S7-300 as Multi-Protocol Data Hub for S7-1200 Networks

Overview and Network Topology

The classic industrial automation requirement of running Profinet, Profibus DP, Modbus TCP, and Modbus RTU inside one logical network is solvable on a Siemens S7-300 / S7-1200 platform. The architecture uses an S7-300 CPU 314C-2 DP as the central data hub: the CPU aggregates incoming values from each field protocol in a single memory image and re-distributes that image to the participating S7-1200 stations (6ES7214-1BG40-0XB0 family, DC/DC/Rly and AC/DC/Rly variants) over the same or parallel physical layers.

This article covers the full engineering path:

• OSI and TCP/IP layering proof that the four protocols can share one Ethernet segment where appropriate, and the physical separation required for RS-485.
• Concrete hardware and module selections, including order numbers, for S7-300 314C-2 DP, S7-1200 1214 AC/DC/Rly, and the communications modules needed to cover all four protocols on each side.
• Block-level TIA Portal programming for Modbus TCP (MB_CLIENT / MB_SERVER), Modbus RTU (MB_COMM_LOAD + MB_MASTER / MB_SLAVE), Profinet S7 communication (PUT / GET), and Profibus DP master/slave configuration.
• Data exchange architecture, memory mapping rules, and diagnostic procedures.

OSI Model Considerations for Mixed Protocols

A common engineering misconception is that two protocols must each occupy a physically distinct cable. The OSI model clarifies this: each frame captured at the physical layer carries multiple headers, one per active layer-2 to layer-7 protocol, stacked according to the encapsulation rules of the suite in use. This is documented in the Cisco Learning Network explanation of multiple protocols in a single frame.

Consequences for this network:

• Profinet and Modbus TCP are both TCP/IP applications running on Ethernet (IEEE 802.3) and share the same physical media. The two can be active on a single Profinet port simultaneously; the CPU stack demultiplexes frames on port number (Profinet uses UDP 34964/49152/49153, Modbus TCP uses TCP 502).
• Modbus RTU is a serial, RS-485 protocol using EIA-485 (TIA-485) as physical layer. It cannot be multiplexed with Profibus DP on the same RS-485 wire, even though Profibus DP also uses EIA-485, because the two protocols use incompatible framing, baud-rate negotiation, and bus arbitration. They require separate RS-485 segments.
• Profibus DP uses the same EIA-485 physical layer as Modbus RTU but a different signaling scheme (RS-485 with 9.6 kbit/s to 12 Mbit/s, half-duplex, async UART for Modbus RTU vs. synchronous HDLC for Profibus DP). Keep one bus per protocol.

Hardware Selection and Part Numbers

The following order numbers are catalog references, not stock. Always confirm the active catalog revision with the Siemens Industry Mall before ordering.

If the S7-300 hub must also host a Profinet line, the alternative is the S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0), which integrates both Profinet and Profibus DP. The original question specifies the 314C-2 DP variant, so the examples below use a CP 343-1 Lean for the Ethernet side and a CP 341 for RS-485.

S7-300 314C-2 DP as Central Data Hub

The hub concept: every PLC pushes its measurements into a tagged data block on the S7-300. Every other PLC pulls (or is pushed) the consolidated values from the same block. This pattern removes protocol translation from the S7-1200 side and keeps the gateway logic in a single, debuggable place.

Recommended DB layout on the S7-300 hub:

DATA_HUB      DB 100
  STRUCT
    Net_1  : ARRAY[1..32] OF WORD;   // values from S7-1200 #1 over Profinet
    Net_2  : ARRAY[1..32] OF WORD;   // values from S7-1200 #2 over Modbus TCP
    Net_3  : ARRAY[1..32] OF WORD;   // values from S7-1200 over Profibus DP
    Net_4  : ARRAY[1..32] OF WORD;   // values from S7-1200 over Modbus RTU
    Diag   : STRUCT
      LastProfinetError  : WORD;
      LastModbusTCPErr  : WORD;
      LastProfibusErr   : WORD;
      LastModbusRTUErr  : WORD;
    END_STRUCT;
  END_STRUCT
END_DATA_HUB

Keep each protocol-local data set in its own sub-array. This isolates protocol-specific diagnostics and lets you scale the data width independently for each link.

Profinet Configuration (S7-300 Hub ↔ S7-1200)

The S7-300 314C-2 DP has no integrated Profinet port. Add a CP 343-1 Lean (6GK7343-1CX10-0XE0) and configure it as Profinet IO controller. The two S7-1200 stations use their on-board PROFINET interface as IO device.

