ET200SP Modbus RTU: Resolving EASYGEN 3000 Status 7002 Errors

Problem Description

An S7-300 (CPU 31x series) programmed in STEP 7 V5.5 polls four Woodward EASYGEN 3000 genset controllers as Modbus RTU slaves through a SIMATIC ET200SP station equipped with a CM PtP serial module. The bus is a 2-wire RS-485 multi-drop loop carrying six PMU controllers, four EASYGEN 3000 units, and four additional generator controllers, totaling up to 18 slaves. Six of the eight PTP modules in the plant operate correctly. The seventh cable loop fails on the four EASYGEN 3000 slaves only, while the PMU and generator controllers on the same physical cable return valid data.

The Modbus_Master block assigned to the EASYGEN controllers latches with BUSY = 1 and STATUS = W#16#7002 indefinitely and never sets DONE. The corresponding Modbus_Comm_Load block returns STATUS = W#16#8186 during the first scan and never becomes DONE = 1. Modscan against the same physical slaves and the same starting register 450009 (length 55 holding registers) returns valid data, proving that the physical layer, slave configuration, and addressing semantics are correct on the field side. The fault is therefore inside the S7-300/ET200SP Modbus master configuration rather than in the field wiring.

System Architecture

The network is split into two distinct segments. The PROFINET segment links the S7-300 CPU to four ET200SP stations on a 100 Mbit/s industrial Ethernet ring. The Modbus RTU segment begins at the CM PtP module on the seventh ET200SP station and runs as a daisy-chained RS-485 cable. Each ET200SP station contains two CM PtP modules, each running an independent Modbus RTU master for one cable loop. The 7th cable loop is the failing segment.

Root Cause Analysis

Four independent defects typically combine to produce this signature. The diagnostics in the rest of the article target each defect in the order they should be ruled out at the desk.

The 8186 status code is a one-time, configuration-time error raised by the Siemens MODBUS master library when the input PORT_ID does not resolve to a configured PTP module. The 7002 status code is an in-progress state, raised while the master waits for a slave response. The combination of "8186 at startup + 7002 forever" therefore indicates that the master is sending frames onto a port that was never initialized correctly. The PMU and generator controllers on the same loop do respond because their master blocks happen to be wired against a different PTP module that is correctly initialized.

EASYGEN 3000 Modbus Communication Specifications

The EASYGEN 3000 (Woodward part number family 8440-2250 / 8440-2300) exposes its measurement, control, and configuration data through a Modbus RTU slave interface. The bus interface supports 2-wire RS-485 in half-duplex and 4-wire RS-485 in full-duplex. The device is addressed using the standard Modicon 6-digit notation where the leading digit encodes the function code and the remaining five digits encode the 16-bit register number, allowing register addresses 400001 through 465535.

Reference: Woodward EASYGEN 3000 product page and the EASYGEN 3000 Modbus communication manual (publication 37159, available through the Woodward manuals portal). Always confirm the exact register number, data type (INT16, UINT16, INT32, REAL), and any scaling factor against the Modbus map shipped with the firmware version of the controller installed in your panel.

ET200SP CM PtP Hardware Configuration

The CM PtP is a serial interface module that plugs into an ET200SP BaseUnit. Two part numbers are relevant:

Reference: SIMATIC ET 200SP system manual and the CM PtP operating instructions, available through the Siemens Industry Online Support portal (entry ID 59062563). The IM 155-6 PN standard interface module (e.g. 6ES7155-6AU01-0BN0) hosts the PROFINET connection back to the S7-300 CPU.

For each CM PtP module used as a Modbus master, three settings in the device configuration of STEP 7 V5.5 / TIA Portal are mandatory:

1. Operating mode: select "Modbus master (RTU)" or "Freeport" depending on the library you intend to use. The legacy S7-300/400 MODBUS master library (FB 7 / FB 8) requires "Freeport" mode; the TIA Portal Modbus library (FB 1800 / FB 1801) uses the "Modbus" mode.
2. Port configuration: baud rate, parity, data bits, stop bits, and flow control must match the EASYGEN 3000 (19200, 8, N, 1 by default).
3. Hardware identifier (HW ID): the symbolic name that the Modbus_Comm_Load block uses as PORT_ID. Capture this from the properties of the CM PtP in HW Config.

Modbus_Comm_Load and Modbus_Master Block Parameters

Each CM PtP module requires exactly one Modbus_Comm_Load instance executed once at startup (or on a slow OB such as OB 100) to apply the port settings, and one or more Modbus_Master instances executed in a fast OB (typically OB 1) to perform the actual requests. The legacy library for S7-300/400 ships FB 7 (MODB_4xx) and FB 8 (MODB_4xx) for the master, and an initialization block for the port. The TIA Portal library ships FB 1800 (Modbus_Comm_Load) and FB 1801 (Modbus_Master). Reference: Siemens MODBUS RTU master library documentation for S7-300/400.

Modbus Address Mapping: Extended vs Standard Notation

The EASYGEN 3000 Modbus manual numbers registers using the standard 6-digit prefixed form, e.g. 450009. The leading "4" denotes function code 03 (Read Holding Register) and the trailing "50009" is the actual 16-bit register address (0 - 65535). The Siemens MODBUS master library expects DATA_ADDR to be the raw register number, not the prefixed 6-digit display form. Strip the leading function code digit and the data type prefix.

