S7-1200 to Mitsubishi FX5U Communication: Modbus TCP & SLMP Setup

Overview

The Siemens SIMATIC S7-1200 CPU 1214C DC/DC/DC and the Mitsubishi MELSEC iQ-F FX5U exchange process data over standard industrial Ethernet using three documented transports: Modbus TCP (IETF RFC for industrial control), Mitsubishi SLMP / MC Protocol 3E frame (on TCP port 2000), and CC-Link IE Field Basic (cyclic I/O on UDP 61450). All three ride on the CPUs' built-in Ethernet port; no additional Ethernet module is required on the FX5U when the application bandwidth stays below the native socket capacity of the CPU and the FX5U model is the -ES or later suffix.

The selection between the three is driven by data volume, determinism, and which PLC is the master. Modbus TCP is the most portable, has the smallest learning curve, and ships with ready-made function blocks in TIA Portal (MB_CLIENT, MB_SERVER) and GX Works3 (the M+FX5-MODBUSTCP-Master/Slave library, or the legacy SP.ECPRTCL instruction). SLMP is the lowest-friction choice when the FX5U is the master because the SLMP client is built into the FX5U's protocol stack. CC-Link IE Field Basic is the right answer when cyclic refresh of a fixed I/O map is required; it needs an FX5-ENET or FX5-ENET/IP module on FX5U-16MR/32MR CPUs, while the FX5U-32MT/ES and FX5U-64MT/ES have the master built in.

This reference documents the configuration, function block parameters, and verification procedure for each path, with worked examples using an S7-1200 CPU 1214C DC/DC/DC on firmware V4.6 and an FX5U-32MT/ES on firmware V1.060, running on TIA Portal V18 and GX Works3 V1.085R. Always cross-check the version-specific behaviour against the latest manuals.

Communication Path Comparison

Choose Modbus TCP when you need the simplest data exchange with at most a few hundred registers, no strict cycle time, and want to keep the FX5U's I/O comments visible in TIA Portal through CSV import/export. Choose SLMP when the FX5U is the master and you want the lowest possible round-trip time on a LAN. Choose CC-Link IE Field Basic when you need deterministic cyclic I/O refresh, particularly for high-speed handshakes where the FX5U is reading a fixed group of inputs from the S7-1200 every cycle.

Prerequisites

Hardware

• S7-1200 CPU 1214C DC/DC/DC, firmware V4.4 or later (V4.4+ required for the Modbus TCP FBs in TIA Portal V16+; V4.6+ recommended for the CC-Link IE Field Basic library).
• FX5U-32MT/ES or FX5U-64MT/ES (built-in Ethernet port). For CC-Link IE Field Basic on FX5U-32MR/16MR, an FX5-ENET or FX5-ENET/IP module is required.
• CAT5e or better Ethernet cable; managed switch recommended (CC-Link IE Field Basic uses multicast and benefits from IGMP snooping).
• 24 VDC power supply for both PLCs and the switch.

Software

• TIA Portal V18 (or V17 with the latest HSP for the FX5U profile).
• GX Works3 V1.085R or later.
• MELSEC iQ-F FX5 User's Manual (Communication), document SH-082625ENG.
• Siemens "MODBUS TCP" library (bundled with TIA Portal).
• Mitsubishi "FX5 Modbus/TCP Communication" library, downloadable from the Mitsubishi Electric FA e-Manual site (Mitsubishi Electric FA).

Network plan

• S7-1200 IP: 192.168.0.10 / 24.
• FX5U IP: 192.168.0.20 / 24.
• Both CPUs on the same subnet; no router between them for Modbus/TCP and SLMP tests.
• Windows Firewall on the engineering PC must allow TCP 502 and TCP 2000 outbound for live testing.

Network Topology

Method 1 — S7-1200 as Modbus TCP Client, FX5U as Modbus TCP Server

1.1 Configure the FX5U Modbus TCP Server

In GX Works3, open the FX5U project and navigate to Navigation → Parameter → FX5U Module → Ethernet Port → External Device Configuration / Protocol Setting.

