S7-300 as Modbus Host

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 1 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

Group Topic

6 S7-300 as Modbus Host

Overview

This Applications Tip describes a method for getting an S7-300 family PLC to act as a ModbusRTU host device. This tip will not work for S7-400 PLC’s because the current versions of theCP441 card (6ES7 441-1AA00-0AE0 and 6ES7 441-2AA0-0AE0) do not support the ASCIIdriver.

Hardware Requirements:• S7-300 PLC. The Modbus host code will not fit in a S7-312 (the size of the Modbus and

CP340 interface code and instance DB’s is about 9 KBytes). A S7-313 will work, but a S7-314 or 315 is recommended.

• CP 340 Point-to-Point Communications Processor

Supported Functions:• Modbus Function 3 - Read Holding Registers• Modbus Function 16 - Preset Multiple RegistersBoth of these functions map Modbus holding registers starting at Modbus address 40001 into asingle S7 data block for each Modbus secondary.

PLC Resources Used:• 9 KBytes PLC work memory for code and instance DB’s. This does not include the register

storage DB for each Modbus secondary, which will use another 80+ bytes per secondary.• Timer 0, used to detect communications timeouts in polling.

Configuring the CP340

To work with the Modbus communications software, the CP340 card must be configured to usethe ASCII driver. You do this using the STEP 7 Hardware Configuration utility. Once theCP340 card is added to your S7-300 rack, double-click on the card to set its properties. STEP7 will open a window where you can set the CP340 properties.

SIMATICS7-300/400 Tips

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 2 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

Click on the Parameters… button, and STEP 7 will open a CP340 protocol selection window(you must have the Point-to-Point configuration software installed for this to work).

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 3 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

Select ASCII in the protocol list, then double-click on the Protocol icon (the box with anenvelope in it) to set the port parameters.

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 4 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

For the End Code of a Receive Message Frame, select “On Expiry of Character Delay Time.”Set the Character Delay Time to the time it takes to transmit 4 characters at the selected baudrate. For 9600 baud, this is about 4 ms. Set the baud rate and character frame parameters tothose used by your Modbus host device. Click on the Transmission tab in the Protocolwindow.

In the Data Flow Control field, select “None.” In order to get finer control of the RTS/CTStiming, we will be handling flow control within our PLC program. Click on the Receiving Datatab.

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 5 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

Set the checkbox for “Delete CP Receive Buffer at Start-Up,” and reset the checkbox for“Prevent Overwriting.” Press the OK button to accept the port parameters, the select theFile→→Save menu item in the CP340 Parameterization window. Close the CP340Parameterization window, the press OK in the CP340 Properties window to accept the moduleconfiguration.

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 6 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

Installing the Modbus Software

Before installing the Modbus blocks, you must first copy the CP340 interface blocks into yourprogram. These blocks, FB2, FB3, FC5, and FC6, are located in the CP340 library that wasinstalled when you installed the CP340 configuration software. Drag these blocks from thelibrary AP-off folder to your program’s AP-off folder.

The Modbus software is distributed as a STEP 7 import file. This file contains the followingblocks:

FC1 Modbus CRC calculation functionFB4 Modbus host Preset Multiple Registers functionFB5 Modbus host Read Holding Registers functionFB8 Modbus poll scheduler - polls up to 10 secondariesFB9 Modbus poll sequence function (write then read from single secondary)DB1 Table of pre-calculated CRC partial sums, used in CRC calculation.DB8 FB8 and FB9 instance data blockDB12 P_RCV (CP340 receive function) instance data blockDB13 P_SEND (CP340 send function) instance data blockDB14 FB4 instance data blockDB15 FB5 instance data blockDB91..DB100 Data to/from Modbus secondary 1..10

To install these blocks into your program, right-click on the SO folder in the destination program.On the pop-up menu, select External Source File….

STEP 7 will open a file selection dialog. Select the modhost.awl import file, and press theOpen button. The modhost source file has now been added to the SO folder. Right-click onthe modhost source file, and select Compile from the pop-up menu.

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 7 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

STEP 7 will open the LAD/STL editor to compile the source file. The compile may generate afew warning messages: ignore these. Close the LAD/STL editor. Click on the AP-off folder:the modbus blocks have been added to your program.

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 8 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

Using the Modbus Driver

The Modbus host driver is designed to exchange data with up to 10 Modbus secondaries. Asfrequently as possible, the driver writes a block of 20 registers to then reads a block of 20registers from each Modbus secondary. The station addresses of the secondaries must be inthe range 1..10.

The Modbus host driver is invoked by adding a call to FB8 to your OB1 code.

You may need to change some of the default configuration values in DB8 to reflect your PLCand Modbus network configuration:

Location Description Default ValueDB8.DBW0 MaxAddr - the highest Modbus secondary address to be

polled. Must be in range 1..10. This keeps the driver fromtrying to poll all 10 possible secondaries if you have lessthan 10 on your network.

1

DB8.DBX2.0 Enable1 - boolean set TRUE to enable polling Modbusaddress 1. The EnableN bits let you selectively enableand disable polling individual stations. You might want todisable polling if a station is taken down for servicing, etc.to prevent communications timeouts from slowing downyour polling.

TRUE

DB8.DBX2.1 Enable2 - boolean set TRUE to enable polling address 2. TRUEDB8.DBX2.2 Enable3 - boolean set TRUE to enable polling address 3. TRUEDB8.DBX2.3 Enable4 - boolean set TRUE to enable polling address 4. TRUEDB8.DBX2.4 Enable5 - boolean set TRUE to enable polling address 5. TRUEDB8.DBX2.5 Enable6 - boolean set TRUE to enable polling address 6. TRUEDB8.DBX2.6 Enable7 - boolean set TRUE to enable polling address 7. TRUEDB8.DBX2.7 Enable8 - boolean set TRUE to enable polling address 8. TRUEDB8.DBX3.0 Enable9 - boolean set TRUE to enable polling address 9. TRUEDB8.DBX3.1 Enable10 - boolean set TRUE to enable polling address 10. TRUEDB8.DBW58 LADDR - the starting I/O address of your CP340 card. 256

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 9 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

The Modbus Host driver maps registers from each secondary into a separate Data Block.Secondary Address Data Block

1 DB912 DB923 DB934 DB945 DB956 DB967 DB978 DB989 DB9910 DB100

Each secondary data block is organized as 40 16-bit registers. The first 20 registers are readfrom Modbus addresses 40001..40020 in the secondary. The last 20 registers are written toModbus addresses 40021..40040 in the secondary.

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 10 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

Modbus Driver Program

Note: In the interest of brevity, I have left the instance and secondary data blocks out of theprogram listing. To see a listing of these blocks, open modhost.awl with a text editor.

