Reading REAL Values from S7-400H DB via Modbus TCP/IP CP 443-1

When a Siemens S7-400H (H-System) is the Modbus TCP/IP server, an external client (SCADA, HMI, OPC UA gateway, or third-party PLC) can only read 16-bit holding registers. A 32-bit REAL value in a Data Block does not map to one Modbus register - it must be split into two consecutive 16-bit words, transmitted, and reassembled in the application layer. This article documents the exact wire format, the CP 443-1 Modbus configuration, the word-order pitfall that causes every wrong-value symptom in the field, and the STEP 7 STL swap block that resolves it.

1. Why Modbus Cannot Carry a REAL Directly

Modbus is fundamentally a 16-bit protocol. The original Modicon specification (1979) and the modern Modbus Application Protocol V1.1b3 define four data primitives:

• Coil (1 bit, read/write)
• Discrete Input (1 bit, read-only)
• Holding Register (16 bits, read/write)
• Input Register (16 bits, read-only)

Function codes FC 03 (Read Holding Registers), FC 04 (Read Input Registers), FC 06 (Write Single Register), FC 16 (Write Multiple Registers), and FC 23 (Read/Write Multiple Registers) all transport 16-bit words. A 32-bit IEEE 754 single-precision REAL therefore occupies exactly two consecutive Modbus registers, and a 64-bit LREAL occupies four.

This is the source of every "I read 0.0" or "I read garbage" symptom. The PLC stores the REAL correctly in the DB; the CP transmits the two halves correctly; but the client interprets the two halves in the wrong order, or treats them as separate INT values.

2. IEEE 754 Single-Precision (32-bit) Format

The S7-400H REAL data type is an IEEE 754 single-precision float. The IEEE Std 754-2008 layout is:

Example reference values for field verification:

When the S7-400H stores a REAL at DB100.DBD4, the four bytes are laid out in little-endian byte order in physical memory. In the Modbus holding register space, this becomes:

• Modbus register N = bytes 0-1 (low-address) = low 16 bits of the REAL
• Modbus register N+1 = bytes 2-3 (high-address) = high 16 bits of the REAL

3. S7-400H Hardware, CP 443-1, and Required Firmware

The S7-400H redundant system (per the Siemens S7-400H Automation System Manual) uses CPUs such as CPU 412-3H, CPU 414-4H, CPU 416-4H, and CPU 417-4H on an SIMATIC UR2-H rack. Modbus TCP/IP server functionality is provided by the CP 443-1 Communication Processor, not the CPU itself.

Verified CP 443-1 part numbers supporting the Modbus/TCP server option:

Older CP 443-1 EX20/GX20 modules do not support the Modbus TCP/IP server option and cannot be used for this application. Confirm the firmware version of the installed CP in STEP 7 under PLC → Module Information before commissioning.

The Modbus/TCP server functionality is delivered via the Siemens HSP (Hardware Support Package) "Modbus/TCP PN-CPU" or "Modbus/TCP CP" depending on STEP 7 version. Install the HSP in STEP 7 V5.5 SP4 or later (or the equivalent package in TIA Portal V14+). The HSP adds the partner type "Modbus TCP server" to NetPro and the corresponding configuration dialogs.

4. Word Order: The Root Cause of Wrong REAL Readings

Three word-order conventions are seen in production Modbus TCP/IP deployments:

1. Low word first (Siemens CP 443-1 default, Modicon TSX ETY): register N = low 16 bits, register N+1 = high 16 bits. Byte order within each register is big-endian (network byte order) for the wire.
2. High word first (some Modicon Unity PRO mappings, some SCADA drivers): register N = high 16 bits, register N+1 = low 16 bits.
3. Byte-swapped within word (rare, some Asian vendors): the bytes inside each 16-bit register are reversed on the wire.

When the client expects convention (2) but the S7-400H CP 443-1 sends convention (1), the decoded IEEE 754 value is:

• Zero, Inf, or NaN for most values, because the exponent field (which carries the magnitude information) is replaced by the mantissa and vice versa.
• Sign flip for some values, because the sign bit moves from bit 31 to bit 15 (interpreted as a negative INT or as part of the mantissa).
• Wildly wrong magnitude, often 2^16 or 2^-16 of the correct value.

