Reading LReal (64-bit Float) from Modbus RTU on S7-1200 in TIA

Reading LReal (64-bit Float) from Modbus RTU on S7-1200 in TIA Portal V13

The Siemens S7-1200 with firmware V4.0 and TIA Portal V13 supports Modbus RTU master and slave communication through the MB_MASTER / MB_SLAVE instructions. The DATA_PTR parameter of these blocks points to a data area in a global data block (DB). The block copies raw bytes from the Modbus message into that area or reads bytes from it for outgoing messages. Reading 16-bit Word or Int values is straightforward: each holding or input register maps to one Word element. Reading a 64-bit floating-point value (S7 LReal, IEEE 754 double precision) is significantly more complex because the value occupies four 16-bit Modbus registers (eight bytes), and the byte order transmitted by the slave rarely matches the byte order the S7-1200 stores internally.

This tutorial explains how to configure a non-optimized DB, map a Modbus slave register window into a byte array, and convert those eight bytes into a usable LReal value using SCL. It also covers the MB_CLIENT alternative introduced in S7-1200 firmware V4.1, the byte-order decisions that must be made, and the diagnostic steps to verify the conversion end-to-end.

1. Prerequisites

Confirm the S7-1200 program version. Open the project in TIA Portal, right-click the CPU, select "Properties", and read the firmware version on the "General" tab. Firmware V4.0 is the first release that supports the MB_MASTER block; V4.1 added MB_CLIENT for PROFINET-side Modbus TCP. For Modbus RTU, MB_MASTER is the right block across V4.0..V4.6.

2. How Modbus RTU Encodes a 64-bit Float

Modbus RTU is a register-oriented protocol. Each holding register is exactly 16 bits. The protocol has no native concept of a "float"; the master reads N consecutive registers using function code 03 (Read Holding Registers) or 04 (Read Input Registers) and interprets the resulting bytes as the slave documents.

For a 64-bit IEEE 754 double the layout is:

• Total bytes: 8 (64 bits).
• Total registers: 4 (5000, 5001, 5002, 5003 for the first value; 5004..5007 for the second).
• Encoding: 1 sign bit, 11 exponent bits, 52 mantissa bits (per IEEE 754-2008 binary64).
• Value range: approximately ±1.7977 × 10³⁰⁸ with ~15–17 significant decimal digits.

The IEEE 754 standard specifies big-endian byte order for the encoded value: byte 0 is the most-significant byte, byte 7 the least-significant. However, Modbus RTU itself transmits bytes in the order they appear in the PDU, and many slaves present registers in one of three common "endian" conventions:

You must determine which convention the slave uses before writing conversion code. There is no universal answer; the slave's manual is authoritative. If the manual is silent, treat it as Modicon (CDAB) and verify against a known value (see Section 9).

3. Create the Non-Optimized Target Data Block

The DATA_PTR input on MB_MASTER must point to a non-optimized DB (also called "standard" or "non-symbolic" access). Optimized DBs do not guarantee a fixed memory layout; the compiler can reorder and pad members, so a byte array declared in an optimized DB is not guaranteed to receive bytes at the offsets the block expects.

1. In the project tree, right-click "Program blocks" and choose "Add new block" → "Data block".
2. Name it DB_ModbusRx. Click OK.
3. Open the DB and disable the "Optimized block access" checkbox in the DB properties (right-click the DB title → Properties → Attributes).
4. Declare a single member at the start of the DB:

   DATA  : Array[0..15] of Byte;   // 16 bytes cover registers 5000..5007 (two 64-bit values)
   END_STRUCT;

5. Compile the block. The byte offsets are now fixed: DB_ModbusRx.DATA[0] = byte at register 5000 high; DATA[7] = byte at register 5003 low; DATA[8..15] = bytes of the second LReal.

You may also add a separate DB_ModbusTx for write requests with the same byte-array layout, and additional DBs to hold the decoded LReal values. The decoded DB can be optimized; it only receives the converted result.

4. Configure the MB_MASTER Instruction

Drag "MB_MASTER" from the "Communication → Modbus (RTU)" palette into OB1. The instruction appears as a multi-instance block. Declare an instance DB or let TIA Portal create one automatically.

Wire the inputs as follows for a single 4-register read:

The block places eight bytes into DB_ModbusRx.DATA[0..7] on a successful read. It places the next four registers (5004..5007) into DATA[8..15] only if you read eight registers in one request (DATA_LEN = 8). For sequential polling, drive REQ with a rising edge from a clock bit that runs slower than the expected response time (typical 50–200 ms for RTU at 9600–19200 baud).

5. Decide the Byte Order

Before writing SCL, inspect the raw bytes of a known value. A practical workflow:

1. Set the slave to output a known value, e.g. 0.123 as the first LReal.
2. Run the S7-1200 program and force DB_ModbusRx into the watch table.
3. Format the first eight bytes in hex.
4. Compare the byte sequence with the IEEE 754 encoding of the expected value.