FUNCTION FC 1: VOIDTITLE =Calculate CRC of Modbus message//This FC calculates the CRC of the specified msg, using the table lookup method.//The message should be in Modbus RTU format, with Address and Function as//the first 2 bytes, and the CRC as the last 2 bytes. The message len field//should include the address, function, data, and crc fields.//The FC will replace the existing CRC with the CRC that it calculates, then//return with stat=TRUE if the original CRC = the calculated CRC.AUTHOR : mmckayFAMILY : CP340NAME : mod_crcVERSION : 1.0

VAR_INPUT msg_db : INT := 1; //DB number containing message msg_dbb : INT := 1; //byte in msg_db where msg starts msg_len : INT ; //message length in bytes crctbl : INT ; //DB # containing precalculated crc partial sumsEND_VARVAR_OUTPUT stat : BOOL ; //status output: TRUE = crc goodEND_VARVAR_TEMP msgCrc : INT ;//initial msg CRC crcIndex : DWORD ; //bit index of CRC in msg DB charNdx : DWORD ; //bit index of current msg character crcAccum : INT ; //crc accumulator tblNdx : DWORD ; db_no : INT ; index : INT ;END_VARBEGINNETWORKTITLE =Open Data Blocks//DI = modbus message block//DB = crc table block L #crctbl; T #index; OPN DB [#index]; //open our data blocks. DI=msg, DB=crctbl L #msg_db; T #db_no; OPN DI [#db_no];NETWORKTITLE =Check message length//If the message length is < 4, then the modbus message is invalid L DBW 0; L 4; >=I ; SAVE ;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 11 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

BEC ;NETWORKTITLE =Save initial CRC

L #msg_len; //convert length to bit index of crc L #msg_dbb; //..bit index = (length - crc_len + msg_start) * 8 +I ; //.. = (msg_len -2 + msg_dbb) << 3 L 2; -I ; SLD 3; T #crcIndex; L DIW [#crcIndex]; T #msgCrc;NETWORKTITLE =initialization for loop

L #msg_dbb; //point index to first character SLD 3; T #charNdx; L W#16#FFFF; //set crc accumulator to FFFF T #crcAccum;m001: L #crcAccum; //calculate crc table index L W#16#FF; AW ; L DIB [#charNdx]; XOW ; SLW 4; T #tblNdx; L #crcAccum; //calculate new crcAccum value L W#16#FF00; AW ; SRW 8; L DBW [#tblNdx]; XOW ; T #crcAccum; L #charNdx; //increment character index L 8; +D ; T #charNdx; L #crcIndex; //check for done <D ; JC m001; L #crcAccum; //byte swap crc accumulator CAW ; T #crcAccum; T DIW [#crcIndex]; //store new CRC in msgNETWORKTITLE =Compare new & old CRC

L #msgCrc; L #crcAccum; ==I ; = #stat;END_FUNCTION

DATA_BLOCK DB 1

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 12 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

AUTHOR : mmckayFAMILY : cp340NAME : crctblVERSION : 1.0

STRUCT w : ARRAY [0 .. 255 ] OF WORD ; END_STRUCT ;BEGIN w[0] := W#16#0; w[1] := W#16#C0C1; w[2] := W#16#C181; w[3] := W#16#140; w[4] := W#16#C301; w[5] := W#16#3C0; w[6] := W#16#280; w[7] := W#16#C241; w[8] := W#16#C601; w[9] := W#16#6C0; w[10] := W#16#780; w[11] := W#16#C741; w[12] := W#16#500; w[13] := W#16#C5C1; w[14] := W#16#C481; w[15] := W#16#440; w[16] := W#16#CC01; w[17] := W#16#CC0; w[18] := W#16#D80; w[19] := W#16#CD41; w[20] := W#16#F00; w[21] := W#16#CFC1; w[22] := W#16#CE81; w[23] := W#16#E40; w[24] := W#16#A00; w[25] := W#16#CAC1; w[26] := W#16#CB81; w[27] := W#16#B40; w[28] := W#16#C901; w[29] := W#16#9C0; w[30] := W#16#880; w[31] := W#16#C841; w[32] := W#16#D801; w[33] := W#16#18C0; w[34] := W#16#1980; w[35] := W#16#D941; w[36] := W#16#1B00; w[37] := W#16#DBC1; w[38] := W#16#DA81; w[39] := W#16#1A40; w[40] := W#16#1E00; w[41] := W#16#DEC1; w[42] := W#16#DF81; w[43] := W#16#1F40; w[44] := W#16#DD01; w[45] := W#16#1DC0;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 13 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

w[46] := W#16#1C80; w[47] := W#16#DC41; w[48] := W#16#1400; w[49] := W#16#D4C1; w[50] := W#16#D581; w[51] := W#16#1540; w[52] := W#16#D701; w[53] := W#16#17C0; w[54] := W#16#1680; w[55] := W#16#D641; w[56] := W#16#D201; w[57] := W#16#12C0; w[58] := W#16#1380; w[59] := W#16#D341; w[60] := W#16#1100; w[61] := W#16#D1C1; w[62] := W#16#D081; w[63] := W#16#1040; w[64] := W#16#F001; w[65] := W#16#30C0; w[66] := W#16#3180; w[67] := W#16#F141; w[68] := W#16#3300; w[69] := W#16#F3C1; w[70] := W#16#F281; w[71] := W#16#3240; w[72] := W#16#3600; w[73] := W#16#F6C1; w[74] := W#16#F781; w[75] := W#16#3740; w[76] := W#16#F501; w[77] := W#16#35C0; w[78] := W#16#3480; w[79] := W#16#F441; w[80] := W#16#3C00; w[81] := W#16#FCC1; w[82] := W#16#FD81; w[83] := W#16#3D40; w[84] := W#16#FF01; w[85] := W#16#3FC0; w[86] := W#16#3E80; w[87] := W#16#FE41; w[88] := W#16#FA01; w[89] := W#16#3AC0; w[90] := W#16#3B80; w[91] := W#16#FB41; w[92] := W#16#3900; w[93] := W#16#F9C1; w[94] := W#16#F881; w[95] := W#16#3840; w[96] := W#16#2800; w[97] := W#16#E8C1; w[98] := W#16#E981; w[99] := W#16#2940; w[100] := W#16#EB01; w[101] := W#16#2BC0;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 14 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

