MODBUS/TCP Master on Siemens S7-300: CP343-1 Driver and Licensing

Integrating a Siemens SIMATIC S7-300 as a MODBUS/TCP master is not a free, built-in capability. It requires a specific Ethernet communications processor (typically the CP343-1 family), a licensed Siemens "Open MODBUS/TCP" software package (order number 2XV9 450-1MB00), and a working instance of STEP 7 (Classic) or TIA Portal that can load the supplied FBs/FCs onto the CPU. This reference documents the protocol, the hardware matrix, the licensing model, the FB/FC interface, configuration procedure, multi-vendor alternatives, and the field-proven troubleshooting matrix that engineers use when commissioning a CP343-1 against a third-party MODBUS/TCP client or server.

1. MODBUS/TCP Protocol Reference

MODBUS/TCP is the IETF-standardised encapsulation of the legacy MODBUS RTU protocol over TCP/IP, defined in MODBUS Messaging on TCP/IP Implementation Guide V1.0b and now maintained by the Modbus Organization. The application layer is unchanged; the difference is the transport.

1.1 MBAP Header

Every MODBUS/TCP ADU carries a 7-byte MBAP (MODBUS Application) header in front of the PDU:

1.2 Standard Function Codes

1.3 Default Port and Socket Lifecycle

Port 502 is the registered MODBUS/TCP port. The Open MODBUS/TCP driver on S7-300 manages one TCP connection per remote partner. Each partner requires:

• A unique remote IP address
• A configured CP343-1 connection DB
• An instance of the client FB for that connection

2. S7-300/400 MODBUS/TCP Architecture

The S7-300 CPU does not have a built-in Ethernet port with the MODBUS/TCP capability. The architecture is layered:

The licensed driver is downloaded into the CP343-1's firmware and runs in parallel with the standard S7 communication (RFC1006, S7 connections, PROFINET IO). The user FBs in the CPU orchestrate the requests by passing structured data blocks to the CP.

3. CP343-1 Hardware Selection

Not every CP343-1 supports Open MODBUS/TCP. Verify the order number and firmware level before specifying.

4. Open MODBUS/TCP Software Package 2XV9 450-1MB00

Order number 2XV9 450-1MB00 is the Siemens "Open MODBUS/TCP" package for the S7-300 and S7-400 range. The package contains:

• Function blocks (FBs) for client and server roles
• User-defined data types (UDTs) for connection parameters and data buffers
• Example projects in STEP 7 (Classic) format
• PDF manual with call interface

4.1 Licensing Model

The license is bound to a single S7 station (a single CPU). The vendor delivers a non-exclusive-use right, meaning the package can be loaded and run on one CPU at a time. Multiple MODBUS/TCP partners on the same CPU do not require additional licenses; the per-station license is sufficient. To run Open MODBUS/TCP on a second CPU, purchase a second license. The license is priced at roughly EUR 1,000+ in the current Siemens catalog.

4.2 Operating Modes

Mod is the most common mode and is the default in 80%+ of integration projects. Switch to ModB4 only when the partner device specifically requires FC4 (Read Input Registers) or a wider register window.

5. Programming the Client Interface

After installing 2XV9 450-1MB00 into STEP 7 (Classic) or TIA Portal, the package exposes FBs that act as the wrapper around the CP's MODBUS/TCP stack. The interface is structured around a connect/send/receive pattern.

5.1 Data Block Layout (DB "MOD_PARAM")

DATA_BLOCK "MOD_PARAM"
TITLE = MODBUS TCP connection parameters
VERSION : 0.1
NON_RETAIN
  STRUCT
    ip_remote       : ARRAY[1..4] OF BYTE := 192,168,0,50;  // Partner IP
    port_remote     : WORD := W#16#01F6;                    // 502 decimal
    ip_local        : ARRAY[1..4] OF BYTE := 192,168,0,10;  // CP IP
    conn_id         : WORD := W#16#0001;                    // 1..16 per CP
    timeout         : TIME := T#5S;                         // Modbus timeout
    retry_count     : BYTE := B#16#03;                      // Retry on NAK
    mode            : BYTE := B#16#00;                      // 0=Mod, 1=ModB4
  END_STRUCT;
END_DATA_BLOCK

5.2 Sample Client Call in SCL

// Polling cycle: every 200 ms read 10 holding registers from partner
// (FC03 starting at register 40001)
IF "clock_200ms" THEN
  "MOD_PARAM".ip_remote[1]:= 192;
  "MOD_PARAM".ip_remote[2]:= 168;
  "MOD_PARAM".ip_remote[3]:= 0;
  "MOD_PARAM".ip_remote[4]:= 50;     // remote IP = 192.168.0.50

  "MOD_CLIENT_DB"(REQ        := TRUE,
                  ID         := "MOD_PARAM".conn_id,
                  START_ADDR := 1,             // MODBUS addr 40001
                  QUANTITY   := 10,            // 10 holding registers
                  RD_BUF     := "holding_in",  // destination DB
                  DONE       := "mb_done",
                  ERROR      := "mb_error",
                  STATUS     := "mb_status");
END_IF;

5.3 UDT "MOD_HOLDING_IN"

TYPE "MOD_HOLDING_IN"
VERSION : 1.0
  STRUCT
    reg40001 : INT;     // process value 1
    reg40002 : INT;     // process value 2
    reg40003 : INT;     // process value 3
    reg40004 : INT;     // setpoint echoed
    reg40005 : INT;     // status word
    reg40006 : INT;
    reg40007 : INT;
    reg40008 : INT;
    reg40009 : INT;
    reg40010 : INT;
  END_STRUCT;
END_TYPE

