Siemens S7-mEC Modbus TCP Configuration: Complete Setup Guide

S7-mEC Hardware and Firmware Variants

The S7-mEC product family is documented on the S7-modular Embedded Controller (S7-mEC) EC31-RTX product page and the SIMATIC S7-mEC Operating Manual (PDF). The platform pairs an x86-compatible embedded CPU with the S7-300 backplane, so any S7-300 SM (signal module), FM (function module), or CP (communications processor) that fits the rail can be used alongside it. The S7-mEC ships with a pre-installed Windows Embedded Standard 7 (WES7) image and, in the RTX variants, the IntervalZero RTX real-time extension that allows the S7 logic to run deterministically without Windows interference.

For Modbus TCP purposes the choice between EC31 and EC31-RTX does not affect the communication stack itself, which lives in the Windows side. RTX is only relevant if you intend to run a deterministic S7 task that pre-empts the Windows scheduler. The two integrated Industrial Ethernet (IE) ports on the front of the CPU are the physical connections for Modbus TCP traffic. The PCI-104 expansion module (EM PCI-104) and the EM PC expansion add serial interfaces, additional fieldbuses, and digital I/O, but Modbus TCP always rides on the integrated IE ports.

Modbus TCP Protocol Recap

Modbus TCP is the IANA-registered TCP/IP encapsulation of the Modbus application layer, defined by Schneider Electric and maintained by the Modbus Organization. Every server (slave) listens on TCP port 502. The S7-mEC, when configured as a master (client), opens an outgoing socket to the slave's IP and port 502; when configured as a slave (server), the Open Modbus library opens a listening socket and accepts the master connection. The Modbus Application Protocol Header (MBAP) is 7 bytes: transaction ID, protocol ID (always 0x0000), length, and unit ID. The Open Modbus library for STEP 7 supports function codes 1, 2, 3, 4, 5, 6, 15, and 16 out of the box. Function code 23 (read/write multiple registers) is not supported in the standard blocks and must be implemented manually if needed.

System Architecture

The S7-mEC acts as the Modbus TCP master in this topology. Each slave can use a different subset of function codes, and the Open Modbus library creates a per-connection configuration block in the project.

Prerequisites and Required Software

1. Hardware: S7-mEC EC31 or EC31-RTX with at least one free Industrial Ethernet port, a managed switch, and the Modbus TCP target device. Verify the controller is reachable using SIMATIC Manager -> Target system -> Accessible nodes, or TIA Portal -> Online -> Accessible devices.
2. STEP 7 V5.5 SP4 or later: The Open Modbus library has both classic STEP 7 and TIA Portal variants. If you are on TIA Portal V13 SP1+ with an S7-mEC project that was migrated from STEP 7, the classic blocks can be re-imported; otherwise, use the wizard variant that matches your engineering tool.
3. Open Modbus/TCP library: Download the latest version from Siemens support (entry ID 22660304 at the time of the original case). The ZIP contains the wizard executable (ModbusTCPWizard.exe), the function blocks (FB100 series), the UDTs, and the example projects.
4. Windows admin rights: The wizard writes registry entries and configuration files. Right-click STEP 7 and run as administrator on Windows 7 and later.
5. Static IP addressing: Assign a fixed IP to the S7-mEC's IE port. DHCP works once the link is up, but at commissioning you need a static address so the wizard and the slave can both resolve the controller.
6. Network reachability: From the engineering station, ping the S7-mEC and ping the slave. Modbus TCP issues that look like a wizard problem are often a firewall, VLAN, or routing fault.