1. Set the FX5U IP address to 192.168.0.20, subnet mask 255.255.255.0.
2. Add a new connection in the Ethernet Configuration window. Select MODBUS/TCP Server as the protocol; leave the port at 502.
3. Open CPU Parameter → FX5 → Modbus/TCP Server and assign the starting Modbus register (4xxxx range) to a known data register, e.g., D1000. The FX5U maps D1000..D1249 to Modbus holding registers 400001..400250.
4. Add the FX5 Modbus/TCP server FB to the program: drag M+FX5ModbusTcpServer (or the legacy SP.ECPRTCL-based block) into a POU. The instance DB is auto-generated.

1.2 Configure the S7-1200 Modbus TCP Client

In TIA Portal, open the S7-1200 project:

1. In Devices & Networks, open the S7-1200 CPU properties → PROFINET interface → Ethernet addresses. Set IP to 192.168.0.10/24 and disable "Use router".
2. Under PLC programming → Libraries, ensure the "MODBUS TCP" global library is loaded (it ships with TIA Portal V16+).
3. Insert the MB_CLIENT function block in a cyclic OB (e.g., OB1). The block is found under Instructions → Communication → MODBUS TCP.
4. Wire the block as follows (values are sample values for reading the FX5U D1000 register mapping):

MB_CLIENT_DB
  REQ         := TRUE                // trigger one read on rising edge
  DISCONNECT  := FALSE               // keep connection alive
  CONNECT_ID  := 1                   // connection resource 1
  IP_OCTET_1  := 192
  IP_OCTET_2  := 168
  IP_OCTET_3  := 0
  IP_OCTET_4  := 20
  IP_PORT     := 502
  MB_MODE     := 0                   // 0 = read, 1 = write
  MB_DATA_ADDR:= 0                   // 0-based offset into FX5U holding register area
  MB_DATA_LEN := 10                  // 10 words = 20 bytes
  DATA_PTR    := P#DB10.DBX0.0 BYTE 20
  DONE        -> M100.0
  BUSY        -> M100.1
  ERROR       -> M100.2
  STATUS      -> MW102

5. Create a global data block (DB10) with at least 10 WORD fields (e.g., fx5u_data[0..9]). Pass its pointer to DATA_PTR.

1.3 Trigger and Verify

Add a rising-edge from a clock bit (or one-shot from the CPU's first scan) to REQ to issue a single read. Watch the MB_CLIENT status word:

• DONE = TRUE, STATUS = 16#0000 → read succeeded.
• ERROR = TRUE, STATUS = 16#80C8 → connection timeout.
• STATUS = 16#80B1 → no TCP connection (FX5U not listening, wrong port, wrong IP, or PC firewall).

Force D1000 in the FX5U to a known value (e.g., 1234), run the read, and confirm DB10.DBW0 = 1234 in the S7-1200 watch table.

Method 2 — FX5U as Modbus TCP Client, S7-1200 as MB_SERVER

2.1 Configure the S7-1200 Modbus TCP Server

1. Add the MB_SERVER FB to OB1. The FB is in the same library as MB_CLIENT.
2. Configure the instance DB to allow 1–4 simultaneous connections (default is 1). The MB_SERVER listens on port 502 of the CPU's PROFINET interface.
3. Define the holding register area as a global DB. Typical: DB20 of type ARRAY[0..99] OF WORD. Map this DB to the MB_SERVER's DATA_PTR (P#DB20.DBX0.0 BYTE 200).
4. By default, MB_SERVER accepts connections from any IP in the same subnet. For tighter control, use the "Connection resource" parameters in the CPU properties to limit to the FX5U's IP.

2.2 Configure the FX5U Modbus TCP Client

1. Add a M+FX5ModbusTcpClient instance or build with SP.ECPRTCL.
2. Configure: remote IP 192.168.0.10, port 502, function code 03 (read holding register), slave/unit ID 0xFF, starting register 0, quantity 10.
3. The function block returns data into a label array, e.g., uData[0..9]: WORD.

2.3 Verification

Write a value into DB20.DBW0 in the S7-1200, trigger a read from the FX5U, and confirm the corresponding D-register in the FX5U shows the new value within one cycle of the request. In GX Works3, the Module Diagnostics → Ethernet Diagnostics window shows the active connection count and partner IP.

Method 3 — SLMP (3E Frame) Communication

SLMP (Seamless Message Protocol) is Mitsubishi's TCP/IP implementation of the MC Protocol. The FX5U supports the 3E frame on TCP port 2000. The S7-1200 has no native SLMP client/server, so the open user communication blocks (TCON, TSEND, TRCV, TDISCON) are used to build the 3E-frame request/response by hand. The full 3E frame is specified in the MELSEC iQ-F FX5 Communication Manual, document SH-082625ENG, chapter 9 (SH-082625ENG).