6. STEP 7 / TIA Portal Configuration Procedure

1. Install the license. From the Automation License Manager, transfer the license key for 2XV9 450-1MB00 to the CPU's memory card (or to a network license server). Without the key, the driver runs in trial mode for ~14 days, then refuses to start.
2. Insert the CP343-1 in the hardware catalog under the right slot of the S7-300 station. Assign an IP address, subnet mask, and (if used) a router. Do not enable PROFINET IO mode on the port used for MODBUS/TCP unless the same port must also carry PROFINET — the driver co-exists, but performance drops with each enabled service.
3. Set the CP's connection count. The CP supports up to 16 simultaneous TCP connections; reserve at least one connection per MODBUS partner. Each connection requires a connection ID from 1 to 16.
4. Open NetPro / TIA "Devices & Networks". Create an "Open MODBUS/TCP connection" between the CP and the partner IP. Define connection type as "MODBUS", assign the connection ID, and bind the local port to 502 (default) or a custom port if required.
5. Load the supplied FBs into the S7 program. The package includes the client/server FBs and the UDTs. Drag the instance DB into the project, connect it to the connection DB from NetPro.
6. Compile and download the hardware configuration plus the user program. Trigger an initial read with a one-shot REQ from a startup OB (e.g., OB100) to verify connectivity before enabling cyclic polling.
7. Monitor with the CP's online diagnostics. Open the CP's online view → "Connections" → verify the connection state is "Established" and the byte counters increment with each successful transaction.

7. Multi-Vendor Alternatives

When the Open MODBUS/TCP licensing cost is excessive, when the integrator needs to bridge MODBUS/TCP to a Siemens-only protocol (e.g., MPI, PPI), or when a gateway is preferred over a CPU-side driver, two mainstream options exist.

7.1 Schneider Electric Modicon and Momentum

Schneider Electric's Modicon M251 (e.g., TM251MESE) and M221 (e.g., TM221CE24R) controllers include native MODBUS/TCP master and slave capability. M251 logic controllers support up to 8 MODBUS/TCP client connections plus the embedded Modbus server on port 502. SoMachine Basic / EcoStruxure Machine Expert Basic configures the client under Communication → Modbus TCP without an additional license. The same pattern applies to the older Momentum M1E and Premium/Quantum ranges using Unity Pro / EcoStruxure Control Expert. Limitations historically noted in the field: legacy Momentum units expose holding registers only (FC3/FC6/FC16); FC4 (Read Input Registers) and FC2/FC15 (coil access) require a custom block or a firmware version that supports them. Confirm against the specific M1E firmware bundle on the Schneider Electric product page for your part number.

7.2 Red Lion Data Station Plus

For projects that need protocol conversion, data logging, or a virtual HMI between an S7-300 and a third-party MODBUS/TCP master, the Red Lion Data Station Plus (DSP) is a battle-tested option. Three variants exist:

The DSP appears to the MODBUS/TCP master as a standard MODBUS server, and to the S7-300 as an S7 partner on MPI or PROFINET. The G3 HMI line (Graphite series) covers the same role with a built-in touch panel.

8. Multi-Device Polling and Socket Topology

A common question is whether one socket per device is required or whether a single socket can be shared. Per the MODBUS/TCP specification, a single TCP connection carries a single transaction stream — the protocol is request/response and does not multiplex. A second client request on the same socket must wait for the response to the first request. There are two field-proven patterns:

8.1 One Connection per Partner (recommended)

Each partner IP receives a unique connection ID (1..16) on the CP. The CPU instantiates one client FB per partner. This is the standard pattern when integrating vision cameras, drives, or weigh scales that each speak MODBUS/TCP natively. With 7 partners, allocate 7 connection IDs and 7 client FB instances; the polling cycle runs in OB1 (or a faster OB35 / OB38 cyclic interrupt).

8.2 Connect / Disconnect Per Transaction

A few SCADA masters (e.g., some Wonderware and Ignition drivers) open a new socket for each transaction and close it afterwards. This is inefficient on the S7-300 side because the Open MODBUS/TCP driver maintains state per connection. Choose pattern 8.1 unless the partner is on a closed firewall and the S7 is the only initiator — in that case, use the connection-on-demand mode supported by some drivers.

9. Troubleshooting Matrix

10. Field-Commissioning Checklist

1. Verify the CP343-1 firmware level is at least V2.0 (or V3.0 for newer -1GX variants).
2. Confirm the Open MODBUS/TCP license is installed on the CPU's MMC and visible in Automation License Manager.
3. Ping the partner from a laptop on the same VLAN before any PLC work.
4. Capture a baseline Wireshark trace of the partner responding to a manual FC03 request; this becomes the reference ADU for byte-order verification.
5. Bring the S7 program up with REQ=TRUE on a single client FB; check DONE, ERROR, STATUS against the matrix in section 9.
6. Incrementally add more partners, one at a time, validating the byte counters on the CP's online diagnostics after each.
7. Decouple the polling cycle from OB1 if the cycle time exceeds 50 ms — move to OB35 (100 ms default) or OB38 (10 ms default).
8. Document the IP, port, function codes, register map, and timeout on the panel drawing or in the project folder for the next engineer.

11. Notes on Adjacent Platforms

The Open MODBUS/TCP approach is S7-300/400 specific. S7-1200 and S7-1500 use a different path: the MODBUS TCP library (free with TIA Portal) on S7-1500, or the MB_CLIENT / MB_SERVER instructions in TIA Portal V14+ for S7-1200. S7-1500 can also use the PtP (point-to-point) MODBUS library for serial RTU. None of these libraries cross-load onto an S7-300 CPU. If a project migrates from S7-300 to S7-1500, the MODBUS/TCP block set must be re-implemented and the 2XV9 450-1MB00 license retired (or transferred under Siemens' re-use terms, which require a new activation key).

12. FAQ