Resolving S7-1200 CB 1241 Modbus RTU Smart Meter Serial Number Read Errors

The combination of a Siemens SIMATIC S7-1200 CPU, the CM 1241 / CB 1241 RS485 communication module, and the Modbus RTU library instruction MB_MASTER (also available as Modbus_Master in some TIA Portal library revisions) is one of the most widely deployed Modbus RTU master configurations in industrial metering applications. When a PLC successfully reads instantaneous voltage, current, energy, and power values from a multi-function smart meter but returns zero, garbage, or no data when reading the device's serial number, the failure is almost never physical. The cause is systematic and is rooted in three recurring engineering mistakes: incorrect Modbus address mapping, an inappropriate PLC data type for the value, and inadequate interpretation of MB_MASTER status output. This reference provides a structured diagnostic path and a verified fix for the failure pattern in which all but the serial number register read correctly.

1. Problem Statement

A typical configuration is as follows:

• CPU: SIMATIC S7-1200 (any firmware variant supporting Modbus RTU, typically V3.0 and later; current mainstream CPUs are V4.4 / V4.5 / V4.6).
• Communication module: CB 1241 (RS485 half-duplex) with order number 6ES7241-1CH30-1XB0 (current revision) or 6ES7241-1CH30-0XB0 (legacy). The electrically related CM 1241 (RS485) module 6ES7241-1CH32-1XB0 is also affected by the same library behavior.
• Smart meter: a multi-function energy meter exposing instantaneous measurements, energy registers, and a serial number over Modbus RTU.
• Software: TIA Portal V14 or later with the "MODBUS (RTU) Master" or "PtP/Modbus Communication" library installed.

Observed behavior:

• Measurements such as voltage, current, active power, reactive power, frequency, and total energy read without issue.
• Serial number read returns all zeros, all Fs, or static values that never update.
• No MB_MASTER error flag is raised: DONE becomes TRUE, ERROR stays FALSE, but the destination buffer remains unchanged or contains invalid data.
• Subsequent Modbus requests on the same instance continue to work, ruling out bus contention, termination, or baud-rate mismatch.

Any one of these symptoms is sufficient to invoke the diagnostic flow described in this article.

2. System Architecture

The RS485 bus carries a single twisted pair (A and B) terminated at both ends with 120 Ω resistors (only the two physical ends should be terminated; intermediate drops must not have termination). The CB 1241 is wired according to Siemens wiring diagram:

• Pin 8: RS485-A (D+)
• Pin 9: RS485-B (D-)
• Pin 6: shield ground (one end only, typically at the PLC cabinet ground bar)

The CB 1241 is configured in the device configuration for the following protocol stack:

• Protocol selection: MODBUS master (RTU) or PtP communication with a MODBUS_RTU instruction overlay.
• Baud rate: 9600 bps (most common) up to 115200 bps supported.
• Parity: Even (Modbus standard) or None with 2 stop bits.
• Data bits: 8 (fixed for RTU mode).
• Stop bits: 1 with even/odd parity, 2 with no parity.
• Flow control: None (RS485 half-duplex).

3. Root Cause Analysis

The serial number read failure described in the source thread is caused by a combination of three issues, in order of frequency:

3.1 Wrong Modbus address (most common)

Smart-meter datasheets almost universally label Modbus addresses using the 5-digit Modicon convention where the leading digit indicates the register type and the remaining digits indicate the address offset. The mapping is:

The CB 1241 firmware and TIA Portal V14+ Modbus_RTU library implement the 1-based convention: register 40001 is DATA_ADDR = 0 for a "1-based" call type, while register 40042 is DATA_ADDR = 42 in the same convention. The MODE input on the instruction selects the function code (0 = read holding registers, 1 = write, 3 = read/write, etc.).

