S7-1200 MB_MASTER Modbus RTU: Resolving PM5110 Base Address

Overview

Modbus RTU is the most widely deployed industrial serial protocol on S7-1200 gateways, power meters, and energy submetering installations. A persistent commissioning issue is the base address offset between the addressing convention printed in a slave's user manual and the convention enforced by the Siemens MB_MASTER / MB_CLIENT instructions in TIA Portal. The discrepancy is not a fault; it is the cumulative effect of three independent design choices that vendors do not coordinate:

1. Whether the address is a zero-based offset (0–65535) or a one-based ordinal (1–65536).
2. Whether the function code is selected explicitly (e.g. FC03) or implied by a leading digit prefix (3xxxxx, 4xxxxx, 1xxxxx, 0xxxxx).
3. Whether the device stores the value as an Input Register (read-only, FC04) or a Holding Register (read/write, FC03).

This reference documents the diagnostic procedure used to align a SIMATIC S7-1214C running MB_MASTER as a Modbus RTU master with a Schneider Electric PM5110 power meter as a Modbus RTU slave. The same procedure applies to PM5310, PM5330, PM5340, and most PM5000-series meters, as well as third-party slaves from any vendor that publishes an ambiguous register map.

Modbus RTU Addressing Models

Every Modbus data transfer has five components: station ID, function code, slave data table, starting address, and quantity. The station ID is always a 1–247 byte. The remaining four are interdependent, and that is where vendors diverge.

Model A — Explicit Function Code, Zero-Based Offset

The original Modicon convention. The master specifies Function Code 03 (Read Holding Registers), Address 1836, Quantity 3. Address 1836 means "the 1837th Holding Register" because the count starts at 0. Most PLC master drivers implement this model, including the legacy Modsoft MBP_MSTR and CompactLogix MSG instructions with route paths.

Model B — Explicit Function Code, One-Based Ordinal

Identical wire behavior to Model A. Address 1836 means "the 1836th Holding Register." Several energy and process vendors print one-based maps because their documentation traces back to legacy Modsoft register sheets.

Model C — Prefix Digit, Zero-Based Offset

The five-digit address format. A slave's register map shows 41837 for Holding Register address 1836 (zero-based), and the prefix '4' implies Function Code 03. The '3' prefix implies Function Code 04 (Input Registers), '1' implies Function Code 02 (Discrete Inputs), and '0' implies Function Code 01/05 (Coils). The Modbus Application Protocol V1.1b3 explicitly states that the leading prefix is a de facto convention and is not part of the formal specification. Siemens notes this on its SiePortal in the context of the two driver modes — Address mode (application layer) versus Offset mode (protocol layer).

Model D — Prefix Digit, One-Based Ordinal

The same five-digit format as Model C, but the trailing four digits are one-based. Register 41837 means "the 1837th Holding Register." This is the form used by the Schneider PM5110 user-facing register map.

Siemens MB_MASTER and MB_CLIENT Addressing

The S7-1200/S7-1500 Modbus RTU library ships two instructions: MB_MASTER (legacy, S7-1200 only) and MB_CLIENT (S7-1200 from firmware V4.2 and S7-1500). Both accept the same three inputs that govern addressing:

Per the S7-1200 System Manual, DataAddr is always a one-based ordinal. The instruction adds the data-table offset internally before transmitting on the wire. Holding Registers therefore start at DataAddr = 1 (corresponding to wire register 0), Input Registers at 30001, Coils at 1, and Discrete Inputs at 10001.

The implication is direct: a PM5110 register documented as 41836 must be entered into MB_MASTER with one of three values, depending on which model the PM5110 map uses:

• If the PM5110 map is Model C (zero-based prefix notation), MB_MASTER DATA_ADDR = 1836 + 30001 = 31837, OR simply 1837 if you rely on the auto-prefix (see below).
• If the PM5110 map is Model D (one-based prefix notation), MB_MASTER DATA_ADDR = 1836 + 30001 = 31837, OR 1836 if the prefix is informational only.

The Siemens driver detects the requested data table by value range: 0–9999 → coils, 10000–19999 → discrete inputs, 30000–39999 → input registers, 40000–49999 → holding registers. Therefore, dropping the prefix entirely (DATA_ADDR = 1836) places the request into the holding-register range and selects FC03, while 30001–39999 selects FC04 input registers.

