Contents
The PLC with Ethernet port integrates the CP243 Ethernet module, but it does not require configuration settings. After configuring the IP address, it can be used directly. It is simpler and more reliable than the CP243 module. Ethernet supports two protocols: S7 Ethernet protocol and Modbus TCP protocol. The upload, download and monitoring of the program can be realized through the network cable, and the download speed is super fast. It can also communicate with the touch screen and directly connect with WINCC. If multiple PLC hosts are connected to a switch, they can also communicate with each other.
IP address view and modification
Connect the PLC with a network cable. The factory default IP address of this machine is 192.168.1.218. The PLC can be directly connected to the computer, or it can be connected to a router or switch, and the PLC can be accessed through the router settings.
To access the PLC from the computer, it is required that the computer and the PLC are in the same LAN segment, and the wired network card (note that it is not a wireless network card) IP address is in the network segment 192.168.1.XXX
After filling in the computer’s IP address, test whether the computer and the PLC are physically connected properly. Open the “Command Line Prompt” on the computer, and ping 192.168.1.218. If the PLC returns the data within 1ms, the physical link is normal.
View and modify IP address via web page
Use a browser (IE browser is recommended) to enter the URL, http://192.168.1.218
Ethernet download and monitoring
Download
Take the PLC network cable connected to the computer as an example, click Set PG/PC interface in the viewing window and choose according to your computer network card (the picture below is the demo machine network card, the user needs to choose according to your computer network card, the name of your computer network card can be viewed in the “device manager”, if the driver list There is no network card in the computer, this is a S7 software compatibility problem, it is recommended to apply a 64-bit system patch), click Diagnose to test.
OK means that the SR protocol test is successful, but it does not mean that the PLC connection is successful, because even if the PLC is not connected, if the SR protocol is okay, the test will be OK; if it fails, please refer to the “SR Protocol Diagnosis Failure Solution”.
Click the communication button on the viewing interface
Click OK, double-click to refresh the list, the PLC model is identified in the host column, indicating that the connection is successful
Be sure to click the searched device, and then click Confirm.
SR protocol diagnosis failure solution
An error occurred in the function call SRMD_Set(..)
Error: No interface handle
Question: S7ONLINE Error: SRMD_Set No interface handle?
Reason: “C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe” file is blocked from running, causing: “SIMATIC IEPG Help Service” to stop.
Solution 1:
Right-click on the computer, left-click on Manage—>Services and Applications—>Service—>and then activate "SIMATIC IEPG Help Service"; if it fails to activate, it means that it is blocked by antivirus software. Add the s7oiehsx.exe file to the "antivirus software" "In the executable file trust table, re-run "SIMATIC IEPG Help Service", finally restart the computer, and restart STEP 7.
Solution 2:
Left-click the mouse and click Start—>Run—>services.msc to activate "SIMATIC IEPG Help Service"; if it fails to activate, it means it is blocked by anti-virus software. Add the s7oiehsx.exe file to the executable file of "360 or other anti-virus software" In the trust list, re-run "SIMATIC IEPG Help Service", finally restart the computer, and restart STEP7.
MODBUS TCP Protocol-Communication Example
Ethernet port PLC, supports Modbut TCP server mode and client mode
Install MODBUS TCP command library
Open the S7 programming software, there is no Modbus TCP in the library, download the latest Modbus TCP library “S7-200 software Modbus TCP installation library 4.0.mwl“
This library file cannot be deleted after installation, otherwise the library will be lost, so it is recommended to copy it to a fixed location. After restarting, the MODBUS_TCP library is installed
MODBUS address mapping table
| Modbus address | Read/write | Description | Function code |
|---|---|---|---|
| 00001 to 00128 | Q0.0 to Q15.7 | Digital output | Read coil: No. 1 function code; Write single coil: No. 5 function code, Write multiple coils: No. 15 function code |
| 10001 to 10128 | I0.0 to I15.7 | Digital input | Read input status bit:No. 2 Function code |
| 30001 to 30128 | AIW0 to AIW62 | Analog input register | Read input register: No. 4 function code; |
| 40001 to 4XXXX | VW(HoldStart) to VW[HoldStart +2 * (XXXX-1)] | Holding register, corresponding to V area, HoldStart is filled in the program instruction. | 40001 to 4XXXX Read holding register: No. 3 function code; Write a single register: function code No. 6; write multiple registers: function code No. 16 |
PLC as server, computer (touch screen) as client example
The PLC is the server and the touch screen is the client is the most commonly used connection method. It is also the easiest way to program on the PLC. You only need to write a command. Modbus tcp serves as the server, and the port is 502.
