Configuring Modbus TCP/IP Communication on S7-300 PLC Systems

Overview: Modbus/TCP on a SIMATIC S7-300

Modbus/TCP is an open, Ethernet-based variant of the Modbus protocol (IANA assigned TCP port 502) that lets a SIMATIC S7-300 exchange process data with third-party devices such as drives, instruments, RTUs, and SCADA servers without a proprietary gateway. On the S7-300 platform, Modbus/TCP is implemented through one of two architectural paths:

• Path A — CP-based (recommended): A communications processor (CP 343-1 or CP 343-1 Lean/Advanced/EX) terminates the TCP connection and runs the Modbus/TCP server or client. The CPU exchanges data with the CP through the backplane using standard S7 PUT/GET or via the MODBUSCP function block.
• Path B — CPU PN/IE integrated port: For S7-300 CPUs with an integrated PROFINET interface (e.g., CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP), Modbus/TCP can run directly on the CPU's Ethernet port when the optional Modbus/TCP license and blocks are loaded. This eliminates the CP hardware but requires an additional software package.

Siemens' official entry 22660304 in the Siemens Industry Online Support describes both options and points to the matching manuals, sample projects, and library deliverables. Use that entry as the canonical index whenever a firmware or library version question arises.

Hardware Prerequisites

Before any software configuration, confirm the physical layer is complete and the catalog numbers match the firmware you intend to load.

Verify the hardware list against the S7-300 module spectrum manual (entry 8859629) before ordering. Field-replacement with a CP of a different article number is one of the most common causes of a "TCP connection refused" fault on first commissioning.

Software Prerequisites and Licensing

For Path A (CP-based), no license is required on the CP itself. The CP firmware handles the Modbus/TCP framing and the CPU simply reads/writes data tags. For Path B (CPU-based), the Modbus/TCP PN CPU package 2XV9450-1MB11 must be installed and a valid license transferred to the SIMATIC Memory Card; without it the Modbus FB will return error code 0x8600 ("license missing").

Network Topology and IP Planning

Plan IP addresses before you touch TIA Portal or STEP 7. Modbus/TCP does not perform any discovery, so an addressing mismatch between CP and partner device is the single most common commissioning fault.

1. Reserve a static IPv4 address for the CP 343-1 in the same subnet as the Modbus partner. Example for an isolated machine network: 192.168.10.10 / 255.255.255.0.
2. Reserve a static IPv4 address for each Modbus partner (PLC, VFD, SCADA node). Avoid DHCP for industrial Modbus/TCP nodes.
3. Place the CP and the partner on the same physical switch or VLAN. Cross-subnet Modbus/TCP requires the CP 343-1 Advanced or a router; a Lean or standard CP cannot route.
4. Confirm TCP port 502 is not blocked by any managed switch ACL, firewall, or Windows Firewall rule on the SCADA host.
5. If the project uses PROFINET and Modbus/TCP on the same physical port of the CP, verify the CP variant supports both simultaneously (CP 343-1 EX30 and Advanced do; Lean limits concurrent PROFINET IO + open TCP).

Configuration in STEP 7 (Classic) — Path A (CP 343-1)

Step 1: Insert the CP in HW Config

1. Open the SIMATIC Manager and the S7 project.
2. In HW Config, drag the CP 343-1 (6GK7343-1EX30-0XE0) from the hardware catalog onto slot 4–11 of the S7-300 rack.
3. Double-click the CP to open its properties dialog. Assign the static IP address, subnet mask, and (optionally) a router address.

Step 2: Enable the Modbus/TCP connection in NetPro

1. Open NetPro from the SIMATIC Manager.
2. Right-click the CP 343-1 and choose Insert New Connection.
3. Connection type: TCP connection (not ISO-on-TCP, not S7 connection).
4. Set Active connection establishment on the side that initiates (usually the S7-300 for a client role; the partner for a server role).
5. Specify the partner IP address and confirm local port 502 is used for the Modbus/TCP server.

Step 3: Load the MODBUSCP function block

Import the Modbus/TCP CP block library obtained from Siemens entry 22660304. The library contains:

• FB MODBUSCP (background DB instance per logical connection)
• UDT MODBUS_PARAM for connection parameters
• Example project with a sample S7 program

Copy FB MODBUSCP into the S7 program blocks container. Open OB1 and instantiate the FB once per active Modbus/TCP connection.

