Complete Guide to Modbus RTU Register Address Mapping for the Siemens S7-200 SMART PLC

1. Overview

When an S7-200 SMART PLC acts as a Modbus RTU master or slave, there is a fixed mapping relationship between its internal memory areas (I, Q, AIW, V) and the standard Modbus addresses. Based on Siemens' official technical documentation, this article explains the Modbus address mapping rules of the S7-200 SMART in detail, including complete address comparison tables, configuration steps, communication examples and a troubleshooting guide.

The S7-200 SMART supports two Modbus operating modes:

• Modbus RTU Master: actively initiates communication requests to read from or control slave devices
• Modbus RTU Slave: passively responds to the master's read/write requests

2. Modbus Address Type Description

The Modbus protocol defines four data areas, each with a fixed address range and function codes:

Modbus Address Area	Function Code	Read/Write	Data Type	Corresponding S7-200 SMART Memory Area
0xxxx (Coils)	01 (Read Coils) / 05 (Write Single Coil) / 15 (Write Multiple Coils)	Read/Write	Bit (1 bit)	Q area digital outputs
1xxxx (Discrete Inputs)	02 (Read Discrete Inputs)	Read-only	Bit (1 bit)	I area digital inputs
3xxxx (Input Registers)	04 (Read Input Registers)	Read-only	Word (16 bit)	AIW analog inputs
4xxxx (Holding Registers)	03 (Read Holding Registers) / 06 (Write Single Register) / 16 (Write Multiple Registers)	Read/Write	Word (16 bit)	V memory area (configurable)

Important note: Modbus addresses use 1-based numbering, i.e. counting starts from 1. PLC internal addresses are usually 0-based, starting from 0.

3. S7-200 SMART Modbus Address Mapping Table

3.1 Digital Output Area (Q Area) → 0xxxx Coils

The digital output Q area is mapped to the Modbus 0xxxx coil area and supports read and write operations.

Modbus Address	S7-200 SMART Address	Description
00001	Q0.0	Channel 0, bit 0
00002	Q0.1	Channel 0, bit 1
00003	Q0.2	Channel 0, bit 2
00004	Q0.3	Channel 0, bit 3
00005	Q0.4	Channel 0, bit 4
00006	Q0.5	Channel 0, bit 5
00007	Q0.6	Channel 0, bit 6
00008	Q0.7	Channel 0, bit 7
00009	Q1.0	Channel 1, bit 0
00010	Q1.1	Channel 1, bit 1
00011	Q1.2	Channel 1, bit 2
00012	Q1.3	Channel 1, bit 3
00013	Q1.4	Channel 1, bit 4
00014	Q1.5	Channel 1, bit 5
00015	Q1.6	Channel 1, bit 6
00016	Q1.7	Channel 1, bit 7
00017	Q2.0	Channel 2, bit 0
00018	Q2.1	Channel 2, bit 1
...	...	And so on; every 8 addresses correspond to one byte
00256	Q31.7	Maximum address (up to 32 bytes of outputs)

Calculation formula: Modbus address = channel number × 8 + bit number + 1

Example: to access Q2.3, Modbus address = 2×8 + 3 + 1 = 00020

Function codes:

• Read coil status: function code 01
• Write a single coil: function code 05
• Write multiple coils: function code 15 (0x0F)

Notes:

• The Q area address mapping is fixed and requires no additional configuration
• The number of Q points actually available depends on the CPU model and expansion modules
• If the corresponding Q point does not exist in hardware, the value read back is always 0

3.2 Digital Input Area (I Area) → 1xxxx Discrete Inputs

The digital input I area is mapped to the Modbus 1xxxx discrete input area and is read-only.

Modbus Address	S7-200 SMART Address	Description
10001	I0.0	Channel 0, bit 0
10002	I0.1	Channel 0, bit 1
10003	I0.2	Channel 0, bit 2
10004	I0.3	Channel 0, bit 3
10005	I0.4	Channel 0, bit 4
10006	I0.5	Channel 0, bit 5
10007	I0.6	Channel 0, bit 6
10008	I0.7	Channel 0, bit 7
10009	I1.0	Channel 1, bit 0
10010	I1.1	Channel 1, bit 1
10011	I1.2	Channel 1, bit 2
10012	I1.3	Channel 1, bit 3
10013	I1.4	Channel 1, bit 4
10014	I1.5	Channel 1, bit 5
10015	I1.6	Channel 1, bit 6
10016	I1.7	Channel 1, bit 7
10017	I2.0	Channel 2, bit 0
10018	I2.1	Channel 2, bit 1
...	...	And so on; every 8 addresses correspond to one byte
10256	I31.7	Maximum address (up to 32 bytes of inputs)

Calculation formula: Modbus address = 10000 + channel number × 8 + bit number + 1

Example: to access I3.5, Modbus address = 10000 + 3×8 + 5 + 1 = 10030

Function code: use function code 02 to read discrete inputs

Notes:

• The I area address mapping is fixed and requires no additional configuration
• Discrete inputs are read-only; the master cannot write to them
• The number of I points actually available depends on the CPU model and expansion modules

3.3 Analog Input Area (AIW Area) → 3xxxx Input Registers

The analog input AIW area is mapped to the Modbus 3xxxx input register area and is read-only.

