Modbus TCP Performance on Siemens S7-300/S7-400: Timing Limits

When a process specification demands a 10 ms data refresh between a Siemens S7-400 master and a remote Modbus TCP server, the first engineering question is not whether the wire is fast enough. The wire at 100 Mbps can carry 1 kbit in roughly 10 microseconds. The bottleneck is request/response turnaround, OB cycle time, and the Modbus application layer itself. This reference quantifies what is achievable on a S7-300 PN CPU (e.g. CPU 315-2 PN/DP) and an S7-1200, and presents the deterministic alternatives that reach the 10 ms target.

1. Protocol Stack and Wire-Speed Reality

Modbus TCP (IEC 61158, MBAP + PDU over TCP port 502) is a classic request/response protocol. The frame is small, the network is fast, and yet the end-to-end cycle time is dominated by application scan time, not by the physical layer.

1.1 Frame Anatomy

For a typical "read 16 holding registers" request: 12-byte request, 37-byte response. Total Ethernet bandwidth on the wire for one transaction:

T_wire = (12 + 37) * 8 bits / 100 Mbit/s = 3.92 µs

One kilobit of useful payload is moved in roughly 8 µs at 100 Mbps. The wire is therefore not the bottleneck. The bottleneck is everything between the OB tick and the TCP ACK.

1.2 Request/Response Cycle Components

Figure 1 — End-to-end Modbus TCP transaction timing components.

2. Siemens Library Options for Modbus TCP

Siemens ships two distinct Modbus TCP libraries, and the choice materially affects achievable cycle time.

2.1 S7-300 / S7-400 with PN Interface

For a CPU 315-2 PN/DP or any S7-300/400 with a built-in PROFINET port (or a CP 343-1 / CP 443-1), the standard library is:

• "ModbusTCP" library for PN CPU — order number 6ES7 135-6HD00-0BA1 (delivery on DVD, license key via Automation License Manager). Documentation: Siemens entry ID 109748001.
• Function blocks FB100 MB_REDCL (client, PN CPU), FB101 MB_REDSV (server, PN CPU), and the corresponding instance DBs.
• Configured via STEP 7 V5.5 SP2+ or TIA Portal V13+ on a SIMATIC S7-300/400 station.

The blocks run on the PN controller's internal TCP/IP stack. They do not use the CP 343-1 as a separate router. Throughput is bounded by the CPU's OB1 / OB35 tick and by the maximum number of open Modbus TCP connections on the PN interface.

2.2 S7-1200 Native Modbus TCP

From firmware V4.0 the S7-1200 ships with native Modbus TCP instructions in the "Communication" palette:

• MB_CLIENT — Modbus TCP client (master)
• MB_SERVER — Modbus TCP server (slave)
• Up to 8 active client connections per CPU (firmware V4.2+), each driven from its own instance DB.

Reference manual: S7-1200 System Manual, 09/2019 edition, section 12.4 "Modbus TCP".

2.3 Comparison of Approaches

3. Cycle-Time Drivers

Three classes of variable determine achievable Modbus TCP cycle time on a Siemens S7 master.

3.1 OB Priority and Cycle Time

Modbus TCP clients are normally called from OB1 (free-cyclic, lowest priority) or a timed interrupt OB such as OB35 (default 100 ms, configurable down to 1 ms in TIA Portal). Calling MB_CLIENT / MB_REDCL faster than the worst-case transaction completion causes the same request to be retriggered before the previous response arrives, producing duplicate or stale data, not a faster cycle.

3.2 CPU Loading

OB1 execution time on a CPU 315-2 PN/DP with a typical 200-step user program is 3–8 ms. Adding MB_REDCL plus array marshalling raises the OB1 floor toward 10 ms. Cyclic interrupt OBs cannot run faster than the main OB1 finishes, because STEP 7 serializes OB dispatch.

3.3 Server Turnaround Time

The remote Modbus TCP server must process the request, access its register map, and reply. A Schneider M340, Wago 750-352, or any third-party slave typically requires 5–25 ms. The "round-trip time" reported by MB_CLIENT's DONE/ERROR timing is the sum of all of the above plus the TCP ACK round trip on the network.

4. Calculating Achievable Request Rate

A common engineering shortcut: each Modbus TCP transaction requires at least one OB cycle. The cycle budget is:

f_max = min( 1 / T_OB, 1 / T_tx, 1 / T_server, 1 / T_RTT )

For an S7-300 PN CPU with:

• OB1 cycle time: T_OB = 10 ms (with MB_REDCL loaded)
• Stack TCP/IP transaction time: T_tx = 8 ms (incl. connect, send, ACK, disconnect logic)
• Server turnaround: T_server = 10 ms
• LAN round-trip: T_RTT = 0.5 ms

f_max = min(100, 125, 100, 2000) req/s
      = 100 req/s (theoretical)

Field experience is materially lower. Siemens forum moderators and Siemens application engineers routinely cite ~20 requests per second per connection, equating to ~50 ms per request. The factor-of-five difference between theory and practice is absorbed by:

1. Server scan latency (often >> advertised value).
2. Stack buffering — the client waits for a free socket before issuing the next request.
3. Lost-connection retries (TCP keepalive, transient drops).
4. OB scheduling jitter when the user program grows.

