Modbus/TCP connection S7-1200/1500 SE-7xxDocumentationModbus/TCP connectionS7-1200/1500 SE-7xxusing the new S7 Modbus interfaceDocumentation: 15th November 2017valid for: Version 1.4 2017 by STANGE Elektronik GmbH1Subject to technical modifications.

Modbus/TCP connection S7-1200/1500 SE-7xxAuthor: Lukas JolbejIn this documentation the S7 Modbus connection to the STANGE SE-7xx device is explained.Used devices: STANGE SE-702 Siemens S7-1212C DC/DC/DC (6ES7 212-1AE40-0XB0)connected via a 100 MBit/s switchUsed software: Siemens TIA Portal V13 SP1 Update 9 Windows 7 SP1 Device version for the SE-702 Firmware version 4.1 for the S7-1212CRequirements: The feature must be licensed in the SE-7xx IP address and Modbus Unit ID of the SE-7xx must be knowncorresponding TIA Portal templates: se7xx-1200-1500-scl-mb (template project), version 1.4 se7xx-1200-1500-scl-mb-library (library), version 1.4 2017 by STANGE Elektronik GmbHSubject to technical modifications2


Modbus/TCP connection S7-1200/1500 SE-7xxGetting startedFunction overviewWhat are the features? Control and query programmerControl and query control zoneQuery setvalue and its statusControl and query alarmhandlerGenerate alarm and query alarm statusControl and query dataloggerQuery process step statusQuery digital track statusQuery tolerance status, enable tolerance (if configured as external activatable)Query limit statusSet digital variable in SE-7xx (starting at FE 2000)Query digital variable from SE-7xx (starting at FA 2000)Set analog variable in SE-7xx (values 41-80)Query analog variable from SE-7xx (values 1-40)Set actual value in SE-7xx, force Overflow/Underflow/Break statusQuery actual value from SE-7xx, query error status of actual valueWhat data is transferred from the SE-7xx to the S7 (status data)? Boolean data Control zone status, Setvalue status, Actual value status, Tolerance status, Limit status,Programmer status, Process step status, Digital track status, Digital output variables,Alarmhandler status, Alarm status, Datalogger status32 Bit floating point values (REAL) Control zone outputs (Y values), Setvalues, Analog variables 1-40, Actual valuesWhat data is transferred from the S7 to the SE-7xx (control data)? Boolean data Programmer control, Control zone control, Tolerance enabling, Digitale input variables,Alarmhandler control, Alarm inputs, Datalogger control32 Bit floating point values (REAL) Analog variables 41-80, Actual values (correction points, mean values etc. can be configured via SE-7xx) 2017 by STANGE Elektronik GmbHSubject to technical modifications4

Modbus/TCP connection S7-1200/1500 SE-7xxCheck licensing statusThe correct licensing status of the S7 Modbus connection can be checked in the SE-7xx.Configuration, Hardware Test, License Information, Siemens Modbus Connection will show the current status.In case of a missing license this entry shows “No” and a license alarm will be activated.Activate Siemens Modbus connection in the SE-7xxFirst the S7 interface is enabled in the SE-7xx device. This takes place under Configuration, Standard Settings, SiemensModbus Connection. Change the setting Modbus enabling to Enabled.Datalogger configuration (PLC statement list)For proper functionality of the datalogger when enabling the S7 interface, the following two lines must be present in theSTANGE SE-7xx PLC statement list:L FO 768R FO 1311The PLC statement list can be found at Configuration, Functions, PLC statement list. After adding those two lines apply thechanges by selecting Apply (Take Over) and then save the changes with Back.For more information on configuring the datalogger see the corresponding documentation.Using the project as a templateThe project se7xx-1200-1500-scl-mb can be used as a template. It is loaded into the TIA Portal and can be saved directly viaProject Save as as a copy with a new name. This enables to use the template again. 2017 by STANGE Elektronik GmbH5Subject to technical modifications.