PLC server command (ModbusTCP_Sever)
| Parameter | Parameter Type | Data Type | Definition |
|---|---|---|---|
| EN | INPUT | Bool | Enable |
| Port | INPUT | Byte | Communication port 1,2,3,4,5 |
| Error | INPUT | Byte | error code |
| MaxIO | INPUT | Word | The maximum I/Q bit, the maximum number of I/O points involved in communication, the I/O image area of S7-200 is 128/128, and the default value is 128 |
| MaxAI | INPUT | Word | The maximum number of AI words, the maximum number of AI channels involved in communication, can be 16 or 32 |
| MaxHold | INPUT | Word | The largest holding register area, V memory area words involved in communication (VW) |
| Holdstart | INPUT | DWord | The starting address of the holding register area, specified by &VBx (indirect addressing mode) |
PLC as client, computer (touch screen) as server setting
This kind of use is mainly used in PLC connection with sensor applications that support Modbus TCP protocol.
Client instruction (ModbusTCP_Client)
| Parameter | Parameter Type | Data Type | Definition |
|---|---|---|---|
| EN | INPUT | Bool | Enable |
| CONNECT | INPUT | Bool | 0: Disconnect, 1: Establish and keep the connection. |
| Socket | INPUT | Byte | Communication port 1,2,3,4,5 |
| Profile_Table | INPUT | Word | The starting address of the communication profile table is represented by a byte offset from V0 (for example, VB99, the corresponding value is 99) |
| Error | INPUT | Byte | Error code |
Add data in the data block according to the access requirements
Send data configuration format
| Offset address of sending start address | example | example | |
|---|---|---|---|
| VBn | 4 | Number of segments accessed by this socket | 4 |
| VBn+1 | The highest byte of the other party’s IP address | 192 | |
| VBn+2 | The second byte of the other party’s IP address | 168 | |
| VBn+3 | The third byte of the other party’s IP address | 1 | |
| VBn+4 | The last byte of the other party’s IP address | 205 | |
| VBn+5 | Slave ID Slave address | 16#FF | |
| VBn+6 | function code | 3 | |
| VBn+7 | The data address of the slave to be read and written | 40001 | |
| VBn+9 | Number of read and write data | 4 | |
| VBn+11 | Start address of sending data in V storage area | 1000 | |
| VBn+13 | Start address of the received data in the V storage area | 1300 | |
| VBn+15 | Status byte of this section | ||
| VBn+16 to VBn+20 | This section reserved for use | ||
| VBn+21 | The highest byte of the other party’s IP address | 192 | |
| VBn+22 | The second byte of the other party’s IP address | 168 | |
| VBn+23 | The third byte of the other party’s IP address | 1 | |
| VBn+24 | The last byte of the other party’s IP address | 205 | |
| VBn+25 | Slave ID Slave address | 16#FF | |
| VBn+26 | function code | 16 | |
| VBn+27 | The data address of the slave to be read and written | 41000 | |
| VBn+29 | Number of read and write data | 4 | |
| VBn+31 | Start address of sending data in V storage area | 1600 | |
| VBn+33 | Start address of the received data in the V storage area | 1900 | |
| VBn+35 | Status byte of this section | ||
| VBn+36 to VBn+40 | This section reserved for use | ||
| continuous | continuous |
The format of the received data
| answer | Receive the offset address of the start address | Description | |
|---|---|---|---|
| Correct answer | VBn | Number of received data | |
| VBn+1 | Slave ID Slave address | ||
| VBn+2 | function code | ||
| VBn+3 | Number of data read | ||
| VBn+4 | Data area | ||
| Error | VBn | Number of received data | |
| VBn+1 | Slave ID Slave address | ||
| VBn+2 | function code+0x80 | The highest position of the function code 1 | |
| VBn+3 | Error code: 0 no error 1 The value of Count is 0 2 Illegal data address 4 Communication port is busy 6 Function code error |
In the above example, only the Socket1 communication port is turned on, segment 1 accesses 192.168.1.205, segment 2 accesses 192.168.1.205, segment 3 accesses 192.168.1.210, segment 4 accesses 192.168.1.213, and the same communication port accesses the unreachable IP Address, this will reduce the efficiency of communication. It is recommended that the same socket only access the same IP address. If you want to access another IP address, open another socket for configuration.
FAQ
Ping fails.
Answer: It means that the physical layer is not connected successfully. 1 Check whether the network cable is loose. 2 Check whether the computer IP and PLC’s IP are in the same network segment. 3Whether the computer gateway address, subnet mask and DNS address are filled in completely. 4Turn off the computer’s wireless network card and try. 5 Let the computer and the PLC connect directly with the network cable, and try to remove the intermediate router.
It can be pinged, but the web page cannot be opened.
Answer: 1 Try changing the IE browser. 2 https is not allowed in the URL, but http should be used. 3 Try changing to another computer.
The S7 software settings PC/PG interface cannot find the network card driver.
Answer: Download the 64-bit patch from the website and try it out.
Two CPU226-ETH devices are hung under the same switch, and one of them is not smooth.
Answer: After the PLC leaves the factory, the MAC addresses are all the same. Check if the MAC addresses are the same, and just modify one of them.
The two PLCs can’t communicate directly with the network cable, but they can communicate when they are plugged into the switch.
Answer: Try changing the crossover cable.