Programming SIMATIC CN 4100: CNET Block Configuration Guide

1. SIMATIC CN 4100 System Overview

The SIMATIC CN 4100 is a Siemens industrial communication gateway that converts between Modbus TCP, OPC UA, and SIMATIC S7 protocols. It operates as a dedicated subnet node in PCS 7 systems and is configured through the CNET engineering tool rather than STEP 7 or TIA Portal. The CN 4100 runs a Linux-based firmware with a BIOS-driven boot sequence that takes approximately 8 minutes during initial commissioning.

Key operational characteristics:

• Architecture: x86 embedded platform with preinstalled firmware (current documented release: V4.0)
• Network interfaces: Minimum two Ethernet ports; PG/PC interface must be on the same subnet as the CN 4100 during engineering
• Supported protocols: Modbus TCP, OPC UA (server), S7 communication for PCS 7
• Configuration: Done offline in CNET, then deployed to the runtime gateway
• Integration path: Block library (CN_BB_COMM, MODBUS_COMM, CN_BB_AI8, CN_BB_AO8, CN_BB_DI8, CN_BB_DO8) imported into PCS 7 as Type/Instance DBs

The official system manual is the SIMATIC CN 4100 Communication System manual (PDF). Application-level configuration and the PCS 7 demo project are documented in entry 109801222 - CN 4100 OPC UA/Modbus TCP gateways application manual V4.0 (PDF) on the Siemens Industry Online Support portal.

2. CNET Project Structure

CNET organizes each external Modbus device as a Folder within a CN 4100 project. Each folder contains one or more logical connection instances and a set of I/O function blocks. A typical folder has this structure:

CN_4100_Project
  └── Folder: Device_1 (e.g., a Modbus power meter)
        ├── Instance: CN_BB_COMM (connection backbone)
        ├── Instance: MODBUS_COMM (Modbus TCP driver)
        ├── Instance: CN_BB_AI8 (analog inputs, 8 channels)
        ├── Instance: CN_BB_AO8 (analog outputs, 8 channels)
        ├── Instance: CN_BB_DI8 (digital inputs, 8 channels)
        └── Instance: CN_BB_DO8 (digital outputs, 8 channels)
  └── Folder: Device_2
        └── ...
  └── Folder: Device_N
        └── ...

The CN_BB_COMM block is the per-folder communication backbone: it owns the read/write length budgets (READ_LEN, WRITE_LEN) and arbitrates the request to the Modbus driver instance. The MODBUS_COMM block holds the IP, port, slave/unit ID, and timeout configuration. The I/O blocks (CN_BB_AI8, CN_BB_AO8, CN_BB_DI8, CN_BB_DO8) only describe how much data and where in the Write DB/Read DB the values should land.

3. The CN_BB_COMM Parameters: READ_LEN and WRITE_LEN

Two parameters of CN_BB_COMM govern the buffer layout of the Write DB and Read DB for that folder:

In the Siemens-supplied application example, both are set to 200 bytes per folder. This value must be greater than or equal to the sum of the byte counts consumed by every I/O block in the folder. Two engineering rules apply:

1. WRITE_LEN ≥ Σ (byte footprint of every CN_BB_AO8 + CN_BB_DO8 instance in the folder).
2. READ_LEN ≥ Σ (byte footprint of every CN_BB_AI8 + CN_BB_DI8 instance in the folder).

If the sum of I/O block footprints is, for example, 145 bytes, then WRITE_LEN = 200 leaves 55 bytes unused inside that folder's slice. The next folder does not start at byte 246 (i.e., 200 + 46) - it starts at byte 200, because the WRITE_LEN defines the size of the slot, not the size of the data. The unused tail of the slot is reserved for the folder but is not addressable by the user program.

4. The Write DB and Read DB Layout

CNET generates two global data blocks that are visible in PCS 7: the Write DB (gateway → field) and the Read DB (field → gateway). The user program reads its process values from the Write DB and writes setpoints into the Read DB. Each I/O block instance has two configuration fields that anchor it in this layout:

• DB Address (start): Byte offset within the Write DB or Read DB where the first byte of this instance lives.
• Length: Number of bytes this instance occupies in the DB.

Within a single folder, byte ranges must not overlap. Across folders, each folder receives a contiguous slot whose size is governed by READ_LEN and WRITE_LEN. The starting offset for folder k is the cumulative sum of WRITE_LEN values from folders 0…k−1 (for the Write DB) or READ_LEN (for the Read DB).

Worked example: three folders with WRITE_LEN = 200 each:

Inside Folder_1, a CN_BB_AO8 instance with DB address = 220 and length = 16 occupies bytes 220–235. The next CN_BB_DO8 in the same folder could start at byte 236 if it consumes 2 bytes, leaving 164 bytes still inside the folder's 200-byte slot.

5. Bit vs Byte Parameters in the Write DB

CNET maps every parameter onto a byte in the Write DB, even when the underlying Modbus register is a single bit (coil or discrete input). This byte-padded representation is intentional: it eliminates alignment ambiguity for the Modbus driver, which has no native notion of a "bit address in a DB."

The question of whether PCS 7 then converts this byte back to a BOOL for the user program depends on the project convention used by the integrator. Two valid approaches exist:

1. BYTE view (default): The user program reads DB1.DBB246 directly. A bit-style parameter occupies one full byte (0x00 or 0x01). This is the lowest-risk approach and the one used in the Siemens demo project.
2. BOOL view: The user program defines a UDT or a derived DB that overlays DB1.DBX246.0 onto the source byte. This requires the integrator to be aware that the other 7 bits of byte 246 are still inside the folder's reserved slot and are not available for any other instance.