Modbus/TCP connection S7-1200/1500 SE-7xxIn the template project, there are projected one S7-1212C DC/DC/DC and one S7-1513-1 PN, respectively. Both contain thesame modules. The project must be adapted if another PLC than S7-1212C DC/DC/DC or S7-1513-1 PN is used: under Devices& networks the S7 must be selected by right mouse click and Change device opens the Change device dialog. Now the useddevice can be selected. The S7 which is not used can be deleted from the project by right mouse click.To change the IP address of the S7, select Devices & networks and double-click on the S7. Then double-click on the S7 again.Under the category PROFINET interface the IP address, Subnet mask and Router address (if needed) of the S7 can be set.Then the S7 can be assigned to an existing „Subnet“ by selecting the correct entry or you can create a new subnet by clicking„Add new subnet“. Either way, this step of assigning a subnet is necessary so TIA Portal can connect to the S7. Finally, theblocks need to be compiled and loaded onto the S7. 2017 by STANGE Elektronik GmbHSubject to technical modifications6

Modbus/TCP connection S7-1200/1500 SE-7xxUsing the library modules in an existing projectThe provided library se7xx-1200-1500-scl-mb-library can be used if a S7 project already exists in the TIA Portal and only theModbus communication modules shall be added to the project. The following screenshot shows an overview of thecontained modules: 2017 by STANGE Elektronik GmbH7Subject to technical modifications.

Modbus/TCP connection S7-1200/1500 SE-7xxThe following modules are needed at least in order that the Modbus communication works. They must be copied into theproject (Program blocks): datatransfer and modbusconnTotalDataDatalogger [FB114] (when using the datalogger)MB CLIENTMB CLIENT DB[1-4]The project and the library use the system library “S7 Open user communication” in version 4.0.The blocks need System Flags (Merker). In the device configuration, select “System and clock memory” and check “Enable theuse of system memory byte”.The remaining FC/FB can be integrated to the project as required. But they only work if the above described modules areavailable in the project. datatransfer is the module that performs the actual communication of both devices. It must beintegrated via OB1. An example OB1 can be found in the library.If the datalogger is configured as active in the SE-7xx, the FB Datalogger must be called via OB1 and be served with an IDB.This step is mandatory, otherwise the SE-7xx datalogger will not work. For full flexibility, the FB Datalogger Manual can beused as an alternative (see corresponding chapter).If both the Programmer block and the Datalogger block are used in the project, the input ProgStart of the Programmer blockmust be connected with the bit Start Programmer of the Datalogger IDB by an OR operation, otherwise the programmer willnot start. If ProgStart is not connected at all, no changes are needed.To avoid problems when using the Programmer block and the Datalogger block at the same time, the Programmer block shallbe called before the Datalogger block is called. Otherwise the programmer of the SE-7xx may not start. It is not advised toinsert Programmer and Datalogger more than one time each. To avoid further problems, only one of the two Datalogger FBsshould be used.If the datalogger is not used, the FB Datalogger (or Datalogger Manual) do not have to be imported into the project.Finally, the blocks need to be compiled and loaded onto the S7.If a compile error occurs (“Network 1: Tag transfer error not defined”), a variable tag shall be defined in OB1, Network 1 byclicking with the right mouse button on transfer error and selecting “Define tag”. Then the blocks have to be recompiled andreloaded onto the S7. 2017 by STANGE Elektronik GmbHSubject to technical modifications8

