Î b S7-300,400 CPU L ä PN y · Modbus TCP EîA ¿Eó 9K¼ È (...
Transcript of Î b S7-300,400 CPU L ä PN y · Modbus TCP EîA ¿Eó 9K¼ È (...
S7-300,400 CPU PN Modbus TCP
V2.4) Modbus TCP Communication Base On S7-300/400 CPU Intgrated PN Interface Getting
Started(Update V2.4)
Getting-Started Edition (2011 1 )
IA&DT Service & Support
Page 2-36
2010 3 Indusdry Solution IT S7-300/400 CPU
PN Modbus/TCP “MobusTCP PN-CPU V2.4”,
S7-300/400 CPU PN Modbus TCP , Modscan32
Modbus slave CPU PN
Modus TCP , , S7-300/400 CPU PN Modbus TCP
S7-300/400, PN CPU, Modbus TCP, ,
, , , , ,Modscan32,Modbus Slave,MobusTCP PN-
CPU V2.4
Key Words S7-300/400,CPU With Intgrated PN Interface,Open IE Communication,
Modbus TCP,Holding Register,Input Register,Read/Write,Server,Clent,
Adress Mapping,Modscan32,Modbus Slave, MobusTCP PN-CPU V2.4
Software Packet
IA&DT Service & Support
Page 3-36
1 Modbus TCP ................................................................................... 4
1.1 ...........................................................................................4 1.2 Modbus TCP ........................................................................................................4 1.3 Modbus TCP ................................................................................5 1.4 Modbus TCP ..........................................................................................5 1.5 Modbus TCP ..............................................................................................5
2 SIMATIC S7-300/400 Modbus/TCP ....................................... 5 2.1 S7-300/400 Modbus/TCP ...................................................................5 2.2 ”ModbusTCP PN-CPU V2.4” ............................................................7
2.2.1 ” ModbusTCP PN-CPU V2.4” ................................................................7 2.2.2 ” ModbusTCP PN-CPU V2.4” ..................................................8
2.3 “ModbusTCP PN-CPU V2.4” step7 ...............................................9 3 S7-400 CPU PN Server Modbus TCP
10 3.1 .........................................................................................11 3.2 S7-400 Modscan32 ..............................................................................12 3.3 ........................................................................................................................17
4 S7-400 CPU PN Client Modbus TCP 22 4.1 .........................................................................................22 4.2 S7-400 Modbus Slave ...................................................................23 4.3 ........................................................................................................................26
5 “ModbusTCP PN-CPU V2.4” ............ 29 CPU PN Modbus TCP FB 31
IA&DT Service & Support
Page 4-36
1 Modbus TCP MODBUS/TCP MODBUS
, , TCP/IP “Intranet” “Internet”MODBUS PLC’s I/O
I/O . MODBUS/TCP MODBUS_RTU MODBUS TCP TCP/IP
MODBUS MODBUS TCPTCP/IP MODBUS MODBUS TCP
TCP/IP MODBUS TCPMODBUS TCP
1.1 Modbus TCP TCP/IP 5
/ /
32 IP IP
Modbus .
1.2 Modbus TCP
Modbus TCP/IP Ethernet II 802.3 ,Modbus TCP
3 ,MBAP (MBAP Modbus Application Protocol Modbus ) 4 7 1 :
1 MODBUS TCP TCP/IP MODBUS TCP
”CHECKSUM” “ADDRESS” “UNIT ID”MODBUS
IA&DT Service & Support
Page 5-36
1.3 Modbus TCP Moodbus Port 502 , Modus
2000 .