When the smart meter datasheet prints the serial number as 40042 and 40044, the engineer must confirm whether the device expects the leading 4 to be stripped (giving register 42 and 44 zero-based) or used as a category prefix (giving register 42 and 44 one-based). For a Siemens MB_MASTER call configured for "1-based addressing" (the default in TIA Portal V14+ with MB_MASTER), the value to load into DATA_ADDR is 42 (or 16#002A) and 44 (or 16#002C), exactly as the discussion contributor Scorp identified.

3.2 Wrong data type (the "REAL trap")

Serial numbers are virtually never stored as IEEE-754 floating-point values in any commercially produced smart meter, energy meter, or sensor. Across a survey of common meters (Schneider PM5xxx, ABB M2M, Acrel ADL series, Carlo Gavazzi EM, Selec MFM, and Eastron SDM630), the serial number is encoded as one of the following:

• 32-bit unsigned integer (UDINT/DWORD) across two consecutive 16-bit Modbus holding registers: high word first then low word. This is the most common format.
• 32-bit signed integer (DINT) across two consecutive registers, used when the serial number could legitimately be negative (rare but observed in legacy modems).
• 8 × 16-bit ASCII registers, each holding one printable character of the serial string ("SN-123456" → registers hold 0x53, 0x4E, 0x2D, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36).
• BCD encoding across several registers, used in older electromechanical-equivalent devices.

If the destination tag in the PLC data block is declared as REAL, the bytes returned from two consecutive 16-bit registers will be reinterpreted as an IEEE-754 single-precision float, which very rarely produces a non-NaN finite value. The visible symptom is "all zeros" because most serial numbers have a low mantissa structure that round-trips to a small float, or the REAL tag reads 0.0 if either register returns the documented 0xFFFF-style invalid marker.

3.3 Single-call, multi-EN race condition

The source thread also shows the user driving multiple MB_MASTER calls in the same scan through a single instance background data block (DB4) with a counter. Because the MB_MASTER instruction is edge-triggered on REQ and its internal state machine spans multiple PLC cycles, firing more than one transaction on a single instance within the same cycle is illegal and will corrupt the state. The standard Siemens pattern is one instance per logical transaction (or per slave device), and at most one REQ pulse per cycle. This is unrelated to the serial-number issue specifically, but frequently coexists with it and confuses the diagnosis.

4. Modbus Address Mapping Reference

The following compact table captures the conversion the engineer performs in their head when reading a meter datasheet. The right-most column is the value typed into MB_MASTER.DATA_ADDR on the S7-1200 with the TIA Portal V14+ library:

If the smart meter is old or non-standard and lists register addresses beginning at 1, the offset is one less than the printed number. If the datasheet explicitly states "Modbus register 0 = address 0", use the printed value as-is. In all other cases, the conversion rule is: subtract 1 from the printed 5-digit address.

5. Smart Meter Serial Number Encoding

Three real-world serial number encodings are common, with concrete worked examples below.

5.1 Encoding A: 32-bit unsigned across two registers (most common)

Datasheet excerpt:

• Register 0x002A (dec 42): Serial number high word
• Register 0x002B (dec 43): Serial number low word
• Data type: UINT32, big-endian

If the meter returns 0x0001 in register 42 and 0x86A0 in register 43, the serial number is 0x000186A0 = 100000 decimal. The destination MB_MASTER.DATA_LEN must be 2, and the DATA_PTR must point to a tag at least 4 bytes long. A DWORD tag in the DB will then show 16#000186A0 (or 16#A0860100 if a byte-swap is required and not applied).

5.2 Encoding B: ASCII across 8 registers

Datasheet excerpt:

• Registers 0x00C8 to 0x00CF (dec 200 to 207): Serial number, 16 characters ASCII, two per register, big-endian

Read length is 8. The destination tag should be a byte array of length 16 (ARRAY[0..15] of BYTE) in the destination DB. After reading, copy the array into a 16-character STRING[16] tag. The mapping is register[i] high byte = char[2i], low byte = char[2i+1] in big-endian meters, reversed in little-endian devices.

