How does data communication work between S7-300/S7- 400 and S7-200 via MPI using S7 basic communication?
You can access various S7-200 CPUs from the S7-300 / 400 using X_PUT / X_GET via MPI. Here, the S7-300 / S7-400 is the master and the S7-200 the slave
With S7-200 CPUs of the CPU 22x series, you can work with the baud rates 19.2kBd and 187.5kBd. Refer to the technical data of the CPUs concerned for the transfer rates supported by your S7-300 / S7-400 CPU at the MPI interface. The table below gives you information about the maximum number of connections available for S7 basic communication in the S7-300 CPUs
Requirements for the S7-200 CPU:
- Set the address of the S7-200 CPU.
- Put the data to be sent into the relevant Send buffer or get the received data from the Receive buffer.
- You define the Send and Receive buffers in STEP 7 when parameterizing the system functions SFC67 “X_PUT” and SFC68 “X_GET”.
Reading data from the S7-200 CPU with the system function SFC67 “X_GET”
You use the system function SFC67 “X_GET” for reading data from the S7-200 CPU. You call this in the OB1 of the S7-300 / S7-400, for example. In this example, 10 bytes are read as from address 10 from the variable area of the S7-200 CPU. The 10 bytes of data received are stored in data block DB10 as from address 10 in the S7-300/S7-400. The following table gives an overview of the input parameters of the system function SFC67 “X_GET”
| Input parameter | Variable | Description |
| REQ | M0.1 | The input parameter REQ (request to activate) is a level-triggered control parameter. A positive level at M0.1 of the S7-300 / S7-400 starts reading of the data from the S7-200. |
| CONT | FALSE | The input parameter CONT (continue) is a control parameter that determines whether or not the connection to the communication partner remains established upon completion of the job.CONT=0: connection is cleared down after completion of data transfer. CONT=1: connection remains established after completion of data transfer. |
| DEST_ID | W#16#4 | MPI address of the S7-200 CPU |
| VAR_ADDR | P#DB1.DBX 10.0 BYTE 10 | Reference to the area to be read in the partner CPU. 10 bytes of data are read as from address 10 from the variable area (VB) of the S7-200. |
The following table gives an overview of the output parameters of the system function SFC67 “X_GET”.
| Output parameter | Variable | Description |
| RET_VAL | MW 2 | If an error occurs during processing of the function, the return value includes the relevant error code.If no error occurs, the RET_VAL contains the length of data block copied into the receive area RD as a positive number in bytes. |
| BUSY | M12.1 | BUSY=1: The receive procedure has not yet finished. BUSY=0: The receive procedure has been completed or no receive procedure is active. |
| RD | P#DB10.DBX 10.0 BYTE 10 | Reference to the receive data area. The following data types are permitted: BOOL, BYTE, WORD, DWORD, and arrays of these data types except BOOL. The receive area RD must be at least as long as the read area VAR_ADDR of the communication partner. In addition, the data types of RD and VAR_ADDR must match. |
Writing data to the S7-200 CPU with the system function SFC68 “X_PUT”
You use the system function SFC68 “X_PUT” for writing data to the S7-200 CPU. You call this in the OB1 of the S7-300 / S7-400, for example.
In this example, 10 bytes are written as from address 10 to the variable area of the S7-200 CPU. The 10 bytes of data sent are stored in data block DB10 as from address 20 in the S7-300/S7-400.
The following table gives an overview of the input parameters of the system function SFC68 “X_PUT”.
| Input parameter |
Variable | Description |
| REQ | M100.1 | The input parameter REQ (request to activate) is a level-triggered control parameter. A positive level at M100.1 of the S7-300 / S7-400 starts writing of the data to the S7-200. |
| CONT | FALSE | The input parameter CONT (continue) is a control parameter that determines whether or not the connection to the communication partner remains established upon completion of the job.CONT=0: connection is cleared down after completion of data transfer. CONT=1: connection remains established after completion of data transfer. |
| DEST_ID | W#16#4 | MPI address of the S7-200 CPU |
| VAR_ADDR | P#DB1.DBX 20.0 BYTE 10 | Reference to the area to be written to in the partner CPU. 10 bytes of data are written as from address 20 to the variable area (VB) of the S7-200. |
The following table gives an overview of the output parameters of the system function SFC68 “X_PUT”.
| Output parameter |
Variable | Description |
| SD | P#DB10.DBX 20.0 BYTE 10 | Reference to the area in your own CPU that contains the data to be sent. The following data types are permitted: BOOL, BYTE, WORD, DWORD, and arrays of these data types except BOOL. SD must have the same length as the VAR_ADDR parameter of the communication partner. In addition, the data types of SD and VAR_ADDR must match. |
| RET_VAL | MW102 | If an error occurs during processing of the function, the return value includes the relevant error code. |
| BUSY | M112.1 | BUSY=1: The send procedure has not yet finished. BUSY=0: The send procedure has been completed or no send procedure is active. |
A sample program for parameterizing the system functions SFC67 “X_GET” and SFC68 “X_PUT” is attached for downloading.
The sample program is a STEP 7 project that contains the complete hardware configuration including the user program of an S7-300 station. The STEP 7 project is available for downloading as a ZIP file.
Extract the “S7_basic_communication.zip” file into a separate directory. The STEP 7 project is unpacked automatically with all its subdirectories. You can then use the SIMATIC Manager to open and process the extracted STEP 7 project.
Sample :
Note:
Set the S7-300/S7-400 control to STOP mode before loading the block that calls the system functions SFC67 “X_GET” and SFC68 “X_PUT” into the controller. This ensures that the system functions SFC67 “X_GET” and SFC68 “X_PUT” are initialized in any case and the data is transferred