6. INT16 and Analog Value Addressing

Analog values in CNET are defined as INT16 (16-bit signed integers, range −32768…+32767). One INT16 occupies two consecutive bytes in the Write DB or Read DB. CNET applies little-endian byte order, which matches S7 conventions:

Engineering rules for INT16 placement:

• An INT16 always starts on an even byte offset. CNET enforces this automatically.
• An 8-channel AI block (CN_BB_AI8) consumes 16 bytes of Read DB (8 channels × 2 bytes).
• An 8-channel AO block (CN_BB_AO8) consumes 16 bytes of Write DB.

If a folder contains two CN_BB_AI8 instances and one CN_BB_DI8, and each AI8 occupies 16 bytes and the DI8 occupies 1 byte, the total Read DB footprint is 33 bytes. Setting READ_LEN = 200 therefore reserves 200 bytes per folder, of which 33 are populated by I/O blocks and 167 are unused padding inside the folder's slot.

7. Signal Status Offsets in the AI8 Block

Application manual section 4.2 (CN 4100 V4.0) documents a Signal Status byte for every parameter of the CN_BB_AI8 block. The signal status byte is a quality indicator: it reports whether the value is GOOD, BAD, UNCERTAIN, or in a substituted state, following the OPC UA status-code conventions used elsewhere in PCS 7.

The signal status byte is placed after the value bytes of the corresponding channel. The addressing rule is therefore:

Channel n value  : Read_DB.DBB[DB_Addr + 2*n    ]  (low byte)
                   Read_DB.DBB[DB_Addr + 2*n + 1]  (high byte)
Channel n status: Read_DB.DBB[DB_Addr + 16 + n   ]  (status byte)

For an 8-channel AI8 with DB_Addr = 100, the layout is:

Total AI8 footprint: 16 bytes of process value + 8 bytes of status = 24 bytes per instance. This is larger than the naive "8 channels × 2 bytes = 16" calculation and is a common source of off-by-eight errors in user-supplied READ_LEN values.

8. Step-by-Step Configuration in CNET

1. Set the PG/PC interface in SIMATIC Manager / TIA Portal to the network adapter that is on the same subnet as the CN 4100. The first commissioning step requires this, because the CN 4100 is reached by IP, not PROFIBUS.
2. Create the CN 4100 project in CNET and add a folder for each downstream Modbus device. Each folder is one logical gateway-to-device connection.
3. Insert CN_BB_COMM into the folder and set READ_LEN and WRITE_LEN to the slot size you want to reserve. A practical starting value is 200 bytes per direction, matching the Siemens demo.
4. Insert MODBUS_COMM and configure the IP address, TCP port (default 502), unit/slave ID, response timeout (typical 1000 ms), and number of retries (typical 3).
5. Insert I/O blocks (CN_BB_AI8, CN_BB_AO8, CN_BB_DI8, CN_BB_DO8) into the folder. For each instance, set the starting DB address and length so that the sum of all I/O block footprints does not exceed READ_LEN / WRITE_LEN.
6. Compile the CNET project and download the configuration to the CN 4100 runtime.
7. Import the generated type DBs into the PCS 7 S7 program as type/instance DBs. The block library is documented in entry 109801222.
8. Wire the user program to read process values from the Read DB and to write setpoints into the Write DB.

9. Verification Procedure

After deployment, the following checks confirm correct addressing and configuration:

1. Watch the Write DB and Read DB online in STEP 7. Confirm that values written by the user program appear at the expected offsets in the Write DB within one Modbus cycle.
2. Inspect the signal status bytes. A persistently BAD (0x00/0x01 in OPC UA terms) status on a channel that is physically connected indicates either a wrong Modbus register address or a slave device that is offline.
3. Cross-check the byte budget. If WRITE_LEN is set to 200 but the Modbus driver reports a buffer overflow, the cumulative footprint of CN_BB_AO8 and CN_BB_DO8 instances has exceeded 200 bytes. Increase WRITE_LEN, or split the device into two folders.
4. Verify the slot boundaries across folders. Folder_1's first parameter must land at offset = Σ WRITE_LEN of all preceding folders. Any deviation indicates a manual override of the DB address field was performed in CNET and is likely a configuration error.
5. Confirm cycle time. With a single folder at 200-byte WRITE_LEN and 200-byte READ_LEN, expect a per-folder update time of approximately 250–500 ms over Modbus TCP, depending on the slave's response latency.

10. Common Pitfalls and Corrections

11. Where to Find the Working Demo Project

Siemens publishes a complete, working PCS 7 demo project for the CN 4100 V4.0 firmware. It is attached to the support entry 109801222 - CN 4100 OPC UA/Modbus TCP gateways in PCS 7. The deliverable includes:

• A pre-built CNET configuration with three reference folders
• The S7 program source (FBs, DBs, UDTs) for PCS 7 V9.x
• A commissioning checklist
• Mapping tables that explicitly show the byte offsets produced by each I/O block instance

Use this project as the baseline. After confirming the baseline runs against a single Modbus slave, layer your own folders on top of it - the byte-budget math described in sections 3, 6, and 7 will then become a verification check rather than a design exercise.