Programming the MODBUSCP Function Block

The TIA Portal documentation for MODBUSCP describes the block interface for S7-300/S7-400. Key parameters:

Minimal ST call pattern (SCL or STL) to read 10 holding registers starting at Modbus address 40001 from partner 192.168.10.50:

// OB1 — cyclic call
CALL FB 100, DB100   // FB MODBUSCP, instance DB
     ID       := W#16#0001
     START    := TRUE                  // single-shot; latch off in OB1 logic
     REQ_FUNC := B#16#03               // Read Holding Registers
     START_ADDR:= W#16#0000             // address 40001
     QUANTITY := 10
     DATA_PTR := P#DB200.DBX0.0 BYTE 20
     DONE     := M100.0
     BUSY     := M100.1
     ERROR    := M100.2
     STATUS   := MW102

The 20-byte DATA_PTR area in DB200 receives ten 16-bit Modbus registers in big-endian order (high byte first). If the CPU is little-endian, byte-swap each word with TAW / manual rotation before any further integer arithmetic.

Configuration in TIA Portal — Path B (CPU PN/IE direct)

When the project uses an S7-300 CPU with an integrated PN port and the optional Modbus/TCP PN CPU package 2XV9450-1MB11 is installed:

1. In the TIA Portal device view, select the CPU and open Properties > Communication > Modbus/TCP.
2. Add a new Modbus connection; specify role (server/client), partner IP, port (default 502), and the Modbus register area mapping.
3. Transfer the Modbus/TCP license to the SIMATIC Memory Card via Online > Licensing.
4. Use the supplied FBs MB_CPCLI / MB_CPSRV in OB1 instead of MODBUSCP.

Data Areas and Modbus Register Mapping

Modbus addressing is 0-based in the protocol and 1-based in many tools. Translate consistently to avoid off-by-one faults.

When the SCADA configuration tool asks for register 40001, set START_ADDR := W#16#0000 in the FB. When the tool asks for register 40100, set START_ADDR := W#16#0063 (decimal 99 → 0-based offset). Document the mapping in a cross-reference table so commissioning engineers can verify quickly.

Diagnostics and Status Codes

Read the CP's diagnostic buffer via Online > Accessible Nodes or via the RDREC / WRREC SFBs. The MODBUSCP STATUS output returns a hex word that combines a class byte and a detail byte.

The CP 343-1 also writes its own diagnostic entries with identifiers in the format Modbus: TCP xyz. Filter the diagnostic buffer on the string "Modbus" to retrieve only relevant entries.

Verification and Commissioning Checklist

1. From the TIA Portal / STEP 7 engineering station, ping the CP 343-1 IP address; expect < 5 ms RTT on a healthy switched network.
2. Open a Telnet or netcat session to partner-ip 502; the connection should complete silently (no banner).
3. In Online & Diagnostics, view the CP's connection list; the Modbus/TCP entry should appear with state ESTABLISHED.
4. Force a single read of holding register 40001 from the FB and observe DONE = TRUE, ERROR = FALSE, and a non-zero STATUS = 0x0000.
5. From the SCADA side, perform a Modbus poll of the same register; values must match within one poll cycle.
6. Capture a Wireshark trace filtered on tcp.port == 502; verify request/response pairs and MBAP (Modbus Application) header transaction IDs increment monotonically.
7. Disconnect the partner cable; STATUS should change to 0x80D0 within the configured keep-alive time (default 10 s).
8. Reconnect and confirm the FB recovers without CPU restart (no STOP needed).

Troubleshooting Matrix

Performance and Polling Recommendations

• Keep poll cycles ≥ 100 ms per connection to leave CPU scan time for the user program.
• Batch reads into multi-register requests (FC 3 / FC 16) instead of single-register polling to cut TCP overhead.
• For more than 4 simultaneous Modbus/TCP partners, choose CP 343-1 (8 connections) or CP 343-1 Advanced (up to 32 connections).
• Place Modbus/TCP on a dedicated VLAN when shared with PROFINET to keep both deterministic.
• Use BUSY for hand-shake: do not retrigger START until BUSY = FALSE; retriggering during a pending transaction returns STATUS 0x80A3.

Related Siemens Documentation

• Siemens Entry 22660304 — Modbus/TCP configuration for SIMATIC S7-300/S7-400
• TIA Portal documentation — MODBUSCP for S7-300/S7-400
• S7-300 module spectrum manual (Entry 8859629)

FAQ