MBMA340

Software Driver for

SIMATIC S7-300/400 Controllers with
Serial Communication Processor CP340

MODBUS RTU Protocol

S7 Controller becomes Modbus Master

Manual

Version 2.00
1 Contents

1 Contents ....................................................................................................................................... 2
2 Disclaimer .................................................................................................................................... 3
3 Application Possibilities .............................................................................................................. 3
4 Functionality ................................................................................................................................ 4
5 Supplied software function blocks ............................................................................................... 4
5.1 FB10 MBMAREQ function block ................................................................................... 4
5.1.1 FB10 MBMAREQ parameters description .................................................................. 5
5.2 FB34 MBMA340 function block ..................................................................................... 8
5.2.1 FB34 MBMA340 parameters description .................................................................... 8
6 Preparing the user program .......................................................................................................... 9
6.1 STEP7 HW-Config .............................................................................................................. 9
6.2 STEP7 Project program blocks .......................................................................................... 10
7 Supported Modbus Function Codes with program example...................................................... 11
7.1 Function Code 01 - Read Coil Status ................................................................................. 12
7.2 Function Code 02 - Read Input Status ............................................................................... 12
7.3 Function Code 03 - Read Output Registers ....................................................................... 12
7.4 Function Code 04 - Read Input Registers .......................................................................... 12
7.5 Function Code 05 - Force Single Coil ............................................................................... 13
7.6 Function Code 06 - Write Single Register ......................................................................... 13
7.7 Function Code 15 - Force Multiple Coils .......................................................................... 13
7.8 Function Code 16 - Write Multiple Registers .................................................................... 13
8 Performance ............................................................................................................................... 14
9 Trouble shooting ........................................................................................................................ 14
10 Service and Support ................................................................................................................... 15

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 2 of 15
2 Disclaimer

THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

ALL TRADEMARKS MENTIONED IN THIS MANUAL ARE PROPERTY OF THEIR

RESPECTIVE OWNERS

3 Application Possibilities

This software package implements the GOULD MODBUS RTU protocol on SIMATIC S7-300/400
controllers with a Point-to-Point (PtP) serial communication processor module. The SIMATIC S7
becomes the Modbus Master.

Supported Communication Processor (CP) module

CP340

The CP340 is supplied with the following protocol drivers

3964(R) driver
ASCII driver
Printer driver

The software function blocks in this package use a protocol adaption with the ASCII driver in order
to provide you with the

Modbus Master RTU driver

With this additional software driver many Modbus Slave devices supporting the Modbus RTU
protocol can be connected to the CP340 of your SIMATIC S7-300/400 station. Typical Modbus
Slaves, but not limited to the below, are

Energy Power Meters

Valves
Variable Frequency Drives (VFDs)
Vibration Monitoring Systems (VMSs)
PLCs
MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 3 of 15
4 Functionality

The Modbus Master is the active partner in this asynchronous communication while the Modbus
Slave remains always passive. The Master is sending its requests one by one to the connected Slave
and waits for a reply or timeout from the Slave before processing the next request.

All requests will be configured by the programmer in the user program and then cyclically
processed by the communication driver.

The following Modbus function codes are supported:

Function Code 01 - Read Coil Status

Function Code 02 - Read Input Status
Function Code 03 - Read Output Registers
Function Code 04 - Read Input Registers
Function Code 05 - Force Single Coil
Function Code 06 - Write Single Register
Function Code 15 - Force Multiple Coils
Function Code 16 - Write Multiple Registers

5 Supplied software function blocks

The software driver comes as project archive MBMA340.ZIP which needs to be retrieved with the
Simatic Manager software. That project is a working example and will support the programmer as a
reference to his own implementation.

The project archive software consists of total four function blocks

FB10 MBMAREQ Modbus Master Request function block

FB2 P_RCV Siemens standard receive function block for CP340
FB3 P_SEND Siemens standard send function block for CP340
FB34 MBMA340 Modbus Master Communication function block

5.1 FB10 MBMAREQ function block

All Modbus Master Requests need to be configured in the user program by calling the FB10
MBMAREQ function block. Although it is important to know about the different Modbus
Function Codes this function block uses Modbus addresses instead only for configuring a request.
That makes its handling easier for beginners.

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 4 of 15
5.1.1 FB10 MBMAREQ parameters description

INSTANCE DATA BLOCK

Each function block needs an individual instance data block.

