Configuring S7-400 Modbus/TCP Communication in STEP 7 V5.5

Overview

Modbus/TCP is the de facto standard for industrial Ethernet communication between a SIMATIC S7-400 controller and third-party PLCs, drives, SCADA nodes, and instrumentation. The protocol rides on TCP port 502, the standard Modbus/TCP port defined in the Modbus Organization's specification Modbus Application Protocol V1.1b3. The classic Modbus RTU frame is encapsulated in a 7-byte MBAP (Modbus Application) header plus a PDU (Protocol Data Unit) payload that carries the function code, starting address, quantity, and data bytes.

The S7-400 family supports Modbus/TCP through two distinct paths. The first path is the native "Modbus/TCP PN" capability that ships with PN-CPUs of the S7-300/400 generation when the firmware supports the stack and a license is present on the SIMATIC Memory Card. The second path is the SIMATIC Modbus/TCP Wizard / library bundle (catalog numbers 6AV6676-6MB10-0AX0 for H-redundancy and 6AV6676-6MB20-3AX0 for single stations) for S7-300/400 stations that need Modbus/TCP but do not have the integrated PN-CPU Modbus option, or that need redundant communication. The application note How do you configure a Modbus/TCP communication for a SIMATIC S7-300/S7-400 and where can you find further information? is the canonical Siemens reference for this configuration.

Prerequisites

Modbus/TCP Frame Layout

Every Modbus/TCP frame carries the 7-byte MBAP header in front of the function code and the Modbus data. The MBAP fields are transmitted in big-endian byte order on the wire.

Path 1 - Native Modbus/TCP PN on the CPU

When to Choose Native PN

If you have an S7-400 PN CPU (such as the CPU 414-5 H PN/DP) and a single S7-400 station that is not part of a redundant H-system, the native Modbus/TCP PN capability is the lowest-cost and lowest-overhead path. The CPU's PROFINET interface processes Modbus/TCP frames directly, so no additional CP module is required. Connections are configured inside STEP 7 V5.5 under the PROFINET interface properties, and the user program reads/writes Modbus registers as if they were a mirrored S7 data block area.

Firmware and License Requirements

Modbus/TCP server capability on an S7-300/400 PN CPU requires both the firmware on the PROFINET interface that supports the protocol stack (typically introduced on CPU 31x PN/DP and CPU 41x PN from firmware V6.0) and a separate license key for the "Modbus/TCP PN" feature. The license is bound to the CPU's serial number and is stored on the SIMATIC Memory Card. Without a valid license the CPU's PN interface will still accept the TCP/502 open, but the data exchange will be denied at runtime and the diagnostic buffer will record a license error. The licensing and configuration procedure is detailed in the Siemens TIA Portal documentation for the same feature, which is also valid as a reference for the STEP 7 V5.5 path: Modbus/TCP PN - Commissioning (S7-300, S7-400).

STEP 7 V5.5 Configuration Steps

1. Open the SIMATIC Manager project containing your S7-400 station.
2. Open the hardware configuration (HW Config) for the S7-400 station.
3. Select the PROFINET interface of the CPU (X1 or X2 on the CPU 414-5 H PN/DP).
4. Open the Properties dialog of the PROFINET interface and assign the IP address, subnet mask, and router address. The PROFINET interface must be on the same subnet as the third-party device or have a router that is reachable.
5. Under the Modbus tab of the interface properties, click New to add a Modbus/TCP connection.
6. Configure the partner (third-party device) IP address, leave the partner port at 502, and set the S7-400 role (Modbus/TCP server or client) and the connection ID.
7. Map the Modbus register areas to S7 data blocks: holding registers (4xxxx) and input registers (3xxxx) to DB words, coils (0xxxx) and discrete inputs (1xxxx) to DB bits.
8. Save and compile the hardware configuration. Download the HW Config to the CPU.
9. Transfer the Modbus/TCP PN license to the SIMATIC Memory Card using the Automation License Manager.
10. Insert the Memory Card into the CPU and perform a power-on to activate the license.

Program-Side Interface

The Modbus/TCP PN CPU implementation exposes the Modbus register areas as S7 data blocks. The user program reads and writes the configured DBs to exchange data with the third-party device. For program-side access from a higher-level HMI or another CPU, standard S7 PUT/GET (FB 14 / FB 15) can be used because the area is just a DB on the local CPU. The MBAP parsing, transaction ID tracking, and exception code generation are all handled inside the PN interface firmware, so the user program does not need to deal with the TCP layer at all.

Path 2 - Modbus/TCP Wizard / Library Bundle

Product Numbers and Scope

For S7-400 stations that do not have the native Modbus/TCP PN option, or that require Modbus/TCP on a non-PN CPU using a separate Industrial Ethernet CP, Siemens supplies the SIMATIC Modbus/TCP Wizard bundled with the FBs/FCs that implement the Modbus/TCP client and server roles in software.

The bundle ships with the Modbus/TCP Wizard configuration tool, the FBs/FCs (FB 100 series for the wizard blocks), and full PDF manuals. The manuals are also installed automatically when the demo or full version is installed on the engineering station.

