S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

SIMATIC S7-300/400 Tips Group 6

Topic S7-300 as Modbus Host

Overview This Applications Tip describes a method for getting an S7-300 family PLC to act as a Modbus RTU host device. This tip will not work for S7-400 PLC’s because the current versions of the CP441 card (6ES7 441-1AA00-0AE0 and 6ES7 441-2AA0-0AE0) do not support the ASCII driver. Hardware Requirements: • S7-300 PLC. The Modbus host code will not fit in a S7-312 (the size of the Modbus and CP340 interface code and instance DB’s is about 9 KBytes). A S7-313 will work, but a S7314 or 315 is recommended. • CP 340 Point-to-Point Communications Processor Supported Functions: • Modbus Function 3 - Read Holding Registers • Modbus Function 16 - Preset Multiple Registers Both of these functions map Modbus holding registers starting at Modbus address 40001 into a single S7 data block for each Modbus secondary. PLC Resources Used: • 9 KBytes PLC work memory for code and instance DB’s. This does not include the register storage DB for each Modbus secondary, which will use another 80+ bytes per secondary. • Timer 0, used to detect communications timeouts in polling.

Configuring the CP340 To work with the Modbus communications software, the CP340 card must be configured to use the ASCII driver. You do this using the STEP 7 Hardware Configuration utility. Once the CP340 card is added to your S7-300 rack, double-click on the card to set its properties. STEP 7 will open a window where you can set the CP340 properties.

Copyright 1997 by SIEMENS Status: 3/97

page 1 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Click on the Parameters… button, and STEP 7 will open a CP340 protocol selection window (you must have the Point-to-Point configuration software installed for this to work).

Copyright 1997 by SIEMENS Status: 3/97

page 2 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Select ASCII in the protocol list, then double-click on the Protocol icon (the box with an envelope in it) to set the port parameters.

Copyright 1997 by SIEMENS Status: 3/97

page 3 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

For the End Code of a Receive Message Frame, select “On Expiry of Character Delay Time.” Set the Character Delay Time to the time it takes to transmit 4 characters at the selected baud rate. For 9600 baud, this is about 4 ms. Set the baud rate and character frame parameters to those used by your Modbus host device. Click on the Transmission tab in the Protocol window.

In the Data Flow Control field, select “None.” In order to get finer control of the RTS/CTS timing, we will be handling flow control within our PLC program. Click on the Receiving Data tab.

Copyright 1997 by SIEMENS Status: 3/97

page 4 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Set the checkbox for “Delete CP Receive Buffer at Start-Up,” and reset the checkbox for “Prevent Overwriting.” Press the OK button to accept the port parameters, the select the File→ →Save menu item in the CP340 Parameterization window. Close the CP340 Parameterization window, the press OK in the CP340 Properties window to accept the module configuration.

Copyright 1997 by SIEMENS Status: 3/97

page 5 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Installing the Modbus Software Before installing the Modbus blocks, you must first copy the CP340 interface blocks into your program. These blocks, FB2, FB3, FC5, and FC6, are located in the CP340 library that was installed when you installed the CP340 configuration software. Drag these blocks from the library AP-off folder to your program’s AP-off folder. The Modbus software is distributed as a STEP 7 import file. blocks:

This file contains the following

FC1 Modbus CRC calculation function FB4 Modbus host Preset Multiple Registers function FB5 Modbus host Read Holding Registers function FB8 Modbus poll scheduler - polls up to 10 secondaries FB9 Modbus poll sequence function (write then read from single secondary) DB1 Table of pre-calculated CRC partial sums, used in CRC calculation. DB8 FB8 and FB9 instance data block DB12 P_RCV (CP340 receive function) instance data block DB13 P_SEND (CP340 send function) instance data block DB14 FB4 instance data block DB15 FB5 instance data block DB91..DB100 Data to/from Modbus secondary 1..10 To install these blocks into your program, right-click on the SO folder in the destination program. On the pop-up menu, select External Source File….

STEP 7 will open a file selection dialog. Select the modhost.awl import file, and press the Open button. The modhost source file has now been added to the SO folder. Right-click on the modhost source file, and select Compile from the pop-up menu.

Copyright 1997 by SIEMENS Status: 3/97

page 6 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

STEP 7 will open the LAD/STL editor to compile the source file. The compile may generate a few warning messages: ignore these. Close the LAD/STL editor. Click on the AP-off folder: the modbus blocks have been added to your program.

Copyright 1997 by SIEMENS Status: 3/97

page 7 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Using the Modbus Driver The Modbus host driver is designed to exchange data with up to 10 Modbus secondaries. As frequently as possible, the driver writes a block of 20 registers to then reads a block of 20 registers from each Modbus secondary. The station addresses of the secondaries must be in the range 1..10. The Modbus host driver is invoked by adding a call to FB8 to your OB1 code.

