Configuring Modbus TCP on ET200S IM-151-8 PN/DP for Energy Meters

Overview

This technical reference describes how to configure a Siemens ET200S distributed I/O station equipped with an IM-151-8 PN/DP interface module as an S7-300-class controller in STEP 7 V5.7, and use the MODBUSPN function-block library to poll energy meters (e.g. Schneider Electric PM710, PM5000, PM8000 families) over Modbus TCP. The procedure covers hardware configuration, library installation, TCON_IP_V4 connection setup, the MB_CLIENT call structure, multi-drop addressing through the Modbus Unit Identifier, and the practical constraints imposed by the ET200S firmware when working as an S7-300 station rather than an S7-1200/1500 controller.

The IM-151-8 PN/DP (order numbers 6ES7151-8AB01-0AB0 and later -0BB0x releases) is unique because it can operate either as an I/O device on PROFINET/PROFIBUS or as a stand-alone PLC-like station. When used in PLC-mode it is programmed from STEP 7 V5.x with classic S7-300 function blocks, which means the modern S7-1200/1500 Modbus blocks (MB_CLIENT, MB_SERVER from the TIA Portal libraries) are not available. Instead the older MODBUSPN library (also referred to in Siemens documentation as the "MODBUS_PN" / "Modbus/PN-CP" library for S7-300 / ET200S CPU-mode) provides the equivalent functionality.

Prerequisites

• STEP 7 V5.7 (or V5.6 with SP2) installed and licensed. STEP 7 V5.7 is the last classic version; floating or single-user licenses are valid. See the STEP 7 V5.7 release notes for installation and license requirements.
• MODBUSPN library package downloaded from the Siemens support portal (entry ID 23923230 or 26662490 depending on revision). Extract the archive into a working folder; the library file is typically named S_MODBPN or Modbus_PN_CPU.
• ET200S station with IM 151-8 PN/DP CPU-mode enabled, firmware ≥ V3.0 (firmware ≥ V3.2 recommended for stable Modbus TCP polling).
• Ethernet connection between the IM-151-8 PN/DP PROFINET port and the Modbus TCP gateway or the energy meter if it has an embedded Ethernet port.
• Energy meter documentation listing Modbus register map (function code, register start address, scaling, units). Schneider PM710 default Modbus parameters: Unit ID 1, 19200 8N1 for RS-485; for Ethernet gateway these are translated to Modbus TCP holding registers starting at 40001.
• Network access to assign a valid IP address to the IM-151-8 PN/DP CPU interface (PN IO port, X1).

Hardware & Software Requirements

ET200S IM-151-8 PN/DP Architecture

The IM-151-8 PN/DP differs from the lower-end IM-151-1 / IM-151-3 PROFINET heads because it includes an internal backplane CPU capable of executing a STEP 7 V5.x user program. From STEP 7's perspective it behaves as an S7-314/315-class CPU with restricted work memory (work memory 128 KB–384 KB depending on firmware revision). The PROFINET port X1 of the interface module is the only Ethernet interface available for Modbus TCP communication; it must be configured with a fixed IP address in the same subnet as the energy-meter gateway.

Key architectural constraints:

• The PROFINET stack and the user TCP connections share the same physical port. Up to 8 open TCP connections are supported concurrently (this is the limit imposed by the Open Communication Wizard / TCON resources of the CPU).
• Modbus TCP polling must use the Open Communication Services (OC) via TCON, TSEND, TRCV, TDISCON blocks. The MODBUSPN library wraps these into dedicated function blocks.
• No hardware Modbus TCP CP (e.g. CP343-1 Lean) is required — the integrated PN interface handles the TCP traffic natively.

MODBUSPN Library Installation

1. Download the library archive (e.g. Modbus_PN_CPU_Vxx.zip) from the Siemens support portal, entry ID 23923230.
2. Extract to a local working directory. The archive contains the program files of standard S7 blocks such as FC11 "MODBUSPN" (Modbus PN client), FB11 "MODBUSPN_DB" (instance DB), and UDT1 / UDT2 for parameter structures.
3. Open the SIMATIC Manager and your S7 project.
4. From the menu choose Options → Install Library and select the extracted *.s7l or *.zip file.
5. The library MODBUSPN appears in the library navigator (left pane) under "Standard Library → MODBUSPN".

