specified for LEN at S_SEND too The minimum length for small. A greater length is required for the this function code is 6 transferred function code. bytes. Transferred function code is illegal. The only function codes which are permitted are those listed in section 3.3 Only use Slave Address 0 for the suitable function codes.
0E 42H
66
0E 43H
67
Slave Address 0 (= Broadcast) not permitted with this function code.
3-90
Modbus/USS
Event Class 14 (0EH) General Processing Errors <Processing of a S_SEND Job> Event Number 0E 44H 68 Event Number (Decimal) Event The value of the transferred Amount of Bits is not within the range 1 to 2040. The value of the transferred Amount of Registers is not within the range 1 to 127. Function codes 15 or 16: The values of the transferred Amount of Bits and/or Amount of Registers are not within the range 1 to 2040 and/or 1 to 127. Function codes 15 or 16: The LEN for S_SEND does not correspond to the transferred Amount of Bits and/or Amount of Registers. LEN is too small. Corrective Action The Amount of Bits must be within the range 1 to 2040. The Amount of Registers must be within the range 1 to 127. The Amount of Bits and/or Amount of Registers must be within the range 1 to 2040 and/or 1 to 127. Increase LEN for SEND until a sufficient amount of user data is transferred to the module. A larger amount of user data must be transferred to the module because of the Amount of Bits and/or Amount of Registers. The only permitted codes are SET BIT(FF00H) DELETE BIT OR 0000H. The only permitted code is Diagnostic Code 0000H. Refer to the manual on the max length size for each function code
0E 45H
69
0E 46H
70
0E 47H
71
0E 48H
72
Function code 5: The code specified in SEND source DB for Set Bit (FF00H) or Delete Bit (0000H) is wrong. Function code 8: The code specified in SEND source DB for Diagnostic Code is wrong. The length for this function code is greater than the max length.
0E 49H
73
0E 4AH
74
3-91
Modbus/USS
Event Class 14 (0EH) General Processing Errors <Receive Evaluation> Event Number 0E 50 H 80 Event Number(Decimal) Event Master received a reply without a send. Corrective A slave or another master is on network. Check if the transmission line is interrupted(interface analyzer may be required). 0E 51 H 81 Function code incorrect: The function code received in the reply message is different from the sent function code. Byte Underflow: Amount of characters received is less than should have resulted from the byte counter of the reply message, or is less than expected with this function code. Byte Overflow: Amount of characters received is more than should have resulted from the byte counter of the reply message, or is more than expected with this function code. Byte counter wrong: The byte counter received in the reply message is too small. Byte counter wrong: The byte counter received in the reply message is wrong. Echo wrong: The data of the reply message (amount of bits, ...) echoed from the slave are different from the data sent in the request message. CRC Check incorrect: An error has occurred on checking the CRC 16 checksum of the reply message from the slave. Check Slave Device
0E 52H
82
Check Slave Device
0E 53H
83
Check Slave Device
0E 54H
84
Check Slave Device
0E 55H
85
Check Slave Device
0E 56H
86
Check Slave Device
0E 57H
87
Check Slave Device
3-92
Modbus/USS
Event Class 14;. (0EH) General Processing Errors <Receive Exception Code Message> Event Number 0E 61H 0E 62H 0E 63H 0E 64H 0E 65H 0E 66H 0E 67H 97 98 99 100 101 102 103 Event Number (Decimal) Event Corrective Action
Reply message with Exception Code 01: See the manual for Illegal Function your slave device. Reply message with Exception Code 02: See the manual for Illegal Data Address your slave device. Reply message with Exception Code 03: See the manual for Illegal Data Value your slave device. Reply message with Exception Code 04: See the manual for Failure in associated device your slave device. Reply message with Exception Code 05: See the manual for Acknowledge your slave device. Reply message with Exception Code 06: See the manual for Busy, Rejected Message your slave device. Reply message with Exception Code 07: See the manual for Negative Acknowledgment your slave device.
Event Class 30 (1EH): Error During Communication between Serial Interface and CPU Event Number (1E) 0DH (1E) 0EH 13 14 Event Number (Decimal) Event Corrective Action
Request aborted due to complete restart, restart, or reset. Static error when the DP_RDDAT SFC was called. Return value RET_VAL of SFC is available for evaluation in SFCERR variable in instance DB. Static error when the DP_WRDAT SFC was called. Return value RET_VAL of SFC is available for evaluation in SFCERR variable in instance DB. Static error when the RD_LGADR SFC was called. Return value RET_VAL of SFC is available for evaluation in SFCERR variable in instance DB. Parameter out of range. Load SFCERR variable from instance DB.
(1E) 0FH
15
Load SFCERR variable from instance DB.
(1E) 10H
16
Load SFCERR variable from instance DB.
(1E) 20H
32
Change the Function Block parameter input to be within the acceptable range. Stay within the value range of 1 to 256 bytes.
(1E) 41H
65
Number of bytes set in LEN parameter of FBs is illegal.
3-93
Modbus/USS
3.6.3
PROFIBUS Slave Diagnosis

The slave diagnosis complies with the EN 50170, Volume 2, PROFIBUS standard. It can be displayed with STEP 5 or STEP 7 for all DP slaves that comply with the standard depending on the DP master. The PROFIBUS slave diagnosis contains module diagnosis, module status, and channel-specific diagnosis. Refer to the chapter Commissioning and Diagnostics in this manual for more information about DP slave diagnostic information.
Channel-Specific Diagnosis
The channel-specific diagnosis gives information on channel errors of modules and begins after the module status. Table 3-28 lists the channel-specific error types.
Table 3-28 ET 200S Serial Interface Modbus/USS Module Channel Error Types Error Type 00110: Wire break 00111: Overflow 01000: Underflow Description Broken or disconnected wire. Buffer overflow; message length overflow. Message with 0 length sent. Recommended Action Check the wiring to the terminals. Check the cable to the partner. The S_RCV FB must be called more frequently. Check why communications partner is sending message frames without user data. Replace the module. Adjust the parameter assignment. Check the communication setup.
01001: Error 10000: Parameter assignment error 10110: Message error
Internal module error occurred. Parameters have not been assigned to the module. Framing error; parity error.
3.6.4
Modbus Slave Diagnostic Functions

The Modbus communications FB has the following two output parameters which indicate occurred errors: Parameter ERROR_NR Parameter ERROR_INFO
ERROR_NR, ERROR_INFO
Errors are indicated at the ERROR_NR output. Additional details regarding the error in ERROR_NR are displayed at the output ERROR_INFO.
3-94
Modbus/USS
Deleting the Errors

