S7-300 CM PtP Modbus Master Configuration: FB640/FB641 Setup

Overview

Using a SIMATIC S7-300 CPU317 with a CM PtP communication module (order number 6ES7137-6AA00-0BA0 / SIPLUS 6AG1137-6AA00-0BA0) as a Modbus RTU master over RS485 is a common requirement when distributed ET 200S stations must poll third-party devices (inverters, energy meters, RTUs, IEDs) but the application still has to run on a classic S7-300 controller programmed with STEP 7 V5.5. The CM PtP does not natively implement the Modbus protocol; Modbus is delivered as a ready-made function block library (FB640 "MB_MASTER" and FB641 "MB_SLAVE") which the user calls from the application and which drives the CM PtP through the standard point-to-point system functions.

The most common cause of an apparently "non-working" configuration is the mismatch between the library target platform and the actual project platform. The example project published on the Siemens support site for "Modbus Master for S7-1500" cannot be imported into STEP 7 V5.5, and the S7-1500 FB blocks are not downward compatible. This article documents the STEP 7 V5.5 path specifically, with the correct library, parameterization, hardware setup, and verification steps.

Module Identification and Variants

The CM PtP used here is the SIMATIC ET 200S serial interface module, not a slot module that plugs into the S7-300 rack. It is installed in an ET 200S head station (IM151-1 with PROFIBUS or PROFINET interface) and addressed from the S7-300 CPU as distributed I/O. The relevant catalog numbers are:

The two-channel variant 6ES7137-6BD00-0BA0 is also available if a second independent serial port is required, but the FB library interface and configuration procedure described here apply identically.

Prerequisites

1. STEP 7 V5.5 with SP4 or later (SPx) installed, including the optional package "Modbus_Master_PtP" or "SIMATIC Modbus/USS Communication". This package is included on the STEP 7 DVD as an add-on library and is also available in the Siemens Knowledge Base as entry ID 75226762.
2. SIMATIC S7-300 CPU317-2 DP (or compatible) with sufficient work memory. The MB_MASTER instance DB consumes approximately 1 KB per channel.
3. ET 200S head module (IM151-1) with the CM PtP module plugged in and the correct terminal module (6ES7193-4CA40-0AA0 for the CM PtP slot).
4. STEP 7 GSD file for the ET 200S head module, imported via HW Config → Options → Install GSD File.
5. Front connector and a shielded RS485 cable, terminated at both ends with 120 Ω.
6. Modbus slave device with its user manual showing the register map, supported function codes, and default address (typically 1).

Hardware Configuration in HW Config

1. Open the S7-300 station in SIMATIC Manager → HW Config.
2. Insert the CPU317 onto rack 0, slot 2. Open its properties, set the MPI/PROFIBUS address as required.
3. Drag a DP master system from the catalog and place an IM151-1 STANDARD as a DP slave. Set its PROFIBUS address to a free value (for example, 3).
4. Open the IM151-1 and add a CM PtP (6ES7137-6AA00-0BA0) into slot 1 of the ET 200S station.
5. Double-click the CM PtP icon to open Properties → Parameter Assignment.

On the Protocol tab, set:

• Protocol selection = Modbus master (RTU) — this is critical; selecting "ASCII" or "RS232 transparent" will cause FB640 to return status 0x0001 ("wrong protocol") on the first call.
• Character delay = 4 ms (matches a 1-stop-bit, no-parity frame at 19200 baud; recalculate as (3.5 × bits-per-character) / baud for other rates).

On the Interface tab, set the physical layer to RS485 two-wire (half-duplex). Match baud rate, parity, data bits, and stop bits to the slave device, for example 19200, 8, E, 1.

Confirm the input/output address assignment — the CM PtP occupies 8 bytes of input and 8 bytes of output area as default; record the I/O start address because the library uses symbolic names that resolve to these addresses.

RS485 Wiring and Termination

The 20-pin front connector of the CM PtP has the following assignments when set to RS485:

Use a twisted pair with overall shield (for example Belden 9841 or equivalent), keep the segment under 1200 m at 19200 baud, and bond the shield to PE at the cabinet entry only — do not loop the shield through multiple devices.

Installing the Modbus Master Library

1. In SIMATIC Manager, open the Options → Install Library dialog.
2. Select the file Modbus_Master_PtP_Vxx.xx.zip (or the .ax variant) provided with the entry 75226762. The library must be the V5.5-compatible build; the V13/V14 TIA build will not register.
3. Open the library and copy the following objects into your S7 program under Program blocks:
   • FB640 — MB_MASTER (Modbus master, multiple instance capable)
   • FB641 — MB_SLAVE (Modbus slave, included for completeness)
   • UDT 600 — MB_MASTER_PARAM (data structure for the configuration DB)
   • UDT 601 — MB_MASTER_DATA (data structure for the data buffer)
4. Create a shared data block (DB640, recommended) of type MB_MASTER_PARAM. This DB holds static parameters such as the configured COM port, the response timeout, and the inter-frame delay.

