Configuring Modbus RTU for Keller PR-33X Sensors on Siemens

Problem Overview: Keller PR-33X Modbus RTU on ET200SP

The Keller PR-33X series pressure and level transmitters expose process data over Modbus RTU on an RS-485 physical layer. When integrating these sensors with a Siemens ET200SP distributed I/O station controlled by an S7-300 (or S7-1500) CPU, engineers typically select the CM PtP communications module with order number 6ES7137-6AA00-0BA0 and the Modbus RTU master blocks FB640 (MODBUS_MASTER) and FB641 (MODBUS_SLAVE). Despite the apparent simplicity, field experience shows several recurring failure modes: STATUS returns 7002 on the master instance, the sensor never replies, or Comm_Load does not transition the CM PtP into RUN.

This guide documents the complete configuration path, the meaning of the 7002 status code, the prerequisite checks for the Keller slave, and the exact parameter values required by FB640 against the PR-33X register map. It is built from the Siemens TIA Portal V20 PTP special connection properties documentation and the SIMATIC ET 200SP manual collection.

Hardware Configuration and Wiring

The CM PtP module 6ES7137-6AA00-0BA0 is a serial interface module for the ET200SP that supports RS-422, RS-485, and RS-232 with Modbus RTU master/slave libraries. The module plugs into a BaseUnit (BU type A0 or B0) and is configured in TIA Portal under the ET200SP station's device view.

Pin Assignment for RS-485 to PR-33X

The Keller PR-33X exposes a 4-pin M12 connector or terminal block depending on variant. The RS-485 link uses a twisted pair with optional shield. The CM PtP 6ES7137-6AA00-0BA0 pinout is:

For multi-drop buses, terminate the line at both ends with a 120 Ω resistor between A and B. The PR-33X has an internal 120 Ω terminator that can be enabled via the manufacturer configuration tool; the CM PtP does not include internal termination, so an external resistor or a terminated BaseUnit may be required.

Power and BaseUnit

Use BaseUnit 6ES7193-6BP00-0DA0 (BU15-P16+A0+2D) for the CM PtP. Verify the 24 V DC supply is on a clean, dedicated circuit; noise on the 24 V rail can corrupt Modbus frames and trigger 7002/7006 errors on the master instance.

Keller PR-33X Modbus RTU Register Map

The Keller PR-33X supports Modbus RTU as a slave with a manufacturer-specific subset of the standard function codes. The key function code is FC03 (Read Holding Registers), used to retrieve pressure, level, and temperature process values. The full register map and floating-point conversion rules are documented in the Keller PR-33X datasheet.

Verify the address field in your FB640 request matches the Keller slave address. A common commissioning mistake is to use Unit ID = 100 on the master when the sensor is set to address 1; the sensor will simply not respond, and the master will time out.

TIA Portal Device and Module Configuration

1. Open the ET200SP station in the TIA Portal project tree and drag the CM PtP (6ES7137-6AA00-0BA0) onto a free slot.
2. Assign the BaseUnit type to match the installed hardware (BU15-P16+A0+2D or equivalent).
3. Open the module's Properties > Port Configuration and set:
   • Operating mode: RS-485 half-duplex
   • Baud rate: 9600 (typical for PR-33X; confirm with the device datasheet — 19200 and 38400 are also supported)
   • Parity: Even (Keller default) or None
   • Data bits: 8
   • Stop bits: 1
4. Set the receive line initial state and the response timeout. A typical timeout is 2000 ms for slow Keller devices.
5. Compile the hardware configuration and download to the CPU.

Program Structure: Comm_Load, FB640, FB641

The Modbus RTU master/slave communication for the CM PtP is implemented with three function blocks. The official Siemens example is available in the TIA Portal Help under "Communication > Modbus RTU".

Comm_Load (One-Time Parameterization)

Comm_Load is called once in OB100 (warm restart) or in a startup routine. It loads the port configuration into the CM PtP. If this block never runs, the CM PtP is not operational and every subsequent Modbus call returns STATUS = 7002.

FB640 MODBUS_MASTER (Cyclic Read Request)

FB640 issues a single Modbus request. It must be called cyclically (OB1) and triggered with a rising edge on REQ only when the previous call has completed (DONE = TRUE or ERROR = TRUE). The recommended pattern:

// FB640 MODBUS_MASTER - example instance for one PR-33X read
IF "instModbusMaster".DONE OR "instModbusMaster".ERROR THEN
    "startTrigger" := TRUE;       // start next request
ELSE
    "startTrigger" := FALSE;
END_IF;

"instModbusMaster"(REQ := "startTrigger",
                   MB_ADDR := 1,                  // PR-33X unit address
                   MODE := 0,                    // 0 = RTU, 1 = ASCII
                   DATA_ADDR := 1,               // start at register 0x0001
                   DATA_LEN := 6,                // read 6 registers (3 floats)
                   DATA_PTR := "mdProcessData",  // ANY pointer to data buffer
                   DONE => , BUSY => ,
                   ERROR => , STATUS => "mwStatus");

STATUS 7002 Root Cause Analysis

The STATUS output of FB640 reports the current state of the master. The value 7002 (hex 1B5A) has a specific meaning that depends on whether it appears on the REQ, BUSY, DONE, or ERROR output path. The most common interpretations in field service are:

Step-by-Step Resolution Procedure

1. Verify the CM PtP is in the correct slot. Open the device view, confirm the module at the configured slot is CM PtP 6ES7137-6AA00-0BA0, and note the system constant for the hardware identifier (e.g., CM_PtP_HW_ID).
2. Run Comm_Load once in OB100. Use the hardware identifier from step 1 as the PORT input. Set REQ to TRUE with a one-shot, monitor DONE, STATUS, and ERROR for one scan cycle. STATUS must return 0 (or 16#0000) on success.
3. Check the STATUS of Comm_Load. If STATUS <> 0, the port parameterization failed. Common faults: baud rate not supported (the 6ES7137-6AA00-0BA0 supports 300 to 115200), parity mismatch, or BaseUnit type error.
4. Call FB640 cyclically in OB1 only after Comm_Load has completed. Gate the REQ input on a rising edge generated after the first successful DONE or ERROR from the previous request.
5. Match the slave address. Use the Keller configuration tool (K-Log, READ30, or similar) to read the current Modbus slave address from register 0x0080. Set MB_ADDR on FB640 to that value.
6. Match serial parameters exactly. Use a USB-to-RS-485 converter and a Modbus master test tool (Modbus Poll, Simply Modbus, or the Siemens Modbus master test in TIA) to confirm the PR-33X is reachable on the bus before involving the PLC.
7. Read a small number of registers first. Set DATA_LEN = 2 (one FLOAT32) for the first test. If the request succeeds, expand to 6 registers.
8. Monitor STATUS continuously during commissioning. Watch for the transition 7001 → 7003 (success) or 7001 → 8190 (timeout). This is the most direct diagnostic feedback.

Verification and Commissioning Checks

After the master returns STATUS 0x7003 (DONE = TRUE, ERROR = FALSE), the data buffer DATA_PTR contains the raw Modbus register values. To verify the float conversion:

// Interpret PR-33X register pair as FLOAT32 (big-endian word order)
"mdPressureRaw"  := "mdProcessData".DW0;  // bytes 0..3
"mdTempRaw"      := "mdProcessData".DW2;  // bytes 4..7
"mdLevelRaw"     := "mdProcessData".DW4;  // bytes 8..11
// On S7-300 in big-endian, swap words if necessary
"rPressure_bar"  := DWORD_TO_REAL("mdPressureRaw");

Compare the engineering value to the live reading on the PR-33X display or to a calibrated reference. Typical acceptance criteria: pressure reading within 0.05 % FS of the reference at room temperature.

Troubleshooting Matrix

Advanced: Multi-Sensor Polling and Cycle Time

When polling multiple PR-33X sensors on the same RS-485 bus, instantiate one FB640 per sensor. Trigger the next request only when the previous DONE or ERROR has been received. Total cycle time for N sensors is approximately:

T_cycle = N × (T_request + T_response + T_idle)
T_request (bytes) = 8 + 2×DATA_LEN     // RTU framing
T_byte (ms) = 11000 / baud_rate        // 9600 baud → 1.146 ms/byte

For 3 sensors with DATA_LEN = 6 at 9600 baud, the per-frame byte count is 20, the byte time is ~1.15 ms, and the response time at the slave is typically < 5 ms. Total cycle ≈ 3 × (20 × 1.15 + 5) ≈ 84 ms, which is acceptable for typical process control loops. Increase the baud rate to 38400 to cut the cycle time to ~25 ms.

Differences Between S7-300 and S7-1500 Implementations

The same FB640 / FB641 library runs on both S7-300 (with CM PtP 6ES7137-6AA00-0BA0 on ET200SP) and S7-1500 (with CM PtP on ET200SP or PtP module in the central rack). The PTP special connection properties — which control how status messages are exchanged between the local and partner device — are documented in the TIA Portal V20 PTP connection properties guide. For Modbus RTU on the CM PtP, the special connection properties are typically not required — leave the default unchecked unless your PR-33X is configured for handshaking via the special status mechanism.

On S7-1500, the Modbus master blocks are FB1860–FB1863 in some library versions, but the behavior is identical. On S7-300, the legacy blocks are FB640/FB641. Cross-reference the TIA Portal online help for the version installed in your project.

Field-Proven Cautions

• Do not call FB640 with REQ = TRUE continuously. The block requires a one-shot edge; a held REQ will queue a single job, but the cycle behavior becomes confusing because DONE and ERROR only pulse for one cycle.
• Do not assume MB_ADDR = 1. The Keller default is 1, but PR-33X units are often shipped with a customer-specific address. Always read register 0x0080 first or check the device label.
• Confirm parity and stop bits with a scope or a Modbus scanner. A parity mismatch produces consistent timeout errors (8190) but no diagnostic interrupt.
• The CM PtP at 6ES7137-6AA00-0BA0 does not support Modbus TCP. If you need Modbus TCP to the PR-33X, use the PR-33X-ETH variant or a CP 1542-1 / CP 343-1.
• Keep cable shield grounded at one end only. Multi-point grounding creates ground loops that couple noise into the RS-485 differential pair.

Frequently Asked Questions