3.1 S7-1200 as SLMP Client (Reading FX5U D-Registers)

In GX Works3, enable the SLMP server on the FX5U:

1. Parameter → FX5U Module → Ethernet Port → SLMP Function: set Enable SLMP Function to Enable.
2. Default port is 2000. The CPU will respond to 3E-frame commands 0401 (batch read) and 1401 (batch write).

In TIA Portal, insert the open user communication blocks: TCON, TSEND, TRCV, TDISCON. Place them in OB1 or a dedicated OB.

1. Create a connection DB (T_CON_PARA structure) and fill in:
   • InterfaceId := 64 (decimal) for the PROFINET interface
   • ID := 1
   • ConnectionType := 16#0B (TCP/IP)
   • ActiveEstablished := TRUE (S7-1200 initiates)
   • RemoteAddress := W#16#C0A80014 (192.168.0.20)
   • RemotePort := 2000
   • LocalPort := 0 (system-assigned ephemeral)
2. The send buffer is built as a 3E frame in a global DB. The first 11 bytes form the request header (sub-header + addressing), followed by the command-dependent data.

3.2 SLMP 3E Batch Read Frame (Command 0401)

Total request frame: 23 bytes. The S7-1200 ST code below builds the request in a global DB byte array:

// S7-1200 ST — Build SLMP 3E read request for D1000, 10 words
REQ : ARRAY[0..22] OF BYTE;
REQ[0]  := 16#00;  REQ[1]  := 16#50;   // sub-header 0x5000
REQ[2]  := 16#00;                       // network no.
REQ[3]  := 16#FF;                       // PC no.
REQ[4]  := 16#FF;  REQ[5]  := 16#03;   // module I/O 0x03FF
REQ[6]  := 16#00;                       // station no.
REQ[7]  := 16#0C;  REQ[8]  := 16#00;   // request data length = 12
REQ[9]  := 16#01;  REQ[10] := 16#00;   // monitoring timer 250 ms
REQ[11] := 16#01;  REQ[12] := 16#04;   // command 0x0401
REQ[13] := 16#00;  REQ[14] := 16#00;   // sub-command word access
REQ[15] := 16#E8;  REQ[16] := 16#03;
REQ[17] := 16#00;  REQ[18] := 16#00;   // head device = 1000 = D1000
REQ[19] := 16#A8;  REQ[20] := 16#00;   // device code D register
REQ[21] := 16#0A;  REQ[22] := 16#00;   // number of points = 10

Issue the request on a 1-second clock bit and parse the response. The response begins with sub-header 0xD000; if the end code at offset 9–10 is 0x0000, the read succeeded and the device data follows starting at offset 11.

3.3 FX5U as SLMP Client (Reading S7-1200 DB)

Use the built-in SP.ECPRTCL instruction in GX Works3, with the protocol configured for MC Protocol (3E Frame) client.

1. Set partner IP to 192.168.0.10 and partner port to 2000. (The S7-1200 TCON configuration must listen on 2000.)
2. Configure the request packet as a 3E-frame read, head device "DB", DB number 10, offset 0, length 10.
3. The SP.ECPRTCL block returns a "Complete" flag and a "Send/Receive Done" flag; route the data into a D-register array.

Method 4 — CC-Link IE Field Basic

CC-Link IE Field Basic is a 1 Gbps Ethernet-based protocol for cyclic I/O and transient messaging, intended for lower-cost networks than full CC-Link IE. The FX5U participates natively as a master; the S7-1200 participates as a slave or master using the Siemens FB library "CC-Link IE Field Basic" that is part of TIA Portal V18 (or downloadable as an HSP).

4.1 FX5U as Master

1. In GX Works3, Parameter → FX5U Module → Ethernet Port → CC-Link IE Field Basic: set Number of Slaves to 1, set Slave 1 IP to 192.168.0.10, and assign the RWr / RWw points (e.g., 16 words in each direction).
2. The FX5U CPU automatically opens UDP socket 61450 to the slave and begins cyclic refresh.
3. Map the FX5U points to D-registers: e.g., D200..D215 are RX (output from master to slave), D300..D315 are RY (input to master from slave).