5.3 Encoding C: 64-bit (eight registers)

Some meters (Acrel ADL300, Schneider PM8000) use a 64-bit serial number across four 16-bit register pairs (8 registers total) or across 8 individual registers with a BCD digit per register (one BCD byte per register). The DATA_LEN must be 8 and the destination tag must be 16 bytes (two DWORDs, a LWORD, or an 8-element WORD array).

6. MB_MASTER Parameter Configuration

The MB_MASTER (legacy) or Modbus_Master (current TIA Portal library) instruction in the S7-1200 accepts the following parameters. Set them according to the meter datasheet and the encoding chosen in section 5.

The instance DB (often DB4 in the source thread) must be at least the size required by the largest DATA_PTR target. Siemens allocates a fixed instance footprint per MB_MASTER call; the tag buffer is taken from the destination data block, not from the instance DB.

7. Diagnostic Procedure

Follow the steps below in order before changing any code. Each step produces a verifiable result and is reversible.

1. Confirm the smart meter datasheet's register table for the serial number: address range, register count, encoding (UINT32, ASCII, BCD, FLOAT32), and endianness.
2. Monitor MB_MASTER.STATUS online in TIA Portal. If the value is non-zero at the moment DONE becomes TRUE, jump directly to the error code table in section 11.
3. If STATUS = 0 but the destination tag is wrong, the transaction is succeeding but the data interpretation is failing. Continue with step 4.
4. Temporarily change the destination tag to ARRAY[0..7] of BYTE (8 bytes) and read 4 registers. Inspect the bytes in the watch table. A serial number of "12345" encoded as ASCII will show bytes 31 32 33 34 35 00 00 00. A serial number of 100000 encoded as UINT32 will show bytes 00 01 86 A0 00 00 00 00 (big-endian) or A0 86 01 00 00 00 00 00 (little-endian).
5. Re-derive the correct destination tag type from the byte view. If the bytes are ASCII, build a STRING tag. If the bytes are an integer, build a DWORD tag and apply a word-swap if needed.
6. Verify the byte-swap hypothesis by comparing the integer value to the value printed on the meter's nameplate or in its Modbus map examples.
7. If the source thread's "many calls to DB4" pattern is in use, refactor to one MB_MASTER instance per slave device. This is the only legal multi-request pattern in the S7-1200 Modbus_RTU library.

8. Step-by-Step Solution

The following procedure resolves the source-thread failure pattern in a way that does not require firmware changes or hardware modifications.

Step 1: Determine the correct Modbus address

From the smart meter datasheet, the serial number is at holding register 40042 and 40043 (32-bit UINT, high word first). In TIA Portal:

// MB_MASTER parameters for serial number read
REQ       := tx_pulse;          // BOOL, rising edge from sequencer
MB_ADDR   := 1;                 // slave ID of the smart meter
MODE      := 0;                 // 0 = FC03 read holding registers
DATA_ADDR := 42;                // first register = 40042 - 40000 = 42 (1-based) or 41 (0-based)
DATA_LEN  := 2;                 // 2 holding registers = 32 bits
DATA_PTR  := P#DB5.DBX0.0 DWORD;

If the meter is verified to use 0-based addressing in the documentation, change DATA_ADDR to 41. If the meter is verified to be 1-based (the more common case for modern Chinese and European smart meters), use 42.

Step 2: Allocate a non-REAL target tag

Open the destination DB (DB5 in this example) and create the following tags:

NAME          : sMeterSerialNumber
DATA TYPE     : DWORD
INITIAL VALUE : 16#00000000
ADDRESS       : DB5.DBX0.0

Add an aux tag for the byte-level view used in commissioning:

NAME          : aMeterSerialNumberBytes
DATA TYPE     : ARRAY[0..3] of BYTE
ADDRESS       : DB5.DBX4.0

Right-click on aMeterSerialNumberBytes in the project tree and use "Add watch table" to inspect the raw bytes. Use the format selector to display in Hex.

