Overview
Connecting ten S7-400 control systems to Modbus TCP/IP networks via the integrated Ethernet interface of the CP 443-1 communications processor is a recurring PCS 7 / STEP 7 requirement. The question of how many software licenses are required, and what to do when the field devices only speak Modbus RTU, must be resolved before hardware is ordered. This reference consolidates licensing rules, hardware catalog numbers, configuration sequences, and verified fallback paths (CP 341/441 plus external TCP/RTU converters) so that an engineer can commission the architecture in a single engineering pass.
The Modbus TCP protocol is supported on S7-400 through the Modbus/TCP PN Coupler software (order number 2XV9450-1MB00) running on the CP 443-1. Function blocks (FB) for client/server roles are loaded into the S7-400 CPU and exchange process data with the CP over the backplane using the SEND/RECEIVE or Open Communication services (T_conn, T_SEND, T_RCV, UD_CONNECT, UD_SEND, UD_RCV). The CP handles the TCP socket state machine and the Modbus PDU/ADU mapping transparently, which keeps the CPU program free of socket plumbing.
Prerequisites
Before commissioning, verify the following hardware and software stack:
- 10× S7-400 CPU (e.g., 6ES7416-3ES06-0AB0 CPU 416-3 PN/DP) with STEP 7 V5.5 SP4 or higher, or TIA Portal V15.1+ if migrating to V17/V18.
- 10× CP 443-1 communications processor. The Advanced variant
6GK7443-1EX30-0XE0supports Open Communication (TCP/UDP) required by Modbus TCP. Earlier firmware revisions (e.g., V2.x) require Open IE communication blocks; verify that firmware V3.0 or higher is installed. - STEP 7 project with the SIMATIC Modbus/TCP PN Coupler library (shipped with 2XV9450-1MB00) integrated into the S7 program.
- Ethernet infrastructure: managed switches supporting IGMP snooping if multicast, but Modbus TCP uses unicast on TCP port 502 (default).
- IP plan: each CP 443-1 needs a unique IPv4 address in the same subnet as the Modbus TCP master/scanner. Reserve at least one IP for the engineering station.
- License media (per 2XV9450-1MB00) on the engineering station — the license is bound to the PC or the CPU, depending on the order variant.
Licensing Analysis: 2XV9450-1MB00
The order number 2XV9450-1MB00 identifies the SIMATIC Modbus/TCP PN Coupler software package, which is delivered on CD and includes:
- Modbus/TCP master and slave function blocks (FB 100–FB 115 family, exact numbers depend on package version).
- Example projects for STEP 7 V5.x.
- A license key that must be installed on the engineering station (or transferred to a CPU-bound license).
The license is required for each CPU in which the Modbus/TCP PN Coupler blocks are instantiated. The community confirmation from senior contributors is unambiguous: "1 license is valid for 1 CPU. If you use the modbus block in 10 CPUs, then you need 10 licenses." The license is bound to the CPU's serial number once the blocks are downloaded; a single engineering station can technically load all ten CPUs, but each target CPU must carry its own valid license.
| Scenario | Licenses Required | Justification |
|---|---|---|
| 1× S7-400 with 1× Modbus TCP connection | 1 × 2XV9450-1MB00 | One CPU uses the Modbus blocks; one license is consumed. |
| 10× S7-400 each with one Modbus TCP connection | 10 × 2XV9450-1MB00 | Each CPU is a separate runtime; license tracking is per-CPU. |
| 1× S7-400 with 2× CPs running Modbus TCP | 2 × 2XV9450-1MB00 | Two independent runtime instances of the Modbus blocks. |
| Single engineering station programming 10 CPUs | 10 × 2XV9450-1MB00 | Engineering license is a red herring; runtime license is per CPU. |
2XV9450-1MB00 directly through your Siemens distributor. Each shipment includes a unique License Key USB stick or download certificate. Do not attempt to clone a single license across multiple CPUs — Siemens Automation License Manager (ALM) will report a license violation during download, and the affected CPU will refuse to go to RUN.CP 443-1 Hardware Configuration for Modbus TCP
Open the S7 station in STEP 7 HW Config and place the CP 443-1 in the rack. The configuration steps are identical across all ten stations once you have a template project:
-
Set the CP slot. In SIMATIC 400 stations, slot 4 is reserved for the CP. Place the order number
6GK7443-1EX30-0XE0(or the variant in your BOM) at slot 4. - Assign an IP address and subnet mask on the CP's Properties → Ethernet interface. Disable router if the network is single-subnet.
