Siemens S7-1200/S7-1500 Modbus TCP Setup Guide (TIA Portal)

Siemens is one of the PLC brands engineers most often need to pair with a Modbus PLC simulator — the S7-1200 and S7-1500 don't speak Modbus natively the way a Schneider Modicon does, so the wiring inside TIA Portal has a few gotchas that trip people up the first time. This guide walks through configuring Modbus TCP on an S7-1200 or S7-1500 with the MB_CLIENT and MB_SERVER instructions, then verifying the whole program against a simulated Modbus device before any field hardware is on site.

MB_CLIENT/MB_SERVER vs Modbus_Master/Modbus_Slave

TIA Portal actually ships two separate instruction families for Modbus, and mixing them up is the single most common source of confusion:

Connection Type	Instructions Used	Hardware Required	Role
Modbus TCP (Ethernet)	MB_CLIENT / MB_SERVER	Built-in PROFINET/Ethernet port — no extra module	Client = master (polls devices), Server = slave (exposes data)
Modbus RTU (serial)	MB_COMM_LOAD + Modbus_Master / Modbus_Slave	CM 1241 RS485 or CM 1241 RS422/RS485 module	Master polls devices, Slave exposes data

Both TCP instructions live in TIA Portal under Instructions → Communication → Others → MODBUS TCP, are included free in the standard instruction library from TIA Portal V11 onward, and run on both the S7-1200 and S7-1500 CPU families.

Setting Up MB_SERVER (PLC as Modbus TCP Slave)

Use MB_SERVER when your S7-1200/S7-1500 needs to expose its own data — for example, so a SCADA system or a Modbus master can poll the PLC's internal values as if it were a field device.

1. Drag MB_SERVER into a network in OB1 (it must be called cyclically, every scan, not just on a one-shot condition)
2. Create the instance data block when prompted
3. Set CONNECT to a TCON_IP_v4 connection parameter structure with the local port (typically 502) and, for a server, leave the remote IP blank/zero so it accepts any client
4. Point MB_HOLD_REG at the data block holding your Modbus register data
5. Critical: right-click that data block → Properties → uncheck "Optimized block access." Modbus addressing depends on fixed byte offsets, and an optimized DB will not lay memory out the way MB_SERVER expects

Setting Up MB_CLIENT (PLC as Modbus TCP Master)

Use MB_CLIENT when your PLC needs to poll a Modbus TCP device — an energy meter, a VFD, or (during development) a Modbus simulator running on your PC.

1. Drag MB_CLIENT into OB1, also called every scan
2. Configure CONNECT with the target device's IP address and port 502
3. Set MB_MODE to select read (0) or write (1) and MB_DATA_ADDR for the Modbus register address you want
4. Point MB_DATA_PTR at the local data block where the read/write values will be stored, again with Optimized block access disabled
5. Monitor STATUS for the result — a non-zero value here is almost always the fastest way to identify a configuration problem

A single S7-1200 or S7-1500 can run MB_CLIENT and MB_SERVER at the same time on different connection IDs — polling field devices as a master while simultaneously serving its own data to a SCADA system as a slave.

Testing Against a Simulator Before Field Devices Arrive

Because Siemens PLCs don't have native Modbus support the way Schneider Modicon does, engineers commissioning an S7-1200/S7-1500 project usually can't fully validate the Modbus logic until the real meters, VFDs, or gateways show up on site — unless they simulate the other end. Here's the workflow:

1. Run ModbusSimulator in Slave mode, Modbus TCP protocol, port 502, on your development PC
2. Set the simulator's IP to the PC's LAN address and point your MB_CLIENT instance's CONNECT parameter at that IP
3. Load the target device's real register map into the simulator (holding registers for setpoints, input registers for readings) so the values your PLC reads match what the actual meter or VFD will return
4. Force test values in the simulator and step through your PLC's scaling/byte-order logic to confirm it decodes them correctly — this is exactly the kind of check covered in our byte order guide
5. Stop the simulator mid-poll to confirm your MB_CLIENT STATUS logic correctly flags a timeout instead of silently holding stale data

This mirrors the general workflow in our PLC Modbus testing tool guide, but with the specific TIA Portal instruction names and pitfalls that are unique to Siemens.

Common Siemens Modbus TCP Errors

MB_CLIENT/MB_SERVER STATUS shows a connection error

• Confirm the PLC and the remote device (or simulator PC) are on the same subnet, and that a firewall isn't blocking TCP port 502
• Make sure MB_CLIENT and MB_SERVER aren't sharing the same CONNECT ID if both are active
• Check that only one side is initiating the TCP connection — if both are configured as active/client, neither will listen

Data reads back scrambled or as zero

• "Optimized block access" is almost always the culprit — disable it on the data block referenced by MB_DATA_PTR/MB_HOLD_REG
• Double-check MB_DATA_ADDR uses Modbus's own numbering, not the S7 absolute address of your data block
• For 32-bit values, verify byte/word order matches the source device — Siemens defaults to big-endian, but many Modbus devices use word-swapped order

Modbus TCP works, but PROFINET I/O also needs to run

This isn't a conflict — PROFINET and Modbus TCP can run over the same physical Ethernet port at the same time, since PROFINET operates at a different protocol layer than the TCP/502 socket Modbus TCP uses. No special CPU configuration is required beyond making sure both are enabled in your program.