Modbus/TCP connection S7-1200/1500 SE-7xxDescription of the functionalityGeneralThe most important module is Main [OB1]. The content is cyclically called and contains at least datatransfer [FC5000] andwhen using the datalogger Datalogger [FB114]. datatransfer controls the general data exchange between both the S7 andthe SE-7xx. Without this FC no Modbus communication is possible.datatransfer [FC5000]ParameterDescriptionenable s rxanalogvariables txIP OCTET [1.4]MB PORTUnitIDTransfer boolean control/status values [true/false]Number of setvalues [0.30]Number of actual values [0.48]Number of controller Y values [0.20]Number of analog variables from SE-7xx [0.40]Number of analog variables to SE-7xx [0.40]IP address of the SE-7xx (default: port of the SE-7xx (default: 21303)Modbus Unit ID of the SE-7xx (default: 0)Please set the IP address and port of the SE-7xx. An error at the Modbus transfer is signaled at output transfer error whererequired. It can be set to a flag or a Bool variable in a DB.The respective blocks correspond to the components of the STANGE device. They can be easily dragged into OB1 or a selfcreated FC/FB. Then they are integrated by their inputs/outputs into the program sequence.InstanceNo describes the number of the instance of the function; for example, digital track 4 or limit value 2. Thereby a limitcheck takes place; i.e. for an InstanceNo outside of the valid range (for instance setvalue 23 in case of a maximum of 20possible values) the value is set to the maximum possible instance; for values equal to or less than 0 instance 1 is selected.The number of insertable blocks is not limited. For each inserted FB a separate IDB (Instance DB) is created. Not usedinputs/outputs of FCs can be set to an unused flag or variable in a DB. The sequence of instances of a FC/FB does not makeany difference; however, each new call of a block with an already used instance number overwrites each previous call of thisblock with this instance. Not used blocks can be deactivated via input EN (set to false). 2017 by STANGE Elektronik GmbH9Subject to technical modifications.

Modbus/TCP connection S7-1200/1500 SE-7xxOverview eInputFC112ActualValueOutputFC113Reads setvalue and setvalue statusGenerates alarm, reads alarm statusReads process step statusReads digital track statusReads tolerance status,external tolerance activationReads limit statusSets digital input variablein SE-7xx (starting at FI 2000)Reads digital output variablefrom SE-7xx (starting at FO 2000)Sets analog input variablein SE-7xx (values 41-80)Reads analog output variablefrom SE-7xx (values 1-40)Sets actual value in SE-7xx,force Overflow/Underflow/Break statusReads actual value from SE-7xx,reads actual value error talogger ManualFB115Controls Programmer and gets statusControls controlzone and gets statusControls alarmhandler and gets statusWrites and reads digital variablesWrites and reads analog variablesControls datalogger and gets status(automatic mode)Controls datalogger and gets status(manual mode)General structure of the FCs/FBsInputs: InstanceNo [instance number] and respective function inputsOutputs: Function outputsTemp: instno tmp: Copy of InstanceNo; used for limit checkConstant: entries: contains maximum number of instances; used for limit check 2017 by STANGE Elektronik GmbHSubject to technical modifications10

Modbus/TCP connection S7-1200/1500 SE-7xxFC5000: datatransfer and DB5000: TotalDataThe FC5000 datatransfer is responsible for sending and receiving data via Modbus TCP. Therefor the system blockmb client is being used. Four TCP connections are used, each connection multiplexes two data transfers. Each data transferof a connection is thereby assigned each one of two timeslices. The timeslices are processed one after another and eachconnection separately.Connection1234Data transmissionc[1-4] 1c[1-4] ariables.txLocally all the data is buffered in the DB TotalData. All the FC/FB just access this DB when reading or writing data. Data fromcontrol are sent to the SE-7xx, data from SE-7xx are stored in status. It is wise to not use any direct connections with entriesfrom TotalData, but to use the interface of the FC/FB.The internal mapping of the Modbus registers to the functions of the SE-7xx is done automatically. No settings orconfiguration changes are needed here.There may be some circumstances where the Modbus Unit ID has to be changed in the SE-7xx. In this case this value needs tobe applied at the input parameter UnitID of datatransfer. Otherwise the Modbus connection fails. By default, this value is 0. 1Connection 1:o Receive BoolData (172 Byte)o Send BoolData (140 Byte)status.booldatacontrol.booldatac1 1c1 2Connection 2:o Receive setvalues (120 Byte1)o Receive actual values (192 Byte1)status.setvaluesstatus.actvaluesc2 1c2 2Connection 3:o Receive Y values (80 Byte1)o Send actual values (192 Byte1)status.yvaluescontrol.actvaluesc3 1c3 2Connection 4:o Receive analog variables (160 Byte1)o Send analog variables (160 Byte1)status.analogvarscontrol.analogvarsc4 1c4 2when transferring all values (4 Byte per value) 2017 by STANGE Elektronik GmbH11Subject to technical modifications.

