Siemens S7-1200 Modbus TCP Register Reading Tutorial

Key Takeaways

Siemens S7-1200 can act as a Modbus TCP client and read holding registers from a Modbus server using the built-in MB_CLIENT block.
Holding registers are 16-bit WORD values and are typically read as Modbus address 40001 onward.
In TIA Portal, the key setup items are the TCON_IPv4 connection data, the MB_CLIENT call, and a WORD array in a data block.
Use a clean register map, slow your request pulse, and verify connectivity with a Modbus test tool before troubleshooting the PLC logic.
For panel applications, pair the PLC with proper networking hardware and consider related components like PLC IO modules, HMI/SCADA, and protection relays.

If you need to read holding registers from a Modbus TCP device with a Siemens S7-1200, the job is straightforward once you understand Siemens’ connection model and the Modbus addressing rules. The S7-1200 is a good fit for machine control, utility skids, and process systems where you need to poll third-party devices like energy meters, VFDs, analyzers, or remote I/O.

In this tutorial, I’ll walk you through the practical setup in TIA Portal, show you how to build the tags and data blocks, explain the address mapping, and cover the most common faults I see in the field.

For applications in industrial manufacturing, water and wastewater, and oil and gas, this pattern is used constantly. It is also common in data centers where power monitoring and chilled-water systems often expose Modbus TCP registers.

What You Need Before You Start

Hardware and software requirements

You need an S7-1200 CPU with Modbus TCP support, typically a CPU 1212C, 1214C, or similar S7-1200 model. The PLC should have firmware V4.0 or later for full support. Use TIA Portal V16 or newer; V17 and V18 are common when you are working with newer firmware.

You also need:

A Modbus TCP server device with a known IP address
Ethernet connectivity between PLC and device
TIA Portal project access
A Modbus test tool such as Modbus Poll or ModbusClientX
Basic network access to port 502

If this is part of a larger control panel, the PLC is usually housed in a PLC automation panel or motor control center, depending on the application.

Know the register type

Modbus holding registers are 16-bit words. That matters because Siemens prefers clean typed data. Don’t try to read holding registers directly into bits or integers of the wrong size. Read into a WORD array and then reinterpret the values if needed.

Here is the practical rule:

| Item | Value | |---|---:| | Modbus TCP port | 502 | | Function code for holding registers | FC03 | | Siemens MB_CLIENT mode for read | 0 | | Data type for register buffer | WORD[] | | Typical max registers per request | 120–125 words |

Understanding the Addressing

Modbus address vs Siemens address

This is where many people get stuck. Modbus documentation often shows holding registers as 40001, 40002, and so on. In Siemens MB_CLIENT, you do not enter the human-friendly 40001 format. Instead, you use the register offset.

For the first holding register, use:

DATA_ADDR = 40,0 in the convention shown in many Siemens examples
Practically, think of this as the first holding register, or 40001

So if your device manual says:

40001 = temperature
40002 = pressure
40003 = flow

Then your read starts at the first register and reads a block into a word array.

A simple register map example

| Modbus register | Meaning | PLC buffer index | |---|---|---:| | 40001 | Temperature | Data[0] | | 40002 | Pressure | Data[1] | | 40003 | Flow | Data[2] | | 40004 | Status bits | Data[3] |

This is why I recommend documenting the register map directly in the DB comments. Six months from now, you will not remember why Data[7] mattered.

TIA Portal Setup Step by Step

1) Create a data block for the Modbus values

Create a new DB for the incoming data. Use an array of WORD.

Example structure:

DATA_BLOCK "DB_Modbus"
VAR
    Data : ARRAY[0..15] OF WORD;
END_VAR

If you expect more values later, size the buffer generously. Just stay under the practical request limit.

2) Create a connection structure

Use a TCON_IPv4 structure for the connection parameters. Set:

LocalPort = 0 or auto
RemotePort = 502
ConnectionType = 11
RemoteAddress = the Modbus server IP

Example configuration:

Connect_DB :
TCON_IPv4 := (
    LocalPort := 0,
    RemotePort := 502,
    ConnectionType := 11,
    RemoteAddress := '192.168.0.100'
);

If you are building a panel with a VFD or remote device, make sure your network topology is clean. For example, a variable frequency drive on the same subnet is fine, but do not leave the PLC fighting with routing or NAT unless you have to.

3) Insert the `MB_CLIENT` block

In TIA Portal, insert MB_CLIENT in OB1 or a cyclic FC. Use a pulse on REQ, not a continuous 1. That way you make a request, wait for it to finish, then request again.

Example SCL-style call:

MB_CLIENT(
    REQ := ReadPulse,
    MODE := 16#00,      // Read holding registers
    DATA_ADDR := 4000,  // First holding register offset
    DATA_LEN := 16,
    CONNECT := Connect_DB,
    DATA := DB_Modbus.Data,
    DONE => ReadDone,
    ERROR => ReadError,
    STATUS => ReadStatus
);

4) Generate a read pulse

Use a timer or a one-shot bit to trigger the request every second or every few hundred milliseconds.

Ladder-style pseudocode:

// Pulse every 1 second
TON_1s(IN := TRUE, PT := T#1s);

IF TON_1s.Q THEN
    ReadPulse := TRUE;
    TON_1s(IN := FALSE);
END_IF;

In practice, I prefer a clean edge-triggered pulse so the block doesn’t stay busy longer than intended.

