Configuring Modbus RTU on S7-1500 with MB_CLIENT: Complete Guide

1. Overview: Modbus RTU on S7-1500

Modbus RTU (Remote Terminal Unit) is a serial master/slave protocol used extensively in power conversion equipment, UPS systems, inverters, and protection relays. The S7-1500 CPU family (S7-15xx) supports Modbus RTU through the MB_CLIENT instruction when a serial communication module such as the CM PtP RS422/485 (e.g., 6ES7540-1AB00-0AA0) or a communications processor (e.g., CP 340/341/440/441) is installed in the backplane.

This article documents a working configuration for reading measurement registers (current, alarms, status) and writing multi-register command sequences to a power unit, addressing the most common commissioning error: incorrect MB_MODE selection and address offset handling. The reference target is the Siemens S7-1500 family running TIA Portal V14 SP1 through V20, communicating with a third-party Modbus RTU slave that exposes holding registers in the 4xxxx range.

For the architectural background of Modbus RTU on S7-1500 point-to-point links, refer to the Siemens TIA Portal V20 Modbus RTU configuration overview.

2. Prerequisites

3. The MB_CLIENT Instruction: Parameter Reference

The MB_CLIENT (formerly Modbus_Master in V13) instruction is a single-instance block that sends one Modbus request per rising edge of REQ. All Modbus PDU types are exposed through the MB_MODE parameter.

4. MB_MODE Selection: The Address Offset Trap

This is the most common commissioning error when reading holding registers. MB_MODE in TIA Portal V14+ is split into two families:

The original problem report shows MB_MODE = 1 with MB_DATA_ADDR = 2200. With mode 1, the slave will attempt to read holding register 2200 in Modicon convention, which translates to Modbus PDU address 2199. The power unit's actual register 2200 (in user documentation) lives at PDU address 2199, so the correct MB_DATA_ADDR for MB_MODE = 1 is 42199 (offset 40000 + 2199) or simply 42199 if interpreted as 4xxxx addressing.

The cleanest solution on TIA Portal V14 SP1 and later is to use the extended addressing modes (100-115), which accept the register number as written in the slave's documentation. For register 2200 use MB_MODE = 103 with MB_DATA_ADDR = 2200. This eliminates the offset mental load entirely.

5. Reading UINT16: Current Demand on Phase 1 (Register 2200)

The power unit's register map declares register 2200 as a 16-bit unsigned integer reporting the current demand on phase 1, scaled in 0.1 A per LSB. The following TIA Portal code implements the read cycle at a 1-second cadence using a 1-Hz clock bit.

5.1 Data Block Layout

DATA_BLOCK "DB_Modbus_Phase1"
  STRUCT
    CurrentRaw : UINT;      // Raw register value (0-65535)
    CurrentA   : REAL;      // Scaled value in amperes (CurrentRaw * 0.1)
    Status     : WORD;      // MB_CLIENT STATUS word
    ErrorFlag  : BOOL;      // MB_CLIENT ERROR
    DoneFlag   : BOOL;      // MB_CLIENT DONE
    BusyFlag   : BOOL;      // MB_CLIENT BUSY
  END_STRUCT;
END_DATA_BLOCK

5.2 Cyclic OB1 Read Call

// 1-Hz clock from timer or system clock bit (e.g., "Clock_1Hz")
"MB_Client_DB"(REQ        := "Clock_1Hz" AND NOT "MB_Client_DB".BUSY,
               DISCONNECT := FALSE,
               MB_MODE    := 103,                  // FC 03, extended addressing
               MB_DATA_ADDR := 2200,                // Native register 2200
               MB_DATA_LEN  := 1,                   // 1 register
               MB_DATA_PTR  := "DB_Modbus_Phase1".CurrentRaw,
               CONNECT   := FALSE,                 // Connect only once via init OB
               DONE      => "DB_Modbus_Phase1".DoneFlag,
               BUSY      => "DB_Modbus_Phase1".BusyFlag,
               ERROR     => "DB_Modbus_Phase1".ErrorFlag,
               STATUS    => "DB_Modbus_Phase1".Status);

5.3 Scaling Logic (Cyclic)

// Convert raw 0.1-A LSB to engineering units
IF "DB_Modbus_Phase1".DoneFlag THEN
    "DB_Modbus_Phase1".CurrentA := INT_TO_REAL("DB_Modbus_Phase1".CurrentRaw) * 0.1;
END_IF;

If you must remain on TIA V13 or use the classic MB_MODE 1 family, change MB_MODE := 1 and MB_DATA_ADDR := 42199 (or 42001-40000+2200 = 42200 if the slave uses 1-based user addressing). Always cross-check with the slave vendor's Modbus Register Map PDF — vendor A's "register 2200" is sometimes PDU address 2200 (0-based) and sometimes PDU address 2199 (1-based).

