Fixing Modbus 32-Bit IEEE 754 Float Read Errors in Siemens Step 7

Problem Description

Reading a 32-bit IEEE 754 floating-point value from a Modbus RTU/TCP meter in a Siemens SIMATIC S7-300 or S7-400 with STEP 7 and the MB_MASTER library block returns hex data that does not decode to a sensible engineering value. Typical field symptoms:

• Two consecutive 16-bit input words reported by STEP 7 do not match the displayed process value on the meter.
• Byte-swap or word-swap attempts produce another nonsense number (for example, 4.05e17) but never the actual measurement.
• When the process variable is increased, the read value changes by a constant factor, jumps discontinuously, or remains stuck on a garbage number.
• MB_MASTER.STATUS returns 0x0000 (no error), which is misleading because the data is still wrong.

Example capture from STEP 7 (MB_MASTER, function code 03 or 04, 2 words starting at the user-supplied start address):

Expected engineering range: ~16.0 to ~16.5 (process value 16.343). Expected IEEE 754 single-precision encoding of the displayed values:

Because 0x0000 0x5CB4 (decoded as 4.0532397e17) does not correspond to any value the meter should be producing, the protocol transaction itself is delivering data the master did not intend to read. This is an addressing error at the Modbus application layer, not a float-format error. The next section shows that the fix is a one-line change to the start address.

Root Cause: Modbus 0-Based vs. 1-Based Addressing

Modbus is a 0-based protocol. The address field of every Modbus PDU is an offset from the start of the relevant register table (coil, discrete input, input register, holding register). The Modbus Application Protocol Specification V1.1b3 defines this address as a 16-bit unsigned offset starting at 0; the function code prefix (1, 2, 3, 4) is purely a documentation convention, not part of the wire format.

Meter manufacturers, however, document their register maps with 1-based numbering for human convenience, and they often add a function-code prefix to that number:

The general rules to apply consistently across vendors:

• Subtract 1 from any 1-based number the vendor prints.
• If the vendor prints a "4xxxx" or "3xxxx" five-digit prefix, strip the leading 3 or 4 and subtract 1 from the remaining four digits.
• If the vendor uses 0-based numbering in the manual (some Schneider, ABB, and Siemens SIPROCESS meters), do not subtract — read the offset literally.
• Place the resulting 0-based offset into the master's start address input as a WORD or INT.

IEEE 754 Single-Precision Layout (Quick Reference)

For diagnosing whether the master did read the correct pair of words, decode them as follows:

Decoded value = (-1)^S × 1.M × 2^(E-127). Examples to keep at hand during commissioning:

• 16.343 = 0x4182BE77 = 0 10000011 00000101011111001110111
• 23732.0 = 0x46B96800 = 0 10001101 01110010110100000000000
• 1.0 = 0x3F800000
• 0.0 = 0x00000000
• 0x7F800000 = +infinity; 0x7FC00000 = NaN

When STEP 7 shows 0x0000 0x5CB4 in a buffer that you then interpret as a REAL, the resulting value 4.05e17 has exponent bits 0x7F and mantissa bits that do not match any physical process variable. This is a fast visual confirmation that the data is from the wrong register pair.

Word Order Across the Modbus Wire

Modbus RTU/TCP is big-endian on the wire. For a 32-bit float, the slave transmits the high word first, then the low word:

• Wire bytes for 16.343: 0x41 0x82 0xBE 0x77 (high word 0x4182, then low word 0xBE77)

Inside a Siemens S7 CPU, words are stored little-endian. A 32-bit REAL in a DB or memory is laid out with the low word at the lower byte address and the high word at the higher byte address:

• S7 MD100 holding 16.343: MW100 = 0xBE77 (low), MW102 = 0x4182 (high)

This produces a second class of decode errors that mimic the off-by-one problem:

Best practice: read into a paired 2-word buffer (for example, an ARRAY[0..1] OF WORD in a DB), then assemble the two words into a 32-bit REAL in the S7 little-endian layout. For STEP 7 classic (S7-300/400) the canonical STL pattern is:

// STEP 7 STL - assemble 2 Modbus words into a REAL
// Assumes the first word is in MW0 (0xBE77) and the second word in MW2 (0x4182).
// The MD0 then reads as 16.343 when viewed as REAL.

