Connecting Moxa Modbus TCP Gateways to WinCC V7.0 SCADA

1. System Overview and Architecture

WinCC V7.0 introduced a built-in Modbus TCP/IP channel that allows the SCADA station to poll registers from any Modbus TCP server on the plant LAN without requiring the legacy SIMATIC S7-MODBUS OPC server or external third-party drivers. The typical deployment places one or more Moxa MB3480 serial-to-Modbus-TCP gateways in the field to expose RS-232/422/485 devices (instruments, energy meters, weigh scales, protective relays) to the supervisory network. The Ethernet segments are terminated on industrial managed switches such as the SCALANCE XC/XB/XR family so that traffic can be prioritized with QoS, mirrored for diagnostics, and optionally protected by HRP/MRP ring redundancy.

The WinCC SCADA station, the SCALANCE switch, and every MB3480 must share a routable IP subnet (or be reachable via static routes in the same routing domain). WinCC V7.0 opens one TCP socket per configured logical connection on port 502 of the gateway.

2. Prerequisites and Compatibility

3. Hardware Components

3.1 Moxa MB3480 Modbus TCP Gateway

The Moxa MB3480 is a four-port RS-232/422/485 gateway that bridges Modbus RTU/ASCII slaves to Modbus TCP masters. Each serial port can be set to either Slave mode (master polling from SCADA goes out as RTU/ASCII) or Master mode (MB3480 actively polls serial slaves and caches results). Key configuration parameters exposed through MGate Manager:

• IP address, subnet mask, default gateway
• Modbus TCP port (default 502; can be remapped to e.g. 5502 for NAT traversal)
• Maximum TCP connections (1-32)
• Serial parameters: baud rate (75-921600), parity (None/Even/Odd/Space/Mark), data bits (7/8), stop bits (1/2)
• Operation mode: RTU Master, RTU Slave, ASCII Master, ASCII Slave
• TCP idle timeout, response timeout, inter-character timeout
• Accessible IP list (ACL) for restricting TCP masters

For WinCC SCADA, the recommended operating mode is RTU Master on the serial side (MB3480 polls the field slaves) and Modbus TCP Slave on the Ethernet side (WinCC polls the MB3480 cache). This decouples the polling rate from serial latency and protects slow serial devices from being flooded by the SCADA cycle.

3.2 SCALANCE X Switch Family

SCALANCE X switches (X204, X308, XC-200, XR-100) are Siemens Industrial Ethernet Layer 2 managed switches. They provide:

• Ring redundancy via HRP (High-speed Redundancy Protocol) or MRP (Media Redundancy Protocol per IEC 62439-2)
• VLAN tagging (802.1Q) to segregate SCADA traffic from office traffic
• QoS priority queues for PROFINET real-time class
• Port-based access control (802.1X) and ACLs
• SNMPv3, Web-based management (HTTPS), CLI via Telnet/SSH
• LLDP and DCP (Discovery and Configuration Protocol) for automatic PROFINET device discovery

The X204 is a four-port managed switch without fiber uplinks; for ring topologies pair it with the X204-2 (which adds two fiber ports for ring closure) or use the XC-200 series. Review the SCALANCE X-200 operating instructions for ring configuration.

4. Installing and Licensing the WinCC Modbus TCP Driver

1. Insert the WinCC V7.0 DVD and run Setup.exe. Select WinCC Installation.
2. In the Components dialog, ensure Modbus TCP/IP Channel is checked. It is selected by default from V7.0 onward.
3. Complete the installation and reboot. No separate SIMATIC NET DVD is required.
4. Activate the WinCC License. Open the WinCC Explorer and select Help > About > Licensing. The base Modbus TCP channel is unlocked with the standard RC tag license; no option package needs to be purchased.

5. Configuring the Modbus TCP/IP Channel in WinCC V7.0

The configuration mirrors the procedure documented for current TIA Portal WinCC Unified Modbus TCP/IP channel, adapted to the WinCC V7.0 tag management interface.

1. Open WinCC Explorer.
2. Right-click Tag Management and choose Add New Driver.
3. Select Modbus TCPIP from the list of installed channels and confirm with Open. A new driver instance appears under Tag Management > Modbus TCPIP.
4. Right-click the new channel and select New Connection. Name the connection (e.g. MB3480_SubA).
5. Open the connection properties dialog. The parameters described in Section 6 are mandatory.

