Downloading Siemens Modbus TCP Demo Blocks for S7-1200/1500

Overview: Modbus TCP Library Access for S7 PLCs

Siemens distributes officially tested Modbus TCP libraries for the S7-1200 and S7-1500 families that contain pre-built program blocks (FB, FC, DB, UDT) implementing Modbus TCP client and server functionality on top of the integrated PROFINET interface of the CPU. The most widely deployed package is the "Modbus/TCP CP" library, current revision V4.3, which exposes the MB_CLIENT and MB_SERVER function blocks for use inside TIA Portal projects. The library is shipped as a global library archive (.al14, .al15, or .al18) and as a zipped bundle that includes worked example projects, release notes, and bilingual documentation.

Because Siemens distributes the demo version through the IT4INDUSTRY license-tracking backend rather than the standard support.industry.siemens.com download area, engineers routinely hit a dead link or an "email not found" error when trying to retrieve the package. This reference consolidates the working retrieval path, documents the required registration on the IT4INDUSTRY portal, lists the TIA Portal integration sequence, and provides drop-in alternatives when the official channel is offline.

Prerequisites for Obtaining Modbus TCP Demo Blocks

Before retrieving the library, verify the following items are in place:

• Siemens Industry Online Support account: A registered user at support.industry.siemens.com. Note that the IT4INDUSTRY portal credentials are independent from this account; do not assume single sign-on.
• IT4INDUSTRY downloads account: A separate registration is required on the IT4INDUSTRY distribution site that hosts the licensed demo material. Re-use of the standard support credentials returns "The email-address was not found or password was wrong."
• TIA Portal installation: V15, V15.1, V16, V17, or V18 installed locally. Modbus/TCP CP V4.3 is compatible with all of these; older revisions V3.x are required for TIA V13/V14 environments.
• S7-1200 or S7-1500 CPU firmware: Firmware 4.2 or higher for S7-1200 (CPU 1211C/1212C/1214C/1215C/1217C and 1212FC/1214FC/1215FC) and firmware 2.0 or higher for S7-1500 to use the integrated PROFINET interface for Modbus TCP without an additional CP module.
• Working email address: The IT4INDUSTRY portal sends an activation link that must be confirmed before any download is enabled.
• Outbound HTTPS to extranet.is.industry.siemens.com: Corporate firewalls that block the extranet domain prevent the Accept page from loading.

Locating the Official Modbus TCP Library on Siemens Support

The canonical entry point for the Modbus/TCP CP library on the Siemens Industry Online Support portal is reached via the search term "Modbus TCP S7-1200" or the direct article number 67293086. The article carries the library ZIP, release notes, and a German/English PDF describing the MB_CLIENT/MB_SERVER block interfaces.

For TIA Portal cloud documentation and worked examples, refer to the TIA Portal help portal at docs.tia.siemens.cloud – Modbus TCP examples. The cloud collection covers example projects for both client and server roles, instruction instance DB creation, and download behavior when blocks are still in compile-error state.

Registering on the IT4INDUSTRY Portal

The demo version of the Modbus/TCP CP library is distributed under the IT4INDUSTRY license-tracking system rather than the public Siemens support area. IT4INDUSTRY is a separate authentication domain — a Siemens Industry Online Support login will not be recognized. The decision tree below illustrates the correct path through the Accept and authentication flow.

Follow the steps below to obtain working credentials:

1. Open the library entry on Siemens Support and click the Download link. When the Accept EULA screen appears, click Accept.
2. The browser redirects to the IT4INDUSTRY login form. If you have not registered, click the Register link — not Login.
3. Provide a valid corporate email address, first/last name, company, and country. A confirmation email is dispatched within minutes; click the embedded activation URL to complete the registration.
4. Return to the original library entry, click Accept again, and authenticate with the freshly activated IT4INDUSTRY credentials. The download initiates immediately.

Downloading the Modbus TCP V4.x Demo Package

The download package ships as a ZIP archive (typically 67293086_Modbus_TCP_CP_V4_3.zip) containing the following structure:

/
├── Library/
│   ├── Modbus_TCP_CP_V4_3.al14          (TIA V14 SP1–V15 library)
│   ├── Modbus_TCP_CP_V4_3.al15          (TIA V15.1–V16 library)
│   └── Modbus_TCP_CP_V4_3.al18          (TIA V17–V18 library)
├── Examples/
│   ├── Modbus_TCP_Client_S7-1200.zap14
│   ├── Modbus_TCP_Server_S7-1200.zap14
│   └── Modbus_TCP_Client_S7-1500.zap16
├── Documentation/
│   ├── Modbus_TCP_CP_V4_3_en.pdf
│   └── Modbus_TCP_CP_V4_3_de.pdf
└── Release_Notes.txt

The library exposes the following function blocks in the Modbus_TCP_CP program folder:

Modbus TCP reserves TCP port 502 per IANA assignment. All connections opened by MB_CLIENT and MB_SERVER use port 502 as the server-side listen port and as the destination port for outgoing client requests. The library additionally reserves 16 connection identifiers (CONNECT_ID 1..16) per CPU instance; CONNECT_ID collisions between two MB_CLIENT instances cause STATUS 16#80C9 at runtime.

MB_CLIENT and MB_SERVER Parameter Reference

The V4.3 library publishes the following input and output parameters on MB_CLIENT. The structure of MB_SERVER is a subset (no partner IP, fixed listen port).

Modbus Address Mapping and Register Conventions

Modbus function codes are paired with four logical address spaces. The library accepts the 1-based address as written in the device documentation; conversion to the 0-based PDU offset happens inside the block.

