Configuring Modbus RTU/ASCII on Siemens SICAM P50 via RS485

David Krause13 min read
ModbusSiemensTechnical Reference
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview: Communication Options on the Siemens SICAM P50/55

The Siemens SICAM P50 (formerly branded SIMEAS P50, device family 7KG77) is a panel-mount power and energy meter intended for substations, feeder monitoring, and power-quality trending at the LV/MV boundary. It exposes four on-board serial protocols selectable from its front-panel or configuration tool:

  • Modbus RTU – binary, 8-bit, CRC-16, master/slave.
  • Modbus ASCII – 7-bit printable, LRC-8, master/slave.
  • IEC 60870-5-103 – protection-equipment companion standard, used in substation automation.
  • Siemens Serial ASCII – proprietary, documented only inside legacy SIMATIC CP441 manuals (entry ID 1137419), intended primarily for SIMATIC S7-300/400 backplanes and not freely redistributable.

For any non-SIMATIC host — including LabVIEW, Python, .NET, or third-party RTUs — the practical candidates collapse to the two Modbus variants. IEC 60870-5-103 has very limited process-data support on the P50 and was designed for protection IED interchange, not general SCADA polling.

Note on naming: The current Siemens documentation and the official download portal use the designation SICAM P50/55 – 7KG77. The SIMEAS P50 designation appears in older product labels and catalogues (e.g., the historic PDF SIMEAS_Pxxx_Com_Modbus_A4_EN.pdf). The electrical, register, and protocol behavior described in this article is identical for both labels.

Protocol Decision Matrix: RTU vs ASCII vs IEC 60870-5-103 vs Siemens ASCII

Criterion Modbus RTU Modbus ASCII IEC 60870-5-103 Siemens Serial ASCII
Bit width per character 8 7 8 8
Frame delimiter 3.5 char silent gap : start, CR LF end Start/end flag 0x68/0x16 STX/ETX framing
Error check CRC-16 (poly 0xA001) LRC-8 (two's complement) IEC checksum (mod 256) BCC or CRC (per CP441 doc)
Max payload/frame (typical) 253 bytes ~513 bytes (2 hex chars/byte) 253 bytes ASDU Device-defined
Throughput @ 9600 8-N-1 ~25 ms for 8-word read ~38 ms for 8-word read ~30–40 ms with class-2 polling Device-defined
LabVIEW native VIs Built-in (NI VISA + Modbus library, 2013+) Built-in Not native — third-party add-on Not supported
Public documentation Siemens entry 109752374 Siemens entry 109752374 IEC standard only, Siemens device profile short Restricted to SIMATIC CP441 manual (1137419)
Recommendation for 1 read/s host Preferred Acceptable fallback Not recommended Not recommended

Recommended Choice: Modbus RTU over RS485

For a LabVIEW 8.6 host that polls the SICAM P50 once per second, Modbus RTU is the correct selection. The justification is:

  1. Public, free documentation. Siemens publishes the full register map, function-code support, and exception responses in the manual at SICAM P50/55 – 7KG77 Communication Protocol Modbus Manual (entry ID 109752374). No NDA, no SIMATIC dependency.
  2. Compact binary framing. At 9600 bit/s, an 8-word input register read (Function Code 04) is ~25 ms end-to-end, leaving a 975 ms idle window in a 1 Hz poll — even with 8-E-1 parity, an inter-frame gap, and a half-duplex RS485 turnaround.
  3. LabVIEW ecosystem. NI ships the Modbus Library for LabVIEW (2013 and later; installable into 8.6 via the ni-modbus.llb drop-in). It exposes MB Master Query and MB Master Response Parse VIs that wrap the CRC-16 directly, eliminating the most common LabVIEW ↔ Modbus implementation bug.
  4. ASCII is not faster for your use case. ASCII doubles the on-wire byte count for every register. The extra ~13 ms per transaction is irrelevant at 1 Hz, but ASCII also halves the parity coverage and forces a 7-bit data path that complicates serial-port configuration in LabVIEW on Windows COM ports. There is no engineering reason to prefer it.
  5. IEC 60870-5-103 is the wrong tool. On the P50, IEC 60870-5-103 is intended for protection-IED interoperability and reports only a small subset of measurements in standard information numbers. The full instantaneous-value table is reachable only through Modbus.
Field-proven caveat: The Siemens Serial ASCII protocol on the P50 is a legacy point-to-point driver described in CP441 manual 1137419. It is not a public protocol — its complete frame grammar is not reproduced in the Modbus manual and cannot be reverse-engineered reliably from observed traffic because the device does not emit unsolicited frames. Treat it as unavailable for LabVIEW work.

