Configuring Modbus RTU Master on ET200SP CM PtP for Energy Meters

System Architecture and Communication Path

Reading data from a KLEFR 6934 three-phase energy meter over Modbus RTU requires three distinct layers to be correctly aligned: the physical RS-485 bus, the serial protocol framing (Modbus RTU), and the application layer that maps raw holding registers to engineering values. This article walks through the complete path from the ET200SP CPU to the energy meter using the CM PtP communication module 6ES7137-6AA00-0BA0, including hardware wiring, TIA Portal device configuration, the Modbus master parameterization, and SCL code that converts raw registers into 32-bit IEEE 754 floats in ABCD (big-endian, MSB first) byte order.

The reference hardware set used in this article is:

• CPU: SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7 510-1DJ01-0AB0, firmware V2.9 or higher recommended for full Modbus RTU master block support)
• CM PtP: SIMATIC ET 200SP CM PtP (6ES7137-6AA00-0BA0) installed on a Type A0 BaseUnit such as 6ES7193-6BP00-0DA0 or 6ES7193-6BP00-0BA0
• Energy meter: KLEFR 6934 three-phase direct energy meter, Modbus RTU slave over RS-485, 8 data bits / no parity / 1 stop bit or 8E1 (consult KLEFR operating instructions for the variant ordered)

RS-485 is the electrical layer, not a protocol. On top of RS-485 the meter uses Modbus RTU. The PLC must therefore be configured as a Modbus master and the meter as a Modbus slave with a unique address between 1 and 247. The CM PtP is the serial interface that converts the CPU's internal data buffers into differential A/B signals on the bus.

Prerequisites: Hardware, Firmware, and Software

Before commissioning, verify the following prerequisites.

Download the CM PtP manual from the official Siemens support page to keep the parameter list, diagnostic events, and error codes on hand during commissioning: ET200SP CM PtP manual (PDF).

Hardware Wiring: CM PtP to RS-485 Energy Meter

The CM PtP exposes the serial interface on the BaseUnit terminals. For RS-485, the relevant terminals are:

Steps to wire the bus:

1. Disconnect the ET200SP station power and the 24 V supply to the BaseUnit.
2. Connect terminal A of the CM PtP BaseUnit to terminal A of the KLEFR meter, and B to B. Polarity must match across the entire bus; reversing one device puts the slave in an indeterminate state.
3. Connect the cable shield at one end only (cabinet PE bar) to avoid ground loops; leave the meter end floating or use a small capacitor (10 nF / 100 V) for HF grounding.
4. Enable the CM PtP internal bus termination by setting the DIP switch on the back of the module to ON, but only if the CM PtP is physically the last device on the bus segment. Disable termination on all intermediate devices.
5. If the KLEFR meter is the other bus end, enable its 120 ohm termination (typically a 2-pin jumper labeled "TERM" or a 120R DIP switch on the meter PCB).
6. Power up the station and observe the LEDs on the CM PtP: a green PWR and a steady or slow-blinking DIAG indicate the module is ready for cyclic operation.

TIA Portal Device Configuration

After physically installing the CM PtP next to the CPU on the ET200SP rack, configure the module in the TIA Portal device view.

1. Open the project and select the ET200SP station in the project tree.
2. Drag the CM PtP (6ES7137-6AA00-0BA0) from the hardware catalog onto the slot next to the CPU. The order is fixed: CM PtP must be plugged into a BaseUnit directly adjacent to the CPU; it cannot be skipped.
3. In the module's Properties > General, switch the operating mode from Freeport (RS232/422/485) to Freeport protocol; the Modbus RTU master is a CPU-side library, so the module must be in freeport mode.
4. Set the Interface field to RS485 (half-duplex) and enable the internal termination if this module is the end of the bus.
5. Set the diagnostic behavior: enable hardware interrupts on wire break, only if you want a fast reaction to a disconnected cable; otherwise leave at default for commissioning.
6. Compile the hardware configuration and download it to the CPU.

The CM PtP must be assigned a hardware identifier (HW ID) by TIA Portal; this HW ID is later required by the MB_COMM_LOAD instruction. Note the HW ID (for example, 271) from the module's Properties > System constants tab.

Modbus Master Parameterization

Two function blocks implement the Modbus RTU master: MB_COMM_LOAD for one-time configuration of the serial port, and MB_MASTER for each request transaction. Both are part of the standard Modbus library that ships with every TIA Portal installation.

