Using the Modbus Protocol Library ‘The STEP 7-Micro/WIN Instruction Libraries make communicating to Modbus devices easier by including pre-configured subroutines and interrupt routines that are specifically designed for Modbus communications. With the Modbus Protocol Instructions, you can configure the $7-200 to act as a Modbus master or slave device. You find these instructions in the Libraries folder of the STEP 7-MicrofWIN insvuction tree. When you put a Modbus instruction in your program, one or more associated subroutines are Automatically added to your project. ‘Siemens Libraries are sold on a separate CD, STEP 7-MicroMWIN Add-On: Instruction Library, with the order number 6€S7 830-2BC00-OYX0. After version 1.1 of the Siemens Library is Purchased and installed, any subsequent STEP 7-MicroiWIN V3.2x and V4.0 upgrade that you instal will also upgrade your libraries automatically at no addtional cost (when library additions or ‘modifications are made). In This Chapter Overview 348 Requirements for Using Madbus Protocol 348, Initialization and Execution Time for Modbus Protocol 349 Modbus Addressing 350 Using the Modbus Master Instructions 351 Using the Modbus Slave Instructions 352 Instuuctions for the Modbus Protocol 353 Advanced Topics 362‘81-200 Programmable Convallor Systom Manual Overview ‘STEP 7-MicroiWIN Instruction Libraries make communicating to Modbus master and slave devices easier by including pre-configured subroutines and interrupt routines that are specifically designed for Modbus communications Modbus slave instructions can configure the $7-200 to act as a Modbus RTU slave device and communicate to Modbus master devices, Modbus master instructions can configure the $7-200 to act as a Modbus RTU master device and ‘communicate to one or mare Modbus slave devices. ‘The Modbus instructions are install into the loraries folder in the STEP 7-MicrofWIN instruction tree. These instructions enable the $7-200 to act as a Modbus device. When you place a Modbus instruction in your pragram, one or more associated subroutines are automaticaly added to your Project ‘There are two versions of the Modbus master protocol lary. One version uses por 0 of the CPU and the other uses port 7 of the CPU. The port 7 library has a_P1 appended to the POU names (for example, MBUS_CTRL_P1) to denote that the POU utilizes port 1 on the CPU. The two Modbus master ibraries are identical n all other respects, The Modbus slave trary only supports port 0 communication, Requirements for Using Modbus Protocol 348 ‘The Modbus Master Protocol instructions use the following resources from the S7-200: Ld Initiaizing the Modbus Slave Protocol dedicates the specific CPU port for Modbus Mast Protocol communicatons. When the CPU port is being used for Modbus Master Protocol communications, it cannot be used for any other purpose, including communications with STEP 7-Micro’WIN, The MBUS_CTRL instruction controls assignment of Port 0 to Modbus Master Protocol or PPI The MBUS_CTRL_P1 instruction (rom the port 7 library) controls assignment of Port 1 to Modbus Master Protocol or PPI 1 The Modbus Master Protocol instructions affect all of the SM locations associated with Freeport communications port in use [The Modbus Master Protocol instructions use 3 subroutines and 1 interrupt routine. [The Modbus Master Protocol instructions require about 1620 bytes of program space for ‘ne two Modbus Master instructions and the suppor routines. The variables for the Modbus Master Protocol instructions require a 284 byte block of V memory. The siarling address for ths block is assigned by the user and is reserved for Modbus variables, [The $7-200 CPU must be firmware revision 2,00 or greater to support the Modbus Master Protocol Library (CPU MLFB 21x-2xx23-OXB0) [The Modbus Master Library uses the user interrupts for some functions. The user interrupts, must not be disabled by the user program, Tip ‘To change the operation of the CPU communications port back to PPI so that you can communicate with STEP 7-MicroiWIN, you can do one of the folowing: = Set the Mode parameter of the MBUS_CTRL instruction to a zero (0, = Set the mode switch on the $7-200 to STOP mode position. Either of these methods will set the CPU communications port to communicate with STEP 7-Micro/WiN.Using the Modbus Protacol Library Chapter 12 ‘The Modbus Slave Protocol instructions use the following resources from the $7-200: 1D Initializing the Modbus Slave Protocol dedicates Port 0 for Modbus Slave Protocol communications When Por 0 is being used for Modbus Slave Protocol communications, it cannot be used for any other purpose, including communications wih STEP 7-Micro/WIN. The MBUS_INIT instruction contrals assignment of Port 0 to Modbus Slave Protocol or PPI. Q._ The Modbus Slave Protocol instructions affect all of the SM locations associated with Freeport communications on Por 0. 1D. The Modbus Slave Protocol instructions use 3 subroutines and 2 interrupts. Q._ The Modbus Slave Protocol instructions require 1857 bytes of program space for the two Modbus Slave instructions and the support routines. 