Input parameters:

Name: Type: Default: Description:

RW BOOL FALSE READ/WRITE (0=READ, 1=WRITE)

For reading data from the slave this input should be set to FALSE.
For writing data from the CPU to the slave this input should be TRUE.

SLAVE INT 1 Here the address of the connected Modbus slave needs to be specified.
Possible entries are values between 1 and 255.
The Modbus address 255 is reserved for broadcasting data to all connected
Slaves (only possible, when more than one Modbus slave is connected to
the CP in a Multi-drop RS-485/422 network configuration).

START DINT 40001 Defines the Modbus start register in the Modbus Salve
The following addresses are possible:

00001 09999 Outputs/Coils

10001 19999 Inputs
30001 39999 16 bit input registers
40001 49999 16 bit output registers/holding registers

END DINT 40001 Defines the last register in the Modbus slave to be addressed.
The address range is the same as for the START input parameter.

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 5 of 15
WRMODE BOOL 0 Modbus offers two different function codes with the same result if the
User wants to write a single register to the slave. So this parameter is only
valid if the RW input parameter is set to TRUE=WRITE and the specified
START and END parameters are the same.

When this parameter set to FALSE=AUTO the function block will

perform a single register request.
If it is set to TRUE=MULTIPLE the function block will perform a multiple
registers request for one register only.

S7ADDR POINTER Defines the first address byte within the CPU for the Modbus data to be
stored into or data sent from to the slave. The address can be located in the
following areas of the CPU only:

Inputs
Outputs
Memory
Data block

Example of any pointer format

P#DB11.DBX0.0 BYTE 1

The bit address and the byte format specify the location in the S7 controller.
A length parameter must be entered as well but will be ignored.

The driver does not check the availability of the entered address.

FORMAT INT 0 Optional formatting function for received Modbus data.

0 = NONE
1 = LOHI (swapping between low- and high byte)

LINK WORD 0 This input parameter has to be connected to the LINK output parameter of
the MBMA340 communication function block.

Output parameters:

Name: Type: Description:

DONE BOOL This output is set if the Modbus Request has been successfully executed
without any error.

ERROR BOOL This output is set if any error occurred in the execution of the Modbus
Request or any parameterization failure is detected.

Further information can be retrieved by evaluating the STATUS parameter.

STATUS WORD This output parameter will indicate errors occurred during the execution of
the Modbus request. In case of an error it will give an error code.
For identification the error code refer to the error table below.

Note: All output parameters are only available for one CPU cycle.

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 6 of 15
FB10 MBMAREQ Error status table:

Parameter Value (Hex) Description

STATUS 0000h No failure

STATUS E001h Slave address out of range

STATUS E002h START and/or END parameter out of range

STATUS E003h Number of registers is out of range

For accessing outputs/coils (00001 - 09999) or inputs (10001 - 19999)

the max. total is 2040

For the 16 bit input registers (30001 - 39999) or 16 bit output/holding

registers (40001 - 49999) the max. total is 127

STATUS E004h Request cannot be performed

Inputs (10001 - 19999) and 16 bit input registers (30001 - 39999) are read
only addresses

STATUS E005h Specified S7ADDR is not valid

STATUS E006h LINK parameter mismatch with MBMA340 communication function block

STATUS 0E50h Received slave address not correct

STATUS 0E51h Received function code not correct

STATUS 0E52h Byte underflow

STATUS 0E53h Byte overflow

STATUS 0E54h Received byte counter underflow

STATUS 0E55h Received byte counter overflow

STATUS 0E57h CRC checksum error

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 7 of 15
5.2 FB34 MBMA340 function block

The Modbus Master Function block FB34 MBMA340 is adapting the Modbus RTU Protocol and
is processing the requests configured with the MBMAREQ function block one by one. The user
need to supply the block at the LADDR input parameter with the hardware address of the CP340
same as configured in the hardware configuration. The LINK parameter of has to match to all
correspondent MBMAREQ function blocks. The WDTIME parameter is a watchdog/timeout
time, maximum waiting time for a slave response before processing the next request.

5.2.1 FB34 MBMA340 parameters description

INSTANCE DATA BLOCK

Each function block needs an individual instance data block.

Input parameters:

Name: Type: Default: Description:

LADDR INT 256 Defines the hardware I/O address of the communication processor (CP).
This address has to match with the address set in in the HWConfig of the
project.

WDTIME TIME T#2s This is a watchdog timeout time. The time specifies the maximum waiting
time for a response from the Modbus slave.

