KB Controls is reader-supported. When you buy through links on our site, we may earn an affiliate commission. Read more in our disclaimer

PLC-PLC Communication with Modbus/TCP

Advantages, Disadvantages, and an Application Example of Modbus/TCP Communication in TIA Portal.

Communication between PLCs is a common requirement in automation projects.

In modern PLCs, there are so many options for communication available that it can be hard to decide which one to use. Each communication option has advantages and disadvantages, as well as a unique way of working.

In this article, I’ll provide a quick start guide for configuring Modbus/TCP between two S7 PLCs. It will demonstrate how to configure an S7 PLC as a Modbus Server or Client in TIA Portal.

In the next sections, I will;

  • Explain the advantages of using Modbus/TCP
  • Explain the disadvantages of using Modbus/TCP
  • Demonstrate how to set up Modbus/TCP communication between two PLCs using the MB_SERVER and MB_CLIENT instructions in TIA Portal

Advantages of Modbus/TCP

Modbus/TCP can be Routed Over Ethernet

Modbus/TCP communication can be routed over Ethernet which means that its possible for two devices on different subnets to communicate. This is a huge advantage over protocols like S7 Communication, where packets can be routed between subnets.

Modbus/TCP has Built-In Diagnostics

The Modbus/TCP communication protocol has a defined communication timeout that occurs between a client and server. This means that if the communication between two devices breaks down, we get an error to alert us that something has gone wrong.

Modbus/TCP Works with Optimized Data Blocks

Since Modbus/TCP is a relatively modern protocol, it can work with Optimized Data Blocks in TIA Portal. This makes it ideal for new projects that are taking advantage of the technological innovations in the S7-1200 and S7-1500 controllers.

For legacy systems, Modbus/TCP can also be used with Unoptimized Data Blocks.

Modbus/TCP is Vendor Agnostic

Modbus/TCP is a communication protocol that is supported by most industrial devices. This means that the communication protocol is not tied to the hardware of a specific vendor (like S7 Communication). For this reason, Modbus/TCP is an ideal communication protocol for communicating between devices made by different manufacturers.

Disadvantages of Modbus/TCP

Modbus/TCP is not a Secure Communication Protocol

Modbus/TCP does not provide the option to use security or encryption when communicating between devices. This creates a potential security vulnerability in an automation system.

Modbus/TCP Requires Client and Server Side Programming

Unlike S7 Communication, which is a single sided communication mechanism, for two devices to communicate via Modbus/TCP, both devices must be programmed. In TIA Portal, that means that the sending PLC must be programmed with an instance of the MB_CLIENT instruction and the receiving PLC must be programmed with an instance of the MB_SERVER instruction.

Based on these advantages and disadvantages, we can see that it makes sense to use the Modbus/TCP communication protocol when;

  • We are communicating between devices made by different manufacturers (e.g an S7 PLC and a Universal Robot controller),
  • When security is not a concern (e.g in an air gapped automation system)

Using Modbus/TCP for PLC-PLC Communication

Hardware Configuration

To demonstrate how to configure Modbus/TCP communication between two S7-1500 PLCs, I have created a new TIA Portal project and added two PLCs to the project.

Hardware Configuration

Software Configuration

As I mentioned previously, Modbus/TCP is a dual sided communication protocol. That means that we have to program both the sending and receiving PLC. Let's start by configuring the sending PLC, PLC_1.

MB_CLIENT Configuration

In OB1, I add a call to the MB_CLIENT instruction, which is found in the Instructions toolbox under Communications > Others > MODBUS TCP. In this folder, you also see a MODBUS TCP Redundancy folder. These instructions are a cost option and are not provided for free by Siemens.

Create a Call to MB_CLIENT

After creating an instance data block for the call to MB_CLIENT, I can start parameterizing the block.

The REQ pin tells the Modbus client to poll the data exchanged with the Modbus server. If the REQ pin is permanently high, then the client will poll the server at a rate that is pre-defined by the instruction. In this example, I have set the REQ pin to True so that the client is continuously polling the server.

The DISCONNECT pin forces the client to disconnect from the server. In this example, I have set the DISCONNECT pin to False.

The MB_MODE pin defines the mode of the Modbus request from the client. You can use the value 0 to select read mode and the value 1 to select write mode. Here I use a constant with the value of 1 to indicate that we want to use the Modbus client to make a write request to the server.

The MB_DATA_ADDR pin is a reference to the holding register that will be used in the communication between the client and server. In an S7 PLC, the holding registers are located at the addresses 40,001 to 49,999. In this example, I will use the first holding register located at address 40,0001.

The MB_DATA_LEN pin defines the length of the data to write to the server. This length is expressed in holding registers. One holding register is two bytes. In this example, I am writing 2 holding registers, which is 8 bytes of information.

The MB_DATA_PTR pin is a pointer to the data that we want to write from the client to the server. In this example, I have enabled the Clock Byte in the hardware configuration of the PLC at Memory Byte 0 and I have created a pointer to this location.

The CONNECT pin is interconnected with an instance of the UDT TCON_IP_v4, which contains all of the connection information to connect to the other PLC. In this example, I have created a new DB to store this information and interconnected the member with the instruction.

MB_CLIENT Configuration

The configuration of the CONNECT pin is shown below.

Client Connection Configuration

MB_SERVER Configuration

In PLC_2, I create an instance of the MB_SERVER Instruction.


On this block, we have a few pins to parameterize.

Once again, a DISCONNECT pin is available to force a disconnection of communication between the client and server. I have connected the value False to this input.

Next, the MB_HOLD_REG pin is a pointer to the location where the data received from the client will be written to. In this example, I have created a DB to store the data and connected the member of the DB to the pin.

Finally, we have a CONNECT pin which contains the information to connect with the other PLC. Once again, I have interconnected a member of type TCON_IP_v4 from a new DB called DB_Connection.

MB_SERVER Configuration

The Configuration of the CONNECT pin is shown below:

Server Connection Configuration

Download and Go Online

With both the Modbus client and server configured, we can download to the PLCs and Go Online with both PLCs to see if the communication is working as expected.

In both PLCs, you should see that the connection has been established and that the value at the status pins of the MB_CLIENT and MB_SERVER blocks are updating to provide diagnostic information about the communication. The value 16#7006 indicates that data is being sent and 16#7007 indicates that data is being received.

If you were to break the connection between the PLCs, the status pin would update to give an indication of the error that was detected.


In this post, we learned how to use Modbus/TCP to communicate data between two S7 PLCs.

If you encounter Modbus/TCP in the wild, it will most likely be in an application where you are programming the communication between an S7 PLC and another device from another manufacturer. In that case, you would configure the PLC as a Modbus client, server, or both depending on the application's requirements.

PLC Programming Bootcamp

Learn how to write, test, and simulate your first PLC program for free.

Get Started

Related Content