Troubleshooting Modbus RTU to PROFIBUS DP Gateway Byte Swapping and Communication in PCS 7

When third-party Modbus RTU devices (such as energy meters or power analyzers) communicate with an S7-400/CPU 410-5H controller via an RS-485 to PROFIBUS DP gateway (such as Moxa MGate 5105 / 4101 series) and the gateway appears online but process values show zeroes or astronomical numbers in PCS 7, the problem is caused by Endianness and byte-order misalignment. Modbus RTU slaves commonly format 16-bit registers and 32-bit floating-point data in Little-Endian (Intel) format, whereas SIMATIC S7 controllers operate strictly in Big-Endian (Motorola) format. Enabling the 'Byte Swapping' and 'Word Swapping' options in the Moxa gateway configuration software aligns the register byte stream, immediately restoring accurate process values in PCS 7.

Serial Modbus to PROFIBUS Gateway Architecture in SIMATIC PCS 7

In industrial facilities, power distribution switchgear and electrical substations frequently incorporate multi-function digital energy meters (such as L&T, Schneider Electric, or Siemens PAC3200) communicating over two-wire RS-485 serial using the Modbus RTU protocol. To integrate these electrical telemetry parameters (voltage, current, active power, power factor) into a SIMATIC PCS 7 automation system (CPU 410-5H 6ES7410-5HX08-0AB0), engineers install protocol gateways such as the Moxa MGate series (MGate 4101-MB-PBS / MGate 5105-MB-EIP).

The gateway acts as a Modbus RTU Master on the serial RS-485 side, continuously polling holding registers from energy meters, and acts as a standard PROFIBUS DP Slave on the DCS side. The gateway maps polled serial registers into cyclic input bytes defined by its GSD file in STEP 7 HW Config.

The Endianness Dilemma: Big-Endian S7 vs Little-Endian Modbus

A pervasive challenge in serial gateway integration is the discrepancy between binary byte representations:

SIMATIC S7 Architecture (Big-Endian / Motorola):
- Stores the Most Significant Byte (MSB) at the lowest memory address.
- In a 16-bit integer, Byte 0 is MSB and Byte 1 is LSB.
- In a 32-bit IEEE 754 float, Word 0 is Most Significant and Word 1 is Least Significant.
Modbus Slave Architecture (Little-Endian / Intel / Mixed):
- Many electrical meters store registers with the Least Significant Byte first, or transmit 32-bit floats with Word 1 preceding Word 0 (Word Swapped).

When an engineer inspects raw data using a PC-based Modbus scanner (e.g. ModScan or QModMaster), the PC software automatically adapts to x86 Intel byte order and renders the reading correctly (e.g. 415.2 V). However, when that identical register stream is passed unswapped to the S7 CPU, the controller reads the sign and exponent bits in reverse order, interpreting the value as 0.0, NaN (Not a Number), or an astronomical exponent (1.24e-38).

Comparison of Data Formats and Byte Swapping Configurations

The following table compares different byte ordering conventions across 32-bit floating-point telemetry:

Format NameByte SequenceTypical SystemsS7 Interpretation Without SwappingBig-Endian (Motorola)[A] [B] [C] [D]SIMATIC S7-300, S7-400, CPU 410-5HNative / Correct ValueLittle-Endian (Intel)[D] [C] [B] [A]Windows PC, Intel microcontrollersComplete numerical corruption (NaN)Byte-Swapped Big-Endian[B] [A] [D] [C]Serial Modbus RTU meters (L&T, Janitza)Zeroes or inverted integer registersWord-Swapped (Mid-Little)[C] [D] [A] [B]Modicon Modbus, power transducersExtremely large or microscopic exponentsGateway RemedyEnable Byte Swap + Word SwapMoxa MGate / Anybus / Siemens GatewayRe-aligns stream to [A][B][C][D] for S7

