Configuring ET200S IM151-8 PN/DP for Modbus TCP to Remote RTU

1. Application Scenario Overview

This document is a field reference for integrators who must connect a SIMATIC ET200S distributed controller — head module CPU IM151-8 PN/DP (PROFINET IO controller with integrated PROFINET interface) — to a third-party Remote Terminal Unit, typically a Schneider Electric SCADAPack, Trio, or similar water-utility RTU, using the Modbus protocol. The physical path between the two devices is approximately 3 km, well beyond the 100 m copper-Ethernet limit, so the link is carried by either fibre-optic cable or by industrial Ethernet radio (point-to-point bridge).

Two Modbus variants are candidates for the link:

• Modbus TCP/IP — preferred for new deployments. Modbus TCP rides on standard TCP port 502, needs no special hardware on the ET200S side beyond the onboard PROFINET interface, and is implemented in the CPU by loading the S7 OpenModbus/TCP library (Siemens article number 2XV9 450-1MB02).
• Modbus RTU over RS-485 — possible if a CM PtP (point-to-point) communications module is inserted into the ET200S station. RS-485 is limited to roughly 1200 m at 9.6 kbit/s and therefore is a poor fit for a 3 km link. The user would also need a serial-to-Ethernet or serial-to-radio converter on the RTU side, adding another point of failure.

For a 3 km separation with native Ethernet on both ends, the recommended solution is Modbus TCP/IP over industrial radio: a pair of outdoor Ethernet-to-radio bridge radios that present a transparent Layer-2 Ethernet service to the two end devices. The ET200S CPU runs the OpenModbus/TCP blocks and exchanges registers with the RTU exactly as if the RTU were on the same switch as the CPU.

2. ET200S IM151-8 PN/DP Hardware Reference

The head module used in the reference application is the IM151-8 PN/DP, a SIMATIC ET200S CPU that combines the function of a PROFINET IO controller and a PROFIBUS-DP master with the footprint of an ET200S station. Two principal variants exist:

For the OpenModbus/TCP library to load and execute, the CPU firmware must be at least V2.0; firmware V3.x or newer is strongly recommended and is required for some of the function-block enhancements shipped with the 2XV9 450-1MB02 package. Firmware updates are performed using the SIMATIC Automation Tool or by writing the firmware file to a SIMATIC SD card. Firmware files are published on the Siemens Industry Online Support portal.

The two PROFINET ports are independent interfaces. By default:

• Port X1 hosts the PROFINET IO network — the link to the engineering station, the HMI panel, and the head-station backplane traffic that drives the ET200S I/O modules.
• Port X2 can be assigned a separate IP subnet, giving the CPU a second IP address and a second MAC address. X2 is the natural choice for the Modbus TCP traffic because the PROFINET IO real-time traffic on X1 is not disturbed, and the routing rules for the Modbus segments remain simple.

If the HMI is on PROFINET and shares the IO subnet, X1 can still host the HMI panel on the same subnet as PROFINET IO. In single-port installations the CPU can also host Modbus TCP on X1, but the IO update budget should be verified because each Modbus connection consumes cyclic interrupt time and TCP socket resources.

3. Communication-Path Selection: Modbus TCP vs Modbus RTU

For a 3 km link, the design decision between Modbus TCP and Modbus RTU is driven primarily by distance, by the I/O count that must be exposed to the RTU, and by the licensing of the OpenModbus/TCP library. The following table summarises the trade-offs:

For a water-utility station where the RTU is a Schneider Electric SCADAPack, the RTU almost always speaks Modbus TCP natively, which removes the serial converter from the bill of materials. The conclusion is that Modbus TCP/IP is the correct choice.

4. S7 OpenModbus/TCP Library (2XV9 450-1MB02)

The S7 OpenModbus/TCP library is the Siemens-supplied function-block set that allows an S7-300, S7-400, WinAC, or ET200S CPU with a PROFINET/PN-IO interface to act as a Modbus TCP client (master) or server (slave). The library is sold separately under article number 2XV9 450-1MB02 and is shipped on a DVD along with a PDF manual, a demo project, and a license-key generator.

The package contains the following function blocks, used according to the role of the ET200S in the exchange:

For the reference deployment, the ET200S is the Modbus server (slave) and the Schneider RTU is the Modbus client (master). The required blocks are MB_CPSRV and MB_DB_OPEN from the S7 OpenModbus/TCP library; MB_CPCLI and the helper blocks are not needed on the ET200S in this role.

Documentation for the library is bundled inside the installation package and is also available on the Siemens Industry Online Support pages indexed by the article number 2XV9 450-1MB02.

5. Licensing, the Reg_Key Input, and the Demo Version

When the OpenModbus/TCP blocks are inserted into the S7 program, each block exposes a REG_KEY input (sometimes also shown as LIC_KEY depending on the block version). The REG_KEY input is a 16-byte STRING (CHAR) constant that contains the registration key purchased with the library. The S7 program will refuse to run — the blocks will report a permanent error code at the STATUS output — until a valid key is wired in.

