Integrating Schneider PM810 Modbus RTU Power Meters via an EGX300 Gateway to a Siemens S7-300 CPU and Bridging to S7-400 on the PCS7 Plant Bus

This reference covers the field-proven architecture used to land Schneider Electric PM810 Modbus RTU power meters on a Siemens S7-300 CPU through an EGX300 Ethernet gateway, and to forward the readings to an S7-400 AS station across the PCS7 Terminal Bus. The focus is on hardware selection between the integrated PN port of the CPU and a CP 343-1, the driver blocks required (2XV9450-1MB00 / 2XV9450-1MB02), commissioning steps, and the diagnostic checks that prove a clean integration before the OS clients begin polling for kW, kVA, kWh and power-factor values.

1. System Architecture Overview

The target topology, in plain network terms, looks like the block diagram below. RS-485 trunks are kept short (typically inside a switchgear lineup), and the long runs out to remote meter clusters are taken over fiber or wireless modems that terminate at the EGX300's serial port. From the EGX300, the data is wrapped in Modbus TCP frames and forwarded to the S7-300's PROFINET interface. The S7-300 is then a node on the PCS7 Terminal Bus SCALANCE ring along with the S7-400, the Engineering Station (ES) and the Operator Stations (OS).

The S7-300's role in this layout is twofold: it acts as the Modbus TCP client (or "master") polling the EGX300, and it acts as a data concentrator exposing the meter values to the S7-400 over the plant bus. Whether to keep the S7-300 at all, or to point the EGX300 directly at the CP 443-1, is a valid simplification when the CP firmware supports Modbus TCP, but in many greenfield projects the S7-300 station has already been mechanically installed and wired before the Modbus question is raised.

2. Modbus RTU vs Modbus TCP: Protocol Distinctions

Before commissioning the gateway, align the engineering team on three protocol facts that often get blurred in plant documentation:

The MBAP header (Modbus Application Protocol) in a TCP frame is 7 bytes:

The PM810 register map is published by Schneider Electric. The relevant holding registers for an energy dashboard are clustered around the 4000x range; for example, real-time measurements such as current, voltage and power-factor start at register 4000. Verify exact addresses against the latest PM810 user manual on the Schneider Electric website before coding the data block layout.

3. Hardware Selection: Integrated PN Port vs CP 343-1

Either interface can act as a Modbus TCP client when paired with the correct driver blocks. The decision is driven by traffic loading, redundancy, and the number of free PROFINET ports you have on the CPU for other devices (I/O, HMI, drives).

Field-proven recommendation. Use the CP 343-1 for the plant-bus connection (so the gateway and the S7-400 share the same SCALANCE without contention) and the integrated PN port for the I/O on the floor. Where only one Ethernet interface is available, place both the EGX300 and the plant bus SCALANCE on the same switch and configure VLANs to keep Modbus TCP traffic out of the PROFINET real-time class.

4. Schneider EGX300 Gateway Configuration

The EGX300 (part of Schneider's PowerLogic range) acts as a Modbus TCP server on its Ethernet side and a Modbus RTU master on its RS-485 side. By default it polls the downstream PM810s and caches the latest values, exposing them as standard Modbus TCP registers. The configuration tool is the EGX300 web interface; you set:

1. IP address, subnet mask, default gateway (must be reachable from the S7-300 interface that will poll it).
2. RS-485 baud rate and parity (PM810 default: 19200 bps, 8E1).
3. List of downstream meter addresses (1-247).
4. Polling interval (e.g., 1000 ms).
5. Optional: write a static route so the EGX300 is reachable on the plant bus if you decide to skip the S7-300 concentrator.

After configuration, validate the link independently of the PLC: use any Modbus TCP tester (such as mbpoll on Linux) to read holding register 0 of a known PM810. A successful read confirms the RS-485 trunk, the gateway's polling, and the Modbus TCP server side - so any later failure is definitely inside the S7-300 side.

# Example: mbpoll read of PM810 register 0 via EGX300
mbpoll -m tcp -a 1 -r 1 -t 4 -c 10 192.168.10.50
# -a 1   = Modbus slave 1 (PM810 address on RS-485)
# -r 1   = register 40001 (mbpoll is 1-based)
# -t 4   = holding register
# -c 10  = read 10 registers

5. S7-300 Modbus TCP Master Programming

Siemens publishes the Modbus/TCP PN-CPU block library and the Modbus/TCP CP block library. Both contain the same conceptual blocks: a client FB, a server FB, and helper FBs for connection management. Confirm the exact block numbers against the library you purchase:

The following skeleton (ST for an S7-300 in STEP 7 V5.5 or in the S7-300 target of TIA Portal) shows a typical client call. Adapt the instance DB names and connection IDs to your HWConfig.