-
Enable Open Communication: Open Properties → CP 443-1 → Options and tick "Use Open Communication Services". Without this flag, the TCON/TDISCON system status list (SSL) functions report
0x0000(idle) and the Modbus blocks will not establish a socket. - Configure the connection DB. In the user program, the Modbus master block (e.g., FB 100 "ModbusTCP_Master") requires a connection description DB. The DB contains the partner IP, partner port (502), local port, and connection type (TCP, active/passive). One DB is required per Modbus endpoint.
- Insert the Modbus/TCP PN Coupler blocks from the library into the user program (OB 1 or a cyclic OB 35). Pass the connection DB, request/response data, and timeout values.
- Compile and download the hardware configuration and the user program. Repeat for each of the ten stations, substituting the unique IP address.
Recommended S7-400 CPU and CP Pairing
| CPU | Order Number | CP 443-1 | Firmware |
|---|---|---|---|
| CPU 412-2 PN | 6ES7412-2EK07-0AB0 | 6GK7443-1EX30-0XE0 | V3.0+ |
| CPU 414-3 PN/DP | 6ES7414-3EM07-0AB0 | 6GK7443-1EX30-0XE0 | V3.0+ |
| CPU 416-3 PN/DP | 6ES7416-3ES07-0AB0 | 6GK7443-1EX30-0XE0 | V3.0+ |
| CPU 417-4 | 6ES7417-4HT07-0AB0 | 6GK7443-1GX30-0XE0 (Adv. gigabit) | V3.0+ |
Modbus/TCP PN Coupler Block Architecture
The library exposes two primary role blocks plus helper FBs:
| Block | Role | Typical Use |
|---|---|---|
| FB 100 "ModbusTCP_Master" | Client (issues Modbus requests) | S7-400 reads from RTU/TCP slaves (e.g., drives, meters) |
| FB 101 "ModbusTCP_Slave" | Server (responds to Modbus requests) | S7-400 exposes process data to a SCADA master |
| FB 102 "ModbusTCP_Connect" | Connection setup | Called once on startup to open the TCP socket |
| FB 103 "ModbusTCP_Disconnect" | Connection teardown | Called on shutdown or fatal error |
| DB "ModbusTCP_Instance" | Instance data | Holds status, request, response, and timing data |
Wiring in OB 1 (Master Example)
// Cyclic call in OB 1 (master role)
CALL FB 100, DB 100 // FB 100 = ModbusTCP_Master
iReq := TRUE // request trigger (rising edge)
iUnitID := 1 // Modbus unit/slave address (0 or 1 for TCP)
iFuncCode := 3 // 3=Read Holding Registers, 4=Read Input Reg, 6=Write Single
iStartAddr := 40001 // Modbus 0-based register start
iQuantity := 10 // number of registers
iConnDB := "Modbus_ConnDB" // connection description DB
qDone := "DB_Tag".Done // BOOL: request complete
qError := "DB_Tag".Error // BOOL: error flag
wStatus := "DB_Tag".Stat // WORD: error code (0 = OK)
iDataPtr := "Modbus_Buff" // pointer to data area (e.g., P#DB200.DBX0.0 BYTE 20)
Common Status Codes from FB 100
| Status (hex) | Meaning | Remedy |
|---|---|---|
| 0x0000 | No error, idle | None — normal polling state |
| 0x0001 | Request in progress | Wait for qDone |
| 0x8001 | Connection not established | Verify TCON completed; check CP and partner IP |
| 0x8002 | TCP send failed | Inspect CP diagnostic buffer; check network |
| 0x8003 | TCP receive timeout | Increase iTimeout, verify slave responds to port 502 |
| 0x8004 | Modbus exception from slave | Check wException byte — codes 1=Illegal Function, 2=Illegal Data Address, etc. |
| 0x8005 | Invalid connection DB | Recompile DB and re-download |
Alternative Path: Modbus RTU via CP 341 or CP 441
If the downstream devices are strictly Modbus RTU (RS-232 or RS-485), the CP 443-1 cannot drive a serial line. Two fallback paths exist:
Option A — Direct Serial Modbus with CP 341 / CP 441
Place a CP 341 (6ES7341-1AH02-0AE0, RS-232/422/485) in the ET 200M station or in the central rack. Each CP requires a separate Modbus RTU driver license:
| Driver | Order Number | Role |
|---|---|---|
| Modbus Master RTU | 6ES7870-1AB01-0YA0 | S7-400 polls RTU slaves |
| Modbus Slave RTU | 6ES7870-1AC01-0YA0 | S7-400 responds to RTU master |
| Modbus Master ASCII | 6ES7870-1AD01-0YA0 | For Modbus ASCII variant |
The driver is loaded into the CP's firmware slot; the CPU uses the standard Siemens "PtP" FBs (FB 7 / FB 8 on CP 341) or the Modbus-specific block (FB 80 "MODB_341") provided in the driver package. The driver is licensed per CP, not per CPU. For ten S7-400 stations each with one CP 341, the order quantity is ten driver licenses.
