Sizing and Segmenting Modbus TCP Server Registers Using MB_REDSV in PCS 7

In SIMATIC PCS 7, when an S7-400H or CPU 410-5H communicates with an external DCS (such as a GE DCS) using the redundant Modbus TCP server block MB_REDSV and the client experiences intermittent communication drops, the packet size and polling schedule are dictated entirely by the external Modbus Client (Master), not the Siemens server. Because MB_REDSV acts as a passive server, the Siemens CPU cannot proactively divide data into smaller packages; the external GE DCS client must be configured to split its Read Holding Registers (Function Code 03) queries into smaller register blocks (e.g., 50 to 100 registers per telegram instead of 124). On the PCS 7 side, data is segmented by mapping distinct holding register ranges to separate Data Blocks (DBs) within the MODBUS_PARAM configuration structure and verifying gateway timeout settings.

Executive Summary

Interfacing SIMATIC PCS 7 controllers with third-party Distributed Control Systems (such as GE Mark VIe or Emerson DeltaV) is frequently achieved using the PCS 7 Modbus TCP Redundant Server library (MB_REDSV). During site commissioning, third-party DCS engineers often observe communication timeouts or data freezes across plant firewalls and fiber links, pushing Siemens automation engineers to 'divide the server data into smaller packages.' In Modbus TCP protocol architecture, servers are strictly passive responders. Understanding client-server request dynamics, holding register segmentation across multiple Data Blocks, and network gateway timeout parameters resolves third-party DCS communication deadlocks.

Architecture and Fundamental Mechanics

The communication mechanics and data exchange roles of the PCS 7 MB_REDSV block operate through distinct protocol specifications:

The Client-Server Asymmetry of Modbus TCP:
* In Modbus TCP, communication is strictly master-driven (Client-driven).
* The Modbus Client (GE DCS) initiates all TCP requests: specifying the Unit Identifier (Slave ID), Function Code (e.g., FC 03 Read Holding Registers), starting register address (e.g., 40001), and number of registers requested.
* The Modbus Server (S7-400H with MB_REDSV) is completely passive. It cannot initiate telegrams, cannot arbitrarily split a client request into multiple responses, and must answer the client request with a single TCP response packet containing the exact data length requested.
The 124/125 Register Boundary Limitation:
* Per the Modbus application protocol specification, a standard Read Holding Registers request can request a maximum of 125 registers (250 bytes) per PDU.
* While 124 registers is theoretically compliant, intermediate industrial cybersecurity firewalls, NAT gateways, or legacy third-party DCS communication cards frequently suffer internal buffer overruns or packet fragmentation drops when processing large frames near the maximum limit.
* Therefore, splitting queries into chunks of 50 to 64 registers must be executed on the Client side by scheduling multiple sequential polling jobs.
Data Block Mapping in MB_REDSV:
* In PCS 7, MB_REDSV links external Modbus register addresses to internal SIMATIC Data Blocks (DBs) using parameterization blocks (MODBUS_PARAM).
* You can configure multiple sequential or non-contiguous register areas (e.g., Area 1: 40001..40050 mapped to DB10, Area 2: 40051..40100 mapped to DB11).
* This organizes process data logically inside the S7 CPU without altering protocol mechanics.

Step-by-Step Implementation Procedure

Follow these procedures to configure, segment, and troubleshoot Modbus TCP server communication using MB_REDSV:

Structure Data Blocks for Logical Register Mapping:
* In SIMATIC Manager, create dedicated Data Blocks for Modbus data (e.g., DB100 for Analog Measurements, DB101 for Digital Statuses).
* Ensure each DB is formatted with standard word/real array structures matching the expected register layout.
Configure MODBUS_PARAM Parameterization Block:
* In CFC, open the parameterization chart for MB_REDSV.
* In the parameterization DB, define the data areas:
- data_type_1 := B#16#3 (Holding Registers).
- db_1 := W#16#64 (DB 100).
- start_1 := W#16#0 (First register offset in DB).
- end_1 := W#16#64 (Last register offset in DB - 100 registers).
- Configure data_type_2, db_2, start_2, end_2 for subsequent data ranges.
Instruct External DCS Engineer to Reconfigure Client Polling:
* Formally inform the third-party (GE) DCS engineer that the S7-400H is a passive Modbus TCP server.
* Request the GE DCS engineer to split their single master polling block into two or more smaller sequential polling requests (e.g., Request A: Read 60 registers from 40001; Request B: Read 60 registers from 40061).
* Ensure the client configures a minimum pause time (e.g., 20 ms to 50 ms) between sequential polling requests to allow TCP buffer clearance.
Verify Gateway and Switch Timeout Settings:
* In plant network firewalls and switches, verify that TCP Keep-Alive is enabled for port 502.
* Set the Modbus response timeout on the GE DCS client to at least 1,000 ms to 2,000 ms to accommodate redundant CPU cycle execution and network latency.
Monitor MB_REDSV Diagnostics in CFC Test Mode:
* Open the CFC chart containing MB_REDSV in test mode.
* Verify that output pin BUSY toggles during client requests and that ERROR remains FALSE.
* If errors occur, monitor STATUS (e.g., 16#80C8 for timeout or 16#80B0 for invalid register address).

Verification

Connect a Modbus test simulator (e.g., Modscan or Modbus Poll) directly to the CP 443-1 port using an isolated commissioning cable. Execute polling of 120 registers; verify 100% successful responses with zero error counters. Then reconnect the plant network and have the GE DCS issue its split polling requests; confirm that the GE DCS displays stable, live updating process data without intermittent drops.

Limitations and Operational Precautions

The S7-400H cannot control the polling frequency or request size of an external Modbus Client; if the client floods the server with unthrottled requests, TCP connection resets will occur. MB_REDSV requires an official Siemens runtime license key (Modbus/TCP Redundant Server) per controller pair.

Engineer FAQ

Can MB_REDSV divide outgoing Modbus responses into multiple packets?

No. Modbus TCP is a request-response protocol; the server must respond to each client request with a single response matching the requested length.

Why did the GE DCS experience intermittent drops with 124 registers?

Intermediate network gateways, cybersecurity switches, or the GE DCS communication card buffer often drop or truncate frames near the maximum 125-register limit; splitting into smaller chunks resolves buffer overruns.