5) Watch the outputs

Monitor:

DONE
ERROR
STATUS
DATA_LEN_ACTUAL

If DONE goes high, the read succeeded. If ERROR is high, use the STATUS code to diagnose the issue.

Example Structured Text Implementation

Here is a more complete example you can adapt:

FUNCTION_BLOCK FB_ModbusRead
VAR_INPUT
    Poll : BOOL;
END_VAR
VAR_OUTPUT
    Done : BOOL;
    Error : BOOL;
    Status : WORD;
END_VAR
VAR
    Trig : BOOL;
    ModbusData : ARRAY[0..15] OF WORD;
    Connect_DB : TCON_IPv4;
END_VAR

// Connection parameters
Connect_DB.RemotePort := 502;
Connect_DB.ConnectionType := 11;
Connect_DB.LocalPort := 0;
Connect_DB.RemoteAddress := '192.168.0.100';

MB_CLIENT(
    REQ := Poll,
    MODE := 0,
    DATA_ADDR := 4000,
    DATA_LEN := 16,
    CONNECT := Connect_DB,
    DATA := ModbusData,
    DONE => Done,
    ERROR => Error,
    STATUS => Status
);

You can then copy ModbusData[0] through ModbusData[15] into engineering units, scaling blocks, or HMI tags.

Testing the Device Before You Blame the PLC

Before chasing PLC logic, test the Modbus server with an external client. This is the fastest way to isolate whether the problem is in the device or in Siemens configuration.

Use a tool like Modbus Poll or ModbusClientX and connect to:

IP address of the device
Port 502
Function code 03
Holding register start address matching the device map

If the external tool reads correct values, your slave/server is healthy. If it fails there, stop debugging the PLC and fix the device side first.

That same approach applies whether the device is in a food and beverage process line or a utility skid in a water/wastewater plant.

Common Pitfalls and Fixes

1) Wrong address offset

A classic mistake is entering 40001 directly where the block expects an offset. In Siemens, use the correct offset format. If the device manual says register 40001, don’t assume that means literal 40001 in the block.

2) Wrong data type

Holding registers are words. Store them in WORD[]. If you need 32-bit values, combine two words carefully with endianness in mind.

3) Request pulse held too long

Do not hold REQ high continuously. Pulse it briefly and wait for the block to complete. If you hammer the device, you will get status errors and poor network performance.

4) Network issues

Check:

PLC and server IP addresses
Subnet mask
Gateway if crossing subnets
Firewall rules on port 502
Physical link status

5) Too much data per request

Stay within the practical register count. A smaller, more frequent request is often better than a huge one. It also reduces scan-time pressure on the CPU.

Troubleshooting Status Codes

| Status code | Meaning | What to check | |---|---|---| | 80C1 | Connection timeout | IP, port 502, ping test, server online | | 80A4 | Invalid data length | Reduce register count | | 7001 | Request active too long | Use a pulse, not a held request | | 0000 | No error | Successful transaction |

Use TIA Portal online diagnostics and watch tables to monitor the connection object and buffer. If needed, run Wireshark and filter on TCP port 502 to confirm traffic is actually leaving the PLC.

Best Practices for Production Panels

When this goes into a real panel, design it like a maintenance engineer will inherit it tomorrow.

Name your registers clearly in the DB
Keep the Modbus map documented in a comment table
Separate comms logic from application logic
Add retry logic and fallback states
Buffer values before handing them to HMI/SCADA
Use VLANs or VPNs if the network leaves the control layer

If you are integrating this into an HMI/SCADA system or pairing it with contactor/motor starters, clean data handling pays off immediately.

Comparison: Reading Holding Registers in Siemens vs Other PLCs

| Brand | Typical approach | Notes | |---|---|---| | Siemens S7-1200 | MB_CLIENT with TCON_IPv4 | Clean and native in TIA Portal | | Rockwell CompactLogix | MSG or gateway-based mapping | Often needs more setup | | Schneider Modicon | Modbus TCP client FB | Very direct mapping | | Beckhoff | Modbus library calls | Flexible, software-centric |

Siemens is not the only way to do it, but it is a solid way when you want a predictable industrial workflow.

External References

Siemens S7-1200 Modbus tutorial reference: https://www.youtube.com/watch?v=lLMsfaa3nPE
Siemens Modbus overview and register mapping discussion: https://ubidots.com/blog/siemens-simatic-s7-modbus/
Siemens S7-1200 Modbus video guide: https://www.youtube.com/watch?v=pTGQXnsMxkE
Siemens memory bit and Modbus TCP discussion: https://industrialmonitordirect.com/blogs/knowledgebase/reading-and-writing-memory-bits-via-modbus-tcp-on-s7-1200
Modbus Application Protocol Specification: https://modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf

Next Steps

Now that you can read holding registers from a Modbus TCP device, the next logical topics are:

PLC communication protocols
Structured Text programming
Ladder logic design patterns
PLC troubleshooting guide
Panel design examples like PLC automation panels and VFD panels

Need a custom PLC or automation panel built to spec? Patrion's engineering team can help — [email protected]

Key Takeaways