Configuring Siemens LMV51 Modbus Communication

David Krause12 min read
S7-1200SiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Architecture Overview

The Siemens LMV51 is a microprocessor-based burner management controller for modulating gas/oil burners up to ~350 kW. It exposes a serial Modbus RTU interface on the X89 terminal block (RS-485) for integration into BMS or PLC networks. The Prosoft PLX31-PND-MBS4 is a PROFINET Device / Modbus Serial master-or-slave gateway. Combined with a Siemens S7-1215C (CPU 1215C DC/DC/DC, 6ES7215-1AG40-0XB0 or newer), the topology is:

S7-1215C PROFINET Controller IP: 192.168.0.10 PLX31-PND-MBS4 PROFINET Device (slave to PLC) Modbus RTU Master (to LMV51) IP: 192.168.0.20 Siemens LMV51 RS-485 Modbus RTU Addr: 1, 9600 8N1 PROFINET RS-485 (A/B)

Data flow: TIA Portal cyclically exchanges I/O data with the gateway on PROFINET; the gateway independently polls the LMV51 with Modbus function codes and updates the I/O image. The PLC does not need to handle the Modbus protocol directly — it only reads/writes the process image configured in the Prosoft gateway.

2. Prerequisites

2.1 Hardware

Item Model / Notes
PLC SIMATIC S7-1215C (firmware V4.4 or higher recommended for GSDML v2.3+ device compatibility)
Burner controller Siemens LMV51 (AGM31.xx fuel-air ratio control); observe the wiring diagram in the LMV51 datasheet, document LMV51 data sheet
Gateway Prosoft PLX31-PND-MBS4 (PROFINET Device, 4-port Modbus Serial); refer to the PLX31-PND-MBS4 product page for the latest datasheet and downloads
Cabling PROFINET: shielded Cat 5e or higher, max 100 m segment; RS-485: twisted shielded pair, 120 Ω terminator on both ends for long runs
Display AZL2x (AZL23 or AZL21) for setting the LMV51 Modbus address and baud rate

2.2 Software

Tool Purpose Version (minimum)
TIA Portal PLC hardware configuration and programming V16 (with HSP for the GSDML if needed)
Prosoft Configuration Builder (PCB) Gateway IP, Modbus master map, register mapping Current release from Prosoft
GSDML file for PLX31-PND-MBS4 Allows TIA Portal to recognize the gateway as a PROFINET device Download from the Prosoft product page (do not rename the file)
LMV51 system documentation Modbus register list, supported function codes Siemens LMV5x system manual (A7541)
Important: The PLX31-PND-MBS4 is a PROFINET Device, not a controller. It must be connected to a PROFINET IO-controller (the S7-1215C). TIA Portal only requires the gateway's GSDML because it is a third-party IO device — Siemens PLCs do not ship a generic Modbus driver for serial burners.

3. Configuring the LMV51 Modbus Interface

By default the LMV51 ships with Modbus disabled or set to address 1. Before powering the burner, set the serial parameters on the AZL2x display:

  1. Enter the parameter level on the AZL2x (see LMV51 parameter list, parameter 161 "Communication address").
  2. Set parameter 161 to a unique Modbus slave address (default = 1, valid 1…247).
  3. Set parameter 162 for baud rate (typically 9600 for PLX31-PND-MBS4).
  4. Set parameter 163 for parity (None, Even, Odd) — 8N1 is the LMV51 default.
  5. Wire the LMV51 X89 terminals: 61 = RS-485 A (+), 62 = RS-485 B (−), 63 = GND.

Reference the official Siemens LMV5x system manual (A7541) under "Bus connection / Modbus" to confirm the register table. A typical subset used in burner control programs:

Register (4x) Access Description Data type
0 R Operating mode / status word UINT16
1 R Current lockout / fault code UINT16
2 R/W Setpoint modulation (%) UINT16 (0…1000 = 0.0…100.0%)
3 R Actual modulation (%) UINT16
4 R Flame signal (AD value) UINT16
10 R Hours run resettable UINT32 (2 registers)
20 R/W Start / Stop / Lockout reset command UINT16
Always cross-check the register list against the LMV51 parameter list shipped with the unit. Siemens revises the Modbus map between firmware releases of the LMV5x firmware (BCM5.x).

