1. Architecture Overview
The Siemens LMV51 is a microprocessor-based burner management controller for modulating gas/oil burners up to ~350 kW. It exposes a serial Modbus RTU interface on the X89 terminal block (RS-485) for integration into BMS or PLC networks. The Prosoft PLX31-PND-MBS4 is a PROFINET Device / Modbus Serial master-or-slave gateway. Combined with a Siemens S7-1215C (CPU 1215C DC/DC/DC, 6ES7215-1AG40-0XB0 or newer), the topology is:
Data flow: TIA Portal cyclically exchanges I/O data with the gateway on PROFINET; the gateway independently polls the LMV51 with Modbus function codes and updates the I/O image. The PLC does not need to handle the Modbus protocol directly — it only reads/writes the process image configured in the Prosoft gateway.
2. Prerequisites
2.1 Hardware
| Item | Model / Notes |
|---|---|
| PLC | SIMATIC S7-1215C (firmware V4.4 or higher recommended for GSDML v2.3+ device compatibility) |
| Burner controller | Siemens LMV51 (AGM31.xx fuel-air ratio control); observe the wiring diagram in the LMV51 datasheet, document LMV51 data sheet |
| Gateway | Prosoft PLX31-PND-MBS4 (PROFINET Device, 4-port Modbus Serial); refer to the PLX31-PND-MBS4 product page for the latest datasheet and downloads |
| Cabling | PROFINET: shielded Cat 5e or higher, max 100 m segment; RS-485: twisted shielded pair, 120 Ω terminator on both ends for long runs |
| Display | AZL2x (AZL23 or AZL21) for setting the LMV51 Modbus address and baud rate |
2.2 Software
| Tool | Purpose | Version (minimum) |
|---|---|---|
| TIA Portal | PLC hardware configuration and programming | V16 (with HSP for the GSDML if needed) |
| Prosoft Configuration Builder (PCB) | Gateway IP, Modbus master map, register mapping | Current release from Prosoft |
| GSDML file for PLX31-PND-MBS4 | Allows TIA Portal to recognize the gateway as a PROFINET device | Download from the Prosoft product page (do not rename the file) |
| LMV51 system documentation | Modbus register list, supported function codes | Siemens LMV5x system manual (A7541) |
3. Configuring the LMV51 Modbus Interface
By default the LMV51 ships with Modbus disabled or set to address 1. Before powering the burner, set the serial parameters on the AZL2x display:
- Enter the parameter level on the AZL2x (see LMV51 parameter list, parameter 161 "Communication address").
- Set parameter 161 to a unique Modbus slave address (default = 1, valid 1…247).
- Set parameter 162 for baud rate (typically 9600 for PLX31-PND-MBS4).
- Set parameter 163 for parity (None, Even, Odd) — 8N1 is the LMV51 default.
- Wire the LMV51 X89 terminals:
61 = RS-485 A (+),62 = RS-485 B (−),63 = GND.
Reference the official Siemens LMV5x system manual (A7541) under "Bus connection / Modbus" to confirm the register table. A typical subset used in burner control programs:
| Register (4x) | Access | Description | Data type |
|---|---|---|---|
| 0 | R | Operating mode / status word | UINT16 |
| 1 | R | Current lockout / fault code | UINT16 |
| 2 | R/W | Setpoint modulation (%) | UINT16 (0…1000 = 0.0…100.0%) |
| 3 | R | Actual modulation (%) | UINT16 |
| 4 | R | Flame signal (AD value) | UINT16 |
| 10 | R | Hours run resettable | UINT32 (2 registers) |
| 20 | R/W | Start / Stop / Lockout reset command | UINT16 |
4. Installing the GSDML in TIA Portal
- Open the TIA Portal project containing the S7-1215C station.
- In the project tree choose Options → Manage general station description files (GSD).
