Resolving S7-1500 Modbus Server FC04 Read Returns Zero

Problem Summary

A Modbus TCP client (PC-based SCADA or test application) writes successfully to a Siemens SIMATIC S7-1500 (CPU 1512F-1 PN) using Modbus function code 06 (Write Single Register, 0x06) but consistently receives a response payload of 0 when it issues function code 04 (Read Input Registers, 0x04) against the same address range. The S7-1500 is the Modbus server (the device that responds). The migration path is from a legacy ET 200S IM151-8F CPU with an open Modbus/TCP solution to the standard S7-1500 library instruction MB_SERVER running on firmware V2.1. The legacy project used two distinct data blocks (DB10 for writes, DB11 for reads), and the PC master application cannot be rewritten because its address map is fixed and the source is no longer maintainable.

The failure pattern is repeatable: any 0x04 request, regardless of starting address, returns a value of 0. The same request re-issued as 0x03 (Read Holding Registers) returns the correct data. The diagnosis is therefore not a network problem, not a CPU protection level problem, and not a licensing problem. It is a memory-map configuration issue inherent to MB_SERVER on the S7-1500 firmware line in use.

Modbus Register Model Refresher

The Modbus Application Protocol (Modbus Organization) defines four discrete address spaces. The leading digit of the user-visible address is implicit in the function code and is stripped before the request is presented to the server.

When a master issues a request against address 40001 with FC 06, the request is for Holding Register 1. When the same master issues a request against address 30001 with FC 04, the request is for Input Register 1. A strict Modbus server maps these to two different physical memories. A permissive server may map both function codes to the same memory. The behavior of the S7-1500 MB_SERVER falls between these two extremes depending on firmware version, as detailed below.

Reference: modbustools.com Modbus protocol reference; Beijer Electronics Modbus interface documentation (GL-997X series).

Root Cause: MB_SERVER Memory Map in S7-1500 FW 2.1

The MB_SERVER instruction shipped with TIA Portal V13 through V15 for S7-1500 CPUs (firmware V1.8 through V2.5) exposes a single data area parameter, MB_HOLD_REG, which serves as the source/destination for all data-oriented function codes except FC 04. On the legacy IM151-8F with the open Modbus/TCP solution, the user-defined code split read and write traffic into two DBs explicitly. The standard S7-1500 MB_SERVER does not.

On the CPU 1512F-1 PN with firmware V2.1, the FC 04 (Read Input Registers) handler in MB_SERVER reads from a memory region that is conceptually distinct from MB_HOLD_REG. In the older S7-1200 implementation, FC 04 reads from the process image input area (%IW). On S7-1500 with firmware V1.8 - V2.5, the implementation differs: the input register area is hard-wired inside the instruction and is not exposed as a configurable pointer. The data block the user assigned to MB_HOLD_REG is therefore inaccessible to FC 04 reads.

The result is the symptom reported: FC 06 writes to MB_HOLD_REG succeed (the data is visible in the DB), but FC 04 reads return 0 because the FC 04 source is a different memory region, not the user DB.

Affected Firmware and Instruction Comparison

The MODBUS_SERVER instruction was introduced for S7-1500 in TIA Portal V15.1 with firmware V2.6. It provides three independent data area pointers: one for the input register space (FC 04), one for the holding register and coil space (FC 01/02/03/05/06/15/16/23), and a length parameter. This is the architectural change that resolves the FC 04 read issue without modifying the master.