Step-by-Step Procedure to Configure Moxa Gateway and Read Energy Meters

Follow this procedure to configure byte swapping and read energy meters accurately in PCS 7:

Configure Serial Parameters in Gateway Management Tool:
- Launch Moxa MGate Manager connected to the gateway.
- Configure serial settings to match the energy meters: Baud rate (e.g. 9600 or 19200 bps), 8 Data bits, No parity, 1 Stop bit.
- Add Modbus polling commands: Read Holding Registers (Function 03) for Voltage, Current, and Active Power registers.
Enable Byte and Word Swapping in the Gateway:
- In the MGate Manager PROFIBUS I/O mapping table, locate the data mapping rules.
- Under Data Format / Conversion, check the box for Byte Swap (swaps adjacent bytes in 16-bit words).
- For 32-bit float parameters, also check Word Swap (swaps High Word and Low Word).
- Download the configuration to the Moxa gateway.
Configure PROFIBUS DP Slave in HW Config:
- In SIMATIC Manager HW Config, install the Moxa GSD file (Options -> Install GSD Files...).
- Add the Moxa gateway to the PROFIBUS DP master system, assigning its physical DP slave address.
- Configure modular I/O slots matching the gateway byte length (e.g., 4 Input Words for 2x 32-bit floats).
- Note the assigned peripheral input addresses (e.g. PID 512 and PID 516).
Read Data in CFC Using Channel Blocks:
- In CFC, connect PID 512 directly to input PV_In on Pcs7AnIn (FB1869) or use DWORD_TO_REAL cast to feed MonAnL (FB1845).
- Compile CFC changes and download to the controller.

Verification

Verify accurate telemetry in PCS 7:
1. Check the Moxa gateway diagnostic LEDs: verify that P1 (Serial) flashes green continuously and PROFIBUS LED is solid green.
2. In the CFC Editor, switch to Online test mode (Test -> Watch on).
3. Monitor the floating-point output representing grid voltage. Confirm that the value reads realistically (e.g., 415.2 V ±1%).
4. Compare the reading in PCS 7 directly against the physical LCD front display of the L&T energy meter. Confirm zero discrepancy.
5. Open the WinCC faceplate for MonAnL. Verify that electrical readings update smoothly with correct engineering units (V, A, kW).

Limitations and Operational Precautions

Serial Polling Latency: RS-485 serial buses operating at 9600 bps cannot support sub-second update times across dozens of meters. Stagger polling rates and query only essential electrical parameters to prevent serial bus timeouts.
RS-485 Termination and Bias: Modbus RS-485 networks require 120-ohm terminating resistors at both physical ends of the trunk cable. Ensure the termination dip switches on the Moxa gateway and the last meter are engaged.
Address Zero Offset: Some Modbus devices document registers starting from 1 (e.g. 40001), while others document raw hex offsets starting from 0 (e.g. 0x0000). Adjust the gateway starting register address by 1 if readings appear shifted by one parameter.

Engineer FAQ

Why does Mod-Scanner read the correct value on PC, but PCS 7 reads garbage?

Windows PCs run on Intel processors that utilize Little-Endian byte ordering, which matches the meter's output. SIMATIC S7 controllers utilize Big-Endian byte ordering. Without byte swapping in the gateway, the S7 CPU reads the bytes in reverse order, resulting in numerical corruption.

What is the difference between Byte Swapping and Word Swapping?

Byte Swapping reverses the two 8-bit bytes within a 16-bit register ([A][B] becomes [B][A]). Word Swapping reverses the two 16-bit words within a 32-bit floating point number ([Word 0][Word 1] becomes [Word 1][Word 0]). 32-bit floats often require both.

Can I perform byte swapping in CFC code instead of inside the gateway?

Yes, you can use CFC data conversion blocks or custom SCL code using the CAW (Change Any Word) instruction to swap bytes and words inside the S7 CPU. However, performing byte swapping directly in the gateway firmware is far more computationally efficient.