The errors are deleted with a rising edge at START. If necessary, the error displays may be deleted by the user at any time.
FB Error Codes
ERROR_No 1 to 9 Error during Initialization FB and CP Error numbers 1...9 indicate initialization with error. Parameter START_ERROR is 1. Modbus communication to the master system is not possible. ERROR_No 10 to 19 Error during Processing of a Function Code Error numbers 10...19 indicate an error during processing of a function code. The module transmitted an illegal processing job to the communications FB. The error is also reported to the driver. Subsequent processing jobs continue to be processed. ERROR_No 90 to 99 Other Errors A processing error has occurred. The error is not reported to the driver. Subsequent processing jobs continue to be processed.
3-95
Modbus/USS
3.6.5
Errors
Errors during Initialization Error Number (Decimal) 0 1 2 0 SFC51->RET_VAL S_SEND->STATUS, S_RCV->STATUS ERROR_INFO Description Corrective Action
no error Error when reading SZL with SFC51. Timeout when initializing module or error when initializing module (Error in S_SEND job). Analyze RET_VAL in ERROR_INFO, eliminate cause. Check if protocol Modbus Slave has had parameters assigned on this interface. Check whether the ID specified on the communications FB is correct. Analyze ERROR_INFO.
Errors during Processing of Function Codes Error Number (Decimal) 11 ERROR_INFO Description Corrective Action
Start Address
Illegal start address transferred by the driver to communications FB. Illegal amount of registers transferred by the driver to communications FB: Amount of registers = 0. Illegal amount of registers transferred by the driver to communications FB: Amount of registers > 128.
Check Modbus address of Modbus master system.
12
Amount of Registers
Check amount of registers of Modbus master system, if required restart module (Mains_ON)
13
Amount of Registers
Check amount of registers of Modbus master system, if required restart module (Mains_ON)
14
Memory bits M -End Address
Attempted access to Reduce Modbus start address and/or access SIMATIC memory area length in Modbus master system. Memory Bits in excess of range end. Attention: Range length in SIMATIC CPU is CPU type-dependent.
3-96
Modbus/USS
Error Number (Decimal) 15
ERROR_INFO
Description
Corrective Action
Outputs Q - End Address Inputs I - End Address
Attempted access to Reduce Modbus start address and/or access SIMATIC memory area length in Modbus master system. Outputs in excess of range end. Attention: Range length in SIMATIC CPU is CPU type-dependent. Attempted access to Reduce Modbus start address and/or access SIMATIC memory area length in Modbus master system. Timers in excess of range end. Attention: Range length in SIMATIC CPU is CPU type-dependent. Attempted access to Reduce Modbus start address and/or access SIMATIC memory area length in Modbus master system. Counters in excess of range end. Attention: Range length in SIMATIC CPU is CPU type-dependent. Illegal SIMATIC memory area transferred by the driver to communications FB. Error during access to SIMATIC I/Os. If required, restart module (Mains_ON)
16
Timers T - End Address
17
Counters C - End Address
18
19 20 21 22 23 DB# DB# DB# DB#
Check if required I/Os exist and are error-free. Add DB to your project Increase DB length
DB does not exist DB length invalid
DB# is below minimum Change DB limit minimum value DB limit value DB# is above the maximum DB limit value M memory below minimum limit M memory above maximum limit Q memory below minimum limit Q memory above maximum limit Change DB limit maximum value
24 25 26 27
M memory address M memory address Q memory address Q memory address
Change M memory minimum limits in conversion DB Change M memory maximum limits in conversion DB Change Q memory minimum limits in conversion DB Change Q memory maximum limits in conversion DB
3-97
Modbus/USS
Other Errors Error Number (Decimal) 90 ERROR_INFO Description Corrective Action
S_SEND->STATUS
Error during transmission of an acknowledgment message to the driver with S_SEND. Error when reading SYSTAT with S_RCV (STATUS).
Analyze STATUS information.
94
S_RCV->STATUS
Analyze STATUS information.
3-98
Modbus/USS
3.7
USS Master
3.7.1
USS Protocol
The USS protocol is a simple serial data transfer protocol which is fully tailored to the requirements of drive technology. A detailed description of the protocol specification, the physical interface, the bus structure as well as a definition of the transferred net data for drive applications are documented in the specification Universal serial interface protocol USS protocol (Part Number E20125-D0001-S302-A1-7600). The USS protocol defines an access technique according to the master-slave principle for communications via a serial bus. One master and up to 31 slaves can be connected to the bus. The individual slaves are selected by the master using an address character in the message. A slave can never transmit without first being initiated by the master so that direct information transfer between individual slaves is not possible. Communications utilize the half-duplex mode. The master function cannot be transferred; USS is a single-master system.
Message Structure
Each message starts with the start character (STX), followed by the length information (LGE) and the address byte (ADR). The data fields then follow. The message is terminated by the Block Check Character (BCC).
STX LGE ADR 1 2 ... n BCC
For single-word data (16 bit) in the net data block, the high byte is sent first, followed by the low byte. Correspondingly, for double-word data the high word is first sent followed by the low word. The protocol does not identify tasks in the data fields.
Data Coding
The information is coded as follows: STX: 1 byte, Start of Text, 02H LGE: 1 byte, contains the message length as binary number ADR: 1 byte, includes the slave address and the message type. Binary-coded data fields: Each one byte, contents are task-dependent BCC: 1 byte, Block Check Character
3-99
Modbus/USS
Data Transfer Procedure

The master ensures cyclic message data transfer. The master addresses all of the slave nodes one after another with a task message. The addressed nodes respond with a response message. In accordance with the master-slave procedure, the slave must send the response message to the master after it has received the task message before the master can address the next slave node.
General Structure of the Net Data Block

The net data block is sub-divided into two areas: Parameter (PKW) and Process Data (PZD).
STX LGE ADR Parameter (PKW) Process data (PZD) BCC
Parameter Area (PKW)

The PKW area handles parameter transfer between two communication partners (such as open-loop control and drive). This involves, for example, reading and writing parameter values and reading parameter descriptions and associated texts. The PKW interface usually involve tasks for operator control and display, service and diagnostics.
Process Data Area (PZD)

The PZD area includes signals required for the automation: Control words and setpoints from the master to the slave Status words and actual values from the slave to the master. The contents of the Parameter Area and the Process Data Area are defined by the slave drives. Refer to drive documentation for this information.
3.7.2
Configuration and Parameterization

The following parameters and operating modes must be set for the driver using the hardware configuration. Diagnostic alarm Transmission rate
3-100
Modbus/USS
3.7.3
Functional Overview
The blocks handle net data transfer cyclically with up to 31 drive slaves in accordance with the sequence specified in the polling list (Parameter Sets DB). Only one request to a slave is active at any one time. The net data for each slave are stored by the user in a data block (Net Data DB) and retrieved from there. They are transferred to and retrieved from the communication processor as defined by the program in the polling list via another data area (Communication Processor DB). Two function calls are required for this procedure (one transmit and one receive block). Another function supports creation and pre-assignment of the data blocks required for communication. Performance features: Creation of data areas for communication depending on the bus configuration Pre-assignment of the polling list Frame structure according to the USS specification Net data exchange may be parameterized in accordance with the required net data structure Execution and monitoring of PKW requests Handling of parameter change reports Monitoring of the overall system and error handling Various net data structures can be used to transmit net data Depending on the selected structure, the net data have a PZD Area for the process data and a PKW Area for parameter processing. The PKW Area allows the master to read and write parameter values and the slave to signal parameter changes in the form of parameter change reports. The PZD Area contains signals necessary for process control, such as control words and setpoints from the master to the slave and status words and actual values from the slave to the master. The proper order of function calls is S_USST, S_SEND, S_RCV, S_USSR. This is important because the outputs from the functions S_SEND and S_RCV are only valid for the current PLC cycle. Figure 7-1 shows how data travels between the user control program and the USS slave.
3-101
Modbus/USS
User Control Program (OB1, etc)
Data to slave
Data from Slave
Net Data DB
S-USST FC
...
Parameter Set DB
...
S-USSR FC
Communication Processor DB
S-SEND FB
S-RECV FB
ET200S SI Modbus/USS Module
USS Slave
Figure 3-12 Data travel between user control program and USS slave
3-102
Modbus/USS
3.7.4
FC17 S_USST: Transmitting Data to a Slave