You may need to change some of the default configuration values in DB8 to reflect your PLC and Modbus network configuration: Location DB8.DBW0

DB8.DBX2.0

DB8.DBX2.1 DB8.DBX2.2 DB8.DBX2.3 DB8.DBX2.4 DB8.DBX2.5 DB8.DBX2.6 DB8.DBX2.7 DB8.DBX3.0 DB8.DBX3.1 DB8.DBW58

Description MaxAddr - the highest Modbus secondary address to be polled. Must be in range 1..10. This keeps the driver from trying to poll all 10 possible secondaries if you have less than 10 on your network. Enable1 - boolean set TRUE to enable polling Modbus address 1. The EnableN bits let you selectively enable and disable polling individual stations. You might want to disable polling if a station is taken down for servicing, etc. to prevent communications timeouts from slowing down your polling. Enable2 - boolean set TRUE to enable polling address 2. Enable3 - boolean set TRUE to enable polling address 3. Enable4 - boolean set TRUE to enable polling address 4. Enable5 - boolean set TRUE to enable polling address 5. Enable6 - boolean set TRUE to enable polling address 6. Enable7 - boolean set TRUE to enable polling address 7. Enable8 - boolean set TRUE to enable polling address 8. Enable9 - boolean set TRUE to enable polling address 9. Enable10 - boolean set TRUE to enable polling address 10. LADDR - the starting I/O address of your CP340 card.

Copyright 1997 by SIEMENS Status: 3/97

page 8 / 45

Default Value 1

TRUE

TRUE TRUE TRUE TRUE TRUE TRUE TRUE TRUE TRUE 256

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

The Modbus Host driver maps registers from each secondary into a separate Data Block. Secondary Address 1 2 3 4 5 6 7 8 9 10

Data Block DB91 DB92 DB93 DB94 DB95 DB96 DB97 DB98 DB99 DB100

Each secondary data block is organized as 40 16-bit registers. The first 20 registers are read from Modbus addresses 40001..40020 in the secondary. The last 20 registers are written to Modbus addresses 40021..40040 in the secondary.

Copyright 1997 by SIEMENS Status: 3/97

page 9 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Modbus Driver Program Note: In the interest of brevity, I have left the instance and secondary data blocks out of the program listing. To see a listing of these blocks, open modhost.awl with a text editor. FUNCTION FC 1: VOID TITLE =Calculate CRC of Modbus message //This FC calculates the CRC of the specified msg, using the table lookup method. //The message should be in Modbus RTU format, with Address and Function as //the first 2 bytes, and the CRC as the last 2 bytes. The message len field //should include the address, function, data, and crc fields. //The FC will replace the existing CRC with the CRC that it calculates, then //return with stat=TRUE if the original CRC = the calculated CRC. AUTHOR : mmckay FAMILY : CP340 NAME : mod_crc VERSION : 1.0

VAR_INPUT msg_db : INT := 1; //DB number containing message msg_dbb : INT := 1; //byte in msg_db where msg starts msg_len : INT ; //message length in bytes crctbl : INT ; //DB # containing precalculated crc partial sums END_VAR VAR_OUTPUT stat : BOOL ; //status output: TRUE = crc good END_VAR VAR_TEMP msgCrc : INT ;//initial msg CRC crcIndex : DWORD ; //bit index of CRC in msg DB charNdx : DWORD ; //bit index of current msg character crcAccum : INT ; //crc accumulator tblNdx : DWORD ; db_no : INT ; index : INT ; END_VAR BEGIN NETWORK TITLE =Open Data Blocks //DI = modbus message block //DB = crc table block L #crctbl; T #index; OPN DB [#index]; //open our data blocks. DI=msg, DB=crctbl L #msg_db; T #db_no; OPN DI [#db_no]; NETWORK TITLE =Check message length //If the message length is < 4, then the modbus message is invalid L DBW 0; L 4; >=I ; SAVE ; Copyright 1997 by SIEMENS Status: 3/97

page 10 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

BEC ; NETWORK TITLE =Save initial CRC L #msg_len; //convert length to bit index of crc L #msg_dbb; //..bit index = (length - crc_len + msg_start) * 8 +I ; //.. = (msg_len -2 + msg_dbb) I ; JC mv25; sk25: NOP 0; NETWORK TITLE =Done A #rspDone; A #wt4Rsp; O #cmplt; S #cmplt; R #in_send; R #wt4Rsp; END_FUNCTION_BLOCK FUNCTION_BLOCK FB 9 TITLE = //This function block polls a single remote PLC. Each remote PLC has a data //block associated with it, that contains data read and written to the remote //PLC. This FB writes data from the DB to the remote PLC, then reads data from Copyright 1997 by SIEMENS Status: 3/97