FB640 "MB_MASTER" Interface

The block signature in STEP 7 V5.5 is:

CALL FB 640, DB_Master
REQ     := M0.0            // rising edge triggers a request
MB_ADDR := 1               // Modbus slave address (1…247)
MODE    := B#16#03         // function code: 0x03 = Read Holding Regs
DATA_ADDR := W#16#0000     // start address in slave (0-based)
DATA_LEN  := B#16#0A       // number of registers to read (10)
DATA_PTR  := P#DB10.DBX0.0 WORD 10 // pointer to 10-word buffer
DONE    := M10.0           // 1 cycle pulse on success
ERROR   := M10.1           // 1 = error detected
STATUS  := MW12            // extended status / error code
COM_RST := FALSE           // set TRUE to re-initialise on first run

Parameter reference:

Calling the Master in OB1

Place the call in OB1 (cyclic, free-running) or in a time-of-day OB. Do not call it in OB35 at 100 ms if the slave response timeout is shorter, because the block needs to service the next character within the character delay window. The reference call is:

// OB1 - Cyclic
      U     "StartPoll";     // boolean from HMI or sequencer
      FP    "HelpFlag";      // edge memory
      =     M     0.0;       // REQ trigger for FB640

      CALL "MB_MASTER", "Inst_Master_DB"
      REQ     :=M0.0
      MB_ADDR :=1
      MODE    :=B#16#3
      DATA_ADDR:=L#0
      DATA_LEN :=B#16#10
      DATA_PTR :=P#DB20.DBX0.0 BYTE 32
      DONE    :=M100.0
      ERROR   :=M100.1
      STATUS  :=MW102
      COM_RST :=FALSE

DB20 must be created first with at least 32 bytes (16 words) and named, for example, Slave_1_Input_Regs. The block copies the slave response into DB20 starting at byte 0; the application can then SCALE or process the registers as engineering units.

Multiple Slaves and Polling Sequence

Use one instance DB of FB640 per channel (not per slave). For multiple slaves, sequence the calls in OB1 by latching REQ of the next call on the DONE pulse of the previous one. A typical pattern for three slaves is:

// Slave 1 - 16 holding registers
      A     "Go_Slave1"
      FP    "E_S1"
      =     M     0.0
      CALL "MB_MASTER", "Inst_M1"   ...
      A     M    100.0        // DONE of slave 1
      S     "Go_Slave2"       // arm next call

// Slave 2 - 8 input registers
      A     "Go_Slave2"
      FP    "E_S2"
      =     M     0.1
      CALL "MB_MASTER", "Inst_M2"   ...
      A     M    101.0
      S     "Go_Slave3"

Diagnostics and STATUS Codes

The STATUS word of FB640 is the primary diagnostic channel. The most common values returned by the STEP 7 V5.5 build of the Modbus_Master_PtP library are:

Additionally the block stores the last Modbus exception code (the value the slave returns in the response) in the byte at offset 10 of the instance DB. Common slave exceptions are 0x01 (illegal function), 0x02 (illegal data address), 0x03 (illegal data value), and 0x06 (slave device busy).

Configuration DB (DB640 / MB_MASTER_PARAM)

The static parameters of the CM PtP channel are kept in a shared DB of type UDT 600. The default values for a 19200/8/E/1 master are:

Verification and Commissioning Checklist

1. Compile the S7 program and download to the CPU317. After download, set the CPU to RUN.
2. Open Monitor/Modify on the MB_MASTER instance DB and confirm that the static parameters match HW Config.
3. Force a rising edge on REQ and observe STATUS. The expected sequence is:
   • T+0: REQ = 1, STATUS = 0x0006 ("busy")
   • T+5..30 ms: STATUS = 0x0006 with DONE = 0
   • T+50..80 ms: DONE = 1 for one cycle, STATUS = 0x0000
4. Open the data DB in the Monitor view; the response data should appear at the pointer address.
5. Disconnect the slave cable to verify error path: STATUS should become 0x0E02 after the response timeout.
6. Reverse A and B at the master terminal to verify exception handling: STATUS should become 0x0E01 (framing error) or 0x0E02 (CRC error).
7. Check the SF LED on the CM PtP and on the IM151-1 head module. With the configuration correct, both SF LEDs should be off during normal operation.
8. Read the diagnostic buffer of the ET 200S head module: PLC → Module Information → Diagnostic Buffer. There should be no entries during healthy operation.

Troubleshooting Matrix

Limitations and Edge Cases

• Number of slaves per channel: FB640 can address up to 247 slaves sequentially, but the ET 200S CM PtP only supports one logical channel — polling many slaves means round-robin scheduling in the user program.
• Broadcast writes: MB_ADDR = 0 is supported only for function codes 0x05, 0x06, 0x0F, 0x10. The block returns 0x0002 if a read is attempted with address 0.
• Word/byte swap: Modbus registers are big-endian (MSB first). The MB_MASTER block does not swap; if the S7-300 application expects little-endian, swap each word in the application (for example by reading DB20.DBW0 with the two bytes reversed manually before SCALE).
• Concurrent calls: Calling the same instance DB of FB640 from OB1 and OB35 simultaneously is undefined and will corrupt the internal state. Use either a single call site or two separate instance DBs each with their own channel.
• CPU run/stop behaviour: A pending transaction is aborted on CPU STOP. The slave will not see a clean close; if the slave uses timeout-based error recovery, allow at least 5 seconds before restart.
• Hot-swapping the ET 200S: Re-inserting the CM PtP triggers a station failure. The MB_MASTER instance DB must be re-initialised by setting COM_RST := TRUE for one OB1 cycle after the ET 200S returns to RUN.

Standards and Conformance

The Modbus master implementation conforms to Modbus over Serial Line — Specification and Implementation Guide V1.02 (Modbus Organization, December 2006) for the RTU transmission mode. The CRC polynomial is 0xA001 reflected (CRC-16/MODBUS). Frame timing uses the standard 3.5 character inter-frame silence marker. The library does not support Modbus TCP (port 502); that requires a CP343-1 or an S7-1500 module with the dedicated Modbus TCP library, which is a different KB entry.

FAQ