1D. The variables for the Modbus Slave Protocol instuctions require a 779-byte block of V memory. The starting address for this block is assigned by the user and is reserved for Modbus variables, ow ; een Free race ceca sors aloe Either of these methods will set the parameters for Port 0 so that you can communicate with STEP 7-Micro/WiN. Initialization and Execution Time for Modbus Protocol Modbus Master Protocol - The Modbus Master Protocol requires a small amount of time every scan to execute the MBUS_CTRL instruction, The time will be about 1.11 miliseconds when the MBUS_CTRL is initializing the Modbus Master (rst scan), and about 0.41 millseconds on supsequent scans, ‘Tho scan time is extended when the MBUS_MSB subroutine executes a request. Most ofthe time Is spent calculating the Modbus CRC for the request and the response. The CRC (Cyclic Redundancy Check) insures the integrty of the communications message. The scan time is extended by about 1.85 miliseconds for each word in request and in the response. A maximum Fequestrespanse {read or wre of 120 words) extends the scan time to approximately 222, miliseconds. A read request extends the scan mainly when the response is received from the slave, and to a lesser extent when the request is sent. A write request extends the scan mainly when the data is sent to the slave, and to a lesser extent when the response is received Modbus Slave Protocol - Modbus communications utilize a CRC (cyclic redundancy check) to insure the integriy of the communications messages. The Modbus Slave Protocol uses a table of precalculated values to decrease the time required to process a message. The intialization of this RC table requires about 240 miliseconds. This intiaization is done inside the MBUS_INIT subroutine and is normally done in the first scan of the user program after entering RUN mode. You are rosponsible for resetting the watchdog timer and keeping the outputs enabled (f required for expansion modules) i the time required by the MBUS_INIT subroutine and any other user initialization exceeds the 500 milisecand scan watchdog. The output module watchdog timer is reset by wring to the outputs of the module. See the Watchdag Reset Instruction in Chapter 6. ‘The scan time is extended when the MBUS_SLAVE subroutine services a request. Since most of the time is spent calculating the Modbus CRC, the scan time is extended by about 420 ‘microseconds for every byte in the request and in the response. A maximum requestiresponse (read or write of 120 words) extends the scan time by approximately 100 miliseconds. 349‘81-200 Programmable Convallor Systom Manual Modbus Addressing Modbus addresses are normally writen as 5 character values containing the data type and the offset. The first character determines the data type, and the last four characters select the proper value within the data type. Modbus Master Addressing - The Modbus Master instructions then map the address to the Correct functions to send to the slave device. The following Modbus addresses are supported by the Modbus Master instructions: [00001 to 09999 are discrete outputs (coils) [2 10001 to 19999 are diserete inputs (contacts) [30001 to 39999 are input registers (generally analog inputs) [40001 to 49999 are holding registers AllModbus addresses are one-based, meaning that the fist data value starts at address one, The range of valid addresses will depend on the slave device. Different slave devices will support diferent data types and address ranges. Modbus Slave Addressing -The Modbus Master device then maps the addresses to the correct functions. The following addresses are supported by the Modbus Slave instructions: 00001 to 00128 are discrete outputs mapped to 00.0 - 015.7 [10001 to 10128 are discrete inputs Table 12-1 Mapping Mocous Addresses tothe $7-200 mapped to 10.0 - 115.7 Modbus Address $7200 Address {A 30001 io 30082 are analog input oT 00 registers mapped to AIWO to AIW62 0002 aoa 40001 10 o#xexx are holding ‘0008 02 registers mapped to V memory AllModbus addresses are one-based. Table 12-1 shows the mapping of Modbus 00127 ans addresses tothe 57-200 addresses. ooze ans ae ‘The Modbus Slave Protocol allows you to Timit the amount of inputs, outputs, analog 0002 a inputs, and holding registers (V memory) accessible to a Modbus master. 0008 pa The MaxlQ parameter of the MBUS_INIT instruction specifes the maximum number tory nse of discrete inputs or outputs (Is or Qs) the 10128 ir Modbus master is allowed to access. 3007 a0 ‘The MaxA\ parameter of the MBUS_INIT 0002 Awe instruction specifies the maximum number sar "Awe ‘of input registers (AlWWs) the Modbus master is allowed to access. 30032 Awa? he MaxHold parameter of the MBUS_INIT.