S7-300 Modbus RTU Communication with Conzerv EM654 Energy Meter

Overview

This reference covers a complete Modbus RTU link between a Siemens SIMATIC S7-300 CPU (any 31x/31xC/31xT with a free serial port or expansion interface) and a Conzerv EM654 / EM6544 energy meter. The supported physical layer is RS-485 (2-wire half-duplex or 4-wire full-duplex depending on meter option), and the meter operates strictly as a Modbus slave. The S7-300 must therefore host a Modbus RTU master. Three hardware paths are viable on an S7-300:

1. CP 341 point-to-point module with the "Modbus master" loadable driver (license: 6ES7 341-1AH02-0AE0 dongle, sometimes supplied with the driver).
2. ET 200S Profibus-DP station with a 1SI 3964/ASCII module (6ES7 138-4DF01-0AB0) running the free Modbus master example project.
3. ET 200SP with a CM PTP communication module using the same Modbus master function block library.

The CP 341 path is the most common and is documented in detail below.

Prerequisites

STEP 7 → Communication driver installation

On the programming PC, install the SIMATIC Modbus Master RTU loadable driver from the supplied CD or download it via the Siemens Support portal entry referenced below. The driver installs the CP 341 parameter assignment tool and a library of FB/FC/UDT blocks: FB80 MODB_MAST, FB81 MODB_3WAY, FC V24_STAT, plus the UDT for job configuration.

Hardware Configuration of the CP 341

1. In HW Config (STEP 7 V5.5) or device configuration (TIA Portal), insert the CP 341 in the S7-300 rack. Double-click to open Properties → Parameter Assignment.
2. Select the protocol "MODBUS Master (RTU)"; the rest of the driver is wired automatically.
3. Set physical interface:
   • Protocol = RTU
   • Baud rate = 9600 bit/s (default for EM654); 19200 and 38400 supported on most firmware revisions
   • Parity = Even (EM6xxx default)
   • Data bits = 8; Stop bits = 1
   • Flow control = None (RS-485 is hardware-directed)
4. Set RS-485 transceiver mode to "Half-duplex (2-wire)" unless the meter is wired for full-duplex (4-wire).
5. Save and rebuild the HW configuration, then download to the CPU.

RS-485 Pin Assignment (CP 341)

Wire the back of the 9-pin Sub-D to the EM654x terminal block using a shielded, twisted 2-wire pair. Connect the shield to earth ground at the PLC cabinet entry point only to avoid ground loops.

Modbus Register Map (EM654x Series)

The EM654/EM6544/EM6434 expose all instantaneous and accumulated quantities as 32-bit IEEE-754 floating-point registers or as 16-bit signed/unsigned integers. The most useful subset:

Address 0x0000 returns the first parameter (multi-register read returns contiguous words). EM6xxx register addresses are 0-based; CP 341 Modbus master FB expects 1-based addresses—always add +1 in the job block.

PLC Program Structure

The CP 341 Modbus master driver supplies the MODB_MAST function block that must be called once per logical channel (one channel = one RS-485 line = one meter). A cyclic OB (OB1) invokes the block, while parameterization is done through an instance DB. Pseudocode in Structured Text:

// OB1 - cyclic poll of EM654 at slave address 1
// Read 12 holding registers starting at Modbus address 1 (hex 0x0000)
#JobDB.Slave   := 1;            // EM654 Modbus address
#JobDB.Function:= 3;            // Read Holding Registers
#JobDB.ReadStart:= 1;           // 1-based starting address (hex 0x0000 + 1)
#JobDB.ReadCount:= 12;          // 6 consecutive floats: V, I, P, Q, S, PF
#JobDB.WriteStart:= 0;
#JobDB.WriteCount:= 0;
#JobDB.Done    := 0;            // reset done flags each cycle
#JobDB.Error   := 0;

// Trigger handshake
IF "first_scan" THEN
    #JobDB.Request := TRUE;
END_IF;

"MODB_MAST_DB"(REQ      := #JobDB.Request,
              LADDR    := 256,             // CP 341 base address in HW Config
              DONE     => #JobDB.Done,
              ERROR    => #JobDB.Error,
              STATUS   => #JobDB.Status,
              JOB_DB   := #JobDB);

The job data block exports the response as a byte array of length 2·N registers. Convert the bytes into S7 REAL values using area pointers or a temporary block of type REAL with byte-swap because Modbus transmits Float32 big-endian while S7 is little-endian. Sample conversion:

// Convert 2 × 16-bit words to REAL with byte swap
#raw_word_1 := WORD_TO_INT(#resp[0]);
#raw_word_2 := WORD_TO_INT(#resp[2]);
#Voltage   := WORD_TO_REAL(SWAP_WORD(#raw_word_1, #raw_word_2));