MB_COMM_LOAD parameters:

MB_MASTER parameters:

MB_COMM_LOAD and MB_MASTER Function Blocks: Call Order and Timing

Follow this sequence when calling the two blocks:

1. Call MB_COMM_LOAD in OB100 (startup OB) with a rising edge on REQ. Wait until DONE=TRUE and ERROR=FALSE before continuing. The block disables itself internally once the port is configured; further calls do nothing until REQ toggles again.
2. Call MB_MASTER in OB1. It must be called cyclically, but the REQ input should be pulsed with a rising edge to start each new transaction. If BUSY=TRUE, do not trigger a new request on the same instance.
3. Evaluate DONE and ERROR on each cycle. On ERROR=TRUE, read the STATUS word for the Modbus exception code (0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x90) or the CM PtP-specific error.
4. Chain requests with a small inter-frame delay. With KLEFR 6934 at 19200 baud, a typical 8-word read takes ~25 ms; allow at least 50 ms between consecutive REQ pulses on the same instance to avoid overlapping transactions.

SCL Program: Reading KLEFR Registers 5000-6006

Registers 5000 to 6006 (per KLEFR documentation) hold 32-bit floating-point measurements such as voltage, current, power, frequency, and energy. Each float occupies two consecutive 16-bit holding registers. With Modbus function code 03 (read holding registers) the master requests N consecutive 16-bit words and the slave returns them in big-endian order.

The following SCL example shows a cyclic state machine that reads the entire 5000-6006 range in chunks of 32 registers (16 floats) and converts each pair of words into an IEEE 754 float with byte order ABCD (big-endian, MSB first). The conversion is necessary because the S7-1500 stores REAL in little-endian (DCBA) order.

// DB "KlefrModbusData"
// State constants
CONST
    ST_IDLE      : INT := 0;
    ST_REQ_CHUNK : INT := 10;
    ST_WAIT      : INT := 20;
    ST_NEXT      : INT := 30;
    ST_DONE      : INT := 99;
END_CONST

DATA_BLOCK "KlefrModbusData"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
  STRUCT
      state        : INT;          // current state
      chunkIndex   : INT;          // 0..(n-1)
      chunkCount   : INT := 4;     // (6006 - 5000 + 2) / 32 = 4
      regStart     : ARRAY[0..3] OF UINT := [5000, 5032, 5064, 5096];
      reqPulse     : BOOL;
      rawBuffer    : ARRAY[0..63] OF WORD;   // 32 words = 16 floats per chunk
      floatBuffer  : ARRAY[0..15] OF REAL;
      lastError    : WORD;
      lastStatus   : WORD;
  END_STRUCT;
END_DATA_BLOCK

// FB "KlefrPoll" (SCL)
FUNCTION_BLOCK "KlefrPoll"
VAR
    mbLoad  : MB_COMM_LOAD;     // single instance, called from OB100
    mbMaster: MB_MASTER;        // one instance per chunk
    instData: "KlefrModbusData";
    tPulse  : TON;
END_VAR

BEGIN
    // State 0: idle, request next chunk
    IF instData.state = ST_IDLE OR instData.state = ST_NEXT THEN
        instData.chunkIndex := instData.chunkIndex + 1;
        IF instData.chunkIndex >= instData.chunkCount THEN
            instData.chunkIndex := 0;
        END_IF;
        instData.state := ST_REQ_CHUNK;
    END_IF;

    // State 10: fire REQ pulse, then move to wait
    IF instData.state = ST_REQ_CHUNK THEN
        mbMaster(
            REQ      := instData.reqPulse,
            MB_ADDR  := 1,                                     // KLEFR slave address
            MODE     := 0,                                     // FC03 read holding
            DATA_ADDR:= instData.regStart[instData.chunkIndex],// start register
            DATA_LEN := 32,                                    // 32 words = 16 floats
            DATA_PTR := P#DB "KlefrModbusData".rawBuffer,
            DONE     => _,
            BUSY     => _,
            ERROR    => _,
            STATUS   => instData.lastStatus
        );
        instData.reqPulse := FALSE;
        // Re-arm REQ for next cycle using a one-shot pulse
        instData.state := ST_WAIT;
    END_IF;