§ AE instruction specifies the maximum number 40004 Hokistert cof holding registers (V memory words) the ‘0002 HoléStarte2 Modbus master is allowed to access, t0008 Hokistetse ‘See the description of the MBUS_INIT instruction for more information on setting “howe oliStar? x boxe) Up the memory restrictions for the Modbus slave.Using the Modbus Protacol Library Chapter 12 Configuring the Symbol Table {After you enter an address forthe first symbol, the table automatically calculates and assigns the remainder of tne symbols in the table, You should assign a starting V location for the table which occupies 779 bytes. Be sure that the: assignment of the Modbus Slave symbols do not overlap with the V memory assigned to the ‘Modbus holding registers with the oldStar and MaxHolé parameters on the MBUS_INIT instruction. Ifthere is any overlap of the memory areas, the MBUS_INIT instruction rétums an Using the Modbus Master Instructions To use the Modbus Master instructions in your $7-200 program, follow these steps: 1, Insert the MBUS_CTRL instruction in your program and execute the MBUS_CTRL on every scan, You can use the MBUS_CTRL instruction either to initiate or to change the Modbus communications parameters. When you insert the MBUS_CTRL instruction, several hidden subroutines and interrupt routines are automatically added to your program 2. Use the Library Memory command to assign a starting address for the V memory required for Modbus Master Protocol instructions. 3. Place one or more MBUS_MSG instructions in your program. You can add as many MBUS_MSG instructions fo your program as you require, but only one of these instructions can be active ata time, 4. Connect the communications cable between Port 0 on the S7-200 CPU (or Port 1 for the Port library), and the Modbus slave devices. Caution interconnecting equipment with diferent reference potentials can cause unwanted currents to flow through the interconnecting cable, These unwanted currents can cause communications terrors or damage equipment. Ensure that all equipment that is connected with a communications cable either shares a common circuit reference or is isolated to prevent unwanted current flows The Modbus Master instructions use the Modbus functions shown below to read or write a specific Modbus address. The Modbus slave device must support the Madbus function(s) required to read or wrte a particular Modbus address. Table 122 Required Modbus Slave Functon Support Modbus Address Read or Write __ Modbus Slave Function Required ‘0007 to O8SE9 discrete OUD Read Function 7 Write Function § for single output point Function 18 for mutile ouput pints 7000 to 19999 discrete pus Read Function 2 Write Not possible 30001 to 39889 inputregisters Read Function 4 Write Not possible 420001 to 49999 holding registers Read Function 3 Write Function 6 fora single register Function 16 for mule register 351‘81-200 Programmable Convallor Systom Manual Using the Modbus Slave Instructions “To use the Modbus Slave instructions in your $7-200 program, follow these steps 1, _ Insert the MBUS_INIT instruction in your program and execute the MBUS_INIT instruction for one scan only, You can use the MBUS_INIT instruction either to iniiate or to change the Modbus communications parameters, When you insert the MBUS_INIT instruction, several hidden subroutines and interrupt routines are automatically added to your program 2. Use the Library Memory command to assign a starting address for the V memory required for Macbus Slave Protocol instructions 3. Place only one MBUS_SLAVE instuction in your program, This instruction is called every scan to service any requests that have been recewed. 4. Connect the communications cable between Port 0 on the $7-700 and the Modbus master device caution Interconnecting equipment with diferent reference potentials can cause unwanted currents to flow through the interconnecting cable, These unwanted currents can cause communications terrors or damage equipment. Ensure that all equipment that is connected with a communications cable either shares a common circuit reference or is isolated to prevent unwanted current flows The accumulators (ACO, AC1, AC2, AC3) are uilized by the Modbus slave inst appear in the Cross Reference isting, Prior to execution, the values in the accumula ‘Modbus Slave instruction are saved and restored to the accumulators before the Modbus Slave instruction is complete, ensuring that al user data in the accumulators is preserved while ‘executing a Modbus Slave instruction. ‘The Modbus Slave Protocol instructions suppor the Modbus RTU protocol, These instructions. utiize the Freepon ulilties of the S7-200 to suppor the most common Modbus functions. The following Modbus functions are supported: t fe 12-8 Modbus Slave Protacol Functions Supported Function Description T__ Read singlelmobple col (aserete ouipa) satus: Funclon 1 returns the onol stats of any ‘number of output pints (Qs). 2 Read singleimutiple contact (discrete inp) stats. Function 2 retuns the onlof status of any ‘number of nput points (5). | Read singleimuhiple holding registers. Functon 3 etums the cartes of V memery. Holding registers are wore values under Mabus and allow youto read up to 120 words in one request. 4 Read singleimutiple input registers. Function 4 returns Analog Input values. 