Configuring the Siemens ET 200S 1SI as a Modbus Slave with S_MODB (FB81)

This technical reference covers the end-to-end configuration of a SIMATIC ET 200S 1SI serial interface module (order number 6ES7138-4DF11-0AB0) operating as a Modbus RTU slave on a PROFIBUS-DP head station (IM 158). The slave exchanges a small set of binary process signals with an upstream S7-400 master controller across an RS-485 multi-drop network. The procedure uses the S_MODB function block (FB81) from the Siemens "PtP configuration package" installed under SIMATIC Manager, together with a STEP 7 data-conversion DB (typically DB100) that bridges Modbus register space to the PLC's bit memory area (M) and to a master-readable DB.

1. System Topology and Reference Identification

The hardware stack used in the field installation described in the source thread is summarised below. All catalog numbers are Siemens MLFBs and can be cross-checked in the SIMATIC ET 200S Serial Interface Modules manual (entry ID 18667703), which is the official master document for the 1SI family.

The RS-485 bus is terminated with 120 Ω between pins 3 (T/R-T) and 8 (T/R-R) of the sub-D connector on the 1SI module, and biased according to the 1SI manual's wiring diagram (Section 2 of entry ID 18667703). The same RS-485 segment can host up to 32 Modbus slaves; each 1SI must be assigned a unique address 1..247.

2. Prerequisites

1. STEP 7 V5.5 SP2 (or later) installed with the PtP configuration package (the package adds the "Modbus" tab under "Open Projects → Sample projects" and supplies the FB81, FB80, FB82, FB83, FB84, FB85 function blocks and matching UDTs).
2. ET 200S 1SI module firmware compatible with the Modbus function blocks; for 6ES7138-4DF11-0AB0 the matching firmware is V1.0.x. Confirm in HW Config via "PLC → Module Information → Firmware".
3. A unique Modbus slave address in the range 1..247. Address 0 is reserved for broadcast.
4. A free DB for the data-conversion table (in the source project this is DB100). The DB must be set to "non-optimised" (standard access) because FB81 uses absolute addressing.
5. Physical RS-485 wiring with termination and bias; a shielded twisted pair such as Belden 3106A or Lapp UNITRONIC BUS LD is recommended.
6. Engineering access to the IM 158 station; download privilege to the slave head station and to the S7-400 master.

3. Hardware Configuration in STEP 7 (HW Config)

1. Open HW Config for the IM 158 station and drag the 1SI Modbus/3964(R) module (order number 6ES7138-4DF11-0AB0) into the slot directly to the right of the IM 158. The module occupies a single ET 200S slot.
2. Open the Properties → Modbus dialog of the 1SI slot and enter the slave parameters. The values below match the procedure described in SIMATIC ET 200S Serial Interface Modules, Section 3.6 ("Modbus slave").

3. Compile and download the HW Config to the IM 158 head station. The 1SI will now appear as a DP slave on the S7-400 master's PROFIBUS network and the S7-400 can be configured to read the diagnostic / status bytes (slot 0 diagnostic interrupt).

4. S_MODB (FB81) — The Cyclic Slave Block

The slave is driven by FB81 S_MODB (formerly FB9 in very early releases). The block is part of the PtP configuration package; the latest revision is published on the Siemens support page "Function Blocks, Examples and User Manuals for the Serial Interface Module ET 200S 1SI".

The block must be called once per cycle in OB1. A multi-instance DB is generated automatically the first time FB81 is placed; alternatively you can pre-create an instance DB such as DB99.

4.1 FB81 call signature

4.2 Minimal FB81 call in OB1 (STL/SCL view)

// FB81 S_MODB - Modbus slave, ET 200S 1SI
// Cyclic call in OB1
CALL "S_MODB" , DB99
   LADDR  := W#16#0100          // 1SI base address from HW Config
   DB_NO  := 100                // data conversion DB
   START  := "dbSlvStart".Trigger  // one-shot from first OB1 scan
   CANCEL := FALSE
   DONE   := "dbSlvDone"         // optional, can be ignored
   ERROR  := "dbSlvError"
   STATUS := "dbSlvStatus"

5. The Data-Conversion Table (DB100)

The data-conversion table is a STEP 7 DB whose byte-layout is interpreted by FB81. Each row defines a mapping between a contiguous Modbus address range and a contiguous byte/bit range inside the slave CPU. FB81 scans the table on every cycle and publishes the slave's process image in the same cycle that the master request arrives.