1.4 Modbus TCP , 3
1) Modbus.org 2) 65 72 100 110
, RFC 3)
3 1) 0, / (fc.3)
(fc.16) 2) 1 (fc.1) (fc.2)
(fc.4) (fc.5) (fc.6) 3) 2 (fc.15)
(fc.20) (fc.21) (fc.22) (fc.23)
1.5 Modbus TCP , Modbus TCP , : 1) Modbus TCP Connect() TCP 502
2) Modbus 7 MBAP 3) send() 4) 5) recv() 6) TCP
2 SIMATIC S7-300/400 Modbus/TCP
2.1 S7-300/400 Modbus/TCP SIMATIC S7 MODBUS/TCP
CP CPU PN 1) CP343-1 CP443-1:
S7 CP343-1 CP443-1 Modbus/TCP
"ModbusTCP CP" 2XV9450-1MB00 , ( CPU )
V4.1, 1 2 3 4 5 6 15 16 2:
IA&DT Service & Support
Page 6-36
2: ”ModbusTCP CP V4.1”
2) CPU PN : S7 CPU PN Modbus/TCP
"ModbusTCP PN ", 2XV9450-1MB02, V2.4, (CPU ), 1 2 3 4 5 6 15 16, S7-300 S7-400 PN
CPU , 3 :
3: ”ModbusTCP PN-CPU V2.4”
3) S7-400H CP443-1 S7-400H MODBUS/TCP
Open Modbus/TCP V1 ” ModbusTCP Red V1”,
”2XV9450-1MB01”, ( CPU ) 4 :
4: ” ModbusTCP Red V1”
Open Modbus/TCP V2 ” ModbusTCP Red V2”,
”2XV9450-1MB11”, ( CPU ) 5 :
IA&DT Service & Support
Page 7-36
5: ” ModbusTCP Red V2”
2.2 ”ModbusTCP PN-CPU V2.4”
2.2.1 ” ModbusTCP PN-CPU V2.4” 1) S7-300/400 ET200 CPU CPU
PN ModbusTCP 2) SIMATIC TCP ModbusCPU PN Open IE( ) TCP
SIMATIC S7 FB63(TSEND) FB64(TRCV) FB65(TCON)FB66(TDISCON) TCP
Modbus TCP FB63/64/65/66 FB63(TSEND) V2.1 FB64(TRCV) V2.2 FB65(TCON) V2.3 FB66(TDISCON) V2.1 3) S7-CPU PROFINET Modbus TCP FB65
"TCON" FB66 "TDISCON" FB63 "TSEND" FB64 "TRCV" Modbus TCP Modbus TCP Wizard
Modbus TCP Wizard DB STEP 7
6 Step7 DB
IA&DT Service & Support
Page 8-36
6: Modbus TCP Wizard
Modbus TCP Wizard :
http://support.automation.siemens.com/CN/view/zh/31535566
2.2.2 ” ModbusTCP PN-CPU V2.4” 7 8 :
7:” ModbusTCP PN-CPU V2.4”
IA&DT Service & Support
Page 9-36
8:” ModbusTCP PN-CPU V2.4”
2.3 “ModbusTCP PN-CPU V2.4” step7 ” ModbusTCP PN-CPU V2.4 " S7-
300/400 CPU PN Modbus/TCPStep7 Step7
9-11
” ModbusTCP PN-CPU V2.4" S7-300/400 CPU PN Modbus TCP
.
9:
10: ( : ”Browse..” )
IA&DT Service & Support
Page 10-36
11: ( : ”Browse..” )
3 S7-400 CPU PN Server Modbus TCP
S7-400 Modscan32 , S7-400CPU PN Server,Modscan32 Client Modbus TCP 12
:
IA&DT Service & Support
Page 11-36
12:
Modscan32 V7.0
3.1
1:
2:
S7-400 PS 407 10A 1 6ES7407-0KA01-0AA0
S7-400 CPU414-3PN/DP 1 6ES7414-3EM05-0AB0(V5.2)
S7-400 1 6ES7400-1JA00-0AA0
1
STEP7 V5.5 “ ModbusTCP PN-CPU V2.4” 2XV9450-1MB02 Modscan32 V7.0
“EQ_STRNG”
“MODBUSPN” PN
Modbus TCP
“MOD_CLI”:PN Modbus TCP
“TCP_COMM”
OPEN IE TCP
“TCON” TCP “TSEND”
“TRCV” “TDISCON”
“MOD_SERV”:PN Modbus TCP
IA&DT Service & Support
Page 12-36
3.2 S7-400 Modscan32 Step7 “M_TCP_CPU_V2-4(Server)”,
S7-400 13
13: S7-400 Station
SIMATIC 400 Station “Hardware”
PS407 CPU414-3PN/DP, CPU PN IP192.70.44.10 14
IA&DT Service & Support
Page 13-36
14: CP443-1 IP
SIMATIC TCP Modbus
