Configuring WinCC V7.0 Modbus TCP 16-Bit Register Float Values

Configuring WinCC V7.0 Modbus TCP 16-Bit Register Float Values

This reference documents how to configure a Siemens WinCC V7.0 HMI/SCADA station (acting as a Modbus TCP client) to correctly interpret engineering values that a server device stores as scaled 16-bit integers in the 4xxxx holding register range. It is a common failure mode in field commissioning to misconfigure a WinCC tag as a 32-bit IEEE-754 floating-point value, only to discover that the device packs one fractional value per register (resolution factor applied on the SCADA side) and the tag displays garbage. The procedures below cover the three valid configurations: linear scaling on a 16-bit unsigned tag, the Adapt Format conversion FloatToUnsignedWord on a 32-bit float tag, and a 32-bit signed (DINT) tag for integral cross-register values.

1. Problem Summary

A WinCC V7.0 tag is created against a Modbus TCP channel that points to register 40001. The HMI engineer opens the tag properties and selects one of the available data types:

Selecting Floating-point 32-bit at register 40001 instructs the driver to read registers 40001 and 40002 and combine them into an IEEE-754 single-precision float. The combined word pair is interpreted as a 32-bit big-endian value:

float_value = reinterpret<float>( (reg40001 << 16) | reg40002 )

If the device returns only one scaled integer per register, the IEEE-754 decode is meaningless (often a negative number, an overflow, or a value one or two orders of magnitude out of range). This is the central symptom reported in the original support case.

2. Root Cause Analysis

The conflict emerges from three orthogonal encoding schemes meeting at the tag dialog:

The device vendor publishes a "resolution" per variable (e.g., 0.1, 0.01, 1). A raw register value of 321 therefore represents an engineering value of 32.1 (resolution 0.1), 3.21 (resolution 0.01), or 321 (resolution 1). The Modbus TCP driver passes the raw 16-bit word to WinCC; WinCC does not infer the resolution, and there is no automatic scaling on read. A 32-bit float tag decodes the word pair incorrectly because the assumption (two-register IEEE-754 packing) is false.

3. Method A - Linear Scaling on an Unsigned 16-Bit Tag

This is the cleanest configuration when the raw-to-engineering transform is a single linear multiplication by a constant. WinCC's driver-level linear scaling executes at acquisition time and does not require a script.

1. Create the tag with data type Unsigned Value, 16 bits.
2. Set the tag address to Modbus register 40001 (offset 0 in holding register space).
3. In the tag properties, enable Linear Scaling.
4. Set Raw range low = 0 and Raw range high = 65535.
5. Set Engineering range low = 0 / resolution and Engineering range high = 65535 / resolution.
6. Optionally enable Invert if the device swaps the scaling direction.

Example: variable Temperature with resolution 0.1 °C:

• Raw range: 0 to 65535
• Engineering range: 0.0 to 6553.5
• A raw register value of 321 displays as 32.1 °C.

For resolution 0.01:

• Engineering range: 0.00 to 655.35
• A raw register value of 321 displays as 3.21.

4. Method B - Adapt Format FloatToUnsignedWord

If downstream WinCC tags, scripts, archives, or faceplate widgets require a 32-bit float surface, configure the tag as a 32-bit float and apply the Adapt Format conversion FloatToUnsignedWord. The function takes a 32-bit float tag declaration but reads the data as a 16-bit unsigned word at acquisition time, then promotes the result back to a 32-bit float for use throughout the project.

1. Create the tag with data type Floating-point 32-bit IEEE 754.
2. Set the tag address to Modbus register 40001, length 1 word.
3. Open Tag Properties > Adapt Format.
4. Select conversion function FloatToUnsignedWord.
5. Confirm the conversion direction (Word → Float) and commit the dialog.

The FloatToUnsignedWord conversion is documented in the WinCC V7.0 Information System under Working with WinCC > Tag Management > Adapt Format. The function prevents the driver from consuming a second register for the IEEE-754 decode, while preserving the float data type for the rest of the WinCC project.

5. Method C - DINT Tag for Cross-Register Integral Values

When the device returns a 32-bit signed integer across two consecutive registers and the engineering value is integral (no fractional component), use a 32-bit signed (DINT) tag.