// OB35 cyclic interrupt, 100 ms
// Connection to EGX300 (IP 192.168.10.50, Port 502, Unit ID 1)
CALL "MB_CLIENT" , DB100
   REQ        := TRUE                    // pulse to start a request
   ID         := 1                       // connection ID from TCON DB
   UNIT_ID    := 1                       // RTU slave address of PM810
   FUNC_CODE  := 3                       // 3 = read holding registers
   RD_START   := 0                       // start address (0-based)
   RD_AMOUNT  := 10                      // read 10 registers
   WRITE_COIL := FALSE
   WR_START   := 0
   WR_AMOUNT  := 0
   DATA_PTR   := P#DB200.DBX0.0 BYTE 20  // target data block
   BUSY       := MB_BUSY
   DONE       := MB_DONE_OK
   ERROR      := MB_ERR
   STATUS     := MB_STAT;

For each PM810, allocate a slice in DB200 (e.g., 20 bytes per meter) and assign a unique connection ID per TCP session. If you need to read more than one meter through the same EGX300, the EGX300 acts as a TCP server and you must use the Unit ID field (formerly the Modbus RTU slave address) inside the MBAP header to address the downstream meter. The driver library handles this transparently - you only set the UNIT_ID input.

6. S7-300 to S7-400 CPU-CPU Communication over Ethernet

The Profibus SEND/RECEIVE pattern the engineering team is familiar with has an exact Ethernet equivalent: ISO-on-TCP (RFC 1006) using the AG_SEND / AG_RECV blocks on the S7-300, or the more modern BSEND/BRCV / USEND/URCV pair on both sides. Setup in NetPro is identical in principle to Profibus: define a "S7 connection" or an "ISO-on-TCP connection" between the two CPUs.

For the S7-300 - S7-400 link on the PCS7 plant bus, the recommended pattern is:

1. Open a S7 connection from the S7-300 (CP 343-1 or PN port) to the S7-400 (CP 443-1) in NetPro. The S7-300 is the active end; the S7-400 is the passive end.
2. On the S7-300, pack the meter data into a DB (e.g., 4 kB buffer for 200 PM810s @ 20 bytes each).
3. Call BSEND in OB 35 on the S7-300, triggered by a "data ready" flag from the Modbus client.
4. On the S7-400, call BRCV in OB 1; copy received bytes into a PCS7-compliant DB that the OS faceplates will read.

// S7-300 side, send meter buffer to S7-400
CALL "BSEND" , DB300
   REQ        := SEND_REQ               // pulse
   R          := FALSE
   ID         := 2                      // S7 connection ID from NetPro
   R_ID       := DW#16#1                // raw ID, must match BRCV
   DONE       := SEND_DONE
   ERROR      := SEND_ERR
   STATUS     := SEND_STAT
   SD         := P#DB200.DBX0.0 BYTE 2000
   LEN        := METER_LEN;

The R_ID on both sides must match, the ID is the connection ID from NetPro, and the LEN must be exactly the number of bytes copied. A length of zero or a value larger than SD triggers STATUS 0x8085 ("Length parameter wrong").

7. PCS7 Plant Bus Integration Architecture

PCS7 separates the plant bus (engineering, OS, OS server, AS-AS communication) from the terminal bus. The Terminal Bus typically uses a SCALANCE X-200, X-300 or X-400 ring with redundancy protocols such as HRP or MRP. The CP 443-1 must be a model that supports plant-bus protocols: the 6GK7 443-1EX11-0XE1 used in this project is supported in PCS7 V8.x and later, but its firmware must be compatible with the Modbus TCP library if you also intend to use it as a Modbus TCP client in a future simplification. Always consult the Siemens Industry Online Support for the latest PCS7 compatibility matrix before substituting modules.

For the meter integration, the PCS7 OS faceplates are designed to read from the AS-side data blocks, so the path is:

The OS server polls the S7-400 (not the S7-300) by PCS7 convention. This is why the S7-300 - S7-400 BSEND/BRCV pair is essential even though it adds latency compared to a direct read. The latency budget is usually acceptable: a 100 ms OB 35 on the S7-300, plus a 200 ms plant-bus cycle, plus OS update of 1 s, still keeps the operator view below 2 s for any single meter change.

8. Configuration Verification & Diagnostics

Once the wiring and the STEP 7 program are loaded, run the following verification sequence. It is intentionally ordered from low-level (no PLC required) to high-level (OS faceplate updates).

Key STATUS codes from the Modbus TCP driver (2XV9450-1MB00 / 2XV9450-1MB02):

9. Troubleshooting Matrix

10. Spare-Part, Documentation and Driver Reference

Use the following official documents to verify part numbers, firmware and library versions for your specific PCS7 release. Always cross-check against the latest revision on the manufacturer's website before placing orders.

• Siemens S7 Modbus driver portal (CP and PN CPU libraries)
• Modbus TCP / RTU communication overview (Siemens SIMATIC documentation)
• ProSoft Technology Modbus & Modbus TCP protocol solutions (third-party reference for protocol gateway options)
• AutomationDirect MB-GATEWAY spec sheet (alternative single-port Modbus TCP/RTU gateway)
• Schneider Electric PM810 power meter product page
• Schneider Electric EGX300 Ethernet gateway - search under PowerLogic EGX series on se.com

Siemens part numbers used in this architecture:

11. Frequently Asked Questions