w[102] := W#16#2A80; w[103] := W#16#EA41; w[104] := W#16#EE01; w[105] := W#16#2EC0; w[106] := W#16#2F80; w[107] := W#16#EF41; w[108] := W#16#2D00; w[109] := W#16#EDC1; w[110] := W#16#EC81; w[111] := W#16#2C40; w[112] := W#16#E401; w[113] := W#16#24C0; w[114] := W#16#2580; w[115] := W#16#E541; w[116] := W#16#2700; w[117] := W#16#E7C1; w[118] := W#16#E681; w[119] := W#16#2640; w[120] := W#16#2200; w[121] := W#16#E2C1; w[122] := W#16#E381; w[123] := W#16#2340; w[124] := W#16#E101; w[125] := W#16#21C0; w[126] := W#16#2080; w[127] := W#16#E041; w[128] := W#16#A001; w[129] := W#16#60C0; w[130] := W#16#6180; w[131] := W#16#A141; w[132] := W#16#6300; w[133] := W#16#A3C1; w[134] := W#16#A281; w[135] := W#16#6240; w[136] := W#16#6600; w[137] := W#16#A6C1; w[138] := W#16#A781; w[139] := W#16#6740; w[140] := W#16#A501; w[141] := W#16#65C0; w[142] := W#16#6480; w[143] := W#16#A441; w[144] := W#16#6C00; w[145] := W#16#ACC1; w[146] := W#16#AD81; w[147] := W#16#6D40; w[148] := W#16#AF01; w[149] := W#16#6FC0; w[150] := W#16#6E80; w[151] := W#16#AE41; w[152] := W#16#AA01; w[153] := W#16#6AC0; w[154] := W#16#6B80; w[155] := W#16#AB41; w[156] := W#16#6900; w[157] := W#16#A9C1;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 15 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

w[158] := W#16#A881; w[159] := W#16#6840; w[160] := W#16#7800; w[161] := W#16#B8C1; w[162] := W#16#B981; w[163] := W#16#7940; w[164] := W#16#BB01; w[165] := W#16#7BC0; w[166] := W#16#7A80; w[167] := W#16#BA41; w[168] := W#16#BE01; w[169] := W#16#7EC0; w[170] := W#16#7F80; w[171] := W#16#BF41; w[172] := W#16#7D00; w[173] := W#16#BDC1; w[174] := W#16#BC81; w[175] := W#16#7C40; w[176] := W#16#B401; w[177] := W#16#74C0; w[178] := W#16#7580; w[179] := W#16#B541; w[180] := W#16#7700; w[181] := W#16#B7C1; w[182] := W#16#B681; w[183] := W#16#7640; w[184] := W#16#7200; w[185] := W#16#B2C1; w[186] := W#16#B381; w[187] := W#16#7340; w[188] := W#16#B101; w[189] := W#16#71C0; w[190] := W#16#7080; w[191] := W#16#B041; w[192] := W#16#5000; w[193] := W#16#90C1; w[194] := W#16#9181; w[195] := W#16#5140; w[196] := W#16#9301; w[197] := W#16#53C0; w[198] := W#16#5280; w[199] := W#16#9241; w[200] := W#16#9601; w[201] := W#16#56C0; w[202] := W#16#5780; w[203] := W#16#9741; w[204] := W#16#5500; w[205] := W#16#95C1; w[206] := W#16#9481; w[207] := W#16#5440; w[208] := W#16#9C01; w[209] := W#16#5CC0; w[210] := W#16#5D80; w[211] := W#16#9D41; w[212] := W#16#5F00; w[213] := W#16#9FC1;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 16 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

w[214] := W#16#9E81; w[215] := W#16#5E40; w[216] := W#16#5A00; w[217] := W#16#9AC1; w[218] := W#16#9B81; w[219] := W#16#5B40; w[220] := W#16#9901; w[221] := W#16#59C0; w[222] := W#16#5880; w[223] := W#16#9841; w[224] := W#16#8801; w[225] := W#16#48C0; w[226] := W#16#4980; w[227] := W#16#8941; w[228] := W#16#4B00; w[229] := W#16#8BC1; w[230] := W#16#8A81; w[231] := W#16#4A40; w[232] := W#16#4E00; w[233] := W#16#8EC1; w[234] := W#16#8F81; w[235] := W#16#4F40; w[236] := W#16#8D01; w[237] := W#16#4DC0; w[238] := W#16#4C80; w[239] := W#16#8C41; w[240] := W#16#4400; w[241] := W#16#84C1; w[242] := W#16#8581; w[243] := W#16#4540; w[244] := W#16#8701; w[245] := W#16#47C0; w[246] := W#16#4680; w[247] := W#16#8641; w[248] := W#16#8201; w[249] := W#16#42C0; w[250] := W#16#4380; w[251] := W#16#8341; w[252] := W#16#4100; w[253] := W#16#81C1; w[254] := W#16#8081; w[255] := W#16#4040;END_DATA_BLOCK

FUNCTION_BLOCK FB 4TITLE =Modbus Host Write multiple registers (function 16)//On rising edge of "Write", send Preset Multiple Registers command to selected//Modbus secondary. Calling parameters are://// clock = S7-300 clock memory byte, used for timing// LADDR = I/O address of CP340 card// MOD_ADDR = Modbus secondary address to talk to// DATA_DB = data block where Modbus secondary's data is stored// CRCTBL_DB = data block number where CRC partial sums are stored// Rsp_Time = time (in 1/10 second intervals) that we will wait for secondary// to respond before we will time out and declare an error.

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 17 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

// Write = send modbus frame on rising edge. Abort write if trailing edge// before response received from secondary.// WR_Start = Modbus register offset (0..size of DATA_DB/2) where start of// data to write to secondary is found. Secondary will store the// data at the corresponding address in its memory.// WR_Length = number of 16-bit Modbus registers to write.// cmplt = set when write operation has completed, or an error occurs.// WR_Status = indicates completion status back to calling block. Values are:// 0 = no error// 1 = already communications in progress// 3 = timeout on write operation// 4 = WR_Start illegal// 5 = WR_Length illegal// 6 = P_RCV error// 7 = response timeout// 8 = error response from secondary// 9 = bad CRC from secondaryAUTHOR : mmckayFAMILY : CP340NAME : modWriteVERSION : 1.0

VAR_INPUT clock : BYTE ; //CPU clock memory byte LADDR : INT ; //CP340 PW address MOD_ADDR : INT := 1; //Modbus slave address to write to DATA_DB : BLOCK_DB ; //network data storage CRCTBL_DB : INT := 1; //DB # of precalculated CRC lookup table Rsp_Time : INT := 100; //Response timeout preset in 0.1 sec intervals Write : BOOL ; //do write on rising edge WR_Start : INT ; //register (word) index of start of write in DATA_DB WR_Length : INT := 1; //length of write in wordsEND_VARVAR_OUTPUT cmplt : BOOL ; //write complete flag WR_Status : INT ; //write error indicator, valid if cmplt=TRUEEND_VARVAR in_send : BOOL ; //write in progress flag wr_os : BOOL ; //Write input one-shot wt4Rsp : BOOL ; //waiting for response from slave send_os : BOOL ; done_os : BOOL ; //flowDone rising edge clk_os : BOOL ; //10 Hz clock rising edge abort : BOOL ; //Write abort detection oneshot msg : ARRAY [0 .. 255 ] OF //Modbus frame buffer BYTE ; tmr : INT ; //response timer current valueEND_VARVAR_TEMP new_write : BOOL ; //new write request dummy : BOOL ; //don't care output flowSend : BOOL ; startSend : BOOL ; commDone : BOOL ; //P_SEND completed sending frame

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 18 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

rspDone : BOOL ; //P_RCV has new response rspErr : BOOL ; //P_RCV error rspTO : BOOL ; //response timeout crcOK : BOOL ; //response CRC good CTS : BOOL ; //state of RS-232 CTS line from modem doCRC : BOOL ; //time to check response CRC msgLen : INT ; //Modbus frame length in bytes commStat : WORD ; //P_SEND status word DBlen : INT ; //length of DATA_DB WR_End : INT ; //end register of write cnt : INT ; //data counter msgDB : INT ; //msg DB number index : DINT ;END_VARBEGINNETWORKTITLE =If "Write" turned off, then abort operation

A #Write; FN #abort; A #in_send; JNB _001; L 3; T #WR_Status; SET ; SAVE ; CLR ;_001: A BR; R #in_send;NETWORKTITLE =New write Request ?