RS485 Physical Layer and P50 Port Pinout

The SICAM P50/55 exposes one serial port on the rear terminal block, configurable in firmware as RS485 (2-wire half-duplex) or RS232. For multi-drop or for any cable longer than 3 m, use RS485.

P50 terminal RS485 signal RS232 signal Notes
A (D+) TX/RX+ 120 Ω termination to Vcc on some firmware revisions
B (D−) TX/RX− Inverted relative to A
TXD TX (out of P50)
RXD RX (into P50)
GND Shield / signal ground Signal ground Mandatory at one end only

Recommended RS485 bus configuration for a single-P50 link to a LabVIEW PC:

  • Topology: point-to-point daisy-chain, no stubs > 0.3 m.
  • Termination: 120 Ω at each end of the bus, switched on only if the bus length exceeds ~10 m at 19200 bit/s or ~3 m at 115200 bit/s.
  • Bias: 680 Ω pull-up to +5 V on A, 680 Ω pull-down to GND on B — required on the P50 side because the meter does not fail-safe bias internally on all firmware revisions.
  • Converter: isolated USB-to-RS485 (e.g., NI USB-485, FTDI USB-RS485-WE-1800-BT) — isolation protects the meter ground from PC ground loops, which are the single most common cause of intermittent Modbus timeouts.
  • Shield: grounded at the PC end only; leave the P50 shield terminal floating to break ground loops.

Modbus Configuration Parameters on the P50

Set the following parameters via the front keypad (MENU → COMM) or the SICAM Pxxx Parameter tool before polling. The values below are the recommended defaults for a 1 Hz LabVIEW host:

Parameter Value Notes
Protocol Modbus RTU Selectable; not auto-negotiated.
Address (Unit ID) 1 (default) Range 1–247; unique per bus.
Baud rate 9600 bit/s 19200 or 38400 also supported; 9600 maximises compatibility with USB-serial converters.
Data bits 8 Required for RTU.
Parity None Even parity is also valid; if chosen, switch to 8-E-1 in LabVIEW.
Stop bits 1 2 if parity is None and the host expects 8-N-2; verify with the converter datasheet.
Response delay 0 ms Increase to 5–20 ms only if the host cannot release the bus fast enough.
Inter-frame timeout 3.5 char RTU mandatory; do not change.
Save and reboot. COMM parameter changes on the P50 only take effect after a power cycle or a soft-reset from the menu. A meter that responds to the front-panel menu but ignores serial polls is almost always a non-saved parameter set.

SICAM P50 Modbus Register Map (Selected)

The complete map is in the manual at entry 109752374. The most-requested values for a 1 Hz dashboard are listed below. All values are 16-bit Modbus registers; multi-word values are big-endian (high word first).

Register (hex) Register (dec) Function code Quantity Unit / scale
0x0000 40001 03 / 04 Phase voltage L1-N V, scale 0.1
0x0002 40003 03 / 04 Phase voltage L2-N V, scale 0.1
0x0004 40005 03 / 04 Phase voltage L3-N V, scale 0.1
0x0006 40007 03 / 04 Line voltage L1-L2 V, scale 0.1
0x0008 40009 03 / 04 Line voltage L2-L3 V, scale 0.1
0x000A 40011 03 / 04 Line voltage L3-L1 V, scale 0.1
0x000C 40013 03 / 04 Current L1 mA, scale 1
0x000E 40015 03 / 04 Current L2 mA, scale 1
0x0010 40017 03 / 04 Current L3 mA, scale 1
0x0012 40019 03 / 04 Active power, total P W, signed, scale 1
0x0014 40021 03 / 04 Reactive power, total Q var, signed, scale 1
0x0016 40023 03 / 04 Apparent power, total S VA, scale 1
0x0018 40025 03 / 04 Power factor, total PF scale 0.001, signed (lead/lag)
0x001A 40027 03 / 04 Frequency Hz, scale 0.01
0x001C 40029 03 / 04 Active energy import kWh, scale 1 (32-bit at 0x001C–0x001D)
0x001E 40031 03 / 04 Reactive energy import kvarh, scale 1 (32-bit)

