Fixing MB_CLIENT 192.168.0.0 Default IP on S7-1200 CPU 1212C

Problem Description

When configuring MB_CLIENT on a Siemens SIMATIC S7-1200 CPU 1212C DC/DC/DC (order number 6ES7212-1AD30-0XB0) with firmware V2.1, the block instance shows a remote address of 192.168.0.0 regardless of what the engineer enters. The intended server address (for example 192.168.10.241) does not appear in the block faceplate or in the watch table. Despite the MB_CLIENT call being cyclically triggered, the STATUS output returns 0000 (no active job) and no Modbus TCP request is sent on the wire.

Two related symptoms typically accompany this defect:

1. The MB_CLIENT instance DB exposes no CONNECT input, so the user cannot supply connection parameters programmatically.
2. The STATUS word stays at 16#0000 while the DONE, BUSY, and ERROR outputs all remain FALSE. The instruction is being scanned but never performs a job.

This behavior is documented behavior of the MB_CLIENT V1.x instruction when the connection is not declared in the device configuration. The address 192.168.0.0 is a hard-coded placeholder in the older instruction faceplate and does not reflect the actual partner IP being used.

Root Cause Analysis

The S7-1200 CPU 1212C family ships with several revisions of the Modbus TCP library. The version installed in the project depends on the TIA Portal version, the CPU firmware, and the active instruction library selection. Two generations matter for this issue:

If the user's TIA Portal project contains MB_CLIENT V1.x, the faceplate will always display 192.168.0.0 regardless of the partner IP because the older instruction has no input to display. The connection itself is taken from the CPU's PROFINET interface configuration under Modbus TCP connections. If no connection is declared there, the call returns STATUS = 16#0000 and never opens a socket.

The 0000 status is therefore not a healthy state - it is the idle state of the instruction, returned because the block was never able to issue a job without a valid connection. The error is not visible in STATUS; it is visible in the missing connection and the missing CONNECT pin.

Affected Hardware and Firmware

The 6ES7212-1AD30-0XB0 is a first-generation S7-1200 CPU that can be upgraded through the available firmware train. Native Modbus TCP on the PROFINET interface is supported across the V1.0 to V3.0 firmware range of this article number, using the Modbus TCP instruction library. The communication processor (CP) is not required when using the onboard PROFINET port with the MB_CLIENT/MB_SERVER instructions.

Prerequisites

Before changing the project, confirm the following:

1. Network reachability. Ping the Modbus server (e.g., PC simulator at 192.168.10.241) from a workstation on the same subnet. A failed ping is not a CPU problem - it is a network problem.
2. IP configuration of the CPU. The S7-1200 PROFINET interface must have a fixed IP, subnet mask, and (if used) router address. Open Devices & Networks → CPU → PROFINET interface → Ethernet addresses and assign an address in the same subnet as the server, for example 192.168.10.240 / 255.255.255.0.
3. Modbus server reachable on TCP port 502. Confirm the PC-based Modbus simulator is bound to 0.0.0.0:502 or 192.168.10.241:502 and that the host firewall allows inbound 502/TCP.
4. TIA Portal version. Use the TIA Portal version that matches the CPU firmware. TIA Portal V13 / V14 SP1 is appropriate for FW V2.1. TIA Portal V15 or higher supports newer instruction versions that are not always available for older firmware targets.
5. Project rebuilt and downloaded. After any change to the project, perform a full rebuild and download to the CPU. A partial download can leave the runtime instance inconsistent with the offline project.

Solution A: Migrate to MB_CLIENT V2.x with CONNECT

This is the recommended path for new projects and for any project that requires more than one parallel Modbus TCP connection. The CONNECT input is required on MB_CLIENT V2.0 and later.

Step 1 - Replace the MB_CLIENT block

1. Open the program block that contains MB_CLIENT (for example, Main [OB1]).
2. Right-click the MB_CLIENT instance in the program and select Delete. Confirm the deletion of the instance DB.
3. Open the project library or the global Instructions tree. Search for MB_CLIENT and drag the latest available version into the network. The block title in the task card shows the version, e.g., MB_CLIENT V2.2 or MB_CLIENT V3.1.
4. When the new block is inserted, TIA Portal automatically generates a new instance DB. Click OK to accept the default name (for example, MB_CLIENT_DB).