Step 3: Apply word-swap if necessary

Many Asian-manufactured smart meters (Acrel, Eastron, Selec) return the 32-bit serial number as low word first, then high word, which is little-endian word order. The native DWORD view will therefore be wrong. Add an explicit word-swap in the PLC program:

// Word-swap block in SCL
"sMeterSerialNumber_swapped" := WORD_TO_DWORD(SHR(IN := DWORD_TO_WORD("sMeterSerialNumber" AND 16#0000FFFF), N := 0));
// or use SWAP / TAW instructions in LAD/FBD

A simpler approach: read the 2 registers into a ARRAY[0..1] of WORD and reassemble with WORD_TO_DWORD(ARRAY[1]) shifted left 16 OR WORD_TO_DWORD(ARRAY[0]). This works for every endian variant by changing only the index order.

Step 4: Verify DONE/ERROR/STATUS logic

Add the following evaluation block in the same cycle that DONE is processed:

IF "mbMaster_1".DONE AND NOT "mbMaster_1".ERROR THEN
    // success: copy and swap if needed
    "aMeterSerialNumberBytes"[0] := DWORD_TO_BYTE(SHR(IN := "sMeterSerialNumber" AND 16#000000FF, N := 0));
    // ... continue byte extraction
    "bSerialNumberValid" := TRUE;
END_IF;

IF "mbMaster_1".ERROR THEN
    "wSerialNumberStatus" := "mbMaster_1".STATUS;
    "bSerialNumberValid" := FALSE;
END_IF;

The pattern above is the standard Siemens recommendation: read STATUS only at the cycle in which ERROR transitions from FALSE to TRUE, otherwise the status word reflects the last completed transaction, not the current one.

Step 5: Refactor multi-request pattern

Replace the single MB_MASTER instance reused for all slaves with one instance per slave. Inside the OB1 scan:

// One-shot sequencer driving distinct MB_MASTER instances
CASE "iRequestIndex" OF
    0: "mbMaster_Voltage".REQ := "tx_pulse";
    1: "mbMaster_Current".REQ := "tx_pulse";
    2: "mbMaster_Power".REQ   := "tx_pulse";
    3: "mbMaster_SerialNo".REQ := "tx_pulse";
END_CASE;

This eliminates the multi-call state corruption that may be present alongside the serial-number issue.

9. Data Type Selection Matrix

Use the matrix below when mapping Modbus register content to a TIA Portal data type. The matrix is independent of the meter brand and applies to all CB 1241, CM 1241, and integrated RS485 ports on the S7-1200 CPU.

10. Verification Tests

After applying the fix, run the following verification sequence. The test passes when all four steps succeed:

1. Live watch: open the destination DB online, observe the DWORD tag. For a meter with serial number 100000, the value must read 16#000186A0 (or 100000 decimal).
2. Force read: temporarily change the meter's Modbus slave ID to 247, set the S7-1200 MB_ADDR to 247, and confirm a successful read. Restore the original ID afterward.
3. Compare with meter display: the value read by the PLC must match the value shown on the meter's front-panel LCD or web interface (if the meter has one).
4. Bus monitor: connect a Modbus RTU bus monitor (such as a third-party USB-RS485 adapter running Modbus Poll) to the same bus and confirm the request and response byte sequences match. The PLC must send function code 03, starting address 0x002A (or 0x0029 for 0-based), quantity 2, and CRC16. The meter must respond with 4 data bytes, function code echo, and CRC16.

11. Common MB_MASTER Error Codes

The following status values are returned in MB_MASTER.STATUS on completion of a failed request. The list is the comprehensive set for the S7-1200 Modbus_RTU library, ordered by frequency in the field.

If the status word shows 0x0002 (illegal data address) on the serial number read but not on the measurement reads, the address is wrong, not the wiring. If the status word shows 0x7001 (timeout), the wiring or the slave ID is the issue and affects all reads equally.