5 White single col (scrote outpua). Function § seis a discrete ouput point to the specified value. ‘The points not forced and the program can overurte the value writen by the Meabus request. ‘5 White single holing register. Function 6 writes a single hokingregster value to the V memory of the 87-200, 15 Wie mutiple cols (israte ouipas). Function 15 wrkes the male disrete ouipa values tothe image register ofthe 57-200, The stating ouput point must begin ona byte boundary (or ‘example, 00.0 0 Q2.0) and the numberof outputs writen must be @ multiple of eight, This fs a restriction for te Modbus Slave Protocol instructions. The points are nat forced and te program ‘ean overwrite the values writen bythe Madbus request 16 While mliple holding registers, Function 16 wikes multiple holding registers tothe V memary of the 57-200. There can be up 0 120 words writen inane request.Using the Modbus Protacol Library Chapter 12 Instructions for the Modbus Protocol MBUS_INIT Instruction (Initialize Slave) area ‘The MBUS_INIT instruction is used to enable and intaize, orto disable Modbus communications. Before the Ea Ey MBUS_SLAVE instruction can be used, the MBUS_INIT TRUST] | ET instruction must be executed without errors. The instruction || -]81 et completes and the Done bitis set immediately, before toe vorek| eae one comtinuing to the next instruction jos, teh dee The insvucton is executed on each scan when the EN bow ry inputs on ey os ‘The MBUS_INIT instruction should be executed exactly oe Nort once for each change in communications state. Therefore, | fttstaa ate the EN input should be pulsed on through an edge oesart detection element, or executed only on ihe fst sean. es a) The value for the Mode input selects the communications protocol: an input value of 1 assigns port 0 to Modbus ‘eric protocol and enables the protacol, and an input value of 0 assigns por 0 to PPI and disables Modbus protocol The parameter Baud sets the baud rate at 1200, 2400, Daud: Party, Daly, Mast, 4800, 9600, 19200, 38400, 57600, of 115200. Baud rates a aaa 57600 and 115200 are supported by $7-200 CPUs version 1.2 0F later. “The parameter Addr sets the address at inclusive values: between 1 and 247. Table 12-4 Parameters for the MBUS_INIT Instruction Inputs/Ourputs Data Type | Operands Mode, Ada, Party BY VB. 6, QB, MB, SB, SMB, LB, AC, Constant, "VD. “AG, “0 Baud, HoldStart BWORD Vb, 1, QB, MD, SD, SMD, LD, AG, Constant, °VD, “AC, “0 Delay, MaxlO, MaxAl, MaxHola WORD YW, IW, QW, MW, SW, SMW, LW, AC, Constant, “VD, "AC, "LD Done BOOL QMS SMT VL Ewer BYTE VB, IB, QB, MB, SB, SMB, LB, AC, ‘VD, “AC, LD ‘The parameter Parity is set to match the party of the Modbus master. All settings use one stop bit. The accepted values are: 1D O-n0 parity [a 1-odd parity La 2even parity ‘The parameter Delay extends the standard Modbus end-of message timeout condition by adding the specified number of millseconds to the standard Modbus message timeout. The typical value for this parameter should be 0 when operating on a wired network. If you are using modems with eror correction, set the delay to a value of $0 to 100 mliseconds. Ifyou are using spread spectrum radios, set the delay to a value of 10 to 100 milliseconds. The Delay value can be Oto 32767 miliseconds, ‘The parameter MaxlQ sets the number of | and Q points available to Modbus addresses Oxsx and 1xxxx at values of 0 {0 128. A value of 0 disables al reads and wries to the inputs and ‘outputs. The suggested value for MaxiQ is 128, which allows access to all | ané Q points in the S7-200. 353‘81-200 Programmable Convallor Systom Manual ‘The parameter MaxAl sets the number of word input (Al) registers available to Modbus address 31000 al values of Oto 32. A value of O disables reads of the analog inputs. The suggested value for MaxAl to allow access to all of the S7-200 analog inpuls, is as follows; Ofer cpu 221 [a 16 for CPU 222 1 32for CPU 224, CPU 224xP, and CPU 226 ‘The parameter MaxHold sets the number of word holding registers in V memory available to Modbus address 4xxxx. For example, to allow the master to access 2000 bytes of V memory, set MaxHold to a value of 1000 words (nolaing registers) The parameter HoldStart is the address of the start ofthe holding registers in V memory. This value is generally set to VBO, so the parameter HoldStart is set to &VBO (address of VBO). Other V ‘memory addresses can be specified as the starting address for the holding registers to allow VBO to be used elsewhere in the project. The Modbus master has access to MaxHold number of words of V memory starting at HoldStart. When the MBUS-_INIT instruction completes, the Done outputs tumed on. The Error output byte contains the result of executing the instruction, Table 12-6 defines the error conditions that coul result from executing the instruction. MBUS_SLAVE Instruction The MBUS_SLAVE instruction is used to service a request from the Madbus master and must be executed every scan SMATE /EC4791 to allow ito check for and respond to Modbus requests. rr =I The instruction is executed on each scan when the EN BUS SIAPE) | NBUS SLAVE inputs on, Ey es Dn ‘The MBUS_SLAVE instruction has no input parameters. De Ener ‘The Done output is on when the MBUS_SLAVE instruction responds to a Modbus request. The Done output is turned off if there was no request serviced. aac ‘The Error output contains the result of executing the instruction. This output is only valid if Done is on. If Done is off, the error parameter is not changed. Table 12-6 defines the error conditions that could resuk from executing the insituction sm. HLL BUS SLAVE, Done, Ee Parameters forthe MBUS_SLAVE Insruction Data Type __ Operands BOOL TOMS SM TOL Byte VB, IB, QB, MB, SB, SMB, LB, AC, "VD. "AC, “LD Je 12-6 Modbus Slave Protacal Execullon Error Codes Error Codes 2 Memory range eror ogal baud rate or parity egal slave adaress Tegal vale for Modbus parameter Holding registers overlap Modbus Slave symbols Receive pay eror Receive CRC error egal functionrequestituncton not supported Magal memory address in request Slave funetion nat enabledUsing the Modbus Protocol Library Example of Programming the Modbus Slave Protocol Chapter 12 neo Network 204 TERT ntiaize the Modbus Slave Protocol onthe 1 " rSt scan. Sethe Slve acaress to 1, set 1 port 0 to 8600 baud wth even party all ‘ede napa faceess tal and Al vals, alow conf, | Spe 185 to 1000 holding registers (2000 peor I oyes) starting at VBO. ape ib swo1 wae CALL MBUS_INIT1.1,9600,20,128, 52,1000, ‘Shen -2v60,0.1.M81 ronlvavin Network 2 ponies: __] xecute the Modbus Slave Protocol on ewes 2 every scan, ‘00 weESRE] LD Suno a CALL MBUS_SLAVE,Mo.2.MB2 [J }_-———4e L__endve2‘81-200 Programmable Convallor Systom Manual MBUS_CTRL Instruction (Initialize Master) The MBUS_CTRL instruction for $7-200 porto (or MBUS_CTRL_P1 for port 1)s used to iniaize, monitor, or | SMNTICFRETIST to disable Modbus communications. Before the Ta = MBUS_MSG insttuction can be used, the MBUS_CTRL instruction must be executed without errors. The instruction | [meus.cra. | |meus.cra completes and the Done bitis set immediately before 7 7 continuing to the next insttucton, Ths instuction is, executed on each scan when the EN inputis on The MBUS_CTRL insitucion must be called every scan (including the fist scan) to allow itto monitor the progress of || {Mote Mede any outstanding messages intiated with te MBUS_MSG instruction. The Modbus Master Protocol will not operate Basi Dore =]8ad bone correctly unless MBUS_CTRL is called every scan, parcy Bree > Party Eo ‘The value for the Moce input selects the communications protocol. An input value of 1 assigns the CPU porto Modbus protocol ang enables the protocol. Am input value of 0 assigns the CPU port to PPI system protocol and a disables Modbus protocol — ‘The parameter Party is set to match the party ofthe UL US ETAL, Modbus slave device. All setings use one start bit and one Made baud Par, Stop bit The allowed values are: eed (2 0-noparty (1 - odd parity 2-even party The parameter Timeout is set to the number of milliseconds to wait for the response from the slave, The Timeout value can be set anywhere in the range of 1 milisecond through 32767 rmiliseconds. A typical value would be 1000 miliseconds (1 second). The Timeout parameter should be set to a value large enough so that the slave device has time to respond at the selected baud rate ‘The Timeout parameter is used to determine ifthe Modbus slave device is responding to a request. The Timeout value determines how lang the Modbus Master will wait forthe fst character of the response after the last character of the request has been sent, The Modbus ‘Master will receive the entire response from the Modbus slave device i at least one character of the response is received within the Timeout time. When the MBUS_CTRL instruction completes, the Done output is turned on, ‘The Error output contains the resuk of executing the instruction. Table 12-8 defines the error conditions that could resut from executing the MBUS_CTRL instruction. Table 12-7 Parameters forthe MBUS_CTRL Instruction Parameter Data Type | Operands Mode BOOL TOMS SMTOVL Baud DWORD VD, ID, QD, MD, SD, SMD, LD, AC, Constant, "VO. “AC, “LD Parity BYTE VB, IB, QB, MB, SB, SMB, LB, AC, Constant °VD, “AC, "LD Timeout WORD YW, IW, QW, MW, SW, SMW, LW, AC, Constant, “VD, “AC, “LD Done Bool, LOOMS SMEG UL Ewor Byte VB, IB, QB, MB, SB, SMB, LB, AC, “VD, “AC, “LDUsing the Modbus Protacol Library Chapter 12 Table 12-8 Modbus Slave Protocol Execution Error Codes Error Codes: Description @ No Error 1 Party selecton s not val z Baud rato selection is nat valid a Timeout selection is nat valid 4 Mode selection not vata MBUS_MSG Instruction ‘The MBUS_MSG instruction (or MBUS_MSG_P1 for port 1) is used to inate a request to a Modbus slave and process SMATIC/ KCI} the response. = 7 ‘The MBUS_MSG instruction intiates a request to a Modbus | [ wausasc ] | wouswec slave when both the EN input and the First inputs are on, en ew Sending the request, waiting for the response, and processing the response usually requires several scans. ‘The EN inpus must be on to enable the sending of the rest rise request, and should remain on until the Done itis sot sisye Done b -fsive one Note: Only one MBUS_MSG instruction can be active ata | dw errr B iw eror time. Ifthere is more than one MBUS_MSG instruction Ade pase enabled, the fest MBUS_MSG instruction executed willbe count {count processed