CPU PN Open IE( ) TCP S7-CPU PROFINET Modbus TCP FB65 "TCON"FB66 "TDISCON" FB63 "TSEND" FB64 "TRCV" Modbus TCP
DB2“MODBUS_PARAM“ 15 16 :
IA&DT Service & Support
Page 14-36
15:DB2“MODBUS_PARAM“ TCP
DB2“MODBUS_PARAM“ TCP 3 :
block_length W#16#40
Id ID, FB63/64/65/66
connection_type
CPU FB65(TCON) TCP( ): CPU315 317<= FWV2.3
W#16#01 TCP:CPU315,317>= FW V2.4 IM151-8PN/DP
CPU319 CPU414 CPU416 W#16#11
active_est :
S7 Client TRUE S7 Server FALSE
local_device_id
CPU IM151-8PN/DP B#16#1 CPU315 317 B#16#2 CPU319 B#16#3 CPU414 416 B#16#5
OPEN IE
local_tsap_id_len local_device_id
W#16#0 W#16#2
OPEN IE TCP
IA&DT Service & Support
Page 15-36
3: DB2“MODBUS_PARAM“ TCP
rem_subnet_id_len
rem_staddr_len rem_staddr
B#16#0 B#16#4
rem_tsap_id_len rem_tsap_id
W#16#2 W#16#0
next_staddr_len :
CP 0 CPU PN W#16#0
local_tsap_id
TSAP , connection_type 1)connection_type= B#16#01 local_tsap_id[1] [16 ] local_tsap_id[2] [16 ] local_tsap_id[3-16] B#16#00 2)connection_type= B#16#11 local_tsap_id[1] [16 ] local_tsap_id[2] [16 ] local_tsap_id[3-16] B#16#00
rem_subnet_id
rem_staddr
IP connection_type192.168.0.1 1)connection_type= B#16#01 rem_staddr[1]= B#16#01(1), rem_staddr[2]= B#16#00(0) rem_staddr[3]= B#16#A8(168) rem_staddr[4]= B#16#C0(192) rem_staddr[5-6]=B#16#00( IPV6 ) 2)connection_type= B#16#11 rem_staddr[1]= B#16#C0(192) rem_staddr[2]= B#16#A8(168) rem_staddr[3]= B#16#00(0) rem_staddr[4]= B#16#01(1) rem_staddr[5-6]=B#16#00( IPV6 )
rem_tsap_id
TSAP , connection_type 1)connection_type= B#16#01 local_tsap_id[1] [16 ] local_tsap_id[2] [16 ] local_tsap_id[3-16] B#16#00 2)connection_type= B#16#11 local_tsap_id[1] [16 ] local_tsap_id[2] [16 ] local_tsap_id[3-16] B#16#00
next_staddr CP CPU PN B#16#00
IA&DT Service & Support
Page 16-36
16:DB2“MODBUS_PARAM“ Modbus
Modscan32 “Connection-connection”
“Remote TCP/IP Server” IP Adress CPU IP 192.70.44.10,Server Port 502
17
(ENQ_ENR/PLC
15 16
IN
Data_type_x: Modbus
db_x:
start_x:modbus DB
IA&DT Service & Support
Page 17-36
17: TCP Modscan32
3.3 “ ModbusTCP PN-CPU V2.4” FC1 2 3 4 5 6 15 16
FC03( )
Modbus 4:
4:Modbus
I/O
16 I/O
16
IA&DT Service & Support
Page 18-36
FB102“MODBUSPN” OB100OB1 FB102 OB100 FB102 FB102
18 :
18: FB102“MODBUSPN”
: 18 , OB1
OB100
CPU DB2“MODBUS_PARAM“ “server_client“1 Modscan32 “Set up->Data Definition“
19
IN ID
IN Modbus TCP DB IN 20ms
IN
IN IN
IN OUT
OUT OUT
OUT OUT
OUT modbus OUT
OUT OUT
IN/OUT: IN/OUT
IN/OUT:Modbus IN/OUT
IN/OUT: IN/OUT
IA&DT Service & Support
Page 22-36
Step7
Modscan32 CPU414-3PN/DP22
22:
4 S7-400 CPU PN Client Modbus TCP S7-400 Modbus Slave , S7-400
CPU PN Client,Modbus Slave Server Modbus TCP
12
4.1
IA&DT Service & Support
Page 23-36
5:
6:
4.2 S7-400 Modbus Slave Step7 “M_TCP_CPU_V2-4(Client)”,
S7-400 23
S7-400 PS 407 10A 1 6ES7407-0KA01-0AA0
