S7-1200 MB_MASTER: Reading Socomec E34 5xxxxx Registers

Problem Overview

When commissioning an S7-1200 CPU as a Modbus RTU master against a Socomec Countis E34 multifunction power meter, the most common failure mode is that the MB_MASTER instruction enters a permanent BUSY state and never returns DONE or ERROR. The data point of interest is typically the cluster of holding registers 51281-51286 (function code 03), which contain energy, current, voltage, and power data on the E3x family.

The root issue is not the wiring, not the baud rate, and not parity. It is the address map. The S7-1200 MB_MASTER instruction only accepts slave register addresses inside one of two numeric windows:

• 40001 to 49999 (legacy 4xxxxx holding-register notation)
• 400001 to 465535 (6-digit holding-register notation)

Socomec documents the E34 with a 5xxxxx prefix (e.g. 51281, 51282, 51283, 51284, 51285, 51286). That prefix is not part of any ratified Modbus address space. It is a vendor-specific labeling convention that sits outside the two windows supported by Siemens. Entering 51281 in MB_DATA_ADDR produces no response, and entering 451281 in the 6-digit range also fails because the slave does not interpret the digit as a leading address class — it interprets it as a raw register number.

Root Cause Analysis

Modbus addressing conventions

The Modbus Application Protocol V1.1b3 defines function code 03 (Read Holding Registers) as operating on a 16-bit address space of 0 to 65535. The "4xxxxx" and "3xxxxx" prefixes that appear in legacy Modicon documentation are derived notations, not part of the protocol:

When a manufacturer publishes a register table with a 5xxxxx prefix, the physical PDU on RS-485 still carries function code 03 and a 16-bit starting address equal to the digits that follow the 5. Reference: Modbus Application Protocol Specification V1.1b3.

S7-1200 MB_MASTER address filtering

The Siemens SIMATIC S7-1200 Modbus master instruction (MB_MASTER, instruction catalog entry "Communication → Communication processor → MODBUS (RTU)" in TIA Portal) implements the 4xxxxx / 400001-465535 boundary as a hard pre-validation on the MB_DATA_ADDR input. Out-of-range values cause the instruction to return STATUS = 0x0001 or stay in BUSY indefinitely depending on firmware revision. Reference: SIMATIC S7-1200 Programmable Controller System Manual, section "MODBUS (RTU)".

Socomec E34 register map

The Countis E3x product family (E30, E31, E32, E33, E34) exposes energy and instantaneous measurements in a contiguous block. The relevant 5xxxxx range is the metered-value block:

Always cross-check the latest register table in the Socomec Countis E3x product page documentation, as register layouts can be revised across firmware builds.

Resolution: Configure Function 03 with the Offset

The fix is to treat the trailing digits of the 5xxxxx label as the wire-level offset and pass that offset to MB_MASTER using the standard 4xxxxx window. The trailing five digits are the offset; the leading "5" is discarded by the slave firmware when the request arrives with function code 03.

Step 1: Verify the physical link

1. Insert a CM 1241 RS-485 (6ES7241-1CH32-0XB0) or CM 1241 RS232 (6ES7241-1AH32-0XB0) into the S7-1200. The CPU 1211C/1212C/1214C/1215C all support a single CM module without a signal board, while the CPU 1217C and the CPU 1215C DC/DC/DC with signal board can use a second RS-485 port.
2. Wire A+ to A+, B- to B-, and tie the shield to ground at one end only. The Socomec E34 exposes its RS-485 terminals on the bottom of the meter; pin-out is documented in the Countis E3x installation manual.
3. Confirm the meter is configured for Modbus RTU mode (not the default BACnet or proprietary mode). The E34 typically uses 9600 8N1, slave address 1, function code 03/06 enabled.

Step 2: Configure the CM 1241 port in TIA Portal

1. Open the device configuration of the S7-1200, double-click the CM 1241 RS-485, and set the port to RS-485 Half-Duplex (RS-485 2-wire).
2. Open the Properties → Port Configuration panel and enter the communication parameters to match the meter:

Step 3: Insert and parameterize the MB_MASTER instance

From the Instructions task card, navigate to Communication → Communication processor → MODBUS (RTU) and drag MB_MASTER into an FB or OB. The block version depends on the TIA Portal / CPU firmware combination:

Set the REQ, MB_MODE, MB_DATA_ADDR, MB_DATA_LEN, and DONE / BUSY / ERROR / STATUS bits as follows:

// Reading registers 51281-51286 (offsets 1280-1285) on slave 1
// Function code 03 = MB_MODE 0
// Use the 4xxxxx window by subtracting 40001 and adding the offset

MB_MASTER_DB.MB_MODE       := 0;          // 0 = FC03 read holding registers
MB_MASTER_DB.MB_SLAVE_ADDR := 1;          // Socomec Modbus address (default 1)
MB_MASTER_DB.MB_DATA_ADDR  := 41281;      // 4xxxxx notation: 40001 + 1280
MB_MASTER_DB.MB_DATA_LEN   := 6;          // 6 consecutive registers 51281-51286
MB_MASTER_DB.MB_DATA_PTR   := P#DB100.DBX0.0 BYTE 12; // 6 * 2 = 12 bytes
MB_MASTER_DB.REQ           := TRUE;       // Trigger on rising edge