- Set the source path to the folder where the unzipped Prosoft GSDML is stored. TIA Portal lists every
.xmlmatching the GSDML schema (e.g.GSDML-V2.3-ProSoft-PLX31-PND-MBS4-20180112.xml). - Select the file and click Install. The device becomes available under Other field devices → PROFINET IO → Gateway → ProSoft Technology → PLX31-PND-MBS4.
- Restart TIA Portal if a module update is requested (HSP conflict on older V13/V14 builds).
5. Adding the Gateway to the PROFINET Topology
- Open the Devices & networks editor and switch to the network view.
- Drag the PLX31-PND-MBS4 from the hardware catalog onto the PROFINET subnet of the S7-1215C. TIA will assign it a temporary name and IP (e.g.
plx31-pnd-mbs4/0.0.0.0). - Open the gateway's Properties → PROFINET interface and assign a fixed IP address (e.g.
192.168.0.20), subnet mask255.255.255.0and a PROFINET device name (must match the one stored in the gateway, see step 6). - From the device view, drop one or both available slots — the PLX31-PND-MBS4 exposes up to two IO modules:
| Slot | Direction | Length | Typical use |
|---|---|---|---|
| Slot 1 — "MBS In Words" | Input (PLC reads) | Configurable, up to 244 bytes | LMV51 data read via FC 03/04 |
| Slot 2 — "MBS Out Words" | Output (PLC writes) | Configurable, up to 244 bytes | LMV51 setpoints / commands via FC 06/16 |
Compile the hardware configuration and download it to the S7-1215C. The PLC will only establish PROFINET AR (Application Relationship) with the gateway once the gateway's stored device name matches the one TIA programmed into the device.
6. Configuring the PLX31-PND-MBS4 with Prosoft Configuration Builder
Connect the Ethernet port of the PLX31-PND-MBS4 to the engineering PC, open PCB, and load the default project. Important settings:
| Parameter | Recommended value | Comment |
|---|---|---|
| PROFINET IP | 192.168.0.20 | Must match TIA assignment |
| PROFINET device name | plx31-pnd-mbs4 | Must match TIA assignment (lowercase, no spaces) |
| Serial protocol | Modbus RTU Master | LMV51 is a slave; the gateway polls it |
| Port used | Port 1 (RS-485) | Ports 2–4 disabled if not used |
| Baud rate | 9600 | Match LMV51 parameter 162 |
| Data bits / Parity / Stop | 8 / None / 1 | Match LMV51 parameter 163 |
| Inter-character timeout | 50 ms (default 3.5 char) | Increase to 100–200 ms on noisy cable runs |
| Inter-command delay | 50 ms | Some LMV51 firmware versions need ≥ 20 ms |
| Polling mode | Polled / continuous | Polled lets the PLC gate the gateway command queue via the input image |
6.1 Building the Modbus Map
Add commands in PCB's Modbus Master table. A minimal burner-control map:
| Cmd # | FC | Slave | Address | Count | Swap | PROFINET offset | Purpose |
|---|---|---|---|---|---|---|---|
| 1 | 03 | 1 | 0x0000 | 5 | Word | IW 0 | Status, lockout, setpoint echo, actual mod, flame |
| 2 | 04 | 1 | 0x000A | 2 | Word | IW 10 | Hours run (32-bit) |
| 3 | 06 | 1 | 0x0002 | 1 | Word | QW 0 | Write setpoint |
| 4 | 06 | 1 | 0x0014 | 1 | Word | QW 2 | Reset / start command |
When Word swap is selected, the gateway applies byte-swap so the data lands in the PLC big-endian as expected by Modbus-typed tags.
