S7-1200 Modbus TCP Client Setup with King Pigeon M340T RTD

Configuring an S7-1200 as a Modbus TCP Client for a King Pigeon M340T RTD Module

This reference walks through commissioning a Siemens SIMATIC S7-1200 (CPU 1212C / 1214C DC/DC/DC, firmware V4.5) as a Modbus TCP client that polls a King Pigeon M340T 8-channel RTD acquisition module acting as a Modbus TCP server. The procedure is presented for TIA Portal V17 and the MODBUS_TCP library "v6.0" delivered with the S7-1200 instruction set. Each step includes the parameter, register, or tag involved, the value to enter, and the verification method.

1. System Overview and Architecture

The integration consists of two nodes on the same Ethernet subnet:

• Modbus TCP Client (Master) — S7-1200 CPU 1212C / 1214C, PROFINET interface X1.
• Modbus TCP Server (Slave) — King Pigeon M340T, default listen port 502.

The S7-1200 initiates a TCP connection on port 502, then issues Function Code 04 (Read Input Registers) against the 3xxxx address space of the M340T. Eight temperature values (one per RTD channel) are returned and written into an S7-1200 data block where the user program processes them.

2. Prerequisites

2.1 Hardware

• S7-1200 CPU 1214C DC/DC/DC or 1212C DC/DC/DC, firmware V4.4 or later (V4.5 used in the reference project). CPUs below V4.0 do not include the Modbus TCP v6.0 instruction set.
• King Pigeon M340T 8-channel RTD module with PT100/PT1000/Cu50 sensors wired to channels 1–8.
• Ethernet cable (Cat 5e or higher) connecting the CPU PROFINET port to the M340T RJ-45 port or to a managed switch on the same subnet.
• 24 VDC power supply rated for at least 1.5 A to feed the M340T and the RTD excitation current.

2.2 Software

• STEP 7 / TIA Portal V17 (or V16 Update 4 with the Modbus TCP V6.0 library patch).
• MODBUS_TCP instruction library "v6.0" — installed automatically with TIA Portal V17 for S7-1200 CPU V4.4+.
• Optional: CAS Modbus Scanner or Modbus Poll for bench verification of the M340T before involving the PLC.

3. King Pigeon M340T Register Map

The M340T exposes its data through Modbus Input Registers (function code 04, address prefix 3xxxx). The Modbus Holding Register block (function code 03, 4xxxx) is reserved for configuration parameters and should not be used for polling temperature data. The register map below is reproduced from the official M340T user manual.

4. Engineering the MB_CLIENT Request

The MB_CLIENT instruction in the v6.0 library is configured with the following fixed parameters for this application:

5. Step-by-Step TIA Portal Configuration

1. Create the project and add the CPU. Launch TIA Portal V17, create a new project, then Add new device → Controllers → SIMATIC S7-1200 → CPU → CPU 1214C DC/DC/DC (or 1212C). Confirm firmware V4.4 or later in the order number suffix.
2. Configure the PROFINET interface. Open Device view → CPU → PROFINET interface → Ethernet addresses. Set IP 192.168.0.10, subnet 255.255.255.0, and disable the PROFINET device name (leave empty) since the S7-1200 is acting only as a Modbus TCP client.
3. Insert MB_CLIENT. In the program block (OB1 or a dedicated cyclic OB), drag Instructions → Communications → Others → MODBUS TCP v6.0 → MB_CLIENT onto the network. Place a single instance DB (the wizard creates it automatically) named MB_CLIENT_DB.
4. Create the connection data block. In a new global DB, declare a tag TCON_IP_v4 with the structure type TCON_IP_v4 (found under PLC data types → Communications → Others). Populate the fields:

5. Create the data buffer DB. Add a second global DB (for example RTD_Data) and uncheck "Optimized block access" in the DB properties. Without this step, MB_CLIENT cannot resolve MB_DATA_PTR at compile time and reports 16#80C3 or a build warning. Inside, declare:

DATA_BLOCK "RTD_Data"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
NON_RETAIN
  STRUCT
    Temperatures : ARRAY[0..15] OF WORD;   // 16 words; first 8 used
    RawCounts    : ARRAY[0..7]  OF WORD;   // optional raw ADC buffer
  END_STRUCT;
END_DATA_BLOCK

6. Wire the MB_CLIENT inputs in OB1. Drive REQ with a clock-bit or a periodic task (see Section 7). Pass "RTD_Data".Temperatures as MB_DATA_PTR. Pass the connection structure by reference (AT notation or symbol). The complete call in Structured Text (SCL) for an FB:

// Polling block: OB1 calls this every 200 ms via cyclic interrupt
IF NOT %DB_MB_CLIENT_DB.Busy AND NOT %DB_MB_CLIENT_DB.Error THEN
    "MB_CLIENT_DB"(REQ := TRUE,
                  DISCONNECT := FALSE,
                  MB_MODE := 0,
                  MB_DATA_ADDR := 8,       // 0-based: register 30009
                  MB_DATA_LEN := 8,
                  MB_DATA_PTR := "RTD_Data".Temperatures,
                  CONNECT := "Conn_DB".TCON_IP_v4,
                  TIMEOUT := T#2s);
END_IF;

6. Slave ID and the MBAP Header

Modbus TCP normally does not use the Slave ID byte (Unit Identifier, UID), but the King Pigeon M340T expects a non-zero value, otherwise it discards the request. The UID is not an MB_CLIENT input; it must be hard-coded inside the M340T's own configuration web page.

1. Open a browser and navigate to http://192.168.0.20 (default M340T web interface).
2. Log in with the factory credentials and open Modbus Settings.
3. Set Modbus Slave ID = 1. Any non-zero value in the range 1–247 is acceptable, but both ends of the link must agree.
4. Confirm the listen port is still 502 unless the network policy mandates a non-standard port.

7. Polling Cadence and Timing

The MB_CLIENT is edge-triggered: a single rising edge of REQ issues exactly one transaction. If REQ stays high, the block internally re-triggers as soon as the previous transaction completes, but this prevents user code from reacting to errors. The recommended pattern is:

• Drive REQ from a cyclic interrupt OB (OB30) at a configurable interval. RTD temperatures typically change slowly; 250–500 ms is sufficient.
• Check MB_CLIENT_DB.Done on the next scan after the trigger to read the freshly updated buffer.
• Latch MB_CLIENT_DB.Error into a sticky bit and capture the static STATUS word for diagnostics.

8. Error Code Reference

MB_CLIENT surfaces all errors through the STATUS output word. Some of the codes most frequently seen on a King Pigeon M340T integration are listed below.

9. Troubleshooting Matrix

10. Verification and Commissioning Procedure

1. Bench-test the M340T independently. With the S7-1200 disconnected, point CAS Modbus Scanner at 192.168.0.20:502 with Slave ID 1 and Function 04 starting at 30009. Confirm eight integer values appear and respond to physical changes (heat the PT100 with your hand and watch register 30010 climb).
2. Compile and download to the S7-1200. Use TIA Portal's Compile → Download to device. Open the online watch table and add the buffer DB RTD_Data.Temperatures[0..7] plus MB_CLIENT_DB.Done, MB_CLIENT_DB.Busy, MB_CLIENT_DB.Error, MB_CLIENT_DB.STATUS.
3. Force REQ once. Manually set REQ from the watch table. The block should pulse BUSY for one cycle, then DONE = TRUE, and Temperatures[0..7] should populate.
4. Cross-check values. Compare the values to those seen in CAS Modbus Scanner. They must match exactly; any deviation indicates an address offset.
5. Convert to engineering units. Apply Temp_C[ch] := INT_TO_REAL("RTD_Data".Temperatures[ch]) / 10.0; in a separate FB to obtain degrees Celsius.
6. Verify error handling. Disconnect the Ethernet cable, confirm STATUS rises to 16#80C8 within TIMEOUT, and the sticky error bit latches. Reconnect, confirm STATUS clears within one or two cycles.
7. Stress-test cyclic interrupt. Drop OB30 cycle time to 100 ms for one minute. STATUS must remain 16#0000 throughout; Done must toggle at the requested cadence.