and all subsequent MBUS_MSG instructions will | 4atsPtr starr bor with an error code 6. “The parameter First should be on for only one scan when there is a new request to send. The First input should be Biel pulsed on through an edge detection element (Le. Postive Edge) which will cause the request to be transmitted one [STL time. See the example program. cau, Nous, Fist Save RW.Adé. The parameter Slave isthe address of the Modbus slave Count DatPtr.Done Eror device, The allowed range is 0 through 247. Address 0 is the broadcast address and can only be used for write requests, There is no response to a broadcast request to address 0. Not all slave devices will suppor the broadcast adaress. The S7-200 Modbus Slave Library does not support the broadcast address. ‘The parameter RW specifies i this message is to be a read or a write. The following two values. are allowed for RW. 1 0- Read a1 write Discrete outputs (coils) and holding registers support both read and write requests. Discrete inputs (contacts) and input registers only support read requests. The parameter Addr is the starting Modbus address. The following ranges of values are allowed: [00001 to 09999 for discrete outputs (cols) [2 10001 to 19999 for discrete inputs (contacts) La 30001 to 39999 for input registers [40001 to 49999 for holding registers The specific range of values for Addr are based on the addresses that the Madbus slave device suppor, 357‘81-200 Programmable Convallor Systom Manual ‘The parameter Count specifies the number of data elements to read or write in this request. The Count will be the number of bits forthe bit data types, and the number of words for the word data ‘ypes. Address Oxexx Counts the number of bits to read or write [Address tx Counts the number of bits to read [Address 3x Countis the number of input register words to read [Address 4x Count s the number of holding register words to read or write he MBUS_MSG instruction will read or write a maximum of 120 words or 1920 bits (240 bytes of data). The actual limit on the value of Count wil depend upon the limits in the Modbus slave device. The paramoter DataPtr is an indiract address pointer which points to the V memory in the $7-200, CPU for the data associated with the read or write request. For a read request, DataPtr should Point tothe frst CPU memory location used to store the data read from the Modbus slave. For a ‘write request, DataPtr should point to the first CPU memory location of the data to be sentto the Modbus slave. The DataPtr value is passed into MBUS_MSG as an indirect adress pointer. For example, ifthe data to be writen to a Modbus slave device starts at address VW200 in the S7-200 CPU, the value for the DataPtr would be &VB200 (address of VB200). Pointers must always be a type VB even if they point to word data, Table 17-9 Parameters forthe MBUS_M'SG Instruction Parameter Data Type | Operands etecton element) Shave BYTE VB. IB, QB, MB, SB, SMB, LB. AC, Constant *VD, “AC, “LD aw Bye VB, 1B, QB, MB, SB, SMB, LB, AC, Constant, "VD, “AC, “LD Addr DWORD VD, 1D, QD, MD, SD, SMD, LD, AG, Constant, “VD, “AC, “LD Count N) WW, IW, QW, MW, SW, SMW, LW, AC, Gonstant, “VD, “AC, “LD DataPe WORD ave Done BOL LQMS.SMT.CVL Evror avTe VB, IB, Q8, MB, SB, SMB, [B. AC, VD. "AC, “LD Holding registers (address 4xvaxx) and input registers (address 3xxxx) are word values (2 bytes or ‘16 bits). $7-200 CPU words are formatted the same as Modbus registers. The lower numbered \-memary address is the most significant byte of the register. The higher numbered V-memory ‘address is the least significant byte of the register. The table below shows how the $7-200 byte ‘and word addressing corresponds to the Modbus register forms Table 17-10 Modus Holding Register 'S7-200 CPU Memory 'S7-200 CPU Memory Modbus Byte Address. Word address Holding Register Address Adress Hex Data Address Hex Data Address Hex Data ven! 12 wwiz00 12 200) 2 ‘ve201 3a vez02 36 ‘wwiz02 36 78 002 5678 vaz08 78 vazo4 oA ‘vwizo4 9A BC 008 8A BC var0s ac The bitdata (addresses Oxexx and 1xxxx) areas are read and written as packed bytes, thats, 8 bits are packed into each byte of data. The least significant bit ofthe frst data byte Is the addressed bitrumber (he parameter Addi). only a single bitis written then the bit must be in the teast significant bi of the by’e painted to by DataPv.Using the Modbus Protacol Library Chapter 12 var veo soos] [Lion 10008 0003 008 Lroooa igure 12-1 Forma for Packed Bytes (Discrete Input Adsresses) For bit data addresses that do not stat on even byte boundaries, the bit corresponding to the starting adgress must be in the least significant bit ofthe byte. See below for an example of the packed byte format for 3 bits starting at Modbus address 10004, Vac? vxa [ [Loe wot 10005 igure 12-2 Format for Packed Bytes (Discrete input starting at adress 10004) When writing to the discrete output data type (coils), the user is responsible for placing the bits in the correct bt positions within the packed byte before the data is passed to the MBUS_MSG instruction via DataPtr The Done output is off while a request is being