Schneider PM5110 Modbus Register Map Conventions

The PM5110 publishes its register set as a comma-separated values document on the Schneider Electric website. Across firmware revisions 1.5.x, 2.0.x, and 3.1.x the addressing convention has not changed: addresses are one-based ordinals and are prefixed with the table identifier. The PM5110 uses Holding Registers (prefix 4) for virtually every measurement value because Schneider designed the meter to accept remote configuration writes through the same address space. Selected registers use the Input Register range for read-only telemetry that must not be modified accidentally.

Common PM5110 registers that commissioning engineers encounter:

Diagnostic Procedure — Determining the Base Offset

Reading three contiguous registers at a known-offset location is the fastest way to determine the exact offset between the PM5110 and the S7-1214C. The technique exploits a value pair the meter is guaranteed to return at a documented address range.

Test 1 — Read Holding Register Block 1836

1. Open TIA Portal, expand the S7-1214C project, and instantiate one FB MB_MASTER (or one FB MB_CLIENT) with instance DB MB_DB.
2. Wire REQ to a periodic 1-second pulse, MODE = 0 (Read), SLAVE = 1, DATA_ADDR = 1836, DATA_LEN = 3, and a data pointer to MB_HOLDING[0..2] (3 words).
3. Place the program online and watch MB_HOLDING[1], MB_HOLDING[2], MB_HOLDING[3].

The diagnostic hinges on the fact that the PM5110 stores two known sentinel values at this location: a serial-number fragment around 2000+ and a small status word ≤31. If the first word you read is the sentinel, your DATA_ADDR is exact; if it is the small status word, you have slid the window by one.

Test 2 — Read Input Register Block 1836

Many PM5110 firmware revisions publish measurement data in Input Registers (3xxxxx) instead of Holding Registers (4xxxxx). Repeat the test with DATA_ADDR = 31836 (MB_MASTER will auto-select FC04 in the 30000–39999 range) and compare the two result buffers. Whichever buffer returns realistic power-meter values (in the expected engineering range, e.g. 110–480 for V_L-N) is the correct table.

Worked Example — Reading PM5110 Active Power Total (Register 3060)

The PM5110 register map lists Active Power Total as register 3060 (one-based ordinal, in the Input Register range). To read it on a SIMATIC S7-1214C running firmware V4.5 with the Modbus RTU library V4.0:

1. In the PLC device configuration, enable the CM1241 RS485 module (or the onboard RS485 of the CPU 1214C DC/DC/DC). Set the protocol to "Modbus Master (RTU)" and configure baud rate, parity, and station ID. The PM5110 default is 19200 8E1, station ID 1.
2. Create a global data block DB_MODBUS with the following tags:

   MB_DB          : MB_MASTER        // instance
   REQ            : BOOL             // request trigger
   MODE           : WORD             // 0 = Read Holding, 1 = Write, etc.
   MB_ADDR        : WORD             // DATA_ADDR
   MB_LEN         : WORD             // DATA_LEN
   DATA_PTR       : POINTER          // data buffer pointer
   DONE           : BOOL
   ERROR          : BOOL
   STATUS         : WORD
   ActivePower_W  : INT              // raw value from PM5110

3. Wire the FC04 input-register read using either model:
   • If PM5110 map is one-based with prefix (Model D): DATA_ADDR = 30060 (the prefix adds 30000 internally, the trailing 60 is one-based ordinal).
   • If PM5110 map is one-based without prefix (Model B): DATA_ADDR = 3061 (S7 adds 30000 internally, +1 because the master is one-based).
4. Trigger REQ on a 1-second timer. The instruction returns ActivePower_W in watts.
5. For power values that exceed the 16-bit signed range (±32 767 W), use a two-register read (FC04 starting at 3058 with quantity 2, MSW-first). PM5110 returns signed 32-bit integer; in TIA Portal use DWORD_TO_DINT and check for sign extension.

Function Code Selection: Input Register vs Holding Register

Energy meters are unusual in Modbus networks because the same physical measurement can live in either data table depending on vendor design. The PM5110 keeps most live measurements in Input Registers and reserves Holding Registers for configuration parameters (CT ratio, PT ratio, demand window, communications settings). Other vendors do the opposite.