Output parameters:

Name: Type: Description:

LINK WORD 0 This output parameter has to be connected to the LINK input parameter of
the MBMAREQ function block.

Standard function blocks:

This function block utilizes the Siemens standard function blocks FB2 P_RCV and FB3 P_SEND.

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 8 of 15
6 Preparing the user program

For hard- and software installation of the CP340 you should follow the instructions given in the user
manual of the CP.

6.1 STEP7 HW-Config

After you have installed the CP340 into your system open the HW-Config and configure the
module accordingly and follow the steps below.

1. Place the correct version of your CP340 module into the HW-Config matching with the real
position of the module in your physical rack.
2. Note down the I-address of the module. That address will be required as LADDR input
parameter to the FB34 MBMA340 Modbus Master Communication function block.
3. As protocol ASCII needs to be selected in order to adapt the Modbus RTU Master
protocol.
4. The protocol parameters need to match with the parameters at the connected Modbus Slave
devices.
5. Save, compile and download the hardware configuration to your CPU.

ASCII F. MODBUS RTU MASTER

LADDR

PROTOCOL PARAMETER

This picture shows an example configuration of a CP340.

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 9 of 15
6.2 STEP7 Project program blocks

All the below following function blocks should be part of your software

FB10 MBMAREQ Modbus Master Request function block

FB2* P_RCV Siemens standard receive function block for CP340
FB3* P_SEND Siemens standard send function block for CP340
FB34 MBMA340 Modbus Master Communication function block

* This function block is called internally from the MBMA340 function block and its FB number
is not allowed to be changed. The programmer needs to ensure that the FB number is not occupied
by any another function block.

While the MBMAREQ function block can be called as many times as required in your
application the MBMA340 function block is only allowed to be called one time per CP340
interface module in the user program. Independent on the number of Modbus Slaves attached to this
one interface.

The below diagram shows the typical sequence of the function blocks in the user program. Both
MBMAREQ and MBMA340 call in cyclic executed OB1 or MBMA340 called from cyclic
interrupted organization block (i.e. OB35). Find out more about its second option in chapter 8.

OB1 OB1

MBMAREQ MBMAREQ

Request No. 1 Request No. 1 OB35

20ms

MBMAREQ MBMAREQ
MBMA340
Request No. 2 Request No. 2

MBMAREQ MBMAREQ

Request No. n Request No. n

MBMA340

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 10 of 15
These two function blocks are exchanging data through the LINK parameter on each of the blocks.
The programmer needs to ensure that the LINK parameters on the MBMAREQ blocks are
identical with the LINK parameter at the corresponding MBMA340 communication function
block.

MBMAREQ LINK

Request No. 1
LINK MBMA340

MBMAREQ

Request No. 2 LINK

LINK parameters must be identical

See in the next chapter the use of configuring requests with the MBMAREQ function block and
showing the corresponding Modbus Function Code.

7 Supported Modbus Function Codes with program example

The following Modbus function codes are supported by this driver:

Function Code 01 - Read Coil Status

Function Code 02 - Read Input Status
Function Code 03 - Read Output Registers
Function Code 04 - Read Input Registers
Function Code 05 - Force Single Coil
Function Code 06 - Write Single Register
Function Code 15 - Force Multiple Coils
Function Code 16 - Write Multiple Registers

This software driver does use a MBMAREQ function block to configure all Modbus requests.
Pending on the information given at the input parameters during parameterization of the function
block it will automatically generate the corresponding Modbus function code internally.

The below given program code is just giving parameterization examples for the MBMAREQ
function block and might not reflect your application.

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 11 of 15
7.1 Function Code 01 - Read Coil Status

CALL "MBMAREQ" , "MBMAREQ NO.1" // MODBUS MASTER REQUEST FUNCTION BLOCK

LINK := "LINK_340" // I-LINK WORD (CONNECT TO MBMA340 FUNCTION BLOCK!)
RW := FALSE // I-FUNCTION = READ
SLAVE := 1 // I-SLAVE NUMBER
START := L#1 // I-START ADDRESS (00001)
END := L#9 // I-END ADDRESS (00009)
WRMODE := FALSE // I-WRITE MODE = AUTO
S7ADDR := "MBDB READ OUTPUTS STATUS".DATA_BYTE[0] // I-S7 ADDRESS
FORMAT := 1 // I-NONE
DONE := "DONE_340" // Q-DONE
ERROR := "ERROR_340" // Q-ERROR
STATUS := "STATUS_340" // Q-STATUS WORD

