S7-300 to S7-300 Modbus: RTU and TCP Configuration Guide

Overview: Modbus Between Two S7-300 CPUs

Modbus is a de facto industrial protocol for inter-PLC data exchange, but Siemens S7-300 CPUs do not support Modbus RTU or Modbus TCP natively. Any S7-300 to S7-300 Modbus link requires dedicated hardware (a Communication Processor) and a licensed function block library, or a migration to a CPU family that has built-in Modbus support (S7-1200, S7-1500, ET 200SP).

Before specifying hardware, lock down the four design parameters that drive every later decision:

1. Physical media – RS-485 half-duplex (RTU) vs. industrial Ethernet (TCP).
2. Master / slave role assignment – which CPU initiates transactions, which responds.
3. Data throughput – number of words, cycle time, determinism.
4. Project budget – CP cost + Modbus driver library license vs. zero-cost alternatives such as S7 GET/PUT.

For two S7-300 stations in the same plant that simply need to exchange process data over Profinet or MPI, the S7 GET/PUT instructions are almost always the lower-cost, lower-risk path. Modbus becomes the right answer only when one of the CPUs must inter-operate with a third-party device (drive, SCADA RTU, energy meter, vendor package) that already speaks Modbus.

Modbus RTU Path: Hardware and Wiring

Modbus RTU on S7-300 always requires a serial Communication Processor (CP) on each rack. The integrated serial interfaces of the S7-300 CPUs (MPI / PtP combo port) cannot be used for Modbus because they do not support the RS-485 framing, slave addressing, and timing required by the Modbus RTU state machine when paired with the licensed driver.

CP Selection Matrix for Modbus RTU

Install one CP 341 (RS-485 variant) in each S7-300 rack. Wire the two RS-485 ports point-to-point using a shielded twisted pair. RS-485 Modbus requires termination at both ends: 120 Ω across the data pair, with bias resistors enabled on at least one node if the master does not actively drive the line in idle state.

CP 341 DIP Switch and Front-Panel Settings

• Set the CP 341 to the Modbus Master or Modbus Slave firmware load using the parameter assignment tool in STEP 7 / TIA Portal. The Modbus protocol is uploaded to flash on the CP as a separate firmware package; the default load on delivery is a generic ASCII/3964(R) driver.
• Assign the RS-485 bus address (1–247). Each Modbus RTU device on a bus segment must have a unique address; for an S7-300 to S7-300 link, slave = 1 and master = 2 is a common convention.
• Match the baud rate and parity on both CPs (e.g. 19200, 8, E, 1) and verify the inter-character timeout (3.5 character times) that the CP uses to delimit RTU frames.

Modbus TCP Path: Hardware and Topology

Modbus TCP runs over industrial Ethernet. On the S7-300 you have two options:

1. Integrated PROFINET port of an S7-31x-2 PN/DP CPU (e.g. CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP). The PROFINET interface is a standard 100 Mbit/s Ethernet port and can be used for Modbus TCP without any additional hardware, but it still requires the Modbus TCP library on the CPU.
2. CP 343-1 (6ES7 343-1EX30-0XE0 or current 6GK7 343-1HX00-0XE0 Lean/Standard). Use a separate CP 343-1 when the integrated PROFINET port is fully consumed by I/O devices, HMI panels, or other PROFINET traffic and you need to isolate Modbus traffic on its own physical interface.

Modbus TCP Wiring

Modbus TCP is standard 10/100 Mbit/s Ethernet. Use Cat 5e or higher shielded cable. For a direct CPU-to-CPU link use a crossed cable (older gear) or rely on Auto-MDI/MDIX on the integrated PROFINET port. For multi-drop (master + several slaves, or multiple Modbus nodes behind managed switches), use a star topology with managed switches that support IGMP snooping and QoS.

