Resolving CB 1241 MB_COMM_LOAD 80C8 Error on S7-1200 Modbus RTU

Problem Overview

The S7-1200 family supports legacy Modbus RTU on a serial port using the MB_COMM_LOAD and MB_MASTER/MB_SLAVE instructions. A recurring field failure is a CPU 1215C DC/DC/RLY on firmware V4.4 paired with a CB 1241 (RS485) signal board V1.0: MB_COMM_LOAD reports STATUS = 16#7000, the DONE bit briefly pulses TRUE on the first call, and the master then returns error 0x80C8 for every read/write request. The transmit LED stays dark; only the RX LED flickers as line noise or a malformed response is sampled. Swapping the CB 1241 for a CM 1241 module (same baud rate, parity, slave address) restores communication immediately.

This article isolates the root cause, walks through correct MB_COMM_LOAD configuration for the CB 1241, and documents the conditions under which the signal board cannot be used and a CM 1241 must replace it.

Hardware Identification: CB 1241 vs. CM 1241

Siemens sells two mechanically and logically distinct RS485 products for the S7-1200. The differentiation is not optional and drives every parameter downstream of MB_COMM_LOAD.

The CB 1241 and the CM 1241 do not share a hardware identifier. If you port a working TIA Portal project from a CPU with a CM 1241 to a CPU with a CB 1241 (or vice versa), the symbolic HW ID at the MB_COMM_LOAD PORT input must be remapped or the block will silently bind to the wrong port, producing the 16#7000/80C8 symptom set above.

Symptoms and Status Code Meanings

16#7000 at MB_COMM_LOAD

16#7000 is not an error. It is the no active job status. Per the legacy Modbus RTU instruction set, the STATUS output of MB_COMM_LOAD returns 16#7000 between calls and immediately after a successful port configuration. The user observation that DONE pulses TRUE on the first call and then falls back is normal: DONE, ERROR, and STATUS are valid for a single CPU scan only. Latch them in your code if you need persistent diagnostics.

0x80C8 at MB_MASTER

Code 0x80C8 from MB_MASTER means the master transmitted a valid request, started the response window, and either:

• did not see any response characters within the configured Response Timeout, or
• saw a response that failed Modbus CRC validation or contained an illegal frame length, or
• saw a Modbus exception code (0x01 – 0x0B) inside the response PDU.

An RX LED that flickers on the master with no TX activity is consistent with the master reading noise on the bus or a single corrupted byte from the slave. The TX LED staying dark is a strong indicator that the bus is held in receive-only mode or that the port itself was never placed into Modbus mode by MB_COMM_LOAD.

Root Cause: Why the CB 1241 Fails Where the CM 1241 Succeeds

There are three independent root causes that combine to produce the symptom in the field. Any one of them is enough; all three are easy to introduce together.

1. Hardware identifier mismatch. The PORT input of MB_COMM_LOAD is a HW identifier (uint). When the project is migrated, the new CB 1241 is inserted but the symbolic constant is not refreshed. The block binds to an invalid identifier; the firmware returns 16#7000 and no I/O is driven.
2. MODE chosen after MB_COMM_LOAD execution. For RS485 2-wire networks MODE = 4 is the correct value, but it must be set in the device configuration and the value passed into MB_COMM_LOAD's MODE input must match. If the constant block is read at compile time but the actual input is overwritten elsewhere (for example, by a move from a data block written incorrectly), the port will not enter half-duplex direction control and no slave reply will ever be framed correctly.
3. CB 1241 hardware/firmware combination on CPU firmware V4.4. CPU 1215C firmware V4.4 with CB 1241 (6ES7241-1CH30-1XB0) HW V1.0 has documented field issues when the signal board is the only Modbus RTU master on the bus. The CM 1241 (6ES7241-1CH32-0XB0) shares its URAM with the left-side bus driver and handles DMA reads of the response buffer without contention. A noise burst during the inter-character timeout therefore does not corrupt the descriptor and 0x80C8 does not appear.

Swapping the CB 1241 for a CM 1241 directly addresses point 3 and indirectly addresses point 1 (the new module forces a fresh device mapping and TIA Portal rebinds the HW ID automatically). The user's confirmation that "all settings are the same" and yet communication starts working is the practical proof.

Prerequisites for a Working CB 1241 Modbus Master

• CPU 1215C firmware V4.4 (6ES7215-1AG40-0XB0) or later 4.x revision
• CB 1241 RS485 (6ES7241-1CH30-1XB0) seated fully in the front slot
• TIA Portal V16 with the MODBUS (RTU) library V4.4 (or matching version)
• RS485 cable ≤ 50 m total bus length
• Terminating resistor engaged at both physical ends only, 120 Ω, 1 nF failsafe
• Common ground reference between master and slave
• Verified slave: tested with a Modbus poll utility on a PC first

