Configuring S7-1200 as Modbus RTU Slave for Bidirectional Data

Modbus RTU Master/Slave Fundamentals for S7-1200

Modbus is a strictly client/server architecture in master/slave terminology. The S7-1200 acting as a Modbus slave is a passive device: it never initiates a transaction on the RS485 bus. The DCS (master) is the only node permitted to poll the bus, and only the master can read or write registers on the slave. The slave only responds when its station address is queried.

Key constraints:

• Only one master is allowed per RS485 segment.
• A slave cannot request data, cannot push data, and cannot speak to another slave.
• Function codes 03 (Read Holding Registers), 06 (Write Single Register), 16 (Write Multiple Registers), and broadcast write (Function code 10 with station address 0) are supported by MB_SLAVE.
• Hold registers are the bidirectional data container - the same register address can be read or written depending on what the master requests.

This distinction matters when you wire the CPU 1214C to a third-party DCS: the S7-1200 will expose a contiguous block of holding registers, and the DCS decides per register whether to poll (read) or set (write). The PLC does not have separate "read-only" and "write-only" registers; access direction is decided by the master on every transaction.

Prerequisites: Hardware and Firmware Requirements

CM 1241 RS485 Wiring and Termination

The CM 1241 RS485 uses a 9-pin sub-D male connector on the front face. The pinout is non-standard compared to legacy PC COM ports:

For RS485 bus termination:

1. Slide the termination switch on the bottom of the CM 1241 to ON if the PLC is the first or last physical device on the bus segment.
2. Connect pin 2 to DCS "Data A" (also labelled "D+" or "TxD+/RxD+").
3. Connect pin 3 to DCS "Data B" ("D-" or "TxD-/RxD-").
4. Tie shield to pin 8 at the PLC end; ground the shield at one end only to avoid ground loops.
5. Maintain a maximum stub length of < 30 mm if you tap into the middle of an existing bus.

TIA Portal Project Setup and Device Configuration

1. Open TIA Portal and create a new project.
2. Add the CPU 1214C DC/DC/DC (6ES7 214-1AG40-0XB0) from the hardware catalog.
3. Open Device View and drag the CM 1241 (RS485) module (6ES7 241-1CH30-0XB0) into the left communication slot of the signal board area. Although the part is a submodule physically mounted on the CPU front, in TIA it is configured as a slot to the left of the CPU.
4. Right-click the CM 1241 and open Properties > Port Configuration.
   • Set Baud rate: 9600 (default for most DCS systems).
   • Set Parity: Even (Modbus RTU standard).
   • Set Data bits: 8.
   • Set Stop bits: 1.
   • Set Flow control: None.
5. Assign a unique Modbus slave address in Properties > Modbus (e.g. station 3). The DCS must use the same station number when polling.

MB_COMM_LOAD Instruction Configuration

The MB_COMM_LOAD block initialises the CM 1241 port and is called once on PLC warm restart (OB100) or first scan (OB1 with a one-shot). It does not perform any Modbus transactions itself.

MB_SLAVE Instruction Setup for Bidirectional Data

The MB_SLAVE instruction is called from a cyclic OB (typically OB1). It makes a contiguous range of the PLC's data accessible as Modbus holding registers (function codes 03, 06, 16) plus broadcast writes.

Pin reference (TIA Portal V15+ MB_SLAVE V3.1):

For the application described - 14 words inbound to the DCS and 3 bits inbound from the DCS - the most common mapping is:

• Allocate a global DB (e.g. DB200 "ModbusHold") with at least 16 WORD entries.
• Point MB_HOLD_REG to DB200.
• Set DATA_ADDR = 0 (start at the first word).
• Set DATA_LEN = 16 (14 measurement words + 1 control word + 1 status word - adjust to match DCS register map).

The first 14 words are written by the PLC program from I/O signals (read by the DCS). Word 15 contains the 3 bits that the DCS writes back to the PLC. Because the same register block is read/write, you do not need a separate MB_MASTER block - the direction of each register is controlled entirely by the master's request.

Modbus Address Mapping Table for the Application

The DCS sees the slave as a contiguous block of holding registers starting at Modbus address 40001 (or 40000 depending on the DCS vendor's 1-based vs 0-based convention):

LAD/FBD Program Example with Hold Register DB

Data block definition (DB200 "ModbusHold") in TIA Portal:

DATA_BLOCK "ModbusHold"
{ S7_Optimized_Access := 'FALSE' }
STRUCT
    PV_01 : WORD;    // DBW0  -> 40001
    PV_02 : WORD;    // DBW2  -> 40002
    PV_03 : WORD;    // DBW4  -> 40003
    PV_04 : WORD;    // DBW6  -> 40004
    PV_05 : WORD;    // DBW8  -> 40005
    PV_06 : WORD;    // DBW10 -> 40006
    PV_07 : WORD;    // DBW12 -> 40007
    PV_08 : WORD;    // DBW14 -> 40008
    PV_09 : WORD;    // DBW16 -> 40009
    PV_10 : WORD;    // DBW18 -> 40010
    PV_11 : WORD;    // DBW20 -> 40011
    PV_12 : WORD;    -> DBW22 -> 40012
    PV_13 : WORD;    // DBW24 -> 40013
    PV_14 : WORD;    // DBW26 -> 40014
    CTRL_W : WORD;   // DBW28 -> 40015 (DCS writes here)
    STATUS  : WORD;   // DBW30 -> 40016
END_STRUCT;
END_DATA_BLOCK