The IEEE 754 binary64 encoding of 0.123 is 0x3FBF7CED916872B0. In big-endian byte order, the eight bytes are:

Whichever row matches your captured hex defines the conversion your SCL code must perform. For Modicon (CDAB), the S7-1200 receives bytes in the order 72, B0, 68, 91, ED, 7C, BF, 3F and must reassemble them into 3F BF 7C ED 91 68 72 B0 before reinterpreting as LReal.

6. SCL Conversion Code

Create an SCL source file and add a function block (e.g. FB_LRealConvert) that runs whenever DONE of MB_MASTER rises. The block reorders bytes using the AT overlay view and copies the result into a typed LReal variable.

FUNCTION_BLOCK "FB_LRealConvert"
{ S7_Optimized_Access := 'FALSE' }
VAR
    bModiconSwap    : Bool := TRUE;    // set FALSE if slave is true big-endian
END_VAR
VAR_TEMP
    tByte0, tByte1, tByte2, tByte3,
    tByte4, tByte5, tByte6, tByte7 : Byte;
END_VAR
BEGIN
    // First LReal: bytes 0..7 of the read buffer
    IF "DB_ModbusRx".DATA[0] = 0 AND "DB_ModbusRx".DATA[1] = 0
       AND "DB_ModbusRx".DATA[2] = 0 AND "DB_ModbusRx".DATA[3] = 0
       AND "DB_ModbusRx".DATA[4] = 0 AND "DB_ModbusRx".DATA[5] = 0
       AND "DB_ModbusRx".DATA[6] = 0 AND "DB_ModbusRx".DATA[7] = 0
    THEN
        "DB_Decoded".Value1 := 0.0;
    ELSE
        IF bModiconSwap THEN
            // CDAB: most-significant word last
            tByte0 := "DB_ModbusRx".DATA[6];
            tByte1 := "DB_ModbusRx".DATA[7];
            tByte2 := "DB_ModbusRx".DATA[4];
            tByte3 := "DB_ModbusRx".DATA[5];
            tByte4 := "DB_ModbusRx".DATA[2];
            tByte5 := "DB_ModbusRx".DATA[3];
            tByte6 := "DB_ModbusRx".DATA[0];
            tByte7 := "DB_ModbusRx".DATA[1];
        ELSE
            // AB CD EF GH: true big-endian, no swap needed
            tByte0 := "DB_ModbusRx".DATA[0];
            tByte1 := "DB_ModbusRx".DATA[1];
            tByte2 := "DB_ModbusRx".DATA[2];
            tByte3 := "DB_ModbusRx".DATA[3];
            tByte4 := "DB_ModbusRx".DATA[4];
            tByte5 := "DB_ModbusRx".DATA[5];
            tByte6 := "DB_ModbusRx".DATA[6];
            tByte7 := "DB_ModbusRx".DATA[7];
        END_IF;

        "DB_Decoded".Value1 := DWORD_TO_LREAL(0) // placeholder; replaced below
                             ;
    END_IF;

    // Reinterpret the eight bytes as LReal using an AT overlay
    // The cleanest approach: a temp DWORD array + the LReal overlay
    // -- implementation in Section 7 --
END_FUNCTION_BLOCK

The example above is illustrative; the cleanest production code uses an AT overlay on a DWord array to make the byte-to-double conversion explicit and vendor-independent. See Section 7.

7. Clean AT-Overlay Implementation

An AT overlay lets the compiler treat eight consecutive bytes as a LReal without copying or shifting. Declare it inside the VAR_TEMP section of an SCL block:

FUNCTION_BLOCK "FB_LRealConvert"
{ S7_Optimized_Access := 'FALSE' }
VAR CONST
    cSwapWords : Bool := TRUE;   // TRUE = Modicon CDAB, FALSE = big-endian
END_VAR
VAR
    DoneTrig : Bool;
END_VAR
VAR_TEMP
    aRaw : Array[0..7] of Byte;
    aReordered : Array[0..7] of Byte;
    dwPair0 : DWord AT aReordered[0] : ARRAY[0..1] OF DWORD;
    rResult : LReal AT dwPair0[0];
    iWord   : Int;
END_VAR
BEGIN
    // Copy raw bytes into reorder buffer
    aRaw[0] := "DB_ModbusRx".DATA[0];
    aRaw[1] := "DB_ModbusRx".DATA[1];
    aRaw[2] := "DB_ModbusRx".DATA[2];
    aRaw[3] := "DB_ModbusRx".DATA[3];
    aRaw[4] := "DB_ModbusRx".DATA[4];
    aRaw[5] := "DB_ModbusRx".DATA[5];
    aRaw[6] := "DB_ModbusRx".DATA[6];
    aRaw[7] := "DB_ModbusRx".DATA[7];

    IF cSwapWords THEN
        // CDAB: words are reversed: 2,3,0,1 then 6,7,4,5
        aReordered[0] := aRaw[2];
        aReordered[1] := aRaw[3];
        aReordered[2] := aRaw[0];
        aReordered[3] := aRaw[1];
        aReordered[4] := aRaw[6];
        aReordered[5] := aRaw[7];
        aReordered[6] := aRaw[4];
        aReordered[7] := aRaw[5];
    ELSE
        // Big-endian: no swap
        FOR iWord := 0 TO 7 DO
            aReordered[iWord] := aRaw[iWord];
        END_FOR;
    END_IF;

    "DB_Decoded".Value1 := rResult;

    // Repeat for the second LReal using a separate AT overlay
    // that starts at aReordered[8] of a longer temp array if you need both values
END_FUNCTION_BLOCK

The AT declaration on aReordered tells the compiler to map the same eight bytes as a 64-bit float. The CPU performs a single load instruction; no byte-level shifting is required at runtime, which makes the block both compact and deterministic.