7.2 Function Code 02 - Read Input Status

CALL "MBMAREQ" , "MBMAREQ NO.2" // MODBUS MASTER REQUEST FUNCTION BLOCK

LINK := "LINK_340" // I-LINK WORD (CONNECT TO MBMA340 FUNCTION BLOCK!)
RW := FALSE // I-FUNCTION = READ
SLAVE := 1 // I-SLAVE NUMBER
START := L#10001 // I-START ADDRESS (10001)
END := L#10009 // I-END ADDRESS (10009)
WRMODE := FALSE // I-WRITE MODE = AUTO
S7ADDR := "MBDB READ INPUTS STATUS".DATA_BYTE[0] // I-S7 ADDRESS
FORMAT := 1 // I-NONE
DONE := "DONE_340" // Q-DONE
ERROR := "ERROR_340" // Q-ERROR
STATUS := "STATUS_340" // Q-STATUS WORD

7.3 Function Code 03 - Read Output Registers

CALL "MBMAREQ" , "MBMAREQ NO.3" // MODBUS MASTER REQUEST FUNCTION BLOCK

LINK := "LINK_340" // I-LINK WORD (CONNECT TO MBMA340 FUNCTION BLOCK!)
RW := FALSE // I-FUNCTION = READ
SLAVE := 1 // I-SLAVE NUMBER
START := L#40001 // I-START ADDRESS (40001)
END := L#40050 // I-END ADDRESS (40002)
WRMODE := FALSE // I-WRITE MODE = AUTO
S7ADDR := "MBDB READ OUTPUT REGS".DATA_BYTE[0] // I-S7 ADDRESS
FORMAT := 0 // I-NONE
DONE := "DONE_340" // Q-DONE
ERROR := "ERROR_340" // Q-ERROR
STATUS := "STATUS_340" // Q-STATUS WORD

7.4 Function Code 04 - Read Input Registers

CALL "MBMAREQ" , "MBMAREQ NO.4" // MODBUS MASTER REQUEST FUNCTION BLOCK

LINK := "LINK_340" // I-LINK WORD (CONNECT TO MBMA340 FUNCTION BLOCK!)
RW := FALSE // I-FUNCTION = READ
SLAVE := 1 // I-SLAVE NUMBER
START := L#30001 // I-START ADDRESS (30001)
END := L#30009 // I-END ADDRESS (30009)
WRMODE := FALSE // I-WRITE MODE = AUTO
S7ADDR := "MBDB READ INPUT REGS".DATA_BYTE[0] // I-S7 ADDRESS
FORMAT := 0 // I-NONE
DONE := "DONE_340" // Q-DONE
ERROR := "ERROR_340" // Q-ERROR
STATUS := "STATUS_340" // Q-STATUS WORD

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 12 of 15
7.5 Function Code 05 - Force Single Coil

CALL "MBMAREQ" , "MBMAREQ NO.5" // MODBUS MASTER REQUEST FUNCTION BLOCK

LINK := "LINK_340" // I-LINK WORD (CONNECT TO MBMA340 FUNCTION BLOCK!)
RW := TRUE // I-FUNCTION = WRITE
SLAVE := 1 // I-SLAVE NUMBER
START := L#9 // I-START ADDRESS (00009)
END := L#9 // I-END ADDRESS (00009)
WRMODE := FALSE // I-WRITE MODE = AUTO
S7ADDR := "MBDB WRITE OUTPUT".DATA_BYTE[0] // I-S7 ADDRESS
FORMAT := 0 // I-NONE
DONE := "DONE_340" // Q-DONE
ERROR := "ERROR_340" // Q-ERROR
STATUS := "STATUS_340" // Q-STATUS WORD

7.6 Function Code 06 - Write Single Register

CALL "MBMAREQ" , "MBMAREQ NO.6" // MODBUS MASTER REQUEST FUNCTION BLOCK

LINK := "LINK_340" // I-LINK WORD (CONNECT TO MBMA340 FUNCTION BLOCK!)
RW := TRUE // I-FUNCTION = WRITE
SLAVE := 1 // I-SLAVE NUMBER
START := L#40003 // I-START ADDRESS (40003)
END := L#40003 // I-END ADDRESS (40003)
WRMODE := FALSE // I-WRITE MODE = AUTO
S7ADDR := "MBDB WRITE OUTPUT REG".DATA_BYTE[0] // I-S7 ADDRESS
FORMAT := 1 // I-NONE
DONE := "DONE_340" // Q-DONE
ERROR := "ERROR_340" // Q-ERROR
STATUS := "STATUS_340" // Q-STATUS WORD

