Connecting a Non-Siemens HMI to a SIMATIC S7-300 CPU 315-2 PN/DP via Modbus/TCP

The SIMATIC S7-300 CPU 315-2 PN/DP is a mid-range controller in the SIMATIC family, deployed in machine building, water/wastewater, packaging, and material handling. Operators often need to attach a non-Siemens panel (Pro-face/Schneider Electric, Beijer, Red Lion, Weintek, Unitronics, Allen-Bradley PanelView 5310, etc.) to it. The panel may not speak PROFIBUS, may not speak PROFINET, and may not speak the proprietary Siemens S7 protocol. Modbus/TCP becomes the natural choice because it is an open, well-documented, IP-based protocol available on virtually every modern HMI. The complication: the integrated PROFINET port of the 315-2 PN/DP does not host a Modbus/TCP server. The CPU supports S7 communication, PROFINET IO, and open IE (TCP/UDP/ISO-on-TCP), but not Modbus/TCP. To add Modbus/TCP, the station must be expanded with a CP 343-1 communications processor and the Siemens ModbusTCP library. This article gives the complete engineering reference: the CPU profile, the protocol stack analysis, the hardware matrix, the function blocks, the TIA Portal / STEP 7 configuration, the diagnostic procedure, and a troubleshooting matrix.

Official references used through this article: the S7-300 product support page on the Siemens Industry Online Support portal, the SIMATIC S7-300 system manual, the PROFINET specification (IEC 61158 / IEC 61784-2 CPF 3), the Modbus Organization Modbus/TCP reference, and the ModbusTCP library documentation available under entry ID 21403704 in the Siemens support portal.

1. SIMATIC CPU 315-2 PN/DP Technical Profile

Before adding any communication processor, confirm the exact order number and firmware of your CPU. The 315-2 PN/DP is sold in multiple revisions that differ in work memory, bit memory, and firmware features. The table below summarises the variants you are most likely to encounter in a live plant.

2. Native Communication Interfaces: What the 315-2 PN/DP Supports Out of the Box

The CPU 315-2 PN/DP provides two physical interfaces and a stack of logical services on the PROFINET port. Mapping your application to the correct service is the first engineering step.

Notice the absence of Modbus/TCP (port 502). The CPU has a TCP stack but does not implement a Modbus Application Protocol (MBAP) handler. To add one, you have three engineering paths: (a) buy a CP 343-1 and use the Siemens ModbusTCP library, (b) write your own TCON/TSEND-based Modbus client/server on the CPU's open IE TCP (considerable work, not recommended), or (c) install a PROFINET-to-Modbus gateway (Helmholz, Phoenix Contact, Hilscher).

3. What Protocol Does WinCC Flexible Use Over Ethernet?

This is a common point of confusion. When a WinCC Flexible / TIA Portal WinCC project is configured to use a SIMATIC S7 300/400 channel over an Ethernet connection, the runtime does not use Modbus/TCP. It uses the proprietary Siemens S7 communication protocol carried over ISO-on-TCP (RFC 1006) on TCP port 102. The tag address you enter (for example DB5.DBW2) is resolved into a Siemens item specification in the wire PDU.

The wire format is a four-layer stack:

1. Ethernet II / IPv4 - standard IP routing; the panel's IP and the CPU's PROFINET IP are used for connectivity.
2. TCP - three-way handshake, port 102 on the CPU.
3. TPKT (RFC 1006, ISO Transport Service over TCP) - 4-byte header: version (0x03), reserved (0x00), length (2 bytes, big-endian). Frames the variable-length COTP payload.
4. COTP (Connection Oriented Transport, ISO 8073) - 3-byte header: length, PDU type (CR, CC, DT, AK), TPDU number. Establishes the connection (CR/CC exchange) and carries the data (DT).
5. S7 Application Layer - variable length. Header: protocol ID (0x32), ROSCTR (job / ack / userdata), redundancy identification, PDU reference, parameter length, data length. Items follow: variable specification (memory area, length, DB number, byte offset) and data.

The protocol is documented at a high level in IEC 61784-2 CPF 3 (CP 3/5 and CP 3/6) and on the Siemens support portal under entry ID 26483647 ("Standardization of SIMATIC communication"). The full implementation is proprietary; only licensed partners and the Siemens "SIMATIC S7 OPC server" or open-source projects such as libnodave, snap7, and Sharp7 implement client/server code for it.

