Configuring Modbus TCP/IP on Siemens S7-300 CPU 317-2 PN/DP

Overview

The Siemens SIMATIC S7-300 CPU 317-2 PN/DP (order number 6ES7317-2EK14-0AB0, firmware V3.x) ships with two integrated PROFINET interfaces on the first PROFINET port (X1) and PROFIBUS DP master/slave on X2. The integrated PROFINET port supports standard TCP/IP transport, which allows the controller to communicate with Modbus TCP devices. The catch: the S7-300 system libraries do not include a native Modbus application layer. The protocol must be implemented through one of three engineering paths: a Siemens-supplied Modbus TCP library, an external protocol gateway (Anybus, Prosoft, MOXA, HMS/IXXAT), or a custom implementation using the standard TCON, TDISCON, TSEND, TRCV open communication blocks.

This reference consolidates the configuration of the integrated PN interface, the selection of the integration method, the programming patterns for the Modbus application layer (Function Codes 0x03, 0x04, 0x06, 0x10), and the verification steps to bring the ICONICS SCADA endpoint online.

CPU 317-2 PN/DP Hardware and Interface Specifications

For the detailed module data sheet see the SIMATIC S7-300 CPU 317-2 PN/DP datasheet (PDF).

Protocol Architecture

Modbus TCP, as defined by the Modbus Organization (MODBUS Messaging on TCP/IP Implementation Guide V1.0b), is an application-layer protocol riding on TCP port 502. Each ADU consists of:

• MBAP Header (7 bytes): Transaction Identifier (2), Protocol Identifier = 0x0000 (2), Length (2), Unit Identifier (1).
• PDU: Function Code (1 byte) + Data (N bytes).

The S7-300 CPU PN port only provides the TCP transport. The MBAP wrapper must be assembled and parsed in the user program unless a library or gateway does it for you.

Integration Method Comparison

Method 1: Siemens Modbus TCP PN CPU Library (S7 Open Modbus TCP)

The official Siemens approach for SIMATIC S7-300/400 with integrated PROFINET interface is the MODBUS/TCP Communication over the integrated PROFINET Interface library. It uses the Open IE communication blocks internally and provides ready-made FBs (MB_RED_CLIENT, MB_RED_SERVER for redundancy) and a wizard for STEP 7 / TIA Portal.

1. Download the library from the Siemens support site. Search entry ID 75330636 - MODBUS/TCP Communication over integrated PROFINET Interface (PDF).
2. Open STEP 7 V5.5 (or TIA Portal V13+). Add the library from Options > Open global library.
3. Insert the wizard block from the library. Configure the IP address, port (502), connection ID, and Modbus role (server when ICONICS is the client; client when reading a Modbus slave device).
4. The wizard generates DBs and FBs that handle MBAP parsing and the most common Function Codes.
5. Call the generated FB in OB1 with the appropriate instance DB.

Method 2: External Gateway

For projects that already have a heterogeneous network or that need to add Modbus TCP to a PROFIBUS/PROFINET segment without programming the PLC, use a stand-alone gateway. The gateway sits between the S7-300 PN port and the Modbus TCP device(s), or in front of the SCADA if the SCADA is the Modbus client.

Recommended gateways

• HMS Anybus X-gateway (PROFINET slave to Modbus TCP master/server). Two Ethernet ports, integrated switch. Catalog: Anybus X-gateway page.
• Prosoft PLX31-EIP-MBTCP (Modbus TCP/IP to Siemens Industrial Ethernet). Acts as both Modbus client and server. Reference: Prosoft Technology.
• MOXA MGate MB3170 / MB3270 (Modbus TCP gateway). Field-proven with S7-300 in many SCADA integrations, including the verified case study at SiePortal: Modbus TCP communication between CPU 317-2 PN and MOXA gateway.

Wiring topology

Gateway configuration outline

1. Assign the gateway a fixed IP in the same subnet as the CPU (default 192.168.0.20, mask 255.255.255.0).
2. Define the Modbus TCP role: gateway as server, ICONICS as client. Map each Modbus register to a PROFINET slot/word the S7-300 exchanges cyclically.
3. On the S7-300, in TIA Portal, install the GSD file of the gateway (PROFINET device). Drag the gateway into the PROFINET topology under the CPU's PN interface.
4. Insert the input/output modules to match the data width (e.g. 8 words in / 8 words out for a small data set).
5. Compile and download. The ICONICS SCADA polls the gateway on port 502 and reads the data the S7-300 has deposited in the gateway input area.

Method 3: Custom Implementation with TCON/TSEND/TRCV

When licensing is a constraint, the S7-300 PN port can be used directly with the Open IE blocks. The FBs are part of the standard SIMATIC_NET_CP library (STEP 7 V5.5) or of the IEC standard blocks in TIA Portal.

Required blocks (STEP 7 V5.5)

Connection DB (UDT65 "TCON_PARAM")

DATA_BLOCK "dbConnModbus"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
NON_RETAIN
  STRUCT
    ConnType   : BYTE  := B#16#11;        // 0x11 = TCP native (0x0B for ISO-on-TCP)
    ActiveEst  : BOOL  := TRUE;            // CPU is Modbus server (passive open)
    RemPort    : WORD  := W#16#01F6;       // Remote port 502 decimal
    LocPort    : WORD  := W#16#01F6;       // Local port 502
    RemIp[1..4]: BYTE  := 192,168,0,50;    // ICONICS SCADA IP
    LocIp[1..4]: BYTE  := 192,168,0,10;    // CPU PN IP
    ID         : WORD  := W#16#0001;       // Connection ID
END_STRUCT;
END_DATA_BLOCK

Sequence in OB1

1. Call TCON once on startup with the connection DB above. Wait for DONE.
2. On TRCV completion, the receive buffer contains the MBAP header + PDU. Parse the Transaction ID, Protocol ID, Length, and Unit ID.
3. Decode the Function Code. Implement at minimum FC 0x03 (Read Holding Registers), 0x06 (Write Single Register), and 0x10 (Write Multiple Registers) for SCADA integration.
4. Build the response: copy the request MBAP header, set the function code, append the requested register data from a configured DB (e.g. DB100 "ModbusMap").
5. Call TSEND to return the response. TRCV must be re-armed with EN_R = TRUE to wait for the next request.