The S_USST FC handles transmission of the net data (PZD and any PKW data) to the slaves depending on the net data structure used. It takes the parameter set of the current slave from the polling list (Parameter Set DB) and its transmit data from the Net Data DB. It evaluates the communication control word for the current slave (initiation of a PKW request or acknowledgment of a parameter change report), completes the USS transmit data and transfers them to the transmit buffer of the Communication Processor DB. Finally, it initiates transmission of the net data to the slave using an S_SEND FB. If the function finds a parameterization error in the Parameter Set DB, then an error signal is stored in the Pafe 2-byte of the Net Data DB. The FC17 is called once per PLC cycle. The diagram below shows the program structure of S_USST.
3-103
Modbus/USS
S_USST FC Communication processor DB Parameterization and status handling blocks DBPA SYPA SLPA Transmit buffer Receive buffer
OB1 Net Data DB
Communication control slave 1
Transmit slave 1
Receive slave 1
Parameter Sets DB System parameters Communication parameter set slaves 1 to n
3-104
Modbus/USS
STL Representation
LAD Representation
CALL DBPA = SYPA = SLPA =
S_USST EN DBPA SYPA SLPA
S_USST ENO
Note The parameters EN and ENO are only present in the graphical representation (LAD or FBD). To process these parameters, the compiler uses the binary result BR. The binary result is set to signal state 1 if the block was terminated without errors. If there was an error, then the BR is set to 0.
FC17 S_USST Parameters

Table 7-1 lists the parameters of the S_USST FC.
Table 3-29 S_USST FC Parameters Name DBPA SYPA Type Input Input Data Type INT INT Description Block number of the parameter sets DB Initial address of the system parameters in the parameter sets DB Initial address of the slave parameters in the parameter sets DB Comment CPU-specific (zero not allowed) 0 <= SYPA <= 8174
SLPA
Input
INT
0 <= SLPA <= 8184
3-105
Modbus/USS
3.7.5
FC18 S_USSR: Receiving Data from a Slave

The S_USSR FC handles receiving of the net data (PZD and any PKW data) from the slaves depending on the net data structure used. It takes the parameter set of the current slave from the polling list (Parameter Sets DB) and evaluates the status word of the Transmit block. If the current request has been completed without error (Bit 9 = 0 in the communication status word of Net Data DB), the receive data are transferred from the receive buffer of the Communication Processor DB to the Net Data DB, are evaluated and the communication status word in the Net Data DB is updated. If the current request has been completed with an error (Bit 9 = 1 in the communication status word the Net Data DB), the data of the current slave are not taken over from the receive buffer of the Communication Processor DB. The FC18 signals this in the communication status word of the Net Data DB and enters the cause of error in the communication error word. If the block detects a parameterization error in the Parameter Sets DB , an error signal is stored in the Pafe 1-byte of the Net Data DB. The FC18 is called once per PLC scan cycle. The diagram below shows the program structure of S_USSR.
3-106
Modbus/USS
S_USSR FC Communication processor DB Parameterization and status handling blocks DBPA SYPA SLPA Transmit buffer Receive buffer
OB1 Net Data DB
Communication control slave 1
Transmit slave 1
Receive slave 1
Parameter Sets DB System parameters Communication parameter set slaves 1 to n
Figure 3-13 Program Structure
3-107
Modbus/USS
STL Representation
LAD Representation
CALL DBPA = SYPA = SLPA =
S_USSR EN DBPA SYPA SLPA
S_USSR ENO
3-108
Modbus/USS
FC18 S_USSR Parameters

Table 7-2 lists the parameters of the S_USSR FC.
Table 3-30 S_USSR FC Parameters Name DBPA SYPA Type Input Input Data Type INT INT Description Block number of the Parameter Sets DB Initial address of the System Parameters in the Paremeter Sets DB Comment CPU-specific (zero not allowed) 0 <= SYPA <= 8174
SLPA
Input
INT
Initial address of the Slave 0 <= SLPA <= 8184 Parameters in the Parameter Sets DB
The parameters of the U_USST FC match the parameters of the S_USSR FC. The two functions access the same parameter set (system and slave parameters) in the Parameter Sets DB and must therefore be parameterized identically.
3.7.6
FC19 S_USSI: Initialization

The S_USSI FC is an optional function. When called on S7 system start-up, this FC generates the data blocks Communication Processor, Net Data and Parameter Sets required for communication. The DBPA is also pre-assigned. The S_USSI FC can be used for the generation and pre-assignment of the specified data areas only if all the slaves have the same net data structure. When called, the FC checks the plausibility of its parameters for the number of slaves, net data structure, number of start nodes and PKW repetitions. If the block detects an error, then generation and pre-assignment of the data blocks is not performed. The CPU goes into the STOP state and the user receives an error signal via the error byte of the S_USSI FC. After the parameterization error has been corrected, any data blocks already generated must be deleted before a restart. After the plausibility check, the block checks whether the data blocks to be generated already exist: If the data blocks to be generated do not already exist, they are generated and the DBPA is pre-assigned. f the data blocks to be generated do exist, the length of each data block is checked. If the DB is long enough, then the Parameter Sets DB is pre-assigned again and the contents of the Net Data DB and Communication Processor DB are deleted. If a DB is too short, then the CPU goes into the STOP state. The user can determine which DB caused the error by the status byte of the S_USSI FC. To correct the error, the three data blocks must be deleted
3-109
Modbus/USS
completely. The data blocks are then generated again on the next restart and the Parameter Sets DB is pre-assigned. S_USSI should be called one time during system start-up (OB100).
STL Representation
LAD Representation
CALL SANZ = TNU1 = PKW = PZD = DBND = DBPA = DBCP = WDH = ANZ =
S_USSI EN SANZ TNU1 PKW PZD DBND DBPA DBCP WDH ANZ
S_USSR ENO
3-110
Modbus/USS
FC19 S_USSI Parameters