sent and the response is being received, The Done output is on when the respanse is complete or when the MBUS_MSG instruction was aborted because of an error. The Error outputs valid only when the Done output is on, See the Modbus Master MBUS_MSG Execution Errors returned by the MBUS_MSG instuction, “The low numbered error codes (1 through 8) are errors that are detected by the MBUS_MSG instruction, These error codes generally indicate a problem with the input parameters of the MBUS_MSG instruction, or a problem receiving the response from the slave. Party and CRC errors indicate that there was a response but that the data was not received correctly. This is, usually caused by an electrical problem such as a bad connection or electrical noise. The high numbered error codes (starting with 101) are errors that are returned by the Modbus slave device. These errors indicate that the slave does not suppor the requested function or that the requested address (either data type or range of addresses) is nat supported by the Modbus slave device. Table 12-11 Modbus Master MBUS_MSG Execution Error Codes Error Codes: Description 0 No Error 7 Parity err in response: This is only possible even or odd party is used. The transmission was disturbed and possibly incorect data was recelved. This error is usualy caused by an electcal problem such as ieorret wing er electcal noise faflecting the communication 2 Natused 3 Receive imeaut There was no response rom the slave within the Timeout time. Some possible causes are bad elecvcal connection to the slve device, master and slave are Seto diferent baud rate party seling, and neovreet slave address, + Error in request parameter: One or more of the input parameters (Slave, RW, Add fr Count) is setto an ilegal value. Check te documentation or allowed values for the input parameters, 5 Modbus master not enabled: Call MBUS_CTRL on every scan prior to calling MBUS_MSG. 359‘81-200 Programmable Convallor Systom Manual 360 Table 12-11 Modbus Master MBUS_MSG Execution Error Cases, continued Error Codes 6 101 102 108 105 108 107 108 Program Example This example program shows how to use the Modbus Master instructions to write and then read 4 holding registers to and from a Modbus slave each time input 10.0 is turned on, Description Modbus is busy wih another request Only one MBUS_NSG mstruction can be ‘active ata ume, Error in response: The response received does not correspond tothe request. THIS mcicates some problem nthe slave ceiice or thatthe wrong slave device answered the request. ‘ERC error in response: The wransmission was disturbed and possibly ncorect data was received, This error is usually caused by an electrical prablam such as incorrect wing oF electrical nase afecting the communication, Slave does not suppor the requested function at this address: See the required Modbus slave function suppor table inthe "Using the Modbus master Instuctons” help topic. Save does nat support the data address: The requested address range of Ada plus Counts oursie the allowed aderess range of the slave. Slave does not support the datatype: The Ader type not supported by the slave device, Slave accepted the message but the response is delayed: This isan eor for MBUS_MSG and the usor program should resend tho requost ata lator imo. Slave accopted the message but the fespanse is delayed: Ths isan oro fr MBUS_MSG and the user program should resend the request ata later me, Slave is busy and rejected the message: You can vy the same request again to get a Slave ejected the message for an unknown reason Slave memary pry error: There is an exrorin the Slave dove ‘The S7-200 CPU will write 4 words starting at VW100 to the Modus slave. The data willbe written to 4 holding registers in the slave starting at address 40001 ‘The S7-200 CPU will then read 4 holding registers from the Modbus slave, The data will come from holding registers 40010 - 40073 and be placed into the V-memory of the $7-200 CPU starting at VW200, 57-200 CPU Modbus Slave ‘Memon Holding Registers > ee 0003 0008 igure 12:3 Example Program Data TransfersUsing the Modbus Protacol Library Chapter 12 Example of Programming the Modbus Master Protocol ‘The program wilturn on oulputs 00.1 and Q9.2 I there is an error retumed from the MBUS_MSG instruction. a es Motor 5 ven bee LN ee Ls) Network 7 /Vinsaize and montor the Modbus {Master by caling MBUS_CTRL on every scan, |The Modbus Master fs set fer 9600 baud Ivan ne party. The slave is allowed 1000 1 miliseconds (1 secone) o respond, Newark 2 11 On the fst sean, reset the enable lags 1 (42.0 and M21) used for te two /MBUS_MSG instructions. Nework |. When 10.0 changes from OFF to ON, set 1 the enable fag fr the frst MBUS_MISG ‘Vinstuction (2.9) Newark 4 1. Callthe MBUS_MSG instruction when the 1 rs enable lag (M2.0) 's ON. The First 1V parameter must be set for ony the frst 1V Scan that te instruction fs enable. JVThis instuction wits (RW = 1) 4 holding Iregsters to slave 2. The wrte data is taken ii from V8100 VB107 (@ words) te CPU Jane written to address 40007 - 40004 in {the Modbus slave. Newark 5 ‘when the fst MBUS_M'SG instuction is Ii complete (Done goes from Oo 1), clear ithe enable forthe fist MBUS MSG andl se 17 the enable forthe second MEUS_MSG ‘vinstuctio, {NT Error (MB1) is nat zero then Set Q0.1 to Iishow the error. Newark 1. Call the second MBUS_MSG instruction {1 wea tne second enable lag (M2.1)S ON. 1 The Fist parameter must be se er only ithe fest sean thatthe instruction is enables |i instuction reads (RW = 0) 4 hong IV rogsters from slave 2. The datas read {from aderess 40010 - 40013 in the Modbus 1 lave and copied to VB200 - V207 (4 words) in te CPU. Newark 7 |iWhen the second MBUS_MSG instruction Vis complete (Done goes from 0 to 1), clear {ithe enabie forthe seconé MBUS_MSG instuction, 1 Ere (ME) is nat zer then set 0.20 Iishow the error. 