STEP 7 V5.7 — Step-by-Step Configuration

1. Hardware Configuration

1. Open HW Config for the ET200S station.
2. Insert the IM 151-8 PN/DP in slot 0 of the ET200S rack. Double-click the module to open its properties.
3. Assign a fixed IP address (e.g. 192.168.10.50 / mask 255.255.255.0) to the PROFINET interface X1.
4. If the PROFINET port is part of an IO-controller relationship with an upstream PLC, ensure the Modbus TCP traffic does not collide with PROFINET IRT cycles. Set the update time of the PROFINET connection to 1 ms and place the Modbus TCP TCON connections in a higher priority OB (e.g. OB35 cyclic interrupt 100 ms).
5. Save and compile the hardware configuration; download to the IM-151-8 PN/DP CPU.

2. Create the Modbus Data Buffer DB

Create a shared DB (e.g. DB100 — "Modbus_Buffer") to hold the read data. A practical layout for 15 PM710 analyzers at 100 registers each is shown below:

3. Create the TCON_IP_V4 Connection DB

The TCON parameter structure is required for every Modbus TCP connection. Create one DB per gateway (e.g. DB200 — "Modbus_Connection_1") with a UDT of type TCON_IP_V4. The UDT is not visible in the dropdown list of STEP 7 V5.7 — type the symbol manually; the compiler recognizes it from the type catalog.

Typical values for an EGX100 gateway at 192.168.10.20:

DATA_BLOCK "Modbus_Connection_1"
TITLE = "Modbus TCP connection to EGX100"
VERSION : 0.1
STRUCT
  InterfaceId   : BYTE := B#16#1;      // PN interface (X1) of IM-151-8
  Connect_Type  : BYTE := B#16#11;     // TCP active connection
  ActiveEstablished : BOOL := TRUE;
  LocalPort     : WORD := W#16#0;      // 0 → assign automatically
  RemoteAddress : IP_V4 := '192.168.10.20';  // gateway IP
  RemotePort    : WORD := W#16#1F6;    // 502 decimal
  LocalAddress  : IP_V4 := '192.168.10.50';  // IM-151-8 IP
END_STRUCT;
END_DATA_BLOCK

The local connection ID (CONN_ID) is a WORD you assign yourself; keep it unique across the project. For 15 meters behind a single gateway, only one TCON connection is required, but the Modbus UNIT_ID inside each poll changes per meter.

4. Wire the MB_CLIENT Call (FC11)

The MODBUSPN library exposes FC11 "MODBUSPN" as the Modbus TCP client. Use a cyclic interrupt OB (recommended: OB35 at 100 ms; minimum cycle 50 ms for stable 15-meter polling). Insert FB11 "MODBUSPN_DB" with instance DB DB11, and wire it from DB100.

CALL FB11, DB11
  REQ     := "Modbus_Buffer".REQ_START
  ID      := "Modbus_Buffer".CONN_ID       // e.g. W#16#0001
  UNIT_ID := "Modbus_Buffer".UNIT_ID       // 1…247, one per PM710
  START   := "Modbus_Buffer".START_ADDR   // e.g. 0 (= Modbus 40001)
  LENGTH  := "Modbus_Buffer".LENGTH        // e.g. 100, max 124
  DONE    := "Modbus_Buffer".DONE
  BUSY    := "Modbus_Buffer".BUSY
  ERROR   := "Modbus_Buffer".ERROR
  STATUS  := "Modbus_Buffer".STATUS
  DATA_PTR:= P#DB110.DBX0.0 BYTE 200      // pointer to destination area

5. Cycle Through the 15 PM710 Meters

Because only one MODBUSPN instance is active at a time, build a sequencer in OB35 (or a separate FC) that increments METER_INDEX after each DONE = TRUE. The sequencer changes START_ADDR, LENGTH, UNIT_ID, and DATA_PTR for the next meter.

Example mapping (PM710 default register layout, 100 registers each):

Total cycle time for 15 meters × 100 registers at a 100 ms OB35 poll = ~1500 ms (well within the 1.5 s refresh tolerance for energy measurement).