TCP Port and Connection Parameters

Software Libraries: What Must Be Licensed

Unlike the S7-1200, S7-1500, ET 200S, and ET 200SP families, the S7-300 has no native Modbus function blocks in the operating system. Every Modbus implementation on S7-300 uses a separately licensed library that must be installed in STEP 7 and called from the user program. The currently supported packages for the legacy S7-300 line are:

Required Libraries for Modbus RTU on CP 341

• Modbus Master (RTU) for CP 341 / CP 340 – order number 6AV6 671-1AE01-0AX0 (or current Modbus_Master_PtP). Provides FB 7 (P_SND_RK), FB 8 (P_RCV_RK), and the Modbus-specific FB 80 / FB 81 wrappers depending on version.
• Modbus Slave (RTU) for CP 341 / CP 340 – order number 6AV6 671-1AE02-0AX0 (or current Modbus_Slave_PtP). Provides FB 82 / FB 83 with FC 03, 06, 16 holding-register access.

Required Libraries for Modbus TCP on S7-300

• Modbus TCP CP – 6AV6 671-1XC10-0AX0 for use with CP 343-1. Implements FB 65 (TCP_CONNECT), FB 66 (TCP_SEND), FB 67 (TCP_RECV) wrappers and the Modbus-specific FB 100 series blocks.
• Modbus TCP PN CPU – 6AV6 671-1XC00-0AX0 (or current Modbus_TCP_PN_CPU) for direct use on the integrated PROFINET port of an S7-31x-2 PN/DP.
• Modbus TCP RedConnect / Redundant – for use with CP 343-1 Advanced and H-CP setups. Not required for a two-CPU non-redundant link.

Function Code Coverage (CP 341 RTU Library)

Configuration Walkthrough: Modbus RTU Between Two S7-300 Stations

Reference: Siemens Application Note 109474714 – Master-Slave Communication with Modbus RTU Protocol for S7-300.

Step 1 – Hardware Install

Insert a CP 341 (RS-485 variant, 6ES7 341-1AH02-0AE0) in slot 4–11 of each S7-300 rack, matching the slot rules for the CPU used. Power down, install, power up, and verify the CP is recognized in the online diagnostic view of STEP 7 HW Config.

Step 2 – Firmware Load

Open the CP 341 properties dialog in HW Config and select Modbus Master or Modbus Slave as the protocol. The tool pushes the Modbus firmware into the CP's flash. One side is master, the other is slave.

Step 3 – Library Install in STEP 7

Install the licensed library (e.g. Modbus_Master_PtP and Modbus_Slave_PtP) in the project. In the master station, open the library and drag the Modbus master FB (FB 80 / FB 81 depending on library version) into the OB 1 cyclic program. In the slave station, drag the Modbus slave FB into OB 1.

Step 4 – Instance DB Wiring

Each Modbus FB requires an instance data block. Configure the instance DB with:

• LADDR – the I/O start address of the CP from HW Config (e.g. 256).
• SLAVE_ADDR – Modbus RTU address (1–247).
• START_REG – first holding register exposed to the bus.
• QTY – number of words or coils to transfer per transaction.
• DATA_PTR – pointer to a data block in the CPU (e.g. P#DB100.DBX0.0 WORD 50) that backs the Modbus register map.

Step 5 – Cycle and Trigger

Call the master FB once per application cycle (OB 1) or in a time-controlled OB (e.g. OB 35 at 100 ms). The FB handles request, response, error decoding, and retries internally; you monitor the STATUS and DONE/ERROR outputs to detect bus faults.

Modbus TCP Configuration Walkthrough

Reference: Siemens TIA Documentation – Overview of Modbus RTU Communication (S7-300, S7-400) and the corresponding Modbus TCP manual pages on the Siemens support site.

Step 1 – IP Plan and Connection Table

Assign static IP addresses to both CPUs (or the CPs). For a 192.168.10.0/24 subnet, set CPU-A = 192.168.10.10, CPU-B = 192.168.10.11, subnet mask 255.255.255.0, no gateway. Enable the PROFINET port in HW Config and assign it to the same subnet as the S7 routing path.