1. Insert the CP 343-1 Lean in the S7-300 device configuration and assign it IP 192.168.0.10 / 255.255.255.0. The CP must be set to PN-IO mode with IO controller role.
2. On each S7-1200, drag the CPU into the PN subnet. The S7-1200 CPU in the role of IO device is enabled under Properties → PROFINET interface → Operating mode → IO device.
3. In the CP 343-1 Lean device view, drag each S7-1200 into the IO system. Assign a unique device name (e.g. s71200-pn-1) and an IP address (e.g. 192.168.0.11).
4. Configure cyclic IO: define one input module of 8 bytes and one output module of 8 bytes per S7-1200 in the device view of the CP 343-1. The IO addresses are mapped into the S7-300 process image, e.g. IB 0..7 / QB 0..7 for station 1 and IB 8..15 / QB 8..15 for station 2.
5. Transfer the configuration. The S7-1200 retains its device name only when its PROFINET interface is bound to the TIA Portal project; use Online → Accessible devices → Assign PROFINET device name if the name has been cleared.

For cross-program data exchange inside the S7-300 hub, copy the cyclic IO into DB 100. In OB1:

// Copy PN input area into hub data block (sample for station 1)
FOR #i := 0 TO 15 DO
  "DATA_HUB".Net_1[#i] := WORD_TO_INT(IB[#i]);
END_FOR;

Profibus DP Configuration (S7-300 Master ↔ S7-1200 Slave)

The S7-300 314C-2 DP integrated Profibus interface is the DP master. The S7-1200 cannot be a Profibus master, only a slave, so add a CM 1242-5 (6GK7242-5DX30-0XE0) to each S7-1200 that must appear on the DP bus.

1. In the S7-300 device configuration, mark the integrated DP interface as DP master. Insert the CM 1242-5 GSD file (Siemens DP slave GSD) into the TIA Portal hardware catalog under Other field devices → PROFIBUS DP → I/O.
2. Drag the CM 1242-5 onto the DP master line. Assign DP address 3 (and 4 for the second S7-1200). Define the slot mapping: 8 bytes input / 8 bytes output per station.
3. On the S7-1200, the CM 1242-5 must match the slot configuration set on the master. In its properties, set the DP slave address to match and verify the I/O lengths agree.
4. Compile and download. Verify in the online diagnostics that the DP slave shows DP slave OK and that the input/output slots are exchanging data.

DP data also lands in the S7-300 process image (e.g. IB 16..23 / QB 16..23 for slave address 3). Mirror these into DB 100 the same way as the Profinet data.

Modbus TCP Configuration (S7-300 Hub ↔ S7-1200)

Modbus TCP runs over the same Ethernet segment as Profinet. On the S7-300 side, use the CP 343-1 Lean in Modbus-TCP-capable firmware; the Modbus TCP library is available from the TIA Portal library under Libraries → Communication → MODBUS TCP. The relevant FB is MB_CLIENT (or its S7-300 equivalent, FB 108 'MB_CLIENT' shipped with the SIMATIC Modbus/TCP CP package).

On the S7-1200 side, use the TIA Portal library Modbus_TCP blocks MB_CLIENT and MB_SERVER. The S7-1200 typically plays the role of Modbus TCP server (slave) and is polled by the S7-300 master.

1. Install the "SIMATIC Modbus/TCP" package on the CP 343-1 Lean (license key required; ships with the CP in current revisions).
2. On the S7-300, instantiate FB 108 MB_CLIENT in OB1. The data block that MB_CLIENT reads from the S7-1200 holding register area 40001..40032 is copied into DB 100 at startup of OB1 or cyclically every 100 ms.
3. On each S7-1200, drop an MB_SERVER instance. Wire MB_SERVER.DB to a data block that mirrors the local process image. The connection ID must match what the hub uses in MB_CLIENT.
4. Set MB_MODE = 1 (read holding registers) and MB_DATA_ADDR = 1 to read 32 words starting at address 40001.

Example S7-300 SCL instance call:

// Modbus TCP read from S7-1200 #2
"mb_client_hub"(
  REQ            := TRUE,
  CONT           := TRUE,
  ID             := 2,
  IP_OCTET_1     := 192,
  IP_OCTET_2     := 168,
  IP_OCTET_3     := 0,
  IP_OCTET_4     := 12,
  IP_PORT        := 502,
  MB_MODE        := 1,            // 0=read, 1=write
  MB_DATA_ADDR   := 1,            // holding register 40001
  MB_DATA_LEN    := 32,
  DATA_PTR       := P#DB100.DBX 100.0 BYTE 64,
  DONE           => #done,
  BUSY           => #busy,
  ERROR          => #err,
  STATUS         => #status);

The destination DATA_PTR points into DB100; copy the 64 bytes (32 words) into DB100.Net_2[] with a simple block move.

