Î b S7-300,400 CPU L ä PN y · Modbus TCP EîA ¿Eó 9K¼ È (...

S7-300,400 CPU PN Modbus TCP

V2.4) Modbus TCP Communication Base On S7-300/400 CPU Intgrated PN Interface Getting

Started(Update V2.4)

Getting-Started Edition (2011 1 )

IA&DT Service & Support

-36

2010 3 Indusdry Solution IT S7-300/400 CPU

PN Modbus/TCP “MobusTCP PN-CPU V2.4”,

S7-300/400 CPU PN Modbus TCP , Modscan32

Modbus slave CPU PN

Modus TCP , , S7-300/400 CPU PN Modbus TCP

S7-300/400, PN CPU, Modbus TCP, ,

, , , , ,Modscan32,Modbus Slave,MobusTCP PN-

CPU V2.4

Key Words S7-300/400,CPU With Intgrated PN Interface,Open IE Communication,

Modbus TCP,Holding Register,Input Register,Read/Write,Server,Clent,

Adress Mapping,Modscan32,Modbus Slave, MobusTCP PN-CPU V2.4

Software Packet


-36

1 Modbus TCP ................................................................................... 4

1.1 ...........................................................................................4 1.2 Modbus TCP ........................................................................................................4 1.3 Modbus TCP ................................................................................5 1.4 Modbus TCP ..........................................................................................5 1.5 Modbus TCP ..............................................................................................5

2 SIMATIC S7-300/400 Modbus/TCP ....................................... 5 2.1 S7-300/400 Modbus/TCP ...................................................................5 2.2 ”ModbusTCP PN-CPU V2.4” ............................................................7

2.2.1 ” ModbusTCP PN-CPU V2.4” ................................................................7 2.2.2 ” ModbusTCP PN-CPU V2.4” ..................................................8

2.3 “ModbusTCP PN-CPU V2.4” step7 ...............................................9 3 S7-400 CPU PN Server Modbus TCP

10 3.1 .........................................................................................11 3.2 S7-400 Modscan32 ..............................................................................12 3.3 ........................................................................................................................17

4 S7-400 CPU PN Client Modbus TCP 22 4.1 .........................................................................................22 4.2 S7-400 Modbus Slave ...................................................................23 4.3 ........................................................................................................................26

5 “ModbusTCP PN-CPU V2.4” ............ 29 CPU PN Modbus TCP FB 31


-36

1 Modbus TCP MODBUS/TCP MODBUS

, , TCP/IP “Intranet” “Internet”MODBUS PLC’s I/O

I/O . MODBUS/TCP MODBUS_RTU MODBUS TCP TCP/IP

MODBUS MODBUS TCPTCP/IP MODBUS MODBUS TCP

TCP/IP MODBUS TCPMODBUS TCP

1.1 Modbus TCP TCP/IP 5

/ /

32 IP IP

Modbus .

1.2 Modbus TCP

Modbus TCP/IP Ethernet II 802.3 ,Modbus TCP

3 ,MBAP (MBAP Modbus Application Protocol Modbus ) 4 7 1 :

1 MODBUS TCP TCP/IP MODBUS TCP

”CHECKSUM” “ADDRESS” “UNIT ID”MODBUS


-36

1.3 Modbus TCP Moodbus Port 502 , Modus

2000 .

1.4 Modbus TCP , 3

1) Modbus.org 2) 65 72 100 110

, RFC 3)

3 1) 0, / (fc.3)

(fc.16) 2) 1 (fc.1) (fc.2)

(fc.4) (fc.5) (fc.6) 3) 2 (fc.15)

(fc.20) (fc.21) (fc.22) (fc.23)

1.5 Modbus TCP , Modbus TCP , : 1) Modbus TCP Connect() TCP 502

2) Modbus 7 MBAP 3) send() 4) 5) recv() 6) TCP

2 SIMATIC S7-300/400 Modbus/TCP

2.1 S7-300/400 Modbus/TCP SIMATIC S7 MODBUS/TCP

CP CPU PN 1) CP343-1 CP443-1:

S7 CP343-1 CP443-1 Modbus/TCP

"ModbusTCP CP" 2XV9450-1MB00 , ( CPU )

V4.1, 1 2 3 4 5 6 15 16 2:


-36

2: ”ModbusTCP CP V4.1”

2) CPU PN : S7 CPU PN Modbus/TCP

"ModbusTCP PN ", 2XV9450-1MB02, V2.4, (CPU ), 1 2 3 4 5 6 15 16, S7-300 S7-400 PN

CPU , 3 :

3: ”ModbusTCP PN-CPU V2.4”

3) S7-400H CP443-1 S7-400H MODBUS/TCP

Open Modbus/TCP V1 ” ModbusTCP Red V1”,

”2XV9450-1MB01”, ( CPU ) 4 :

4: ” ModbusTCP Red V1”

Open Modbus/TCP V2 ” ModbusTCP Red V2”,

”2XV9450-1MB11”, ( CPU ) 5 :


-36

5: ” ModbusTCP Red V2”

2.2 ”ModbusTCP PN-CPU V2.4”

2.2.1 ” ModbusTCP PN-CPU V2.4” 1) S7-300/400 ET200 CPU CPU

PN ModbusTCP 2) SIMATIC TCP ModbusCPU PN Open IE( ) TCP

SIMATIC S7 FB63(TSEND) FB64(TRCV) FB65(TCON)FB66(TDISCON) TCP

Modbus TCP FB63/64/65/66 FB63(TSEND) V2.1 FB64(TRCV) V2.2 FB65(TCON) V2.3 FB66(TDISCON) V2.1 3) S7-CPU PROFINET Modbus TCP FB65

"TCON" FB66 "TDISCON" FB63 "TSEND" FB64 "TRCV" Modbus TCP Modbus TCP Wizard

Modbus TCP Wizard DB STEP 7

6 Step7 DB


-36

6: Modbus TCP Wizard

Modbus TCP Wizard :

http://support.automation.siemens.com/CN/view/zh/31535566

2.2.2 ” ModbusTCP PN-CPU V2.4” 7 8 :

7:” ModbusTCP PN-CPU V2.4”



-36

8:” ModbusTCP PN-CPU V2.4”

2.3 “ModbusTCP PN-CPU V2.4” step7 ” ModbusTCP PN-CPU V2.4 " S7-

300/400 CPU PN Modbus/TCPStep7 Step7

9-11

” ModbusTCP PN-CPU V2.4" S7-300/400 CPU PN Modbus TCP

.

9:

10: ( : ”Browse..” )


-36

11: ( : ”Browse..” )

3 S7-400 CPU PN Server Modbus TCP

S7-400 Modscan32 , S7-400CPU PN Server,Modscan32 Client Modbus TCP 12

:


-36

12:

Modscan32 V7.0

3.1

1:

2:

S7-400 PS 407 10A 1 6ES7407-0KA01-0AA0

S7-400 CPU414-3PN/DP 1 6ES7414-3EM05-0AB0(V5.2)

S7-400 1 6ES7400-1JA00-0AA0

1

STEP7 V5.5 “ ModbusTCP PN-CPU V2.4” 2XV9450-1MB02 Modscan32 V7.0

“EQ_STRNG”

“MODBUSPN” PN

Modbus TCP

“MOD_CLI”:PN Modbus TCP

“TCP_COMM”

OPEN IE TCP

“TCON” TCP “TSEND”

“TRCV” “TDISCON”

“MOD_SERV”:PN Modbus TCP


-36

3.2 S7-400 Modscan32 Step7 “M_TCP_CPU_V2-4(Server)”,

S7-400 13

13: S7-400 Station

SIMATIC 400 Station “Hardware”

PS407 CPU414-3PN/DP, CPU PN IP192.70.44.10 14


-36

14: CP443-1 IP

SIMATIC TCP Modbus

CPU PN Open IE( ) TCP S7-CPU PROFINET Modbus TCP FB65 "TCON"FB66 "TDISCON" FB63 "TSEND" FB64 "TRCV" Modbus TCP

DB2“MODBUS_PARAM“ 15 16 :