361‘81-200 Programmable Convallor Systom Manual Advanced Topics This topic contains information for advanced users of the Modbus Master Protocol Library. Most Users of the Modbus Master Protacol Library should not need this information and shoulé not ‘modify the default operation of the Modbus Master Protocol Library, Retries ‘The Modbus Master instructions will automatically resend the request to the slave device if one of the following errors is detected: There is no response within the response timeout ime (parameter Timeout on the MBUS_CTRL) Instruction (Error code 3). [The time between characters of the response exceeded the allowed value (Error code 3) La There is party errorin the response from the slave (Error code 1). [There is a CRC error in the response from the slave (Error cade 8) [The returned function did not match the request (Error code 7). he Modbus Master will resend the request two additional times before setting the Done and Error output parameters, he number of retries can be changed by finding the symbol mModbusRetres in the Modbus ‘Master symbol table and changing this value after MBUS_CTRL has been executed. The mMocbusReties value is a BYTE with a range of Oto 258 relries Inter-character timeout ‘The Modbus Master will abort a response from a slave device ifthe time between characters in the response exceeds a specified ime lit. The defaul time is set to 100 milliseconds which should allow the Modbus Master Protocol to work with most slave devices over wire or telephone modems. Ifthis ertoris detected, the MBUS CTRL Error parameter will be set to error code 3. here may be cases where a longer time between characters is required, either because of the \wansmission medium (ie. telephone modem) or because the slave device itself requires more time, This timeout can be lengthened by finding the symbol mModbusCharTimeout in the Modbus Master symbol table ang changing this value after MBUS_CTRL has been executed, he mModbusCharTimeout value is an INT with a range of 1 to 30000 miliseconds, Single vs. Multiple BitWord Write Functions ‘Some Modbus slave devices do not support the Modbus functions to write a single discrete output bit (Modbus function 5) or to write a single holding register (Modbus function 6). These devices only support the multiple bit write (Modbus function 15) or multiple register write (Modbus function 16) instead. The MBUS_MSG instruction will turn an error cade 101 ifthe slave device does not ‘suppor the single bivword Modbus functions. ‘The Modbus Master Protocol allows you to force the MBUS_MSG instruction to use the multiple bitiword Modbus functions instead of the single biword Modbus functions. You can force the ‘multiple bk/word instructions by finding the symbol mMacbusForceMuti in the Modbus Master symbol table and changing this value after MBUS_CTRI. has been executed. The mMadbusForceMult value is a data type BOOL value and should be Seto a 1 to force the use fof the mukiple bitword functions when a single bitregister is writen, 362Using the Modbus Protacol Library Chapter 12 Accumulator Usage The accumulators (ACO, AC1, AC2, AC3) are utilized by the Modbus Master instructions and appear in the Cross Reference listing, The values in the accumulators are saved and restored by the Modbus Master instructions. Alluser data in the accumulators is preserved while executing the Modbus Master instructions. Holding Registers Addresses Greater Than 9999 Modbus holding addresses are generally within the range of 40001 through 43999. This range is ‘adequate for most applications But there are some Modbus slave devices with data mapped into holding registers with addresses greater than 9999, These devices do not fk the normal Modbus addressing scheme, ‘The Modbus Master instructions support addressing holding registers greater than 9999 via an aerate adcressing method, The MBUS_MSG instruction allows an additional range for the parameter Adgr to Support an extended range of halding register addresses, 400001 to 465536 for holding registers For example: to access halding register 16768, the Addr parameter of MBUS_MSG should be set to 416768, ‘The extended addressing allows access to the fullrange of 65536 possible addresses supported by the Modbus protocol. This extended addressing is only supported for holding registers. 363‘81-200 Programmable Convallor Systom Manual