A #Write; FP #wr_os; = #new_write; R #cmplt;NETWORKTITLE =If not writing, then done.

AN #new_write; AN #in_send; SAVE ; BEC ;NETWORKTITLE =new write ignored if already write in progress//WR_Status values://0 = no error//1 = already communications in progress//3 = timeout on write operation//4 = WR_Start illegal//5 = WR_Length illegal//6 = P_RCV error//7 = response timeout//8 = error response from secondary//9 = bad CRC from secondary A #new_write;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 19 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

A #in_send; JNB _002; L 1; T #WR_Status; SET ; SAVE ; CLR ;_002: A BR; SAVE ; BEC ;NETWORKTITLE =Get size of DATA_DB

OPN #DATA_DB; //open data DB L DBLG; //get DATA_DB block length T #DBlen;NETWORKTITLE =Calculate last register in write//WR_Start and WR_Length are word values, so we need to multiply by 2 to get byte//values so that we can compare WR_End with DBlen. A( ; A #new_write; JNB _003; L #WR_Length; L #WR_Start; +I ; T #WR_End; AN OV; SAVE ; CLR ;_003: A BR; ) ; JNB _004; L #WR_End; L 2; *I ; T #WR_End;_004: NOP 0;NETWORKTITLE =Check WR_Start for legal range

A( ; A( ; A #new_write; A( ; L #WR_Start; L 0; <I ; ) ; O ; A #new_write; A( ; L #WR_End; L #DBlen; >I ; ) ;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 20 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

) ; JNB _005; L 4; T #WR_Status; SET ; SAVE ; CLR ;_005: A BR; ) ; S #cmplt; R #new_write;NETWORKTITLE =Check WR_Length to make sure it won't overflow the buffer

A #new_write; A( ; L #WR_Length; L 123; >I ; ) ; JNB _006; L 5; T #WR_Status; SET ; SAVE ; CLR ;_006: A BR; S #cmplt;NETWORKTITLE =If WR_Start or WR_Length error, then done

A #cmplt; SAVE ; BEC ;NETWORKTITLE =If new write, initialize state flags

A( ; A #new_write; JNB _007; L 0; T #WR_Status; SET ; SAVE ; CLR ;_007: A BR; ) ; S #in_send; R #wt4Rsp; R #cmplt;NETWORKTITLE =If time to transmit write frame, assert RTS

A #in_send; = L 18.0; BLD 103;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 21 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

A #in_send; AN #wt4Rsp; = L 18.1; BLD 103; A #in_send; JNB _008; CALL FC 6 ( LADDR := #LADDR, DTR := L 18.0, RTS := L 18.1);

_008: NOP 0;NETWORKTITLE =After RTS asserted, wait for CTS before transmitting

A #in_send; JNB _009; CALL FC 5 ( LADDR := #LADDR, DTR_OUT := #dummy, DSR_IN := #dummy, RTS_OUT := #dummy, CTS_IN := #CTS, DCD_IN := #dummy, RI_IN := #dummy);

_009: NOP 0;NETWORKTITLE =Once the modem has returned CTS, then time to send write frame

A #in_send; AN #wt4Rsp; AN #new_write; A #CTS; = #flowSend;NETWORKTITLE =Flow control is ready for us to transmit the Modbus frame

A #flowSend; FP #send_os; = #startSend;NETWORKTITLE =Get message DB number

L DINO; T #msgDB;NETWORKTITLE =Build Modbus frame

A #startSend; JCN sk15; L #MOD_ADDR; //secondary network address T #msg[0]; L 16; //Modbus function code 16 T #msg[1]; L #WR_Start; //register address hi byte

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 22 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

SRW 8; T #msg[2]; L #WR_Start; //register addreee lo byte L 255; AW ; T #msg[3]; L #WR_Length; //write length hi byte SRW 8; T #msg[4]; L #WR_Length; //write length lo byte L 255; AW ; T #msg[5]; L #WR_Length; //data length in bytes SLW 1; T #msg[6]; T #cnt; OPN #DATA_DB; L P#31.0; //***hard coded offset*** T #index; L #WR_Start; //init bit pointer to data SLW 4; LAR1 ;mov: L DBB [AR1,P#0.0]; //copy data to buffer T DIB [#index]; +AR1 P#1.0; //increment pointers by 1 byte L #index; L P#1.0; +D ; T #index; L #cnt; //decrement byte counter DEC 1; T #cnt; L 0; >I ; JC mov; L #msg[6]; //get frame data byte count L 9; //add frame overhead +I ; T #msgLen; CALL FC 1 (//go calculate crc for frame msg_db := #msgDB, msg_dbb := 24,//*** hard coded offset *** msg_len := #msgLen, crctbl := #CRCTBL_DB, stat := #dummy);

sk15: NOP 0;NETWORKTITLE =Send Modbus frame to CP340 card

A #flowSend; = L 18.0; BLD 103; AN #in_send; = L 18.1;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 23 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

BLD 103; A #in_send; JNB _00a; CALL FB 3 , DB 13 ( REQ := L 18.0, R := L 18.1, LADDR := #LADDR, DB_NO := #msgDB, DBB_NO := 24, LEN := #msgLen, DONE := #commDone, ERROR := #dummy, STATUS := #commStat);

_00a: NOP 0;NETWORKTITLE =Wait up to 10 seconds for response

A #commDone; A #flowSend; FP #done_os; JNB _00b; L #Rsp_Time; T #tmr; SET ; SAVE ; CLR ;_00b: A BR; S #wt4Rsp;NETWORKTITLE =Waiting for response

A #wt4Rsp; = L 18.0; BLD 103; A #new_write; = L 18.1; BLD 103; A #in_send; JNB _00c; CALL FB 2 , DB 12 ( EN_R := L 18.0, R := L 18.1, LADDR := #LADDR, DB_NO := #msgDB, DBB_NO := 24, NDR := #rspDone, ERROR := #rspErr, LEN := #msgLen, STATUS := #commStat);

_00c: NOP 0;NETWORKTITLE =...but not too long

A #wt4Rsp; //time active only if waiting

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 24 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

