1. Modbus Slave & Modbus Master in S7
Refer to the Modbus Serial Pack v2 zip.
Project Modbus v2
Manuals for drivers and hardware

2. Preperation Preparation………………..
To enable the Modbus functionality of the CP cards, you must do three things:
Install Point to Point software from
Install Modbus Master and Slave drivers from
Fit the Modbus dongle to the rear of the CP
Install the driver to the CP
Preperation

3. Summary of the GOULD-MODBUS Protocol
The type of data exchange between MODBUS systems is controlled by Function Codes (FCs).
The following FCs can be used to carry out data exchange bit-by-bit:
FC 01 Read coil (output) status,
FC 02 Read input status,
FC 05 Force single coil,
FC 15 Force multiple coils.
The following FCs can be used to carry out data exchange register-by-register:
FC 03 Read holding registers,
FC 04 Read input registers,
FC 06 Preset single register,
FC 16 Preset multiple registers.
Gould-Modbus

4. Summary of the GOULD-MODBUS Protocol
It will save considerable time and frustration to have a good idea upfront of the mapping of Modbus data to S7 data. The Modbus slave will define the function codes to be used by virtue of the fact that specific data is held in specific Modbus registers.
Function Code
Modbus Address Range
Access
Output Coils
Function Codes 01, 05, 15
Read/Write
Input Coils
Function Code 02
Read Only
Internal Registers
Function Code 04
Holding Registers
Function Codes 03, 06, 16
Gould-Modbus

5. Configure the Hardware as Modbus Slave
With the software installed you can now open the Hardware Configuration and configure the CP341 in your rack. Double click the CP to open its properties and click on the Parameter button. The Point to Point configuration software will now open.
From the drop down box at the top left, select Modbus Slave as the Protocol. Next double click the Protocol icon in the middle of the screen.
S7-300 Slave

6. Configure the Driver……..
You are now presented with a number of tabs. The first tab "General" shows the driver versions in use. This is for information only. The second tab "Modbus-Slave" allows you to define the communications properties of the system, baud, stop bits etc.
S7-300 Slave

7. Configure the Driver……..
On the tab labelled FC01, 05, 15, you can enter the Modbus address ranges to be mapped into M area, Outputs, Timers and Counters. If any areas are not used, enter 0.
S7-300 Slave

8. Configure the Driver……..
On the tab FC02, you can define the mapping for M area and Inputs to be read from.
S7-300 Slave

9. Configure the Driver……..
On the tab FC03, 06, 16 you only need to enter a DB number. These function codes use the address range starting from Modbus address The DB number specified is the start DB of a range of DB's that are generated by the user and must be 512 words long. If your Modbus address is say 40513, you would need to generate another consecutively numbered DB of 512 words long. Modbus address would be the first address in the second DB (word 0 of the second DB, the 513 word in total).
S7-300 Slave

10. Configure the Driver……..
The tab labelled FC4 is configured in the same way but for the address range.
S7-300 Slave

11. Configure the Driver……..
The next tab is labelled "Limits". This is where you can define the range of DB's, Memory and Outputs to be written to by FC05, FC15, FC06 and FC16. If you were to use the Modbus address 40513, this would reside in the second DB at word 0. You would therefore need to set the limits here to DB1 and DB2 (assuming DB1 is the DB selected for use by FC03, 06, 16). This is similar for M and Q areas. The final tab defines any electrical properties.
S7-300 Slave

12. Download Hardware Configuration and Modbus Driver……..
Save and Compile the Hardware Configuration then download to the controller. Once the configuration is downloaded we can install the driver to the CP. To do this you must have an online connection and use the Load Drivers button from the Driver Parameters (as we have just configured).
S7-300 Slave

13. Movement of Modbus Data between the CP to the User Program…….
Now the driver is configured. It knows what to do when it receives a Modbus telegram – read or write data to or from a specific Simatic area. Now that the Modbus data can be interpreted by the Modbus driver on the CP341, we need to move the data from the CP to the CPU of the PLC. This is done by use of FB80 MODB_341. This block can be found in the library entitled "Modbus". The block is called as part of the cyclic user program via OB1. It needs to know the logical address (LADDR) of the CP341 from the hardware configuration which can be found by highlighting the CP in the rack in Hardware Configuration. The address will be shown under the I-address column of the bottom half of the window.
S7-300 Slave

14. Movement of Modbus Data between the CP to the User Program…….
Block Dependencies:
When you add the FB80 block to the user program, you will be required to generate an Instance Data Block. BEFORE generating this block, ensure that the FB7 and FB8 blocks are also present in the blocks folder (these are found in the same Modbus library). This is because FB80 uses these blocks to communicate with the CP.
S7-300 Slave

15. Movement of Modbus Data between the CP to the User Program…….
OB100 – Startup OB
The only coding that the user must perform is in OB100, where we set a bit on and a bit off to initialise the FB on start-up of the CPU, used at the parameters CP_START and CP_START_FM.
S7-300 Slave