4. Installing the GSDML in TIA Portal

  1. Open the TIA Portal project containing the S7-1215C station.
  2. In the project tree choose Options → Manage general station description files (GSD).
  3. Set the source path to the folder where the unzipped Prosoft GSDML is stored. TIA Portal lists every .xml matching the GSDML schema (e.g. GSDML-V2.3-ProSoft-PLX31-PND-MBS4-20180112.xml).
  4. Select the file and click Install. The device becomes available under Other field devices → PROFINET IO → Gateway → ProSoft Technology → PLX31-PND-MBS4.
  5. Restart TIA Portal if a module update is requested (HSP conflict on older V13/V14 builds).

5. Adding the Gateway to the PROFINET Topology

  1. Open the Devices & networks editor and switch to the network view.
  2. Drag the PLX31-PND-MBS4 from the hardware catalog onto the PROFINET subnet of the S7-1215C. TIA will assign it a temporary name and IP (e.g. plx31-pnd-mbs4 / 0.0.0.0).
  3. Open the gateway's Properties → PROFINET interface and assign a fixed IP address (e.g. 192.168.0.20), subnet mask 255.255.255.0 and a PROFINET device name (must match the one stored in the gateway, see step 6).
  4. From the device view, drop one or both available slots — the PLX31-PND-MBS4 exposes up to two IO modules:
Slot Direction Length Typical use
Slot 1 — "MBS In Words" Input (PLC reads) Configurable, up to 244 bytes LMV51 data read via FC 03/04
Slot 2 — "MBS Out Words" Output (PLC writes) Configurable, up to 244 bytes LMV51 setpoints / commands via FC 06/16

Compile the hardware configuration and download it to the S7-1215C. The PLC will only establish PROFINET AR (Application Relationship) with the gateway once the gateway's stored device name matches the one TIA programmed into the device.

6. Configuring the PLX31-PND-MBS4 with Prosoft Configuration Builder

Connect the Ethernet port of the PLX31-PND-MBS4 to the engineering PC, open PCB, and load the default project. Important settings:

Parameter Recommended value Comment
PROFINET IP 192.168.0.20 Must match TIA assignment
PROFINET device name plx31-pnd-mbs4 Must match TIA assignment (lowercase, no spaces)
Serial protocol Modbus RTU Master LMV51 is a slave; the gateway polls it
Port used Port 1 (RS-485) Ports 2–4 disabled if not used
Baud rate 9600 Match LMV51 parameter 162
Data bits / Parity / Stop 8 / None / 1 Match LMV51 parameter 163
Inter-character timeout 50 ms (default 3.5 char) Increase to 100–200 ms on noisy cable runs
Inter-command delay 50 ms Some LMV51 firmware versions need ≥ 20 ms
Polling mode Polled / continuous Polled lets the PLC gate the gateway command queue via the input image

6.1 Building the Modbus Map

Add commands in PCB's Modbus Master table. A minimal burner-control map:

Cmd # FC Slave Address Count Swap PROFINET offset Purpose
1 03 1 0x0000 5 Word IW 0 Status, lockout, setpoint echo, actual mod, flame
2 04 1 0x000A 2 Word IW 10 Hours run (32-bit)
3 06 1 0x0002 1 Word QW 0 Write setpoint
4 06 1 0x0014 1 Word QW 2 Reset / start command

When Word swap is selected, the gateway applies byte-swap so the data lands in the PLC big-endian as expected by Modbus-typed tags.

Field-proven caveat: The LMV51 does not require a function-code scan and will respond to a fresh poll within ~30 ms when the bus is idle. Do not enable the gateway's "only on data change" mode for safety-critical parameters such as the lockout code; poll them every cycle.

