S7-1200 MB_Master Modbus Hex to Decimal Address Conversion

1. Overview

The Siemens S7-1200 and S7-1500 CPUs communicate with Modbus RTU slaves through serial communication modules such as the CB1241 (RS485, no termination) or the CM1241 RS422/485 module. The user program calls the MB_MASTER instruction (FB) from the “Modbus” library in TIA Portal (V13 SP1 and later). Unlike most third-party Modbus masters where the function code, slave address, and starting register are independent parameters, the S7-1200 implementation conflates the function code with the Data_ADDR input through a leading-numeral convention borrowed from the legacy Modicon 984 memory map.

This means every register address passed to MB_MASTER must start with a prefix that simultaneously selects the function code and the Modbus memory area. When the device documentation only provides hexadecimal register numbers, you must:

1. Convert the hex value to decimal.
2. Add the appropriate leading-numeral prefix based on which Modbus function code the slave expects.
3. Select a matching MODE value in MB_MASTER.

The protocol-level address transmitted in the Modbus RTU frame is the lower portion of Data_ADDR; the leading numeral itself is stripped before the address bytes are placed on the wire. According to National Instruments’ knowledge base article kA00Z0000019LT6SAM, hexadecimal register values in device manuals must first be matched to the correct address range (input, holding, coil, or discrete) before any decimal conversion is performed.

2. Modbus Function Code to Memory Area Mapping

The Modbus protocol defines four primary memory areas, each tied to specific function codes. The Modbus specification itself does not impose a numbering convention; the 0xxxx/1xxxx/3xxxx/4xxxx prefixes are a de facto legacy from the Modicon 984 PLC family. Siemens adopted this convention for MB_MASTER to keep the user-facing address format familiar to Modicon-trained personnel.

Critical insight: The leading numeral itself is never transmitted on the wire. The MB_MASTER block uses the leading digit only to select the function code and to construct the correct Modbus Application Data Unit (ADU). The two-byte register address field in the actual Modbus RTU frame is the zero-based index derived from the lower portion of Data_ADDR (i.e., Data_ADDR – prefix_constant).

3. Hexadecimal to Decimal Conversion Procedure

Converting a hex register address to decimal is a positional base-16 calculation. For a four-digit hex value 0xh3h2h1h0:

decimal = (h3 × 16³) + (h2 × 16²) + (h1 × 16¹) + (h0 × 16⁰)

Example A: 0x331A → decimal

0x331A = (3 × 4096) + (3 × 256) + (1 × 16) + (10 × 1)
0x331A = 12288 + 768 + 16 + 10
0x331A = 13082 decimal

Example B: 0x9013 → decimal

0x9013 = (9 × 4096) + (0 × 256) + (1 × 16) + (3 × 1)
0x9013 = 36864 + 0 + 16 + 3
0x9013 = 36883 decimal

Handling Hex Values Above 0x270F (9999 decimal)

The legacy prefix constants 40001, 30001, 10001, 00001 only cover register numbers 1–9999. For modern field devices (solar charge controllers, smart power meters, industrial drives) register numbers routinely exceed 9999. In this case the prefix expands to a six-digit constant:

4. Zero-Based vs. One-Based Addressing

Modbus documentation is ambiguous about whether register numbers in the manual correspond to:

• Zero-based protocol addresses — the byte value transmitted in the RTU frame.
• One-based human-readable numbers — legacy Modicon convention where register “40001” transmits address 0.

The widely accepted interpretation is:

• Hex addresses in device manuals are typically zero-based (i.e., they match the wire value).
• Leading-numeral addresses like 40001 are one-based (i.e., 40001 transmits address 0).

Given this, the DATA_ADDR formula for an MB_MASTER call is:

DATA_ADDR = prefix_constant + decimal_value_of_hex_address

If the device manual explicitly states its hex values are 1-based, subtract 1 before adding the prefix. If you receive error 16#8383 from MB_MASTER (data address out of range) or the slave returns an “Illegal Data Address” exception (Modbus exception code 02), shift the address by ±1 and retry.

5. Worked Conversion Examples

The table below consolidates the conversion logic for registers documented in hex.

Verification tip: After entering the value, capture the wire frame with a Modbus sniffer (or the Siemens “Trace” feature in TIA Portal V17+ when the CM/CB has a diagnostic port) and confirm the second byte of the function code response equals the function code you expected. For DATA_ADDR = 313082 the frame should contain 04 33 1A 00 03 (FC 04, address 0x331A, length 3) followed by the CRC.

6. MB_Master MODE Reference

The MODE input selects the read/write operation type. The leading numeral of Data_ADDR independently selects the memory area; together they fully determine the function code on the wire. The MODE constants shipped in the Modbus library depend on the FB version in use:

Note: The MODE constants above align with the “Modbus” library version 3.x used in TIA Portal V15.1 through V18. Earlier library versions (V1.x, V2.x) shipped with S7-1200 in TIA V13 SP1 used slightly different MODE numbering; Siemens consolidated these in V3.x. Always verify against the TIA Portal online help for your specific FB version.