7.7 Function Code 15 - Force Multiple Coils

CALL "MBMAREQ" , "MBMAREQ NO.7" // MODBUS MASTER REQUEST FUNCTION BLOCK

LINK := "LINK_340" // I-LINK WORD (CONNECT TO MBMA340 FUNCTION BLOCK!)
RW := TRUE // I-FUNCTION = WRITE
SLAVE := 1 // I-SLAVE NUMBER
START := L#1 // I-START ADDRESS (00001)
END := L#9 // I-END ADDRESS (00009)
WRMODE := FALSE // I-WRITE MODE = AUTO
S7ADDR := "MBDB WRITE OUTPUTS".DATA_BYTE[0] // I-S7 ADDRESS
FORMAT := 0 // I-NONE
DONE := "DONE_340" // Q-DONE
ERROR := "ERROR_340" // Q-ERROR
STATUS := "STATUS_340" // Q-STATUS WORD

7.8 Function Code 16 - Write Multiple Registers

CALL "MBMAREQ" , "MBMAREQ NO.8" // MODBUS MASTER REQUEST FUNCTION BLOCK

LINK := "LINK_340" // I-LINK WORD (CONNECT TO MBMA340 FUNCTION BLOCK!)
RW := TRUE // I-FUNCTION = WRITE
SLAVE := 1 // I-SLAVE NUMBER
START := L#40004 // I-START ADDRESS (40004)
END := L#40005 // I-END ADDRESS (40005)
WRMODE := FALSE // I-WRITE MODE = AUTO
S7ADDR := "MBDB WRITE OUTPUT REGS".DATA_BYTE[0] // I-S7 ADDRESS
FORMAT := 0 // I-NONE
DONE := "DONE_340" // Q-DONE
ERROR := "ERROR_340" // Q-ERROR
STATUS := "STATUS_340" // Q-STATUS WORD

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 13 of 15
8 Performance

Modbus is an asynchronous protocol where the Modbus Master is sending its requests one by one to
the connected slave. The Master is always waiting for the reply or timeout of the slave before
sending the next request.

So than more requests need to be executed than more time it will take to process them all. Therefore
it is advisable to reduce the total number of requests to a minimum to achieve a fast update cycle.
Unfortunate some vendors provide their data spread all over the Modbus address areas where and
make it necessary to define more requests. In case you have a PLC as a slave you might request the
supplier to provide the data in one compact area.

The standard Siemens P_SEND and P_RECV function blocks called internally from the
Modbus Master Function block can require several cycles to complete the data transfer between
CPU and CP module. First the user should leave the MBMA340 Modbus Master Function block
in OB1 and monitor the cycle time of OB1. In case the OB1 cycle time is greater than 20ms the user
can move the MBMA340 function block into an interrupt OB with a faster execution time (i.e.
OB35 >=20ms).

9 Trouble shooting

If you have done everything correctly you should be able to monitor at the CP340 that both, the Tx-
LED and Rx-LED, are flashing from time to time and the requested data from the Modbus Slave is
stored into its destination address of the CPU. Unfortunate thats not always the case but at least
you should have the Tx-LED flashing confirming that the Master is sending requests. Apart from
various hardware and wiring problems the programmer should verify the below points:

In HW-Config of the CP340 the protocol is set to ASCII

The ASCII protocol parameters at Speed and Character Frame should match with the

attached Modbus Slave devices

FB2 P_RCV and FB3 P_SEND are existing and not changed to other FB numbers

All function blocks are using individual instance data block numbers

The LINK parameter at MBMAREQ is same as the corresponding MBMA340 block

The STATUS output at MBMAREQ is not showing any error code

The LADDR input parameter at MBMA340 is giving the correct hardware address of the

CP340 configured in HW-Config

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 14 of 15
10 Service and Support

In case you face any problem with implementing the software into your application visit the
Siemens Simatic forum for latest information and updates.

https://www.automation.siemens.com/WW/forum

With Best Regards.

TIBI68

MBMA340 Software driver for S7-300/400 controllers with serial communication processor module CP340 / Modbus RTU Protocol
Manual V2.00 English Page 15 of 15