Modbus TCP/IP to PROFINET Gateway Selection for S7-400H

Overview

Integrating Modbus TCP/IP devices into a PROFINET-controlled S7-400H automation system requires selecting a conversion strategy that aligns with the existing CP 443-1 communications processor hardware. Two primary paths are available: leveraging the native Modbus TCP capability of the CP 443-1 through the Siemens Modbus/TCP block library (entry ID 109749851), or installing a third-party protocol gateway that bridges Modbus TCP/IP and PROFINET IO. This technical reference evaluates both approaches, details configuration procedures for the major gateway families (ProSoft PLX32, Moxa MGate 5103, HMS Anybus X-gateway), and addresses the S7-400H redundancy constraints that govern gateway placement and IP routing.

Architecture Options

Three viable architectures exist for an S7-400H controller with one or more CP 443-1 modules reaching Modbus TCP/IP field devices:

1. Native Modbus TCP on the CP 443-1 using the Siemens Modbus/TCP block library. No additional hardware is required; the existing CP performs the conversion via STEP 7 code and the open TCP SEND/RECEIVE interface.
2. Dedicated protocol gateway in the PROFINET IO line of the CP 443-1 (CP as PROFINET IO Controller, gateway as PROFINET IO Device). The gateway maintains the Modbus TCP client or server side and exchanges cyclic I/O data with the PLC.
3. Two-stage architecture using a LOGO! 8 with the LOGO! CIM (Communication Interface Module) as a small Modbus TCP front-end, with the LOGO! 8 exposing data via PROFINET or hardwired I/O to the S7-400H. This is best suited for low-bandwidth, small-point-count applications.

The CP 443-1 module connects to the S7-400H backplane and can be configured as a PROFINET IO Controller or as a programmable node running open TCP services. The latter role is what the Siemens Modbus/TCP block library uses: the CP opens a configurable number of TCP connections on port 502 and exchanges Modbus Application Data Units (ADUs) with remote Modbus TCP servers or clients.

Native Modbus TCP via the CP 443-1

The CP 443-1 supports open TCP communication that can be configured as a Modbus/TCP client or server using the Siemens Modbus/TCP block library for CP 343-1 and CP 443-1. The library contains function blocks that build Modbus ADUs and submit them through the CP using the SEND/RECEIVE interface (BSEND/BRCV for larger payloads).

Required Components

• STEP 7 V5.5 SP2 or later (for Classic projects), or STEP 7 Professional in TIA Portal V13 SP1 or later for S7-400 targets.
• CP 443-1 with PROFINET interface (6GK7443-1EX4x-0XE0 or 6GK7443-1GX4x-0XE0 recommended for current firmware).
• Modbus/TCP PN-CPU block library from the Siemens Industry Online Support portal.
• Configured TCP connections on the CP 443-1 using the "Open TCP Communication" wizard in NetPro or the TIA Portal devices & networks editor.

Supported Modbus Function Codes

The library implements the most common Modbus function codes for process automation:

CP 443-1 Connection Configuration

For each Modbus TCP device, create an undirected TCP connection pointing from the CP 443-1 to the remote Modbus server's IP address. Use the following parameters:

The library's FBs use the connection ID (hex LADDR or "ID" parameter) to route requests to the appropriate connection. The maximum number of concurrent Modbus TCP connections supported by a single CP 443-1 depends on the CP variant and firmware; CP 443-1 Advanced modules generally support more connections than the standard CP 443-1. Always cross-check the CP's technical data for "Number of connections" and "Number of SEND/RECEIVE resources".

Third-Party Protocol Gateways

When the Modbus TCP device population is large, when the S7-400H does not have an available open TCP resource, or when the commissioning schedule does not allow PLC code development, a dedicated protocol gateway is the preferred solution. The gateway appears on the PROFINET side as an IO Device with a GSDML file and on the Modbus TCP side as a client or server, depending on the model.