1. Create the tag with data type Signed Value, 32 bits (DINT).
2. Set the tag address to Modbus register 40001, length 2 words.
3. Verify the word order against the device documentation. Modbus standard is big-endian (MSW at 40001, LSW at 40002); some instruments use the reverse.
4. If the read value appears rotated, swap MSW/LSW with a script or with the driver's word-order configuration.

DINT must not be used as a substitute for a true float read. If the engineering value has a fractional component, DINT will truncate the fractional bits and produce visibly wrong results.

6. Register Addressing Reference (Modicon 4xxxx Convention)

The Modicon 4xxxx holding register address space maps to WinCC offsets as follows:

A 32-bit IEEE-754 float on a Modbus-conforming server occupies two consecutive registers (e.g., 40001 + 40002) in big-endian word order. WinCC's driver automatically reads both registers when a 32-bit float tag is created at register 40001. If the device places only one 16-bit value per register, a 32-bit float tag will overrun into the next variable's register and produce invalid data.

7. Step-by-Step WinCC V7.0 Configuration

7.1 Prerequisites

• WinCC V7.0 SP3 or later installed on the HMI/runtime station.
• Modbus TCP channel driver installed and licensed (Siemens "SIMATIC WinCC Modbus TCP" add-on or equivalent Connectivity Pack component).
• Ethernet connectivity from the HMI station to the device's TCP port 502 (default Modbus TCP port).
• Device address map documentation showing the holding register base (e.g., 40001) and per-variable resolution (e.g., 0.1, 0.01, 1).

7.2 Procedure

1. Open WinCC Explorer and select the project node Tag Management.
2. Expand the Modbus TCP channel (e.g., ModbusTCPIP). If the channel is missing, install the Modbus TCP driver and create a new connection with the device IP address and port 502.
3. Right-click the channel and select New Tag.
4. In the Tag Properties dialog, configure:
   • Name: engineering name, e.g., Tank_Level_Actual
   • Data type: Unsigned 16-bit value (Method A) or Floating-point 32-bit IEEE 754 (Method B)
   • Address: Modbus register 40001, length 1 word
   • Acquisition cycle: 1 s (operator HMI) or 5 s (diagnostics)
5. For Method A: enable Linear Scaling, set raw range 0-65535, set engineering range using the resolution from the device manual.
6. For Method B: open Adapt Format, select FloatToUnsignedWord, then enable Linear Scaling for the resolution factor.
7. Click OK to commit the tag.
8. Test the tag in WinCC's internal Tag Simulation tool, or wire it to a numeric I/O field on a graphics screen.

8. Verification Procedure

1. Raw read check. Use WinCC's internal tag diagnostics or a third-party Modbus master (e.g., Modbus Poll, CAS Modbus Scanner) to read register 40001 and confirm the raw 16-bit value.
2. Scaling check. Multiply the raw value by the documented resolution. The result must match the device's local display to within ±0.5 LSB.
3. Continuity check. Force a known value at the device (e.g., 4 mA loop trim or a calibration reference) and confirm the HMI value follows within the configured acquisition cycle (default 1 s, 250 ms, or 500 ms depending on driver settings).
4. Range check. Sweep the input across the full 0-65535 raw range and confirm no HMI overflow, no NaN, and no negative readings (unless the device documentation explicitly permits negative values).
5. Quality check. Confirm the tag quality stays Good (OPC quality 0xC0) under steady-state operation. If quality drops to Bad - Communication Error (0x00), refer to the timeout section below.

9. Driver Timeout and Channel Health

The WinCC Modbus TCP driver (and most third-party Modbus drivers, including those bundled with Ignition, Kepware, and TOP Server) enforces a default timeout on tag acquisition. If no successful tag read occurs within the timeout window (typically 10 seconds), the channel marks the connection as bad and all dependent tags drop to Bad - Communication Error quality.

Best practice to keep the channel healthy:

• Assign an explicit acquisition cycle to every Modbus tag (no on-demand-only tags) so the driver polls at least one register continuously.
• Set the driver timeout to at least 2× the worst-case device response time observed during commissioning.
• Add a keep-alive read of a known-good register (a static diagnostic or a coil that the device toggles) so polling continues even when operator screens are closed.
• Enable driver-side TCP keep-alive at the operating system level (default Windows TCP keep-alive is 2 hours; reduce to 30-60 s for industrial Modbus).