    // State 20: wait for DONE/ERROR
    IF instData.state = ST_WAIT THEN
        mbMaster(
            REQ      := FALSE,
            MB_ADDR  := 1,
            MODE     := 0,
            DATA_ADDR:= instData.regStart[instData.chunkIndex],
            DATA_LEN := 32,
            DATA_PTR := P#DB "KlefrModbusData".rawBuffer,
            DONE     => _,
            BUSY     => _,
            ERROR    => _,
            STATUS   => instData.lastStatus
        );
        IF mbMaster.DONE THEN
            instData.state := ST_NEXT;
        ELSIF mbMaster.ERROR THEN
            instData.lastError := instData.lastStatus;
            instData.state := ST_NEXT;   // skip and retry next cycle
        END_IF;
    END_IF;
END_FUNCTION_BLOCK

Float ABCD Byte Order and Data Conversion

The KLEFR 6934 returns floats in ABCD byte order, which is the standard big-endian / network byte order. The S7-1500 stores REAL in DCBA order (little-endian). The conversion is therefore a two-step byte swap per word pair:

The SCL snippet below converts the raw 16-bit word array into REAL values. It can be placed in the same FB or a separate FC called from the DONE branch of the poll state machine.

// FC "KlefrConvertABCDFloat" (SCL)
// Input:  pRaw  = P#DB "KlefrModbusData".rawBuffer (32 WORDs)
//         pReal = P#DB "KlefrModbusData".floatBuffer (16 REALs)
FUNCTION "KlefrConvertABCDFloat" : VOID
VAR_IN_OUT
    pRaw  : VARIANT;   // 32 WORDs
    pReal : VARIANT;   // 16 REALs
END_VAR
VAR_TEMP
    i       : INT;
    wHigh   : WORD;
    wLow    : WORD;
    dWord   : DWORD;
    rValue  : REAL;
END_VAR

BEGIN
    FOR i := 0 TO 15 DO
        // Read the two source words (big-endian) by symbolic name
        wHigh := WORD_TO_BLOCK_DB(NIL).rawBuffer[i * 2];
        wLow  := WORD_TO_BLOCK_DB(NIL).rawBuffer[i * 2 + 1];

        // ABCD > DCBA: swap bytes inside each word, then assemble as DWORD
        dWord := (DWORD(wHigh AND 16#00FF) SHL 8)
               OR (DWORD(wHigh AND 16#FF00) SHR 8)
               OR (DWORD(wLow  AND 16#00FF) SHL 24)
               OR (DWORD(wLow  AND 16#FF00) SHL 8);

        // Interpret DWORD as IEEE 754 REAL
        rValue := REAL_VALUE_FROM_DWORD(dWord);  // or: DWORD_TO_REAL via AT overlay

        // Store into destination REAL buffer
        WORD_TO_BLOCK_DB(NIL).floatBuffer[i] := rValue;
    END_FOR;
END_FUNCTION

An equivalent, type-safe approach uses an AT overlay on a 4-byte field. The principle is identical: take the two incoming WORDs in big-endian order, swap bytes within each word, and reinterpret the resulting DWORD as REAL. If you prefer a 16-bit byte swap instruction, search the TIA Portal libraries for SWAP / BYTE_SWAP_WORD; otherwise inline the shift-and-mask operations as shown above.

Diagnostics, LED Status, and Error Codes

The CM PtP has three LEDs relevant to commissioning: PWR, DIAG, and RX/TX. Their meaning in RS-485 freeport mode is documented in the CM PtP manual.

Modbus error codes returned in the STATUS output of MB_MASTER:

Troubleshooting Matrix

Use this matrix as a quick field reference when communication fails or data is garbage.

Commissioning and Verification

After the first download, perform these checks before handing the system over to production.

1. LED verification: PWR solid green, DIAG solid green, RX/TX flickers yellow then green on each poll cycle.
2. Online STATUS monitoring: Force the MB_MASTER instance with the online watch table; STATUS must read 0x0000 within one cycle of DONE=TRUE.
3. Float sanity check: Display raw holding register 5000 in HEX on the HMI; it must equal the value shown in the meter's Modbus test page (most KLEFR meters have a service mode that prints the raw register on a button press). Then compare the converted float against a handheld multimeter reading on the same phase.
4. Burst test: Run 1000 transactions in a row and count ERRORs. A healthy bus should show < 0.1% errors; anything above 1% points to wiring or termination problems.
5. Soak test: Leave the poll running for at least 24 hours and verify that no timeouts occur during normal operation. Timeouts under load (e.g. when a VFD is started in the same cabinet) indicate EMC issues; add ferrite cores on the bus cable or re-route it away from VFD power cables.

FAQ