JNB sk20; L P#0.0; //pointer to bit 0 of clock LAR1 ; A DIX [AR1,P#0.0]; FP #clk_os; //get rising edge JNB sk20; L #tmr; //decrement timer L 1; -I ; T #tmr; L 0; //timer elapsed? <=I ; SAVE ; CLR ;sk20: A BR; = #rspTO; //timeout flagNETWORKTITLE =timeout on response

A #rspTO; JNB _00d; L 7; T #WR_Status; SET ; SAVE ; CLR ;_00d: A BR; S #cmplt;NETWORKTITLE =Error in P_RCV

A #rspErr; A #wt4Rsp; JNB _00e; L 6; T #WR_Status; SET ; SAVE ; CLR ;_00e: A BR; S #cmplt;NETWORKTITLE =If we have a new response, then check its CRC

A #rspDone; A #wt4Rsp; AN #cmplt; = #doCRC;NETWORKTITLE =Check response CRC

A #doCRC; JNB _00f; CALL FC 1 ( msg_db := #msgDB, msg_dbb := 24,

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 25 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

msg_len := #msgLen, crctbl := #CRCTBL_DB, stat := #crcOK);

_00f: NOP 0;NETWORKTITLE =Response CRC bad

A #doCRC; AN #crcOK; JNB _010; L 9; T #WR_Status; SET ; SAVE ; CLR ;_010: A BR; S #cmplt;NETWORKTITLE =If CRC OK, then check for wrong Modbus Function code in response

A #doCRC; AN #cmplt; A( ; L #msg[1]; //response Modbus function code L 16; //code we sent <>I ; //if different, then error ) ; JNB sk26; L 8; //bad response error code T #WR_Status; SET ; SAVE ; CLR ;sk26: A BR; S #cmplt;NETWORKTITLE =Done

A #rspDone; A #wt4Rsp; O #cmplt; S #cmplt; R #in_send; R #wt4Rsp;END_FUNCTION_BLOCK

FUNCTION_BLOCK FB 5TITLE =Modbus Read Holding Registers command (function code 3)//On rising edge of "Read", send Read Holding Registers command to selected//Modbus secondary. Calling parameters are://// clock = S7-300 clock memory byte, used for timing// LADDR = I/O address of CP340 card// MOD_ADDR = Modbus secondary address to talk to// DATA_DB = data block where Modbus secondary's data is stored

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 26 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

// CRCTBL_DB = data block number where CRC partial sums are stored// Rsp_Time = time (in 1/10 second intervals) that we will wait for secondary// to respond before we will time out and declare an error.// Read = send read request on rising edge. Abort read if trailing edge// before response received from secondary.// RD_Start = Modbus register offset (0..size of DATA_DB/2) in DATA_DB where// data from the secondary is to be stored. Data will be from the// corresponding Modbus address in the secondary.// RD_Length = number of 16-bit Modbus registers to write.// cmplt = set when rad operation has completed, or an error occurs.// RD_Status = indicates completion status back to calling block. Values are:// 0 = no error// 1 = already communications in progress// 3 = timeout on read operation// 4 = RD_Start illegal// 5 = RD_Length illegal// 6 = P_RCV error// 7 = response timeout// 8 = error response from secondary// 9 = bad CRC from secondaryAUTHOR : mmckayFAMILY : CP340NAME : modReadVERSION : 1.0

VAR_INPUT clock : BYTE ; //CPU clock memory byte LADDR : INT ; //CP340 PW address MOD_ADDR : INT := 1; //Modbus slave address to read DATA_DB : BLOCK_DB ; //network data storage CRCTBL_DB : INT := 1; //DB # of precalculated CRC lookup table Rsp_Time : INT := 100; //response timeout preset in 0.1 sec intervals Read : BOOL ; //do read on rising edge RD_Start : INT ; //register (word) index of start of read RD_Length : INT := 1;//length of read in wordsEND_VARVAR_OUTPUT cmplt : BOOL ; //read complete flag RD_Status : INT ; //read error indicator, valid if cmplt=TRUEEND_VARVAR in_send : BOOL ; //read in progress flag rd_os : BOOL ; //read input one-shot wt4Rsp : BOOL ; //waiting for response from slave send_os : BOOL ; sent : BOOL ; //P_SEND has been called with frame done_os : BOOL ; //flowDone rising edge clk_os : BOOL ; //10 Hz clock risign edge CTS : BOOL ; //CP340 CTS status abort : BOOL ; //one-shot detecting abort of operation msg : ARRAY [0 .. 255 ] OF //Modbus frame buffer BYTE ; tmr : INT ; //response timer current valueEND_VARVAR_TEMP

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 27 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

new_read : BOOL ; //new read request dummy : BOOL ; //dummy output coil flowSend : BOOL ; //time to send read request startSend : BOOL ; //rising edge of flowSend commDone : BOOL ; //P_SEND completed sending frame rspDone : BOOL ; //P_RCV has new response rspErr : BOOL ; //P_RCV error rspTO : BOOL ; //response timeout crcOK : BOOL ; //response CRC good doCRC : BOOL ; //checking CRC msgLen : INT ; //Modbus frame length in bytes commStat : WORD ; //P_SEND status word DBlen : INT ; //length of DATA_DB RD_End : INT ; //end register of read cnt : INT ; //data counter msgDB : INT ; //msg DB number index : DINT ; //data output pointerEND_VARBEGINNETWORKTITLE =If caller turns off Read before complete, then abort error

A #Read; FN #abort; A #in_send; JNB _001; L 3; T #RD_Status; SET ; SAVE ; CLR ;_001: A BR; R #in_send;NETWORKTITLE =new read request ?

A #Read; FP #rd_os; = #new_read; R #cmplt;NETWORKTITLE =if not reading, then done

AN #new_read; AN #in_send; SAVE ; BEC ;NETWORKTITLE =new read ignored if already in progress//RD_Status values://0 = no error//1 = already communications in progress//3 = timeout on Modbus transaction//4 = RD_Start illegal//5 = RD_Length illegal//6 = P_RCV error

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 28 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

//7 = response timeout//8 = error response from secondary//9 = bad CRC from secondary A #new_read; A #in_send; JNB _002; L 1; T #RD_Status; SET ; SAVE ; CLR ;_002: A BR; SAVE ; BEC ;NETWORKTITLE =Get size of DATA_DB

OPN #DATA_DB; //open network data DB L DBLG; //and record DB length T #DBlen; L DINO; //get message buffer DB number T #msgDB;NETWORKTITLE =Calculate last register in read//RD_Start and RD_Length are word values, so we need to multiply by 2 to get byte//values so that we can compare RD_End with DBlen. A( ; A #new_read; JNB _003; L #RD_Length; L #RD_Start; +I ; T #RD_End; AN OV; SAVE ; CLR ;_003: A BR; ) ; JNB _004; L #RD_End; L 2; *I ; T #RD_End;_004: NOP 0;NETWORKTITLE =Check RD_Start for legal range

A( ; A( ; A #new_read; A( ; L #RD_Start; L 0; <I ; ) ; O ;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 29 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