Open Modbus Library and Wizard Architecture

The Open Modbus/TCP library follows the classic Siemens library pattern: a wizard creates a configuration DB that captures the master or slave definitions, and one or two function blocks execute the runtime. The blocks rely on the standard TCON, TDIS, TSEND, and TRCV system blocks from the S7-300 communication resources, so the controller must have at least one open TCP connection resource on the chosen IE port. The library contains these primary components:

• FB100 "TCP_MB_MASTER": Master function block. Polls configured slaves, writes data to a per-connection data area in the configuration DB, and surfaces status codes.
• FB101 "TCP_MB_SLAVE": Slave function block. Listens for incoming connections, services requests, and exposes a process image in the configuration DB.
• FB102 / FB103: Helper blocks for connection management, fragmentation, and assembly of multi-register responses.
• FB105 / FB106: Used in some variants for connection ID management when multiple slaves are active.
• UDT "MB_DATA": Process image type. Defines the layout of the per-connection data buffer.
• ModbusTCPWizard.exe: Generates the configuration DB and the call interface. Reads from a registry key to find the project and writes the DB into the project's block container.

Step-by-Step Implementation

Step 1 - Configure the IE Interface in HW Config

Open the S7-mEC station in HW Config (or the device view in TIA Portal). On the IE port that will carry Modbus TCP, assign a fixed IP address, subnet mask, and (if used) router. Set the IE port type to "PN/IE" if it is also carrying PROFINET. Confirm that at least one TCP connection resource is free in the interface's connection list. The S7-mEC supports 16 ISO-on-TCP connections and 16 TCP connections per IE port by default, but the exact number depends on the firmware and any CP modules installed.

Step 2 - Install the Open Modbus Library

Extract the Open Modbus ZIP to a local folder. In SIMATIC Manager, open the S7 program. Right-click the Blocks container and choose "Insert -> S7 Library -> Open Modbus/TCP". The library FBs, UDTs, and the wizard executable are added to the project. If prompted, allow the wizard to register the library path in the Windows registry; this is required for the next step to work.

Step 3 - Run the Modbus TCP Wizard

Launch ModbusTCPWizard.exe as administrator. The wizard opens with a project picker. Point it at the STEP 7 project file (.s7p) or the TIA Portal project folder. The wizard reads the station configuration and presents the available IE ports. The first user trap appears here.

After selecting the correct IE port, choose master or slave role. The wizard then asks for the slave IP, port (502 default), polling interval, response timeout, and retry count. The library examples include 1xx, 2xx, 3xx, and 4xx slave variants. The 3xx variant is the most common for a holding-register slave (function codes 3, 4, 6, 16), which matches most process instruments and drives. The 4xx variant supports bit-packed register mapping for devices that report status as register bits.

Step 4 - Generate the Configuration DB

Click "Generate DB" in the wizard. The wizard creates a DB (typically DB1000 or higher) that holds the connection parameters, the polling list, and the process image. It also creates a UDT instance per connection. The wizard writes the DB into the project's offline blocks container. Do not modify the generated DB manually; the wizard will overwrite it on the next run.

Step 5 - Call the Function Block

Open OB1 (or a cyclic OB) and insert a call to FB100 (master) or FB101 (slave). The instance DB is created automatically on first download. A minimal master call in STL looks like:

CALL FB100, DB1000
   ID         := 1                // Connection ID from wizard
   TIMEOUT    := T#1S             // Response timeout
   DONE       := M10.0            // 1 = last request completed OK
   ERROR      := MW12             // Error word
   STATUS     := MW14             // Detailed status
   DATA       := P#DB200.DBX0.0   // Process image pointer

For the slave role, the equivalent call uses FB101 with the connection ID, the buffer DB, and the buffer length. The buffer must be at least 2x the largest expected response, because the library uses an assembly buffer for multi-register reads.

Step 6 - Download and Test

Download the hardware configuration and the S7 program to the S7-mEC. Open a Modbus TCP client tool on the engineering station (e.g., Modbus Poll, QModMaster, or a simple Python script using pymodbus) and connect to the S7-mEC's IP on port 502 if it is configured as a slave, or to the slave's IP on port 502 if the S7-mEC is the master. Verify that the wizard-generated process image updates at the configured poll interval.