4. Why Modbus/TCP Is Not Native to the 315-2 PN/DP

The 315-2 PN/DP firmware implements the SIMATIC S7 communication system and open IE. Both terminate at ISO Layer 4 (TCP/UDP). Modbus/TCP, however, is a presentation-layer protocol defined by the Modbus Organization and standardized in IEC 61158 (CPF 15). It needs:

• A TCP listener on port 502.
• An MBAP (Modbus Application Protocol) parser that interprets PDUs with function codes 1, 2, 3, 4, 5, 6, 15, 16, 23.
• A mapping between Modbus register addresses (0x0000 to 0xFFFF in four address spaces: coils, discrete inputs, holding registers, input registers) and CPU memory areas (I, Q, M, DB).

None of these are present in the CPU firmware. Adding them via the "Open IE" TCON/TSEND blocks would be possible in theory, but you would have to implement the entire MBAP parser, transaction ID tracking, exception code generation, and TCP connection management in S7-300 STL/SCL. Siemens does not provide this as a built-in feature, because their portfolio assumes that Modbus/TCP integration is handled by a CP 343-1 or by a separate SCADA / OPC server.

5. Hardware Modules to Add Modbus/TCP to an S7-300 Station

The 315-2 PN/DP slots in slot 2 of the S7-300 rack. CP modules can be installed in slots 4 to 11. The following CPs are valid for Modbus/TCP integration with S7-300:

The standard choice is the CP 343-1 (6GK7343-1EX30-0XE0). The 6GK7-343-1CX10-0XE0 "Lean" variant is often mistaken for the correct part because the price and form factor are similar, but it does not run the ModbusTCP library. Always verify the order number before ordering. The Lean module is sometimes marked as "for PROFINET IO Controller only"; you will find that out the moment you try to enable the Modbus/TCP option in HW Config and the tab is greyed out.

6. Software Implementation: The ModbusTCP Library

Siemens provides the library "ModbusTCP" on the support portal under entry ID 21403704 (also bundled in some S7-300 demo images). The library contains a server function block, a client function block, an S7-DB interface, and example projects. The library works with CP 343-1 and CP 443-1 Advanced. Always install the version that matches your CP's firmware; the library has had at least three major revisions corresponding to the CP firmware families V1.x, V2.x, and V3.x.

6.1 Library contents

6.2 Function codes supported by the ModbusTCP library

6.3 Register mapping convention

Modbus addresses are 16-bit unsigned. The library translates a Modbus address N into the offset 2*N bytes from the start of the Modbus_Hold_Reg DB. Holding register 0 is therefore DB100.DBW0, register 1024 is DB100.DBW2048. Coils map to the LSB of the corresponding word: coil 0 = DB100.DBX0.0, coil 1 = DB100.DBX0.1, coil 15 = DB100.DBX1.7, coil 16 = DB100.DBX2.0, and so on.

7. STEP 7 / TIA Portal Configuration Procedure

7.1 Prerequisites

• STEP 7 V5.5 SP4 with HSP 0232 for CP 343-1 (6GK7343-1EX30-0XE0), or TIA Portal V15.1+ with the S7-300 HSP installed.
• The ModbusTCP library installed in the global library. Download the .zip from the Siemens support entry, run the setup, or import the .s7l library into TIA Portal under Options > Global libraries > Open library.
• One free slot in the S7-300 rack (slot 4 to 11) for the CP 343-1.
• A known IP address plan. The CP and the HMI must be on the same subnet (or be reachable via a router with a static route).

7.2 Procedure in STEP 7 V5.5

1. Open SIMATIC Manager and the S7-300 station. Open HW Config.
2. Drag a SIMATIC S7-300 > CP 300 > Industrial Ethernet > CP 343-1 (6GK7343-1EX30-0XE0) from the catalog into slot 4 of the rack.
3. Double-click the CP. On the Properties > General tab, set the IP address, subnet mask, and (optionally) router.
4. Switch to the Options tab in the CP properties and enable "Modbus/TCP". Specify the connection port (default 502) and the number of simultaneous Modbus connections (default 4, max 16 on EX30).
5. Save and compile HW Config. The CP 343-1 is now online-capable.
6. Open the S7 program. From the global library, copy the ModbusTCP blocks (FB 100, UDT 100, DB 100, OB 100) into the project.
7. Open DB 100 (Modbus_Hold_Reg). Increase the length to fit your application (for example 2048 words = 4096 bytes for 1024 holding registers, or scale to the size of the data you need to expose).
8. In OB 1, call FB 100 with the instance DB (for example DB 200), the Modbus interface DB (DB 100), the CP's hardware ID (from HW Config, for example 256), and the connection ID (default 1).
9. Map your process data into the Modbus_Hold_Reg DB using simple L / T instructions in OB 35 or a cyclic OB, for example L MW 100; T DB100.DBW 0; L DB100.DBW 0; T MW 200. From OB 35 (default 100 ms), this gives a deterministic update rate.
10. Save, compile, download to the CPU. Switch the CPU to RUN.