A #new_read; A( ; L #RD_End; L #DBlen; >I ; ) ; ) ; JNB _005; L 4; T #RD_Status; SET ; SAVE ; CLR ;_005: A BR; ) ; S #cmplt; R #new_read;NETWORKTITLE =Check RD_Length to make sure it won't overflow the buffer

A #new_read; A( ; L #RD_Length; L 125; >I ; ) ; JNB _006; L 5; T #RD_Status; SET ; SAVE ; CLR ;_006: A BR; S #cmplt;NETWORKTITLE =If error, then done

A #cmplt; SAVE ; BEC ;NETWORKTITLE =If new read, initialize state flags

A( ; A #new_read; JNB _007; L 0; T #RD_Status; SET ; SAVE ; CLR ;_007: A BR; ) ; S #in_send; R #wt4Rsp; R #cmplt;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 30 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

NETWORKTITLE =If time to transmit read request, assert RTS

A #in_send; = L 18.0; BLD 103; A #in_send; AN #wt4Rsp; = L 18.1; BLD 103; A #in_send; JNB _008; CALL FC 6 ( LADDR := #LADDR, DTR := L 18.0, RTS := L 18.1);

_008: NOP 0;NETWORKTITLE =After RTS asserted, wait for CTS before transmitting

CALL FC 5 ( LADDR := #LADDR, DTR_OUT := #dummy, DSR_IN := #dummy, RTS_OUT := #dummy, CTS_IN := #CTS, DCD_IN := #dummy, RI_IN := #dummy);

NOP 0;NETWORKTITLE =Once the modem has returned CTS, then time to send read command

A #in_send; AN #wt4Rsp; AN #new_read; A #CTS; = #flowSend;NETWORKTITLE =Flow control is ready for us to transmit the Modbus frame

A #flowSend; FP #send_os; = #startSend;NETWORKTITLE =Build Modbus Read Request

A #startSend; JCN sk14; L #MOD_ADDR; //secondary network address T #msg[0]; L 3; //Modbus function code 3 T #msg[1]; L #RD_Start; //register address hi byte SRW 8;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 31 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

T #msg[2]; L #RD_Start; //register address lo byte L 255; AW ; T #msg[3]; L #RD_Length; //read length hi byte SRW 8; T #msg[4]; L #RD_Length; //read length lo byte L 255; AW ; T #msg[5]; L 8; //frame length T #msgLen; CALL FC 1 (//go calculate CRC for frame msg_db := #msgDB, msg_dbb := 24,//*** hard coded offset *** msg_len := #msgLen, crctbl := #CRCTBL_DB, stat := #dummy);

sk14: NOP 0;NETWORKTITLE =Send Modbus frame to CR340 card

A #flowSend; = L 18.0; BLD 103; A #wt4Rsp; = L 18.1; BLD 103; A #in_send; JNB _009; CALL FB 3 , DB 13 ( REQ := L 18.0, R := L 18.1, LADDR := #LADDR, DB_NO := #msgDB, DBB_NO := 24, LEN := #msgLen, DONE := #commDone, ERROR := #dummy, STATUS := #commStat);

_009: NOP 0;NETWORKTITLE =Wait for specified time for response from secondary.

A #commDone; A #flowSend; FP #done_os; JNB _00a; L #Rsp_Time; T #tmr; SET ; SAVE ;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 32 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

CLR ;_00a: A BR; S #wt4Rsp;NETWORKTITLE =Waiting for response

A #wt4Rsp; = L 18.0; BLD 103; AN #in_send; = L 18.1; BLD 103; A #in_send; JNB _00b; CALL FB 2 , DB 12 ( EN_R := L 18.0, R := L 18.1, LADDR := #LADDR, DB_NO := #msgDB, DBB_NO := 24, NDR := #rspDone, ERROR := #rspErr, LEN := #msgLen, STATUS := #commStat);

_00b: NOP 0;NETWORKTITLE =...but not too long

A #wt4Rsp; //timer active only if waiting JNB sk19; L P#0.0; //pointer to bit 0 of clock LAR1 ; A DIX [AR1,P#0.0]; //get 10 Hz square wave FP #clk_os; //get 10 Hz pulse JNB sk19; L #tmr; //on 10 Hz pulse, decrement timer current L 1; -I ; T #tmr; L 0; //timer elapsed ? <=I ; SAVE ; CLR ;sk19: A BR; = #rspTO; //elapsed -> timeoutNETWORKTITLE =timeout on response

A #rspTO; JNB _00c; L 7; T #RD_Status; SET ; SAVE ; CLR ;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 33 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

_00c: A BR; S #cmplt;NETWORKTITLE =Error from P_RCV

A #rspErr; A #wt4Rsp; JNB _00d; L 6; T #RD_Status; SET ; SAVE ; CLR ;_00d: A BR; S #cmplt;NETWORKTITLE =Time to check CRC ?

A #rspDone; A #wt4Rsp; AN #cmplt; = #doCRC;NETWORKTITLE =Check Response CRC

A #doCRC; JNB _00e; CALL FC 1 ( msg_db := #msgDB, msg_dbb := 24, msg_len := #msgLen, crctbl := #CRCTBL_DB, stat := #crcOK);

_00e: NOP 0;NETWORKTITLE =Response CRC bad

A #doCRC; AN #crcOK; JNB _00f; L 9; T #RD_Status; SET ; SAVE ; CLR ;_00f: A BR; S #cmplt;NETWORKTITLE =if CRC ok, then check response's Modbus function code

A #doCRC; AN #cmplt; A( ; L #msg[1]; //response Modbus function code L 3; //code we sent

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 34 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

<>I ; ) ; JNB sk24; L 8; //bad response error code T #RD_Status; SET ; SAVE ; CLR ;sk24: A BR; S #cmplt;NETWORKTITLE =Good Response, so store response data

A #doCRC; AN #cmplt; JCN sk25; OPN #DATA_DB; L #RD_Start; //build pointer to data destination SLD 4; T #index; L P#27.0; //pointer to msg[3] = start of data LAR1 ; L #RD_Length; //init byte counter SLW 1; T #cnt;mv25: L DIB [AR1,P#0.0]; //copy byte from buffer to DATA_DB T DBB [#index]; L #index; //increment pointers L P#1.0; +D ; T #index; +AR1 P#1.0; L #cnt; //decrement byte counter L 1; -I ; T #cnt; L 0; >I ; JC mv25;sk25: NOP 0;NETWORKTITLE =Done

A #rspDone; A #wt4Rsp; O #cmplt; S #cmplt; R #in_send; R #wt4Rsp;END_FUNCTION_BLOCK

FUNCTION_BLOCK FB 9TITLE =//This function block polls a single remote PLC. Each remote PLC has a data//block associated with it, that contains data read and written to the remote//PLC. This FB writes data from the DB to the remote PLC, then reads data from

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 35 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