Modbus Function Codes Used

MODBUSPN FC11 supports FC03, FC04, FC06, and FC16 out of the box. The function code is implicit in the direction of the request — for reading, set the input MODE = B#16#03 (or 0x04 for input registers). For writing, switch to FC06/FC16 mode via the dedicated FC13 / FC14 blocks included in the MODBUSPN library.

PLCSIM Simulation

STEP 7 PLCSIM (V5.4 SP8 or later) supports S7-300 programs but does not virtualize the PROFINET stack of the IM-151-8 PN/DP. The TCON instruction will return STATUS = 16#80A7 ("connection not established") or 16#80C4 ("temporary communication error").

To develop and commission without physical hardware, use one of the following:

1. PLCSIM + 3rd-party Modbus simulator: Run a Modbus TCP server on the engineering PC (e.g. Modbus Poll, Modbus Slave, or the open-source diagslave tool) and bridge PLCSIM to it using NetToPLCSIM. NetToPLCSIM is an open-source tunneling tool that maps PLCSIM's virtual Ethernet port onto the host's network so external TCP/UDP traffic is reachable by the simulated CPU.
2. PLCSIM Advanced (≥ V2.0) + Modbus Slave: PLCSIM Advanced supports simulating S7-1500/ET200SP CPUs with real network interfaces; for S7-300/IM-151-8 the same NetToPLCSIM technique applies.
3. Real hardware bench: Use a single physical PM710 or a Modbus TCP simulator (e.g. Modbus Tools) and the actual IM-151-8 PN/DP; this is the most reliable commissioning method.

Verification & Commissioning

1. Online → PLC → Operating Mode → ensure the IM-151-8 PN/DP is in RUN with no SF/BF diagnostic LEDs.
2. Open DB100 online and trigger REQ_START = TRUE for the first meter (Index 0).
3. Watch DONE rise within 200–500 ms; STATUS should equal 16#0000.
4. Open DB110 and confirm the first 100 registers contain valid PM710 data (e.g. Voltage L-L in register 0 should be around 400 V ± 10 % for a European installation).
5. Disable REQ_START (set to FALSE) before switching to the next meter; rising-edge triggered calls are mandatory per the MODBUSPN manual.
6. Repeat for all 15 meters; verify the cycle completes within 2 s end-to-end.
7. Capture a Wireshark trace on the engineering PC with display filter tcp.port == 502 to confirm MBAP/PDU sequence: Tx → Rx → Tx → Rx … without retransmissions.

Troubleshooting Matrix

Migration Considerations

If you anticipate migrating the application to a S7-1200 (CPU 1215C, CPU 1217C) or S7-1500 (CPU 1511, ET200SP CPU 1510SP-1 PN), the MODBUSPN library is replaced by the TIA Portal libraries MODBUS_TCP (S7-1500) or the MODBUS TCP blocks of MB_CLIENT / MB_SERVER (S7-1200). These provide a more efficient MBAP stack and dynamic connection pools. For systems designed today, the IM-151-8 PN/DP + MODBUSPN path remains supported but is considered a legacy path; new installations are encouraged to use ET200SP with CPU 1510SP/1512SP and TIA Portal V18+.

Performance & Timing Notes

• A single poll of 100 registers on a 100 Mbit/s Ethernet typically completes in 25–60 ms (round-trip including TCP ACK).
• OB35 at 100 ms with a sequencer of 15 meters yields a worst-case refresh latency of ~1.5 s; this is suitable for energy measurement, not for transient power-quality monitoring (use a faster OB for that).
• The PROFINET IRT update time should be set to ≥ 1 ms when the same port carries both IRT and Modbus TCP traffic; 500 µs updates can starve the OC stack.
• Do not exceed 8 concurrent TCON connections on the IM-151-8 PN/DP. If you need more, use a CP343-1 Lean/Advanced module in slot 1 of the ET200S rack (firmware permitting).

Safety & Reliability Notes

Energy meter polling is non-safety, non-deterministic network traffic. Do not rely on the polled values for SIL-rated protective functions. If the Modbus connection fails, the destination DB110 values should be either zeroed, frozen at the last good value, or marked with a quality byte — implement this in the sequencer FB to prevent downstream control logic from acting on stale or corrupted data.

FAQ