Manually Upgrade MB_CLIENT Block Version in TIA Portal V17

Overview

The MB_CLIENT instruction implements the Modbus TCP client role on SIMATIC S7-1200 and S7-1500 CPUs. The instruction has gone through multiple internal revisions, each adding functionality, fixing defects, or adapting to firmware features. The revision shown in your project tree is not arbitrary — it is the intersection of three independent variables: the CPU platform (S7-1200 vs. S7-1500), the order number of the CPU (which carries a base firmware level), and the actual firmware revision loaded in the device.

When MB_CLIENT v5.2 or v6.0 is not visible in the instruction catalog, the cause is almost always one of the three variables above, not a defect in TIA Portal V17. TIA Portal supports a manual instance upgrade that swaps the version of an existing instruction instance without deleting and re-adding it. That workflow is hidden behind a right-click menu and is the focus of this reference.

Prerequisites

• TIA Portal V17 (Update 2 or later recommended) installed with the HSP matching the target CPU family.
• CPU whose firmware supports the target MB_CLIENT block version. Cross-check against the CPU manual entry on Siemens Industry Online Support.
• Project backup (TIA Portal project archive .zap17) before any structural block change.
• Read/write access to the project's offline blocks. If the instance is referenced by other FBs, plan to recompile dependent code paths.
• For live systems, perform an offline/online diff before download. The online block title bar in TIA Portal V17 reports the active revision.
• Optional: a packet capture tool (Wireshark) on a mirrored port of the CPU's PROFINET interface to validate runtime traffic.

Why MB_CLIENT Block Versions Differ

Siemens ships the Modbus TCP instructions as part of the global library delivered with TIA Portal. The installation includes a base set of instruction versions; the HSP (Hardware Support Package) and the CPU's firmware together determine which revisions become selectable. The TIA Portal catalog grays out revisions that are not supported by the current configuration — there is no override flag.

Three Variables That Select the Revision

1. Platform. S7-1200 and S7-1500 use different instruction binaries. An MB_CLIENT v5.2 build for S7-1500 is not interchangeable with an MB_CLIENT v5.2 build for S7-1200. The instruction catalog groups them under separate paths (Communication → Modbus TCP → Client).
2. Order number (MLFB / Article Number). The CPU order number encodes a base firmware level. A 6ES7 214-1AG40-0XB0 ships with a different base firmware than a 6ES7 214-1BG40-0XB0; each base firmware ships with its own maximal instruction set. Cost-optimized variants cap at lower instruction revisions.
3. Actual firmware revision. A CPU's installed firmware may be lower than the maximum supported by TIA Portal. Updating the firmware (via SIMATIC Automation Tool, TIA Portal online, or SD card) is often the prerequisite for a higher block version to appear in the catalog.

Send and receive instructions for the same protocol ship with independent version streams. MB_CLIENT and MB_SERVER revisions do not always move in lockstep. Verify each one individually when troubleshooting an upgrade.

Firmware Revision Bands on S7-1200

S7-1200 firmware moves in distinct bands (4.0, 4.1, 4.2, 4.3, 4.4, 4.5 and onward). Each band introduces a new instruction catalog; the band itself, not the catalog, is the gating factor. When porting a project from a 4.2 CPU to a 4.5 CPU of the same order number, the catalog typically expands without any project-level change.

Locating the Current Revision

Open the project, expand Program Blocks → System Blocks → Communication and inspect the MB_CLIENT instance. The block title shows the version digit. Alternatively, the F1 help inside the instruction editor lists all revisions available for the configured CPU. Hovering the instruction in the catalog surfaces the supported CPUs in the tooltip — a quick way to confirm a candidate revision is valid for the project.

Manual Upgrade Procedure

TIA Portal supports swapping the version of an existing instruction instance without deleting and re-adding it. The instance DB and its wiring are preserved when the upgrade is structurally compatible.

1. Open the project in TIA Portal V17.
2. Navigate to the Program Blocks tree. Locate the MB_CLIENT instance — a single instance DB or a multi-instance inside a parent FB.
3. Right-click the block and select Properties. Open the Information tab. The current revision is shown under Version / Firmware.
4. Close Properties. Right-click the block again and select Change block version (in some TIA Portal builds the menu entry is labeled Update block version or Switch to another version).
5. In the dialog, pick the target version (e.g., 5.2 or 6.0) from the dropdown. Only revisions compatible with the configured CPU and firmware are listed. Disabled entries indicate the configuration does not support that revision — see the next section.
6. Confirm with OK. TIA Portal recompiles the block. Watch the Compile pane for warnings — interface changes between versions are common and may require adapting the calling code.
7. Repeat the action for the instance DB and for any background DBs the instruction references.
8. Download the project to the CPU. TIA Portal shows an Online/offline comparison dialog before download; the block version change is the only delta in most cases.
9. After download, use Online & Diagnostics → Online block title to confirm the live revision matches the offline revision.

When the Target Version Is Not Listed

If v5.2 or v6.0 does not appear in the dropdown, the configuration is not eligible. Investigate in this order:

1. CPU order number. Older or cost-optimized CPUs (entry-level S7-1200s, certain S7-1500 compact variants) cap at a lower instruction revision. The order number is on the CPU's front label — read it directly rather than trusting the device name in TIA Portal.
2. CPU firmware. A higher block version often requires a minimum firmware. Update firmware via Online → Accessible nodes → Online & Diagnostics → Firmware update or SIMATIC Automation Tool, then re-evaluate the dropdown.
3. TIA Portal version. A v5.2 instruction that does not appear in TIA Portal V17 may require TIA Portal V17 Update 4 or later, or a newer HSP. Install the latest updates and HSPs from Siemens Industry Online Support.
4. Project device substitution. If the project was originally created for a different CPU, change the device in the project tree to the actual CPU. TIA Portal re-evaluates the available instruction set when the device changes.
5. HSP not installed. Some instruction revisions are introduced by a specific HSP. Open Options → Manage General Station Description Files (GSD) and verify the relevant HSP is loaded. The TIA Portal installation log records which HSPs are active.
6. Project consistency. A project with unresolved cross-references or a stuck offline/online conflict can hide catalog entries. Compile the entire station to clean state, then retry.