FUNCTION FC_SWAP : REAL
VAR_INPUT
    W1, W2 : WORD;
END_VAR
VAR_TEMP
    b0, b1, b2, b3 : BYTE;
END_VAR
b0 := WORD_TO_BYTE(W2);  // low byte of high word → lowest address
b1 := WORD_TO_BYTE(SHR(W2,8));
b2 := WORD_TO_BYTE(W1);
b3 := WORD_TO_BYTE(SHR(W1,8));
// Assemble little-endian REAL
FC_SWAP := DWORD_TO_REAL(BYTE_TO_DWORD(b0, b1, b2, b3));
END_FUNCTION

Step-by-Step Commissioning Procedure

1. Verify wiring with a multimeter: resistance between D+ and D− should be ~120 Ω with both ends terminated, ~∞ if only one end terminated.
2. Power the meter; check the LED pattern: green RUN, no red COM-ERROR.
3. Set meter Modbus address using the front-panel keypad (Service menu → Address) or by writing to register 0x07D0 from a separate Modbus master tool (e.g., Modbus Poll, Schneider EBO, or any RS-485 scanner).
4. Install SIMATIC Modbus master loadable driver on the PG/PC.
5. In HW Config, insert CP 341 and parameterize for Modbus RTU master.
6. Compile and download HW configuration.
7. Generate the Modbus job DB and import the MODB_MAST source from the example project.
8. Insert the call into OB1; download the program.
9. Go online with the CPU, open the CP 341 diagnostic buffer, and monitor the CP 341 "Send/Receive" indicators.

Verification Checklist

CP 341 Modbus Master Status / Error Codes

Troubleshooting Matrix

Alternative Hardware: ET 200S 1SI Path

For installations that already include an ET 200S Profibus-DP slave station, the cheaper path is a 1SI module (6ES7 138-4DF01-0AB0) plus the free "Modbus Master" example for ET 200S 1SI from Siemens. The block library is functionally identical: FB121 Modbus_Master cycles one job per call, and the device is addressed by slot number rather than a logical address. A typical poll cycle of eight quantities runs at ~250 ms at 9600 baud.

If migrating to a newer SIMATIC platform, the ET 200SP CM PtP module (6ES7 137-6AA01-0BA0) supports Modbus master natively and integrates with TIA Portal V17+ without the legacy CP 341 driver.

Concrete Floating-Point Readback — Sample Ladder Implementation

Using Function Block Diagram style, the same conversion in graphical form:

• Network 1: Call MODB_MAST with the job DB.
• Network 2: When DONE=TRUE, extract two 16-bit words from the response data block and feed them into the byte-swap FC.
• Network 3: Move the REAL outputs into DB fields such as DB100.Voltage_LN, DB100.kW_Tot, and DB100.kWh_Tot.
• Network 4: Scale kW from W to kW with DIV_R by 1000.0.

For energy scaling the EM654 returns kWh directly; no scaling required.

Time and Watchdog Considerations

CP 341 Modbus master supports a configurable "response timeout" (default 3000 ms). At 9600 baud with 8N1 (here 8E1) framing, a request of 8 bytes + 0.25 char gap + slave turnaround + response of N·2 bytes takes roughly:

T ≈ (8 + N·2) × 10 / 9600 × 1.2 → ≈ 100 ms for a 20-word read

Cycle OB1 if your application is tight: invoke MODB_MAST in a time OB (e.g., OB35 at 100 ms) or use a self-resetting latch to prevent request retriggering faster than the slave can respond.

Reference Documents

• CP 341 manual and Modbus master RTU driver: see the Siemens "SIMATIC S7-300/S7-400 Loadable Driver for Point-to-Point CPs: MODBUS protocol, RTU format, S7 is master" entry in the Siemens Industry Online Support.
• Conzerv/Schneider EM6544 User Manual: see "Download User Manual - Schneider Electric" entry on the Schneider Electric product page for the PowerLogic EM-series meters.
• Siemens "Instructions for communication tasks (S7-300, S7-400, S7-1500)" reference: Siemens TIA documentation portal.
• ET 200S 1SI Modbus master example project: search "Modbus Master for ET 200S 1SI" in Siemens Industry Online Support.

Field-Proven Acceptance Test Procedure

1. Verify all addresses return non-zero status flags.
2. Compare 3-phase voltages against a calibrated reference meter; tolerance ±1%.
3. Apply a known 100 % load; record time, run for 30 minutes, compare integrated kWh against meter display ±0.5 %.
4. Disconnect and reconnect RS-485; verify automatic recovery within 5 s.
5. Disconnect termination at one end; verify status indicates "Intermittent, CRC errors" rather than full timeout.
6. Save diagnostic buffer from CP 341 and archive with the commissioning report.