7. PLC Programming — SCL Example
The PROFINET I/O addresses are configured in step 5. With the mapping above, the LMV51 status word arrives at IW0 and the setpoint is written to QW0. The following SCL function block (TIA Portal V16, S7-1200 FW 4.4) can be used as a starting point:
FUNCTION_BLOCK "fb_LMV51_Gateway"
VAR
// Edge bits
bResetCmd : BOOL;
bRunEnable : BOOL;
// Process image from PLX31-PND-MBS4
nStatus : UINT; // IW0
nLockoutCode : UINT; // IW2
nSetpointEcho : UINT; // IW4
nActualMod : UINT; // IW6
nFlame : UINT; // IW8
diHoursRun : DINT; // IW10..IW13
// Outputs to PLX31-PND-MBS4
nSetpoint : UINT; // QW0 (0..1000 = 0.0..100.0 %)
nCmdWord : UINT; // QW2
END_VAR
BEGIN
// Scale setpoint request from HMI 0.0..100.0 % to LMV51 0..1000
#nSetpoint := REAL_TO_UINT( "HMI_Setpoint_pct" * 10.0 );
// Build command word: bit 0 = Start, bit 1 = Reset lockout
#nCmdWord := 0;
IF #bRunEnable THEN #nCmdWord := #nCmdWord OR 16#0001; END_IF;
IF #bResetCmd THEN #nCmdWord := #nCmdWord OR 16#0002; END_IF;
// Diagnostics: trip a fault if lockout code <> 0 and the burner is supposed to run
IF (#nStatus AND 16#0001) = 0 AND #bRunEnable THEN
"LMV51_Fault_latch" := #nLockoutCode; // user-defined global
END_IF;
END_FUNCTION_BLOCK
Call fb_LMV51_Gateway in a cyclic OB (OB1) and add an alarm to drive the S7-1215C's PROFINET diagnostic interrupt if the gateway reports a Modbus timeout (status word bit "IO-Not-OK").
8. Verification
- PROFINET AR up? In TIA's Online & diagnostics → PROFINET diagnostics, both devices should show AR Established and no alarms.
- Gateway LEDs: The PLX31-PND-MBS4 has separate PROFINET and Serial activity LEDs. Green on PROFINET, flickering green on the serial port means valid Modbus traffic.
-
Watch table: Force
QW0 = 500(50.0 %); the LMV51 should ramp its actuator and the actual modulation read-back atIW6should track within the configured ramp rate. - Modbus trace in PCB: PCB's Diagnostics → Modbus Traffic window must show the four configured commands being answered without "CRC error" or "Timeout".
- LMV51 AZL2x view: Navigate to parameter 0/1/2 and confirm the values match what the PLC wrote and read.
9. Diagnostics & Troubleshooting Matrix
| Symptom | Likely root cause | Corrective action |
|---|---|---|
| PROFINET "Station Failure" in TIA | PROFINET device name on the PLX31-PND-MBS4 differs from the TIA assignment | Use PCB or the gateway's web UI to set the name (case-sensitive), then power-cycle the gateway |
| AR up, but all inputs read 0xFFFF | Modbus timeouts — no response from LMV51 | Verify A/B wiring polarity, 120 Ω terminators, LMV51 address 161, baud rate 162, parity 163 |
| Inputs read valid data, outputs ignored | Polled-mode enable bit not set in the gateway input image, or output slot not added in TIA | Add the "MBS Out Words" module to slot 2 in TIA and rebuild the project |
| Intermittent CRC errors | Cable too long, no shielding, missing GND reference | Use shielded twisted pair, tie shield to earth at one end only, fit 120 Ω at both physical ends of the RS-485 segment |
| LMV51 reports "Communication error" on AZL2x | Parity or stop bits mismatch | Match 8N1 exactly. The LMV51 defaults to 8E1 on some firmware builds — confirm in parameter 163 |
| Setpoint write succeeds but actual modulation does not change | LMV51 in operating state < 12 (modulation), or fuel-air curve not commissioned | Check the burner state machine and ensure the LMV51 has been commissioned with the AZL2x |
| One specific register returns "Illegal Data Address" | Address 0-based vs 1-based confusion | LMV51 documentation is 0-based in some firmware builds and 1-based in others; subtract/add 1 to the address in PCB and try again |
10. LMV51 Register Map — Quick Reference
The following is a typical LMV5x Modbus map valid for BCM5.3x firmware. Refer to the LMV5x system manual (A7541) for the exact register set in your firmware version. Do not assume a register exists because it appears here — verify with the official Siemens parameter list.