Solution A: Upgrade to MODBUS_SERVER (Recommended)

Prerequisites

• TIA Portal V15.1 Update 3 or later (V16, V17, or V18 strongly recommended for current Siemens support)
• S7-1500 CPU 1512F-1 PN firmware V2.6 or later; V2.9 is the current shipping release for the 1512F-1 PN
• STEP 7 Safety Advanced is required only if the F-CPU safety program is in use; the standard MODBUS_SERVER instruction does not require Safety
• Read/write access to the project file (.ap15_1 or later) and the SD card or onboard flash of the CPU
• The master application unchanged

Step-by-Step Configuration

1. Confirm firmware version. In TIA Portal, right-click the CPU in the device tree, choose Online → Diagnostics → Module Information, and read the firmware version under the General tab. If the version is below V2.6, schedule a firmware update through Siemens Industry Online Support before proceeding.
2. Update CPU firmware if required. Right-click the CPU, choose Online → Diagnostics → Update Firmware. Select the target firmware file (.upd) and confirm. The CPU performs an automatic restart after the update.
3. Remove the existing MB_SERVER call. In the program blocks folder, open the cyclic OB (typically OB1) and delete the call to MB_SERVER. The instance DB can be deleted or left in place; it will be unreferenced.
4. Insert MODBUS_SERVER. In the project tree, navigate to Instructions → Communication → MODBUS TCP. Drag the MODBUS_SERVER instruction into OB1. The instruction is contained in the global library; an SCL or LAD/FBD view is acceptable.
5. Create the connection DB. MODBUS_SERVER requires a connection description of type TCON_IP_V4. Double-click the CONNECT input to open the connection wizard. Set the interface to the PROFINET port of the CPU, leave the partner unspecified (server-side passive open), and use port 502.
6. Set the connection ID. The MB_ID parameter must be unique across all Modbus instructions in the CPU (both client and server). Any value in the range 1 - 247 is valid. Document the value in the project.
7. Configure the data area pointers. Two pointer inputs control memory mapping:
   • MB_HOLDING_REG_PTR → pointer to a DB for FC 01/02/03/05/06/15/16/23 traffic. The first 4 bytes of this DB also serve the bit-oriented (coil) function codes; words above address 0 serve the word-oriented function codes.
   • MB_INPUT_REG_PTR → pointer to a DB for FC 04 traffic. The DB must contain only word-sized data; bit areas are not applicable to FC 04.
   To replicate the original IM151-8F layout, assign MB_HOLDING_REG_PTR to DB10 and MB_INPUT_REG_PTR to DB11.
8. Set the data length. MB_DATA_LEN specifies the byte length of the data area. The instruction computes the maximum register count from the DB lengths. Recommended initial value: 1000 bytes for each area, sufficient for most installations.
9. Wire the status outputs. Connect NDR (new data received), DR (data read), ERROR, and STATUS to tags or DB fields for online monitoring. STATUS returns a 16-bit code; non-zero values indicate Modbus exceptions (1 = illegal function, 2 = illegal data address, 3 = illegal data value, 4 = slave device failure) or Siemens-specific protocol errors.
10. Compile and download. Compile the program blocks, then download to the CPU. Verify in the watch table that MODBUS_SERVER is being called every cycle and that ERROR remains 0.

Sample SCL Implementation

// In OB1 or a cyclic OB
"modbus_server_db"(
    MODE := 1,                              // 1 = TCP, 2 = UDP
    MB_ID := 1,                             // unique connection ID
    CONNECT := "modbus_tcp_connection",     // TCON_IP_V4 DB
    IP_PORT := 502,                         // IANA Modbus port
    MB_HOLDING_REG_PTR := "DB10",           // holding + coils
    MB_INPUT_REG_PTR := "DB11",             // input registers (FC 04)
    MB_DATA_LEN := 200,                     // bytes per area
    NDR => "tag_NDR",
    DR => "tag_DR",
    ERROR => "tag_ERROR",
    STATUS => "tag_STATUS"
);

Sample Ladder Implementation

      DB_VAR_INST.MODBUS_SERVER
   |--MODE--|-----------( )  |
   |  1     |              |
   |MB_ID---|              |
   |  1     |              |
   |CONN----|              |
   |"conn" |  STATUS->tag_STATUS  ERROR->tag_ERROR
   |PORT----|              |
   |  502   |              |
   |HR_PTR--|              |
   |"DB10" |              |
   |IR_PTR--|              |
   |"DB11" |              |
   |LEN-----|              |
   | 200    |              |

The MODBUS_SERVER instruction must be called in a cyclic OB (OB1 or any OB with a defined cycle time). The Siemens instruction background is non-blocking; the call returns immediately and the actual protocol processing occurs in the CPU firmware task.