Table 7-3 lists the parameters of the S_USSI FC.
Table 3-31 S_USSI FC Parameters Name SANZ Type Input Data Type INT Description Number of slaves with the same net data structure (system parameters in the DBPA) Initial node (station) number Number of PKW Comment 1 <= SANZ <= 31
TNU1 PKW
Input Input
INT INT
0 <= TNU1 <= 31 Number of words of the PKW interface 0, 3 or 4 Number of words of the PZD interface 0 <= PZD <= 16 CPU-specific (zero not allowed) CPU-specific (zero not allowed)
PZD
Input
INT
Number of PZD
DBND DBPA DBCP WDH
Input Input Input Input
INT INT INT INT
Net Data DB number Parameter Sets DB number
Communication Processor CPU-specific DB number (zero not allowed) Number of permissible repetitions of a PKW request Error byte 0 <= WDH <= 32767
ANZ
Output
BYTE
0: no error 1: number of slaves too large 2: impermissible net data structure 3: Parameter Sets DB too short 4: Net Data DB too short 5: error station number 6: Communication Processor DB too short 7: unassigned 8: repeat counter: incorrect value
3-111
Modbus/USS
3.7.7
Net Data DB
These data blocks can either be generated and pre-assigned with the S_USSI during CPU start-up (DBPA only) or entered manually. The Net Data DB is the interface between the communication and the user program. The user must provide this block empty and with sufficient length. Only the transmit data for a slave is placed in the transmit buffer of the Net Data DB assigned to the slave from the control program. The response data from the slave is taken from the appropriate receive buffer (after evaluation of bit 9 of communication control word). Status words allow communication to be checked and the control word permits initiation of a specific parameterization request. The communication interface contains the following data for each slave: Slave-related communication data (communication control, tracing, 6 data words) Buffer for the current PKW request (only if a PKW area exists) Transmit buffer for net data (maximum 20 data words) Receive buffer for net data (maximum 20 data words). The lengths of the transmit and receive buffers depend on the net data structure selected. If the PKW interface does not exist, the buffer for the current PKW request is not used. The total length of the Net Data DB required depends on the number of slaves and the net data structure used: Number of data words per slave = 2 x (PKW + PZD) + PKW + 6 where PKW is 0, 3, or 4 and 0 <= PZD <= 16 For example, a drive with a PKW area of 3 words and a PZD area of 2 words requires 19 data words in the Net Data DB. The Net Data DB is at most 1550 data words long for 31 slaves of the maximum net data length. DBW0 is reserved.
3-112
Modbus/USS
Slave Data Assignment in the Net Data DB with 4 Words in the PKW Area and 0 to 16 Words in the PZD Area
DBWn DBWn+2 DBWn+4 DBWn+6 DBW n+8 DBW n+10 DBW n+12 DBW n+14 DBW n+16 DBW n+18 DBW n+20 DBW n+22 DBW n+24 DBW n+26 DBW n+28 DBW n+30 DBW n+32 DBW n+34 ... DBW n+58 DBW n+60 DBW n+62 DBW n+64 DBW n+66 DBW n+68 DBW n+70 DBW n+72 DBW n+74 ...
Communication control word (KSTW) Internal Communication status word Communication error word Internal Pafe 1-byte, Pafe 2-byte Parameter ID Index Parameter value 1 Parameter value 2 Parameter ID Index Parameter value 1 Parameter value 2 Control word (STW) Main setpoint (HSW) Setpoint/suppl. control word Setpoint/suppl. control word ... Setpoint/suppl. control word Parameter ID Index Parameter value 1 Parameter value 2 Status word (ZSW) Main actual value (HIW) Actual value/ suppl. status word Actual value/ suppl. status word ... PZD16 PKE IND PWE1 PWE2 PZD1 PZD2 PZD3 PKE IND PWE1 PWE2 PKE IND PWE1 PWE2 PZD1 PZD2 PZD3
Communication control
Communication tracing Error status PKW attempt counter Parameter error
Buffer for current PKW request
PKW area
Transmit buffer
PZD area PZD4 (max. 16 words PZD)
PKW area
Receive buffer
PZD area PZD4 (max. 16 words PZD)
3-113
Modbus/USS
DBW n+98
Actual value/ suppl. status word
PZD16
S
(n = 2,4,6...)
Note If there is no PKW area, then both the Buffer for current PKW request and the PKW area in the Transmit Buffer do not exist.
Communication control word KSTW (DBW n)

Bits in the Communication Control Word coordinate the user program and the S_USST FC.
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Bit 0: Accept PKW request Bit 0 is set by the user if a new PKW request is in the transmit buffer and ready for processing.It is reset by the FC if the PKW request has been accepted. Bit 1: Accept parameter change report Bit 1 is set by the user when the parameter change report has been accepted. It is reset by the FC to acknowledge the acceptance. The slave resumes interrupted processing of the current request after this acknowledgment or transmits the next parameter change report.
3-114
Modbus/USS
Communication status word (DBW n+4)

Bits are set in the Communications Status Word by the S_USST and S_USSR FCs.
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Bit 0: PKW request in progress Bit 0 is set by the S_USST FC if the PKW request has been accepted and the parameter ID (PKE) contains a valid request ID. It is reset by the S_USSR FC if the PKW request has been executed (with or without error) or if the PKW interface has an error. Bit 1: PKW request complete without error Bit 1 is set by the S_USSR FC if a PKW request has been executed correctly. The response is available in the receive buffer. It is reset by the S_USST FC if a new PKW request is initiated.
Note The PKW requests for the slaves are executed in the sequence of the polling list (DBPA). Only one request to one slave is active at any one time. If more than one slave is entered in the polling list, the response data to a new PKW request are only available on a positive edge of bit 1 (or bit 2). Bit 2: PKW request completed with error. Bit 2 is set by the S_USSR FC for response ID 7 in the PKE. The error number is in the PWE of the slave response. It is reset by the S_USST FC if a new PKW request is initiated.
Note The PKW request last transferred by the user is retained in the transmit interface after it has been processed. Transmission to the slave is repeated until a new request is entered. This might require additional responses in the user program in the event of the status PKW request completed with error (bit 2) and PKW interface fault (bit 4).
Bit 3: PKW request ID invalid. Bit 3 is set by the S_USST FC if request ID 15 is found in the PKE or if index 255 is entered for request ID 4. It is reset by the S_USST FC with initiation of the next PKW request with valid request ID in the PKE. Bit 4: PKW interface with error (counter overflow).
3-115
Modbus/USS
Bit 4 is set by the S_USSR FC if the PKW request is not acknowledged by the slave within a parameterized number of request repetitions (see parameter WDH in Parameter Sets DB) or for response ID 8 in the PKE. It is reset by the S_USSR FC if a new PKW request is initiated and executed properly. Bit 5: Response data contain parameter change report. Bit 5 is set by the S_USSR FC if a parameter change report from the slave exists (response ID 9 to 12 and toggle bit 11 inverted). It is reset by the S_USST FC if the user has acknowledged the parameter change report (communication control word, Bit 1). Bit 6: Operation fault in slave. Bit 6 is set and reset by the S_USSR FC. The FC evaluates the status word (Bit 3) from the slave. Bit 7: Warning from the slave exists. Bit 7 is set and reset by the S_USSR FC. The FC evaluates the status word (Bit 7) from the slave. Bit 8: PLC control requested. Bit 8 is set and reset by the S_USSR FC. The FC evaluates the status word (Bit 9) and the control word (Bit 10). Bit 9: Group error communication. Bit 9 is set and reset by the S_USSR FC. The FC evaluates the feedback signals of the standard blocks S_SEND and S_RCV and checks the frame received for ADR, STX, BCC and LGE. The FC also signals violation of the frame monitoring time here
Note The receive data from the Net Data DB is only valid if bit 9 = 0.
3-116
Modbus/USS
Structure of the Communication Error Word (DBW n+6)