16. Movement of Modbus Data between the CP to the User Program…….
OB1 – Main Cyclic OB
Call FB80 in OB1 and assign addresses for status reporting. Also assign the CP_Start and CP_Start_FM bits generated in OB100.
Download all program blocks to the controller and test!!!
S7-300 Slave

17. Configure the Hardware as Modbus Master
To configure the Modbus Master, we start in Hardware Configuration. Perform the same steps as for the slave (selecting Modbus Master as the Protocol) and click on the Protocol icon in the middle of the screen.
S7-300 Master

18. Configure the Driver……..
Here you have three tabs. The first, "General" identifies the driver version, as in the slave. The second, "Modbus Master" is where you define the communications properties, stop bits, baud etc.
S7-300 Master

19. Configure the Driver……..
The final tab defines any electrical properties. This is the hardware configured for operation. We must now send and receive data to/from the CP341.
S7-300 Master

20. Movement of Modbus Data between the CP to the User Program…….
OB1 – Main Cyclic OB
In the cyclic user program we must call two blocks, P_SND_RK and P_RCV_RK, found in the Modbus library. The Modbus Master will send a request for data to its slave (reading values) or simply send it data (writing).
S7-300 Master

21. Movement of Modbus Data between the CP to the User Program…….
The send block is used to send a number of bytes that are structured in a specific way and populated with specific data, depending upon the function code to be used. For example, FC03 requires the first byte to contain the slave address, the second byte to contain the function code number, the third and fourth bytes (DBW2) must contain the Modbus start address and bytes five and six (DBW4) contain a value representing the number of registers required.
S7-300 Master
*(All of the structures of data for the various function codes can be found in section 5 of the Modbus master manual).

22. Movement of Modbus Data between the CP to the User Program…….
OB1 – Main Cyclic OB
You will need to define a DB that can be used to receive the data into. You call the receive block, and populate its parameters similarly to the send block, telling it the LADDR of the CP341 and the DB to which the data is to be received.
S7-300 Master

23. Movement of Modbus Data between the CP to the User Program…….
With these blocks now configured, you can download to the hardware and you should have a working Modbus master. Of course, the blocks will need code writing around them for timing the send and receives and also error handling, but I recommend using a VAT (variable table) to manually trigger sends etc until you are happy that the system is functioning. This way you are in control of the requests and also the data that is sent.
S7-300 Master

24. S7-400 Modbus Master and Modbus Slave……
The configuration is similar when using the S Differences include the possibility to install two interface modules to one CP441-2, which can be configured independently for different functions. These interface modules are fitted to the front of the CP, with the type dependant upon the electrical connection to the system (RS232, RS485, RS422). The driver configuration is identical to when using the S7-300.
S7-400

25. S7-400 Modbus Master and Modbus Slave……
There are differences in the blocks used for both slave and master functions in the S7-400.
Firstly, the slave uses block FB180 MODB_441. This can be found in the same location as the block used in the S7-300.
Secondly, the master uses different blocks to the S The S7-400 uses the System Function Blocks SFB12 and 13 (BSEND and BRCV).
S7-400

26. S7-400 Modbus Master and Modbus Slave……
The main difference with both the master and slave blocks is the requirement of a connection between the devices. This connection is configured in Netpro and the ID of this connection is entered as a parameter to the send and receive blocks. The connection type is Point to Point. Once a new connection of the type Point to Point is added to the configuration, you can view the properties of it. Here you can set the CP to be used and select which of the CP’s interfaces are to be connected. You also find the connection ID, whose value needs to be entered to the send and receive blocks.
S7-400

27. Diagnostics Diagnostics
Sometimes you may have configured the system but devices do not communicate in the manner you expected. Things may appear to be healthy but data is not being successfully transferred. If this is the case then you have a number of options available.
The first place to check would be on the block calls. The blocks will generate status and error information.
Secondly, you can check the Module Information of the CPU and CP for any diagnostic entries.
Error codes generated on the block calls and in Module Information can be found in the manuals included in the Modbus Serial Pack.
A further option is to monitor the network using a network analyzer. This will enable you to see the raw data present on the network media and determine if it is present and correct. You should be seeing telegrams with the format matching that described in chapter 5 of the Modbus master manual, depending upon the function code being implemented (byte 1 should contain the slave address, byte 2 should contain the function code etc).
Diagnostics

28. Multipoint Connection Details…..
RS422 Multipoint
In the RS422 mode CP341 and CP441-2 can only be used as a Master“

29. Multipoint Connection Details…..
RS485 Multipoint

30. Multipoint Connection Details…..
The following applies for both modules:
• GND (PIN 8 by CP341 / CP441-2) must always be connected on both sides
• The casing shield must be installed everywhere
• A terminating resistor of approx. 330 Ω is to be soldered into the connector on the last receiver of a node sequence
• Recommended cable type: LIYCY 3 x 2 x 0,14 R(A)/R(B) and T(A)/T(B) twisted pairs
• A wiring with “Stub“ is not allowed
Multipoint