-36

15:DB2“MODBUS_PARAM“ TCP

DB2“MODBUS_PARAM“ TCP 3 :

block_length W#16#40

Id ID, FB63/64/65/66

connection_type

CPU FB65(TCON) TCP( ): CPU315 317<= FWV2.3

W#16#01 TCP:CPU315,317>= FW V2.4 IM151-8PN/DP

CPU319 CPU414 CPU416 W#16#11

active_est :

S7 Client TRUE S7 Server FALSE

local_device_id

CPU IM151-8PN/DP B#16#1 CPU315 317 B#16#2 CPU319 B#16#3 CPU414 416 B#16#5

OPEN IE

local_tsap_id_len local_device_id

W#16#0 W#16#2

OPEN IE TCP


-36

3: DB2“MODBUS_PARAM“ TCP

rem_subnet_id_len

rem_staddr_len rem_staddr

B#16#0 B#16#4

rem_tsap_id_len rem_tsap_id

W#16#2 W#16#0

next_staddr_len :

CP 0 CPU PN W#16#0

local_tsap_id

TSAP , connection_type 1)connection_type= B#16#01 local_tsap_id[1] [16 ] local_tsap_id[2] [16 ] local_tsap_id[3-16] B#16#00 2)connection_type= B#16#11 local_tsap_id[1] [16 ] local_tsap_id[2] [16 ] local_tsap_id[3-16] B#16#00

rem_subnet_id

rem_staddr

IP connection_type192.168.0.1 1)connection_type= B#16#01 rem_staddr[1]= B#16#01(1), rem_staddr[2]= B#16#00(0) rem_staddr[3]= B#16#A8(168) rem_staddr[4]= B#16#C0(192) rem_staddr[5-6]=B#16#00( IPV6 ) 2)connection_type= B#16#11 rem_staddr[1]= B#16#C0(192) rem_staddr[2]= B#16#A8(168) rem_staddr[3]= B#16#00(0) rem_staddr[4]= B#16#01(1) rem_staddr[5-6]=B#16#00( IPV6 )

rem_tsap_id

TSAP , connection_type 1)connection_type= B#16#01 local_tsap_id[1] [16 ] local_tsap_id[2] [16 ] local_tsap_id[3-16] B#16#00 2)connection_type= B#16#11 local_tsap_id[1] [16 ] local_tsap_id[2] [16 ] local_tsap_id[3-16] B#16#00

next_staddr CP CPU PN B#16#00


-36

16:DB2“MODBUS_PARAM“ Modbus

Modscan32 “Connection-connection”

“Remote TCP/IP Server” IP Adress CPU IP 192.70.44.10,Server Port 502

17

(ENQ_ENR/PLC

15 16

IN

Data_type_x: Modbus

db_x:

start_x:modbus DB


-36

17: TCP Modscan32

3.3 “ ModbusTCP PN-CPU V2.4” FC1 2 3 4 5 6 15 16

FC03( )

Modbus 4:

4:Modbus

I/O

16 I/O

16


-36

FB102“MODBUSPN” OB100OB1 FB102 OB100 FB102 FB102

18 :

18: FB102“MODBUSPN”

: 18 , OB1

OB100

CPU DB2“MODBUS_PARAM“ “server_client“1 Modscan32 “Set up->Data Definition“

19

IN ID

IN Modbus TCP DB IN 20ms

IN

IN IN

IN OUT

OUT OUT

OUT OUT

OUT modbus OUT

OUT OUT

IN/OUT: IN/OUT

IN/OUT:Modbus IN/OUT

IN/OUT: IN/OUT


-36

19:Modscan32 Modbus

ModbusModbus SIMATIC DB

DB , 20 DBModbus 21


-36

20:


-36

21: DB Modbus


-36

Step7

Modscan32 CPU414-3PN/DP22

22:

4 S7-400 CPU PN Client Modbus TCP S7-400 Modbus Slave , S7-400

CPU PN Client,Modbus Slave Server Modbus TCP

12

4.1


-36

5:

6:

4.2 S7-400 Modbus Slave Step7 “M_TCP_CPU_V2-4(Client)”,

S7-400 23

S7-400 PS 407 10A 1 6ES7407-0KA01-0AA0

S7-400 CPU414-3PN/DP 1 6ES7414-3EM05-0AB0(V5.2)

S7-400 1 6ES7400-1JA00-0AA0

1

STEP7 V5.5 “ ModbusTCP PN-CPU V2.4” 2XV9450-1MB02 Modslave V4.3.0


-36

23: S7-400 Station

SIMATIC 400 Station “Hardware”

PS407 CPU414-3PN/DP, CPU PN IP192.70.44.10 24


-36

26: CPU IP

SIMATIC TCP Modbus

CPU PN Open IE( ) TCP S7-CPU PROFINET Modbus TCP FB65 "TCON"FB66 "TDISCON" FB63 "TSEND" FB64 "TRCV" Modbus TCP

DB2“MODBUS_PARAM“ DB2“MODBUS_PARAM“V3.2 15 16

Modbus Slave Connection-connection“Modbus TCP/IP” TCP/IP Server Port 502

“Ignore Unit ID” 27


-36

27: TCP Modbus Slave

-“Ignore Unit ID” Ignore Unit ID- PLC Unit ID

4.3 “ModbusTCP CP V4.1” FC1 2 3 4 5 6 15 16

FC03( )

FB102“MODBUSPN”“DATA_TYPE” DB2“MODBUS_PARAM“ “single-write”

28 :


-36

28:S7-400

FB102“MODBUSPN”

OB100 OB1 FB108 OB100 FB909FB108 V3.3 18

CPU DB2“MODBUS_PARAM“ “server_client“0 ENQ_ENR Modbus Slave “Set up-

>Slave Definition““Hide Alias Columns” “PLC Adresses(Base1)” “Insert

CRC/LRC error” “Skip response” 29


-36

29: Modbus Slave Modbus

( -

Hide Alias Columns – PLC Addresses(Base1) - PLC (1..65535)

(0-65535) Insert CRC/LRC error - CRC/LRC Skip response – )

SIMATIC DB ModbusV3.3 21

Step7Modsbus Slave CPU414-3PN/DP

( "WRITE_ READ" ) 30


-36

30:S7-400 Modbus Slave

5 “ModbusTCP PN-CPU V2.4” PC SIMATIC CPU PN Modbus

TCP CPU PN 1) 2XV9450-1MB02 CPU

S7-300 CPU 2) SIMATIC S7 DB_x DB DB

Start_x END_x


-36

3) SIMATIC S7 DBModbus

4) ID IP

FC

5) Modbus TCP 125 2000

6) S7-300/400 Client Server ServerClient

TCP Modbus/TCP 7) SIMATIC Modbus CPU

31 :

31: SIMATIC Modbus

FAQ : http://support.automation.siemens.com/CN/view/zh/34010717

S7 Open Modbus/TCP Industrial IT http://www.industrysolutions.siemens.com/industrial-services/it/en/PRODUCTS/SIMATIC_ADD_ONS/S7_OPEN_MODBUS_TCP.HTM

Modbus TCP FAQ :

“ SIMATIC OPEN MODBUS /TCP ? ” http://support.automation.siemens.com//CN/view/zh/22660304



-36

CPU PN Modbus TCP FB STATUS(Hex)

STATUS_MODBUS A001 DB(MODBUS_PARAM)

DB

A002 END_x Start_x END_x Start_x A003 Modbus DB

: - : (START_ADDRESS – start_x + LENGTH) * 2 - (START_ADDRESS – start_x + LENGTH) / 8

: · (CPU Client ) ·(CPU Server )