6. Writing a 6-Register Command Sequence (Alarm Reset 8000-8005)

The alarm reset on the referenced power unit requires writing six consecutive holding registers in a single FC 16 (Write Multiple Registers) transaction. The data layout per the source specification is:

6.1 Build the Payload in a Separate DB

DATA_BLOCK "DB_Reset_Cmd"
  STRUCT
    Word0_Cmd     : UINT := 41096;     // 0xA088
    Word1_Sub     : UINT := 10;        // 0x000A
    Word2_IO      : UINT := 8193;      // IO 1; change to 8449 for IO 2
    Word3_Enable  : UINT := 1;         // 0x0001
    Word4_PwdHi   : UINT := 16#3333;   // ASCII '33' upper
    Word5_PwdLo   : UINT := 16#3333;   // ASCII '33' lower
    Trigger       : BOOL;              // Rising edge triggers write
    Done          : BOOL;
    Busy          : BOOL;
    Error         : BOOL;
    Status        : WORD;
  END_STRUCT;
END_DATA_BLOCK

6.2 FC 16 Write Call with Extended Addressing

// One-shot write triggered by HMI button or alarm-clear logic
"MB_Client_DB"(REQ        := "DB_Reset_Cmd".Trigger AND NOT "DB_Reset_Cmd".Busy,
               DISCONNECT := FALSE,
               MB_MODE    := 115,                   // FC 16, extended addressing
               MB_DATA_ADDR := 8000,                // Native starting register
               MB_DATA_LEN  := 6,                   // Six consecutive registers
               MB_DATA_PTR  := "DB_Reset_Cmd".Word0_Cmd,
               CONNECT      := FALSE,
               DONE      => "DB_Reset_Cmd".Done,
               BUSY      => "DB_Reset_Cmd".Busy,
               ERROR     => "DB_Reset_Cmd".Error,
               STATUS    => "DB_Reset_Cmd".Status);

// Reset trigger after completion (one-cycle pulse)
IF "DB_Reset_Cmd".Done OR "DB_Reset_Cmd".Error THEN
    "DB_Reset_Cmd".Trigger := FALSE;
END_IF;

6.3 If You Are Stuck on TIA V13

Use MB_MODE := 15 (classic FC 16, 1-based) and set MB_DATA_ADDR := 48000 (40000 + 8000). The data pointer still references the same six-word structure. Verify the result by reading the alarm status word back on a subsequent cycle to confirm the slave accepted the command.

7. STATUS Word Decoding and Error Diagnosis

When ERROR is TRUE, the STATUS output contains either a Modbus exception code (returned by the slave) or a Siemens protocol-stack error (generated locally). Distinguishing the two is critical for correct diagnosis.

For a deeper discussion of the specific error originally observed in the source — MB_MODE = 1 with MB_DATA_ADDR = 2200 producing an immediate error — see the Siemens support entry 83130159 on Modbus addressing modes. The document 100633819 further details the offset behavior of the MB_CLIENT instruction across TIA Portal versions.

8. TIA Portal Version Compatibility Matrix

9. Hardware Configuration of the CM PtP

1. In the device view of the S7-1500 station, drag the CM PtP RS422/485 module into the configured slot.
2. Open the module properties and select RS485 as the interface mode (not RS422 — the power unit is two-wire).
3. Set the protocol to Modbus master (RTU) — this auto-fills the MB_COMM_LOAD parameters with 8 data bits, no parity, 1 stop bit, and the user-selected baud rate.
4. Assign a hardware identifier (e.g., HW_ID = 269) — this is the value used by the HW_ID input of MB_COMM_LOAD.
5. Wire D+ to terminal T/R+ and D- to terminal T/R-. Activate the internal 120 Ω termination on the module DIP switch if the slave is the last node on the bus and no external terminator is fitted.

10. MB_COMM_LOAD Configuration (One-Shot in OB100)

// OB100 — startup; pulse CONNECT once after CPU restart
"MB_Comm_Load_DB"(REQ       := TRUE,
                  PORT      := "CM_PtP".Configuration,
                  BAUD      := 19200,
                  PARITY    := 0,        // 0=none, 1=odd, 2=even
                  FLOW_CTRL := 0,        // 0=none (RS485 half-duplex)
                  RTS_ON_DLY := 0,
                  RTS_OFF_DLY := 0,
                  RESP_TO   := 1000,     // 1000 ms response timeout
                  DONE      => "StartFlag_DB".MbCommLoadDone,
                  ERROR     => "StartFlag_DB".MbCommLoadError,
                  STATUS    => "StartFlag_DB".MbCommLoadStatus);

11. Verification and Commissioning Checklist

12. Troubleshooting Matrix

13. Performance and Timing Notes

At 19200 baud, a single FC 03 read of one register is approximately 12-15 ms round trip on a clean bus. A six-register FC 16 write is approximately 20-25 ms. Polling a single 1-Hz register consumes negligible CPU time. If you scale up to 50+ registers, switch to a higher baud (38400 or 115200) and consider using a single FC 03 read with MB_DATA_LEN = 50 instead of 50 single-register reads — this cuts the overhead per register from ~5 ms to ~0.4 ms.

14. FAQ