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Bit 0: Addressing error (ADR) Bit 3: Start of frame not recognized (no STX for first character) Bit 4: Incorrect Block Check Character (BCC) Bit 6: Incorrect frame length (LGE) Bits 0, 3, 4, and 6 are set by the S_USSR FC if an error is detected in checking the frame received (ADR, STX, BCC, LGE). Bit 7: Frame monitoring timeout Bit 7 is set by the S_USSR FC if the time between transmitting the frame from the master to a slave and arrival of the response from that slave exceeds the permissible limit calculated by the program (frame monitoring time). The remaining bits are not used.
Pafe 1-Byte
Error message from S_USSR FC, parameterization errors in the Parameter Sets DB Value 0: Value 1: No error Incorrect data for PKW / PZD
Pafe 2-Byte
Error message from S_USST FC, parameterization errors in the Parameter Sets DB Value 0: Value 1: No error Incorrect data for PKW / PZD
Parameter ID PKE in the Transmit Buffer

The user must assign the parameter number (bits 0 to 10) and the request ID (bits 12 to 15). The toggle bit for the parameter change report (bit 11) is masked by the functions S_USSR and S_USST.
3-117
Modbus/USS
3.7.8
Parameter Sets DB
The Parameter Sets DB contains the program parameters required for controlling communication. The user must create this block and assign the configuration of the communication system accordingly (S_USSI or manually). The slaves on the bus are processed in the sequence of entry in the DBPA (polling list). A slave can also be entered more than once in the Parameter Sets DB, effectively increasing its priority. The length of the Parameter Sets DB depends on the number n of slaves to be addressed in one bus cycle. Number of data words of the Parameter Sets DB = (n x 4) + 5. 4 data words are required for each slave communication, and 4 data words are assigned once for the system parameters. DBW0 is reserved.
DBW 0 DBW 2 DBW 4 DBW 6 DBW 8 DBW 10 DBW 12 DBW 14 DBW 16 DBW 18 DBW 20 DBW 22 DBW 24
Not used DBCP SANZ SLAV WDH Number of PKW, number of PZD TNU DBND KSTW Number of PKW, number of PZD TNU DBND KSTW Communication parameter set slave 2 Communication parameter set slave 1 System parameters
Number of PKW, number of PZD TNU DBND DBW (n x 8 + 8) KSTW Communication parameter set slave n
3-118
Modbus/USS
System Parameters
DBCP: SANZ: Block number of Communication Processor DB Number of slave parameter sets in the Parameter Sets DB. If individual slaves are to be addressed more frequently than others in a bus cycle, their slave parameters must be entered more than once in the Parameter Sets DB. The system parameter SANZ must be adjusted accordingly. Serial number of the current slave. Required by S_USST FC and S_USSR FC to calculate the current parameter set. This data word must be initialized to 1. This is done by the S_USSI FC if it is used. Number of permissible repetitions of a PKW request (value range: 0 to 32767).If the current PKW request is not completed within the set number, the PKW interface is signaled as faulted.
SLAV:
WDH:
Slave Communication Parameter Set

No. of PKW, No. of PZD: Definition of the net data structure Left byte: Number of words for PKW area (0, 3, 4) Right byte: Number of words for PZD area (0 to 16) Any differences from this are detected as parameterization errors by S_USST FC and S_USSR FC and entered in the Pafe 1-byte, Pafe 2-byte of the Net Data DB. Node number corresponding to the bus address on the drive (0 to 31). Block number of the Net Data DB. Address of the communication control word KSTW for the slave in Net Data DB.
TNU: DBND: KSTW:
3-119
Modbus/USS
3.7.9
Communication Processor DB
Data exchange between the CPU and ET 200S Serial Interface Modbus/USS module is handled via this data block. The user must provide this block with sufficient length. The Communication Processor DB must be at least 50 words long (DBW 0 to 98).
DBW 0 DBW 2
Communication status Maximum number of cycles while waiting to receive Cycle counter for timeout calculation while waiting to receive
TRANSMIT and RECEIVE FC17
DBW 4 DBW 6 DBW 8 DBB10 DBB 11 : DBB 54 DBB 55 : DBB 98
Starting pause measured Duration of the last cycle (OB1_MIN_CYCLE) Send telegram length (LEN) Not used
FC17 FC17, OB1 TRANSMIT
Transmit buffer
Transmit frame to module (length depends on the net data structure of the current slave)
Receive buffer
Receive frame from the module (length depends on the net data structure of the current slave)
Communication Status DBW0

Bit 0: The REQ input to S_SEND. This bit is reset when bit 8 is set. Bit 1: The R input to S_SEND. This bit is reset cyclically by S_USST. Bit 2: The DONE output from S_SEND. Bit 3: The ERROR output from S_SEND. Bit 4: The EN_R input to to S_RCV. This bit is set cyclically by S_USSR. Bit 5: The R input to S_RCV. This bit is reset cyclically by S_USSR. Bit 6: The NDR output from S_RCV. Bit 7: The ERROR output from S_RCV. Bit 8: Request in progress (stored DONE bit from S_SEND). This bit is set and reset by S_USST.
Duration of the Last Cycle DBW6

This parameter is used by S_USST to measure the response time of a slave. The user program should copy the PLC scan cycle time (OB1_MIN_CYCLE) into this parameter before each call to S_USST.
3-120
Modbus/USS
3.8
Start-up Characteristics and Operating Modes of the ET 200S Serial Interface Modbus/USS Driver
3.8.1
Loading the Configuration and Parameter Assignment Data
Data Management When you close the Hardware Configuration, your Step 7 project automatically saves the data.
Loading the Configuration and Parameters You can download the configuration and parameter assignment data online from the programming device to the CPU. Use the menu command PLC Download to transfer the data to the CPU. During CPU startup and each time you switch between STOP mode and RUN mode, the module parameters of the module automatically transfer to the module as soon as it can be reached via the S7-300 backplane bus. The parameter assignment tool in the retentive memory of the module saves the driver code. This means you cannot change a module without a programming device.
Additional Information
Refer to the Step 7 User Manual for a detailed description of the following tables: How to save the configuration and the parameters How to load the configuration and the parameters into the CPU How to read, change, copy, and print the configuration and the parameters
3-121
Modbus/USS
3.8.2
Operating Modes of the ET 200S Serial Interface Modbus/USS Module