Master vs Slave Selection (3xx vs 4xx)

The Open Modbus library ships with example projects named for the dominant function codes they exercise. The 1xx series is for coil-heavy slaves (FC 1, 2, 5, 15). The 2xx series is for input-register-heavy slaves (FC 4). The 3xx series is the most common and covers holding-register slaves (FC 3, 4, 6, 16), which describes the majority of process instruments, variable-frequency drives, and energy meters. The 4xx series is for slaves that report data packed into register bits, often older power meters and protection relays. Choose the example that most closely matches the actual slave device, then customize the polling list in the wizard.

Verification and Acceptance Tests

1. Link layer: From the engineering station, ping the S7-mEC. From the S7-mEC's Windows command prompt, ping the slave.
2. Connection establishment: In STEP 7, open the connection table and confirm the Modbus TCP connection is in "Established" state.
3. Polling: Force a known value in the slave and verify the wizard-generated DB updates at the configured poll interval.
4. Write path: Write a value from the S7-mEC to the slave and confirm the slave accepts it. Check the slave's diagnostic counters for receive errors.
5. Error path: Disconnect the slave and confirm the FB reports an error code and the DONE bit remains 0. Reconnect and confirm recovery within the retry count.
6. Sustained load: Run for at least 30 minutes under normal traffic to surface any memory leak, socket exhaustion, or Windows scheduling issue.

Troubleshooting Matrix

Platform Comparison: S7-mEC vs S7-1200/1500 vs ET 200SP

Engineers sometimes ask whether the S7-mEC is the right platform for Modbus TCP or whether a newer S7-1200 or S7-1500 would be simpler. The trade-off is as follows:

If your application is a greenfield Modbus TCP integration with no Windows side, an S7-1200 or S7-1500 with the native MB_CLIENT/MB_SERVER blocks is faster to commission and easier to maintain. The S7-mEC with the Open Modbus library is the right choice only when you need the S7-300 I/O family, the Windows runtime, or are migrating an existing STEP 7 V5.5 project.

Edge Cases and Field-Proven Caveats

Multiple masters on the same slave: Some process instruments and drives will only accept one TCP connection at a time. If the S7-mEC is a master, no other master should hold a connection to the same slave. The Open Modbus library does not enforce this; it is up to the engineer to design the network.

TCP keep-alive: Long-idle Modbus TCP sessions can be silently dropped by intermediate firewalls or switches. Enable TCP keep-alive on the IE port's advanced properties, or configure a periodic no-op read in the wizard polling list.

Endianness: Modbus is big-endian on the wire, S7 is little-endian. The Open Modbus library handles byte-swapping for 16-bit registers, but 32-bit values across two registers (long integer, float) require the user to swap word order. Plan for this in the S7 side; do not assume a float from the slave is ready-to-use.

RTX real-time interference: On EC31-RTX, the RTX scheduler can preempt the Windows TCP/IP stack. Symptom is bursts of timeouts that correlate with RTX task load. Mitigation is to run the S7 program on the RTX side and the Modbus TCP on the Windows side, with a hand-shared data area.

Library version drift: The Open Modbus library has had several revisions. A project built against v4.x may not import cleanly into v6.x. Always archive the library ZIP with the project, and document the library version in the project header.

Field Commissioning Checklist

• [ ] S7-mEC firmware, STEP 7, and Open Modbus library versions recorded in the project header
• [ ] IE port IP, subnet, and VLAN documented
• [ ] Windows Firewall rules set for TCP 502 (slave mode) or outbound allow (master mode)
• [ ] TCP offload disabled on the IE NIC
• [ ] Wizard-selected port verified against the wired port in HW Config
• [ ] Example project variant (1xx, 2xx, 3xx, 4xx) matches the slave device
• [ ] Unit ID matches the slave configuration
• [ ] Function codes match the slave device capability
• [ ] Byte-swap rules documented for any 32-bit data
• [ ] 30-minute sustained load test completed
• [ ] Error path tested (slave disconnect and reconnect)

Related Siemens Resources

For additional reference, see the S7-modular Embedded Controller (S7-mEC) EC31-RTX product page for the full EC31-RTX datasheet and ordering information, and the SIMATIC S7-mEC Operating Manual (PDF) for the hardware configuration, addressing, and diagnostic procedures that apply to Modbus TCP commissioning.