Example FB call (SCL)

// In OB1
// Passive open (CPU is server, SCADA is client)
IF "startup" THEN
    "dbConnModbus".ID := 1;
    "dbConnModbus".ActiveEst := FALSE; // passive open
    "instTCON"(REQ := TRUE, ID := 1, CONNECT := "dbConnModbus", DONE => .., ERROR => .., STATUS => ..);
END_IF;

// Receive loop
"instTRCV"(EN_R := TRUE, ID := 1, LEN := 0, DATA := "rcvBuf", NDR => .., ERROR => .., STATUS => .., RCVD_LEN => ..);

// Process MBAP and PDU in custom FB "FB_ModbusServer"
// Send response
"instTSEND"(REQ := "sendReq", ID := 1, LEN := "respLen", DATA := "sndBuf", DONE => .., ERROR => .., STATUS => ..);

Hardware and IP Configuration

1. Open the CPU 317-2 PN/DP in the project (HW Config in STEP 7, or Device View in TIA Portal).
2. Double-click the PROFINET interface X1. In Properties > General > Ethernet addresses, enter:
   • IP address: 192.168.0.10
   • Subnet mask: 255.255.255.0
   • Router (if any): 192.168.0.1
3. Assign a subnet (e.g. PN/IO_1). Make sure the router checkbox is unchecked if no external router is required.
4. Open Properties > General > PROFINET interface > Port 1 / Port 2 and verify "End of detection of accessible nodes" is disabled, monitor mode is off.
5. Compile and download HW Config.

Connection Limits on the S7-300

The CPU 317-2 PN/DP supports a maximum of 16 Open IE communication connections, shared with PG/OP/HMI. Plan accordingly:

If the ICONICS SCADA opens a single TCP connection that is kept open and reused, this uses only one of the 16 slots. If the SCADA is configured to open one socket per request, you will exhaust the budget quickly.

ICONICS SCADA Configuration

1. Install the ICONICS Modbus TCP/IP driver (typically bundled with Genesis64 or GraphWorX64).
2. Create a new channel. Set Device ID = IP of the gateway or CPU (192.168.0.20 for MOXA, 192.168.0.10 for direct CPU connection).
3. Set Port = 502. Set Connection Type = TCP/IP.
4. Set Modbus Function Code = 3 (Read Holding Registers) for measurement data, 4 (Read Input Registers) if the slave differentiates them.
5. Map each ICONICS tag to a Modbus register address. The address range starts at 40001 for FC03, 30001 for FC04, 00001 for FC01/FC02 (coils).
6. Configure scan rate (typical 1 s for process values, 100 ms for fast control loops).

For details on the Modbus addressing scheme, see the Modbus Application Protocol V1.1b3 (PDF).

Verification and Diagnostics

1. PG/PC ping test: From the STEP 7 PC, ping 192.168.0.10 and 192.168.0.20 (gateway) or the SCADA host. The CPU replies via the integrated PN port only when the project has been downloaded with an IP address.
2. Connection status in TIA Portal: Online > Diagnostics > PROFINET interface shows the open TCP connections. The Modbus socket (ID 1) should show state = established.
3. Block status of TCON/TSEND/TRCV: STATUS = 0x0000 = OK. Common non-zero values:
   • 0x8081 – Connection ID already in use.
   • 0x8085 – Connection not yet established, TCON not called or DONE missing.
   • 0x80A1 – Connection terminated by remote (SCADA closed the socket).
4. SCADA driver trace: In ICONICS, enable the Modbus driver trace. A successful read returns FC03 response with length = 2*N + 3 (Unit ID + FC + byte count + 2*N data bytes).
5. Wireshark capture: Place a SPAN port on the switch. Filter on tcp.port == 502. Verify MBAP header bytes: TxID (any), Protocol ID = 0x0000, Length field, Unit ID = 0xFF or 0x01.

Troubleshooting Matrix

Performance and Timing Notes

Typical Modbus TCP transaction round-trips on a 100 Mbit/s PROFINET segment with a CPU 317-2 PN/DP running FC03 read of 10 registers:

• OB1 cycle (CPU 317-2 PN/DP @ 100 ms): typical 5 to 20 ms for the request handling.
• Ethernet RTT (1 switch hop): < 1 ms.
• SCADA scan at 250 ms yields plenty of headroom.

For high-speed polling (sub-50 ms), consider the gateway approach so the SCADA never competes with the PLC OB1 cycle for the same connection resources.

Choosing the Right Method

• Direct CPU with Siemens library – Cleanest, single component, but paid license. Best for new projects where the S7-300 is the only PLC.
• External gateway (MOXA, Anybus, Prosoft) – Best when multiple Modbus slaves exist, when the SCADA already has a proven Modbus driver, or when the PLC user program must remain untouched. Field-proven pattern for the CPU 317-2 PN/DP per the SiePortal case study.
• Custom TCON-based server – Only when licensing is impossible and you have the engineering capacity to maintain the MBAP parser and FC handlers. Audit your code against MODBUS Application Protocol V1.1b3.

FAQ