Three families dominate this segment:

• ProSoft Technology PLX32-MBTCP-PND — Modbus TCP/IP to PROFINET Device gateway. PROFINET IO Device mode, Modbus TCP Client mode. Industrial DIN-rail enclosure with dual Ethernet ports.
• Moxa MGate 5103 — Modbus RTU/ASCII/TCP/EtherNet/IP to PROFINET gateway. Multi-protocol on the field side, PROFINET IO Device on the control side. 1 or 2 Ethernet ports depending on submodel.
• HMS Networks Anybus X-gateway (AB9007-B) — Modbus TCP Client to PROFINET IO Device. Compact gateway with web-based configuration and the Anybus NP40 network processor.

Other vendors including Advantech offer PROFINET gateways covering similar Modbus RTU/TCP conversion use cases.

Gateway Comparison

ProSoft PLX32-MBTCP-PND Configuration

Topology

The PLX32-MBTCP-PND sits between the CP 443-1 (PROFINET IO Controller) and the Modbus TCP field network. The PROFINET side connects to the CP 443-1 PROFINET port (or to an industrial Ethernet switch if multiple IO Devices are present). The Modbus TCP side connects to the field switches/routers that reach the Modbus TCP servers.

+-------------------+      PROFINET       +-------------+      Modbus TCP      +----------------+
| S7-400H CPU      | -------------------> | PLX32-MBTCP | ------------------> | Modbus TCP     |
| + CP 443-1       |   (IO Controller)   |   -PND      |    (TCP Client)    | Field Devices   |
+-------------------+                      +-------------+                     +----------------+

Configuration Steps

1. Install ProSoft Configuration Manager (PCM) on the engineering workstation. PCM is downloadable from the ProSoft Technology website with a free account.
2. Import the GSDML file for the PLX32-MBTCP-PND into the TIA Portal or STEP 7 hardware catalog.
3. Drag the PLX32-MBTCP-PND into the PROFINET IO line of the CP 443-1. Assign a unique device name and IP address consistent with the PROFINET naming convention (use the PROFINET DCP tool or TIA Portal topology editor).
4. Configure the I/O data slots in the device properties. Each slot can be a defined number of input/output bytes, with a maximum total I/O per gateway enforced by the device firmware.
5. Launch PCM and connect to the PLX32 over Ethernet using its default IP. Configure the Modbus TCP client side: enter the IP address, port 502, slave/unit ID, and the register/holding register/coil mapping for each Modbus device.
6. For each Modbus device, define the read and write transactions: starting register, quantity, function code, and update rate.
7. Map Modbus data points to PROFINET slots. The PROFINET-to-Modbus tag mapping is bi-directional and is configured inside PCM.
8. Download the configuration to the PLX32 and verify PROFINET IO communication by checking the CP 443-1 diagnostic buffer and the gateway's PROFINET status LEDs.

Key Parameters

Moxa MGate 5103 Configuration

Topology

The MGate 5103 acts as a PROFINET IO Device on the S7-400H PROFINET segment and a Modbus master on the field side. The field side accepts Modbus RTU/ASCII/TCP and (in some submodels) EtherNet/IP. The PROFINET side connects directly or via managed switch to the CP 443-1.

Configuration Steps

1. Install MGate Manager for Windows (Moxa's free utility) or use the device's built-in web console.
2. Import the Moxa MGate 5103 GSDML into the TIA Portal / STEP 7 hardware catalog. The GSDML is available on the Moxa product page.
3. Add the MGate 5103 as a PROFINET IO Device on the CP 443-1 IO Controller. Assign the PROFINET device name and IP address via DCP.
4. Configure the PROFINET I/O modules in the device properties. The MGate 5103 typically exposes a small number of pre-defined slot types (e.g., 8-byte input, 8-byte output).
5. Open the web console of the MGate 5103 (default IP printed on the device label). Set the PROFINET device name to match the PLC project.
6. In the "Modbus" section of the web console, define the Modbus commands: enable RTU/TCP/ASCII as needed, set slave ID, function code, register address, and quantity.
7. Save the configuration. Optionally back up the configuration to a MicroSD card (if installed) for quick field replacement.
8. Verify communication: the MGate 5103's "Ready" and "PWR" LEDs should be solid green, the "PROFINET" LED indicates PROFINET IO data exchange, and the "Modbus" or serial LEDs indicate active field transactions.