12. Best Practices for Modbus RTU on S7-1200

• One MB_MASTER instance per slave device. Re-using a single instance for multiple slaves works in theory but is fragile in the field; allocate per-slave instance DBs and a sequencer in OB1.
• Edge-trigger REQ with a one-shot pulse from a clock or a counter; do not hold REQ = TRUE continuously, otherwise the instruction re-fires immediately and overwrites the result.
• Use a 4-byte integer or byte array for serial numbers; never use REAL for identification values.
• Capture STATUS only on the rising edge of ERROR; reading it every cycle gives the last completed status, not the current one.
• Verify endianness with the datasheet; meters from different vendors use both big-endian and little-endian word order. Read into a WORD array, inspect online, then build the final tag.
• Terminate both ends only. A 120 Ω resistor at the meter end and a 120 Ω at the CB 1241 end. Intermediate nodes must not have a termination resistor.
• Use shielded twisted pair with the shield grounded at one end (typically the cabinet ground bar). Avoid running RS485 in the same conduit as VFD output cables.
• Configure 9600/8E1 as the default for industrial Modbus RTU unless the meter requires higher. Most Chinese-made meters default to 2400/8N2 or 9600/8N2 — verify the exact value with the meter vendor.
• Poll serial number only at startup or on diagnostic trigger. There is no value in reading the serial number at the same rate as instantaneous measurements.
• Document the address map in the project. Use a separate DB with comments per register that mirror the meter datasheet; this is invaluable for the next commissioning engineer.

13. Field Commissioning Checklist

Use this checklist during the next meter swap or new installation.

1. Confirm the meter model and firmware version with the vendor; record the revision.
2. Download the meter Modbus map (PDF or XLS) and attach to the project documentation.
3. Identify the serial number register, register count, and encoding (UINT32, ASCII, BCD, FLOAT32). Annotate the datasheet with the page number.
4. Wire A to A, B to B, shield to ground at one end only.
5. Configure CB 1241 baud/parity/stop bits to match the meter default.
6. Test with a Modbus RTU bus monitor first; confirm the request and response are correct before launching TIA Portal.
7. In TIA Portal, build one MB_MASTER instance per slave and a sequencer OB1 block.
8. Validate each register read against the datasheet values for a known state (for example, force the meter current to 0 A and confirm the read matches).
9. Trigger the serial number read once at startup; latch the result in a retentive tag so it survives CPU restart.
10. Save a project snapshot, label all instance DBs, and export the watch table to PDF for the commissioning report.

14. Troubleshooting Matrix

When the serial number read still fails after applying the fix, use this matrix to triage.

15. Related Configuration References

Additional reference material in the Siemens SIMATIC documentation set:

• S7-1200 Programmable Controller System Manual — chapter on Modbus RTU communication with the CB 1241 and CM 1241 modules, including the MB_MASTER and MB_SLAVE instruction set and the supported function codes.
• TIA Portal Help — "MODBUS (RTU) Master" library (legacy) and "PtP/Modbus Communication" library (current): the instruction names changed in TIA Portal V14 SP1 from MB_MASTER to Modbus_Master; both are functionally identical, with Modbus_Master being the maintained instruction for new projects.
• CB 1241 (6ES7241-1CH30-1XB0) device manual — pin assignment, wiring, supported baud rates (300 to 115200 bps), and Modbus protocol selection in the device configuration of TIA Portal.
• S7-1200 Easy Book — recommended for engineers starting a first Modbus RTU integration; provides a worked example with the energy meter pattern.

All values, error codes, and parameter fields documented above are taken from the official Siemens S7-1200 Modbus RTU library reference and the CB 1241 device manual. Refer to those documents for revision-specific variations and for the exact instruction signatures in TIA Portal V14, V15, V15.1, V16, V17, V18, and V19.