5. Data Block to Modbus Register Mapping

Configure the CP 443-1 Modbus server in NetPro to map a contiguous range of the S7-400H memory (DB or Merker/Prozessabbild) to Modbus Holding Registers. The default starting address is 40001 (function code 3 offset 0). Example mapping for a 4-channel pressure / temperature block:

The CP 443-1 transmits Word 0 first (low word of the REAL) and Word 1 second (high word) for the default Siemens Modbus mapping. If the SCADA or third-party client expects high word first, swap the words on either side as described in sections 8 and 9.

6. Configuring the CP 443-1 Modbus TCP/IP Server

1. Open the S7 project in STEP 7 V5.5 (or TIA Portal with the appropriate HSP).
2. Open NetPro and right-click the CP 443-1 in the rack.
3. Select Insert New Connection → partner type Modbus TCP server.
4. Assign the CP IP address (e.g., 192.168.0.10) and TCP port 502 (default Modbus port).
5. Open the CP's Properties → Modbus configuration dialog.
6. Define the data area: starting address in the DB (e.g., DB100, byte 0), length in bytes, mapping to Modbus holding register base 40001.
7. Set the byte/word order to Low word first (default) or High word first depending on the client expectation.
8. Compile and download the configuration to the CP 443-1 (a full download may be required to activate the Modbus task).
9. Cycle power on the CP if the firmware/HSP option is being activated for the first time.

7. Reading REAL: Step-by-Step Procedure

7.1 Prerequisites

• S7-400H with CPU 41x-4H, firmware V6.0 or later
• CP 443-1 EX30/GX30 with firmware V3.0 or later
• STEP 7 V5.5 SP4 (or TIA Portal equivalent) with Modbus/TCP HSP installed
• Target Data Block (DB) compiled and downloaded to the S7-400H
• Any conformant Modbus TCP/IP client (CAS Modbus Scanner, Modbus Poll, openMUC, libmodbus-based app, or another PLC)

7.2 Create the Data Block

In STEP 7, create DB100 with the following structure (Symbol Table or absolute addresses):

DATA_BLOCK DB100
STRUCT
   Pressure     : REAL;    // 4 bytes, DBD0-DBD3
   Temperature  : REAL;    // 4 bytes, DBD4-DBD7
   Setpoint     : REAL;    // 4 bytes, DBD8-DBD11
   Status       : WORD;    // 2 bytes, DBW12
   ErrorCode    : INT;     // 2 bytes, DBW14
END_STRUCT
END_DATA_BLOCK

7.3 Configure CP 443-1 Modbus Mapping

Map DB100 byte 0 onward to Modbus holding register 40001 with the byte/word order matching the client.

7.4 Verify with a Modbus Master Tool

Use a Modbus TCP master to read 2 registers starting at register 1 (the REAL at DB100.DBD2 = Pressure):

MBAP Header: TxID=0001, ProtoID=0000, Length=0006, UnitID=01
PDU:         Function=03, StartHi=00, StartLo=01, QtyHi=00, QtyLo=02
Expected PDU response: 01 03 04 [B0 B1 B2 B3] [CRC CRC]

Capture the four response bytes and decode manually:

• If 123.45 is the value in the DB, expected hex (little-endian word) is E6 66 42 F6 on the wire (4 bytes returned by FC 03 as a single 4-byte data block per the spec, but each pair of bytes is a Modbus register).
• Reassemble: low word = 0x66E6, high word = 0xF642. Combined 32-bit = 0xF64266E6, which in IEEE 754 = 123.45 (verify with floating-point calculator).

7.5 Implement Word-Swap on the Server Side (STEP 7 STL)

If the client expects high word first, swap the words inside the S7-400H program before the CP reads them. Add a separate "shadow DB" that holds the swapped copy:

// OB1 cycle - swap REAL values for client readability
// Assume DB100 contains native REAL, DB200 contains swapped copy

      L     DB100.DBD    0       // Load Pressure (native low-word-first)
      T     DB200.DBD    0
      TAW                      // Swap bytes within low word (Siemens TAW swaps bytes, not words)

      L     DB100.DBD    4       // Load Temperature
      T     DB200.DBD    4
      TAW

// For FULL word swap (low word <-> high word), use:
      L     DB100.DBW    0       // Low word of Pressure
      T     DB200.DBW    2       // High word of swapped copy
      L     DB100.DBW    2       // High word of Pressure
      T     DB200.DBW    0       // Low word of swapped copy

