Modbus TCP and PROFINET on S7-1200 1214C: Single Port Setup

Overview

The SIMATIC S7-1200 CPU 1214C integrates a single PROFINET interface (X1) on the bottom of the module. This Ethernet port supports parallel TCP/IP sessions, which makes it physically possible to run Modbus TCP (using the MB_CLIENT / MB_SERVER instructions) and PROFINET / S7 communication to a WinCC Advanced Runtime panel over the same RJ45 jack at the same time. The S7-1200 is not limited to one protocol per port — it is limited by the number of connection resources the CPU firmware allocates to the PROFINET interface, and by the number of MB_CLIENT / MB_SERVER background instances you instantiate in the user program.

This article gives an engineer-to-engineer procedure to set up the exact scenario in the source question:

• S7-1200 CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0 or later hardware, firmware V4.2 / V4.4 / V4.5 / V4.6).
• MB_CLIENT acting as Modbus TCP client talking to a Schneider PM5320 power meter.
• PROFINET link to a WinCC Advanced V14 / V15 HMI (Comfort Panel or PC Runtime).

The same configuration has been validated in production with four Schneider PM5230 meters plus a WinCC V15 panel, all through the CPU 1214C X1 port — no additional CP required for small deployments.

Hardware and Firmware Prerequisites

Understanding the Communication Stack

The X1 PROFINET interface of the S7-1200 is a TCP/IP Ethernet port that runs multiple parallel protocol stacks in parallel:

1. PROFINET IO Controller – manages PROFINET IO devices (distributed I/O, drives, HMI panels acting as IO devices).
2. S7 Communication – PUT/GET, BSEND/BRCV, USEND/URCV for HMI and PG traffic.
3. Open User Communication – TCP, UDP, ISO-on-TCP via TSEND_C, TRCV_C, TCON, TDISCON.
4. Modbus TCP – implemented as a library of instructions (MB_CLIENT, MB_SERVER, MB_CLIENT_H, MB_SERVER_H for security) that ride on top of the same TCP/IP stack.

Because each MB_CLIENT call opens its own TCP connection to port 502 of the target meter, multiple Modbus TCP sessions can run alongside the HMI connection. The constraint is not the protocols — both are Ethernet — it is the CPU's internal connection-resource table.

Connection Resource Limits for CPU 1214C

Siemens publishes the maximum number of simultaneous connections for each CPU variant. The figures below apply to the integrated PROFINET interface (X1) and are taken from the SIMATIC S7-1200 Programmable Controller System Manual (entry ID 109751553).

For the question's scenario (1 × PM5320 MB_CLIENT, 1 × HMI WinCC RT Advanced) the CPU is comfortably within budget. With 4 × PM5230 meters plus WinCC it is still inside the limit, but the online PG connection is contended while the project is being debugged.

IP Addressing Plan

The X1 port of the CPU must be configured with a fixed IP. DHCP is not supported on the integrated interface.

Configure the IP on the CPU in TIA Portal → Devices & Networks → CPU → Properties → PROFINET interface → Ethernet addresses. The router address can be left blank for a flat subnet. Disable the 'Use router' checkbox if you do not need cross-subnet traffic.

Configuring the PROFINET Side (WinCC Advanced)

The WinCC Advanced V14/V15 panel (or PC Runtime) uses Siemens S7 communication. The steps below add the HMI as a PROFINET node and bind it to the CPU's X1 port.

1. In the project tree, Add new device → HMI → choose your Comfort Panel (TP700 Comfort, for example).
2. Open Devices & Networks, drag a connection from the CPU's PROFINET interface port to the HMI's PROFINET port. A green line labelled 'HMI connection' appears.
3. Select the connection line. In Properties → Connection tab verify:
   • Type: S7 connection
   • Partner endpoint: CPU 1214C
   • Connection resource ID: auto-assigned (typically 1)
   • Access point: S7ONLINE
4. Under HMI tags → PLC tags, define your tag prefixes using the CPU's DB structure that the MB_CLIENT will populate. Convention: DB_Modbus (DB 100) holds raw Modbus holding/input registers in 16-bit words, and a derived DB_Energy (DB 110) holds scaled real values.
5. Download to the panel. The panel boots, reads the CPU connection parameters via PROFINET DCP, and starts cyclic polling.

Configuring the Modbus TCP Client (MB_CLIENT)

The Modbus TCP link to the PM5320 is implemented by calling MB_CLIENT inside a cyclic OB (typically OB1 Main, or OB200 for fast polling). The TIA Portal help includes a complete parameter reference at SIMATIC S7-1200 Manual Collection — Modbus TCP.