Step 2 - Create a global connection DB

The CONNECT input expects a structure of type TCON_IP_v4 (or the older TCON_IP_RFC1006). The cleanest approach is a dedicated global DB.

1. Add a new global DB, name it ModbusConnections (or similar), and disable optimized block access (Attributes → Optimized block access = No). Optimized access can hide the structure layout from older instruction versions.
2. Declare a tag of type TCON_IP_v4. Example:

DATA_BLOCK "ModbusConnections"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
NON_RETAIN
  STRUCT
    sim_HR_Client : TCON_IP_v4;   // PC simulator, holding registers
  END_STRUCT;
END_DATA_BLOCK

3. Open the new DB and populate the structure fields. The values depend on the CPU's PROFINET interface index and the partner details. Typical values for a single local PROFINET port:

The InterfaceId for the S7-1200 onboard PROFINET port is exposed in the device configuration under System constants. Open the CPU device view, switch to Properties → System constants, and locate the entry for the PROFINET interface. On the CPU 1212C this is typically Local~PROFINET_interface_1 with a numeric system constant that resolves to 64 in newer projects.

Step 3 - Wire the CONNECT input

1. Open the network with MB_CLIENT and click the CONNECT pin.
2. Type the DB tag name (for example, "ModbusConnections".sim_HR_Client) and press Enter.
3. Compile the block. If the compiler accepts the type, the wiring is correct. If it rejects, the most common cause is a missing TCON_IP_v4 declaration in the DB or a mismatch between optimized and non-optimized access.

Step 4 - Fill the function-code and address parameters

The MB_CLIENT interface requires function-code, starting address, length, and the data buffer. For reading holding registers from the simulator:

MB_CLIENT(
  REQ        := iStartRequest,         // BOOL - rising edge triggers
  DISCONNECT := FALSE,                // BOOL - keep open between calls
  MB_MODE    := 0,                    // INT  - 0 = read, 1 = write
  MB_DATA_ADDR := 40001,              // INT  - starting register (4xxxx)
  MB_DATA_LEN := 10,                  // UINT - number of registers
  DONE       => bDone,
  BUSY       => bBusy,
  ERROR      => bError,
  STATUS     => wStatus,
  CONNECT    := "ModbusConnections".sim_HR_Client,
  MB_DATA_PTR:= pHoldingRegs);

The data buffer pHoldingRegs must be a tag of type ARRAY[0..n] OF WORD in a global DB with non-optimized access. The array length must be at least MB_DATA_LEN. For 10 holding registers use ARRAY[0..9] OF WORD or larger.

Solution B: Keep MB_CLIENT V1.x and Configure the Connection in Device Properties

Use this path only when project policy mandates MB_CLIENT V1.x (for example, replication of an existing validated program) or when TIA Portal does not offer a newer instruction version for the selected CPU firmware.

1. Open Devices & Networks and select the S7-1200 CPU.
2. Open Properties → PROFINET interface [X1] → Modbus TCP connections. If the entry is not visible, the Modbus TCP feature is not enabled for the port. Right-click the PROFINET port and confirm Enable Modbus TCP (or check the CPU's Communication → Modbus TCP setting depending on TIA Portal version).
3. Add a new connection. Set Partner IP to 192.168.10.241 and accept the default partner port 502. Set the local port to 0 for a client connection.
4. Note the Connection ID assigned by TIA Portal (typically 1 for the first connection).
5. Open the MB_CLIENT V1.x call and assign that connection ID to the ID input (older faceplate) or to the connection parameter field exposed by the block. The faceplate will continue to display 192.168.0.0 - this is cosmetic and does not affect runtime behavior.
6. Compile the project (Hardware and Software) and download both the hardware configuration and the software to the CPU.