Step-by-Step: Correct MB_COMM_LOAD Configuration

1. Insert the CB 1241 in the device view. Open Device configuration → Signal Board slot. The new node will appear in the project tree with a system-assigned hardware identifier (for example, 271). Write this number down — TIA Portal renumbers it whenever a sibling CM is added or removed.
2. Configure the port in HWCN. Open the CB 1241 properties, set:
   • Port configuration: RS485 Half-Duplex (2-wire)
   • Receiver initial state: Active (suitable for 2-wire)
   • Termination: ON only if the CB 1241 is at the physical end of the bus segment
3. Insert MB_COMM_LOAD in OB1 (or in a startup OB executed once at warm restart). Drive REQ with a one-shot rising edge from a system clock (for example, "FirstScan" from the system clock memory) so the block runs exactly once after power-on.
4. Bind the hardware identifier symbolically. Click the PORT pin and pick the CB 1241 from the dropdown — do not type the numeric ID. The symbolic link is what survives a recompile.
5. Set the MODE input. For RS485 2-wire half-duplex the constant is 4. Pin the input with a tag of type WORD initialised to 16#0004 or a constant literal.
6. Set the baud rate, parity, and data bits to match the slave exactly. Use BAUD = 9600, PARITY = 0 (Even), DATABITS = 8, STOPBITS = 1 for the most common Modbus defaults. Do not leave these as default; the default for a CB 1241 in TIA Portal is often 19200/8/E/1, which does not match many third-party slaves.
7. Verify DONE rising edge. Latch MB_COMM_LOAD.DONE into a BOOL tag Comm_Load_Done. Latch ERROR into Comm_Load_Err and STATUS into Comm_Load_Status (WORD). Only after Comm_Load_Done is TRUE may the master call be enabled.
8. Enable MB_MASTER only after Comm_Load_Done is TRUE. Wrap the REQ pin of MB_MASTER in an AND with the latched done bit. A request issued before MB_COMM_LOAD finishes configuring the port always returns 0x80C8.

MB_COMM_LOAD Pin Map

MODE Reference for CB 1241 and CM 1241

Verify the MODE input value in the compiled program (right-click block → Cross-reference). Any MOV or arithmetic instruction touching the MODE tag is suspect.

Status Code Diagnostics

Wiring and Termination

Although the original problem was solved by hardware swap, the symptom (RX flicker only) is also classic for a bus that is held in receive by an engaged termination at the master when no slave is driving the line. Apply the following rules:

• Engage the CB 1241 termination DIP switch only if the device is at the physical end of the segment.
• If the bus is < 5 m, termination may be omitted entirely provided cable capacitance is low and the baud rate is ≤ 19200.
• For a 2-wire RS485 bus, the shield is bonded to ground at one end only (typically the cabinet end). The signal ground (pin 5 on the CB 1241 DSUB-9) must be tied to the slave ground; floating grounds produce CRC bursts and intermittent 0x80C8.
• Verify A/B polarity. Swapping A and B on exactly one end is correct; swapping on both ends is the most common commissioning mistake and produces a bus where every byte is inverted.

Verification Procedure

1. Power-cycle the CPU. Watch the CB 1241 TX LED at the moment MB_COMM_LOAD runs — it will not flash, this is normal.
2. Open the user DB. Confirm Comm_Load_Done = TRUE, Comm_Load_Err = FALSE, Comm_Load_Status = 16#0000 after the first cycle.
3. Trigger a single MB_MASTER read of a known holding register. Observe TX LED one short burst, then RX LED. If RX does not flash, the slave is not responding. If RX flashes once with the same length as TX, the slave is responding with an exception code embedded in the PDU (decode with MB_MASTER STATUS).
4. Set the Response Timeout on MB_MASTER to 1000 ms during commissioning. Once communication is stable, drop it to 200 ms.
5. Use a Modbus poll utility on a PC tapped onto the bus and read the same register. If the PC succeeds and the PLC fails, the bus is healthy and the problem is in the PLC project (HW ID, MODE, or sequence).

When to Migrate from CB 1241 to CM 1241

Replace the signal board with a communication module if any of the following apply. The catalog number for the replacement is 6ES7241-1CH32-0XB0 (RS485) or 6ES7241-1AH32-0XB0 (RS232).

• The CB 1241 is the only Modbus master on the segment and the field exceeds 5 m in an electrically noisy cabinet (VFDs, contactors, switching power supplies).
• You need more than one Modbus master or a mix of Modbus and USS/Freeport on the same CPU.
• You need galvanic isolation between the field and the CPU backplane; the CM 1241 isolates, the CB 1241 does not.
• You observe intermittent 0x80C8 errors that do not correlate with a specific slave, with a CB 1241 sitting on CPU firmware V4.4 and you cannot update the CPU firmware.

Commissioning Sequence (CM 1241 and CB 1241 Common)

1. Validate slave on PC with Modbus Poll, Modbus Doctor, or an equivalent utility.
2. Open TIA Portal project, install the new module in HWCN, and let the portal assign a HW ID.
3. Drop MB_COMM_LOAD in OB1, bind PORT symbolically.
4. Set MODE = 4, BAUD/PARITY/DATABITS/STOPBITS to the values confirmed with the PC test.
5. Trigger REQ with a one-shot from FirstScan or a system clock edge.
6. Latch DONE, ERROR, STATUS into a global DB.
7. Only after DONE pulses TRUE for the first time, gate MB_MASTER.REQ with the latched done bit.
8. Issue one read, verify RX LED on the new module, and confirm the value lands in the destination tag.

Troubleshooting Matrix

Related Documentation

• Legacy Modbus RTU communication (CM/CB 1241 only) — TIA Siemens Cloud — official Siemens reference for the legacy Modbus RTU library on the S7-1200, including the MB_COMM_LOAD and MB_MASTER instruction set and parameter tables.
• S7-1200 Programmable Controller System Manual, chapter "Communication" — full hardware description of CB 1241 and CM 1241 modules.
• S7-1200 Function Manuals for "Point-to-Point Communication" — MODE, BAUD, PARITY, and flow control reference.

FAQ