Licensing of the library works as follows:

• Without a license (free demo): a fully functional demo version is available from the Siemens Support download area. The demo version runs for a limited time (historically 30 minutes, then the connection is dropped) or is limited to a small number of registers. It is intended for engineering and factory acceptance test (FAT) only, not for production.
• With a purchased license: the customer receives a license certificate with a 16-character alphanumeric key. The key is generated against the CPU's serial number (or against a memory card's serial number for the V3 release), so the license is tied to a specific CPU. The key is pasted into a data word constant in the project and passed to MB_CPSVR.REG_KEY and MB_DB_OPEN.REG_KEY at first scan.
• Price: the list price is published in the Siemens Industry Mall under article 2XV9 450-1MB02. Pricing is country-specific and is handled by the local Siemens partner; the customer is not expected to discover the price in the Support forum.

6. Network Topology and Long-Distance Link Options

The IM151-8 PN/DP is, electrically, an Ethernet device. Its copper PROFINET ports are designed for the 100 m twisted-pair segment defined by IEEE 802.3 100BASE-TX. To reach 3 km the integrator has three practical choices, summarised below.

For the 3 km water-utility link the most common choice is a pair of industrial 5 GHz bridge radios mounted on the well-site and the RTU-mast poles. The radio is transparent at Layer 2, so no Modbus or IP configuration on the ET200S changes — the same Modbus register layout works whether the RTU is in the same rack or 3 km away.

RS-485 alternative (for reference only): a Modbus RTU link over RS-485 is limited to 1200 m at 9.6 kbit/s. A 3 km RS-485 link would require one or more RS-485 repeaters, which add another potential point of failure and which are not generally recommended for utility telemetry where the radio path already exists.

7. STEP 7 Classic Configuration Procedure (ET200S as Modbus Server)

The OpenModbus/TCP library installs in STEP 7 V5.5 / V5.6 (the original target environment for the IM151-8 PN/DP) as a standard library that exposes the FBs in the Libraries > OpenModbusTCP section. The following procedure configures the ET200S as a Modbus server.

1. Install the OpenModbus/TCP library. Run the setup from the 2XV9 450-1MB02 DVD on the engineering station. Confirm that the FBs FB100 "MB_DB_OPEN", FB101 "MB_CPSRV", FB102 "MB_CPCLI", FB103 "MB_SENDMSG" and FB104 "MB_RECVMSG" appear in the library navigator.
2. Add the ET200S station. In SIMATIC Manager, create a new project and insert an SIMATIC 300 Station. Replace the CPU 300 with the IM151-8 PN/DP (MLFB 6ES7 151-8AB01-0AB0) so that the standard S7-300 program blocks can be used unchanged in the ET200S head station.
3. Configure the PROFINET interfaces. Open HW Config > Properties > Ethernet Interface on the IM151-8 and assign IP addresses to both ports. Typical values: X1 = 192.168.0.10/24 (PROFINET IO subnet), X2 = 192.168.1.10/24 (Modbus subnet). Enable the IP router between the two interfaces if the RTU is on a different subnet.
4. Create the Modbus data block. Generate a DB (for example DB200 "MODBUS_IMAGE") of sufficient size to hold the registers to be exposed. The simplest layout is one contiguous array of WORD or INT elements. A water-utility station with 32 digital inputs, 16 digital outputs, 8 analog inputs and 4 analog values will fit in 64 words (128 bytes).
5. Insert MB_DB_OPEN. Call FB100 in OB100 (warm restart) or OB101 (hot restart). Pass the DB number of the Modbus image, the offset of the holding-register area, the number of holding registers, and the offset and count of the input-register area. Pass the REG_KEY string constant.
6. Insert MB_CPSRV. Call FB101 in OB1 (or in a cyclic OB such as OB35 if determinism is required). Pass the instance DB, the local IP (0.0.0.0 to accept on any interface, or the IP of port X2), the TCP port (502 decimal), and the REG_KEY.
7. Map I/O to the Modbus DB. Use the standard S7 mechanisms — direct read/write of the process image, or move instructions driven by the I/O module's PIW/PQW symbols — to keep the process values in the same DB that MB_DB_OPEN has registered with the library. Holding registers (function code 03/06/16) are read-write and are used for setpoints and commands; input registers (function code 04) are read-only and are used for measurements.
8. Compile, download, run. Save, compile, and download the hardware configuration and the S7 program to the IM151-8. Switch the CPU to RUN-P and check the STATUS outputs of the FBs — they should report 16#0000 after a successful first scan.

8. Function-Block Parameter Reference

The two blocks that are relevant for the ET200S server role are documented below. Names and data types follow the S7 OpenModbus/TCP V3.x manual; earlier versions of the library use slightly different pin names but the same semantics.

