S7-1200 Modbus Master: Addressing Slave ID 248 Workaround

The SIMATIC S7-1200 Modbus master instruction (MODBUS_MASTER) declares its MB_Unit_ID input as a BYTE in default installations of TIA Portal, which restricts the addressable range to 1–247. Field engineers regularly encounter third-party devices that ship from the factory with slave ID 248 pre-configured, and they cannot talk to the device until that ID is changed. Because changing the ID usually requires the vendor's PC tool, and the vendor tool itself needs a working Modbus link, the PLC programmer is stuck in a chicken-and-egg situation. This reference documents the three engineered paths out of that loop: the TIA Portal V15+ extended-range workaround, an external Modbus gateway/repeater, and a one-time peer-to-peer reconfiguration using the S7-1200 as a temporary Modbus slave.

1. Problem Summary

2. Why 1–247? The Modbus Addressing Rule

The Modbus Organization's MODBUS Application Protocol Specification V1.1b3, section 4.1 Protocol Description, defines the addressing field on the serial link as one byte (8 bits). The specification reserves:

• 0 – Broadcast address (master writes, slaves do not respond)
• 1–247 – Individual slave addresses
• 248–255 – Reserved (legacy use, not part of the public Modbus standard)

Siemens implements the Modbus RTU master in the S7-1200 to be a strict consumer of the Modbus specification. The MB_Unit_ID input is therefore a one-byte unsigned value, and Siemens validates the range to 1–247 in instruction run-time. Slave ID 248 is rejected because it falls outside the public protocol address space. Refer to the MODBUS Application Protocol V1.1b3 specification for the authoritative definition.

3. Siemens S7-1200 Modbus Implementation Details

3.1 Default Data Type Mapping (TIA Portal ≤ V14 SP1)

The legacy MODBUS_MASTER instruction installed from the S7-1200 program block library exposes the following parameter signature:

Because MB_ADDR is a BYTE, the maximum storable value is 255, but the instruction's run-time guard refuses any value outside 1–247. Slave ID 248 cannot be written into MB_ADDR without triggering a syntax warning at compile time, and the request never reaches the wire.

3.2 Error Codes You Will See at ID 248

4. Workaround 1 — TIA Portal V15+ Extended MB_Unit_ID Range

Starting with TIA Portal V15.0, Siemens widened the MB_Unit_ID input in the S7-1200 Modbus_Master instruction to a WORD / UINT data type, which lifts the engineering-time limit from 1–247 to 1–65535. The instruction still rejects 0 (broadcast is read-only in client mode) and the run-time error codes remain, but a value of 248 can now be passed legally through the FB parameter. This is the cleanest fix when you are licensed for V15 or later.

4.1 Prerequisites

• TIA Portal V15.0, V15.1, V16, V17, V18, V19 or later (Engineering in TIA Portal)
• S7-1200 CPU firmware V4.2 or higher (the older V4.0/V4.1 images still lock the type to BYTE)
• CM 1241 or CB 1241 with a fully wired RS-485 two-wire or RS-422 four-wire segment
• Termination resistor 120 Ω enabled at both physical ends of the trunk (DIP switch on CM 1241)
• Shielded twisted-pair cable, shield grounded at the cabinet entry only

4.2 Procedure

1. Upgrade the project. Open the project in TIA Portal V15+ and accept the CPU firmware upgrade prompt. Verify the CPU is at firmware V4.2+ via Online → Accessible Devices → Online & Diagnostics.
2. Insert the Modbus_Master instruction. From Instructions → Communication → Modbus (PtP), drag Modbus_Master (the post-V15 instance) into a new FB or OB1. Right-click the instance DB and confirm the FBG version is >= V6.0.
3. Inspect MB_Unit_ID. Open the block interface. Confirm the MB_Unit_ID input is now declared as WORD or UINT. Older instances keep BYTE; recompile to regenerate.
4. Wire the new parameter. Create a tag of type WORD in the global symbol table, e.g. "Slave_Unit_ID" = 16#00F8 (decimal 248). Connect it directly to the MB_Unit_ID input.
5. Configure the port. Open the CM/CB 1241 properties → Port Configuration and set the protocol to Modbus Master (RTU), baud, parity and stop bits to match the slave vendor spec (commonly 19200 / 8N1 or 9600 / 8E1).
6. Compile and download the hardware configuration and software to the CPU. The download re-initializes the PtP port.
7. Trigger a single Read Holding Registers (FC=03) request at address 0x0000, length 1. Monitor STATUS: it should return 16#0000 on DONE.

4.3 STL / SCL Reference Snippet

// SCL example, S7-1200 / TIA V17, MB_ADDR widened to WORD
"Modbus_Master_DB".REQ := Start_Trigger;        // BOOL pulse
"Modbus_Master_DB".MB_Unit_ID := 248;            // WORD, now legal
"Modbus_Master_DB".MODE := 0;                    // 0 = read
"Modbus_Master_DB".DataAddr := 16#0000;          // Holding register 0
"Modbus_Master_DB".DataLen := 1;                 // One register
"Modbus_Master_DB".DataPtr := P#DB1.DBX0.0 BYTE 2; // Target in DB1

If the project must remain on TIA V14 or earlier, the FB instance is locked to the BYTE type and the workaround above is unavailable. In that case, deploy Workaround 2 or 3.

