Resolving Basler DECS-250 Modbus TCP Communication with S7-300

1. Problem Overview

Engineers integrating a Basler DECS-250 Digital Excitation Control System with a Siemens SIMATIC S7-300 CPU 315-2 PN/DP over Modbus TCP frequently encounter a class of faults that are subtle yet completely deterministic. The PLC establishes the TCP session, exchanges Modbus Application Data Units (ADUs) without exception, and yet the read data either returns zero, returns a stale value, or returns a value that is off by one register relative to the address printed in the DECS-250 Modbus map. Field cases with the DECS-250 and DECS-250N show this symptom on STEP 7 V5.5, V5.6, and V5.7 using FB ModbusPN and the Simatic Modbus TCP Wizard.

The root cause is rarely the TCP socket, the CPU firmware, or the Basler firmware. It is the convention mismatch between the protocol-level Modbus register number (1-based as transmitted on the wire) and the PLC data block address (0-based within the Simatic wizard). When FC03 (Read Holding Registers) or FC04 (Read Input Registers) is issued against a Basler parameter such as 41320 or 7259, the wizard input must be decremented by 1 to address the same physical register. The companion issue is byte/word swapping: the DECS-250 returns 16-bit Modbus registers that, when packed into a 32-bit floating-point telemetry such as generator current, must be reassembled in the correct word order inside the S7-300.

2. System Architecture and Prerequisites

2.1 Hardware Stack

2.2 Cabling and Addressing

• Assign a fixed IPv4 address to the DECS-250 (e.g., 192.168.10.50) with mask 255.255.255.0. The default after factory reset is usually 192.168.1.250, which can collide with the S7-300 default of 192.168.0.1 — change one of them before commissioning.
• Assign the CPU 315-2 PN/DP a static address in the same subnet (e.g., 192.168.10.10). Use the PN port (X2), not the DP/MPI port (X1).
• Confirm the DECS-250 Modbus TCP server is enabled and the Unit Identifier is set to 0xFF (or 0x01 depending on firmware) in BESTCOMS or BESTlogic+.
• Use port 502 unless the controller has been moved off the standard port for security reasons; in that case the wizard must be configured with the alternate port number.

2.3 Required Software Packages

• STEP 7 V5.6 with HSPs applied so the CPU 315-2 PN/DP is recognized in HW Config.
• Simatic Modbus TCP PN-CPU block library, typically installed as a separate DVD package ("Modbus/TCP PN-CPU V4.0" or newer). It contains the FB ModbusPN (FB1027 in some versions) and the wizard tool.
• Basler BESTCOMS-Pro or BESTCOMSPlus for DECS-250 parameter configuration. Registration is required to download the DECS-250 Instruction Manual.

3. Hardware Configuration in HW Config

The DECS-250 is a third-party Modbus TCP server, not a PROFINET device, so no GSD file is required. The S7-300 should not be configured with a DECS-250 slave in the PROFINET topology; the controller simply acts as a TCP client on the same physical network. The HW Config steps are limited to setting the PN interface properties.

1. Open SIMATIC Manager and load the station containing the CPU 315-2 PN/DP.
2. Open HW Config and double-click the PN-IO port of the CPU.
3. On the Properties > General tab, set the IPv4 address, subnet mask, and (optionally) a router address. Disable the "Use router" option if there is no L3 device in line.
4. Confirm that PROFINET is set to "IO device" mode for the CPU itself and that the port is connected to the same Ethernet subnet as the DECS-250.
5. Save and compile. Download the hardware configuration to the CPU. The CPU must be in STOP for the first download of HW Config.

No further slave insertion is required for Modbus TCP. The FB ModbusPN establishes the TCP connection from the user program using the local IP stack of the CPU's PN interface. There is no I/O data exchange to map in HW Config for a pure Modbus server.

4. Software Setup with the Simatic Modbus TCP Wizard

The wizard generates a DB (sometimes called the "parameter DB") that the FB ModbusPN reads at startup. The DB is the place where the off-by-one mistake most often occurs.

1. Launch the Simatic Modbus TCP wizard. It is normally installed as Start > SIMATIC > ModbusTCP > Modbus TCP Wizard.
2. Create a new connection. Enter the remote IP address of the DECS-250 (192.168.10.50) and the remote TSAP/port (0x01F6 for port 502, or 0x01 plus the lower byte of the custom port).
3. Enter the local TSAP for the CPU's PN interface, typically 01.00 or 01.01 depending on the slot configuration.
4. Select the Modbus role: the S7-300 is the Modbus TCP client (master), the DECS-250 is the server (slave). The wizard labels this "Modbus master" in older revisions.
5. For each request, define: function code (03, 04, 06, or 16), start register, length, and target DB / byte offset inside that DB.
6. Generate the FB call, the parameter DB, and the data DB. The wizard writes all three into the S7 program.
7. Download the blocks to the CPU and put the CPU in RUN.

5. The Off-by-One Register Mapping Fix

Modbus protocol defines register numbers as 1-based, and the master must place the address as transmitted in the Protocol Data Unit (PDU). Inside the Simatic wizard, the field that asks for the "start address" is a 0-based offset relative to register 1 of the slave. Therefore, to read Basler parameter 41320 you must enter 41319 in the wizard, not 41320. This is the single most common reason for a null result when the TCP handshake and FC04 response are otherwise valid.

The DECS-250 manual often shows the address as a 5-digit decimal that already includes the leading digit for the function group. The mapping is preserved across firmware revisions of the DECS-250. If a wizard request returns all zeros despite a successful TCP session, decrement the start address by 1 and re-test.