7. Step-by-Step Conversion Procedure

1. Identify the function code. Read the device manual and determine which FC number is required to access the target data block (FC 01/02/03/04/05/06/15/16).
2. Identify the memory area. Cross-reference the FC with the memory area table in Section 2 (Coils, Discrete Inputs, Input Registers, Holding Registers).
3. Convert the hex address to decimal. Use the positional calculation or a calculator. Example: 0x331A → 13082; 0x9013 → 36883.
4. Apply the leading-numeral prefix.
   • FC 03/06/16 → prefix 4xxxx
   • FC 04 → prefix 3xxxx
   • FC 01/05/15 → prefix 0xxxx
   • FC 02 → prefix 1xxxx
5. Adjust for zero/one-based offset if required. If the manual states “registers numbered from 1,” subtract 1 from the decimal value before adding the prefix. Otherwise use the value as-is.
6. Select the MODE. Match the MODE table in Section 6 to the FC.
7. Wire up DATA_PTR. Provide an ARRAY OF BYTE or ARRAY OF WORD sized to (DATA_LEN × 2) bytes.
8. Set BLOCKED_PROC_TIMEOUT. Default 3.0 s is appropriate for sub-1-second poll cycles. Increase to 10–30 s for slow slaves (some solar charge controllers sleep between requests).
9. Trigger REQ and monitor status. A rising edge on REQ initiates one transaction.

8. Error Code Reference

MB_MASTER returns standardized status codes via its DONE, BUSY, and ERROR outputs and the STATUS word. The most common errors encountered during hex-to-decimal addressing problems are:

9. Common Pitfalls and Field-Proven Caveats

9.1 Wire Swapping on RS485

RS485 is polarity-sensitive at the physical layer: “A” (Data+) and “B” (Data–) must not be reversed, although some vendors label them “+” / “–” or “D1” / “D0” instead. A swapped pair produces 0x80C9 (Blocked_Proc_Timeout) followed by 0x80D5 (Timeout on receive) even though the slave is present on the bus. Always verify with a Modbus sniffer first.

9.2 One vs. Two-Byte Address Padding

Some manufacturers specify their register map with leading zeros (e.g., “0x0331A” for 5-digit registers). When the prefix 4 is added, the resulting 6-digit value must still be inside the INT range. If a 32-bit integer overflow occurs, this is a symptom of incorrectly concatenating the prefix rather than adding it (e.g., using “43xxxx” as a literal instead of 400001 + xxxx).

9.3 MODE Mismatch with Prefix

The MODE input must be consistent with the leading numeral. If MODE = 4 (Read Input Registers) but DATA_ADDR = 413082 (4xxxx prefix), the block will either reject the combination with 0x8383 or transmit a frame with the wrong FC. The MODE value cannot force a different function code than the prefix dictates; they are anded together internally.

9.4 DATA_PTR Array Sizing

DATA_PTR must be declared as ARRAY [0..n-1] OF BYTE where n ≥ 2 × DATA_LEN. If n = DATA_LEN (instead of 2 × DATA_LEN), MB_MASTER reports 0x8383 because it cannot fit the response bytes.

9.5 32-Bit Values and IEEE-754 Floats

Many sensors pack a 32-bit float or a 32-bit signed integer into two adjacent 16-bit registers. The MB_MASTER response data must be re-assembled and converted to IEEE-754 single-precision float using the standard formula:

sign = (raw >> 31) & 0x01
exponent = ((raw >> 23) & 0xFF) − 127
mantissa = 1 + ((raw & 0x7FFFFF) / 8388608.0)
float = (−1)^sign × mantissa × 2^exponent

Per Schneider Electric FAQ FA406976, the two 16-bit register words must be combined with the high-order word first (big-endian / Modbus word order). On S7-1200 SCL this conversion is most easily done with the standard library function WORD_TO_REAL after manual byte-swap, or by enabling the “Byte Swap” parameter on the receiving block when available.

9.6 Negative Number Handling

16-bit registers transmitting signed integers use two’s complement. A raw value of 0xFFFE (65534 decimal) is −2, not 65534. Apply DINT_TO_REAL or the equivalent two’s-complement conversion in your application code when interpreting negative temperatures, currents, or signed counts.

10. Verification Checklist

1. Confirm the wire frame: open the TIA Portal online & diagnostics view of the CB1241 (right-click → “Online & diagnostics” → “Port statistics”) or attach a Modbus RTU sniffer such as the open-source “ModbusTools” or the Wireshark Modbus dissector. Verify the FC byte equals the value in Section 2.
2. Confirm the slave response: a successful FC 04 read returns bytes equal to 2 × DATA_LEN. For DATA_LEN = 3, expect 6 bytes of payload plus the slave address, FC, length, and CRC.
3. Confirm STATUS = 0x0000 after DONE pulses high. Any non-zero STATUS means the transaction failed; cross-reference Section 8.
4. Confirm the payload values match the device manual within expected scaling (some sensors apply a 0.1 or 0.01 multiplier).
5. Confirm cyclic execution: the DONE flag must pulse every MB_MASTER cycle. If BUSY remains low, the request edge was missed.

11. Troubleshooting Matrix

12. Migration Notes: S7-1200 to Codesys/Wago

Engineers frequently migrate Modbus master code from the S7-1200 platform to a Codesys-based controller (Wago PFC200, Wago CC100, Beckhoff CX) because Codesys Modbus libraries expose the function code as an explicit input. If you are porting an MB_MASTER call to Codesys:

1. Drop the leading numeral. Use only the zero-based decimal address.
2. Pass the function code explicitly (e.g., FUNCTION_CODE := 4).
3. Configure the slave address separately (e.g., SLAVE_ADDR := 1).
4. Re-order bytes if migrating 32-bit values; Codesys Modbus_Slave / Modbus_Master handle byte order differently than Siemens’ byte-swap convention.

This explicit structure makes the addressing scheme self-documenting and eliminates the leading-numeral confusion entirely. The trade-off is more parameters per call.

13. FAQ