5. Workaround 2 — External Modbus Gateway or Address Translator

Insert a third-party Modbus RTU-to-RTU address-translating gateway (also called a slave-multiplexer or ID-rewriting bridge) between the S7-1200 CM 1241 and the third-party device. The gateway acts as the slave at a compliant ID (for example, 10) on the S7-1200 side, and forwards traffic to the physical device at ID 248 on the field side, transparently rewriting the Unit ID byte. Popular families include the Anybus X-gateway Modbus RTU (HMS Industrial Networks), ProSoft Modbus Multiplexer, and the Wieland Electric Wienet RTU router.

5.1 Configuration Steps

1. Power the gateway and connect the upstream port to the CM 1241 (RS-485 A, B, GND).
2. Connect the downstream port to the third-party device's RS-485 terminals.
3. In the gateway's web/HMI configuration, set the upstream Unit ID (e.g. 10) and the downstream Unit ID (248).
4. Match baud rate, parity, character format, and inter-frame timeout on both sides. The inter-frame timeout must be ≤ 3.5 character times per the Modbus RTU spec.
5. From TIA Portal, set the S7-1200 MB_ADDR = 10 and proceed with normal MODBUS_MASTER calls. The gateway handles the ID rewrite silently.

6. Workaround 3 — One-Time Reconfiguration as Modbus Slave

Use the S7-1200 temporarily as a Modbus slave to write the desired address change directly to the third-party device. The instruction set in question is MB_SLAVE – Communicate using the PtP port as Modbus RTU slave. The MB_SLAVE instruction supports broadcast write requests from any Modbus master, so once the S7-1200 holds a generic master (also the same CPU using the MODBUS_MASTER block) it can reach the device at its factory address and rewrite the slave-ID holding register, after which the third-party device reboots at the new address and normal master polling resumes.

6.1 Step-by-Step Reconfiguration Procedure

1. Wire the CM 1241 RS-485 to the third-party device with bias and termination as per the Modbus standard.
2. Insert a Modbus_Master (V15+ type, see §4) into the S7-1200 program. Set MB_Unit_ID = 248.
3. Read the device's address-change holding register (vendor documentation, commonly register 0x07D0 with two-byte value). Verify the response: DONE = 1, STATUS = 16#0000.
4. Write the new address (e.g. 7) to that same register using MODE = 1 (write single register, FC=06) and DataPtr pointing at a data word = 7.
5. Cycle power on the third-party device. The new Unit ID takes effect on cold start per vendor firmware behavior.
6. Change the S7-1200 MB_Unit_ID tag to 7 (or whatever address the device was set to). Resume normal polling. The extended-range workaround from §4 is no longer required.

6.2 PLC Code Skeleton

// Step 1 - Read current slave ID register from device at Unit ID 248
IF First_Scan THEN
    Read_Req   := TRUE;
    Slave_ID   := 248;          // WORD, requires TIA V15+
    Mode_Read  := 0;            // Read
    Reg_Addr   := 16#07D0;      // Vendor-defined address register
    Reg_Len    := 1;
END_IF;

// Step 2 - When Read_Req_Done and the read value is, e.g., 248, write 7
IF Read_Req_Done AND Read_Data.Word = 248 THEN
    Write_Req  := TRUE;
    Mode_Write := 1;            // Write single register
    Write_Data.Word := 7;
END_IF;

// Step 3 - After Write_Req_Done cycle power to the slave (digital output).
IF Write_Req_Done THEN
    Slave_Power := FALSE;       // De-energize via DO
END_IF;

7. Choosing the Right Workaround

8. Verification Procedure

1. Watch table: Open Online → Watch & Force Tables in TIA Portal. Force MB_Unit_ID = 248 and trigger a read. Confirm STATUS = 16#0000, DONE = 1 within the configured Timeout (default 1000 ms).
2. Bus monitor: Use a Modbus protocol analyzer (e.g. Simply Modbus on a tap, or the in-built trace of HMS Anybus) to capture the byte stream. Verify the on-wire Slave Address byte is 0xF8 (decimal 248) and the CRC-16 matches.
3. Electrical check: With a scope on A and B, verify the differential voltage swing is > 1.5 V at the receiver under load. Half-duplex RS-485 must idle HIGH on A (–) and LOW on B (+) per TIA-485-A. Bias resistors 620 Ω pull-up on +5 V and pull-down on GND are required when the master is not actively driving.
4. End-to-end register test: Read a known holding register (for example 0x0000) and confirm the value matches the vendor documentation. Document the result in the SAT (Site Acceptance Test) report.
5. Failure mode test: Disconnect the slave. The STATUS must transition to 16#80C8 (timeout) within the configured Timeout value. Reconnect and verify auto-recovery to 16#0000 on the next REQ pulse.

9. Troubleshooting Matrix

10. Field-Proven Best Practices

• Always keep the vendor configuration tool in the cabinet. The day you have to swap the third-party device under failure conditions, the new unit will ship with the same default 248.
• Document non-standard Unit IDs in the project's P&ID and the PLC tag database. A simple comment field in the data block, e.g. // Unit ID 248 - vendor default, see SAT-2024-08, prevents the next engineer from wasting hours on the same issue.
• Escalate the deviation to the vendor. Cite the Modbus Application Protocol Specification V1.1b3 §4.1 and request a firmware update that defaults to a compliant ID (1–247). A polite non-conformance report often produces a fix in the next release.
• For multi-vendor RS-485 networks, always insert a gateway in front of legacy or non-compliant devices. It isolates the S7-1200 from bus faults and allows you to swap slaves without reprogramming the controller.
• Validate the entire bus with a Modbus scanner (Modbus Poll, QModMaster, or a portable Witte Analog RTU tool) before connecting the PLC. This confirms the slave is alive on its claimed address and saves the PLC's debug STATUS from being used as a general-purpose bus tester.

11. Glossary