Home / Knowledge Base / PLC & Controllers

How to Fix the Codesys Modbus Byte Swap Issue (U16 to S32)

PROTOCOL: MODBUS RTU / TCP Applies to: Codesys V3.5, Wago, Schneider, Beckhoff, Eaton
⚡ TL;DR Diagnostic Quick-Card
Symptom:
Good Modbus communication, but 32bit floats (REAL) or DWords read large, garbled or negative numbers (e.g., 2.45e-41).
Data Types:
Affects S32, Float32 (IEEE 754), DWord, REAL.
Root Cause:
MODBUS protocol only supports 16-bit WORDs. The field device and Codesys disagree about the Endianness (byte sequence) of the two combined 16 bit words.
↓ Step 1: Identify Endianness ↓ Step 2: The Bitwise ST Fix ↓ Step 3: Zero-Code Hardware Parsing

When integrating third-party energy meters or inverters into a PLC, the Codesys Modbus byte swap swap is an unavoidable rite of passage. You make the connection just fine but instead of a clean 230.5V your monitoring variable shows garbage value like 324560001.5e-41 astronomically

Codesys Variable Watch / Symptom
Variable:        Type:    Value:
Raw_Reg_1        WORD     16#4366
Raw_Reg_2        WORD     16#8000
Combined_Value   REAL     2.45e-41  (Expected: 230.5)

This is not a wiring issue; it is an Endianness mismatch. The Modbus protocol inherently only defines 16-bit registers (WORDs / U16). It completely lacks standardization for how 32-bit data (DWORDs, REALs, or S32) should be sequenced. When the field device transmits a 32-bit value split across two registers, Codesys reconstructs it based on its native architecture (usually Little-Endian). If the field device is Big-Endian, the High Word and Low Word get reversed.

Step 1: Identify the Byte Order

Before writing any code, you must determine what the field device is actually sending. There are four possible byte sequence combinations for a 32-bit float: ABCD, CDAB, BADC, and DCBA.

The Most Common Scenario: Word Swap (CDAB)

Roughly 90% of industrial power meters (like Eastron) and solar inverters transmit data in a Big-Endian Word Swap format (CDAB). This means the bytes inside each WORD are correct, but the two WORDs themselves are reversed. You simply need to swap Register 1 with Register 2.

Step 2: The Structured Text (ST) Solution

In Codesys, you can safely reconstruct the 32-bit value using bitwise operations (SHL and OR). Read the raw Modbus data into an array of WORDs, and then combine them into a DWORD.

💻 Codesys ST Template: Float32 Byte Swap Open-Source Reference
// Variables Declaration
VAR
    ModbusData : ARRAY[0..1] OF WORD; // Data pulled from Modbus
    Swapped32Bit : DWORD;             // The corrected 32-bit variable
    FinalFloat : REAL;                // Final human-readable value
END_VAR

// ST Code: Word Swap (Low Word first, High Word second)
// Convert WORD to DWORD, shift the High Word 16 bits left, and merge.
Swapped32Bit := (WORD_TO_DWORD(ModbusData[1]) SHL 16) OR WORD_TO_DWORD(ModbusData[0]);

// STRICT RULE: Do not use REAL_TO_DWORD! Use ADR/POINTER mapping for raw bits.
SysMem.SysMemCpy(ADR(FinalFloat), ADR(Swapped32Bit), SIZEOF(FinalFloat));
💡 Critical Memory Rule: Never process IEEE 754 floats with math operators (e.g. multiplication) or conversion blocks (e.g. DWORD_TO_REAL). This will corrupt the mantissa and the exponent logic. Use bitwise shifts and direct memory pointer copies (SysMemCpy) always..

Executing this ST block will reconstruct the raw hexadecimal segments into the correct 32-bit format, instantly converting your garbage numbers into readable data.

The Reality of Large-Scale Integrations (CPU Bloat)

If you read two or three parameters, the above ST code is the perfect zero-cost solution. But if you are integrating a commercial solar farm or a multi-tenant metering panel, you could easily be polling over 500 floating-point registers across dozens of devices.

Are bit-shift loops eating your PLC cycle time?

Writing a Function Block (FB) and running FOR loops to execute hundreds of bitwise SHL operations and SysMemCpy memory copies per scan cycle will severely bloat your main CPU execution time—delaying critical process control tasks.

❌ Software Script Parsing
  • Requires complex ST memory pointer mapping.
  • Looping 500+ shifts spikes PLC CPU scan time.
  • Fragile to maintain if field devices vary in endianness.
✅ Hardware Edge Gateway
  • Gateway natively auto-swaps CDAB/ABCD at the ASIC hardware level.
  • Zero data parsing scripts required in the Codesys program.
  • Codesys reads clean, native IEEE 754 floats instantly over Ethernet.
Explore Edge Protocol Gateways → Consult an Integration Engineer