Problem Overview
The SITRANS FC410 Coriolis flowmeter from Siemens operates as a Modbus RTU slave on its RS485 port. Operators integrating it with an AutomationDirect PLC (Do-more, BRX, Click, Productivity, or DirectLOGIC family) frequently succeed with read transactions but immediately fail every write transaction with Modbus exception code 04 – SLAVE DEVICE FAILURE. Read-only coils and input registers (function codes 01/02/03/04) return correct process values, yet function codes 05, 06, 15, and 16 are rejected regardless of the target register or the data type (UINT16, INT16, UINT32, FLOAT32).
The exception response is the slave's way of reporting an internal application error. Per the FC410 Modbus Operating Instructions (function code 0x84 definition), exception 04 maps to one of three internal conditions:
- Application-level error inside the FC410 firmware.
- The requested value is outside the parameter min/max range.
- The parameter is write-protected at the current access level.
Because writes fail on every register attempted — including Boolean toggles (0/1) and parameters clearly within published range — the third condition, write-protection, is the actual root cause. The FC410 ships in a logged-out state that prevents any Modbus write, even though the published Modbus register map marks most configuration registers as read/write.
4 (logged out) regardless of the write attempt.
Root Cause Analysis
The FC410 implements a multi-level access model inherited from the SIMATIC PDM (Process Device Manager) commissioning workflow. Until the user is authenticated, the slave rejects every configuration write at the firmware layer before the Modbus stack can apply the value — and it does so by returning exception 04 rather than a more specific code.
The documented access-level register is (4)0404. Per the FC410 Modbus Operating Instructions, writing the value 32 (0x0020) should log the user in at the standard user level. In practice, two manual errors make this path unusable from a generic Modbus master:
- Manual error #1 (length): Register (4)0404 is documented as a 4-byte (long integer) register. The actual implementation is a 2-byte unsigned register. Attempting a 16-bit write succeeds at the Modbus layer, but the firmware rejects it because of the access state.
- Manual error #2 (direction): Register (4)0404 is documented as read/write. The actual implementation is read-only; it only reports the current access level. The control path is a different register.
The PIN entry register — which enables Modbus writes after the user supplies the correct passcode — is not documented in the Modbus register map at all. Siemens' commissioning path normally uses SIMATIC PDM, where the wizard prompts for the PIN 2457 on first connection. That wizard step does not surface in the Modbus register table, so engineers integrating the meter with third-party masters (AutomationDirect, Beckhoff, Schneider, Red Lion, etc.) hit an undocumented gate.
Prerequisites
Confirm the following before applying the write-access procedure:
| Item | Specification |
|---|---|
| Firmware | FC410 firmware 4.0 or later (Modbus register map version current with operating instructions A5E33120874-AC) |
| Physical layer | RS485, 2-wire half-duplex, common with shield grounded at one end only |
| Default serial parameters | 19200 baud, 8E1 (8 data bits, even parity, 1 stop bit), Modbus RTU |
| Default slave address | 1 (configurable, see register (4)0600 group) |
| Termination | 120 Ω at both ends of the RS485 trunk, none on stubs |
| Default PIN | 2457 (Siemens factory default for user-level access) |
| Master tool | Any Modbus RTU master capable of function codes 03, 06, and 16 (e.g., Do-more with MODBUSWR instruction) |
Refer to the official SITRANS FC410 Modbus Operating Instructions (A5E33120874-AC, 02-2016) and the FC410 Operating Instructions from firmware 4.0 for the canonical register list.
Resolution Procedure
Step 1 – Verify Read Health
Before any write attempt, confirm that reads work. Read input register (4)0404 (access level). Expected value: 4 (logged out). Read input register (4)0527 (float transmission example per section 7.10) to verify the byte order the meter is presenting on the wire.
Step 2 – Write the PIN to Register 412
Send a Modbus function code 06 (Write Single Register) or function code 16 (Write Multiple Registers) to the secret PIN register:
- Register: (4)0412 — not documented as a PIN register in the published map.
- Data type: 2-byte unsigned integer (UINT16).
-
Value to write:
2457decimal (0x0999 hex). -
Byte/word order on wire: high byte first (
0x09 0x99) per standard Modbus big-endian register ordering.
