A brief discussion on Modbus TCP communication technology of S7-300 CPU integrated PN port configuration

2. Configure the S7-300 single-station system to use the CPU integrated PN port as a Client for Modbus TCP communication

The following takes the S7-300 single-station system and Modbus Slave software as an example to introduce in detail how to configure the integrated PN port of the S7-300 single-station system CPU as a Client and the Modbus Slave as a Server for Modbus TCP communication.

2.1 Hardware and Software

The hardware devices used in this example are as follows:

The software used is as follows:

2.2 S7-300 single station system and Modbus Slave software configuration

Open the TIA software, create a new project file, name it "PN_MODBUS TCP Client", and insert an S7-300 station under the project, as shown in Figure 1 below:

Figure 1 New S7-300 Station

Open the device view and modify the IP address of the CPU. In this example, set the PN port IP address of the CPU to 192.168.0.220, as shown in Figure 17 below:

Figure 2 Setting the CPU IP address in the device view

2.3 Configuring technology objects

①Select and add the technological object "Modbus" --- "Other" --- "MODBUS TCP" --- "MB_PN_PARAM"

Figure 3 Adding a new process object

②Set “Connection Settings”

Connection ID: Connection reference identifier (range 1~4095), which will be used when calling the command later

Connection establishment: PLC acts as MODBUS TCP client and selects active.

Remote IP address: The IP address in the figure (192.168.0.228) is the IP address of the laptop

Local Device ID: Select the device type of the PLC

Local port: As a client, you do not need to specify a fixed port

Partner port: Port 502 in the figure is the port number of Modbus Slave

Figure 4 Configuration technology object

③Modbus setting "Internal"

Figure 5 Configuration technology object

③Modbus setting "data area"

In the figure below, 4 Modbus data areas are set

Figure 6 Configuration technology object

2.4 Add data blocks according to the data areas created in the technology object

According to the data area set in step 3.3 of the process object, add four data blocks, as shown in the figure below

Figure 7 Creating a data block

Figure 8 Creating a data block to store MODBUS coil data

Figure 9 Creating a data block to store MODBUS digital input types

Figure 10 Creating a data block to store MODBUS holding register data

Figure 11 Creating a data block to store MODBUS input register data

2.5 Create a data block with registry keys that can be used for authorization

Create an authorization key data block DB3 (name REG_KEY), select the type as "Global DB", open the DB block, create a variable "REG_KEY", and set the data type to "String[17]", as shown in the figure:

Figure 12 Creating a data block to store the authorization code

For how to obtain the authorization key, refer to //www.ad.siemens.com.cn/productportal/Prods/published/Comm/Comm_9.4/Comm_9.4.html

2.6 Calling OB121

Because the "MODBUSPN" instruction is in an unauthorized state before obtaining the authorization key, the CPU will report an error and shut down. In order to read the "IDENT_CODE" code of the CPU, the CPU needs to be running, and the programming error organization block OB121 must be added, as shown in the following figure:

Figure 13 Calling OB121

2.7 Calling communication instructions

Call the MODBUS TCP instruction (Communication---Others---MODBUS_TCP---MODBUSPN) and fill in the parameters.

In order to find the cause when communication fails, program segment 2 is written to capture the error code.

Figure 14 Calling the "MODBUSPN" instruction

2.8 Initialization Instructions

Create a startup organization block OB100 (name COMPLETE RESTART), the language is "STL", open the OB block, and set the initialization bit input pin register, as shown in the figure:

Figure 15 Initialize the "MODBUSPN" instruction

2.9 Communication Test

Example 1: The client reads the server's [digital input], offset 3, length 2 data

Figure 16 Communication test example

Example 2: The client reads the server's [input register], offset 0, length 3 data

Figure 17 Communication test example

Example 3: The client reads the server's [coil register], offset 0, length 8 data

Figure 18 Communication test example

Example 4: The client reads the server's [holding register], offset 0, length 3 data