page 34 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

//remote PLC into the DB. Each of these DB's is currently organized as follows: // DBn.DBW0..38 contains the first 20 modbus holding registers read from the // remote PLC // DBn.DBW40..78 contains 20 words of data written to modbus registers 20..39 // in the remote PLC. //If there is an error in communications, this FB will return ReadStatus and/or //WriteStatus 0. Possible error codes are: // 0 = no error // 1 = already communications in progress // 3 = timeout on Modbus send/recieve // 4 = illegal Modbus register address // 5 = illegal read/write length // 6 = recieve error reported by CP340 card // 7 = timeout on modbus response // 8 = error response from remote PLC // 9 = bad CRC from remote PLC // //Once this FB has completed polling a remote PLC, it sets PollDone to tell the //calling block to advance to the next remote PLC. //If a Modbus transaction does not complete within 5 seconds (including both send //and recieve), the transaction is aborted with an error code of 3, and the next //modbus transaction is started. No retry attempts are made, since if one poll //is missed, the data will be exchanged in the next poll. AUTHOR : mmckay FAMILY : CP340 NAME : PollRTU VERSION : 0.1

VAR_INPUT ModAddr : INT := 1; //Modbus Address RTUData : BLOCK_DB ; //Modbus data for RTU END_VAR VAR_OUTPUT PollDone : BOOL ; ReadStatus : INT ; WriteStatus : INT ; END_VAR VAR LADDR : INT := 256; //CP340 I/O address inPoll : BOOL ; newPoll : BOOL ; ReadWrite : BOOL ; WriteDone : BOOL ; ReadDone : BOOL ; StartWrite : BOOL ; StartRead : BOOL ; END_VAR VAR_TEMP toggle : BOOL ; timeout : BOOL ; END_VAR BEGIN NETWORK TITLE =Detect the start of each Modbus transaction

Copyright 1997 by SIEMENS Status: 3/97

page 35 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

A #ReadWrite; FP #StartWrite; O( ; A #ReadWrite; FN #StartRead; ) ; = #toggle; NETWORK TITLE =Timeout on Modbus Transaction //If 5 seconds elapse without a new Modbus transaction starting, then abort the //current transaction (it's locked up somehow) and start a new one. AN #toggle; L S5T#5S; SD T 0; A #toggle; R T 0; NOP 0; NOP 0; A T 0; = #timeout; NETWORK TITLE =First write new data to remote PLC A #ReadWrite; = L 1.0; BLD 103; CALL FB 4 , DB 14 ( clock := MB 100, LADDR := #LADDR, MOD_ADDR := #ModAddr, DATA_DB := #RTUData, CRCTBL_DB := 1, Rsp_Time := 20, Write := L 1.0, WR_Start := 20, WR_Length := 20, cmplt := #WriteDone, WR_Status := #WriteStatus); NOP 0; NETWORK TITLE =After write complete, read RTU data A( ; O #WriteDone; O #timeout; ) ; A #ReadWrite; R #ReadWrite; R #timeout; NETWORK TITLE =Then read new data from remote PLC AN #ReadWrite; = L 1.0; BLD 103; Copyright 1997 by SIEMENS Status: 3/97

page 36 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

CALL FB 5 , DB 15 ( clock := MB 100, LADDR := #LADDR, MOD_ADDR := #ModAddr, DATA_DB := #RTUData, CRCTBL_DB := 1, Rsp_Time := 20, Read := L 1.0, RD_Start := 0, RD_Length := 20, cmplt := #ReadDone, RD_Status := #ReadStatus); NOP 0; NETWORK TITLE =After read, done with poll A( ; O #ReadDone; O #timeout; ) ; AN #ReadWrite; S #ReadWrite; = #PollDone; END_FUNCTION_BLOCK FUNCTION_BLOCK FB 8 TITLE =Modbus Remote PLC poll scheduler //This function block schedules polling for up to 10 remote PLC's. The polling is //done in a round-robin fashion, starting at Modbus address 1 and going to MaxAddr, //then re-starting back at 1. MaxAddr can be set to any value between 1 and 10 //(inclusive). To support more than 10 Remote PLC's, this FB will have to be //changed to make more calls to FB9, and more DB's to store the remote PLC data //will need to be added to the program. This FB maps each remote PLC's data into //a separate data block as follows: // Remote PLC 1 - DB91 Remote PLC 6 - DB96 // Remote PLC 2 - DB92 Remote PLC 7 - DB97 // Remote PLC 3 - DB93 Remote PLC 8 - DB98 // Remote PLC 4 - DB94 Remote PLC 9 - DB99 // Remote PLC 5 - DB95 Remote PLC 10 - DB100 // //All remote PLC's must have unique Modbus addresses in the range 1..MaxAddr. If //the addresses are not unique, or if a remote PLC is to be offline for a while, //you can disable polling the remote PLC by setting the Enable bit corresponding //to the remote PLC to FALSE. For example, to disable polling remote PLC #4, set //Enable4 to FALSE. AUTHOR : mmckay FAMILY : CP340 NAME : ModPoll VERSION : 0.1