ModScan32, by default, displays addresses in the same 1-based convention used in DECS-250 documentation. That is why a Basler engineer could confirm the read with ModScan (entering 41320 directly) while the PLC failed (entering 41320 in the wizard instead of 41319). The two tools have different default base offsets.

6. Byte-Order and Endian Handling

After the register offset is fixed, the second fault class is word order inside multi-register floats. Basler DECS-250 documentation states that 32-bit IEEE-754 telemetry values are returned as two consecutive 16-bit Modbus registers, with the low word at the lower register and the high word at the higher register (little-endian word order). The S7-300 stores a REAL (32-bit float) in standard big-endian DWord format. When the wizard copies four bytes from the Modbus response into the destination data DB at a byte offset that is not a multiple of four, the resulting REAL is word-swapped and prints as a garbage magnitude such as 1.0E+09, a negative near-zero, or NaN.

Two safe solutions:

1. Byte/word swap inside the data DB. Use the S7 function TAW (swap words inside an accumulator word) and the standard library FC12 / FC14 to swap two 16-bit halves of a DWord before casting to REAL. Apply the swap before interpreting the value.
2. Re-map the target offset. Configure the wizard to write the 32-bit value starting at an even byte offset that aligns the low word at the low address. The S7-300 must place the bytes in the order expected by the CAST from DWORD to REAL.

A pragmatic field check: after reading parameter 7259 (generator current, typically a 32-bit float in amperes), compare the ModScan decimal value to the S7 value. If the ratio is exactly 65536 or the magnitude is wildly different, swap the two 16-bit halves. If both are still wrong by a small constant factor, the offset is still off by one and the read is returning adjacent register garbage.

7. Function Code Selection

Live measurements on the DECS-250 are exposed as Input Registers, so the S7-300 must issue FC04 to read them. Using FC03 against a parameter marked as Input Register causes the DECS-250 to return a Modbus exception code 0x02 (Illegal Data Address). The wizard will translate that into a non-zero STATUS word on the FB, with the low byte carrying the Modbus exception code.

8. Verification with ModSim and ModScan

Before trusting the S7 program, the recommended verification path isolates the PLC from the Basler device, then isolates the Basler device from the PLC. Two freeware tools cover both sides of the same Modbus TCP segment.

1. PLC side (ModSim32): Run ModSim32 on a PC sharing the subnet with the CPU. Configure ModSim32 as a Modbus TCP server on the same IP that the wizard uses for the DECS-250 (point the wizard at the ModSim PC temporarily). If the S7 program reads expected values from ModSim, the FB, the wizard DB, and the byte order are correct. The fault is on the DECS-250 side.
2. Field side (ModScan32): Run ModScan32 on a PC, connect to the DECS-250 IP, and read the same parameter at the same address. If ModScan returns the documented value, the DECS-250 is responding correctly. The fault is the offset, the function code, or the wizard configuration.

This two-stage isolation is the exact procedure that originally diagnosed the S7-300/DECS-250 case: ModSim was readable from the PLC (proving the wizard was correct), ModScan confirmed the DECS-250 was responding (proving the controller was correct), and the remaining variable was the offset in the wizard start address.

9. Common DECS-250 Parameter Mappings

The DECS-250 manual organizes parameters into functional groups. The group prefix digit in the address (e.g., the "4" in 41320 or the "7" in 7259) is part of the address itself, not a category. The most frequently read values in excitation applications are:

Always cross-check the address against the revision of the manual that matches the controller's firmware. The DECS-250N (negative forcing variant) follows the same Modbus map convention but has additional parameters in the higher address ranges.

10. Diagnostic and Troubleshooting Matrix

11. Step-by-Step Commissioning Procedure

1. Power the DECS-250, configure its IP address and Modbus TCP server enable in BESTCOMS, then reboot.
2. Connect a PC running ModScan32 to the same subnet. Read parameter 7259 with FC04, address 7259, length 2. Verify the returned float matches the front-panel display.
3. Configure the CPU 315-2 PN/DP IPv4 address in HW Config, download the hardware configuration.
4. Open the Simatic Modbus TCP wizard. Enter the DECS-250 IP and port 502. Add a request for parameter 7259 with FC04, start address 7258, length 2, target DB and even byte offset.
5. Generate the FB call, parameter DB, and data DB. Download to the CPU.
6. Run the CPU. Trigger the first read by setting the request enable bit. Observe STATUS in the parameter DB. A non-zero STATUS with low byte 0x00 indicates a successful read.
7. Add a word-swap FB if the 32-bit float is misaligned or byte-swapped. Verify the displayed amperage matches ModScan to within 0.1 A.
8. Repeat the procedure for all other parameters in the Modbus map. Document the address offset (always manual - 1) and the swap rule in the project comments.

12. Field-Proven Caveats

• Basler customer support is gated by product registration. Plan a 1-2 business day delay for first-time manual requests. The PDF manual is the only reliable source for the address map; the public web pages list product features but not register-level detail.
• The DECS-250 must be in Run (not Edit) mode for Modbus TCP to respond. While BESTCOMS is online editing, the controller will return exception 0x06 (Slave Device Busy) on most reads.
• The S7-300 PN interface has a finite number of open TCP connections (typically 16 for the Modbus TCP library). Closing unused connections in OB100 (cold restart) prevents resource exhaustion when the program cycles.
• For redundant DECS-250 applications, the FB ModbusPN supports a single partner per connection block. Use two parallel blocks (one per controller) and select based on a health flag derived from the connection STATUS.
• The off-by-one issue applies to any Modbus slave that exposes its 1-based protocol address in the manual. The DECS-250 is not unique in this regard; it is one of the most visible because the manual ships with 1-based addresses and the wizard expects 0-based.

FAQ