6. Defining Connection Parameters and Port Addresses

The complete Port Addresses for Coupling via Ethernet table from the WinCC Information System should be reviewed during planning; see the WinCC V7.0 Communication Manual entry Process Communication > Modbus TCP/IP.

7. Tag Addressing and Data Block Mapping

WinCC Modbus TCP tags are configured with the syntax:

<ConnectionName>::<Area><Offset><DataType>

The offset is 1-based in WinCC V7.0 (matching Modbus convention). Example for reading the voltage of energy meter #1 on station address 1:

// Holding register 40007 contains the line-to-line voltage (float, big-endian)
MB3480_SubA::40007FLOAT

8. Network Integration with SCALANCE X Switches

1. Assign a fixed IP to the SCALANCE switch (e.g. 192.168.10.1) using the Web Based Management on port 80/443 (HTTPS recommended) or via SIMATIC Primary Setup Tool.
2. Configure VLAN 1 for the SCADA / Modbus TCP traffic. Place the WinCC station, the MB3480 units, and the SCALANCE uplink in VLAN 1.
3. If a ring topology is used, enable HRP in the Layer 2 > Ring Redundancy menu and designate one switch as the HRP Manager. All other ring members become HRP Clients. Maximum reconfiguration time with HRP is 300 ms.
4. Enable IGMP Snooping only if the WinCC station uses multicast for tag distribution (not the case for Modbus TCP unicast); otherwise leave it disabled to avoid flooding unknown multicast groups.
5. Set QoS priority queue 6 for Modbus TCP traffic (DSCP 0x30 / 802.1P 6) to ensure deterministic latency under load.
6. Configure Broadcast Limiter at 5% of port bandwidth to protect the SCADA station from broadcast storms caused by misconfigured Modbus devices.
7. Define an ACL on the SCALANCE to permit only the WinCC station IP and the MB3480 IPs on TCP/502, blocking all other traffic to the gateway ports.

9. Connection Limits and Performance Considerations

WinCC V7.0 does not publish a hard-coded maximum number of Modbus TCP connections. The actual ceiling depends on system resources, primarily:

• CPU cores / clock: each connection consumes a separate thread in the WinCC communication layer. Field deployments with 32+ connections typically require a quad-core CPU at >= 2.4 GHz.
• RAM: approximately 1.5 MB per active connection plus tag buffer (~250 bytes per tag).
• Ethernet bandwidth: a single Modbus TCP PDU is 12 bytes header + up to 253 bytes payload. With 1000 tags at 1 s cycle time the average load is < 10 Mbps, well within a 100 Mbps LAN.
• Firewall settings: Windows Firewall on the SCADA station must allow outbound TCP/502. Create an inbound rule for the WinCC process (CCEServer.exe in V7.0) if outbound NAT is used.

Reference design point: a WinCC V7.0 single-station configuration on a Core i5 with 8 GB RAM has been used in production with 16 Modbus TCP connections, 2000 tags, and 1 s acquisition cycle without dropping frames. A conservative planning budget is 20-25 connections per SCADA server with mixed tag types.

10. Verification and Diagnostics

1. Channel status: Open WinCC Explorer and expand Tag Management > Modbus TCPIP > <Connection>. The connection icon turns green when the handshake completes; red indicates timeout; gray indicates not yet started.
2. Tag diagnostics: Open Graphics Designer > Tag Simulation and verify quality code 0xC0 (good) for each tag.
3. WinCC Channel Diagnosis: Start Start > Programs > Siemens Automation > WinCC > Tools > Channel Diagnosis. The tool reports the connection state, number of retries, and average response time per connection.
4. Packet capture: Run Wireshark on the WinCC station with filter tcp.port == 502. Verify that each transaction follows a clean request/response pair and that the Modbus Unit Identifier matches the configured station address.
5. SCALANCE diagnostics: Use the SCALANCE WBM Information > Port Statistics to confirm no CRC errors, runts, or giants on the port connected to the MB3480.
6. Moxa MB3480 diagnostics: Open MGate Manager and check the System Status page; the Connection Status matrix shows the live TCP master list and per-port serial traffic counters.

11. Troubleshooting Matrix

12. Frequently Asked Questions