Modbus Address	S7-200 SMART Address	Description
30001	AIW0	1st analog input channel
30002	AIW2	2nd analog input channel
30003	AIW4	3rd analog input channel
30004	AIW6	4th analog input channel
30005	AIW8	5th analog input channel
30006	AIW10	6th analog input channel
30007	AIW12	7th analog input channel
30008	AIW14	8th analog input channel
30009	AIW16	9th analog input channel
30010	AIW18	10th analog input channel
...	...	And so on, with a step of 2
30056	AIW110	56th analog input channel (maximum)

Calculation formula: Modbus address = 30000 + AIW number / 2 + 1

Example: to read AIW20, Modbus address = 30000 + 20/2 + 1 = 30011

Function code: use function code 04 to read input registers

Notes:

• AIW uses word addressing; each AIW occupies 2 bytes, so an address step of 1 corresponds to an AIW step of 2
• Input registers are read-only; the master cannot write to them
• The analog input value range is usually 0-32767 (unipolar) or -32768 to 32767 (bipolar)
• The number of AIW channels actually available depends on the number of channels of the analog module

3.4 V Memory Area → 4xxxx Holding Registers

The mapping of the V memory area is configurable, defined by two parameters of the Modbus slave instruction MBUS_INIT:

• HoldStart: the starting V address of the holding register area (e.g. &VB1000)
• MaxHold: the number of words in the holding register area (unit: word, i.e. the number of VW)

Mapping rules:

Modbus Address	S7-200 SMART Address	Description
40001	VW[HoldStart]	1st holding register
40002	VW[HoldStart + 2]	2nd holding register
40003	VW[HoldStart + 4]	3rd holding register
40004	VW[HoldStart + 6]	4th holding register
...	...	And so on, with a step of 2 bytes
400XX	VW[HoldStart + 2 × (XX - 1)]	The XXth holding register

Complete example: if HoldStart = &VB1000 and MaxHold = 100

Modbus Address	V Memory Address	Byte Range	Description
40001	VW1000	VB1000-VB1001	1st holding register
40002	VW1002	VB1002-VB1003	2nd holding register
40003	VW1004	VB1004-VB1005	3rd holding register
40004	VW1006	VB1006-VB1007	4th holding register
40005	VW1008	VB1008-VB1009	5th holding register
...	...	...	...
40100	VW1198	VB1198-VB1199	100th holding register (the last one)

Function codes:

• Read holding registers: function code 03
• Write a single register: function code 06
• Write multiple registers: function code 16 (0x10)

Notes:

• The V memory area mapping is configurable, set through the HoldStart and MaxHold parameters of the MBUS_INIT instruction
• HoldStart must point to a VB address, e.g. &VB1000
• The unit of MaxHold is the word (VW), not the byte (VB)
• The holding register area must not conflict with V memory already used in the PLC program
• If MaxHold is set to 100, it occupies VB1000-VB1199, a total of 200 bytes

4. PLC Slave Configuration Steps

4.1 Install the Modbus Slave Instruction Library

1. Open the STEP 7-Micro/WIN SMART programming software
2. Locate the "Libraries" folder in the instruction tree
3. If there is no Modbus Slave library, import it first: right-click "Libraries" → "Import Library" → select the Modbus Slave library file
4. The library file is usually downloaded from the Siemens official website and is named "Modbus Slave"

4.2 Call MBUS_INIT to Initialize the Slave

Call the MBUS_INIT instruction in the first scan cycle (SM0.1). The parameters are described below:

Parameter	Value Range	Description
Mode	0 / 1	0 = disable the Modbus slave and revert to an ordinary freeport; 1 = enable the Modbus slave
Baud	1200-115200	Baud rate; common values: 9600, 19200, 38400, 115200
Parity	0 / 1 / 2	Parity: 0 = none, 1 = odd, 2 = even
Port	0 / 1	Communication port: 0 = onboard RS485 port, 1 = RS485 port of the SB CM01 signal board
SlaveAddr	1-247	Modbus slave address; it must not be duplicated on the same bus
HoldStart	&VBxxx	Pointer to the starting V address of the holding register area, e.g. &VB1000
MaxHold	0-10000	Number of words in the holding register area (unit: word); e.g. 100 means 100 VW
Done	BOOL	Initialization-complete flag bit
Error	BYTE	Error code

4.3 Poll MBUS_SLAVE in the Main Program

The MBUS_SLAVE instruction must be called every scan cycle in the main program loop:

• This instruction handles requests sent by the Modbus master
• If it is not called, the slave cannot respond to the master
• Parameters: Done (complete flag), Error (error code)

4.4 Configure the V Memory Area Data

Store the data to be read/written in the V address area specified by HoldStart:

• Data written by the master is stored in this area
• The PLC program reads data from this area for processing
• Make sure it does not conflict with other V addresses already used in the program