Solution B: Modify the Master to Use FC 03

If a firmware upgrade is not feasible (the CPU is in long-term operation, the firmware update is blocked by the plant's change management, or the 1512F-1 PN is below V2.6 and cannot be updated), the next-cleanest workaround is to modify the PC master application to substitute FC 03 (Read Holding Registers) for FC 04 (Read Input Registers). Both function codes then access the same MB_HOLD_REG data area in the legacy MB_SERVER instruction.

Operationally:

• FC 06 → 40001 → writes to MB_HOLD_REG[0] in the user DB (already working).
• FC 03 → 40001 → reads from MB_HOLD_REG[0] in the user DB (now works).

From a strict Modbus conformance standpoint, this is a deviation: the master is reading "input" data through the "holding" function code. Most industrial systems tolerate this, but the change must be documented in the project record and reviewed with the end customer. If the master application is a closed-binary vendor product with no support contract, this solution is not viable.

Solution C: Custom Modbus TCP Server via Open User Communication

If neither firmware upgrade nor master modification is possible, a custom Modbus TCP server can be implemented on the S7-1500 using the Open User Communication (OUC) instruction set:

• TCON for connection establishment on port 502
• TRCV for receiving the Modbus ADU (MBAP header + PDU)
• Custom logic to parse the function code, route FC 06 writes to a DB, and route FC 04 reads from a different DB
• TSEND for transmitting the response PDU
• TDISCON for graceful disconnect on shutdown

The implementation must handle the MBAP header (transaction ID, protocol ID 0, length, unit ID), the PDU (function code, starting address, quantity), and the exception responses (codes 1 - 4). Siemens provides reference code for a custom Modbus server in the Siemens Industry Online Support knowledge base; review the code carefully for re-entrancy and connection count limits (S7-1500 supports up to 64 simultaneous OUC connections).

This approach is the most complex and is generally not recommended unless all other options are blocked. Test protocol conformance with a third-party Modbus conformance tester before deployment.

Memory Layout Diagram (MODBUS_SERVER Solution)

FC Routing Flowchart (MB_SERVER Legacy vs MODBUS_SERVER)

Verification Procedure

Verification with modpoll

# Read holding registers (FC 03) - control test
modpoll -m tcp -a 1 -r 1 -c 10 -p 502 192.168.0.10

# Read input registers (FC 04) - target test
modpoll -m tcp -t 4 -a 1 -r 1 -c 10 -p 502 192.168.0.10

# Write single register (FC 06) - control test
modpoll -m tcp -a 1 -r 1 -p 502 192.168.0.10 12345

Flags used:

• -m tcp → Modbus TCP transport
• -t 4 → register type = input registers (forces FC 04)
• -a 1 → unit ID 1 (Modbus server address)
• -r 1 → start at register 1 (strips the leading 3 or 4)
• -c 10 → quantity of 10 registers
• -p 502 → TCP port 502

Verification with Wireshark

1. Capture on the Ethernet port connecting the S7-1500 to the master PC.
2. Apply display filter: mbtcp || modbus
3. Trigger an FC 04 read from the master.
4. Inspect the response frame. The function code byte should be 0x04 (read) or 0x84 (read exception, high bit set), the exception code should be 0x00 on success, and the data payload should contain non-zero values matching the DB11 contents.

Verification with TIA Portal Watch Table

1. Open a watch table and add DB11.DBW0 through DB11.DBWn (the input register data area).
2. Force specific values into the tags.
3. Trigger an FC 04 read from the master and confirm the response matches the forced values.
4. Check MODBUS_SERVER.STATUS for non-zero error codes.

Detailed MODBUS_SERVER Parameter Reference

STATUS / Error Code Reference

The STATUS encoding is firmware-version-specific. The complete list is integrated into the TIA Portal F1 help for MODBUS_SERVER; refer to the help for the exact installed version.