OB100 - initialise port (called once on restart):

// OB100 - Warm restart
      CALL "MB_COMM_LOAD"
        REQ       := TRUE                // one-shot
        PORT      := "CM1241_1_ID"       // HW identifier from device config
        BAUD      := 9600
        PARITY    := 2                   // even
        FLOW_CTRL := 0
        RESP_TO   := 1000
        DONE      => "mb_load_done"
        ERROR     => "mb_load_err"
        STATUS    => "mb_load_status";

OB1 - cyclic slave execution:

// OB1 - Main
      CALL "MB_SLAVE"
        MODE       := 1
        DATA_ADDR  := 0                  // start at offset 0 of DB200
        DATA_LEN   := 16                 // expose 16 holding registers
        MB_HOLD_REG:= "DB200".PV_01      // pointer to first word
        NDR        => "mb_ndr"           // pulses when DCS writes
        DR         => "mb_dr"            // pulses when DCS reads
        ERROR      => "mb_err"
        STATUS     => "mb_status"
        MB_STATE   => "mb_state";

// Map process I/O into PV_01..PV_14
      "DB200".PV_01 := "IW64";            // AI0 scaled value
      "DB200".PV_02 := "IW66";            // AI1
      ... (repeat for all 14 process values) ...

// Decode the 3 DCS command bits from CTRL_W
      "DCS_CMD_1"  := "DB200".CTRL_W.%X0; // bit 0 of word 15
      "DCS_CMD_2"  := "DB200".CTRL_W.%X1; // bit 1
      "DCS_CMD_3"  := "DB200".CTRL_W.%X2; // bit 2

// Heartbeat / status
      "DB200".STATUS := "Heartbeat_Counter";

Direction of Data Flow: Read vs Write Clarification

Many engineers expect the S7-1200 to distinguish between "read registers" and "write registers" via two separate blocks. It does not. MB_SLAVE exposes a single buffer that supports all three standard Modbus data functions:

• Function code 03 - Read Holding Registers (master polls, slave returns register contents).
• Function code 06 - Write Single Register (master writes one word, slave echoes it back).
• Function code 16 - Write Multiple Registers (master writes up to 123 contiguous words, slave returns ack).

The 14 "read-only" process values from the DCS perspective are simply registers that the DCS chooses never to write. The 3 bits the DCS sends back are simply a register that the DCS chooses to write via FC06 or FC16. There is no slave-side logic that prevents the master from writing register 40001 - it is allowed by Modbus protocol.

Verification, Online Diagnostics, and Status Codes

After downloading the project and placing the CPU in RUN:

1. Open Online > Online & Diagnostics on the CM 1241 and confirm Port Status = OK and Transmission Errors = 0.
2. Watch MB_STATE: value 1 = "ready & idle", 2 = "executing a request", 3 = "error".
3. Pulse NDR (new data) on every successful write from the master; pulse DR (data read) on every successful master read.
4. From the DCS side, force a manual poll of register 40001; verify the AI value is returned.
5. Force a single-register write to 40015 with the value 16#0007; verify the three command bits in DB200.CTRL_W become TRUE in the watch table.

MB_SLAVE STATUS Word Decoding (common values)

Troubleshooting Matrix for Common Faults

Best Practices and Field-Commissioning Tips

1. Always start with a single register loop-back test: have the DCS write 16#1234 to register 40015 and verify the same value appears in the PLC's watch table before commissioning the full register map.
2. Document the Modbus address map (register number, direction, scaling, engineering unit) in a shared CSV and put it under version control. This is the single most important piece of project documentation for any Modbus interface.
3. Add a "heartbeat" register (e.g. STATUS = a free-running counter) that the DCS can poll to detect a frozen slave. Increment it once per PLC scan; if the DCS sees the same value twice in a row, raise an alarm.
4. For RS485 buses longer than 30 m or with more than three devices, bias the bus with external 680 ohm pull-up on Data A to +5 V and 680 ohm pull-down on Data B to GND at the master. The CM 1241 has internal bias only when termination is enabled.
5. Keep MB_SLAVE in OB1 with no conditional logic around it - the instruction handles its own state machine and only needs a cyclic call. Adding EN gating on slow transitions can cause missed polls.
6. Disable unused Modbus function codes if the master is misbehaving. The instruction supports FC01/02/03/04/05/06/15/16, but you cannot filter at the slave - instead, restrict the master's address range.
7. Use RDREC/WRREC on the CM 1241 only if you need non-standard diagnostics; the STATUS outputs of MB_SLAVE cover 95% of field issues.
8. When migrating to a CPU 1215C or 1217C, the same CM 1241 article and the same MB_SLAVE V3.1 instruction are forward-compatible. No code changes are required.