DB CPU Client

START-ADRESSLENGTH

CPU Server

A004 CP Client DATA_TYPE WRITE_READ

A005 CP Client LENGTH

CP Server Client ,

: / : 1 to 2000 : 1 to 1968

: 1 to 125 : 1 to 123

CPU Client LENGTH

CPU Server Client

A006 CP 1-8 Modbus

(DATA_TYPE, START_ADDRESS LENGTH ) CP

CPU Client DATA_TYPE,START-

ADRESS LENGTH CPU Server

Client data_type_x

A007 CPU Client RECV_TIME CONN_TIME

RECV_TIME20ms, CONN_ TIME 100ms

A009 CPU ClientTI

A00A CPU Client


-36

UNIT A00B CPU Client

CPU Server

CPU Client

CPU Server FB MODBUSPN

FC01 02 03 04 05 06 1516

A00C +

A00D CPU Client : MODBUS

A00E MODBUS

FB A00F 0 ,

A010 DB1-DB8 DB

DB

A011 DATA_TYPE (1-4)

A012 data_type_1data_type_2







A019 data_type_x 0db_x 0

DB 0

A01A Modbus (1-253)

A01F FB MODBUSPN



A025 data_type_2


-36

data_type_5 A026 data_type_2


















data_type_8 A079 ID DB(MODBUS_PARAM)

A07A ID(ID 1-

4095)

ID

A07B ID DB(MODBUS_PARAM)2

A07C data_type_x ( 1-4) A07D data_type_1

data_type_1

DB DB(MODBUS_PARAM)


-36

A07E DB_x

DB(MODBUS_PARAM) FB102DB

A07F FB102 PARAM_DBDB

DBPARAM_DB

A080 DB(MODBUS_PARAM)CPU

DB(MODBUS_PARAM)CPU

A081 CP Client FC05:

A082 CP Client FC06:

A083 CP Client :

DONE =TRUE ERROR = TRUE

A084 ”IDENT_CODE” A085

DB REG_KEY

A090

ERROR 1

CPUIT4industry.

A091 1( Client)

A092 2( Client)

LENGTH START_ADDRESS

A093 3( Client

) (

) A094 4( Client

)

A095 ( Client)

STATUS_CONN A100 CONN_TIME RECV_TIME

RECV_TIME

A101 TDISCON SFC6/20

7xxx SIMATIC SIMATIC manager -> mark block -> key F1 –> Ethernet -> see also -> code evaluation

8xxx SIMATIC SIMATIC manager ->

mark block -> key F1 –> Ethernet ->

http://www.ad.siemens.com.cn/download/feedback.aspx


-36

see also -> code evaluation

FB63,64,65,66 7xxx SIMATIC SIMATIC manager ->

mark block -> key F1 –> Ethernet -> see also -> code evaluation

8xxx SIMATIC SIMATIC manager ->

mark block -> key F1 –> Ethernet -> see also -> code evaluation

SFC24

80A1 DB=0 CPU DB 80B1 DB CPUU DB_x DB

CPUU 80B2 DB “Unlinked” DB “Unlinked”

A0401


-36

/

www.4008104288.com.cn

/ http://www.ad.siemens.com.cn/download/DocList.aspx?TypeId=0&CatFirst=12

/ http://support.automation.siemens.com/CN/view/zh/10805868/140000 “ ”Net http://www.ad.siemens.com.cn/service/answer/category.asp?cid=1041

: +86 400-810-4288 : +86 10 64719991 : [email protected] : www.4008104288.com.c

/

( )

© 2001-2011

http://www.4008104288.com.cn/

http://www.ad.siemens.com.cn/download/DocList.aspx?TypeId=0&CatFirst=12

http://support.automation.siemens.com/CN/view/zh/10805868/130000

http://www.ad.siemens.com.cn/service/answer/category.asp?cid=1031%20

http://www.4008104288.com.c/

Î b S7-300,400 CPU L ä PN y · Modbus TCP EîA ¿Eó 9K¼ È (...

Documents

Transcript of Î b S7-300,400 CPU L ä PN y · Modbus TCP EîA ¿Eó 9K¼ È (...