VAR MaxAddr : INT := 1; //last modbus address in system Enable1 : BOOL := TRUE; //enable bits for RTU's Enable2 : BOOL := TRUE; Copyright 1997 by SIEMENS Status: 3/97

page 37 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

Enable3 : BOOL := TRUE; Enable4 : BOOL := TRUE; Enable5 : BOOL := TRUE; Enable6 : BOOL := TRUE; Enable7 : BOOL := TRUE; Enable8 : BOOL := TRUE; Enable9 : BOOL := TRUE; Enable10 : BOOL := TRUE; PollDone1 : BOOL ; PollDone2 : BOOL ; PollDone3 : BOOL ; PollDone4 : BOOL ; PollDone5 : BOOL ; PollDone6 : BOOL ; PollDone7 : BOOL ; PollDone8 : BOOL ; PollDone9 : BOOL ; PollDone10 : BOOL ; NextPoll : BOOL ; Poll1 : BOOL ; Poll2 : BOOL ; Poll3 : BOOL ; Poll4 : BOOL ; Poll5 : BOOL ; Poll6 : BOOL ; Poll7 : BOOL ; Poll8 : BOOL ; Poll9 : BOOL ; Poll10 : BOOL ; CurRTU : INT := 1; //Current RTU Modbus address RStat1 : INT ; RStat2 : INT ; RStat3 : INT ; RStat4 : INT ; RStat5 : INT ; RStat6 : INT ; RStat7 : INT ; RStat8 : INT ; RStat9 : INT ; RStat10 : INT ; WStat1 : INT ; WStat2 : INT ; WStat3 : INT ; WStat4 : INT ; WStat5 : INT ; WStat6 : INT ; WStat7 : INT ; WStat8 : INT ; WStat9 : INT ; WStat10 : INT ; PollRTU : FB 9; END_VAR BEGIN NETWORK TITLE =Select Remote PLC to Poll //CurRTU contains a number between 1 and MaxAddr. Whenever FB9 completes polling Copyright 1997 by SIEMENS Status: 3/97

page 38 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

//a remote PLC, CurRTU is incremented (wrapping back to 1 after MaxAddr). //When CurRTU = the remote PLC number and the remote PLC polling is enabled, then //it is time to poll that PLC. A #Enable1; A( ; L #CurRTU; L 1; ==I ; ) ; = #Poll1; NETWORK TITLE =Poll Current remote PLC A #Poll1; JNB _007; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 1, := DB 91, := #PollDone1, := #RStat1, := #WStat1);

_007: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable2; A( ; L #CurRTU; L 2; ==I ; ) ; = #Poll2; NETWORK TITLE =Poll Current remote PLC A #Poll2; JNB _008; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 2, := DB 92, := #PollDone2, := #RStat2, := #WStat2);

_008: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable3; A( ; L #CurRTU; L 3; ==I ; ) ; = #Poll3; Copyright 1997 by SIEMENS Status: 3/97

page 39 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

NETWORK TITLE =Poll Current remote PLC A #Poll3; JNB _009; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 3, := DB 93, := #PollDone3, := #RStat3, := #WStat3);

_009: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable4; A( ; L #CurRTU; L 4; ==I ; ) ; = #Poll4; NETWORK TITLE =Poll Current remote PLC A #Poll4; JNB _00a; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 4, := DB 94, := #PollDone4, := #RStat4, := #WStat4);

_00a: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable5; A( ; L #CurRTU; L 5; ==I ; ) ; = #Poll5; NETWORK TITLE =Poll Current remote PLC A #Poll5; JNB _00b; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus

:= 5, := DB 95, := #PollDone5, := #RStat5,

Copyright 1997 by SIEMENS Status: 3/97

page 40 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip WriteStatus

S7-300 as Modbus Host

Tip No. 6

:= #WStat5);