7.6 Implement Word-Swap on the Client Side

If the client is a C/C++ application using libmodbus or a similar library:

// C code - reconstruct REAL from two Modbus holding registers
// Assuming little-endian host (x86, ARM Cortex, etc.)
#include <stdint.h>
#include <string.h>

float modbus_read_real(uint16_t reg_lo, uint16_t reg_hi) {
    // Default Siemens CP 443-1: reg_lo is the low 16 bits of the REAL
    uint32_t combined = ((uint32_t)reg_hi << 16) | reg_lo;
    float value;
    memcpy(&value, &combined, sizeof(float));
    return value;
}

float modbus_read_real_swap(uint16_t reg_lo, uint16_t reg_hi) {
    // For clients expecting high word first
    uint32_t combined = ((uint32_t)reg_lo << 16) | reg_hi;
    float value;
    memcpy(&value, &combined, sizeof(float));
    return value;
}

On a Modicon client (Unity PRO / EcoStruxure Control Expert), use the following Structured Text:

// Read 2 words from S7-400H CP 443-1 via Unity Modbus master
arrWords[0] := READ_HOLDING_REGISTERS(Slot := 0, Addr := 1, Qty := 2);
arrWords[1] := READ_HOLDING_REGISTERS(Slot := 0, Addr := 2, Qty := 1);

// If high-word-first expected:
arrSwapped[0] := arrWords[1];
arrSwapped[1] := arrWords[0];

rPressure := REAL_FROM_WORDS(arrSwapped[0], arrSwapped[1]);

8. Verification Procedure

1. Force a known REAL value in the S7-400H DB using a VAT (Variable Table) in STEP 7: e.g., DB100.DBD0 = 123.45 (use the float entry in the VAT, not a hex value).
2. Connect the Modbus master to the CP 443-1 IP and port 502.
3. Issue FC 03 with starting register 1 and quantity 2.
4. Capture the raw 4-byte response and verify hex against the IEEE 754 reference table in section 2.
5. Confirm the client's decoded float matches 123.45 within 0.001.
6. Test with 0.0, -1.0, 1.0, and a value near +Inf boundary (e.g., 1.0E+38) to verify sign and exponent handling.
7. Test with at least one negative REAL to verify the sign bit is at bit 31 of the reassembled 32-bit value, not bit 15.

9. Troubleshooting Matrix

10. IEEE 754 Edge Cases in Modbus Transports

Some REAL values round-trip incorrectly through 16-bit Modbus registers when one of the two words is dropped, masked, or out of order. The following edge cases should be explicitly tested in commissioning:

• 0.0 (0x00000000): all bits zero. Reads correctly through any byte or word order, so a zero value is not a good test for word order.
• -0.0 (0x80000000): sign bit set, all others zero. Reads correctly only if the sign bit ends up in bit 31 after reassembly.
• +Inf (0x7F800000) and -Inf (0xFF800000): if the words are swapped, these become NaN (0x7F80xxxx or 0xFF80xxxx with non-zero mantissa), which most clients display as an error or zero.
• NaN (any 0x7Fxxxxxx with mantissa != 0): bit pattern changes non-deterministically under word swap; a stable NaN cannot be guaranteed across the wire.
• Denormals (exponent = 0, mantissa != 0): the smallest non-zero REALs. If either 16-bit word is misread as zero, the value collapses to 0.0.

Always validate the installation with a non-zero, non-Infinity, non-NaN test value (for example, 123.45) before declaring the Modbus path operational.

11. Function Code Reference for REAL Traffic

12. S7-400H Redundancy Considerations

Because the S7-400H is a hot-standby system with two CPUs running in parallel, the DB area mapped to the CP 443-1 must be part of the synchronized data. Siemens documentation specifies that DBs in the "non-synchronized" or "CPU-local" area are not guaranteed to be consistent across a failover. If the CP is wired to the primary rack only, it will lose connection for the duration of the switchover (typically < 100 ms). If the CP is wired to both racks (redundant CP configuration), the Modbus client should see no interruption provided the keep-alive timeout is longer than the switchover time.

Recommendations:

• Map only synchronized DBs to the Modbus server.
• Configure both CPs in redundant mode if 100% Modbus availability is required.
• Set client TCP keep-alive to at least 1000 ms to absorb a single switchover.
• Use Modbus function code 03 (read-only) for control-critical process values to avoid split-brain writes during failover.