8. Alternative: MB_CLIENT for S7-1200 Firmware V4.1+

If the project is on a PROFINET network and the Modbus device is reachable as a Modbus TCP gateway, firmware V4.1 introduces the MB_CLIENT block. MB_CLIENT supports the same data types and adds typed access modes including REAL and LREAL via the DATA_PTR variant. The conversion flow above is still required for RTU; for TCP, you can use MB_CLIENT with a typed pointer and skip the byte-reorder code when the gateway already presents registers in big-endian order.

For S7-1200 V4.0 projects that must use RTU, MB_MASTER remains the only option. There is no firmware upgrade path to add MB_CLIENT RTU; if the design later needs Modbus RTU on a newer CPU, the conversion code in this article is portable as-is.

9. Verification

Validate the conversion end-to-end before commissioning:

1. Force the slave to output a known constant (e.g. 1.0, 0.0, -1.0). The IEEE 754 binary64 encoding of 1.0 is 0x3FF0000000000000; of -1.0 is 0xBFF0000000000000.
2. Trigger a single read and watch DB_ModbusRx.DATA[0..7] in hex.
3. Compare each captured byte against the IEEE 754 byte sequence for the expected value, in the convention the slave documents.
4. Verify DB_Decoded.Value1 in the watch table matches the expected floating-point value to full LReal precision (15 digits).
5. Repeat with a negative value to confirm sign-bit handling.
6. Repeat with a small value (e.g. 0.123) to confirm mantissa and exponent handling.
7. Verify the second value (DB_Decoded.Value2) after reading eight registers in one request.

Document the result in a commissioning sheet. Capture the hex bytes the slave returns for each known value and the resulting LReal; the sheet becomes the reference when integrating additional slaves of the same model.

10. Troubleshooting Matrix

For the complete list of MB_MASTER status codes, refer to the TIA Portal online help under "MB_MASTER: Status parameter". Common codes are also documented in the S7-1200 System Manual, section on Modbus RTU instructions.

11. Common Patterns and Caveats

• Polling cadence. Drive REQ with a clock bit at least 50 ms wide and at least one Modbus frame time apart. At 9600 baud, 8N2, 8 bytes of payload, one frame is roughly 25 ms. Add 5–10 ms of margin for slave processing.
• Single transaction vs. multiple. Reading both LReal values in a single 8-register read is faster (one round trip) and produces a coherent snapshot. Two separate 4-register reads can return mismatched values if the slave updates between them.
• Atomicity. The decoded LReal assignment is atomic on the S7-1200 because LReal is a native 64-bit type. The temporary buffer copy is not atomic; do not call the conversion block from multiple OBs at different priorities without enabling REA/WR protection.
• Optimized DB constraint. DATA_PTR requires non-optimized access. The decoded DB can be optimized; only the buffer DB must be standard.
• Endian documentation. A slave manual that says "IEEE 754 64-bit float" is ambiguous. It may mean big-endian (the IEEE 754 default) or it may mean the local Modicon order. Confirm with a register-level example in the manual.
• NaN and Inf. If the slave can return NaN or ±Inf, the SCL conversion still produces a valid LReal. Filter them in user code if downstream logic (HMI display, write-back to another device) cannot handle them.
• Endian swapping libraries. TIA Portal V15+ includes the "Swap" extended instructions (SWAP_DWORD, SWAP_LWORD) under "Extended instructions → String + Char". On V13, write the byte reorder manually as in Section 7.

12. References and Standards

• Siemens S7-1200 Programmable Controller System Manual (entry ID 109751516) — chapter on "Modbus RTU communication" covers MB_MASTER and MB_SLAVE parameter definitions and status codes.
• S7-1200 CM 1241 communication module manual (entry ID 58523220) — pin-out, supported baud rates, configuration of the serial port in TIA Portal.
• Modbus Application Protocol V1.1b3 (Modbus Organization, 2012) — function codes 03/04/16/23, PDU layout, exception responses.
• IEEE Std 754-2019 — Floating-Point Arithmetic — binary64 (double precision) layout, encoding of special values.
• Chipkin — How Real (Floating Point) and 32-bit Data is Encoded in Modbus RTU Messages — practical reference on byte order and scaling factors for 32-bit values, applicable pattern for 64-bit.

Frequently Asked Questions