_00b: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable6; A( ; L #CurRTU; L 6; ==I ; ) ; = #Poll6; NETWORK TITLE =Poll Current remote PLC A #Poll6; JNB _00c; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 6, := DB 96, := #PollDone6, := #RStat6, := #WStat6);

_00c: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable7; A( ; L #CurRTU; L 7; ==I ; ) ; = #Poll7; NETWORK TITLE =Poll Current remote PLC A #Poll7; JNB _00d; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 7, := DB 97, := #PollDone7, := #RStat7, := #WStat7);

_00d: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable8; A( ; L #CurRTU; L 8; Copyright 1997 by SIEMENS Status: 3/97

page 41 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

==I ; ) ; = #Poll8; NETWORK TITLE =Poll Current remote PLC A #Poll8; JNB _00e; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 8, := DB 98, := #PollDone8, := #RStat8, := #WStat8);

_00e: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable9; A( ; L #CurRTU; L 9; ==I ; ) ; = #Poll9; NETWORK TITLE =Poll Current remote PLC A #Poll9; JNB _015; CALL #PollRTU ( ModAddr RTUData PollDone ReadStatus WriteStatus

:= 9, := DB 99, := #PollDone9, := #RStat9, := #WStat9);

_015: NOP 0; NETWORK TITLE =Select Remote PLC to Poll A #Enable10; A( ; L #CurRTU; L 10; ==I ; ) ; = #Poll10; NETWORK TITLE =Poll Current remote PLC A #Poll10; JNB _016; CALL #PollRTU ( ModAddr

:= 10,

Copyright 1997 by SIEMENS Status: 3/97

page 42 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip RTUData PollDone ReadStatus WriteStatus

S7-300 as Modbus Host

Tip No. 6

:= DB 100, := #PollDone10, := #RStat10, := #WStat10);

_016: NOP 0; NETWORK TITLE =Detect poll completion //If either FB9 returns PollDone, or the EnableN bit for the remote PLC is not //set, then it is time to advance to the next remote PLC. A( ; O #PollDone1; ON #Enable1; ) ; A #Poll1; O ; A( ; O #PollDone2; ON #Enable2; ) ; A #Poll2; O ; A( ; O #PollDone3; ON #Enable3; ) ; A #Poll3; O ; A( ; O #PollDone4; ON #Enable4; ) ; A #Poll4; O ; A( ; O #PollDone5; ON #Enable5; ) ; A #Poll5; O ; A( ; O #PollDone6; ON #Enable6; ) ; A #Poll6; O ; A( ; O #PollDone7; ON #Enable7; ) ; A #Poll7; O ; A( ; O #PollDone8; ON #Enable8; ) ; Copyright 1997 by SIEMENS Status: 3/97

page 43 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

A #Poll8; O ; A( ; O #PollDone9; ON #Enable9; ) ; A #Poll9; O ; A( ; O #PollDone10; ON #Enable10; ) ; A #Poll10; = #NextPoll; NETWORK TITLE =Done with poll, so increment RTU address A #NextPoll; JNB _017; L #CurRTU; L 1; +I ; T #CurRTU; _017: NOP 0; NETWORK TITLE =After last RTU, wrap back to first A #NextPoll; A( ; L #CurRTU; L #MaxAddr; >I ; ) ; JNB _018; L 1; T #CurRTU; _018: NOP 0; END_FUNCTION_BLOCK

Copyright 1997 by SIEMENS Status: 3/97

page 44 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.

S7-300/400 Tip

S7-300 as Modbus Host

Tip No. 6

General Notes The SIMATIC S7-300/400 Application Tips are provided to give users of the S7-300 and S7-400 some indication as to how, from the view of programming technique, certain tasks can be solved with this controller. These instructions do not purport to cover all details or variations in equipment, nor do they provide for every possible contingency. Use of the S7-300/400 Application Tips is free. Siemens reserves the right to make changes in specifications shown herein or make improvements at any time without notice or obligation. It does not relieve the user of responsibility to use sound practices in application, installation, operation, and maintenance of the equipment purchased. Should a conflict arise between the general information contained in this publication, the contents of drawings or supplementary material, or both, the latter shall take precedence. Siemens is not liable, for whatever legal reason, for damages or personal injury resulting from the use of the application tips. All rights reserved. Any form of duplication or distribution, including excerpts, is only permitted with express authorization by SIEMENS.

Copyright 1997 by SIEMENS Status: 3/97

page 45 / 45

Modhost_.doc Version 1.0

SIMATIC S7-300/400 customers have free use of the application tips. These tips are only a general approach to using the S7-300/400 with various applications. Your specific application may be different. It is your responsibility to use the SIMATIC S7-300/400 properly in your applications.