5. PLC Master Configuration and Read Example

5.1 Call MBUS_CTRL to Initialize the Master

Call the MBUS_CTRL instruction in the first scan cycle (SM0.1) to initialize the Modbus master:

Parameter	Value Range	Description
Mode	0 / 1	0 = disable the Modbus master, 1 = enable the Modbus master
Baud	1200-115200	Baud rate; must match the slave
Parity	0 / 1 / 2	Parity; must match the slave
Port	0 / 1	Communication port: 0 = onboard RS485, 1 = signal board
Timeout	1-32767 ms	Timeout for waiting for the slave response; 1000 ms is recommended
Done	BOOL	Initialization-complete flag bit
Error	BYTE	Error code

5.2 Call MBUS_MSG to Issue Read/Write Requests

The MBUS_MSG instruction is used to issue one Modbus read/write request:

Parameter	Value Range	Description
First	BOOL	First-execution pulse; the request is issued when a rising edge is detected
Slave	1-247	Slave address
RW	0 / 1	0 = read request, 1 = write request
Addr	Modbus address	The Modbus address to access; e.g. 40001 means the 1st holding register
Count	1-120	Number of registers/coils to read or write
DataPtr	&VBxxx	Pointer to the data buffer, e.g. &VB2000
Done	BOOL	Completion flag for this request
Error	BYTE	Error code

5.3 Example: Reading Holding Registers

Suppose you want to read 10 holding registers (40001-40010) from the slave device at address 1:

1. First: trigger with a pulse signal
2. Slave: 1
3. RW: 0 (read)
4. Addr: 40001
5. Count: 10
6. DataPtr: &VB2000

After a successful read, the 20 bytes starting at VB2000 contain the data of the 10 registers.

6. FAQ and Troubleshooting Guide

6.1 No Communication Response; the Slave Does Not Reply

• Check the wiring: whether the RS485 A+ and B- are reversed — this is the most common mistake
• Check parameter consistency: the baud rate, data bits, stop bits and parity of master and slave must be exactly the same
• Check the slave address: whether SlaveAddr is correct; there must be no duplicate addresses on the bus
• Measure the bus voltage: the A line (D+) should be about 200 mV or more above the B line (D-)
• Check the termination resistor: whether 120 Ω termination resistors are fitted at both ends of the bus (needed over long distances)
• Check the Port parameter: whether the correct communication port (0 or 1) is selected

6.2 Data Cannot Be Read or the Data Is Incorrect

• Check the address format: Modbus addresses come in 1-based and 0-based forms; distinguish them carefully
• Check HoldStart: confirm that the holding register start address is set correctly
• Check MaxHold: confirm that the number of holding registers is sufficient
• Check the address range: whether the address to read lies within the range defined by MaxHold
• Check the byte order: whether the high/low word order of 32-bit data matches the master

6.3 Garbled Data or Incorrect Values

• Check the data format: confirm whether it is a 16-bit integer, 32-bit integer or floating-point number
• Check the byte order: whether Big-Endian and Little-Endian are consistent
• Check the word order: whether the high/low word order of 32-bit data is correct
• Check the scaling: whether a multiplier is needed (e.g. values in 0.1 °C units must be divided by 10)
• Check negative-number handling: negative numbers are represented in two's complement; note the difference between signed and unsigned numbers

6.4 Intermittent Communication Failures

• Check the shielded cable: whether shielded twisted-pair cable is used for the RS485 line and whether the shield is grounded at one end only
• Check the bus length: maximum 1200 m at 9600 bps, about 100 m at 115200 bps
• Check the number of slaves: one RS485 bus can carry at most 32 slaves (without a repeater)
• Check electromagnetic interference: whether the communication cable runs parallel to power cables or there is an interference source
• Check the timeout setting: whether the Timeout parameter is set too small; try increasing it appropriately

6.5 Error Code Description

Error Code	Description	Solution
0	No error	-
1	Parity error	Check the parity setting
2	Baud rate not supported	Check the baud rate parameter
3	Timeout error	Check wiring, slave power and timeout setting
4	Slave address error	Check the SlaveAddr parameter
5	Acknowledgement not received	The slave does not respond; check wiring and parameters
10	Gateway error	Check the gateway configuration

7. Summary

The Modbus address mapping rules of the S7-200 SMART are clear and straightforward:

• 0xxxx coil area → corresponds to the Q area digital outputs, read/write
• 1xxxx discrete input area → corresponds to the I area digital inputs, read-only
• 3xxxx input register area → corresponds to the AIW analog inputs, read-only
• 4xxxx holding register area → corresponds to the V memory area, configurable, read/write

Once you master this mapping relationship, you can quickly implement Modbus RTU communication between an S7-200 SMART and third-party devices. In practice, it is recommended to first test the communication with debugging software such as Modbus Poll, and write the PLC program only after confirming that the address mapping is correct.

8. Related Links

• Modbus RTU communication basics tutorial
• Detailed explanation of Modbus function codes
• Siemens S7-200 SMART Modbus master configuration example
• RS485 bus wiring specification