//remote PLC into the DB. Each of these DB's is currently organized as follows:// DBn.DBW0..38 contains the first 20 modbus holding registers read from the// remote PLC// DBn.DBW40..78 contains 20 words of data written to modbus registers 20..39// in the remote PLC.//If there is an error in communications, this FB will return ReadStatus and/or//WriteStatus <> 0. Possible error codes are:// 0 = no error// 1 = already communications in progress// 3 = timeout on Modbus send/recieve// 4 = illegal Modbus register address// 5 = illegal read/write length// 6 = recieve error reported by CP340 card// 7 = timeout on modbus response// 8 = error response from remote PLC// 9 = bad CRC from remote PLC////Once this FB has completed polling a remote PLC, it sets PollDone to tell the//calling block to advance to the next remote PLC.//If a Modbus transaction does not complete within 5 seconds (including both send//and recieve), the transaction is aborted with an error code of 3, and the next//modbus transaction is started. No retry attempts are made, since if one poll//is missed, the data will be exchanged in the next poll.AUTHOR : mmckayFAMILY : CP340NAME : PollRTUVERSION : 0.1

VAR_INPUT ModAddr : INT := 1; //Modbus Address RTUData : BLOCK_DB ; //Modbus data for RTUEND_VARVAR_OUTPUT PollDone : BOOL ; ReadStatus : INT ; WriteStatus : INT ;END_VARVAR LADDR : INT := 256; //CP340 I/O address inPoll : BOOL ; newPoll : BOOL ; ReadWrite : BOOL ; WriteDone : BOOL ; ReadDone : BOOL ; StartWrite : BOOL ; StartRead : BOOL ;END_VARVAR_TEMP toggle : BOOL ; timeout : BOOL ;END_VARBEGINNETWORKTITLE =Detect the start of each Modbus transaction

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 36 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

A #ReadWrite; FP #StartWrite; O( ; A #ReadWrite; FN #StartRead; ) ; = #toggle;NETWORKTITLE =Timeout on Modbus Transaction//If 5 seconds elapse without a new Modbus transaction starting, then abort the//current transaction (it's locked up somehow) and start a new one. AN #toggle; L S5T#5S; SD T 0; A #toggle; R T 0; NOP 0; NOP 0; A T 0; = #timeout;NETWORKTITLE =First write new data to remote PLC

A #ReadWrite; = L 1.0; BLD 103; CALL FB 4 , DB 14 ( clock := MB 100, LADDR := #LADDR, MOD_ADDR := #ModAddr, DATA_DB := #RTUData, CRCTBL_DB := 1, Rsp_Time := 20, Write := L 1.0, WR_Start := 20, WR_Length := 20, cmplt := #WriteDone, WR_Status := #WriteStatus);

NOP 0;NETWORKTITLE =After write complete, read RTU data

A( ; O #WriteDone; O #timeout; ) ; A #ReadWrite; R #ReadWrite; R #timeout;NETWORKTITLE =Then read new data from remote PLC

AN #ReadWrite; = L 1.0; BLD 103;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 37 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

CALL FB 5 , DB 15 ( clock := MB 100, LADDR := #LADDR, MOD_ADDR := #ModAddr, DATA_DB := #RTUData, CRCTBL_DB := 1, Rsp_Time := 20, Read := L 1.0, RD_Start := 0, RD_Length := 20, cmplt := #ReadDone, RD_Status := #ReadStatus);

NOP 0;NETWORKTITLE =After read, done with poll

A( ; O #ReadDone; O #timeout; ) ; AN #ReadWrite; S #ReadWrite; = #PollDone;END_FUNCTION_BLOCK

FUNCTION_BLOCK FB 8TITLE =Modbus Remote PLC poll scheduler//This function block schedules polling for up to 10 remote PLC's. The polling is//done in a round-robin fashion, starting at Modbus address 1 and going to MaxAddr,//then re-starting back at 1. MaxAddr can be set to any value between 1 and 10//(inclusive). To support more than 10 Remote PLC's, this FB will have to be//changed to make more calls to FB9, and more DB's to store the remote PLC data//will need to be added to the program. This FB maps each remote PLC's data into//a separate data block as follows:// Remote PLC 1 - DB91 Remote PLC 6 - DB96// Remote PLC 2 - DB92 Remote PLC 7 - DB97// Remote PLC 3 - DB93 Remote PLC 8 - DB98// Remote PLC 4 - DB94 Remote PLC 9 - DB99// Remote PLC 5 - DB95 Remote PLC 10 - DB100////All remote PLC's must have unique Modbus addresses in the range 1..MaxAddr. If//the addresses are not unique, or if a remote PLC is to be offline for a while,//you can disable polling the remote PLC by setting the Enable bit corresponding//to the remote PLC to FALSE. For example, to disable polling remote PLC #4, set//Enable4 to FALSE.AUTHOR : mmckayFAMILY : CP340NAME : ModPollVERSION : 0.1

VAR MaxAddr : INT := 1; //last modbus address in system Enable1 : BOOL := TRUE; //enable bits for RTU's Enable2 : BOOL := TRUE;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 38 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

Enable3 : BOOL := TRUE; Enable4 : BOOL := TRUE; Enable5 : BOOL := TRUE; Enable6 : BOOL := TRUE; Enable7 : BOOL := TRUE; Enable8 : BOOL := TRUE; Enable9 : BOOL := TRUE; Enable10 : BOOL := TRUE; PollDone1 : BOOL ; PollDone2 : BOOL ; PollDone3 : BOOL ; PollDone4 : BOOL ; PollDone5 : BOOL ; PollDone6 : BOOL ; PollDone7 : BOOL ; PollDone8 : BOOL ; PollDone9 : BOOL ; PollDone10 : BOOL ; NextPoll : BOOL ; Poll1 : BOOL ; Poll2 : BOOL ; Poll3 : BOOL ; Poll4 : BOOL ; Poll5 : BOOL ; Poll6 : BOOL ; Poll7 : BOOL ; Poll8 : BOOL ; Poll9 : BOOL ; Poll10 : BOOL ; CurRTU : INT := 1; //Current RTU Modbus address RStat1 : INT ; RStat2 : INT ; RStat3 : INT ; RStat4 : INT ; RStat5 : INT ; RStat6 : INT ; RStat7 : INT ; RStat8 : INT ; RStat9 : INT ; RStat10 : INT ; WStat1 : INT ; WStat2 : INT ; WStat3 : INT ; WStat4 : INT ; WStat5 : INT ; WStat6 : INT ; WStat7 : INT ; WStat8 : INT ; WStat9 : INT ; WStat10 : INT ; PollRTU : FB 9;END_VARBEGINNETWORKTITLE =Select Remote PLC to Poll//CurRTU contains a number between 1 and MaxAddr. Whenever FB9 completes polling

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 39 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

//a remote PLC, CurRTU is incremented (wrapping back to 1 after MaxAddr).//When CurRTU = the remote PLC number and the remote PLC polling is enabled, then//it is time to poll that PLC. A #Enable1; A( ; L #CurRTU; L 1; ==I ; ) ; = #Poll1;NETWORKTITLE =Poll Current remote PLC