8.1 FB100 MB_DB_OPEN

8.2 FB101 MB_CPSRV

9. Data-Block Design and Modbus Register Mapping

Modbus TCP is register-oriented. The ET200S exposes the data of its data block to the RTU according to the offsets and counts passed to MB_DB_OPEN. The mapping is byte-aligned, big-endian, with the most significant byte at the lower Modbus address. The standard register types and their function codes are:

A practical layout for the reference station, using a 64-word DB200, is shown below. All offsets are byte offsets inside the DB.

The S7 program keeps the Modbus image in sync with the process image with a small set of move instructions executed in OB35 every 100 ms. For a 32-bit value (e.g. a totaliser in m³), the S7 program writes the high word to DB200.DBW 22 and the low word to DB200.DBW 24. The RTU must then reassemble the 32-bit value in big-endian order on its side, which is the convention used by every Modbus implementation.

10. Schneider RTU Side Configuration

On the Schneider RTU the configuration is symmetric. The RTU is the Modbus client and the ET200S is the server. The fields to be entered in the Schneider configuration tool (for example the SCADAPack Workbench or the ClearSCADA point configuration) are:

• Slave IP address: 192.168.1.10 (the IP of port X2 on the IM151-8).
• TCP port: 502.
• Unit ID / slave address: 1 (or 255 if the RTU is set to use the default 0xFF).
• Polling interval: 1000 ms for fast measurements, 5000 ms for slow totalisers. Do not poll faster than 200 ms because the radio bridge may queue packets.
• Timeout and retries: 3000 ms timeout, 3 retries. On a 3 km radio link a single retry is normal during heavy rain or fog.

Most Schneider RTUs default to the standard Modbus register numbering (0xxxx for coils, 1xxxx for discrete inputs, 3xxxx for input registers, 4xxxx for holding registers), which matches the OpenModbus/TCP convention directly.

11. Verification and Commissioning

After the project is downloaded, a five-step verification confirms that the link is healthy end-to-end.

1. Local link check. From the engineering station, ping the IP of port X2 on the IM151-8. A response confirms the local IP stack is up.
2. FB status check. With the CPU in RUN, open the OpenModbus/TCP instance DB online and inspect STATUS on MB_DB_OPEN and MB_CPSRV. Both must be 16#0000.
3. Modbus poll from a PC tool. Use a Windows Modbus master test tool (such as the open-source Modbus Poll or diagslave) to connect to 192.168.1.10:502 and read holding registers 1–24. The values should match the values written by the S7 program.
4. Radio-link test. Repeat step 3 with the engineering station on the far side of the radio bridge, using the radio's remote-side IP. The same register values must be returned.
5. End-to-end RTU poll. On the Schneider RTU, force a poll of the same registers. The RTU's internal point database should show the expected values within one polling interval.

12. Diagnostics and Troubleshooting Matrix

13. Notes on the OpenModbus/TCP Wizard

STEP 7 V5.5 ships a so-called OpenModbus/TCP Wizard that automates part of the work described above. The wizard:

• generates the Modbus image DB from a list of symbols the engineer enters by hand,
• writes the instance DB for MB_CPSRV and MB_DB_OPEN,
• inserts the FBs into OB100 and OB1, and
• creates a default symbol table mapping the I/O symbols to Modbus addresses.

The wizard does not write the S7 program that keeps the process image in sync with the Modbus DB — that part is still the engineer's responsibility. The wizard is a time-saver, not a complete configuration tool. The output of the wizard is identical, in functional terms, to a hand-written configuration as described in section 7.

14. Time and Effort Estimate

For a first-time integrator, the time to bring a single ET200S station online as a Modbus server against a Schneider RTU is dominated by the coordination between the two ends and not by the engineering on either side. A typical breakdown is:

15. Engineering Checklist

• CPU firmware ≥ V3.0; OpenModbus/TCP library version matches the CPU firmware series.
• License key (16 characters) stored in a dedicated DB; backup copy filed with the FAT paperwork.
• Modbus image DB sized for the worst-case point list plus 20 % spare for future expansion.
• Port X1 reserved for PROFINET IO and HMI; port X2 used for Modbus TCP to the radio bridge.
• IP addressing: PROFINET IO subnet on X1 (e.g. 192.168.0.0/24); Modbus subnet on X2 (e.g. 192.168.1.0/24); static route added on the CPU if the RTU is on a third subnet.
• Modbus unit ID agreed with the RTU integrator (typically 1 or 255).
• Polling interval agreed at 1 s for measurements, 5 s for totalisers; faster polling wastes radio bandwidth and CPU cycles.
• Radio bridge tested with at least 15 dB of fade margin before the cabinet is closed up.
• Diagnostic buffer cleared at handover so that the first real fault is easy to identify.

16. Frequently Asked Questions