7. PLC Programming — SCL Example

The PROFINET I/O addresses are configured in step 5. With the mapping above, the LMV51 status word arrives at IW0 and the setpoint is written to QW0. The following SCL function block (TIA Portal V16, S7-1200 FW 4.4) can be used as a starting point:

FUNCTION_BLOCK "fb_LMV51_Gateway"
VAR
    // Edge bits
    bResetCmd     : BOOL;
    bRunEnable    : BOOL;
    // Process image from PLX31-PND-MBS4
    nStatus       : UINT;  // IW0
    nLockoutCode  : UINT;  // IW2
    nSetpointEcho : UINT;  // IW4
    nActualMod    : UINT;  // IW6
    nFlame        : UINT;  // IW8
    diHoursRun    : DINT;  // IW10..IW13
    // Outputs to PLX31-PND-MBS4
    nSetpoint     : UINT;  // QW0  (0..1000 = 0.0..100.0 %)
    nCmdWord      : UINT;  // QW2
END_VAR
BEGIN
    // Scale setpoint request from HMI 0.0..100.0 % to LMV51 0..1000
    #nSetpoint := REAL_TO_UINT( "HMI_Setpoint_pct" * 10.0 );

    // Build command word: bit 0 = Start, bit 1 = Reset lockout
    #nCmdWord := 0;
    IF #bRunEnable THEN #nCmdWord := #nCmdWord OR 16#0001; END_IF;
    IF #bResetCmd  THEN #nCmdWord := #nCmdWord OR 16#0002; END_IF;

    // Diagnostics: trip a fault if lockout code <> 0 and the burner is supposed to run
    IF (#nStatus AND 16#0001) = 0 AND #bRunEnable THEN
        "LMV51_Fault_latch" := #nLockoutCode;   // user-defined global
    END_IF;
END_FUNCTION_BLOCK

Call fb_LMV51_Gateway in a cyclic OB (OB1) and add an alarm to drive the S7-1215C's PROFINET diagnostic interrupt if the gateway reports a Modbus timeout (status word bit "IO-Not-OK").

8. Verification

  1. PROFINET AR up? In TIA's Online & diagnostics → PROFINET diagnostics, both devices should show AR Established and no alarms.
  2. Gateway LEDs: The PLX31-PND-MBS4 has separate PROFINET and Serial activity LEDs. Green on PROFINET, flickering green on the serial port means valid Modbus traffic.
  3. Watch table: Force QW0 = 500 (50.0 %); the LMV51 should ramp its actuator and the actual modulation read-back at IW6 should track within the configured ramp rate.
  4. Modbus trace in PCB: PCB's Diagnostics → Modbus Traffic window must show the four configured commands being answered without "CRC error" or "Timeout".
  5. LMV51 AZL2x view: Navigate to parameter 0/1/2 and confirm the values match what the PLC wrote and read.

9. Diagnostics & Troubleshooting Matrix

Symptom Likely root cause Corrective action
PROFINET "Station Failure" in TIA PROFINET device name on the PLX31-PND-MBS4 differs from the TIA assignment Use PCB or the gateway's web UI to set the name (case-sensitive), then power-cycle the gateway
AR up, but all inputs read 0xFFFF Modbus timeouts — no response from LMV51 Verify A/B wiring polarity, 120 Ω terminators, LMV51 address 161, baud rate 162, parity 163
Inputs read valid data, outputs ignored Polled-mode enable bit not set in the gateway input image, or output slot not added in TIA Add the "MBS Out Words" module to slot 2 in TIA and rebuild the project
Intermittent CRC errors Cable too long, no shielding, missing GND reference Use shielded twisted pair, tie shield to earth at one end only, fit 120 Ω at both physical ends of the RS-485 segment
LMV51 reports "Communication error" on AZL2x Parity or stop bits mismatch Match 8N1 exactly. The LMV51 defaults to 8E1 on some firmware builds — confirm in parameter 163
Setpoint write succeeds but actual modulation does not change LMV51 in operating state < 12 (modulation), or fuel-air curve not commissioned Check the burner state machine and ensure the LMV51 has been commissioned with the AZL2x
One specific register returns "Illegal Data Address" Address 0-based vs 1-based confusion LMV51 documentation is 0-based in some firmware builds and 1-based in others; subtract/add 1 to the address in PCB and try again
Safety reminder: The LMV51 is a safety-integrated burner controller with its own flame supervision and lockout logic. The PLC must never bypass the LMV51's hard-wired safety chain. Modbus is suitable for monitoring (status, modulation, flame signal, hours run) and for supervisory setpoint changes, but emergency trip must remain on the LMV51's safety outputs.