S7-400 CPU414-3PN/DP 1 6ES7414-3EM05-0AB0(V5.2)
S7-400 1 6ES7400-1JA00-0AA0
1
STEP7 V5.5 “ ModbusTCP PN-CPU V2.4” 2XV9450-1MB02 Modslave V4.3.0
IA&DT Service & Support
Page 24-36
23: S7-400 Station
SIMATIC 400 Station “Hardware”
PS407 CPU414-3PN/DP, CPU PN IP192.70.44.10 24
IA&DT Service & Support
Page 25-36
26: CPU IP
SIMATIC TCP Modbus
CPU PN Open IE( ) TCP S7-CPU PROFINET Modbus TCP FB65 "TCON"FB66 "TDISCON" FB63 "TSEND" FB64 "TRCV" Modbus TCP
DB2“MODBUS_PARAM“ DB2“MODBUS_PARAM“V3.2 15 16
Modbus Slave Connection-connection“Modbus TCP/IP” TCP/IP Server Port 502
“Ignore Unit ID” 27
IA&DT Service & Support
Page 26-36
27: TCP Modbus Slave
-“Ignore Unit ID” Ignore Unit ID- PLC Unit ID
4.3 “ModbusTCP CP V4.1” FC1 2 3 4 5 6 15 16
FC03( )
FB102“MODBUSPN”“DATA_TYPE” DB2“MODBUS_PARAM“ “single-write”
28 :
IA&DT Service & Support
Page 27-36
28:S7-400
FB102“MODBUSPN”
OB100 OB1 FB108 OB100 FB909FB108 V3.3 18
CPU DB2“MODBUS_PARAM“ “server_client“0 ENQ_ENR Modbus Slave “Set up-
>Slave Definition““Hide Alias Columns” “PLC Adresses(Base1)” “Insert
CRC/LRC error” “Skip response” 29
IA&DT Service & Support
Page 28-36
29: Modbus Slave Modbus
( -
Hide Alias Columns – PLC Addresses(Base1) - PLC (1..65535)
(0-65535) Insert CRC/LRC error - CRC/LRC Skip response – )
SIMATIC DB ModbusV3.3 21
Step7Modsbus Slave CPU414-3PN/DP
( "WRITE_ READ" ) 30
IA&DT Service & Support
Page 29-36
30:S7-400 Modbus Slave
5 “ModbusTCP PN-CPU V2.4” PC SIMATIC CPU PN Modbus
TCP CPU PN 1) 2XV9450-1MB02 CPU
S7-300 CPU 2) SIMATIC S7 DB_x DB DB
Start_x END_x
IA&DT Service & Support
Page 30-36
3) SIMATIC S7 DBModbus
4) ID IP
FC
5) Modbus TCP 125 2000
6) S7-300/400 Client Server ServerClient
TCP Modbus/TCP 7) SIMATIC Modbus CPU
31 :
31: SIMATIC Modbus
FAQ : http://support.automation.siemens.com/CN/view/zh/34010717
S7 Open Modbus/TCP Industrial IT http://www.industrysolutions.siemens.com/industrial-services/it/en/PRODUCTS/SIMATIC_ADD_ONS/S7_OPEN_MODBUS_TCP.HTM
Modbus TCP FAQ :
“ SIMATIC OPEN MODBUS /TCP ? ” http://support.automation.siemens.com//CN/view/zh/22660304
IA&DT Service & Support
Page 31-36
CPU PN Modbus TCP FB STATUS(Hex)
STATUS_MODBUS A001 DB(MODBUS_PARAM)
DB
A002 END_x Start_x END_x Start_x A003 Modbus DB
: - : (START_ADDRESS – start_x + LENGTH) * 2 - (START_ADDRESS – start_x + LENGTH) / 8
: · (CPU Client ) ·(CPU Server )
DB CPU Client
START-ADRESSLENGTH
CPU Server
A004 CP Client DATA_TYPE WRITE_READ
A005 CP Client LENGTH
CP Server Client ,
: / : 1 to 2000 : 1 to 1968
: 1 to 125 : 1 to 123
CPU Client LENGTH
CPU Server Client
A006 CP 1-8 Modbus
(DATA_TYPE, START_ADDRESS LENGTH ) CP
CPU Client DATA_TYPE,START-
ADRESS LENGTH CPU Server
Client data_type_x
A007 CPU Client RECV_TIME CONN_TIME