      L     MW     0                // low word  = 0xBE77
      T     MD   100                // write to MD100 (REAL target)
      L     MW     2                // high word = 0x4182
      T     MW   102                // placed at MW102 (high word of MD100)
// MD100 now holds 16.343 (REAL)

If the value decodes correctly only after a manual byte swap, the data is correct but the destination buffer is laid out in the opposite byte order; the fix is to remap the destination or use a swap block such as:

// STEP 7 STL - byte-swap 32-bit REAL (big-endian Modbus <-> little-endian S7)
      L     MD     0                // input REAL
      TAD                           // swap all 4 bytes in the accumulator
      T     MD    10                // swapped REAL

For S7-1200 and S7-1500 with TIA Portal, use the system block "SWAP" with MODE = 1 for a 4-byte word swap, or read the float directly into a tag of type Real using the standard MB_CLIENT data block; the runtime applies the byte order configured in the MB_DATA_PTR connection.

STEP 7 MB_MASTER Configuration Checklist

When the master is an S7 CPU using the standard Modbus master library, confirm the following parameters before changing the address. The MB_MASTER FB (part of the "MODBUS" library for S7-300/400) and the MODBUS_PN blocks for S7-1500/ET200SP all share a similar interface:

1. REQ = rising edge to trigger a single transaction.
2. MODE = 0 (send request) or 1 (send/receive on event).
3. Data pointer must point to a DB large enough: DATA_LEN ≥ 5 bytes for FC03/04 (slave address, function code, byte count, data, implicit CRC). For a 2-word float allocate at least 6 bytes in the data block.
4. Function code: FC03 for holding registers, FC04 for input registers — match the meter's register class.
5. START_ADDR: 0-based offset, subtract 1 from any 1-based vendor number.
6. Quantity: 2 for a 32-bit float, 4 for a 64-bit double, 1 for a 16-bit integer.
7. Timeout: 1000 ms minimum for RS-485 at 9600 baud, scaled up for 19200/38400 baud or longer cable runs.
8. Baud and parity: match the meter's serial settings (2400/4800/9600/19200, 8N1, 8E1, or 8O1).

Common error codes returned by MB_MASTER when the start address is wrong:

Step-by-Step Resolution

1. Pull the meter's register map. Identify the float register(s). Note the exact label as printed in the manual: "4000", "40001", "Holding register 4" — all mean slightly different things. Confirm whether the manual uses 0-based or 1-based numbering by looking at the introductory section of the manual or by reading register 0 (the slave's first register) and comparing to whatever the manual calls it.
2. Compute the 0-based offset.

   // Pseudocode for converting vendor-printed address to Modbus wire address
   // vendorNumber is the number printed in the manual, as a WORD
   if (label starts with "4" and has 5 digits) {
       offset = vendorNumber - 40001;   // for holding registers
   } else if (label starts with "3" and has 5 digits) {
       offset = vendorNumber - 30001;   // for input registers
   } else {
       offset = vendorNumber - 1;       // plain 1-based "register N"
   }
   // if vendor documents are explicitly 0-based, replace the above with:
   // offset = vendorNumber;
   

3. Place the offset into MB_MASTER.START_ADDR. For the symptom in the source problem, if the manual said the float is at "address 4000" (1-based, no prefix), START_ADDR = 3999. If the manual said "register 40001" (4xxxx prefix), START_ADDR = 40001 - 40001 = 0 — meaning the float is at the very first holding register of the meter, which is the same as register 0 in 0-based terms. The two conventions collapse to a single 0-based value once the rule is applied consistently.
4. Set the quantity to 2 for a 32-bit IEEE 754 float. Each Modbus word is 16 bits, so 2 words = 32 bits = 1 single-precision float.
5. Decode the two words into a REAL. Use the S7 little-endian layout described above, or apply a byte swap if the meter ships words in the opposite order (rare; Modbus is big-endian on the wire by spec, and the IEEE 754 high-word-first convention is the standard).
6. Verify against the meter's display. Force a known value on the meter (a calibration input of 100.0 is a good test point) and confirm the REAL in the S7 DB reads within single-precision LSB precision of 100.0 (LSB at 100.0 is approximately 7.6e-6).