10. LMV51 Register Map — Quick Reference

The following is a typical LMV5x Modbus map valid for BCM5.3x firmware. Refer to the LMV5x system manual (A7541) for the exact register set in your firmware version. Do not assume a register exists because it appears here — verify with the official Siemens parameter list.

Holding reg. Name Access Encoding
0 Phase / status R Bitmask per LMV5x system manual
1 Lockout code R 0 = no lockout, ≠ 0 = fault code
2 Setpoint modulation R/W 0…1000 = 0.0…100.0 %
3 Actual modulation R 0…1000
4 Flame signal (ionisation) R 0…4095 AD counts
5…9 Air damper / fuel valve positions R 0…1000
10…11 Hours run, resettable R UINT32, LSW @ 10
12…13 Start counter R UINT32
20 Command register W Bit 0 = Burner on, Bit 1 = Reset

11. PLC Fault Handling — Recommended Pattern

Use the PROFINET slot diagnostics to surface a clear operator message. In the S7-1215C, add a hardware interrupt OB (OB82) to react to diagnostic interrupts from the gateway:

ORGANIZATION_BLOCK "OB_82_PROFINET_Diag"
TITLE = 'PROFINET Diagnostic Interrupt'
VAR_TEMP
    t_LocalData  : OB82_STRUCT;
END_VAR
BEGIN
    // Latch raw event data, then evaluate on next OB1 scan
    "Last_PN_Diag" := t_LocalData;
    "PN_Diag_Pending" := TRUE;
END_ORGANIZATION_BLOCK

In OB1, raise an HMI alarm if the gateway went into IO-Not-OK, and write the last good values to a freeze buffer so the operator can identify when the failure occurred.

12. FAQ

Do I need a special TIA Portal driver or GSD for the PLX31-PND-MBS4?

Yes. The PLX31-PND-MBS4 is a third-party PROFINET Device, so TIA Portal needs the GSDML file from the Prosoft product page (PLX31-PND-MBS4 downloads). Install it under Options → Manage general station description files (GSD). No other driver is required because the gateway handles the Modbus RTU master function on its own.

Can the S7-1215C poll the LMV51 directly over RS-485 using the CM1241 module instead of using the Prosoft gateway?

Yes, by adding a CM1241 RS-485 communication module or a CB1241 board and using the Modbus_Master instruction in the S7-1200 program library. The PLX31-PND-MBS4 is preferred when (a) the LMV51 is on a separate physical RS-485 segment far from the PLC, (b) you need bus isolation, or (c) the LMV51 will later be joined by additional Modbus devices on the same trunk.

What is the default Modbus address and baud rate of an LMV51?

Out of the box the LMV51 typically uses Modbus address 1, 9600 baud, 8 data bits, no parity, 1 stop bit. Verify in the LMV5x system manual (Siemens document A7541) and change parameters 161/162/163 on the AZL2x display if a different setup is required.

Why are my inputs 0xFFFF even though PROFINET shows the device as connected?

0xFFFF in the process image is the default for an IO device with no valid data. Almost always this means the gateway is not getting valid Modbus responses from the LMV51 — check A/B polarity, RS-485 termination, slave address, and baud rate. Open the Modbus Traffic window in Prosoft Configuration Builder to confirm whether the gateway is timing out or receiving CRC errors.

How do I make the PLC recognise the gateway after a power-cycle?

The PROFINET device name assigned in TIA Portal must be written to the gateway once, either via the Assign PROFINET device name function in TIA, the gateway's built-in web UI, or PCB. Without this, the gateway boots as an un-named device and the S7-1215C's Application Relationship will not come up.

Can I use the PLX31-PND-MBS4 to write setpoints and start the burner from the PLC?

Yes, the gateway supports Modbus function codes 06 (Write Single Register) and 16 (Write Multiple Registers) to address the LMV51's command and setpoint registers. Always verify that the LMV51 is in a state that accepts the command (typically operating state ≥ 12) and respect the safety chain — the PLC should only issue commands, never bypass the LMV51's hard-wired interlocks.

Back to blog