How to Implement High-Volume Modbus TCP Master Communication (>2000 Words) via CP 443-1 in PCS 7

In SIMATIC PCS 7, acquiring more than 2,000 words from a Modbus TCP slave using a CP 443-1 Industrial Ethernet processor requires managing protocol query limits and sequential telegram scheduling. Because standard Modbus FC03/FC04 telegrams have an architectural protocol limit of 125 words (250 bytes) per query, reading 2,000 words requires at least 16 separate query requests. Attempting to trigger multiple MODTCP blocks simultaneously on the same CP connection causes telegram collisions and communication errors (16#A006). The established best practice is implementing a cyclic state-machine sequencer in SCL or CFC that triggers read requests sequentially upon receipt of the DONE/ERROR handshake.

Modbus TCP Protocol Frame Constraints and Word Limits

When integrating third-party systems (such as electrical power distribution switchgear, energy meters, gas chromatographs, or third-party PLCs) into SIMATIC PCS 7 via Open Modbus / TCP for CP 443-1, communication engineers frequently encounter large data payloads exceeding 2,000 continuous registers.

The Modbus Protocol PDU Limit

Under the official Modbus Application Protocol Specification V1.1b:
* A Modbus TCP Application Data Unit (ADU) has a maximum frame size of 260 bytes.
* The Protocol Data Unit (PDU) has a maximum length of 253 bytes.
* For Read Holding Registers (Function Code 03) and Read Input Registers (Function Code 04):
* Each requested register consumes 2 bytes in the return payload.
* Adding the 1-byte function code and 1-byte byte count leaves a hard protocol limit of 125 words (250 bytes) per single Modbus query.
* Therefore, reading 2,000 words requires a minimum of 16 discrete Modbus read operations (2000 / 125 = 16).

CP 443-1 Architecture and Connection Queue Collisions

The Siemens Open Modbus / TCP package uses standard S7 communication blocks (AG_SEND / AG_RECV or TSEND / TRCV executed via MODTCP_T / MODB_TCP):
* Single Connection Serialization: A CP 443-1 socket connection can only process one active send job at a time.
* The Collision Trap: If an engineer instantiates 16 separate MODB_TCP blocks in CFC and triggers all of them simultaneously (e.g., using a continuous 1-second clock pulse), the blocks attempt to write to the CP's internal send buffer concurrently.
* Error Return: The CP returns communication fault codes:
* 16#A006: Previous job still active on this connection.
* 16#A083: Communication buffer collision / socket busy.
* Data transmission halts, and tags in the PLC report frozen or corrupted values.

Step-by-Step Implementation of a Cyclic Job Sequencer

To deterministically transfer >2,000 words across a single TCP connection, implement a cyclic state-machine sequencer in SCL or CFC:

Step 1: Design the Multiplexed Parameter State Machine

Rather than creating 16 independent MODB_TCP function blocks, use one single MODB_TCP block instance and dynamically multiplex its input parameters:
* START_ADDRESS: Changes from 1, to 126, to 251, up to 1876.
* LENGTH: Set to 125 words for each step.
* DATA_BUFFER: A target DB containing a continuous array: Array[1..2000] OF WORD.

Step 2: Implement the Sequencer Logic (SCL Example)

CASE State OF
    0: // Idle / Start Step
        Start_Addr := 1;
        Dest_Offset := 0;
        Trigger_Req := TRUE;
        State := 1;

    1: // Wait for Query Completion
        IF Done THEN
            // Copy received 125 words to continuous storage buffer
            BLKMOV(SRCBLK := Recv_Buffer, DSTBLK := Global_Array[Dest_Offset]);
            Trigger_Req := FALSE;

            // Advance to next chunk or finish cycle
            IF Start_Addr >= 1876 THEN
                State := 0; // Cycle complete; restart or wait for timer
            ELSE
                Start_Addr := Start_Addr + 125;
                Dest_Offset := Dest_Offset + 125;
                Trigger_Req := TRUE; // Trigger next request
            END_IF;
        ELSIF Error THEN
            // Handle error, retry or timeout
            Trigger_Req := FALSE;
            Error_Counter := Error_Counter + 1;
            State := 0;
        END_IF;
END_CASE;

Step 3: Redundant Multi-Connection Alternative

If the 2,000-word dataset must update faster than sequential polling permits (e.g., < 500 ms refresh):
1. In NetPro, configure multiple parallel TCP connections to the slave device (e.g., 4 connections if supported by the slave).
2. Assign 4 separate MODB_TCP instances, each reading 500 words across its own independent socket.
3. For redundant fault-tolerant systems, deploy MODB4H / MODTCP_RED to provide automatic failover across redundant CP 443-1 cards.

High-Volume Modbus TCP Architecture and Sizing Reference Matrix

The following table outlines architectural choices and performance characteristics for high-volume Modbus TCP communication in PCS 7:

Architecture StrategyModbus Blocks RequiredTCP Connections UsedUpdate Refresh TimeEngineering ComplexityCyclic Sequencer (Recommended)1 MODB_TCP Instance1 Connection1.5 to 3.0 secondsLow (Clean SCL State Machine)Multi-Block Parallel (Single TCP)16 Instances1 ConnectionFails (Buffer Collision 16#A006)UnusableMulti-Connection Parallel4 Instances4 Connections400 to 800 msModerate (Requires slave socket support)Redundant Modbus (MODB4H)2 MODTCP_RED Instances2 Redundant Paths1.5 to 3.0 secondsHigh (Certified high-availability)

Employing a state-machine sequencer guarantees zero telegram collisions and deterministic data buffering.

Verification

To verify that high-volume Modbus data transfer is functioning properly:
1. In CFC Editor Test Mode, monitor the sequencer state machine; confirm it cycles smoothly from Step 1 through Step 16.
2. In the AS data block, inspect Global_Array[1..2000]; confirm that all registers update dynamically.
3. Verify that the MODB_TCP block reports ERROR = 0 and error status 16#0000.
4. Disconnect the Modbus slave Ethernet cable; confirm that the sequencer detects timeout, flags communication error, and freezes or clears data according to safety specifications.
5. In WinCC Runtime, confirm that measurements derived from the 2,000 words display live values.

Limitations and Operational Precautions

Modbus register numbering conventions (0-based vs 1-based addressing) frequently cause a 1-register offset (Register 40001 = Offset 0); verify slave register maps carefully.
Open Modbus / TCP requires a runtime software license dongle or ALM license key per CP 443-1; running without a valid license will trigger periodic communication stops.
Avoid polling large arrays in fast cyclic interrupt tasks (OB35 at 100 ms); schedule the Modbus sequencer in slower OBs (OB34 or OB33) to prevent CPU cycle overruns.
For procurement and ordering, always validate final license quantities and MLFBs against the applicable Siemens catalog and authorized distributor quotation.

Engineer FAQ

Why does Modbus limit queries to 125 words?

The Modbus Application Protocol Specification limits the Protocol Data Unit (PDU) to 253 bytes. Because each 16-bit register consumes 2 bytes, 125 registers (250 bytes) is the absolute mathematical limit.

What causes error code 16#A006 on the MODTCP block?

Error 16#A006 indicates that a new send job was triggered before the previous job on that same TCP connection completed its transmission handshake. Send jobs must be sequenced.

Can CP 443-1 communicate with redundant Modbus TCP slaves?

Yes, by using the Siemens Open Modbus / TCP Redundant block package (MODB4H), which manages automatic IP failover between dual Modbus slave servers.