Modbus/TCP connection S7-1200/1500 SE-7xxTotalData.control.booldataArray [0.1119] of Bool.Contains all Bools which should be sent to the SE-7xx.TotalData.status.booldataArray [0.1375] of Bool.Contains all Bools received from the arsArray [0.47/39] of Real and Array [0.47/29/19/39] of Real.Activation by values greater than zero at FC5000. Contains 32-Bit actual values(/setvalues/Y values)/analog variables.When sending actual values they must not be configured as “unassigned” in the SE-7xx.The sent analog variables 1-40 are mapped in the SE-7xx as analog variables 41-80. 2017 by STANGE Elektronik GmbHSubject to technical modifications12

Modbus/TCP connection S7-1200/1500 SE-7xxFB100: Programmer and FB114: DataloggerWhen the S7 interface is activated, the datalogger only works if the Datalogger block is programmed into the programsequence via OB1. This Datalogger block contains the logic for the job control of the datalogger. The inputs and outputs ofthe Datalogger FB may be wired in the project, but this is not necessary.To start the datalogger (and the programmer) via the S7, set an impulse to the input ProcessStart. After five seconds theprogrammer will be started automatically. As soon as the programm has reached the end or the operator selected END orRESET, the logger stops automatically. The recorded log data can be viewed via the log list of the datalogger in the SE-7xx.When the logging is started from the S7, the user “plc” will be displayed in the charge details, otherwise the name of thecurrently logged in user.To only start the programmer without the datalogger, you can set an impulse to the input ProgStart of Programmer.Because a Programmer block may overwrite the programmer start event, its input (ProgStart) must be supplied with the bitStart Programmer of the Datalogger IDB by an OR block. This step is not necessary if there is no wiring at ProgStart at all.Programmer without wiring at ProgStartProgrammer with wiring at ProgStart 2017 by STANGE Elektronik GmbH13Subject to technical modifications.

Modbus/TCP connection S7-1200/1500 SE-7xxFB114: Datalogger and FB115: Datalogger ManualThe FB Datalogger works in “automatic mode”. This means it contains the logic to detect when the user wants to start theprogrammer via the graphical interface of the SE-7xx and then to finally start the datalogger and the programmer. This logicis necessary since most of the PLC statement list lines got obsolete with the S7 Modbus connection.Therefore, the FB must just be called via OB1; connections to its inputs/outputs are not necessary. When needed, thedatalogger and the programmer can also be started from the S7. Normally this functionality is adequate for most use cases.But when the user wants full flexibility in controlling the datalogger, Datalogger Manual can be used. It contains no logic,but offers no limits in processing the control and status signals.To avoid problems, only one of both FB should be used in the program.When the datalogger is enabled in the SE-7xx configuration, the Start button on the Programmer page only creates a processstart event (and does not start the programmer yet). This event is displayed on the output ProcessstartActive. Also, the inputProcessStart creates a process start event. The event mainly sets the right user name in the batch list of the SE-7xx (“plc” ifstarted from the S7).ProcessstartActive can be used to trigger LogStart to start the datalogger. Also, the input ProgStart of Programmer gets thesignal to start the programmer. ProcessstartActive will be reset automatically when the programmer is running (these arethe two lines which must be inserted into the SE-7xx PLC statement list).LoggerActive shows that the datalogger is recording. Using LogEnd the recording will be finished.On the following page there is an example of using Datalogger Manual.The process start event can either be created locally (M ManualStart); under the condition that no other event exists andthe datalogger is not active. Or the event can be created by the SE-7xx (Programmer).ProcessstartActive outputs a signal through the event. This signal (stored in M LoggerProcstart) can then be used to startthe datalogger recording using LogStart. The flag M LoggerActive then shows the active status of the datalogger.This flag will then be used to end the datalogger recording as soon as the programmer reaches the program end or RESET.Starting of the datalogger and the programmer can be achieved by just applying an impulse to M ManualStart. The statusoutputs can be processed in the program if necessary.As an alternative, the FB Datalogger can be used. It already contains all the logic. 2017 by STANGE Elektronik GmbHSubject to technical modifications14

Modbus/TCP connection S7-1200/1500 SE-7xx 2017 by STANGE Elektronik GmbH15Subject to technical modifications.