RECV_TIME20ms, CONN_ TIME 100ms
A009 CPU ClientTI
A00A CPU Client
IA&DT Service & Support
Page 32-36
UNIT A00B CPU Client
CPU Server
CPU Client
CPU Server FB MODBUSPN
FC01 02 03 04 05 06 1516
A00C +
A00D CPU Client : MODBUS
A00E MODBUS
FB A00F 0 ,
A010 DB1-DB8 DB
DB
A011 DATA_TYPE (1-4)
A012 data_type_1data_type_2
A013 data_type_1data_type_3
A014 data_type_1data_type_4
A015 data_type_1data_type_5
A016 data_type_1data_type_6
A017 data_type_1data_type_7
A018 data_type_1data_type_8
A019 data_type_x 0db_x 0
DB 0
A01A Modbus (1-253)
A01F FB MODBUSPN
A023 data_type_2data_type_3
A024 data_type_2data_type_4
A025 data_type_2
IA&DT Service & Support
Page 33-36
data_type_5 A026 data_type_2
data_type_6 A027 data_type_2
data_type_7 A028 data_type_2
data_type_8 A034 data_type_3
data_type_4 A035 data_type_3
data_type_5 A036 data_type_3
data_type_6 A037 data_type_3
data_type_7 A038 data_type_3
data_type_8 A045 data_type_4
data_type_5 A046 data_type_4
data_type_6 A047 data_type_4
data_type_7 A048 data_type_4
data_type_8 A056 data_type_5
data_type_6 A057 data_type_5
data_type_7 A058 data_type_5
data_type_8 A067 data_type_6
data_type_7 A068 data_type_6
data_type_8 A078 data_type_7
data_type_8 A079 ID DB(MODBUS_PARAM)
A07A ID(ID 1-
4095)
ID
A07B ID DB(MODBUS_PARAM)2
A07C data_type_x ( 1-4) A07D data_type_1
data_type_1
DB DB(MODBUS_PARAM)
IA&DT Service & Support
Page 34-36
A07E DB_x
DB(MODBUS_PARAM) FB102DB
A07F FB102 PARAM_DBDB
DBPARAM_DB
A080 DB(MODBUS_PARAM)CPU
DB(MODBUS_PARAM)CPU
A081 CP Client FC05:
A082 CP Client FC06:
A083 CP Client :
DONE =TRUE ERROR = TRUE
A084 ”IDENT_CODE” A085
DB REG_KEY
A090
ERROR 1
CPUIT4industry.
A091 1( Client)
A092 2( Client)
LENGTH START_ADDRESS
A093 3( Client
) (
) A094 4( Client
)
A095 ( Client)
STATUS_CONN A100 CONN_TIME RECV_TIME
RECV_TIME
A101 TDISCON SFC6/20
7xxx SIMATIC SIMATIC manager -> mark block -> key F1 –> Ethernet -> see also -> code evaluation
8xxx SIMATIC SIMATIC manager ->
mark block -> key F1 –> Ethernet ->
IA&DT Service & Support
Page 35-36
see also -> code evaluation
FB63,64,65,66 7xxx SIMATIC SIMATIC manager ->
mark block -> key F1 –> Ethernet -> see also -> code evaluation
8xxx SIMATIC SIMATIC manager ->
mark block -> key F1 –> Ethernet -> see also -> code evaluation
SFC24
80A1 DB=0 CPU DB 80B1 DB CPUU DB_x DB
CPUU 80B2 DB “Unlinked” DB “Unlinked”
A0401
IA&DT Service & Support
Page 36-36
/
www.4008104288.com.cn
/ http://www.ad.siemens.com.cn/download/DocList.aspx?TypeId=0&CatFirst=12
/ http://support.automation.siemens.com/CN/view/zh/10805868/140000 “ ”Net http://www.ad.siemens.com.cn/service/answer/category.asp?cid=1041
: +86 400-810-4288 : +86 10 64719991 : [email protected] : www.4008104288.com.c
/
( )
© 2001-2011