10. Alternative OPC Server Solutions

If the WinCC native Modbus TCP driver cannot satisfy resolution or scaling requirements (e.g., complex per-tag transforms, signed/unsigned mixing, byte-swap requirements), route the data through an OPC server and consume the OPC tags in WinCC via the OPC channel.

• Siemens PCS 7 Modbus TCP/IP Library (V1.63): driver FBs for S7-400 and S7-400H CPUs; provides native Modbus master functionality with FC 03, FC 06, and FC 16 support for direct integration of third-party Modbus slaves into PCS 7 CFC charts. See PCS 7 Modbus TCP/IP library manual.
• TOP Server Modbus TCP Ethernet Driver (Software Toolbox): client and server Modbus TCP connectivity, with built-in scaling, signed/unsigned handling, and float byte-swap options for Modicon and compatible devices. See TOP Server Modbus driver page.
• Kepware Modbus Ethernet Driver (PTC): extensive Modbus device database covering 200+ instrument vendors; supports 16-bit/32-bit/64-bit data types, float byte order selection, and per-tag linear scaling. See Kepware Modbus Ethernet driver.
• IGSS32 MODBUS/TCP Driver (Schneider Electric): uses a standard Windows TCP/IP socket to communicate with Modbus/TCP PLCs; well suited when IGSS is the supervisory layer alongside WinCC. See IGSS Modbus/TCP driver documentation.

11. PCS 7 Modbus TCP/IP Integration Notes

For PCS 7 V7.1+ plants that include non-Siemens Modbus devices, the PCS7v7_MODBUS_TCPIP library provides pre-built FBs (e.g., MODB_TCP, MODB_4REG, MODB_8REG) that can be inserted into an S7-400 or S7-400H CFC chart. The library supports:

• FC 03 (Read Holding Registers)
• FC 06 (Write Single Register)
• FC 16 (Write Multiple Registers)

The FBs expose the register value as WORD and the engineering value as REAL after applying the resolution in the calling block, which resolves the same 16-bit-scaled-vs-IEEE-754 conflict that WinCC users encounter. The library runs on the S7-400 CPU as a Modbus master and publishes the converted values to WinCC over the standard S7 protocol, removing the Modbus driver from the WinCC layer entirely.

12. Troubleshooting Matrix

13. Float Encoding Diagnostic Procedure

If the device documentation is ambiguous and you need to determine whether a 4xxxx register pair carries a true IEEE-754 float or a scaled integer, run this diagnostic:

1. Read register 40001 (high word) and 40002 (low word) as two separate Unsigned 16-bit tags.
2. Concatenate the words: value32 = (high_word << 16) | low_word.
3. Reinterpret the 32-bit word as IEEE-754 single-precision float (C union or WinCC C-script: memcpy(&f, &v, 4);).
4. If the resulting float matches the device display, the device is returning a true float; configure the WinCC tag as 32-bit Floating-point IEEE 754 at register 40001, length 2 words.
5. If the resulting float is NaN, +Inf, or wildly out of range, the device is returning scaled integers; fall back to Method A or Method B above.

Confirm with the device vendor whether the byte order inside each word is big-endian (Modbus standard) or little-endian. Some Chinese-vendor instruments use little-endian word order; correct with a script or driver byte-swap setting.

14. Performance and Cycle Tuning

For HMI stations polling dozens of Modbus devices:

• Acquisition cycle: 1 s for operator-relevant values, 5 s for diagnostics, 30 s for static configuration. Avoid sub-250 ms cycles on TCP unless the device is on a dedicated VLAN and latency has been measured under 10 ms.
• Multiplexing: group consecutive registers into a single FC 03 multi-register read to minimize round-trip overhead. A 10-register read is one transaction; ten 1-register reads are ten transactions.
• Buffering: enable driver-side read buffering (where supported) to absorb transient TCP latency without dropping the tag quality to Bad.
• Channel count: limit to one Modbus TCP connection per device IP; multiple WinCC tags on the same device share the channel.

15. Glossary of Acronyms

FAQ