7.3 Procedure in TIA Portal (V15.1 and later)

1. Open the TIA Portal project. In the project tree, double-click Devices & networks.
2. Add a CP 343-1 from the catalog SIMATIC S7-300 > Communication > Industrial Ethernet. Set the IP address in the device properties.
3. In the CP's Properties > Modbus/TCP section (available only when the S7-300 HSP is installed), enable the Modbus/TCP server role, set port 502, and define the maximum number of connections.
4. Switch to the PLC program. In the Libraries task card, open the global library containing the ModbusTCP blocks. Drag FB 100 (MODBUSPN) and its instance DB into a program block folder. Drag the UDT and the Modbus_Hold_Reg DB likewise.
5. Call FB 100 in OB 1 (or a cyclic OB of your choice, for example OB 35) with the correct instance, Modbus data DB, and hardware identifier of the CP (visible in the CP's system constants, for example Local~PROFINET_interface_1).
6. Map process data into the Modbus_Hold_Reg DB from OB 35 or from your application logic. Compile and download.

7.4 HMI-side configuration (generic Modbus/TCP driver)

On the HMI, create a Modbus/TCP master (client) connection. The HMI is the client, the CP 343-1 is the server.

• IP address: the CP's IP (for example 192.168.0.10).
• Port: 502.
• Unit ID / Slave ID: 0 (the CP 343-1 ignores the unit ID; some drivers require 1, then 255 for broadcast).
• Polling interval: 100 to 500 ms is typical for a S7-300 station. Do not poll below 50 ms or the FB 100 buffer will queue and the CP will drop requests.
• Register mapping: register 0 -> HMI tag HMI_Tag0 -> DB100.DBW0, and so on. Respect the big-endian / little-endian swap if you use 32-bit tags (treat as two consecutive 16-bit registers).

8. Verification and Online Diagnostics

After commissioning, verify the connection with the following checks. The HMI is treated as a Modbus poll, but you can also use Modbus Poll (WinTech) or qModMaster for an independent test from a PC.

1. CP 343-1 online status: in STEP 7 / TIA Portal, go online to the CP. The Diagnostics tab should show the CP in RUN, with port 502 listed under Active TCP connections when a client connects.
2. Modbus register write/read round-trip: from the HMI (or a PC tool), read register 0 of holding registers. Set a known value in the HMI and verify it appears at DB100.DBW0 in the S7 program (online > monitor/modify). Reverse: write DB100.DBW0 in STEP 7, read it back from the HMI.
3. CP 343-1 diagnostics buffer: read the CP's diagnostic buffer entries. Look for SF (system fault), BF (bus fault), or connection error codes. A typical error code is "0x090A connection partner not reachable" - almost always a firewall, IP mismatch, or wrong VLAN.
4. FB 100 status word: the UDT 100 contains a STATUS output. Values: 0 = OK, no active connection; 1 = OK, at least one connection active; 0x80xx = connection error (xx = Modbus exception code).
5. Wire-level check: with Wireshark on a mirrored port, filter for tcp.port == 502. You should see a SYN / SYN-ACK / ACK from the HMI, then MBAP PDUs with transaction ID, protocol ID 0x0000, length, unit ID, function code, and payload.

9. Troubleshooting Matrix

10. Alternative Paths: S7 Native Protocol, PROFINET Gateways, OPC

Modbus/TCP via CP 343-1 is one of four viable ways to expose a S7-300 to a third-party HMI. Choose based on the HMI's driver set, the network architecture, and the volume of data.

10.1 S7 native protocol on the integrated PROFINET port

If the HMI vendor provides an "S7 TCP/IP" or "S7 MPI/TCP" driver (Beijer iX, Red Lion Crimson, Weintek EasyBuilder, Pro-face GP Pro EX, Unitronics UniLogic, AVEVA, Ignition Edge), use it directly on the CPU's PROFINET port. No CP 343-1 is required; no library is required. The HMI reads DB5.DBW2 exactly as WinCC Flexible would. Limits: the HMI is a passive client; it cannot perform protected S7 functions like programming. Throughput is limited to roughly 8 to 10 tags per second on a CPU 315-2 PN/DP for an unsynchronised HMI poll. PROFINET IO realtime is not affected. The PROFINET connection configuration must allow PUT/GET from the partner (right-click the CPU in TIA Portal > Properties > Connection mechanisms > Permit access with PUT/GET).