An AutomationDirect Do-more example ladder block:
// STR000 - Unlock FC410 write access
// MR000 = slave address (typically 1)
// MR001 = function code (16 = preset multiple)
// MR002 = starting register (412)
// MR003 = quantity of registers (1)
// MD004 = write data (UINT16 value 2457 = 0x0999)
MODBUSWR MR000 MR001 MR002 MR003 MD004Step 3 – Verify Login
Immediately after the PIN write succeeds, read holding/input register (4)0404. The expected value is now 32 decimal (0x0020), indicating Standard User access. If the value is still 4, the PIN write returned no exception but did not authenticate — typically because of a byte-order mismatch on the master side.
Step 4 – Perform the Intended Configuration Write
Now execute the original write (e.g., changing a scaling factor, unit, or damping value) using function code 06 or 16. The FC410 will accept the write and return a normal response (no exception).
Step 5 – Lock the Meter When Finished (Recommended)
To return the meter to a logged-out state and prevent inadvertent Modbus tampering, write 0 to register (4)0412. The access-level register (4)0404 will return to 4.
Modbus Register Reference (Affected Map)
| Register | Name | Documented | Actual | Data Type | Notes |
|---|---|---|---|---|---|
| (4)0404 | Access level | Read/Write, 4-byte | Read-only, 2-byte UINT | UINT16 | Returns 4 (logged out) or 32 (logged in). Cannot be written to authenticate. |
| (4)0412 | PIN / passcode | Not documented | Write, 2-byte UINT | UINT16 | Write 2457 to enable Modbus writes; write 0 to disable. |
| (4)0527 | Float transmission example | Read, 4-byte FLOAT | Same | FLOAT32 | Reference register for byte-order diagnostics (section 7.10). |
| (4)0600 | Communication restart | Read/Write | Read/Write, requires reset | UINT16 | Modbus parameter changes (address, baud, parity) require a comm restart sequence. |
Byte Order and Data Length Diagnostics
Field experience shows that even after the PIN path is understood, AutomationDirect masters can still trip exception 04 if the integer width does not match the slave's expectation. Confirm the following before declaring the integration complete:
-
Read (4)0404 and decode the raw bytes. Expected hex for logged-out:
00 04(big-endian UINT16) or04 00(little-endian / word-swapped). For logged-in:00 20or20 00. -
For any 4-byte parameter (FLOAT32 or INT32), the FC410 follows the standard Modbus byte order: high word first, high byte first within each word. A value of
32as a 4-byte long integer appears as00 00 00 20. - Cross-check with a known reference. Use a USB-to-RS485 converter and a tool such as Modscan32 to read (4)0404 in different display formats (UINT16, INT16, HEX) and confirm what the master is transmitting matches the slave's order.
- Use the float example register (4)0527 as a calibration source. Its published value lets you derive the FC410's exact register endianness against your master's byte-swap settings.
AutomationDirect Master Configuration Notes
AutomationDirect's PLC families each handle Modbus differently. The recommended patterns for the FC410 are:
| Platform | Function Code | Instruction | Key Parameter |
|---|---|---|---|
| Do-more (BRX) | FC06 / FC16 | MODBUSWR | Set Length to 2 bytes for single-register writes; ensure the source element is a UINT location (e.g., D0), not a 32-bit DF. |
| Productivity | FC06 / FC16 | MRX/MWX with Function = Write |
Use Memory Type = Holding Register, Data Type = UINT16 for register 412. |
| DirectLOGIC 06 | FC06 | RX/WX | Disable byte swap on the element holding 2457; transmit 0x0999. |
| Click | FC06 | MBX client | Use a 16-bit source element; Click's MBX does not perform word swapping on single-register writes. |
DF) to write to a 16-bit Modbus register causes the master to transmit two registers. The FC410 sees garbage in the second register and returns exception 04. Always use a 16-bit source (D) for register 412 and for any single-register UINT16 write.
Verification
After login, perform a no-op round-trip to prove write access end-to-end:
- Read (4)0404 — confirm value
32. - Write a benign value (e.g., a damping register or a tag string register) using function code 16.
- Read the same register back and confirm the new value.
- Write
0to (4)0412 to log out. - Read (4)0404 — confirm value
4. - Attempt the benign write again — expect exception 04 again, confirming write protection is restored.
If step 3 returns the new value, the integration is correct. If step 6 still accepts the write, the FC410 firmware revision retains Modbus write access across PIN-locking — escalate to Siemens support with the firmware version printed on the meter nameplate.
Related Siemens Application Notes
For S7-1200/1500 integration, Siemens publishes two complementary references that demonstrate the PIN pathway inside TIA Portal:
- Connection of the flowmeter SITRANS FC410 to a CPU S7-1200 via Modbus RTU — full wiring and MB_MASTER block configuration.