Modbus/TCP connection S7-1200/1500 SE-7xxFC108/FC109, FB108: DigitalVarInput, DigitalVarOutput, DigitalVars (Digital variables)Digital input variables of the SE-7xx can be set from the S7 with the blocks DigitalVarInput and DigitalVars. These will bemapped to Function inputs (FI) 2000 to 2199 of the SE-7xx and can be used for status displays in the Visualisation, forexample.These variables can only be written and not be read by the S7.Digital output variables of the SE-7xx can be read from the S7 with the blocks DigitalVarOutput and DigitalVars. These aremapped to Function outputs (FO) 2000 to 2199 of the SE-7xx and can be used for buttons in the Visualisation, for example.These variables can only be read and not be written by the S7.FC110/FC111, FB110: AnalogVarInput, AnalogVarOutput, AnalogVars (Analog variables)Analog input variables of the SE-7xx can be set from the S7 with the blocks AnalogVarInput and AnalogVars. These will bemapped to analog variables 41-80 of the SE-7xx and can be used for status displays in the Visualisation or as substitutingcontrol zone setvalues, for example.These variables can only be written and not be read by the S7.Analog output variables of the SE-7xx can be read from the S7 with the blocks AnalogVarOutput and AnalogVars. These aremapped to analog variables 1-40 of the SE-7xx and can be used for input fields in the Visualisation, for example.These variables can only be read and not be written by the S7.Analog variables must be configured as IEEE-Float before using them (configuration in SE-7xx).FC112/FC113: ActualValueInput, ActualValueOutput (Actual values)Actual values of the SE-7xx can be set from the S7 with the block ActualValueInput. These can be used there as a controlleractual value, for example. They can also be configured with correction points, mean values, etc.When sending actual values they must not be configured as “unassigned” in the SE-7xx, but at least “linear“.Special values according to IEEE 754 can trigger an actual value alarm in the SE-7xx:Actual valueIEEE 754 descriptionSE-7xx0x7F8000000xFF8000000x7F800001 ff.0xFF800001 ff.0x7FC00000 ff.0xFFC00000 ff.positive infinitynegative infinitysignalling NaNsignalling NaNquiet NaNquiet NaNOverflowUnderflowBreakBreakBreakBreakThe respective status can be generated in the SE-7xx with the inputs ForceOverflow/ForceUnderflow/ForceBreak.Actual values of the SE-7xx can be read from the S7 with the block ActualValueOutput. The output ActValueError will changeto true if the actual value has an error (for example break). 2017 by STANGE Elektronik GmbHSubject to technical modifications16

Modbus/TCP connection S7-1200/1500 SE-7xxHow ToExternal setvalue supply by S7Although the SE-7xx has the ability to store programm recipes which result into setvalue definitions over time, setvalues alsomay be gathered remotely by an S7. This makes the programmed setvalue definition worthless as it will not come into effect.The SE-7xx will then calculate Y values with these external setvalues ignoring setvalues coming directly from the programmer.A direct modification of the internal programmer setvalues is not possible due to technical reasons. However, there is a wayto control which setvalue a control zone gets. The idea is to provide the control zone a substituting setvalue. This substitutingsetvalue is supplied by an analog variable from the S7. On the S7 this is simply done by inserting a block providing the desiredsetvalue as an input parameter. Finally, the control zone will be configured to activate the substituting setvalue permanently.This needs a one-time configuration in the SE-7xx. In the new S7 Modbus interface the 80 analog variables of the SE-7xx aredivided into 40 read values (1-40) and 40 write values (41-80). Therefore, there must be at least 41 analog variablesconfigured s

The correct licensing status of the S7 Modbus connection can be checked in the SE-7xx. Configuration, Hardware Test, License Information, Siemens Modbus Connection will show the current status. In case of a missing license this entry shows No _ and a license alarm will be activated. Activate Siemens Modbus connection in the SE-7xx