Configuring Modbus TCP Client Communication from S7-400 to Weidmuller UR20 Couplers in PCS 7

Integrating a Weidmuller UR20-FBC-MOD-TCP-V2 remote I/O station into SIMATIC PCS 7 V9.1 requires configuring an Open User Communication S7 connection and parameterizing the licensed SIMATIC Modbus/TCP Redundant or Single library blocks (MB_CPCL / MB_REDSV). In the CFC chart, engineers define remote IP addresses, Modbus register offset mappings for Weidmuller analog and digital slices, and register polling cycles to unpack distributed field variables into standard PCS 7 channel drivers.

Architecture of Modbus TCP Integration in SIMATIC PCS 7

In process facilities, third-party remote I/O stations (such as Weidmuller u-remote UR20 series) provide distributed digital and analog interfacing over Ethernet:
* The Weidmuller UR20-FBC-MOD-TCP-V2 operates as a Modbus TCP Server (Slave), listening on standard TCP port 502.
* The SIMATIC S7-400 or CPU 410 station acts as the Modbus TCP Client (Master), initiating cyclical read and write transactions to exchange I/O image data.
* Communication executes over an Industrial Ethernet communications processor (CP 443-1) or CPU integrated PROFINET interface using the official Siemens SIMATIC Modbus/TCP block library.

Hardware Profile: Weidmuller UR20-FBC-MOD-TCP Coupler and I/O Mapping

The Weidmuller UR20 station maps physical slice modules (AI, AO, DI, DO) into continuous Modbus register tables configured via its internal web server:
* Digital Inputs (DI): Mapped to Discrete Inputs (Function Code 02, address range 10001+) or packed into Input Registers (FC04, address range 30001+).
* Analog Inputs (AI): Mapped to Input Registers (Function Code 04, address range 30001+ or Holding Registers 40001+). Each analog channel occupies one 16-bit word (INT).
* Digital Outputs (DO): Mapped to Coils (Function Code 01/15, address range 00001+).
* Analog Outputs (AO): Mapped to Holding Registers (Function Code 03/16, address range 40001+).

Configuring the S7-400 Modbus TCP Client Block (MB_CPCL / MB_REDSV)

To configure Modbus polling in a CFC chart:
1. Network Connection: In NetPro, establish an unspecified TCP connection (or configure dynamic Open User Communication parameters in the data block).
2. Instantiate Driver Block:
* In CFC, instantiate MB_CPCL (Modbus Client via CP) or MB_REDSV (Redundant Modbus Server/Client) from the SIMATIC Modbus/TCP library.
* Schedule the block in a dedicated cyclic interrupt OB (typically OB35 at 100 ms or OB34 at 200 ms).
3. Parameterize the MODBUS_PARAM Data Block:
* IP_ADDR: Set the IPv4 address of the Weidmuller coupler (e.g., 192.168.1.50).
* PORT: Set remote TCP port to 502.
* UNIT_ID: Typically set to 1 (or 255).
* DATA_TYPE: Select Modbus function code (e.g., 16#04 for Read Input Registers).
* START_ADDR: Define starting register address (e.g., 0 or 1).
* LENGTH: Define number of words to read (e.g., 16 words for 16 analog channels).
4. License Registration:
* Enter the Siemens Modbus runtime license key into the license parameter block (LICENSED = TRUE), preventing the driver from generating unlicensed demo timeout errors.

Mapping Modbus Register Buffers to PCS 7 Channel Drivers

Once data is cyclically read into the S7 communication data block:
* Signal Unpacking: Use an SCL unpacking block or standard CFC conversion blocks to separate individual words and bits from the receiving array.
* APL Channel Driver Interconnection:
* For analog inputs, route the 16-bit integers to standard Pcs7AnIn or FbAnIn blocks, applying engineering unit scaling (e.g., 0 to 27648 or 4000 to 20000).
* For digital signals, unpack boolean bits and route them to Pcs7DiIn blocks or directly to technological interlocks (Interlck, MonDiL).
* Quality Code Handling: If the Modbus block reports communication error (ERROR = 1), pass bad signal status (16#00) to the channel drivers to trigger fail-safe hold or substitute values.

Verification

In SIMATIC Manager Variable Table (VAT), monitor the Modbus receive data block: verify that raw register values change when field voltages or contacts toggle.
In CFC dynamic test mode, confirm that MB_CPCL.DONE = 1 and ERROR = 0.
In Weidmuller web server diagnostics, verify that active TCP connections report established status with zero CRC frame errors.
In WinCC OS runtime, verify that process values display smoothly on APL faceplates.

Limitations and Operational Precautions

SIMATIC Modbus/TCP blocks require a runtime software license per CPU; running without a valid license causes the block to stop communicating after a trial period.
Modbus TCP communication is non-deterministic compared to native PROFINET IO; avoid using Modbus TCP for fast safety-instrumented shutdown loops.
Set appropriate TCP keep-alive and connection timeout parameters to ensure the S7-400 detects coupler power loss within 2 to 3 seconds.

Engineer FAQ

What port does the Weidmuller UR20 Modbus TCP coupler listen on?
Standard Modbus TCP port 502.
What S7 block library is used for Modbus TCP communication in PCS 7?
The official Siemens SIMATIC Modbus/TCP library (e.g., Modbus/TCP CP or Modbus/TCP RED V2).
Does Modbus TCP require a hardware communications processor?
It can communicate via an Ethernet CP (e.g., CP 443-1) or directly through the integrated PN interface of CPU 410-5H.
How is licensing handled for SIMATIC Modbus/TCP blocks?
Each CPU requires an individual runtime license registered via an activation key matched to the CPU hardware serial number.
What function code reads analog inputs from the Weidmuller coupler?
Function Code 04 (Read Input Registers) or Function Code 03 (Read Holding Registers).
What happens if the Weidmuller coupler loses Ethernet connectivity?
The Modbus block sets ERROR = 1 with an error status word, and channel drivers transition to bad quality code.
Can I write digital outputs to the Weidmuller coupler?
Yes, using Function Code 05 (Write Single Coil) or Function Code 15 (Write Multiple Coils).
What is the Unit ID parameter in Modbus TCP?
It represents the internal device slave address, typically set to 1 for standalone modular couplers.
How do I configure multiple read/write requests with a single Modbus client block?
Configure a state machine or request scheduler in CFC that cycles through multiple MODBUS_PARAM records sequentially.
Can Weidmuller UR20 integrate via PROFINET instead of Modbus TCP?
Yes, Weidmuller provides a PROFINET coupler (UR20-FBC-PN) that integrates directly into HW Config using a standard GSDML file.

Technical References

Siemens SIMATIC Modbus/TCP Communication Manual
Weidmuller u-remote UR20-FBC-MOD-TCP System Manual
Siemens Industry Online Support Entry: Modbus TCP Client Configuration in S7-400 (Entry ID 299185)
SIMATIC PCS 7 Advanced Process Library (APL) Function Manual