The ET 200S Serial Interface Modbus/USS Module operates in the following modes: STOP: When the module is in STOP mode, no protocol driver is active and all send and receive requests from the CPU are given a negative acknowledgement. The module remains in stop mode until the cause of the stop is removed (for example: a wire break or an invalid parameter). Resetting parameters: When you reset parameters for the module, the protocol driver is initialized. The SF LED is on during the resetting process. Sending and receiving are not possible, and send and receive message frames stored in the module are lost when the driver is restarted. Communication between the module and the CPU is restarted (active message frames are aborted). At the end of the resetting of parameters, the module is in RUN mode and is ready to send and receive. RUN: The module processes the send requests from the CPU and provides the message frames received by the communications partner to be read by the CPU.
3.8.3
Start-up Characteristics of the ET 200S Serial Interface Modbus/USS Module

The start-up consists of two phases: Initialization : As soon as the module is connected to the power supply, the serial interface initializes and waits for parameter assignment data from the CPU. Parameterization: During parameterization, the ET 200S Serial Interface Modbus/USS Module receives the module parameters that you assigned to the current slot within STEP 7.
3-122
Modbus/USS
3.8.4
Behavior of the ET 200S Serial Interface Modbus/USS Module on Operating Mode Transitions of the CPU
Once the ET 200S Serial Interface Modbus/USS Module starts, all data is exchanged between the CPU and the module by means of the function blocks. CPU-STOP: In CPU-STOP mode, communication by means of PROFIBUS is impossible. Any active ET 200S Serial Interface Modbus/USS Module-CPU data transmission, including both send and receive message frames, is aborted and the connection is re-established. CPU-Start-up: At start-up, the CPU transmits the parameters to the module. Through appropriate parameterization, you can have the receive buffer on the module deleted automatically at CPU start-up. CPU-RUN: When the CPU is in RUN mode, sending and receiving are unrestricted. In the first FB cycles following the CPU restart, the module and the corresponding FBs are synchronized. No new S_SEND or S_RCV is executed until this is finished.
Points to Note when Sending Message Frames

Message frames can be transmitted only in RUN mode. If the CPU switches to STOP mode during CPU to Module data transmission, the S_SEND reports the error (05) 02H after restart. To prevent this, the user program can call the S_SEND with the input RESET from the start-up OB.
Note The ET 200S Serial Interface Modbus/USS Module does not send data to the communications partner until it has received all data from the module.
3-123
Modbus/USS
Points to Note when Receiving Message Frames

STEP 7 allows you to parameterize delete SI receive buffer at start-up = yes/no. If you select Yes, the receive buffer on the ET 200S Serial Interface Modbus/USS Module is automatically deleted when the CPU mode changes from STOP to RUN. If you select No, then the message frame is stored in the ET 200S Serial Interface Modbus/USS Module receive buffer. If the CPU changes to STOP mode during transmission ET 200S Serial Interface Modbus/USS Module> CPU, the S_RCV reports the error (05) 02H after restart. To prevent this, the user program can call the S_SEND with the input RESET from the start-up OB. If Delete ET 200S Serial Interface Modbus/USS Module receive buffer at start-up = no is set, the message frame is retransmitted from the ET 200S Serial Interface Modbus/USS Module to the CPU. To learn more about the transfer of data between the CPU and the ET 200S Serial Interface Modbus/USS Module, refer to the ET 200S Serial Interface Module Manual.
Processing Times The time for complete processing of a master-slave (with data update time) can be determined as follows: Total Processing time (t8 ) = Master request processing time (t1 ) + Master request send time (t2 ) + Slave request processing time (t3 ) + 1 CPU cycle (time to process function code) (t4 ) + Slave response processing time (t5 ) + Slave response send time (t6 ) + Master response processing time (t7 ) Request/Response Processing Time The Send or Receive Time formula will be the same for Master or slave. can be determined as follows: If CPU is much > (I/O cycle + 10 ms) then Processing Time = 1 CPU cycle per 7 bytes else Processing Time = (2 CPU cycles + 3 I/O cycles + 10 ms) per 7 bytes Send/Receive Time for the Request/Response The amount of time for a request or response to be sent or received is determined as follows: Send/Receive time = 10 ms + transmission rate times the # of characters in the message Total Processing Time Example:
Read 10 words Baud Rate 9600 bits/sec I/O Cycle 2ms t1 40ms t2 15ms t3 40ms t4 40ms t5 160 ms t6 31.7 ms t7 160 ms t8 488.7 ms
3-124
Modbus/USS
3.9
Protocols and Interface Specifications

Table 3-32 General Specifications of the ET 200S Modbus/USS Module General Specifications Display elements LEDs: green, TX (transmitting) green, RX (receiving) red, SF (system fault)
Supplied protocol drivers Baud rates with Modbus protocol Baud rates with USS driver Character frames (11 bits)
Modbus drivers USS drivers 110, 300, 600, 1200, 2400, 4800, 9600, 19200, 38400 bits per second (half-duplex) 110, 300, 600, 1200, 2400, 4800, 9600, 19200, 38400 bits per second (half-duplex) Number of bits per character: 8 Number of start/stop bits: 1 or 2 Parity: none, even, odd, any
Storage space requirements of the standard blocks (FBs)
Sending and receiving: 4300 bytes approximately
RS-232C Interface Specifications Interface RS-232C signals Maximum transmission distance RS-232C, 8 terminals TXD, RXD, RTS, CTS, DTR, DSR, DCD, PE All isolated against ET 200S internal power supply 15m
RS-422/485 Interface Specifications Interface RS-422 signals RS-485 signals Maximum transmission distance RS-422, 5 terminals RS-485, 3 terminals TXD (A), RXD (A), TXD (B), RXD (B), PE R/T (A), R/T (B), PE All isolated against ET 200S internal power supply 1200m
3-125
Modbus/USS
Dimensions and Weight Dimensions W H D (in millimeters) Weight 15 x 81 x 52 Approximately 50 g Data for Specific Module RS-232C Current source
from backplane bus from the power supply L+ Power dissipation of the module
10 mA maximum 120 mA maximum, 50 mA typical 1.2 W typical
Number of inputs Number of outputs

RS-422
4 3 1 1
Status, Interrupts, Diagnostics Status display Diagnostic functions Green LED (TX) Green LED (RX)
Number of input
pairs
Number of output
pairs RS-485
Group error display Diagnostic information can be displayed
Red LED (SF) Possible
Number of I/O pairs

Length of cable
1 15m maximum 1200m maximum IEC 801-5
Outputs Output, RS-232C range 10 V maximum 2500 pF maximum Yes Approximately 60 mA 25 V maximum
Shielded (RS-232C) Shielded