Troubleshooting Matrix

Endianness and Word Order

Modbus protocol is big-endian (most significant byte first) on the wire, and so is the S7-1500 DB representation. Some PC-based master libraries reverse the byte order under the assumption that x86 is little-endian. When a value is written via FC 06 from the master and then read back via FC 04, the values should match exactly. If they do not, the master is performing byte swapping. Configure the master to use big-endian (network byte order) and re-test. The same DB representation on both ends eliminates the problem.

Network Configuration Checklist

• CPU PROFINET port assigned a static IP address (DHCP not recommended for Modbus server)
• Subnet mask matches the master PC subnet
• Default gateway set if the master is on a different subnet
• Port 502/TCP open in any firewall between the master and the CPU
• No other device on the network using port 502 (use a port scanner like nmap: nmap -p 502 192.168.0.0/24)
• PROFINET device name assigned and verified (Online → Diagnostics → Module Information)
• CPU in RUN, not STOP; MODBUS_SERVER.ERROR = 0; STATUS = 0

Legacy IM151-8F to S7-1500 Migration Notes

The IM151-8F (ET 200S high-feature CPU) used the open Modbus/TCP solution published by Siemens for the ET 200S, which gave the user full control over the data area assignment and allowed the read and write traffic to be split into two DBs. The S7-1500 standard library does not include a drop-in replacement for this two-DB configuration in firmware V2.1; the architecture is asymmetric. The MODBUS_SERVER instruction in firmware V2.6+ is the closest functional equivalent and supports the same two-DB layout.

Other migration considerations specific to the IM151-8F → 1512F-1 PN transition:

• The ET 200S used the IM151-8F as a head module with up to 12 I/O modules; the 1512F-1 PN integrates the PROFINET interface and removes the ET 200S station requirement.
• The ET 200S safety-related I/O modules map directly to the S7-1500 F-I/O catalog.
• The IM151-8F used S7-300 instruction syntax in many cases; the S7-1500 uses the optimized TIA Portal instruction set. Open the legacy project in TIA Portal and accept the auto-migration of FBD/LAD blocks.
• The legacy DB10/DB11 layout can be preserved if the data types and offsets are re-created in the new project. The new DBs do not need to match the legacy DB numbers.

Safety Considerations for F-CPU Migration

The CPU 1512F-1 PN is a fail-safe PLC. The Modbus server functionality is part of the standard (non-safety) program. The standard program may read values from the safety program only through the standard-to-safety boundary (F-shared DB) and only with the appropriate access controls. The Modbus master cannot directly read or write safety tags; this is enforced by the F-CPU runtime. Confirm that the data being read by FC 04 is not safety-tag data that requires F-CPU write protection.

Migration Checklist

• Confirm S7-1500 CPU 1512F-1 PN current firmware version
• If FW < 2.6, schedule firmware update with Siemens support and verify backup of the project
• Decide between Solution A (recommended), B, or C based on master modify feasibility
• If Solution A: install TIA Portal V15.1+ on the engineering workstation
• Replace MB_SERVER with MODBUS_SERVER in the program
• Configure MB_INPUT_REG_PTR to the read DB; MB_HOLDING_REG_PTR to the write DB
• Compile, download, verify in the watch table
• Test FC 04 read with modpoll / QModMaster / Wireshark
• Document the deviation if Solution B is used
• Update the master application if Solution B is used
• Back up the original IM151-8F project archive before decommissioning

Terminology Clarification

The original report states: "The PLC is Server and the computer software acts as slave." This is a common but incorrect phrasing. In Modbus terminology, the device that responds to requests is the Server (historically called Slave), and the device that initiates requests is the Client (historically called Master). The S7-1500 is therefore the Modbus Server, and the PC application is the Modbus Client. The two terms are interchangeable per the Modbus specification, but the modern Modbus Organization terminology is "Client" and "Server."