10.2 PROFINET-to-Modbus gateway

If the HMI is a low-cost panel that speaks only Modbus/TCP and you do not want to spend a CP slot, install a gateway in the PROFINET line:

• Helmholz WALL IE / PN/MODBUS (700-670-MOD12)
• Phoenix Contact GW PN/MODBUS (1105707)
• Hilscher NT 100-RE-EN / cifX M223090
• Woodhead / Molex PROFINET-to-Modbus gateway

The gateway appears as a PROFINET IO Device on the CPU's PROFINET network. It exposes a configurable number of slots, each mapped to a CPU memory area (input, output, DB). The HMI then polls the gateway's IP on port 502. Advantage: no PLC programming, fast commissioning. Disadvantage: extra device, single point of failure, no diagnostic surface in STEP 7.

10.3 OPC UA / OPC DA server

A PC-based SCADA (WinCC, Ignition, FactoryTalk View SE) can act as an OPC UA server that translates between S7 protocol and a third-party HMI's native protocol. This is overkill for a single HMI, but justified when many tags and many users are involved. The CP 343-1 Advanced (6GK7343-1GX31-0XE0) has a built-in OPC DA server that simplifies this path. For new installations, the modern route is to migrate to an S7-1500 with native OPC UA server on the PROFINET port, leaving the S7-300 / Modbus/TCP path for legacy work.

10.4 Direct Ethernet fieldbus on the open IE TCON/TSEND interface

For very small projects (under 50 tags), you can implement a minimal Modbus/TCP server in SCL on the CPU 315-2 PN/DP using the TCON, TSEND, TRECV, TDISCON blocks. This is a development effort, not a maintenance-friendly solution. The CP 343-1 + ModbusTCP library is the engineering-recommended path because it is supported, certified, and updateable. If you do choose to implement it in SCL, expect to allocate OB 1 / OB 35 cycles for connection state management, MBAP parsing, and PDU assembly; budget at least 1 to 2 ms of CPU time per Modbus/TCP client on a 315-2 PN/DP.

11. Field-Proven Notes and Engineering Guidelines

From deployment experience with S7-300 stations talking to non-Siemens panels (Beijer, Red Lion, Weintek, Allen-Bradley PanelView 5310):

• Reserve at least 200 % of the planned tag count in the Modbus_Hold_Reg DB. Adding tags later requires recompilation and HMI download.
• Place the CP 343-1 in slot 4, immediately to the right of the CPU, to minimise backplane bus utilisation. Slot 11 is electrically valid but adds latency.
• Disable the CP's web server and FTP server in production to reduce attack surface. If you need them for diagnostics, restrict access via the CP's IP access list (Security > IP Access Control in the CP properties).
• Cycle time of the calling OB: OB 35 (default 100 ms) is a good compromise. OB 1 works but you may see Modbus PDU delay under heavy CPU load. OB 32 (10 ms) is too fast for FB 100; the buffer fills and the CP drops requests.
• Endianness: if the HMI uses 32-bit REAL tags, it reads two consecutive 16-bit registers. The HMI driver can be set to "big-endian word swap" (the Modbus wire format) or "little-endian" (the S7 format). Verify the first time you commission and freeze the setting in a project standard.
• Firewall: corporate firewalls often close TCP 502 after a few minutes of idle. Enable TCP keep-alive on the CP (default is 30 s) and on the HMI driver.
• Safety: the ModbusTCP library is not safety-rated. For SIL 2/3 applications, route the safety I/O through PROFIsafe on PROFINET and expose only non-safety status to the HMI via Modbus/TCP.
• Redundancy: the S7-300 H-system supports redundant Modbus/TCP via FB 102 (MODB_RED). On a single CPU 315-2 PN/DP, you cannot use the redundancy function block; accept the single point of failure or add a second CP 343-1 in a non-redundant configuration with the HMI polling both.
• Tool alternatives: third-party libraries such as libmodbus (open source, C) and Modbus4J (Java) implement the same wire protocol; they are useful for PC-based tests but do not help inside the CPU.
• Firmware compatibility matrix: ModbusTCP library V5.x requires CP 343-1 firmware V3.0 or higher. Library V3.x is the last to support CP 343-1 firmware V1.x. Check the readme.oss file in the library archive before upgrading.
• Diagnostic surface: the FB 100 instance DB has detailed status: STATUS, LAST_ERROR, OPEN_CONN, RX_COUNT, TX_COUNT. Online monitor all of them on first commissioning to verify traffic; RX_COUNT should increment on every HMI poll.

FAQ