If you are writing configuration to the PM5110 (e.g. setting CT primary at register 4012), use FC06 (Write Single Holding Register) and set MODE = 1 in MB_MASTER. Always issue a Read-Modify-Write sequence, never blind writes, to avoid corrupting configuration when the FC is mis-selected.

Brand-Specific Addressing Variants

Although the PM5110 / S7-1200 pair is the most common on commissioning sites, several other vendors exhibit their own offset quirks:

Step-by-Step TIA Portal Configuration

Prerequisites

• TIA Portal V17 or later with the Modbus RTU library installed.
• S7-1214C DC/DC/DC with firmware V4.2 or later (CM1241 RS485 or onboard RS485).
• PM5110 with Modbus RTU enabled (default settings: 19200 8E1, station ID 1).
• Shielded twisted-pair RS485 cable terminated with 120 Ω at both ends.
• Common 0 V between PLC and meter chassis ground.

Procedure

1. In the device configuration of the S7-1214C, click the CM1241 module, select "Port configuration," set Protocol = "Modbus Master (RTU)," enter the baud rate and parity to match the PM5110, and leave the response timeout at 1000 ms.
2. In the project tree, expand "Libraries" → "Modbus RTU" → "MB_MASTER," and drag the FB into a new Code Block (FB or OB1).
3. Create an instance DB when prompted (e.g. DB_Modbus).
4. Program the call as below:

   // Call in OB1
   "MB_MASTER_DB"(
       REQ   := MB_REQ_PULSE,       // 1 Hz pulse from TON
       MODE  := 0,                  // 0 = Read Holding
       SLAVE := 1,                  // PM5110 station ID
       DATA_ADDR := 40001,          // Holding Register 1 → CT Primary
       DATA_LEN  := 1,              // 1 word
       DATA_PTR  := P#DB100.DBX0.0 BYTE 2,
       DONE  => MB_DONE,
       ERROR => MB_ERROR,
       STATUS => MB_STATUS
   );

5. Compile and download. Go online.
6. Watch MB_STATUS; it should transition from 16#7000 (idle) to 16#0000 (DONE) on the first successful transaction. If it ends in 16#8380, the slave did not respond — check RS485 wiring and station ID.
7. Once the first register returns the expected CT primary value (e.g. 200 for 200:5 CTs), commit the configuration and proceed to scale up to the full register list.

Verification and Commissioning Checks

1. Toggle a known register. Read the PM5110 CT primary at register 4012 (default 200). Compare against the value displayed on the meter's front panel. They must match.
2. Inject a reference voltage at the meter's terminals (e.g. 120 V L-N). Read register 3028 (Voltage L-N Avg) and confirm the returned integer is 12000 with the PM5110 default scale of 0.1 V/unit. Actually, PM5110 stores voltage in 1 V/unit — verify scaling per firmware revision.
3. Verify exception codes. If MB_STATUS ends in 16#8381 (read error), read MB_EXCEPTION. Codes:
   • 01 Illegal Function — wrong FC (recheck prefix).
   • 02 Illegal Data Address — address out of range (recheck map revision).
   • 03 Illegal Data Value — count exceeds device limit.
   • 04 Slave Device Failure — meter in fault, check front panel.
4. Watch the per-register retry counter in the diagnostic DB. More than 3 retries per 10 seconds indicates noise; check shield grounding and termination.
5. Record the bus voltage between DATA+ and DATA− with a scope. A healthy PM5110 line idles at 0.2–0.5 V differential and swings ±1.5 V during traffic.

Troubleshooting Matrix

Notes for Power Engineers Migrating From Legacy PLCs

Engineers familiar with Modicon, SLC 500, or PLC-5 may expect DATA_ADDR to be zero-based. The Siemens S7-1200/1500 convention is one-based, which is consistent with the Modbus Application Protocol V1.1b3 example register list (Section 6). When porting legacy register sheets:

• Add 1 to every zero-based offset.
• If the legacy sheet shows the prefix digit, drop it; MB_MASTER auto-selects FC from the value range.
• If the legacy sheet is one-based with no prefix (Model B), keep the value as-is.

For Modbus TCP migrations using MB_CLIENT, the same logic applies. The wire protocol does not change between RTU and TCP; only the transport does. The Siemens S7-1200 system manual chapter on Modbus TCP notes identical addressing semantics.

FAQ