Key Parameters

HMS Anybus X-gateway Configuration

Topology

The Anybus X-gateway AB9007-B (Modbus TCP Client to PROFINET IO Device) sits in the PROFINET line of the CP 443-1 and connects via a separate Ethernet port to the Modbus TCP field network. The unit is configured entirely through a web browser; no vendor software install is required.

Configuration Steps

1. Power up the Anybus X-gateway. The default IP address is typically 192.168.0.10 (verify against the product datasheet).
2. Connect a laptop to the configuration Ethernet port. Open a browser and navigate to the gateway's default IP.
3. Import the GSDML file for the AB9007-B into the TIA Portal or STEP 7 hardware catalog.
4. Add the Anybus X-gateway to the PROFINET IO line of the CP 443-1. Assign the PROFINET device name and IP address using TIA Portal topology configuration or a DCP tool.
5. Set the Anybus PROFINET device name to match the PLC project. The gateway reboots to apply the new name.
6. In the Anybus web configuration, define the Modbus TCP client transactions: target IP, port 502, slave ID, function code, register range, and polling rate.
7. Map the Modbus data to the PROFINET I/O image. The I/O size is limited to a small number of bytes (typical maximums vary by submodel; check the specific data sheet).
8. Save the configuration and verify data exchange using the CP 443-1 online diagnostics and the gateway's "Live Data" page.

CP 443-1 Communications Processor Specifications

Select the correct CP 443-1 variant before planning the Modbus/TCP integration. The relevant catalog numbers and capability levels are:

For S7-400H redundancy, the system uses two CP 443-1 modules (one per H-station). The H-system manages PROFINET IO with S2 device redundancy for IO Devices that support it, or with single-sided attachment plus a redundancy mode on the CP side. The exact redundancy mode supported by a given CP 443-1 firmware release is documented in the S7-400H communication manual on the Siemens Industry Online Support portal.

S7-400H Redundancy Considerations

When the S7-400H controls a PROFINET segment that includes a Modbus TCP gateway, several redundancy-specific rules apply:

1. Gateway placement: For a non-redundant gateway, attach it to the PROFINET line of the active H-CPU's CP 443-1 only. A failure of the active H-station will break communication with the gateway unless the second CP 443-1 in the standby H-station is also wired to the same PROFINET segment via a managed Ethernet switch.
2. S2 device redundancy: A few gateways on the market support PROFINET S2 (system) redundancy — a single device with two PROFINET ports, one to each H-station. Verify S2 support in the vendor's PROFINET certification documents and GSDML revision.
3. IP addressing: The two CP 443-1 modules have different IP addresses. The PROFINET device name of the gateway must be unique on the segment. Avoid assigning the gateway an IP address in the same subnet as the CP 443-1 management IP if the gateway is meant to be reached only through PROFINET.
4. CP connection resources: Each CP 443-1 has a fixed number of TCP connections available for SEND/RECEIVE. When using the native Modbus/TCP library, plan the number of Modbus devices against the CP's connection resource limit. If more connections are required, install a second CP 443-1 or move to a gateway approach.
5. Diagnostic buffer: In a redundant S7-400H, the diagnostic buffer entries for the CP are written by the active H-CPU. Use the PG/PC interface to "Target system -> Accessible nodes" against both H-CPUs when commissioning.

Diagnostic and Troubleshooting

Selection Decision Matrix

Frequently Asked Questions