Wizard-Supported Blocks

The wizard generates call-ready instance DBs and inserts the FBs/FCs that handle the Modbus/TCP connection, request/response framing, and data exchange. The user program simply calls the generated blocks with the configured data areas. Typical blocks include:

• FB 100 - Modbus/TCP master (client) - read holding registers (FC 3)
• FB 101 - Modbus/TCP master (client) - read input registers (FC 4)
• FB 102 - Modbus/TCP master (client) - write multiple registers (FC 16)
• FB 105 - Modbus/TCP slave (server) - register area server
• FB 106 - Modbus/TCP slave (server) - coil/bit area server
• UDTs for the connection and request data structures

The Modbus/TCP wizard inserts the generated code into your STEP 7 project, links the required library, and reserves the configured data block areas for Modbus register exchange.

Installation

1. Insert the Modbus/TCP Wizard installation media (or run the downloaded setup from the Siemens support page linked to the catalog number).
2. Follow the installer. The wizard integrates into the SIMATIC Manager menu tree and adds the FBs/FCs as a STEP 7 library.
3. Restart SIMATIC Manager so the wizard menu items appear.
4. License the wizard using the Automation License Manager.

Wizard Configuration Steps

1. In SIMATIC Manager, open the S7 project that contains the S7-400 station.
2. Launch the Modbus/TCP Wizard from the menu (Options > Modbus/TCP Wizard, or the location installed by the bundle).
3. Select the S7 station and the CPU/CP that will handle Modbus/TCP.
4. Define the connection: partner IP address, partner port (default 502), S7-400 role (master/slave), and connection ID.
5. Configure the data exchange: define which Modbus register ranges (4xxxx holding, 0xxxx coils, 3xxxx input, 1xxxx discrete) are mapped to which S7 data blocks.
6. Generate the program blocks. The wizard writes the FB calls, instance DBs, and DBs that hold the register data into the S7 program.
7. Save and download the hardware and software to the CPU.

OB1 Call Structure

The wizard inserts the block calls into OB1 in a fixed pattern. A typical generated OB1 segment for a master read of holding registers looks like the following skeleton (the actual instance DB names are wizard-generated):

// Generated by Modbus/TCP Wizard - DO NOT EDIT MANUALLY
CALL  FB 100, DB_Modbus_Master_Read       // Modbus/TCP master - read holding registers
  REQ    := M 0.0                          // Trigger on rising edge
  CONT   := DB_Modbus_Connection           // Connection UDT (IP, port, ID)
  UNIT_ID:= 1                              // Modbus unit ID
  MB_ADDR:= 40001                          // Starting address (4xxxx range)
  QTY    := 100                            // Number of registers to read
  RD     := P#DB_Holding.WordArea          // Pointer to target DB area
  DONE   := M 10.0                         // Job complete (one-shot)
  BUSY   := M 10.1                         // Job in progress
  ERROR  := M 10.2                         // Job error
  STATUS := MW 12                          // Modbus status / exception code
  LEN    := MW 14                          // Bytes actually read

The connection UDT holds the partner IP as four bytes, the partner port (502), the connection ID, and the local TSAP / connection resource. The wizard's documentation lists the full UDT layout for the installed version.

Path 3 - Modbus/TCP via a Separate CP

For older S7-400 CPUs without an integrated PROFINET interface, or for stations that need to keep the PN interface dedicated to PROFINET I/O, an Industrial Ethernet CP (for example, CP 443-1) can carry the Modbus/TCP traffic. The CP is configured with a TCP connection in HW Config, and the wizard blocks run on the CPU. This configuration is identical in principle to Path 2, but the Modbus/TCP frames enter and leave the controller through the CP rather than the integrated PN port of the CPU. The CP must be configured to support a TCP connection on port 502 and must have free connection resources for the Modbus/TCP channel.

Port 502 - What to Know

Modbus/TCP uses TCP port 502 as defined in the Modbus Organization's specification. The port must be open in any firewall, router ACL, or NAT between the S7 station and the third-party device. The native Modbus/TCP PN capability of the S7-300/400 PN CPUs listens on this port; for the wizard bundle the connection is configured with port 502 on both sides. The S7-400 CPU supports multiple concurrent Modbus/TCP connections; the maximum number depends on the CPU type and the connection resources of the PN interface or CP. For the CPU 414-5 H PN/DP, the S7-400 manual specifies a maximum of 64 S7 connections in total, of which a subset may be Modbus/TCP connections - consult the CPU's technical data sheet for the exact figure for your specific CPU order number.

Supported Modbus Function Codes

For high-throughput links, prefer FC 3 (read) and FC 16 (write) because they carry multiple registers in one transaction and avoid the per-request Modbus overhead. The third-party master's timeout must be set longer than the worst-case S7 scan time of the FB that handles the request; otherwise the master will see timeouts during long cycles.

