Integrating Third-Party Systems and Package Units into PCS 7 Using SIMATIC CN 4100 via Modbus TCP and OPC UA

In SIMATIC PCS 7 (V9.0 / V9.1), integrating third-party PLCs, OEM package units, and safety systems via Modbus/TCP or OPC UA is accomplished using the SIMATIC CN 4100 (Communication Node 4100). The CN 4100 acts as a high-performance protocol bridge between industrial Ethernet field networks and PCS 7 controllers (such as CPU 410-5H). It is configured using the standalone CNET engineering tool, which maps Modbus register tables and OPC UA server nodes into standard PCS 7 hardware configurations and CFC channel driver blocks.

Executive Summary

Modern process automation facilities frequently incorporate specialized mechanical package units (such as chillers, air compressors, water treatment skids, and vendor-packaged burner management systems) controlled by third-party PLCs (e.g., Rockwell Automation, Schneider Electric, or legacy Modbus devices). Integrating these external systems into SIMATIC PCS 7 traditionally required complex serial CP modules, third-party software gateways, or custom S7 Open User Communication (TSEND/TRCV) blocks, resulting in high engineering overhead and maintenance difficulty.

To standardize and streamline package unit integration, Siemens introduced the SIMATIC CN 4100 Communication Node. Operating as an intelligent, rack-independent communication gateway, the CN 4100 natively supports Modbus/TCP (client and server) and OPC UA (client and server). This article provides a comprehensive overview of the CN 4100 system architecture, hardware connectivity, supported protocols, and engineering integration workflow within SIMATIC PCS 7.

Architecture and Fundamental Mechanics

The SIMATIC CN 4100 operates as an autonomous industrial edge gateway bridging field networks and the PCS 7 automation layer:

Hardware Architecture and Interfaces:
- The CN 4100 is a ruggedized DIN-rail mounted communication appliance powered by redundant 24 V DC supplies.
- It features multiple independent Gigabit Ethernet interfaces (typically 4 ports organized into isolated subnets):
- Interfaces X1/X2: Connect to the third-party field network (Modbus TCP slaves/servers or external OPC UA servers).
- Interfaces X3/X4: Connect to the SIMATIC PCS 7 Plant Bus or controller PROFINET network.
- This physical network separation provides a secure firewall boundary between external package unit networks and the critical plant control bus.
Protocol Translation Capabilities:
- Modbus/TCP Client/Server: Polls third-party Modbus TCP devices cyclically (holding registers, input registers, discrete inputs, coils) and exposes data to PCS 7.
- OPC UA Client/Server: Connects securely to third-party OPC UA servers with full cryptographic certificate exchange, browsing data nodes and subscribing to value changes.
- Open User Communication (OUC): Facilitates high-speed cyclic or acyclic raw Ethernet communication.
PCS 7 Integration Layer and Module Drivers:
- In SIMATIC Manager, the CN 4100 is integrated into HW Config using a dedicated GSDML/HSP or standard S7 communication blocks.
- The Siemens PCS 7 CN 4100 Library provides pre-built APL-style technological channel blocks (such as CN_InBool, CN_InReal, CN_OutReal).
- These blocks automatically handle signal scaling, quality codes, and diagnostic buffer reporting directly in CFC charts.

Step-by-Step Implementation Procedure

Follow these steps to deploy and integrate the SIMATIC CN 4100 into a SIMATIC PCS 7 project:

Mount and Wire the Hardware:
- Install the SIMATIC CN 4100 on a standard 35 mm DIN rail inside the automation cabinet.
- Connect redundant 24 V DC power to power connectors L1+ and L2+.
- Connect Ethernet cable from port X1/X2 to the third-party skid network switch.
- Connect Ethernet cable from port X3/X4 to the PCS 7 Plant Bus switch.
Configure Network and Protocol Parameters Using CNET:
- Launch the Siemens CNET (Configuration Network Engineering Tool) software.
- Create a new CN 4100 project and assign IP addresses and subnet masks to the physical Ethernet interfaces.
- Select the target protocol (e.g., 'Modbus TCP Client' or 'OPC UA Client').
- In the Modbus mapping editor, define the remote slave IP address, port (default 502), unit ID, and register addresses (holding registers 40001+, input registers 30001+).
- (If OPC UA): Import the third-party server security certificate, configure endpoint URL (opc.tcp://...), and map target variable nodes.
Export Configuration and Import into STEP 7:
- In CNET, validate the configuration consistency and export the data mapping files (.xml/.csv).
- Open the SIMATIC PCS 7 multiproject in SIMATIC Manager.
- In HW Config, insert the CN 4100 node into the PROFINET IO or Industrial Ethernet network.
- Link the exported CNET mapping table to the CN 4100 hardware configuration object.
Instantiate Driver Blocks in CFC:
- Open the destination CFC chart in Plant View.
- From the PCS 7 CN 4100 Library, drag technological driver blocks (e.g., CN_InReal for analog process variables, CN_InBool for discrete status bits).
- Interconnect the block's address inputs with the mapped I/O symbols defined in the symbol table.
Compile and Download:
- Execute 'Chart > Compile > Charts as Program...' with 'Generate module drivers' enabled.
- Download the S7 program to CPU 410-5H in RUN mode.
- Download the network configuration from CNET directly to the CN 4100 hardware appliance via its service interface.

Verification

Inspect CN 4100 front diagnostic LEDs: confirm RUN LED is steady green and BUSF/FAULT LEDs are off.
In CNET, connect online: verify that communication status displays 'Active' with 0 frame error counters for all configured Modbus slaves or OPC UA endpoints.
In CFC Test Mode: confirm that CN_InReal and CN_InBool blocks receive live process values from the third-party skid with Quality Code 16#80 (Good).
In WinCC Runtime: confirm that process variables display live trends and that alarm limits trigger correctly.

Limitations and Operational Precautions

Ensure that the third-party Modbus device does not exceed the CN 4100 maximum polling cycle rate; over-polling can cause request timeouts on resource-constrained slave PLCs. When using OPC UA, secure certificate renewal must be managed to prevent communication interruptions upon certificate expiration. Hardware modules, runtime licenses, and library options should be procured and verified through an authorized Siemens distributor or the Siemens Industry Mall.

Engineer FAQ

What protocols are supported by the SIMATIC CN 4100?

The CN 4100 supports Modbus/TCP (client and server), OPC UA (client and server), and Open User Communication (OUC).

What engineering tool is used to configure the CN 4100?

The standalone Siemens CNET (Configuration Network Engineering Tool) software.

Can the CN 4100 connect directly to CPU 410-5H?

Yes, it communicates with CPU 410-5H over PROFINET IO or Industrial Ethernet Plant Bus.

Does the CN 4100 provide network isolation?

Yes, its physical Ethernet ports operate on separate internal subnets, providing galvanic and logical separation between plant bus and third-party networks.