Option B — External Protocol Converter (TCP ↔ RTU)
When a CP 341 is unavailable or the architecture mandates TCP transport, an external converter bridges Modbus TCP (CP 443-1) to Modbus RTU (RS-485 slaves). Field-proven options include:
| Vendor | Model | Interface | Notes |
|---|---|---|---|
| Lantronix | Xpress-DR-IAP | RS-232/RS-485 ↔ TCP | Loads Modbus firmware free from Lantronix; web config |
| Moxa | MGate MB3170/MB3270 | RS-232/422/485 ↔ TCP | 2-port master/slave; 16 TCP slaves supported |
| Anybus | ABC4000 | Modbus TCP ↔ RTU | Compact, industrial temp range |
| B+B SmartWorx | VESP211 | RS-485 ↔ TCP | Serial console server, scriptable |
Step-by-Step Commissioning Procedure
- Order verification. Confirm ten × 2XV9450-1MB00, ten × CP 443-1 (or shared across stations), and matching license USB sticks.
- Install License Keys on the engineering station via SIMATIC Automation License Manager. Move the license to the target CPU using the "License Transfer to Target Device" function once the CPU is online.
- Build a template STEP 7 project with one S7-400 station, CP 443-1, and the Modbus/TCP PN Coupler library. Configure one connection DB pointing to the first Modbus endpoint.
- Compile, download, and test the first station end-to-end with a Modbus TCP slave simulator (e.g., Modbus Poll, libmodbus). Verify read holding registers (FC 03) and write single register (FC 06) round-trip.
- Clone the project to a master template, then re-master the IP address and connection DB per station. Use STEP 7's "Save As" with suffix to keep revision history clean.
- Download each station and transfer the unique license key to its CPU. Verify in ALM that all ten licenses are deployed.
- Network commissioning. Ping each CP 443-1 from the engineering station. From a PC tool, open a TCP socket to port 502 and confirm the CP responds with a Modbus exception (0x0A) when the unit ID is invalid — this proves the listener is active.
Verification Checklist
| Test | Pass Criterion |
|---|---|
| License status in ALM | All 10 CPUs show "licensed" for Modbus/TCP PN Coupler |
| CP 443-1 diagnostic buffer | No entries with Event ID 0x8001 / 0x8A00 series |
| TCON status (SSL 0x0135) | Connection state = established for each Modbus endpoint |
| Modbus poll round-trip | FC 03 returns expected registers within timeout window |
| Fault injection | Disconnect slave → FB 100 reports qError=TRUE, status=0x8003 within iTimeout |
| Watchdog | Reconnect logic re-establishes the TCP socket within 2× poll interval after restoration |
| CPU scan time | OB 1 cycle increase < 5 ms with 10 Modbus connections |
Troubleshooting Matrix
| Symptom | Likely Cause | Action |
|---|---|---|
| FB 100 status 0x8001, no qDone | CP 443-1 not configured for Open Communication | HW Config → CP properties → enable Open IE |
| CPU goes to STOP with SF | Missing or invalid Modbus license | ALM: check license is on the CPU; retransfer if needed |
| TCP socket opens, Modbus timeout | Wrong unit ID or swapped byte order | Confirm slave expects unit ID 0xFF for TCP; verify Word/Byte order in buffer |
| Intermittent errors under load | Poll interval too short for CP 443-1 buffer | Increase OB 35 cycle to 200 ms, or add iGap between requests |
| License visible on engineering station, not on CPU | License type = "floating" not transferred | Right-click license → Transfer to Target Device |
| Converter-based RTU: dropped polls | RS-485 termination or bias missing | Add 120 Ω termination at both ends; enable fail-safe bias resistors |
| All ten stations show 0x8002 in cascade | Ethernet switch port security or broadcast storm | Enable portfast, disable storm control on the VLAN |
Best Practices and Field Notes
- Document the licensing map. Keep a spreadsheet pairing CPU serial number, CP 443-1 MAC, and license key. This avoids the painful exercise of relocating a license when a CPU is replaced under warranty.