Connection Parameter Reference

The TCON_IP_v4 structure is the building block for every PROFINET-based TCP connection on the S7-1200, including Modbus TCP. The exact layout for firmware V2.1 is:

The four bytes of RemoteAddress are stored in network byte order (big-endian). For 192.168.10.241 the on-wire bytes are C0, A8, 0A, F1. Enter the address in the editor as a dotted string; TIA Portal writes the bytes in the correct order.

Status Code Diagnostics

After a successful compile and download, observe the MB_CLIENT outputs online. The following subset covers the codes most frequently encountered during commissioning:

For a complete status code table, refer to the SIMATIC S7-1200 Communication / Modbus TCP Instructions manual in the TIA Portal help and the corresponding S7-1200 system manual on the Siemens Industry Online Support portal.

Verification Procedure

1. Download the modified project (Hardware + Software) to the CPU. Stop the CPU if a full download is required, then run.
2. Go online and open the MB_CLIENT instance DB. Confirm the CONNECT field is non-zero and contains the expected IP.
3. Set a watchpoint or use a watch table to force REQ = TRUE for one cycle.
4. Monitor BUSY, DONE, ERROR, and STATUS. A healthy exchange ends with BUSY = FALSE, DONE = TRUE, ERROR = FALSE, and STATUS = 16#0000.
5. Inspect MB_DATA_PTR. For a read of 10 holding registers starting at 40001, the array should be populated with the simulator values.
6. Capture the exchange with Wireshark on the PC running the simulator. Filter on tcp.port == 502. Confirm a Modbus/TCP transaction: MBAP header (7 bytes) + function code 0x03 (read holding registers) + register count.

Troubleshooting Matrix

Common Pitfalls and Edge Cases

Optimized block access on the data buffer. The MB_DATA_PTR tag must be in a DB with optimized block access disabled. Optimized tags can be located at any address and the instruction cannot address them reliably. Create a dedicated non-optimized DB for the data buffer, or use the standard MB_CLIENT_DB instance which is non-optimized by default.

InterfaceId zero. If the InterfaceId field in the TCON_IP_v4 structure is left at 0, the connection cannot be opened. TIA Portal hides this field when the structure is populated from the project; verify the value with a watch table.

Duplicate connection ID. Each PROFINET-based TCP connection (including those used by TSEND_C, Modbus TCP, ISO-on-TCP, and S7 communication) must use a unique ID in the range 1..4095. Reusing an ID is the most common cause of an apparently valid connection that never opens.

Port 502 blocked by Windows Firewall. The PC simulator binds to TCP 502, but the Windows Firewall blocks inbound connections by default. Add a rule allowing TCP 502 from the CPU's IP, or temporarily disable the firewall for the engineering test.

Unit ID / Slave ID. The Modbus TCP frame carries a unit identifier. Most PC simulators ignore it and respond regardless; some embedded Modbus gateways route based on it. Leave it at the default 255 (or 1) unless the partner documentation requires otherwise. The MB_CLIENT block on the S7-1200 exposes the unit ID depending on instruction version - V2.x has a separate MB_UNIT_ID input.

Firmware V2.1 limits. The CPU 1212C with firmware V2.1 supports a limited number of simultaneously open TCP connections (typically 8 - confirm with the CPU's manual). Each MB_CLIENT call uses one connection. Stay within budget or upgrade the CPU to a newer article number (6ES7212-1AE40-0XB0 for V4.x) that supports more connections.

Wireshark verification. When the exchange still fails after the corrections above, capture with Wireshark on the PC running the simulator. A healthy client request shows:

Modbus/TCP
  Transaction Identifier: 0x0001
  Protocol Identifier: 0x0000 (Modbus/TCP)
  Length: 6
  Unit Identifier: 1
  Function Code: 3 (Read Holding Registers)
  Reference Number: 0 (40001 - 40001 + 1)	d>Word Count: 10

If the CPU never transmits this frame, the problem is the TIA Portal configuration. If the CPU transmits but the server never responds, the problem is the server or the network.

FAQ