5. Will a 10 ms Refresh Work?

Decision matrix for a 1 kbit payload (≈ 16 holding registers or 128 discrete bits) at a 10 ms cycle.

6. Migration Path: PROFINET for Deterministic I/O

PROFINET IRT (Isochronous Real Time) on a CPU 315-2 PN/DP or higher supports update times from 250 µs upward, with jitter under 1 µs, when the IO device is configured as an IRT slave. For the 10 ms target:

1. Replace the Modbus TCP server with a PROFINET IO device (e.g. ET 200SP, ET 200MP, or a third-party PROFINET slave certified to PN Spec V2.3+).
2. Configure a PROFINET IO system with a 10 ms send clock on the S7-300 PN controller.
3. Map I/O directly into the process image — no application-layer marshalling required.

Reference: PROFINET System Description, Siemens entry 49948856.

6.1 PROFIBUS Alternative

If the field wiring already exists as RS-485, PROFIBUS DP on a CPU 315-2 PN/DP or CP 342-5 reaches 1.5 ms bus cycle at 12 Mbaud with up to 125 µs jitter. PROFIBUS is the most widely deployed deterministic fieldbus in Siemens installations and remains the lowest-friction migration target when 10 ms is required and PROFINET cabling is not in place.

7. Commissioning Procedure (Modbus TCP Path)

Use this procedure when the Modbus TCP path is required and a 50 ms cycle is acceptable.

7.1 Prerequisites

• STEP 7 V5.5 SP2+ or TIA Portal V15.1+
• S7-300 / S7-400 CPU with firmware supporting the Modbus TCP PN CPU library, or an S7-1200 firmware V4.0+
• Static IP addressing (DHCP not recommended for industrial controllers)
• Modbus TCP server reachable on TCP/502

7.2 Step-by-Step Configuration (S7-300 PN)

1. Install library "ModbusTCP PN CPU" (6ES7 135-6HD00-0BA1) via Automation License Manager.
2. In STEP 7, open the S7 program and insert FB100 MB_REDCL with its instance DB (e.g. DB100).
3. Configure the connection in the block's input CONNECT using the structure: {IP: '192.168.0.10', Port: 502, UnitID: 1}.
4. Set REQ = TRUE every OB1 scan; gate the trigger in OB35 if you want a fixed period.
5. Wire MB_DATA_PTR to a data block of WORD elements large enough for the largest request.
6. Compile and download.
7. From the online watch table, force REQ and observe DONE / ERROR / STATUS.

7.3 Step-by-Step Configuration (S7-1200)

1. Open the device configuration of the S7-1200 in TIA Portal.
2. Enable the CPU's PROFINET interface for Modbus TCP (no extra option needed from V4.0).
3. Insert MB_CLIENT from the Instructions panel under "Communication → Modbus TCP".
4. Assign instance DB (e.g. MB_CLIENT_DB).
5. Set CONNECT parameter: {IP: '192.168.0.10', Port: 502, UnitID: 1}.
6. Set REQ = TRUE from OB35 (configure OB35 to 50 ms for a safe baseline).
7. Download and go online.

8. Verification

After commissioning, verify timing on the live system.

8.1 OB Cycle Check

In the online diagnostic of the S7 CPU (right-click → "Operating Mode → Module Information"), read the OB1 minimum and maximum cycle times. Maximum cycle time must remain below 80% of the Modbus TCP period; otherwise the watchdog will trip and the CPU will go to STOP with SF diagnostics.

8.2 Request Rate Measurement

Wrap a free-running TIME counter around the REQ edge and log the elapsed time to a buffer of the last 1000 transactions. Compute the median and 95th percentile. A healthy S7-300 PN CPU with a single Modbus TCP connection should report a median transaction time between 45 and 60 ms.

8.3 Network Verification

• Wireshark capture on a mirror port; filter by tcp.port == 502.
• Confirm TCP keepalive is enabled on the S7 CPU (TIA Portal: properties → PROFINET interface → Advanced options → Keep-Alive interval = 30 s).
• Confirm no spurious TCP resets (server would log error 10054 or similar).

9. Diagnostics — Status Words

MB_CLIENT and MB_REDCL both return a STATUS word. The most common values are:

10. Troubleshooting Matrix

11. Field-Proven Caveats

• OB1 priority — calling MB_CLIENT in OB1 of a heavily loaded S7-300 will silently slow the bus scan. Always prefer a timed interrupt OB.
• One connection per FB — FB100 in the ModbusTCP PN CPU library supports one TCP connection per instance. Up to 16 instances may be loaded, but each requires its own IP/port pair on the server.
• PN interface only — the Modbus TCP PN CPU library does not work on the CP 343-1's external interface; the PN controller must be the one running the FB.
• Firewall — some plant networks block TCP/502. Verify with telnet <server_ip> 502 from a laptop on the same VLAN.
• Watchdog — the S7-300 default OB1 watchdog is 150 ms. Heavy Modbus traffic plus a long-running FB can trip it. Raise to 500 ms during commissioning, then back down once steady-state is proven.
• Vendor interoperability — Modbus TCP is "open" only on the wire; function codes 0x2B (encapsulated interface transport, used by Schneider and Phoenix) are not supported by the Siemens library and will return 0x818B.

12. FAQ