The DB is structured in 32-byte rows. The first two bytes of each row are a control word, followed by up to 30 bytes of process data. The example below shows two rows: one row exposing three coils to the master (read-only) and one row letting the master write three coils into the CPU's bit memory.

5.1 DB100 layout for 3 inputs / 3 outputs

5.2 Control word bit assignment (per row)

For the 3-out / 3-in scenario the source's requirement, the two rows above are sufficient. Row 1 (control word = W#16#0001) is read-only from the master; row 2 (control word = W#16#0002) is write-only from the master. The PLC application code reads M200.0..M200.2 as the three outputs to the process, and writes the three inputs from the process to M210.0..M210.2 — the master will pick them up on the next FC01 (Read Coils) request.

6. Mapping Modbus Addresses to the Data-Conversion Table

The Modbus register map visible to the master is fully defined by the data-conversion table. With a single read-only row of 3 bit-granularity BOOLs starting at row byte 2, the first three Modbus coil addresses (0-based, 0x0000..0x0002) are bound to M200.0..M200.2. The master's Modbus function codes and their effect are:

If your application also needs to share the data as 16-bit holding registers in the same DB, add a third row with control word = W#16#0001 (read) and bit 3 set to 1 (word granularity) to publish M200.0..M201.7 as holding register 0x0000; a fourth row with control word = W#16#0002 and bit 3 set accepts the master's writes into M210.0..M211.7 as holding register 0x0001. The Siemens sample project shows both bit- and word-granular rows coexisting in the same DB.

7. PLC Application Code Around the Slave Block

The slave FB81 exchanges data with the process through the bit memory areas referenced in DB100. A typical application skeleton looks like this:

// OB1 - application logic (3 binary inputs from master, 3 binary outputs to master)
// INPUTS from master are in M210.0 .. M210.2 (DB100 row 2)
// OUTPUTS to master are in M200.0 .. M200.2 (DB100 row 1)

      A    M    210.0        // digital input 1 from master
      =    Q    0.0          // drive the physical output 1

      A    M    210.1        // digital input 2 from master
      =    Q    0.1          // drive the physical output 2

      A    M    210.2        // digital input 3 from master
      =    Q    0.2          // drive the physical output 3

      A    I    0.0          // physical input 1
      =    M    200.0        // publish to master via DB100 row 1

      A    I    0.1          // physical input 2
      =    M    200.1        // publish to master

      A    I    0.2          // physical input 3
      =    M    200.2        // publish to master

Note that the data-conversion table inside DB100 only stores pointers to the M area; FB81 updates the M flags in place. As a result, do not place the M area used by DB100 inside any retain region that requires the standard PG-style retentivity bit, or the master will see stale values on cold restart. If the process requires retentive behaviour, replicate the relevant bits into a separate retain DB and copy them in OB100 / OB101.

8. Master-Side Configuration on the S7-400

The S7-400 master reads the IM 158 (and therefore the 1SI module) as a DP slave. Add the IM 158 to the master's HW Config and insert a universal or manufacturer-specific DP module in the slot corresponding to the 1SI. For 6ES7138-4DF11-0AB0 the GSD file is shipped with STEP 7 — install it via Options → Install GSD and restart HW Config.

The master project does not need to call any S_MODB-equivalent block. The PROFIBUS-DP cyclic I/O image of the 1SI is purely a status channel (diagnostic + handshake); the actual Modbus data flows independently over the RS-485 segment and is consumed by the master's user program using either:

• A third-party S7 Modbus master block from the library "Modbus Master for S7" (modbusan.slb), or
• A purpose-built FB on the S7-400 that sends the FC 01/05/15 frames via its own CP 441 or CM 1241 port — note that this is a separate physical port from the IM 158 / 1SI on the slave side.

In the CCR-room topology described in the source, the master typically uses a CP 441-2 module (e.g. 6ES7441-2AA05-0AE0) with the Modbus master protocol loaded. The procedure is documented in the SIMATIC ET 200S Serial Interface Modules manual, Section 3.5 ("Modbus master on S7-400").

9. Commissioning and Verification

9.1 Bench verification with Modbus Slave simulator / ModScan

Before connecting the master S7-400, validate the slave from a PC. Two free options:

• Witte Software Modbus Slave simulator (Windows) — see the Modbus Slave product page (supports up to 100 simulated slaves, RTU/TCP/UDP/ASCII-over-RTU).
• GitHub open-source simulator ModbusSlaveSimulation for Windows.