Figure 19 Communication test example

Example 5: The client writes data to the server [holding register], offset 5, length 5 data

Figure 20 Communication test example

Example 6: The client writes data to the server [coil register], offset 0, length 8 data

Figure 21 Communication test example

3. Configure the S7-300 single-station system to use the CPU integrated PN port as a server for Modbus TCP communication

The following takes the S7-300 single-station system and ModScan32 software as an example to introduce in detail how to configure the integrated PN port of the S7-300 single-station system CPU as a server and ModScan32 as a client for Modbus TCP communication.

3.1 Hardware and software used in the examples

The hardware devices used in this example are as follows:

The software used is as follows:

3.2 S7-300 single station system and ModScan32 software configuration

Open the TIA software, create a new project file, name it "PN_MODBUS TCP Server", and insert an S7-300 station under the project, as shown in the following figure:

Figure 22 Create a new S7-300 Station

Open the device view and modify the IP address of the CPU. In this example, set the PN port IP address of the CPU to 192.168.0.220, as shown in Figure 17 below:

Figure 23 Setting the CPU IP address in the device view

3.3 Configuring technology objects

① Add a new process object, select "Modbus"---"Other"---"MODBUS_TCP"---"MB_PN_PARAM"

Figure 24 Adding a new process object

②Set “Connection Settings”

Connection ID: Connection reference identifier (range 1~4095), which will be used when calling the command later

Connection establishment: PLC acts as MODBUS TCP server and selects passive.

Remote IP address: You can specify or not specify the IP address of the connection partner.

Local Device ID: Select the device type of the PLC

Local port: Specify a fixed port

Partner port: Not specified

Figure 25 Configuring technology objects

③Modbus setting "Internal"

Figure 26 Configuring technology objects

④Modbus Setting "Data Area"

In the figure below, 4 Modbus data areas are set

Figure 27 Configuring technology objects

3.4 Add data blocks according to the data areas created in the technology object

According to the data area set in step 3.3 of the process object, add four data blocks, as shown in the figure below

Figure 28 Creating a data block

Figure 29 Creating a data block to store MODBUS coil data

Figure 30 Creating a data block to store MODBUS digital input types

Figure 31 Creating a data block to store MODBUS holding register data

Figure 32 Creating a data block to store MODBUS input register data

3.5 Create a data block with registry keys that can be used for authorization

Create an authorization key data block DB3 (name REG_KEY), select the type as "Global DB", open the DB block, create a variable "REG_KEY", and set the data type to "String[17]", as shown in the figure:

Figure 33 Creating a data block to store the authorization code

For how to obtain the authorization key, refer to //www.ad.siemens.com.cn/productportal/Prods/published/Comm/Comm_9.4/Comm_9.4.html

3.6 Calling OB121

Because the "MODBUSPN" instruction is in an unauthorized state before obtaining the authorization key, the CPU will report an error and shut down. In order to read the "IDENT_CODE" code of the CPU, the CPU needs to be running, and the programming error organization block OB121 must be added, as shown in the following figure:

Figure 34 OB121

3.7 Calling communication instructions

Call the MODBUS TCP instruction (Communication---Others---MODBUS_TCP---MODBUSPN) and fill in the parameters.

In order to find the cause when communication fails, program segment 2 is written to capture the error code.

Figure 35 Calling the "MODBUSPN" instruction

3.8 Initialization Instructions

Create a startup organization block OB100 (name COMPLETE RESTART), the language is "STL", open the OB block, and set the initialization bit input pin register, as shown in the following figure:

Figure 36 Initialization "MODBUSPN" instruction

3.9 Establishing a connection with the client

Enable the server side and establish a connection using ModScan32 according to the following settings:

Figure 37 Establishing a connection with the client

3.9 Communication Test

Example 1: The client reads and writes the server [coil register], offset 0, length 10 data