MODBUS TCP on Siemens S7-1200: Client/Server Setup and Limits

Overview: MODBUS TCP on the SIMATIC S7-1200

The SIMATIC S7-1200 CPU family exposes MODBUS TCP as a first-class protocol alongside PROFINET. Two instruction blocks, MB_CLIENT and MB_SERVER, are provided with every TIA Portal installation and implement Modbus Application Protocol V1.1b over TCP/IP per the Modbus Organization specification. The S7-1200 can act simultaneously as a PROFINET IO Controller (or IO Device) and as a Modbus TCP client, a Modbus TCP server, or both, all on the same Ethernet port, because MODBUS TCP is a TCP/IP application-layer protocol that shares the transport stack with PROFINET.

This makes the S7-1200 a practical gateway controller when a third-party drive (such as a Nanotec PD4-E closed-loop stepper, an Oriental Motor AZ series, or a Schneider Lexium), a panel meter, or a remote I/O island uses MODBUS TCP and the rest of the line uses PROFINET. The same CPU can also bridge between Ethernet/IP and Modbus TCP when used with the appropriate instruction blocks, although Ethernet/IP is not natively a Siemens protocol and requires add-on libraries or a CP 1543-1 / CM 1542-1 plug-in module for full scanner support.

Firmware and Software Prerequisites

MB_CLIENT and MB_SERVER are not part of the original S7-1200 firmware V1.0 instruction set. The minimum firmware and software requirements to use the standard library Modbus TCP instructions are:

The official Siemens application note covering Modbus TCP for the S7-1200 and S7-1500 is Modbus/TCP with the instructions "MB_CLIENT" and "MB_SERVER" (Siemens support entry 102020340). The PDF details block pin assignments, the structure of the instance DB, the difference between 0-based and 1-based Modbus addressing depending on firmware version, and the connection-resource bookkeeping.

If the customer CPU is on firmware V1.0, the standard MB_CLIENT/MB_SERVER blocks are not available. In that case you must either upgrade the firmware (firmware update files are available free of charge from Siemens support) or use the older Modbus TCP library that was distributed as an example project on the old Service & Support portal. For any new design, treat firmware V4.x as the baseline and the older paths as legacy.

MB_CLIENT and MB_SERVER Instruction Architecture

Both blocks are FB-type instructions (function blocks) shipped in the standard library. Each call must be associated with its own instance data block, which Siemens calls the IDB (Instance DB). The IDB stores the connection descriptor, the active request, the partial transaction state, and the diagnostics.

MB_CLIENT input pin map

MB_CLIENT output pin map

MB_SERVER pin map (truncated to essentials)

Port Sharing: PROFINET and MODBUS TCP on One Socket

The S7-1200 CPU exposes a single physical PROFINET port (X1 on most models). PROFINET RT and MODBUS TCP both ride on top of TCP/IP, with PROFINET using UDP/IP for real-time class 1 frames and TCP/IP only for non-RT traffic such as engineering and diagnostics. The S7-1200 TCP/IP stack allows multiple TCP server ports to listen on the same IP address and multiple TCP clients to originate connections from the same IP address. This means:

• The S7-1200 can be a PROFINET IO Controller and a MODBUS TCP server on the same X1 port, both bound to the same IP.
• The S7-1200 can be a PROFINET IO Controller and a MODBUS TCP client to one or more third-party servers on the same X1 port.
• CPU 1215C and CPU 1217C have a second port (X2) that can be assigned a different IP subnet; both ports run the same protocols independently.

The connection-resource bookkeeping is split: PROFINET uses one connection slot per IO Device plus reserved slots for the IO Controller itself; MODBUS TCP uses the OPC UA / open TCP / ISO-on-TCP connection pool. On a CPU 1214C, for example, you have up to 8 open Modbus TCP connections available for MB_CLIENT plus the MB_SERVER listen socket. The exact numbers are documented per CPU in the S7-1200 System Manual, entry SIMATIC S7-1200 Programmable Controller System Manual (109741593).

Connection Limits and Resource Planning

Connection limits are a frequent source of commissioning surprises. The S7-1200 splits its connections between PROFINET and open-communication services:

These figures are conservative and depend on firmware revision; the canonical table lives in the System Manual chapter on "Communication services and connection resources". When you approach the limit, the MB_CLIENT STATUS word reports W#16#8085 (no resources available) or W#16#8086 (partner reports resources exhausted). Plan your architecture accordingly: if you have eight third-party Modbus devices, consider a CP 1542-1 to take the load off the CPU, or switch to PROFINET for the higher-density part of the network.