Verification

Confirm the fix end-to-end with these three checks:

1. Hex check. Trigger MB_MASTER and read the first two words of the response. Decode the IEEE 754 single-precision value manually (or with a hex-to-float converter) and confirm the low and high words match the expected encoding of the meter's display value. For 16.343, expect 0xBE77 (low word in the S7 destination) and 0x4182 (high word).
2. Sweep test. Apply three calibration values spanning the meter's range (e.g., 0.0, 50.0, 100.0). Confirm the S7 REAL tracks each within one LSB. This catches both the addressing fix and any leftover byte-order issue in one pass.
3. Exception code check. With the corrected address, MB_MASTER.STATUS should return 0x0000 on success. Persistent 0x0002 means the meter does not expose the float at the address you are now sending; consult the vendor's full register map, not just the highlighted float row in the marketing brochure.

Cross-Platform Notes

The Modbus 0-based address rule applies to every master. The vendor-to-wire conversion is the only thing that changes.

Field Commissioning Checklist

Use this checklist on every new Modbus float integration to catch the off-by-one, byte-order, and quantity errors before they ship:

1. Confirm the meter manual's address convention (0-based vs 1-based, with or without function-code prefix).
2. Read register 0 first, regardless of whether the application needs it. This confirms the master is talking to the right slave and the convention is decoded correctly.
3. Read 2 words and decode the IEEE 754 hex manually before assigning the result to a REAL tag. A 30-second hex check prevents a 3-day debug.
4. Force a known value on the meter and verify the S7 REAL. Re-verify with a second and third value across the meter's range.
5. Record the exact MB_MASTER parameter set (start address, quantity, function code, data pointer) in the project documentation. Off-by-one errors always come back when the next engineer extends the project.
6. Monitor MB_MASTER.STATUS in the HMI or web server. A persistent 0x0002 is an addressing bug, not a wiring bug.

Troubleshooting Matrix

Edge Cases and Field-Proven Caveats

• Some meters, notably certain Chinese multifunction power meters and older Carlo Gavazzi units, document their floats at a 0-based address already. In that case, do not subtract 1. Read the meter specification literally and verify with a known calibration value before assuming the convention.
• If the meter has a configurable Modbus base address (PowerLogic PM5000, Schneider iEM3000, and some ABB M2M meters allow shifting the entire register map), confirm the live base address by reading register 0 (or whatever the vendor calls "Device Address") before assuming the float lives at the printed offset.
• For Modbus TCP over a managed Ethernet switch, do not enable IGMP snooping or broadcast suppression on the Modbus VLAN — many slaves do not respond to broadcast requests, and certain switches will silently drop unregistered multicast.
• Some meters expose the float as two separate 16-bit registers plus a third register containing a scaling factor (for example, a Modbus "Long" with explicit exponent register). Decode the scaling register and apply it to the integer pair rather than expecting a native IEEE 754 float.
• For S7-1500 / TIA Portal, the standard Modbus blocks are MB_CLIENT and MB_SERVER in the "MODBUS TCP" or "MODBUS RTU" instruction set. These expect 0-based addresses in MB_DATA_ADDR, consistent with the protocol spec. The S7-1500 Modbus RTU library and CP1542SP-1 IRC documentation is published on the Siemens Industry Online Support portal at support.industry.siemens.com.
• For CP341 / CP441 with the "MODBUS master" option, the MODB_341 and MODB_441 blocks use a 0-based address and a "data area" pointer. The CP341 Modbus master driver manual entry is available on the Siemens support portal under entry ID 27013598.
• Modbus TCP uses the exact same PDU as Modbus RTU; only the transport changes. The off-by-one and word-order rules above apply identically to TCP port 502. The Modbus Application Protocol V1.1b3 specification defines the 0-based address field for every function code, regardless of transport.

Frequently Asked Questions