(RS-422/485) Type of protection1
For capacitive load Short-circuit protection
Voltage, Currents, Potentials Power rated voltage of the electronics L+ 24 VDC Yes
Short-circuit current Voltage at the outputs or inputs to PE (ground) Output, RS-422/485 Load resistance
Reverse polarity
protection Isolation
50 k minimum Yes Approximately 60mA
Short-circuit protection Yes Yes
Between channels
and backplane bus
Short-circuit current
1
Between channels
and power supply of the electronics
External protection devices required in the user power input lines: Blitzductor DIN rail mounting adapter Blitzductor protection module type KTAD-24V
Between channels Between channels

and PROFIBUS-DP Insulation tested with
No Yes
Channels against
backplane bus and load voltage L+
500 VDC
Load voltage L+
against backplane bus
500 VAC
3-126
Index
Numbers
3964(R) procedure, 2-32 Diagnostics, 3-84 Event Class 14 (0EH)Loadable Driver General Processing Errors, 3-90 Calling the SFCERR Variable, 3-85 Diagnostic Information of the Status LEDs, 3-84 Diagnostic Messages of the Function Blocks, 3-85 ET 200S Serial Interface Module Channel Error Types, 3-94 Event Class 14 (0EH)Loadable Driver General Processing Errors, 3-90 Event Class 30 (1EH): Error During Communication between SI and CPU, 3-93 PROFIBUS Slave Diagnosis, 3-94 Structure of the Function Block Diagnostic Messages, 3-85 Diagnostics of the Communications FB Deleting the Errors, 3-95 Diagnostic Functions, 3-94 Diagnostics via Parameters ERROR_NR, ERROR_INFO, 3-95 ERROR_No 1...9, 3-95 ERROR_No 10...19, 3-95 ERROR_No 90...99, 3-95 ERROR_NR, ERROR_INFO, 3-94 Errors during Initialization, 3-96
A
ASCII driver, RS-232C auxiliary signals, 2-48
B
Brief explanation of commissioning, serial interface, 2-6 Broadcast Message, 3-14
C
Configuring the Modbus Module, 3-27 CRC Check, 3-16
D
DATA Field Data, 3-15 Bytecount, 3-15 Coil_Start Address, 3-15 Number_of_Coils, 3-15 Number_of_Registers, 3-15 Register_Start Address, 3-15 Data Transfer for ET 200S Modbus Master, 3-18
Index-1
Index
Master Function Code 08 -- Loop Back Diagnostic Test, 3-36 Exception Code Message, 3-17 RCV Destination DB, 3-37 Master Function Code 11 -- Fetch Communications Event Counter, 3-37 F RCV Destination DB, 3-37 FB2 S_RCV, 3-23 Master Function Code 12 -- Fetch Assignment in the Data Area, 3-24 Communications Event Log, 3-38 Time Sequence Chart, 3-26 RCV Destination DB, 3-38 FB3 S_SEND, 3-18 Master Function Code 15 -- Force Multiple Assignment in the Data Area, 3-20 Coils, 3-39 Calling, 3-20 Master Function Code 16 -- Preset Multiple Parameters, 3-21 Registers, 3-40 Time Sequence Chart, 3-22 Master Function Codes 01 -- Read Output Full-duplex operation, 2-22 Status, SEND Source DB, 3-31 Function Codes, 3-15 Master Function Codes 03 -- Read Output Registers, 3-33 RCV Destination DB, 3-33 SEND Source DB, 3-33 H Master Function Codes 04 -- Read Input Half-duplex operation, 2-22 Registers, RCV Destination DB, 3-34 Master Function Codes 05 -- Force Single Coil I RCV Destination DB, 3-35 SEND Source DB, 3-34 Interfaces Master Function Codes 06 -- Preset Single RS-232C, 3-10 Register, SEND Source DB, 3-35 RS-422/485, 3-13 Master Function Codes 07 -- Read Exception Status, SEND Source DB, 3-36 M Master Function Codes 08 -- Loop Back Master Function Codes, 3-15 Diagnostic Test, SEND Source DB, 3-37 Master Function Code 01 -- Read Output Master Function Codes 11 -- Fetch Status, 3-31 Communications Event Counter, SEND RCV Destination DB, 3-32 Source DB, 3-37 Master Function Code 02 -- Read Input Master Function Codes 12 -- Fetch Status, 3-32 Communications Event Log, SEND RCV Destination DB, 3-32 Source DB, 3-38 SEND Source DB, 3-32 Master Function Codes 15 -- Force Multiple Master Function Code 04 -- Read Input Coils, SEND Source DB, 3-39 Registers, 3-33 Master Function Codes 16 -- Preset SEND Source DB, 3-34 Multiple Registers, SEND Source DB, Master Function Code 05 -- Force Single 3-40 Coil, 3-34 Message End, 3-16 Master Function Code 06 -- Preset Single Message Structure, 3-14 Register, 3-35 Modbus Master Driver, 3-18 RCV Destination DB, 3-35 Modbus Slave Driver, 3-41 Master Function Code 07-- Read Exception Mode of Operation of the Data Link for the Status, 3-36 Slave Driver RCV Destination DB, 3-36 Access with Bit-Oriented Function Codes, 3-71 Function Code 02, 3-71
Index-2
Index
Function Codes 01, -05, -15, 3-74 Access with Register-Oriented Function Codes, 3-71 Function Code 04, 3-72 Function Codes 03, -06, -16, 3-71 Resulting DB Number, 3-72 Word Number in DB, 3-72 Conversion of MODBUS Addresses for Bit Functions, 3-74 Commence At SIMATIC Memory Area, 3-77 From / To MODBUS Address, 3-75, 3-77 Commence AT SIMATIC Memory Area, 3-75 Example of FC 01, 05, 15, 3-75 Example of FC 02, 3-78 Overview of FC 01, 05, 15, 3-74 Overview of FC02, 3-77 Conversion of MODBUS Addresses for Register Functions, 3-79 commence at DB, 3-80 Example, 3-80 Example of FC 04, 3-81 Overview of FC 03,06, 16, 3-79 Overview of FC 04, 3-80 Data Areas in the SIMATIC CPU, Address Transformation, 3-43 Enable/ Disable Write Access, 3-73 Enable Write Access, 3-73 Function Codes 05, 06,15, 16, 3-73 Limits for Write Functions, 3-82 MIN/MAX SIMATIC Memory Areas, 3-82 Example for FC 05, 06, 16, 3-83 Overview of FC 05, 06, 15, 16, 3-82
Master Function Code 05, 3-35 Master Function Code 06, 3-35 Master Function Code 07, 3-36 Master Function Code 08, 3-37 Master Function Code 11, 3-37 Master Function Code 12, 3-38 RS-232C Communications, Terminal Assignment, 3-5 RS-232C Connecting Cable Pin-out to 25-Pin Connector, 3-8 RS-232C to 9-Pin Connector Cable Pin-out, 3-7 RS-422 Communications, Terminal Assignment, 3-6 RS-422 Connecting Cable Pin-out to 15-Pin Connector, 3-9 RS-485 Communications, Terminal Assignment Diagram, 3-6 RS-485 Connecting Cable Pin-out to 15-Pin Connector, 3-10 RS-232C auxiliary signals, 2-48
S
SEND Source DB Master Function Code 01, 3-31 Master Function Code 02, 3-32 Master Function Code 03, 3-33 Master Function Code 04, 3-34 Master Function Code 05, 3-34 Master Function Code 06, 3-35 Master Function Code 07, 3-36 Master Function Code 08, 3-37 Master Function Code 11, 3-37 Master Function Code 12, 3-38 Master Function Code 15, 3-39 Master Function Code 16, 3-40 Serial interface module, technical specifications, 2-99, 2-100, 3-126 Setting Parameters for the Master Driver, 3-27 Character Delay Multiplier, 3-30 Data Bits, 3-29 Half-Duplex (RS 485) Two-Wire Operation, 3-29 Half-Duplex Receive Line Initial State, 3-29 Interference Suppression, 3-30 Normal Operation, 3-30 Parity, 3-29 Response Time, 3-30 Stop Bits, 3-29 Transmission Rate, 3-29 Signals
P
Parameter Configuration and Setting, Presetting of the Receiving Line, 3-29 Product Overview, 3-2 Order Number, 3-2
R
RCV Destination DB Master Function Code 01, 3-32 Master Function Code 02, 3-32 Master Function Code 03, 3-33 Master Function Code 04, 3-34
Index-3
Index
Automatic Use of the Secondary Signals, 3-55 3-12 register_number, 3-55 RS-232C, 3-11 start_address, 3-55 Time Diagram for Secondary Signals, 3-13 Function Code 04 - Read Input Registers, Slave, Address, 3-14 3-58 Slave Application Examples Application Example, 3-59 Function Code 05, 3-62 register_number, 3-58 Function Code 06 - Preset Single Register, start_address, 3-58 3-63 Function Code 05 - Force Single Coil, 3-61 Function Code 08, 3-65 Access to Memory Bits and Outputs, Function Code 15, Conversion of Modbus 3-61 Addressing Assignment, 3-67 Access to Timers and Counters, 3-61 Function Code 16, 3-69 Application Examples, 3-62 Slave Function Code 01, 3-50 coil_address, 3-61 Slave Function Code 02, 3-53 DATA on/off, 3-61 Slave Function Code 03, 3-56 Function Code 06 - Preset Single Register, Slave Function Code 04, 3-59 3-63 Slave Driver Application Example, 3-63 Components, 3-41 DATA Value, 3-63 Data Structures, 3-41 start_register, 3-63 MODBUS Slave Communications FB, Function Code 08 - Loop Back Diagnostic 3-41 Test, 3-65 MODBUS Slave Data Link, 3-41 Application Example, 3-65 Parameters Function Code 15 - Force Multiple Coils, Data Bits, 3-47 3-66 Interference Suppression, 3-47 Access to Memory Bits and Outputs, Multiplier Character Delay Time, 3-47 3-66 Normal Operation, 3-47 Access to Timers and Counters, 3-66 Configuring, 3-45 Applicaiton Example for Conversion of Parity, 3-47 Modbus Addressing Assignment, Setting Parameters for the Slave Driver, 3-67 3-45 DATA, 3-67 Slave Address, 3-47 Quantity, 3-66 Stop Bits, 3-47 start_address, 3-66 Transmission Rate, 3-47 Function Code 16 - Preset Multiple Slave Function Codes, 3-15, 3-48 Registers, 3-68 Function Code 01 - Read Coil (Output) Applicaiton Example, 3-69 Status, 3-49 DATA (High, Low), 3-69 Access to Memory Bits and Outputs, Quantity, 3-69 3-49 start_register, 3-69 Access to Timers and Counters, 3-49 Start-up Characteristics , 3-122 Application Example, 3-50 Start-up Characteristics and Operating Modes bit_number, 3-50 Loading Assignment Data, 3-121 start_address, 3-49 Operating Modes, 3-122 Function Code 02 - Read Input Status, 3-52 Start-up Characteristics and Operating Modes , Application Example, 3-53 Behavior of the ET 200S Serial Interface bit_number, 3-52 MODBUS/ USS Module on Operating Mode start_address, 3-52 Transitions of the CPU, 3-123 Function Code 03 - Read Output Registers, 3-55 Application Example, 3-56 Calculation Formula for start_register,
Index-4
Index
Net Data DB, 3-112 Communication Control Word Technical Specifications, 3-125 KSTW(DBWn), 3-114 Protocols and Interface Specifications, Communication Status Word (DBW 3-125 n+4), 3-115 Technical specifications, serial interface Pafe 1-byte, 3-117 module, 2-99 Pafe 2-byte, 3-117 Terminal Assignment Diagrams, 3-5 Parameter ID PKE in the Transmit Transmission Protocol, 3-14 Buffer, 3-117 Slave Data Assignment, 3-113 Structure of the Communication Error U Word (DBW n+6), 3-117 Parameter Sets DB, 3-118 Usable Interfaces and Protocols, 3-18 Slave Communication Parameter Set, USS Master, 3-99 3-119 Communication Processor DB, 3-120 System Paramaters, 3-119 Communication Status DBW0, 3-120 USS Protocol, 3-99 Duration of the Last Cycle DBW6, 3-120 Net Data Block, 3-100 Configuration and Parameterization, 3-100 Data Coding, 3-99 FC17 S_USST: Transmitting Data to a Data Transfer Procedures, 3-100 Slave, 3-103 Message Structure, 3-99 Parameters, 3-105 USS Protocol, General Structure of the Net FC18 S_USSR: Receiving Data from a Data Block Slave, 3-106 Parameter Area (PKW), 3-100 Parameters, 3-109 Process Data Area (PZD), 3-100 FC19 S_USSI: Initialization, 3-109 Parameters, 3-111 Function Call Order, 3-101 Functional Overview, 3-101 W
Wiring Guidelines, 3-5
Index-5
Index
Index-6