Step 2 – Open the Connection in NetPro / TIA

Insert a new S7 connection between the two PROFINET interfaces. Mark the local endpoint as Modbus_TCP_PN_CPU partner (or use the connection ID set up by the library configuration tool). For the CP 343-1 variant, the connection is established from the master to the slave's IP at port 502.

Step 3 – Master Call

On the master side, call the Modbus TCP function block (e.g. MODBUS_TCP_MASTER or FB 100 in the older library). The block encapsulates the MBAP header, the PDU, and the TCP send/receive calls. Use FC 03 (read holding registers) and FC 16 (write multiple registers) for the bulk data exchange.

Step 4 – Slave Call

On the slave side, call the matching Modbus TCP slave block. The block accepts incoming TCP connections on port 502, parses the PDU, and either reads from or writes to the configured data block.

Step 5 – Watchdog and Keep-Alive

Enable the application's own application-level watchdog (a heartbeat counter updated on every successful transaction). A stuck TCP connection with no watchdog is the single most common cause of "the link looks healthy but data is stale" in field reports.

The Native Alternative: S7 GET / PUT (No CP, No License)

If the only requirement is two S7-300 stations exchanging process data with each other – not with a third-party Modbus device – use the S7 communication services GET and PUT. These are part of the CPU firmware, require no CP, and need no license beyond the standard S7 CPU.

Why GET / PUT is Usually the Right Answer

GET / PUT Call Example (Master Side)

Place a single-instance call to GET in OB 1 with the partner connection configured in NetPro or the TIA devices & networks editor:

// ST – S7-300 master calling GET to read 20 bytes from partner DB 100
CALL  "GET"
  REQ    := M10.0           // Trigger: edge
  ID     := 1               // Connection ID from NetPro
  NDR    := M10.1           // New data received (1 cycle pulse)
  ERROR  := M10.2           // Error flag
  STATUS := MW12            // Detailed status word
  ADDR_1 := P#DB100.DBX0.0 BYTE 20  // Partner area
  ADDR_2 := P#DB200.DBX0.0 BYTE 20  // Local area
  RD_1   := P#M 100.0 BYTE 20       // Receive buffer (local)
END_CALL;

For the reverse direction, call PUT with SD_1 as the local source and ADDR_1 as the partner destination. Cycle the REQ input at the desired poll rate; do not call it on every OB 1 pass unless you need sub-100 ms latency.

Troubleshooting Matrix

When to Choose Each Path

• Two Siemens S7-300s exchanging data, no third-party device – use GET / PUT over PROFINET or MPI. Lowest cost, lowest risk, fastest commissioning.
• One S7-300 talking to a Modbus RTU device (drive, RTU, energy meter) – install a CP 341 on the S7-300 side, add the Modbus Master (RTU) library, configure the bus.
• One S7-300 talking to a Modbus TCP SCADA or device – add the Modbus TCP PN CPU library (uses the integrated PROFINET port) or install a CP 343-1 and the Modbus TCP CP library if the PROFINET port is full.
• Both S7-300s must also be Modbus slaves to a third-party master – install one CP 341 per station and the Modbus Slave (RTU) library on each.
• New project with no installed base – choose S7-1200 / S7-1500 instead. Modbus TCP and Modbus RTU (via CB 1241 / CM 1241) are native firmware features with free FBs and no library license.

Verification Checklist

1. Confirm the Modbus library license is installed on both target devices.
2. With a Modbus scanner (e.g. Modbus Poll, CAS Modbus Scanner) connected to the bus, read the test register and verify the raw Modbus frame matches the configured start address and quantity.
3. Use STEP 7 Monitor / Modify on the backing DB and observe values update per cycle.
4. Force a fault (unplug the cable, power down the partner) and verify that the error status, retry counter, and exception codes propagate to the user program as expected.
5. Log a 24-hour run with the CP diagnostic buffer and confirm zero CRC or timeout errors beyond the first minute after power-up.
6. Document the bus address, baud rate, parity, register map, and license key location in the project documentation for future maintenance.