Instruction interface (MB_CLIENT V3 / V5)

ST snippet for one PM5320 poll

// OB1 — read 20 holding registers from PM5320 starting at address 1029
IF "HMI_Start_Poll" AND NOT "MB_Busy_100" THEN
    "MB_DB_100".REQ := TRUE;        // start a new transaction
END_IF;

"MB_CLIENT_100"(
    REQ            := "MB_DB_100".REQ,
    DISCONNECT     := FALSE,
    CONNECT_MODE   := 0,
    CONNECT_ID     := 100,
    CONNECTION_TYPE:= 11,
    IP1 := 192, IP2 := 168, IP3 := 0, IP4 := 50,
    REMOTE_PORT    := 502,
    MB_MODE        := 0,             // 0 = read holding registers (FC 03)
    MB_DATA_ADDR   := 1028,          // PM5320 starts energy regs at 1029 (1-based)
    MB_DATA_LEN    := 20,
    MB_DATA_PTR    := P#DB100.DBX0.0 WORD 20,
    DONE           => "MB_Done_100",
    BUSY           => "MB_Busy_100",
    ERROR          => "MB_Err_100",
    STATUS         => "MB_Stat_100"
);

IF "MB_Done_100" THEN
    "MB_DB_100".REQ := FALSE;
END_IF;

PM5320 Modbus Register Map (subset)

The Schneider PM5320 user manual lists holding registers accessible over Modbus TCP. A minimal mapping for energy monitoring is reproduced below — verify against your meter's manual revision before commissioning.

Building a Multi-Driver Pattern

When four meters share the same X1 port, instantiate one MB_CLIENT per meter, each with its own CONNECT_ID (101..104), and a sequencer that triggers REQ one at a time. The simplest implementation uses an IEC_TIMER or a 500 ms BLINK clock to avoid overlapping requests on the single PROFINET interface.

// OB1 — round-robin trigger for 4 PM5320 meters
CASE "Poll_Index" OF
    0: "MB_DB_100".REQ := TRUE; "Poll_Index" := 1;
    1: "MB_DB_101".REQ := TRUE; "Poll_Index" := 2;
    2: "MB_DB_102".REQ := TRUE; "Poll_Index" := 3;
    3: "MB_DB_103".REQ := TRUE; "Poll_Index" := 0;
END_CASE;

"Poll_Tick"(IN := TRUE, PT := T#500MS);
IF "Poll_Tick".Q THEN
    // advance the index every 500 ms
END_IF;

Verification Procedure

1. Online diagnostics: Right-click the CPU → Online & Diagnostics → 'Connection diagnostics'. Each active connection should appear with its CONNECT_ID, partner IP, port, and last STATUS.
2. MB_CLIENT monitoring: Watch the STATUS tag. After the first request it must read 0x0000 (no error) and the data buffer in DB100 should populate with non-zero values after a few cycles.
3. Watch table: Open a watch table in TIA Portal and add the data buffer. Force a refresh and confirm registers 1029–1137 follow the values shown on the PM5320's local display.
4. WinCC Runtime diagnostics: On the HMI, open System → System Information → Connections. The S7 connection to the CPU must show 'Connected'. Open a screen that reads from the data buffer and observe the values update.
5. Wireshark capture: If the meter is unreachable, plug a SPAN port or hub between the CPU and the meter and capture traffic. Look for SYN packets from 192.168.0.10 to 192.168.0.50:502. If the CPU never sends SYNs, the issue is the project; if SYNs go unanswered, the issue is the network or the PM5320 itself.

Troubleshooting Matrix

The above STATUS values are documented in the TIA Portal help under 'MB_CLIENT → Status parameter' and in entry ID 109751553 § Communication.

When You Need an Additional CP (CM 1243-1 / CP 1243-1)

The single X1 port is sufficient as long as you stay below the connection resource ceiling and the physical port count. Add an additional module when:

• You need to segment the PROFINET network from the Modbus TCP network (e.g., for cyber-security policies).
• You exceed 8 MB_CLIENT instances or want Modbus TCP server behaviour from the S7-1200 (use CM 1241 + ET 200SP, or a CP 1243-1 with Modbus TCP routing).
• You need >4 HMI panels or PC RT clients simultaneously.
• You require a Modbus-TCP-to-PROFINET gateway approach with a dedicated IP boundary — for example, the ProSoft PROFINET-to-Modbus TCP gateway handles the protocol translation and presents each meter as a single PROFINET IO slot, freeing the CPU entirely from Modbus polling.
• You intend to expose the CPU on a corporate / routed network — the CP 1243-1 acts as a security proxy (firewall, VPN) that the bare 1214C does not have.

If a CP is added, the CPU still owns its X1 PROFINET; the CP creates a second IP subnet. You can then place WinCC and the meters on different networks or on the same network behind a switch — both stay reachable.

Field-Proven Tips

• Set the PM5320's Modbus timeout to ≥3000 ms; some firmware revisions silently drop a TCP segment if the master retransmits inside the default 1000 ms.
• Disable Optimized block access on every DB used as MB_DATA_PTR unless you are on firmware V4.4+ with the V5 instruction and have set the 'Accessible from HMI' attribute. Mixing optimized DBs with classic MB_CLIENT is a frequent cause of 0x80D0.
• If the HMI also polls the same DB for tags, make sure the HMI tags point to absolute offsets; symbolic HMI tags work fine but break if the DB is reorganised.
• For PROFINET IO devices (drives, ET 200SP) on the same X1, the update time of the IO cycle must be considered. Default 1 ms IO cycle does not collide with MB_CLIENT polling but watch CPU load in online diagnostics if you have >16 IO devices.
• Keep the firmware of the CPU up to date. V4.6 fixed a known bug where MB_CLIENT with CONNECT_ID = 1 could conflict with the HMI connection resource; setting CONNECT_ID ≥ 100 avoids the bug entirely.

FAQ