Configuring MB_SERVER on S7-1200 CPU 1217C with TCON_IP_v4

The S7-1200 MB_SERVER instruction exposes a different hardware interface starting with the CPU 1217C (and any S7-1200 CPU running firmware V4.0 or later with the matching library version). Engineers familiar with the CPU 1214C are surprised to find that the CONNECT input no longer carries inline Connect_ID and IP_Port fields. The port, ID, remote endpoint, and connection mode are now encapsulated inside a TCON_IP_v4 data block produced by the TCON configuration editor. This article walks through the full setup, explains why the block interface changed, and shows the exact DB structure expected at the CONNECT input.

Overview of the Change in MB_SERVER

On legacy S7-1200 CPUs (firmware V3.x and library versions up to V3.1), the MB_SERVER instruction presents the connection parameters directly on the block face:

• Connect_ID – local connection identifier (1..4095)
• IP_Port – local TCP port (502 for Modbus TCP)
• MB_HoldReg – pointer to the Modbus holding register data block

Starting with library version V4.0 (which is the only available version for CPU 1217C, part number 6ES7217-1AG40-0XB0 and equivalents), the connection parameters are no longer inline. They are encapsulated in a connection description of PLC data type TCON_IP_v4. The instruction now requires a single CONNECT input of that type. The TIA Portal project then contains a globally defined connection (created through the TCON editor) that is referenced by the MB_SERVER instruction.

Prerequisites

• CPU: S7-1200 with firmware V4.0 or later, e.g. CPU 1217C DC/DC/DC (6ES7217-1AG40-0XB0) or CPU 1217C DC/DC/Rly.
• TIA Portal: V13 SP1 Update 9 or later (V14 / V15 / V16 / V17 are all compatible). Match the installed S7-1200 HSP so the CPU 1217C V4.x device description is loaded.
• Library: Modbus TCP block library "Modbus_1200_V4_x" or the version delivered with your TIA Portal. Older V3.x libraries will not install on a V4.0 CPU.
• Program unit: A cyclic OB, typically OB1.
• IP plan: A static IP address on the CPU's PROFINET interface (192.168.0.1 is the default).
• PC or HMI running a Modbus TCP master (Modscan, Modbus Poll, custom PLC, SCADA) for verification.

Step-by-Step Configuration

Step 1 – Add the MB_SERVER Instruction

1. Open your S7-1200 project in TIA Portal.
2. Navigate to Program Blocks > OB1.
3. From the right-hand "Instructions" task card, choose Communication > Modbus TCP.
4. Drag MB_SERVER (V4.0) into a network.
5. Confirm the multi-instance DB dialog. The instance DB will store the run-time state of the server.

At this point the block face will show CONNECT, MB_HOLD_REG, DISCONNECT, NDR, DR, ERROR, STATUS – but no inline Connect_ID or IP_Port. This is the expected behavior for V4.0.

Step 2 – Create the Connection Data Block

The CONNECT input expects a tag of data type TCON_IP_v4 (or TCON_IP_v4_S for the secure variant on S7-1500; S7-1200 only supports TCON_IP_v4). Create a dedicated global DB to hold the structure.

1. In the project tree, right-click Program Blocks and choose Add new block > Data block.
2. Name it MB_Conn_DB (or any descriptive name).
3. In the new DB, create a new tag named ConnParam.
4. In the Data type column, type TCON_IP_v4 exactly – it will not appear in the drop-down.
5. Press Enter; TIA Portal resolves the type from the system libraries.

Step 3 – Populate the TCON_IP_v4 Structure

The TCON_IP_v4 data type has the following layout:

Fill the structure with values that match a passive server:

InterfaceId      := 64;        // PROFINET interface of CPU 1217C
ID                := 1;         // Unique connection ID
ConnectionType    := 16#0B;     // TCP
ActiveEstablished := TRUE;      // Server (passive) – accept incoming
RemoteAddress     := 0.0.0.0;   // Accept any remote client
RemotePort        := 0;         // Accept any remote port
LocalPort         := 502;       // Standard Modbus TCP port

Step 4 – Wire the Connection DB to MB_SERVER

1. Open the MB_SERVER call in OB1.
2. Click the CONNECT input pin.
3. Type the symbolic name of the connection tag, e.g. "MB_Conn_DB".ConnParam.
4. For MB_HOLD_REG, supply a pointer to the data block that holds the Modbus holding registers, e.g. P#DB10.DBX0.0 WORD 1000 for 1000 words starting at offset 0 in DB10.
5. Wire DISCONNECT to FALSE (or an I_ tag if you want a control input).