4.2 S7-1200 as Slave

1. In TIA Portal, install the CC-Link IE Field Basic library and instantiate the slave FB.
2. Configure the slave IP, the number of occupied stations (1), and the data size (16 RWw and 16 RWr).
3. The library automatically maps the cyclic data to a configured global DB (e.g., DB30 of type ARRAY[0..15] OF WORD for both directions).

4.3 Verify

Once the network is online, the FX5U's CC-Link IE Field Basic Diagnostics window will show the slave IP, the cyclic state, and any station errors. On the S7-1200 side, the library exposes a "Cyclic State" tag that turns green when running. Both PLCs should reflect the same word values in their respective mapped areas.

CPU Model & Firmware Matrix

Always verify the exact minimum firmware for your CPU revision in the manual's "Version History" appendix; Mitsubishi reserves the right to gate functions on specific production lot suffixes.

Data Type Handling

Modbus TCP is fundamentally 16-bit oriented. For 32-bit values (DWORD, REAL/float), the FX5U and S7-1200 need to agree on word order:

• Big-endian (Motorola): the high word of a REAL is at the lower Modbus address. The default for Mitsubishi D-registers and the default for S7-1200 MB_CLIENT when reading into a Dword array is "big-endian above the word" — meaning D200 holds the high word of the first REAL, D201 the low word.
• Little-endian (Intel): the low word is at the lower Modbus address. The S7-1200's MB_CLIENT with the standard DATA_PTR does not swap words; the application must do the swap in the PLC program with WORD_TO_BLOCKWORD / SWAP instructions or by reading into a ARRAY[0..n] OF WORD and recombining into REAL.

For SLMP, the 3E frame returns data in the natural byte order of the destination device; for D-registers this is word-swapped (high word first) by default. Confirm against the FX5 Communication Manual (SH-082625ENG) section 9.2 if you intend to read REALs across the boundary.

Connection State Machine (Modbus TCP Client)

Verification Checklist

• S7-1200 reachable on PROFINET interface (ping 192.168.0.10 from engineering PC).
• FX5U reachable (ping 192.168.0.20 from engineering PC).
• Both PLCs and engineering PC in same subnet, no duplicate IPs.
• MB_CLIENT / MB_SERVER DONE flag toggling, STATUS = 16#0000.
• Modbus/TCP server library in GX Works3 reports Open status and active connection count > 0.
• SLMP request returns 0xD000 in the sub-header (success); 0xC051 or C056 indicates a device range error.
• CC-Link IE Field Basic cyclic state = Operating on both sides, no station errors in the diagnostics.
• Disconnect the Ethernet cable mid-operation and verify the client-side status changes to a defined error code within the configured timeout (Modbus TCP default 5 s; SLMP monitoring timer default 1 s).

Troubleshooting Matrix

Performance Notes

Modbus TCP round-trip on a 100 Mbit LAN with no load is typically 8–15 ms per request. For a master polling 100 words from one slave every cycle, expect about 200–400 ms total cycle time at 100% link utilization. SLMP 3E frame is comparable, with the FX5U achieving 3–8 ms request-to-response on a clean LAN because of its smaller header and direct kernel handling. CC-Link IE Field Basic is the fastest and most deterministic option, with cyclic refresh intervals configurable from 1 ms to 100 ms and a guaranteed broadcast delivery on every cycle.

If more than a handful of MB_CLIENT connections are required, verify the S7-1200 firmware revision's open-communication resource limit (firmware V4.5+ supports more concurrent connections than earlier revisions; check the CPU's technical data sheet for the exact number).

Safety and Watchdog Configuration

Both PLCs require an independent safety stop circuit at the system level (not over Ethernet). The MELSEC iQ-F FX5 User's Manual (Communication), document SH-082625ENG, states explicitly that "external safety circuits must be installed outside the PLC to ensure safe system operation even during external power supply problems or PLC failure" (SH-082625ENG, section 1.2). This is true for the communication modules as well. Never route an emergency-stop signal over Modbus TCP, SLMP, or CC-Link IE Field Basic; route it as a hardwired input to both PLCs and interlock the actuators at the contactor level.

In TIA Portal, configure a keep-alive / connect-monitor time for the MB_CLIENT and a maximum request timeout for the open user communication. In GX Works3, set the SLMP "Monitoring Timer" to a value that matches the application's maximum allowable data staleness (e.g., 250 ms for a high-speed handshake, 4 s for slow telemetry).

FAQ