11. Scaling and Out-of-Range Handling

The M340T reports negative temperatures in two's-complement signed 16-bit integers. When the buffer is declared as WORD (unsigned), values below 0 °C appear as 16#8000 through 16#FFFF. Three options are available to the programmer:

1. Declare the buffer as ARRAY[0..7] OF INT instead of WORD. MB_CLIENT will move signed values directly.
2. Keep WORD but apply WordToInt to each element before scaling.
3. Test for 16#7FFF (positive overflow) or 16#8000 (negative overflow / open sensor) before scaling.

// SCL scaling routine
FOR i := 0 TO 7 DO
    IF "RTD_Data".Temperatures[i] = 16#7FFF THEN
        "Process".TempStatus[i] := 16#0001;  // sensor open
    ELSIF "RTD_Data".Temperatures[i] = 16#8000 THEN
        "Process".TempStatus[i] := 16#0002;  // out-of-range high
    ELSE
        "Process".TempC[i]    := INT_TO_REAL(WORD_TO_INT("RTD_Data".Temperatures[i])) / 10.0;
        "Process".TempStatus[i] := 16#0000;  // valid
    END_IF;
END_FOR;

12. Optional: Reading Raw ADC Counts

If you need access to the un-scaled ADC counts at 30001–30008 (for custom linearization, for example), issue a second MB_CLIENT call with MB_DATA_ADDR = 0 and MB_DATA_LEN = 8. The M340T returns the raw 16-bit A/D counts that have not been multiplied by 10 or had any calibration offset applied. The conversion to resistance uses the Steinhart-Hart equation or the PT100 lookup table in IEC 60751. Confirm the wiring for the calibration offset in the M340T web interface before mixing raw and scaled data in the same buffer.

13. Edge Cases and Field Notes

• Mixing MB_CLIENT and MB_SERVER on the same CPU. A single S7-1200 can simultaneously host one MB_SERVER (e.g., for an HMI) and several MB_CLIENT connections. Each MB_CLIENT must use a unique connection ID and a unique instance DB. Sharing the buffer DB between an MB_SERVER read and an MB_CLIENT write is undefined behavior.
• Multiple M340T devices on one CPU. Add one MB_CLIENT instance per M340T. Stagger their REQ triggers by at least one OB30 cycle to avoid overlapping responses on a shared Ethernet segment.
• Firmware V4.5 vs V4.6 differences. CPU firmware V4.6 added extended STATUS codes (16#80C9 for partner-initiated reset) that V4.5 maps to the older 16#80D2 code. Either firmware works for this integration; the codes documented in Section 8 cover both.
• Watchdog reset on network loss. If STATUS has been 16#80C8 or 16#80D2 for longer than 30 s, drop DISCONNECT for one second, then re-establish. Use a separate counter DB to track consecutive failures before triggering a reconnect.
• King Pigeon Modbus RTU master function. The M340T also exposes an RS-485 Modbus RTU master capable of reading external slaves. If this feature is enabled in the M340T web UI, it can collide with the TCP server if both try to write the same internal register. Use the TCP server exclusively unless the Modbus RTU master has been disabled in configuration.

14. Quick-Reference JSON Snippet for the Connection DB

For projects using TIA Portal's Openness API, the connection description can be exported as JSON:

{
  "InterfaceId": 64,
  "ID": 1,
  "ConnectionType": 11,
  "ActiveEstablished": true,
  "LocalDeviceId": 0,
  "LocalTsapId": "01.00",
  "RemoteDeviceId": 0,
  "RemoteTsapId": "02.00",
  "NextStaddr": "192.168.0.20",
  "RemotePort": 502
}

15. Frequently Asked Questions