- SITRANS FC410 TIA Portal Getting Started (V1.1) — example code for read/write transactions from a SIMATIC controller.
- SITRANS FC410 Service Tool — KB article on direct RS485 connection for the Siemens service utility.
Troubleshooting Matrix
| Symptom | Likely Cause | Corrective Action |
|---|---|---|
| Exception 04 on every write | FC410 logged out; access-level register 404 reads 4 | Write PIN 2457 to register 412 (UINT16), then re-read 404 (expect 32) |
| Exception 04 after PIN write | Byte/word order mismatch on master | Verify master transmits 0x09 0x99; read 404 with Modscan32 to determine endianness |
| Exception 04 with wrong data length | Master writing 32-bit element to 16-bit register or vice versa | Match data width: UINT16 for register 412 and 404; FLOAT32 only for float parameters |
| Exception 02 (Illegal Address) | Register out of FC410 supported range | Cross-check address against Modbus map; section 7 of FC410 OI |
| Exception 03 (Illegal Value) | Parameter value outside min/max | Read parameter min/max from documented range; clamp write value |
| Reads work, writes work, but changes don't persist | Communication restart not issued after baud/address change | Cycle bit at register (4)0600 per section 7 of FC410 OI |
| PIN write accepted, but 404 still reads 4 | Firmware revision below 4.0 or corrupted session | Update firmware; power-cycle meter; retry PIN write |
| Slave does not respond at all | RS485 wiring or termination issue | Verify A/B polarity, single ground reference, 120 Ω terminators at ends |
Field-Commissioning Sequence
The recommended end-to-end bring-up sequence for a third-party Modbus master is:
- Confirm wiring and termination using a loopback test from the master.
- Read (4)0001 or any published process value to validate the Modbus session.
- Read (4)0404 to confirm logged-out state (value 4).
- Write PIN 2457 to (4)0412 (UINT16, function code 06).
- Read (4)0404 — confirm 32.
- Write intended configuration parameters using function code 06 or 16.
- Read back each parameter to confirm persistence.
- Write 0 to (4)0412 to log out.
- Record the meter's firmware version and any deviations from the manual for the as-built documentation package.
For long-term installations, consider wrapping the PIN write inside a PLC startup routine guarded by a one-shot so that the meter is logged in only on cold start and only for the duration of the commissioning write block.
Documented Manual Errors (For Engineering Records)
The following discrepancies between the published SITRANS FC410 Modbus Operating Instructions and the meter's actual firmware behavior have been verified in the field. Engineers integrating the FC410 should treat this list as authoritative until Siemens issues a manual revision:
- Register 412 absent: The PIN/passcode register is not listed in the Modbus register map at all. It is a 2-byte unsigned register; writing 2457 enables Modbus write access.
- Register 404 direction: Documented as read/write; actually read-only.
- Register 404 width: Documented as 4 bytes (long integer); actually 2 bytes (UINT16).
- Pin disable path: Writing 0 to register 412 disables write access. This behavior is consistent with the PIN enable path but is also undocumented.
FAQ
Why does my SITRANS FC410 reject every Modbus write with exception 04?
The meter is in the logged-out state, which write-protects every configuration register. Write the PIN value 2457 (UINT16) to Modbus register (4)0412 to authenticate as a standard user; verify by reading (4)0404 and confirming a value of 32.
Is Modbus register 412 documented in the FC410 manual?
No. As of the A5E33120874-AC Modbus Operating Instructions (02-2016), register 412 is not in the published Modbus register map. Siemens' PDM commissioning wizard prompts for PIN 2457 interactively, but the Modbus pathway is undocumented and requires this workaround.
What is the correct data type for the PIN value 2457?
UINT16 (2 bytes). Do not transmit it as a 32-bit long integer; the master must write a single 16-bit register. The on-wire bytes are 0x09 0x99 in standard Modbus big-endian register order.
Can I read register (4)0404 to confirm the login worked?
Yes. Read (4)0404 immediately after writing the PIN. A return value of 32 (0x0020) confirms standard-user access; a return value of 4 confirms the meter is still logged out and the PIN write did not authenticate.
How do I log out the FC410 after configuration writes?
Write 0 to register (4)0412. The meter will re-enter the logged-out state and (4)0404 will return to a value of 4. Subsequent configuration writes will return exception 04 until the PIN is re-entered.
Do Modbus communication parameter changes require a restart?
Yes. After changing baud rate, parity, or slave address through the (4)0600 register group, issue the documented communication restart sequence. Without it, the new parameters do not take effect and the master may lose the session.