A #Poll1; JNB _007; CALL #PollRTU ( ModAddr := 1, RTUData := DB 91, PollDone := #PollDone1, ReadStatus := #RStat1, WriteStatus := #WStat1);

_007: NOP 0;NETWORKTITLE =Select Remote PLC to Poll

A #Enable2; A( ; L #CurRTU; L 2; ==I ; ) ; = #Poll2;NETWORKTITLE =Poll Current remote PLC

A #Poll2; JNB _008; CALL #PollRTU ( ModAddr := 2, RTUData := DB 92, PollDone := #PollDone2, ReadStatus := #RStat2, WriteStatus := #WStat2);

_008: NOP 0;NETWORKTITLE =Select Remote PLC to Poll

A #Enable3; A( ; L #CurRTU; L 3; ==I ; ) ; = #Poll3;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 40 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

NETWORKTITLE =Poll Current remote PLC

A #Poll3; JNB _009; CALL #PollRTU ( ModAddr := 3, RTUData := DB 93, PollDone := #PollDone3, ReadStatus := #RStat3, WriteStatus := #WStat3);

_009: NOP 0;NETWORKTITLE =Select Remote PLC to Poll

A #Enable4; A( ; L #CurRTU; L 4; ==I ; ) ; = #Poll4;NETWORKTITLE =Poll Current remote PLC

A #Poll4; JNB _00a; CALL #PollRTU ( ModAddr := 4, RTUData := DB 94, PollDone := #PollDone4, ReadStatus := #RStat4, WriteStatus := #WStat4);

_00a: NOP 0;NETWORKTITLE =Select Remote PLC to Poll

A #Enable5; A( ; L #CurRTU; L 5; ==I ; ) ; = #Poll5;NETWORKTITLE =Poll Current remote PLC

A #Poll5; JNB _00b; CALL #PollRTU ( ModAddr := 5, RTUData := DB 95, PollDone := #PollDone5, ReadStatus := #RStat5,

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 41 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

WriteStatus := #WStat5);

_00b: NOP 0;NETWORKTITLE =Select Remote PLC to Poll

A #Enable6; A( ; L #CurRTU; L 6; ==I ; ) ; = #Poll6;NETWORKTITLE =Poll Current remote PLC

A #Poll6; JNB _00c; CALL #PollRTU ( ModAddr := 6, RTUData := DB 96, PollDone := #PollDone6, ReadStatus := #RStat6, WriteStatus := #WStat6);

_00c: NOP 0;NETWORKTITLE =Select Remote PLC to Poll

A #Enable7; A( ; L #CurRTU; L 7; ==I ; ) ; = #Poll7;NETWORKTITLE =Poll Current remote PLC

A #Poll7; JNB _00d; CALL #PollRTU ( ModAddr := 7, RTUData := DB 97, PollDone := #PollDone7, ReadStatus := #RStat7, WriteStatus := #WStat7);

_00d: NOP 0;NETWORKTITLE =Select Remote PLC to Poll

A #Enable8; A( ; L #CurRTU; L 8;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 42 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

==I ; ) ; = #Poll8;NETWORKTITLE =Poll Current remote PLC

A #Poll8; JNB _00e; CALL #PollRTU ( ModAddr := 8, RTUData := DB 98, PollDone := #PollDone8, ReadStatus := #RStat8, WriteStatus := #WStat8);

_00e: NOP 0;NETWORKTITLE =Select Remote PLC to Poll

A #Enable9; A( ; L #CurRTU; L 9; ==I ; ) ; = #Poll9;NETWORKTITLE =Poll Current remote PLC

A #Poll9; JNB _015; CALL #PollRTU ( ModAddr := 9, RTUData := DB 99, PollDone := #PollDone9, ReadStatus := #RStat9, WriteStatus := #WStat9);

_015: NOP 0;NETWORKTITLE =Select Remote PLC to Poll

A #Enable10; A( ; L #CurRTU; L 10; ==I ; ) ; = #Poll10;NETWORKTITLE =Poll Current remote PLC

A #Poll10; JNB _016; CALL #PollRTU ( ModAddr := 10,

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 43 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

RTUData := DB 100, PollDone := #PollDone10, ReadStatus := #RStat10, WriteStatus := #WStat10);

_016: NOP 0;NETWORKTITLE =Detect poll completion//If either FB9 returns PollDone, or the EnableN bit for the remote PLC is not//set, then it is time to advance to the next remote PLC. A( ; O #PollDone1; ON #Enable1; ) ; A #Poll1; O ; A( ; O #PollDone2; ON #Enable2; ) ; A #Poll2; O ; A( ; O #PollDone3; ON #Enable3; ) ; A #Poll3; O ; A( ; O #PollDone4; ON #Enable4; ) ; A #Poll4; O ; A( ; O #PollDone5; ON #Enable5; ) ; A #Poll5; O ; A( ; O #PollDone6; ON #Enable6; ) ; A #Poll6; O ; A( ; O #PollDone7; ON #Enable7; ) ; A #Poll7; O ; A( ; O #PollDone8; ON #Enable8; ) ;

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 44 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

A #Poll8; O ; A( ; O #PollDone9; ON #Enable9; ) ; A #Poll9; O ; A( ; O #PollDone10; ON #Enable10; ) ; A #Poll10; = #NextPoll;NETWORKTITLE =Done with poll, so increment RTU address

A #NextPoll; JNB _017; L #CurRTU; L 1; +I ; T #CurRTU;_017: NOP 0;NETWORKTITLE =After last RTU, wrap back to first

A #NextPoll; A( ; L #CurRTU; L #MaxAddr; >I ; ) ; JNB _018; L 1; T #CurRTU;_018: NOP 0;END_FUNCTION_BLOCK

S7-300/400 Tip S7-300 as Modbus Host Tip No. 6

Copyright 1997 by SIEMENS page 45 / 45 Modhost_.docStatus: 3/97 Version 1.0SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with variousapplications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

General Notes

The SIMATIC S7-300/400 Application Tips are provided to give users of the S7-300 and S7-400some indication as to how, from the view of programming technique, certain tasks can be solvedwith this controller. These instructions do not purport to cover all details or variations inequipment, nor do they provide for every possible contingency. Use of the S7-300/400Application Tips is free.

Siemens reserves the right to make changes in specifications shown herein or makeimprovements at any time without notice or obligation. It does not relieve the user ofresponsibility to use sound practices in application, installation, operation, and maintenance ofthe equipment purchased. Should a conflict arise between the general information contained inthis publication, the contents of drawings or supplementary material, or both, the latter shall takeprecedence.

Siemens is not liable, for whatever legal reason, for damages or personal injury resulting fromthe use of the application tips.

All rights reserved. Any form of duplication or distribution, including excerpts, is only permittedwith express authorization by SIEMENS.