Step-by-Step Configuration in TIA Portal

1. Add the S7-1200 CPU to the project and configure its PROFINET interface (X1) with the IP address, subnet mask, and router (if any). Confirm firmware revision is at least V2.0; V4.x recommended.
2. In the project tree, open Devices & Networks > Network view, drag the S7-1200 into the Ethernet subnet. If you are also wiring PROFINET devices, add them in the same view.
3. Open the S7-1200 program blocks and create a new FB or use the program OB1 (main) for the Modbus call. Drag Communication > Modbus TCP > MB_CLIENT from the Instructions task card into the network. Confirm the dialog asking for the instance DB name and number.
4. Create the connection description DB. Right-click Program blocks > Add new block > Data block, set it to type "Global DB", and declare a variable of system data type TCON_IP_V4. Populate the fields:\li>

InterfaceId      := 64#0000_0001   // PROFINET interface 1
Id               := 1                // connection ID (must match CONNECT_ID)
ConnectionType   := 16#0B            // TCP/IP
ActiveEstablished := TRUE            // client opens the connection
RemoteAddress    := '192.168.0.50'   // partner IP (third-party Modbus device)
RemotePort       := 502              // standard Modbus TCP port
LocalPort        := 0                // 0 = any free local port

5. Create a standard data block DB_ModbusData for the data buffer. Declare the Modbus registers as ARRAY[0..49] OF WORD for 50 holding registers, plus an ARRAY[0..7] OF BOOL or ARRAY[0..7] OF WORD for coil-style access. The data type must match the FC you are issuing: WORD for holding- and input-register FCs, BOOL for coil- and discrete-input FCs.
6. Wire the MB_CLIENT inputs. Example for a read-holding-register request to address 0, length 10:
   

   REQ          := tagCycle_500ms;          // 500 ms pulse
   MB_MODE      := 0;                       // read
   MB_DATA_ADDR := 0;                       // start at Modbus address 0 (0-based on V4.x)
   MB_DATA_LEN  := 10;                      // 10 holding registers
   MB_DATA_PTR  := "DB_ModbusData".HR[0];   // data buffer
   CONNECT_ID   := 1;                       // match the TCON_IP_V4 DB
   CONNECT      := "DB_Conn_1".Connection;  // pointer to the TCON_IP_V4 struct

7. Add error handling. On every rising edge of ERROR, copy STATUS into a non-volatile diagnostic word and trigger an HMI message. Common status codes are mapped in the next section.
8. Compile, download, and go online. Open the instance DB in watch mode; verify that REQ produces a BUSY cycle, that DONE pulses, and that the data buffer updates.
9. For MB_SERVER, drop the server block into a separate network (or a cyclic OB), wire MB_HOLD_REG to your holding-register DB, and confirm the same IP/port pair that MB_CLIENTs use as the destination. No REQ is needed; the server is event-driven.

Performance Tradeoffs vs PROFINET

PROFINET IRT class 1 on the S7-1200 supports a send clock of 1 ms with cycle times of 2 to 4 ms for typical IO Device configurations. PROFINET RT without IRT typically runs at 4 to 32 ms cycle time, depending on the number of devices and the slot configuration. The PROFINET cycle is hardware-driven and synchronized across the network.

MODBUS TCP is a polled, request/response protocol. The achievable cycle time on the application side is a function of:

• Number of registers requested per transaction (1 to 125 holding registers per FC03 call).
• Number of transactions the application issues per cycle (sequential, no parallelism within a single MB_CLIENT instance; you can run multiple MB_CLIENT FBs in parallel against different partners).
• Network round-trip time: a typical gigabit Ethernet switch adds 10 to 100 microseconds; the partner device's request-processing time dominates and is often 1 to 10 ms.
• TIA Portal scan time of the OB that drives REQ; if you pulse REQ every 50 ms in OB1 and each transaction takes 5 ms, you have a 55 to 60 ms effective loop time.

For motion applications, MODBUS TCP generally updates setpoint and actual-value registers in the 10 to 100 ms range. PROFINET IRT can deliver 2 to 4 ms deterministic updates to a PROFINET drive profile. If the closed-loop stepper (such as the Nanotec PD4-E601L42-E-65-4) is being commanded by position setpoints every 20 to 50 ms and reads back actual position at the same rate, MODBUS TCP is often sufficient. If you need sub-10 ms deterministic updates, PROFINET is the better choice and many drive vendors (including Nanotec, in the PD4-E PROFINET variant) support the PROFIdrive profile over PROFINET.

Diagnostics: STATUS Word Decoding

The STATUS output of MB_CLIENT and MB_SERVER carries a hex code that classifies the failure. Keep these in a fault-matrix tag and expose it to the HMI for the operator. The most useful codes are:

Decoding the STATUS word with a simple case statement gives the operator a clear text on the HMI and turns Modbus into a diagnosable service instead of a black box.

Frequently Asked Questions