SS200S e

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SS200S e

Uploaded by

Copyright:

Available Formats

Contents

SIMATIC Serial Interface Module ET 200S

Overview Serial Interface Module Modbus/USS Index

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module ET 200S A5E00124881-01

3.8 3.8.1 3.8.2 3.8.3 3.8.4 3.9

3-121 3-121 3-122 3-122 3-123

Technical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-125

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module ET 200S A5E00124881-01

How the Manual is Structured

How to Find Your Way Around

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Functionality of the ET 200S Serial Interface Module

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

(green) Interface sends (green) Interface receives

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Brief Explanation of Commissioning the Serial Interface Module

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Installation, Wiring, and Fitting

ET 200S serial interface module

Wiring for RS-232C serial communication

TXD TM-E15S24-01 RTS terminal module DTR DCD

RXD CTS DSR PE

Figure 2-2 Terminal Assignment for the Example

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Creating the User Program

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

M1.0 EN M4.5 MW10 IN

M1.2 EN M4.3 MW12 IN

Figure 2-3 Sample Program for the Sample Application

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Create the DB14 as a global DB in accordance with Table 2-3.

Create the DB15 as a global DB in accordance with Table 2-4.

Save the blocks, and download them to the CPU.

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Testing the Sample Program

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Serial Interface Module ET 200S A5E00124881-01

Serial Interface Module

Block Diagram with Terminal Assignment

Terminal Assignment for RS-232C Communication

RXD CTS DSR PE

DCD Data Carrier Detect