- Set partner ports explicitly. Don't rely on CP 443-1 to choose a random local ephemeral port — pin it (e.g., 2000–2009) so firewall rules are predictable.
- Use passive connection mode on the CP 443-1 side when the Modbus master is a third-party SCADA that initiates the socket. Active mode is for S7-400 as the master.
- Pre-allocate a 200-byte buffer per connection in the CPU's data block; the Modbus block writes diagnostics into the first 32 bytes, leaving the rest for user data.
- Prefer TCP/IP keep-alive by setting iKeepAlive in the connection DB to 30 s. This detects half-open sockets caused by switch reboots or firewall state expiration.
- Validate with two slaves before roll-out. Many RTU/TCP devices ship with default unit ID = 1, but the standard for Modbus TCP reserves unit ID 0xFF for the listening server. Confirm with the device's profile.
Related Siemens Documentation
For deeper implementation details, consult the official Siemens support portal:
- CP 443-1 product page and downloads (6GK7443-1EX30-0XE0)
- SIMATIC Modbus/TCP PN Coupler — Function Manual
- CP 341 Modbus Master/Slave — Installation and Parameterization
- STEP 7 V5.5 — Open Communication with TCON/TSEND/TRCV
- Modbus Master RTU driver for CP 341/441 (6ES7870-1AB01-0YA0)
- Modbus Organization — Modbus Application Protocol V1.1b3 (reference for FC codes, PDU format, exception codes)
How many 2XV9450-1MB00 licenses are required for ten S7-400 stations using Modbus TCP via CP 443-1?
Ten licenses. The Modbus/TCP PN Coupler runtime license is bound to each CPU that instantiates the Modbus blocks. One license per CPU is mandatory — a single engineering-station license cannot be shared across multiple runtime targets.
Can I use a single Modbus TCP connection from CP 443-1 to multiple Modbus slaves?
Yes. The Modbus/TCP PN Coupler supports multiple Modbus unit IDs on one TCP connection (unit ID 0xFF per the Modbus TCP spec) when the slaves sit behind a Modbus gateway. For independent slaves on the same Ethernet segment, open one connection per slave and one connection DB per FB 100 instance.
What is the difference between using CP 443-1 for Modbus TCP and using a CP 341 with a Modbus RTU protocol converter?
CP 443-1 is a direct Modbus TCP path on Ethernet — no external converter, latency under 50 ms typical. A CP 341 with an external TCP/RTU converter introduces a serial bottleneck (RS-485 9600 bps is the realistic ceiling) and 100–300 ms of converter-induced latency. Choose CP 443-1 + Modbus TCP slaves if speed matters; choose the converter only when the field device is hard-wired to RS-485 with no Ethernet option.
Which CP 443-1 firmware version supports Modbus TCP via the Modbus/TCP PN Coupler?
Firmware V3.0 or higher is required for Open Communication services (TCON, TSEND, TRCV, TDISCON) that the PN Coupler blocks call. CP 443-1 order number 6GK7443-1EX30-0XE0 ships with compatible firmware; older V2.x CPs (6GK7443-1EX20-0XE0) must be firmware-upgraded before the Modbus library will function.
Is the Modbus RTU driver license per CPU or per CP 341/441?
Per CP. The Modbus Master RTU driver (6ES7870-1AB01-0YA0) is loaded into the CP 341/441 firmware slot, not the CPU. For ten S7-400 stations each with one CP 341, ten driver licenses are required. The driver is reusable across all S7-400 CPUs that share the same CP.