Read every quantity you need in a single Function Code 04 request rather than chaining single-register reads. A request for 16 input registers starting at 0x0000 returns all voltages and currents in one frame:

// Function Code 04 — Read Input Registers
// Address range: 0x0000 to 0x000F (16 registers)
// RTU frame (hex), Unit ID = 1:
01 04 00 00 00 10 F1 C0
// Bytes:  [UnitID] [FC] [StartHi] [StartLo] [QtyHi] [QtyLo] [CRClo] [CRChi]

CRC-16 / Modbus Verification

The RTU integrity check is CRC-16 with polynomial 0xA001 (reflected 0x8005), initial value 0xFFFF. LabVIEW 8.6 has no built-in Modbus CRC VI, so implement it once as a sub-VI. The following pseudocode is bit-for-bit equivalent to the reference implementation in the manual:

function ModbusCRC16(byte[] buf, int len) -> uint16:
    crc = 0xFFFF
    for i = 0 to len-1:
        crc = crc XOR buf[i]
        for j = 0 to 7:
            if (crc AND 0x0001) != 0:
                crc = (crc >> 1) XOR 0xA001
            else:
                crc = crc >> 1
    // Return low byte first, then high byte on the wire
    return crc

Verification example: frame 01 04 00 00 00 10 must transmit with CRC bytes F1 C0 (low byte first). If LabVIEW produces anything else, check the byte order of the CRC register write — most off-by-one bugs live there.

LabVIEW 8.6 Implementation Skeleton

  1. Open the serial port. Use VISA Open with the COM resource of your USB-RS485 converter. Set baud rate = 9600, data bits = 8, parity = 0 (None), stop bits = 10 (i.e., 1 stop bit — the VISA cluster is in 0.1-stop-bit units), flow control = 0 (None), and termination char = 0x00 (do not auto-terminate; you need the silent gap to mark frame end in RTU).
  2. Build the request. Append the two CRC bytes from the sub-VI above to 01 04 00 00 00 10 and write with VISA Write.
  3. Read the response. Use VISA Read with a count of 37 (1 UnitID + 1 FC + 1 byte-count + 32 data + 2 CRC = 37). A timeout of 1000 ms is appropriate for 9600 bit/s.
  4. Validate the CRC. Run the response through the same CRC sub-VI; the result over the bytes preceding the CRC field must be 0x0000.
  5. Unpack registers. Swap the byte order of each 16-bit word to little-endian (the wire is big-endian) and apply the scale factor from the register table.
  6. Throttle to 1 Hz. Use a Wait (ms) of 1000 in a While Loop. Do not rely on VISA timing alone — the P50 will hold the bus for ~25 ms per transaction, but the inter-frame gap and Windows scheduler jitter can otherwise pile up.
  7. Exception handling. If the response FC has bit 7 set (e.g., 0x84), look up the exception code:\li>
Exception code Name Cause on the P50 Corrective action
0x01 Illegal Function Function code not supported (e.g., 05/06 for non-existent coils) Use FC 03 or 04 only for read; FC 16 for write
0x02 Illegal Data Address Register outside map (e.g., 0x1000 when only 0x0000–0x00FF exist) Re-check the manual
0x03 Illegal Data Value Quantity = 0 or > 125 for FC 04 Clamp quantity to a valid range
0x04 Slave Device Failure Internal P50 error; logged as a device fault Cycle P50 power; check diagnostics buffer
0x06 Slave Device Busy Previous response still in transit Extend inter-frame delay to 50 ms; verify turn-around on the RS485 driver

Verification Procedure

  1. Loopback test the cable. With the P50 disconnected, short A to B at the meter end. Every byte you write must come back. Confirms polarity, termination, and converter direction control.
  2. Single-register read. Issue Function Code 04, start 0x0000, quantity 1. Expected frame: 01 04 02 HH LL CRC CRC. If you receive silence, the unit ID is wrong (try scanning 1–247) or the termination character on VISA is eating the first byte (set it to 0x00 or disable).
  3. Validate scale. Compare the L1-N voltage reading against a handheld DMM at the same terminals. The Modbus value should be 10× the DMM reading (scale 0.1 V).
  4. Burn-in test. Run the 1 Hz poll loop for at least 1 hour and log exception count and CRC error count. < 0.1 % exception rate is normal on RS485; higher rates point to a grounding or bias issue.
  5. Three-phase sanity check. Compute apparent power S = √3 · V_LL · I from the read values and compare to the meter's own S register. Discrepancies > 2 % usually indicate a CT/PT wiring polarity reversal on one phase, not a Modbus problem.