| Holding reg. | Name | Access | Encoding |
|---|---|---|---|
| 0 | Phase / status | R | Bitmask per LMV5x system manual |
| 1 | Lockout code | R | 0 = no lockout, ≠ 0 = fault code |
| 2 | Setpoint modulation | R/W | 0…1000 = 0.0…100.0 % |
| 3 | Actual modulation | R | 0…1000 |
| 4 | Flame signal (ionisation) | R | 0…4095 AD counts |
| 5…9 | Air damper / fuel valve positions | R | 0…1000 |
| 10…11 | Hours run, resettable | R | UINT32, LSW @ 10 |
| 12…13 | Start counter | R | UINT32 |
| 20 | Command register | W | Bit 0 = Burner on, Bit 1 = Reset |
11. PLC Fault Handling — Recommended Pattern
Use the PROFINET slot diagnostics to surface a clear operator message. In the S7-1215C, add a hardware interrupt OB (OB82) to react to diagnostic interrupts from the gateway:
ORGANIZATION_BLOCK "OB_82_PROFINET_Diag"
TITLE = 'PROFINET Diagnostic Interrupt'
VAR_TEMP
t_LocalData : OB82_STRUCT;
END_VAR
BEGIN
// Latch raw event data, then evaluate on next OB1 scan
"Last_PN_Diag" := t_LocalData;
"PN_Diag_Pending" := TRUE;
END_ORGANIZATION_BLOCK
In OB1, raise an HMI alarm if the gateway went into IO-Not-OK, and write the last good values to a freeze buffer so the operator can identify when the failure occurred.
12. FAQ
Do I need a special TIA Portal driver or GSD for the PLX31-PND-MBS4?
Yes. The PLX31-PND-MBS4 is a third-party PROFINET Device, so TIA Portal needs the GSDML file from the Prosoft product page (PLX31-PND-MBS4 downloads). Install it under Options → Manage general station description files (GSD). No other driver is required because the gateway handles the Modbus RTU master function on its own.
Can the S7-1215C poll the LMV51 directly over RS-485 using the CM1241 module instead of using the Prosoft gateway?
Yes, by adding a CM1241 RS-485 communication module or a CB1241 board and using the Modbus_Master instruction in the S7-1200 program library. The PLX31-PND-MBS4 is preferred when (a) the LMV51 is on a separate physical RS-485 segment far from the PLC, (b) you need bus isolation, or (c) the LMV51 will later be joined by additional Modbus devices on the same trunk.
What is the default Modbus address and baud rate of an LMV51?
Out of the box the LMV51 typically uses Modbus address 1, 9600 baud, 8 data bits, no parity, 1 stop bit. Verify in the LMV5x system manual (Siemens document A7541) and change parameters 161/162/163 on the AZL2x display if a different setup is required.
Why are my inputs 0xFFFF even though PROFINET shows the device as connected?
0xFFFF in the process image is the default for an IO device with no valid data. Almost always this means the gateway is not getting valid Modbus responses from the LMV51 — check A/B polarity, RS-485 termination, slave address, and baud rate. Open the Modbus Traffic window in Prosoft Configuration Builder to confirm whether the gateway is timing out or receiving CRC errors.
How do I make the PLC recognise the gateway after a power-cycle?
The PROFINET device name assigned in TIA Portal must be written to the gateway once, either via the Assign PROFINET device name function in TIA, the gateway's built-in web UI, or PCB. Without this, the gateway boots as an un-named device and the S7-1215C's Application Relationship will not come up.
Can I use the PLX31-PND-MBS4 to write setpoints and start the burner from the PLC?
Yes, the gateway supports Modbus function codes 06 (Write Single Register) and 16 (Write Multiple Registers) to address the LMV51's command and setpoint registers. Always verify that the LMV51 is in a state that accepts the command (typically operating state ≥ 12) and respect the safety chain — the PLC should only issue commands, never bypass the LMV51's hard-wired interlocks.