Modbus Function 23 (Read/Write Multiple Registers)

Function code 23 (0x17) is the combined read/write multiple holding registers call. It is gated by the MB_CLIENT block version. Per the official Siemens documentation on MB_CLIENT, function 23 requires an instruction version that is not the default for many S7-1200/1500 firmware levels. To enable function 23, the engineer must upgrade the MB_CLIENT instruction version manually using the procedure above.

Once upgraded, MB_MODE = 101 supports function 23 with the data layout defined in the Siemens function reference. The STATUS output surfaces Modbus exception codes 0x01–0x0B for protocol-level errors and a separate Siemens-specific code for transport-level faults. The data area used for the read portion and the write portion are split according to MB_DATA_LEN and the second range parameter in newer interface builds.

Connection Parameters (CONNECT Parameter Block)

Newer MB_CLIENT revisions use a TCON_IP_V4-style CONNECT structure. The legacy CONNECT parameter is not present in v4.x and later. The engineer must re-wire the parameter block when migrating from older revisions.

Verification

After the upgrade, run a structured verification pass before commissioning:

1. Offline compile. Clean compile of the entire station. No errors, no warnings about mismatched interfaces.
2. Online/offline comparison. The block title bar in online view should show the new version digit. A persistent difference means the project was not yet downloaded.
3. Instance DB initialization. Monitor the instance DB in online view. The first scan should populate MB_DATA_PTR with the configured data area; BUSY should pulse to TRUE and DONE to TRUE on success.
4. STATUS sweep. Force a single REQ edge and read STATUS. A value of 0 indicates a clean transaction. Common post-upgrade values:
   • 0x0001 — connection establishment in progress
   • 0x0002 — connection establishment failed (check IP/port and partner reachability)
   • 0x0003 — Modbus exception from partner (function code 1, 2, 3, etc., as reported in the low byte)
   • 0x7000 — instruction busy
   • 0x7001 — instruction complete, no error
   • 0x80C0 — temporary resource error on the CPU (too many concurrent connections)
5. Cyclic traffic. Use Wireshark on a mirrored port to confirm the TCP handshake completes and Modbus PDUs are exchanged. The TIA Portal trace tool can also record the instruction's lifecycle.
6. Long-run soak. Leave the cyclic transaction running for at least one hour. Memory leaks and connection-reset issues often appear only after thousands of transactions.

Troubleshooting Matrix

Compatibility and Migration Notes

Migrating an MB_CLIENT instance across major version boundaries (e.g., v3.x to v5.x) is a structural change, not a cosmetic one. Field-validated points for the S7-1200 family, applicable in spirit to S7-1500:

• Instance data layout changes. Static variables are not guaranteed to be 1:1 mappable. Reset all instance values on download and re-establish any retentive tags intentionally.
• MB_DATA_PTR is interpreted as a VARIANT in newer builds. Confirm the data block's data type is a structure or array. Scalar tags still work, but strict typing of VARIANT can fail in cross-DB references that worked under the legacy pointer model.
• Connection management. Newer revisions can multiplex multiple Modbus TCP partners over a single TCON connection. The legacy model assumed one instruction instance per partner. Plan connection IDs carefully when scaling.
• STATUS code drift. 16#80C0 and 16#80C1 were refined between v3 and v5. Update any HMI error message mapping that referenced the old codes.
• Implicit vs. multi-instance. The upgrade may convert an implicitly created instance DB into a multi-instance inside the calling FB. This change is invisible to the call site but affects watch tables and cross-references.
• Know-how protection. If the project uses know-how protection on the calling FB, the protected block must be re-protected after the underlying MB_CLIENT instance is upgraded. Re-enter the password before download.

Firmware Update Procedure (for the Gating Path)

If the diagnostic path above points to firmware, the update itself is straightforward but order-sensitive:

1. Identify the current firmware version in Online & Diagnostics → Diagnostic → CPU.
2. Download the matching firmware file (SIMATIC S7-1200 Programmable Controller, firmware update) from Siemens Industry Online Support. Match the order number exactly — cross-family firmware files will not load.
3. From TIA Portal: Online → Accessible nodes → right-click the CPU → Online & Diagnostics → Firmware update. Select the file and confirm.
4. The CPU will go to STOP for the duration of the update (typically 30–120 seconds). Programs are retained.
5. After restart, verify the new firmware in the diagnostics view, then retry the Change block version dialog. The new revision should now be selectable.

Performance and Resource Considerations

Each active MB_CLIENT instance consumes a TCON connection resource and a portion of the CPU's connection budget. Practical limits observed on S7-1200 (CPU 1214C/1215C class):

• Open TCP connections: up to 8 simultaneous (firmware 4.x and later)
• Cyclic MB_CLIENT transactions: scan-time impact is roughly 1–3 ms per active instance, dependent on partner response latency
• Data block size: MB_DATA_PTR may not exceed 2048 bytes in legacy revisions; newer revisions raise this to 8192 bytes

For S7-1500, the limits are higher (up to 64 open connections on mid-range CPUs) and the firmware impact is correspondingly smaller. Always consult the CPU's manual for the actual connection budget before scaling a Modbus TCP fleet.