Procedure:

1. Connect a USB-to-RS-485 adapter to the bus, terminator 120 Ω on the bus far-end only.
2. Open ModScan (or Modbus Poll / Witte Modbus Slave acting as master), set "Connection → RTU", "COMx, 9600, 8, E, 1", slave address 5.
3. Issue Function 01 — Read Coils, address 0, count 3. The simulator should display the current value of M200.0..M200.2 (initially all 0).
4. In STEP 7 monitor, set M200.0 = TRUE. The simulator value should toggle within one master poll cycle.
5. Issue Function 05 — Write Single Coil to address 0x0000, value 0xFF00. The master should observe M210.0 transition to TRUE on the next FB81 cycle. Repeat for coils 1 and 2 to validate all three inputs.
6. Issue Function 15 — Write Multiple Coils with bytes 0x07 (binary 111) to drive M210.0..M210.2 high in a single frame.

9.2 Status / error codes returned by FB81

9.3 Final live commissioning with the S7-400 master

1. Connect the IM 158 to the S7-400 PROFIBUS network. Confirm the DP slave is in Data Exchange state in the master's online view.
2. On the S7-400, set the CP 441 to "Modbus Master" and configure the same 9600 / 8 / E / 1, slave address 5.
3. Force the master to read coil 0x0000 — verify that the value seen on the master matches the bit M200.0 in the slave CPU. Use STEP 7 monitor with VAT or a watch table.
4. Force a write on the master (FC 05) and verify M210.0 toggles in the slave CPU's VAT.
5. Capture one full poll cycle with a PROFIBUS bus monitor (e.g. Softing PROFINET IO tester or AM Profiler) to confirm RTU frame turnaround is < 50 ms at 9600 baud.

10. Troubleshooting Matrix

11. Edge Cases and Field-Engineered Notes

1. Broadcast frames (slave address 0): FB81 honours FC 06 and FC 16 only on address 0; the master cannot read on address 0. If the S7-400 sends a broadcast write, every 1SI on the bus will accept it, which is rarely what you want — disable broadcast in the master's CP 441 configuration unless explicitly needed.
2. Cold-restart race: after power-on, the master typically starts polling before the 1SI finishes initialisation. Expect the first 1–3 polls to time out. Extend the master's response-timeout to ≥ 2 s for the first 5 s of operation, or wait for the 1SI diagnostic bit "module ready" to go high before enabling the master.
3. Address overlap between coils and holding registers: Modbus specifies that FC 01/02/05/15 operate on the coil space (0x0000..) and FC 03/04/06/16 on the register space (0x0000..). FB81 treats them as two independent address maps, but the user is responsible for not double-binding the same byte of DB100 to both a coil and a register row.
4. Word-granular row + bit-granular master FC: the master may issue FC 01 on a row that was declared word-granular (control word bit 3 = 1). The slave will interpret the request as a multi-coil read on the same byte — for the 3-bit scenario this is harmless, but for wider rows it can cause data truncation. Always match the control-word granularity to the function code the master will issue.
5. RS-485 topology: keep the bus length below 1200 m at 9600 baud. If the master is in a separate building (CCR room), use a fibre-optic repeater (e.g. OLM / OBT) and a Modbus-to-fibre converter at each end.
6. FB81 CPU load: each 1SI module costs roughly 0.5 ms of CPU time on an IM 158 with a 314-class CPU. Three 1SI modules on one head station is the practical ceiling before the OB1 cycle time is noticeably affected.
7. Retentive flags: by default the M area is non-retentive on S7-300/ET 200S CPUs. If the process expects the master-written inputs (M210.0..M210.2) to survive a power cycle, map them to retentive DB variables and copy to M on startup, instead of trying to declare M retentive (which has a global effect).

12. Standards and Reference Documents

The Modbus framing and function-code rules implemented by FB81 follow the Modbus Application Protocol Specification V1.1b3, available from the Modbus Organization. Cross-check any unusual function code (e.g. FC 22, FC 23) against that document; FB81 implements the legacy subset only.

The Siemens-specific implementation, the data-conversion table, the FB81 call signature, and the diagnostic status codes are all defined in the SIMATIC ET 200S Serial Interface Modules manual (Siemens entry ID 18667703). For the master-side CP 441-2 configuration, refer to the CP 441-2 manual (Siemens entry ID 1117394). For wiring of the sub-D connector, refer to Section 2.2 of the same ET 200S manual.