Modbus RTU Configuration

Modbus RTU requires a dedicated RS-485 segment. S7-1200 connects via CM 1241 RS-485; S7-300 connects via CP 341 with the Modbus master driver on the EPROM (or via a CM PtP + free ASCII driver with manual Modbus framing, which is not recommended for production).

1. Plug the CM 1241 RS-485 (6ES7241-1CH32-0XB0) into the S7-1200. Configure the port at 19200 bit/s, 8E1, full-duplex disabled.
2. On the S7-1200, instantiate the library blocks MB_COMM_LOAD (one per CM) and MB_SLAVE (one per connected Modbus master). MB_SLAVE maps a local DB onto the Modbus holding register area exposed to the hub.
3. On the S7-300, configure the CP 341 with the Modbus master driver (order 6ES7870-1AB01-0YA0 is no longer available; the driver is now embedded in newer CP 341 firmware). Use FB 7 'PNIO_RECV' for raw RS-485 traffic in advanced cases, or FB 80 'MB_MASTER' for a Modbus master block from the SIMATIC Modbus RTU library.
4. Wire the bus with a 120 Ω termination at each end, shielded twisted pair, and ground the shield at one end only. Maximum stub length 0.3 m at 1.5 Mbit/s equivalents; for 19.2 kbit/s the stub length is not the limiting factor, but the bus must remain a single linear segment.

Example S7-1200 STL (or SCL) instance for MB_SLAVE:

"mb_slave_inst"(
  MODE            := 1,            // 1 = RTU
  DATA_ADDR       := 1,            // Modbus starting address 40001
  DATA_LENGTH     := 32,           // 32 holding registers
  DATA_PTR        := P#DB50.DBX0.0 BYTE 64,
  MB_ID           := 1,            // Modbus slave address on the wire
  DONE            => #done,
  ERROR           => #err,
  STATUS          => #status);

Data Mapping in S7-300 Memory

Establish a single point of truth in DB 100 on the S7-300. Each protocol populates its own sub-array, and any inter-protocol exchange (for example, allowing the S7-1200 connected via Profinet to read values that originated on the Modbus RTU link) is implemented as a copy in OB1 or OB35.

Expose DB 100 as an S7 communication server (PUT/GET permitted) so that any S7-1200 can pull values from the hub without the hub pushing. Activate under Properties → Protection & Security → Connection mechanisms → Permit access with PUT/GET.

TIA Portal Project Structure

Use a single TIA Portal project (V18 or V19 recommended for firmware 4.5 support on S7-1200) with the S7-300 station as the master device and the S7-1200 stations as PN IO devices / DP slaves / Modbus peers. This unifies programming, online diagnostics, and version control. Spread the project across multiple V19 installations only if hardware differ or commissioning windows are decoupled.

1. Add the S7-300 station with the exact MLFB of the 314C-2 DP variant used. Add CP 343-1 Lean and CP 341 to the slot list.
2. Add each S7-1200 station with its MLFB. Insert CM 1241 and CM 1242-5 as required by the protocol mix.
3. Build the PN subnet (CP 343-1 Lean + S7-1200 onboard PROFINET) and the DP master line (integrated DP + CM 1242-5). The Modbus TCP uses the PN subnet; the Modbus RTU uses the CP 341 RS-485 port.
4. Compile and download each station. Use the Go online function on the S7-300 to verify the connections, then on each S7-1200 individually.

Verification and Diagnostics

Run a commissioning sequence after download. Each step produces an explicit pass/fail that can be logged:

1. PN/Modbus TCP: open the S7-300 online view, expand Online & diagnostics → PROFINET IO, and confirm every S7-1200 appears in the IO system with status OK.
2. DP: open Online & diagnostics → PROFIBUS DP → Diagnostic. Each slave must show Station OK with a green indicator.
3. Modbus TCP: in the Modbus TCP DB, evaluate STATUS from the MB_CLIENT call. A value of 0 indicates a clean read. A value of 80C8 typically indicates a timeout, 80C1 a connection refused.
4. Modbus RTU: drive a known value from the S7-1200 holding register and observe the corresponding DB 100 offset on the S7-300. Use a Modbus RTU traffic analyzer on the bus if the value never appears.

Use the S7-300's online CPU diagnostic buffer to see protocol-level errors. The buffer tags entries with the CP slot number, which lets you isolate whether an error is on the CP 343-1 Lean, CP 341, or integrated DP.

Troubleshooting Matrix

Frequently Asked Questions