Integrating the Library into TIA Portal V15–V18

1. Open TIA Portal and the target project.
2. Right-click the project node and choose Global libraries > Open library...
3. Browse to Modbus_TCP_CP_V4_3.al15 (or .al18 for V17/V18) and confirm.
4. In the library palette, navigate to Master copies > Modbus_TCP_CP. Drag the MB_CLIENT or MB_SERVER FB into the project Program blocks folder.
5. Provide an instance DB when prompted (TIA auto-numbers DB1100 onward). Use a fixed DB number for traceability: idb_MB_CLIENT as DB1100.
6. Create a standard-access data DB (un-optimized) to hold the Modbus payload. A 10-register holding-register example:

DATA_BLOCK "dbModbusData"
{ S7_Optimize_Access := 'FALSE' }
AUTHOR : ENG
FAMILY : MODBUS
NAME : dbModbusData
VERSION : 0.1
  STRUCT
   HoldingReg : ARRAY[0..9] OF WORD;   // 10 registers, FC3/FC6/FC16
   CoilState  : ARRAY[0..15] OF BOOL;  // 16 coils,    FC1/FC5/FC15
  END_STRUCT;
END_DATA_BLOCK

7. Insert a CALL MB_CLIENT, "idb_MB_CLIENT" ladder/network in OB1. Wire the inputs:

REQ         := bStartRequest          // Bool — rising edge initiates transaction
DISCONNECT  := bDisconnect            // Bool — close TCP connection on demand
MB_MODE     := 1                      // USInt — 1 = read, 2 = write
MB_DATA_ADDR:= 40001                  // UInt — 1-based Modbus register address
MB_DATA_LEN := 10                     // UInt — number of registers/coils
MB_DATA_PTR := "dbModbusData".HoldingReg  // Variant — must point to a standard DB
CONNECT_ID  := 1                      // UInt — unique per CPU
IP_OCTET_1  := 192                    // USInt
IP_OCTET_2  := 168
IP_OCTET_3  := 0
IP_OCTET_4  := 50
PORT        := 502                    // UInt — Modbus TCP standard port

8. Compile the project (Build > Compile all). Resolve any "Instance DB must be non-optimized" warnings by un-checking Optimized block access on the data DB.
9. Download to the CPU in STOP, then RUN. Watch the STATUS word on the instance DB to confirm clean operation.

Alternative Open-Source Modbus TCP Libraries

When the IT4INDUSTRY portal is offline or the demo download cannot be retrieved, third-party libraries are usable for non-safety, non-validated applications. The Modbus Organization maintains a public resource list at modbus.org/other-sites tracking open-source implementations. For .NET integration, the EasyModbusTCP/UDP/RTU .NET library implements function codes FC1 (Read Coils), FC2 (Read Discrete Inputs), FC3 (Read Holding Registers), FC4 (Read Input Registers), FC5 (Write Single Coil), FC6 (Write Single Register), FC15 (Write Multiple Coils), and FC16 (Write Multiple Registers) for client and server roles.

Verifying the Library Installation

After integration, verify the library loads correctly using the following checks:

1. Compile clean: Project compiles with zero warnings and zero errors referencing Modbus blocks. Watch specifically for "Instance DB must be non-optimized" and "Variant pointer type mismatch".
2. Block inventory: The library FBs (MB_CLIENT = FB1100, MB_SERVER = FB1101) appear in Program blocks > System blocks > Library blocks.
3. Watch table: Open a watch table on the MB_CLIENT instance DB. The DONE, BUSY, ERROR, and STATUS outputs must be visible (Word type for STATUS).
4. Live connection test: Use a Modbus poll tool (such as the Modbus Tools Kit client) to read the same register range the CPU is configured to serve. The tool must return values without "Illegal Data Address" (exception code 02) or "Illegal Function" (exception code 01).
5. STATUS = 16#0000: No transaction error. STATUS = 16#80C8 indicates the configured partner is not reachable; verify IP, subnet, and firewall on TCP/502.
6. Cycle-time budget: A single FC3 read of 10 registers should add < 5 ms to the OB1 cycle time on S7-1214C/DC/DC and < 2 ms on S7-1516-3 PN/DP.

Diagnostic STATUS Code Reference

The MB_CLIENT/MB_SERVER STATUS word returns hex codes that map to specific protocol or local faults. The most common values are listed below; refer to the bundled PDF in the library ZIP for the full table.

Field Commissioning Checklist and Security Notes

Run through the following checks before declaring a Modbus TCP link production-ready:

1. Network isolation: Modbus TCP has no authentication or encryption (per the Modbus Organization specification at modbus.org). Place the link on a separate VLAN or behind an industrial firewall.
2. Write protection: Restrict MB_MODE = 2 (write) to clearly identified instances; accidental writes to a partner holding register can rewrite process setpoints.
3. Watchdog: Implement an OB1 cycle-counter that drops the connection if DONE does not toggle within N cycles; use DISCONNECT = TRUE to force re-handshake.
4. Time synchronization: Use the same NTP source for the S7 CPU and partner SCADA so that transaction logs can be correlated during incident review.
5. Port scan verification: From a laptop on the same VLAN, run nmap -p 502 <cpu-ip> to confirm only TCP/502 is open and no extraneous ports are exposed by the library.
6. Spare CONNECT_IDs: Reserve CONNECT_ID 1–4 for production, 5–8 for commissioning, 9–16 for test/diagnostics. Document in the project README.
7. Backup project: Store the integrated TIA project and the global library in the same versioned repository. Re-downloading the demo at the next migration can be cumbersome if the IT4INDUSTRY portal is unavailable.

Troubleshooting Common Download and Integration Issues