Data Type Mapping

Modbus/TCP registers are 16-bit unsigned words. The S7-400 stores them as WORD, INT, or UINT inside a DB. Two Modbus registers (= four bytes) form one 32-bit REAL or DWORD. The S7 side is responsible for the byte order; the Modbus standard specifies big-endian for the 16-bit register, so on the S7 side a 32-bit value that crosses a register boundary must be byte-swapped if the rest of the program expects little-endian (the default for S7 REAL). The wizard can be configured to apply the swap automatically; verify by writing a known value (e.g., 0x40490FDB = 3.14159 as REAL) and reading it back from the third-party client.

Connection Diagnostics

Once the program is downloaded and the connection is established, the wizard blocks and the native PN option both expose status and error information in their instance DBs. Use STEP 7 V5.5's Monitor/Modify or a watch table to inspect the status word, error code, and connection state. The Modbus/TCP wizard documentation lists the full set of return values; typical values include:

The status of the underlying S7 connection is visible in the standard S7 connection diagnostics (CPU > Connection Information in SIMATIC Manager). For a quick read of the diagnostic buffer, open the online view of the CPU in SIMATIC Manager and select CPU > Diagnostic Buffer.

Verification

1. In the CPU's online diagnostic buffer, confirm no connection establishment errors. Look for entries such as "Modbus connection established" or "Connection aborted by partner."
2. In the watch table, force a known value into a Modbus holding register DB on the S7 side and confirm the third-party client reads the same value. Likewise, write a value from the third-party client and confirm the S7 DB updates.
3. Use Wireshark on a mirror port to capture the TCP stream on port 502 and confirm the MBAP header (transaction ID, protocol ID 0, length, unit ID) and the function code match the configured Modbus request.
4. For redundant H-systems running the 6AV6676-6MB10-0AX0 bundle, perform a link-switch test and confirm the standby CPU takes over the Modbus/TCP connection without an external timeout.
5. Stress test by reading 100+ registers in a single transaction (FC 3) and confirm the response time stays within the partner's timeout.

Troubleshooting Matrix

Cycle Time and Performance

Each Modbus/TCP transaction costs roughly one OB1 cycle of the FB plus the TCP round-trip. For a CPU 414-5 H PN/DP with a 50 ms OB1 cycle, a single FC 3 read of 100 registers from a partner on the same subnet typically completes in well under 100 ms. Bulk transfers of 1000+ registers in one FC 3 read are supported by both the native PN option and the wizard, but the OB1 cycle time grows with the number of registers processed per call. If the application requires a high polling rate, raise the priority of the OB that calls the wizard FB to OB 30 - OB 38 and limit the number of registers per call to 125 (the Modbus spec maximum for FC 3).

Security and Network Considerations

Modbus/TCP has no authentication, no encryption, and no integrity check. The MBAP header has a 16-bit transaction identifier and a 16-bit length field, and the function code is in the clear. Place the S7 station and the third-party device on a private, layer-2 segmented network, ideally a VLAN with no path to the corporate network. If the network must traverse an untrusted segment, terminate it with a stateful firewall that allows only port 502 between the specific Modbus endpoints. Consider wrapping Modbus/TCP in a VPN tunnel for cross-site links. For S7-400 stations that need to expose Modbus/TCP to a higher-trust network, use the CP 443-1's security features (firewall, IP ACL) to restrict access to the CPU's IP and to the port 502 listener.

Firmware and CPU Compatibility

For older firmware revisions or for non-PN CPUs (e.g., CPU 412-1, CPU 414-2 DP, CPU 416-2), the wizard bundle (6AV6676-6MB20-3AX0) running on a CP 443-1 is the supported path.

Migration to TIA Portal

The Modbus/TCP PN option is also exposed in TIA Portal V16 and higher for S7-300/400 projects that have been migrated. The legacy wizard bundle (6AV6676-6MB10-0AX0 / 6AV6676-6MB20-3AX0) is still the supported path for older STEP 7 V5.5 SP4 projects. If the project will be moved to TIA Portal, plan to relicense the Modbus/TCP PN option for the TIA Portal project because the legacy license is bound to the STEP 7 V5.5 project environment. The commissioning procedure for the TIA Portal path is described in the Siemens documentation at Modbus/TCP PN - Commissioning (S7-300, S7-400) and follows the same pattern as the STEP 7 V5.5 setup.

Summary

For a single S7-400 station with a PN CPU running SIMATIC Manager V5.5 SP4, use the native Modbus/TCP PN capability on the CPU's PROFINET interface, license it on the SIMATIC Memory Card, and expose the holding/input/coil/discrete input areas as S7 data blocks. For redundant H-systems, license the 6AV6676-6MB10-0AX0 bundle and use the wizard to configure the redundant connection. For non-PN CPUs or for stations that need Modbus/TCP on a separate CP, license 6AV6676-6MB20-3AX0 and configure the connection through the Modbus/TCP Wizard. In all cases, the protocol runs on TCP port 502, status is monitored through the wizard's instance DBs and the S7 connection diagnostics, and the application is verified end-to-end with a known-value round-trip test and a Wireshark capture on the LAN segment.