Reference: Modbus Application Protocol Specification V1.1b3, section 4 (Address rules). Modscan uses the 1-based register numbering shown in the third column. The legacy S7-300/400 MODBUS library (FB 7/8) is also 1-based. If you have configured a non-default MODE in the master block, refer to the library documentation for the active addressing rule. The block will simply not match any slave when the value 450009 is fed into a 1-based DATA_ADDR, because register 450009 does not exist on the EASYGEN 3000.

STATUS and ERROR Code Reference

Reference: Siemens MODBUS master library error description table, available in the library documentation linked above. A persistent 7002 followed by a later 8381 (timeout) confirms the slave never answers. A persistent 7002 followed by 8383 (illegal data address) confirms the slave is alive but the requested register does not exist. The second case is the one most likely to match the EASYGEN failure described.

RS-485 Physical Layer and Wiring

A multi-drop Modbus RTU bus on 2-wire RS-485 has three non-negotiable hardware rules. Skipping any of them is the most common reason a partial bus - like a 4-of-14 mix - starts to fail while the other 10 slaves still respond.

1. Termination. Place a single 120 ohm resistor between A and B at each physical end of the trunk cable. Do not place termination on intermediate nodes. On a daisy-chained loop, the master end and the last physical slave are the two ends.
2. A/B polarity. The Siemens CM PtP labels the terminals "T/R" (transmit/receive) with two pins per direction. The EASYGEN 3000 labels them A (+) and B (-). All slaves on a bus must agree. A single reversed device will short-circuit the bus and silence the entire segment, including any device that is still correctly wired.
3. Stub length. The drop cable from the trunk to each device should not exceed 30 cm at 19200 bit/s. Use a true daisy chain, not a star, with the trunk running continuously past each device.

Step-by-Step Resolution Procedure

1. Confirm the EASYGEN 3000 configuration on the device. Navigate the EASYGEN front panel to COMM > Modbus and write down the slave address (1-247), baud rate, parity, and stop bits. Note them on a commissioning sheet.
2. Validate the slave from a PC tool first. Run Modscan32 on a laptop connected to the same physical bus (or temporarily at the EASYGEN terminals). Set slave ID, baud 19200, 8N1, function 03, register 50009, length 55. Confirm valid data. This proves the physical layer, addressing, and EASYGEN configuration are correct. Do not skip this step.
3. Inspect the STEP 7 / TIA project for the failing PTP module. Open HW Config (STEP 7 V5.5) or the device configuration (TIA Portal) for the seventh ET200SP station. Confirm the CM PtP is plugged in, has a valid HW ID, and that exactly one Modbus_Comm_Load instance references that HW ID. A common defect is a second CM PtP with a different HW ID in the same station that is never initialized, which causes the master block to keep waiting on a port that was never set up.
4. Fix the PORT_ID mismatch that produces STATUS 8186. Re-read the HW ID of the CM PtP from the properties dialog. Feed it into the Modbus_Comm_Load input verbatim. If you copy the ID from an older project, rebuild HW Config first so the symbol table updates.
5. Correct the DATA_ADDR value. Replace 450009 with 50009 (1-based) at the Modbus_Master block input. Reduce DATA_LEN to 1 for the first test cycle to isolate the addressing issue from the data type issue.
6. Set the correct MODE. For the legacy S7-300/400 library (FB 7/8), MODE is not used and the data follows Modbus standard 1-based numbering. For TIA Portal Modbus library (FB 1800/1801), MODE=0 is standard Modbus and matches Modscan semantics. MODE=1 enables Siemens-notation offsets; do not use it unless the documentation for your library release explicitly says so.
7. Reduce to a single-register read for the first test. Change DATA_LEN to 1 and DATA_PTR to a 2-byte area in the working DB. Trigger REQ once and observe STATUS. A 7002 that resolves to 0000 (DONE=1) confirms the addressing and port. A 7002 that resolves to 8383 confirms the slave is alive but the register number is wrong (re-verify against the EASYGEN Modbus map).
8. Restore the full 55-register read and verify the data type. For each EASYGEN register, determine whether it is INT16, UINT16, INT32, or REAL. Two registers are required per 32-bit value. Update DATA_PTR to P#DB100.DBX0.0 BYTE 110 for 55 INT16 registers or the equivalent byte count for the mixed-type layout.
9. Verify the slave address of the EASYGEN. The user reported address 69 (0x45). Confirm against COMM > Modbus on the device. A single wrong digit here will look identical to a 7002 forever signature because the master is asking a slave that does not exist.
10. Recheck RS-485 wiring and termination. Verify 120 ohm at the master end and at the last physical slave only. Disconnect the failing EASYGEN units one at a time; if communication to the remaining devices improves, you have either a termination or a polarity problem on the removed segment.

Verification and Acceptance Test

After the corrective actions, run the following acceptance checks. Each one should be repeatable on every cycle for at least 10 minutes before the loop is declared healthy.

Capture a status snapshot in a watch table with the following variables so the test is reproducible: MD_MASTER.DONE, MD_MASTER.BUSY, MD_MASTER.ERROR, MD_MASTER.STATUS, MD_LOAD.DONE, MD_LOAD.STATUS. If the acceptance checks pass on this PTP module but the symptoms reappear on others, apply the same procedure to the second CM PtP module - the underlying commissioning defect is usually present in both instances of the block.

Frequently Asked Questions