Troubleshooting Matrix

Symptom Likely cause Fix
No response, no exception Wrong baud / parity / unit ID, or P50 still in ASCII mode Re-check MENU → COMM; power-cycle
CRC error every transaction Byte-swap on CRC, or termination char eating last byte Disable VISA termination character; verify CRC sub-VI
Intermittent timeouts Ground loop, missing bias, or long stub Isolate converter; add 680 Ω bias; re-pull cable
Exception 0x02 on every read Read holding registers (FC 03) on input register addresses Switch to FC 04; consult the register table
Values stuck at 0x0000 or 0xFFFF CT/PT not connected, or quantity = 0 request rejected with 0x03 Verify CT orientation; re-issue with correct quantity
Latency spikes > 500 ms Windows USB latency, or P50 response delay set too high Disable USB selective suspend; set response delay to 0

Field Notes and Best Practices

  • Document the parameter set. Photograph the front panel after every COMM change. P50 firmware revisions have shipped with different default baud rates across the 7KG77 family.
  • Use a dedicated USB port. USB hubs and docking stations introduce additional latency. Plug the RS485 converter directly into the PC.
  • Avoid mixing protocols on the same bus. The P50 will not negotiate; if another device on the same RS485 pair uses a different protocol or baud rate, every device will fail.
  • Keep frame sizes small. Even though the P50 supports a full 125-register FC 04 read, splitting the dashboard into two or three 16-register reads is more robust against single-bit errors and easier to re-parse in LabVIEW.
  • Plan for Modbus ASCII as a fallback. If you ever need to read the meter through a terminal emulator or a 7-bit serial path (e.g., some radio modems), ASCII works identically except for the LRC-8 checksum and the : / CR LF framing.
  • Record firmware version. Certain register ranges — particularly the energy counters — are firmware-dependent. Note the version printed on the meter label and reference the matching revision of the manual at 109752374.

Which protocol should I use to read a Siemens SICAM P50 from LabVIEW at 1 Hz?

Use Modbus RTU at 9600 bit/s, 8-N-1, Unit ID 1. It is the only protocol on the P50 with a public manual (Siemens entry 109752374), has the lowest on-wire overhead, and integrates with LabVIEW 8.6 via NI's Modbus library or a hand-written CRC-16 sub-VI.

Is Modbus ASCII easier to implement than Modbus RTU on the P50?

No. ASCII is human-readable and uses a simple LRC-8 checksum, but it doubles the byte count and forces a 7-bit data path. For a 1 Hz poll, RTU is faster, has stronger error detection (CRC-16), and is the recommended mode in the Siemens Modbus manual.

Where do I find the SICAM P50 serial ASCII protocol documentation?

It is not published as a standalone document. The protocol is described only inside the SIMATIC CP441 manual at Siemens entry 1137419. For a LabVIEW host, use Modbus RTU instead and treat the Siemens Serial ASCII driver as unsupported.

Why is the P50 silent when I poll it over RS485?

Three checks resolve > 90 % of silent-bus cases: (1) confirm Modbus RTU is selected and saved under MENU → COMM, then power-cycle; (2) verify the Unit ID matches the value written in the request frame (default 1); (3) disable the VISA termination character in LabVIEW so the silent-gap detection works. If still silent, swap A and B — RS485 polarity is the next most common mistake.

Can I read all measurements in a single Modbus request?

Yes. Issue Function Code 04 with start address 0x0000 and quantity 16 to read L1–L3 voltages and currents in one 37-byte response. For the full instantaneous-value table (voltages, currents, P/Q/S, PF, frequency), use a second request starting at 0x0012 with quantity 8. Avoid mixing Function Code 03 (holding) and 04 (input) on overlapping addresses — the P50 returns Exception 0x02 for invalid FC/address combinations.

Back to blog