Step 5 – Place a TCON Instruction (Static Definition Only)

The TIA Portal documentation and field practice both recommend adding a TCON instruction somewhere in the program so the editor can validate the connection DB at compile time. The instruction itself does not need to actively call out:

1. Insert TCON from Instructions > Communication > S7 Communication into a separate network.
2. Wire REQ to FALSE.
3. Wire CONNECT to the same MB_Conn_DB.ConnParam tag.
4. Wire ID to 1 (must match the value inside the structure).

Because REQ is permanently FALSE, TCON is never actually executed. It exists only so the project holds a binding to the connection description, which allows TIA Portal to compile the program and check for port/ID collisions.

Verifying the Connection

1. Compile and download the project to the CPU 1217C. Go online.
2. Open the watch table and force a holding register in MB_HOLD_REG, e.g. DB10.DBW0 := 16#1234.
3. On the Modbus TCP master, configure the connection: IP 192.168.0.1, port 502, Unit ID 1, Holding Register base address 40001.
4. Read register 40001 from the master. You should see 16#1234 / 4660 decimal.
5. Write a value from the master to register 40001 and confirm the value appears in the watch table.

If the read returns 0 or times out, see the troubleshooting matrix below.

Troubleshooting Matrix

Reference: TCON_IP_v4 vs. Legacy Inline Parameters

Field Tips and Edge Cases

• Multiple Modbus servers on the same CPU: Each server must use a unique ID and a unique LocalPort (use 502 for the first, 503 / 504 for additional slaves, or stay on 502 with different IDs only if the master supports Unit ID routing – most do not).
• Routing through a CP 1243-1 / CM 1243-1: When the server is exposed through an external IE module, set InterfaceId to the system constant of that module (typically 65 or higher). Using 64 (the onboard interface) when traffic arrives on the CP will silently drop incoming connections.
• Watchdog and connection drop: If a Modbus master opens and immediately closes, the CPU will re-accept the next connection attempt without operator action. The DR (Data Ready) and NDR (New Data Ready) outputs toggle on each completed Modbus transaction.
• Security note: Modbus TCP is unauthenticated. Place the PLC behind a firewall or use the S7-1200's integrated security functions (access protection, "No communication via PG/PC port") when the device is reachable beyond the plant network.
• Firmware upgrade from V3.x to V4.x: After upgrading the CPU firmware, the existing V3.1 MB_SERVER blocks are flagged as incompatible. Delete the call, drag the V4.0 block, recreate the connection DB, and rewire all holding-register pointers.

Acceptable Shortcut – TCON Configuration Editor

Instead of building a raw TCON_IP_v4 DB by hand, TIA Portal can generate one for you:

1. Open Devices & Networks and select the CPU 1217C.
2. Open the Properties > General > PROFINET interface > Ethernet addresses dialog.
3. Switch to the Connection mechanism tab and add a new S7 / Modbus connection.
4. Use the wizard to assign port 502 and an ID of 1.
5. Confirm with OK. TIA Portal creates a connection DB in the System blocks > Connections folder.
6. Reference that DB's ConnParam tag at the CONNECT input of MB_SERVER.

This is the path preferred by Siemens for users migrating from the old inline interface, and it removes the chance of typos in the TCON_IP_v4 structure.

Summary

Configuring MB_SERVER on a CPU 1217C requires a connection DB of type TCON_IP_v4 instead of the inline parameters used on CPU 1214C. Define the DB, fill the local port (502), set ActiveEstablished := TRUE, allow any remote client (0.0.0.0:0), and wire the resulting ConnParam tag to the CONNECT input of MB_SERVER. Keep a stub TCON instruction with REQ := FALSE in the program to anchor the connection. Validate with a Modbus TCP master on register 40001. The same procedure applies to all S7-1200 CPUs running firmware V4.0 or later, including CPU 1211C, 1212C, 1214C, 1215C, 1217C and the fail-safe variants.