Step 4: Use 6-digit notation on firmware ≥ V4.2

Newer S7-1200 firmware accepts the 6-digit form, where MB_DATA_ADDR is the raw address 1-based. The same register block becomes:

MB_MASTER_DB.MB_DATA_ADDR := 41281;   // 6-digit window: 400001..465535, address 41281

This is the cleanest fix and removes the manual offset arithmetic. Confirm the CM 1241 firmware is at the matching level — modules shipped before 2016 require the v2.x MB_MASTER to be downloaded from the Siemens Industry Online Support portal.

Step 5: Convert raw registers to engineering units

Each Socomec register is a signed 16-bit word. Energy values are 32-bit and split across two consecutive words (low word first, big-endian). The 12-byte buffer therefore produces 6 × 16-bit values; pairs combine into 3 × 32-bit energy totals in Wh / varh / VAh. Example conversion in SCL:

// Assuming DB100.DBD0..DBD11 holds the 12 raw bytes (3 DWords)
"energy_Wh_active"   := DWORD_TO_REAL(DB100.DBD0) / 1000.0;     // kWh
"energy_varh_react"  := DWORD_TO_REAL(DB100.DBD4) / 1000.0;     // kvarh
"energy_VAh_apparent":= DWORD_TO_REAL(DB100.DBD8) / 1000.0;     // kVAh

Byte order on the wire is big-endian (network byte order). The MB_MASTER instruction places the first word at the low byte of the configured buffer, so a manual word swap is required if the application expects little-endian DWords. Siemens provides a sample block, "MODBUS_SERIAL_INPUT_SWAP", in the TIA Portal example library.

Verification

On-line observation

1. Go online with the S7-1200 and open the MB_MASTER instance DB.
2. Force REQ := TRUE for a single scan and watch the control bits.
3. A healthy cycle shows REQ → BUSY := TRUE → DONE := TRUE within 50–150 ms at 9600 bit/s. STATUS = 0 indicates no error.
4. Watch the data buffer: DB100.DBW0..DBW10 should populate with non-zero values when the meter is energized.

STATUS code reference (MB_MASTER v2.x / v3.x)

Stand-alone slave simulation

Before connecting to a live meter, validate the S7-1200 program against a PC-side Modbus RTU slave. A free Windows tool such as the Simply Modbus RTU/ASCII Slave Tool lets you publish any register values on a virtual COM port that the CM 1241 can reach via a USB-to-RS-485 adapter. Configure the simulator for function code 03, addresses 1280–1285, and a few recognizable test values. This is the fastest way to distinguish a meter issue from a programming issue.

Alternative Architectures

Modbus gateway / protocol converter

If the application must also poll other slaves that use a non-standard address prefix, drop a Modbus-to-Modbus gateway (e.g. Phoenix Contact EEM-MA400, HMS Anybus X-gateway, or a programmable Moxa MGate) between the S7-1200 and the bus. The gateway exposes the 5xxxxx registers as standard 4xxxxx holding registers, including the ability to remap starting addresses. The S7-1200 code does not change.

Direct serial I/O via Send_Receive / Point-to-Point

For a single E34, the S7-1200 can drive the CM 1241 with the lower-level Send_Receive (PtP) instructions. This bypasses MB_MASTER entirely and lets you construct the function code 03 PDU byte-by-byte. The trade-off is loss of the Modbus CRC and inter-frame timing handled automatically by MB_MASTER; you must calculate the 16-bit CRC-16 (polynomial 0xA001) yourself. The advantage is full control over the address bytes and no filtering of out-of-range values.

Freeport mode with a third-party MODBUS library

Third-party S7-1200 Modbus libraries (e.g. the open-source OpenModbus project or vendor add-ons from Helmholz, Kunbus, or innuPixel) relax the address-window restriction. They communicate with the CM 1241 in freeport mode and offer a function code 03 block that accepts any 0–65535 address. Evaluate the maintenance and licensing implications before adopting in production.

Troubleshooting Matrix

Commissioning Checklist

• Confirm meter firmware supports Modbus RTU (E34 firmware ≥ 1.4 typically enables Modbus; earlier builds may default to BACnet MS/TP).
• Set unique Modbus address on the E34 faceplate menu (range 1–247).
• Match parity, baud, and stop bits between CM 1241 and E34.
• Install a 120 Ω termination resistor at each end of the RS-485 trunk; remove any on intermediate nodes.
• For cable runs over 200 m, lower the baud to 9600 or 19200 bit/s.
• Compute offsets once and store them in constants to avoid arithmetic errors in repeated MB_MASTER calls.
• Capture a Modbus trace (free tools: Modbus Poll, Simply Modbus) to confirm the byte sequence on the wire before the S7-1200 is even powered.

FAQ