Resolving CM1241 Modbus Slave Block Idle Status 7000 on S7-1200

Problem Overview

On a Siemens S7-1200 CPU equipped with a CM 1241 communication module configured as a Modbus RTU slave over RS-232, the Modbus_Comm_Load and Modbus_Slave instructions in the user program frequently display status value 16#7000 in the STATUS output. Engineers reading the block online through TIA Portal interpret this as a communication failure even when the slave is correctly responding to external Modbus masters and the process data exchange is functioning.

The status 16#7000 (decimal 28672) is the documented no job active state for every asynchronous S7-1200/S7-1500 communications instruction. It is the normal resting state of the FB and is not an error indicator. Misreading this value is one of the most common diagnostic dead ends for first-time Modbus integrators.

Root Cause Analysis

The CM 1241 RS-232 / RS-485 modules and the S7-1200 onboard serial port (when supported by the CPU firmware) use the Siemens Modbus RTU instruction library. The library contains two cooperating blocks:

• Modbus_Comm_Load (FB 1803 / instruction in the MODBUS group): configures the serial port — baud rate, parity, data bits, stop bits, and protocol mode (RTU/ASCII). It runs once on REQ and reports the configuration result through DONE and ERROR.
• Modbus_Slave (FB 1805) or Modbus_Master (FB 1804): performs the actual Modbus data exchange. The slave block cycles every scan once Modbus_Comm_Load has completed successfully.

Both blocks share a uniform internal state machine:

1. Block is invoked with a rising edge on REQ (for Modbus_Comm_Load) or continuously by the cyclic OB (for Modbus_Slave).
2. The instruction performs its task — port configuration for Comm_Load; telegram processing for Slave.
3. When finished, it sets DONE=TRUE or ERROR=TRUE for exactly one PLC scan and writes the detailed result to STATUS.
4. On the next scan, the block returns to the idle state: BUSY=FALSE, DONE=FALSE, ERROR=FALSE, STATUS=16#7000.

Online monitoring permanently shows the latest latched value of STATUS. Because the result pulse is only one scan wide, online display almost always shows the last written value, which is the idle status, even though the instruction has just completed a transaction.

Status Code Reference for Modbus Instructions

Source: Siemens Industry Online Support — S7-1200 Modbus RTU instructions.

Internal State Machine (Slave Perspective)

The Modbus RTU protocol layer on the S7-1200 follows a finite state machine consistent with the open Modbus specification and the SimpleModbus reference implementation. Every master/slave interaction traverses the following states:

Between the Sending Response and the next Processing Request state, the driver observes the 3.5-character inter-frame silence required by the Modbus RTU specification. Blocking the call inside the cyclic OB interrupts this machine and corrupts timing, which is why Modbus_Slave must be called in a time-consistent OB such as OB1 (or OB200 for a 1217C).

Correct Status Latching in Structured Text

Because the DONE/ERROR pulse is one scan wide, the latched status must be captured in the same OB call. The following SCL (Structured Text) pattern is the recommended implementation:

// FB instance data
VAR
    mbCommLoad   : MODBUS_COMM_LOAD;     // FB 1803
    mbSlave      : MODBUS_SLAVE;         // FB 1805
    commDone     : BOOL;
    commError    : BOOL;
    commStatus   : WORD;                 // latched status word
    slaveError   : BOOL;
    slaveStatus  : WORD;
END_VAR

BEGIN
    // 1) Run Comm_Load once on cold start or parameter change
    IF NOT commDone AND NOT commError THEN
        mbCommLoad.REQ := TRUE;
    ELSE
        mbCommLoad.REQ := FALSE;
    END_IF;

    mbCommLoad.PORT  := "Local~CM_1241_RS232";   // hardware ID
    mbCommLoad.BAUD  := 9600;
    mbCommLoad.PARITY := 0;                        // 0 = Even, 1 = Odd, 2 = None
    mbCommLoad.STOP_BITS := 1;
    mbCommLoad.DATA_BITS := 8;
    mbCommLoad.MODE   := 4;                        // 4 = RTU slave
    mbCommLoad();

    // Latch the one-scan result
    IF mbCommLoad.DONE THEN
        commDone   := TRUE;
        commStatus := mbCommLoad.STATUS;
    ELSIF mbCommLoad.ERROR THEN
        commError  := TRUE;
        commStatus := mbCommLoad.STATUS;            // store for diagnostics
    END_IF;

    // 2) Slave only runs after Comm_Load is done
    IF commDone THEN
        mbSlave.MODE       := 1;                    // 1 = Modbus RTU
        mbSlave.SLAVE_ADDR := 1;
        mbSlave.DATA_ADDR  := 40001;                // first holding register
        mbSlave.DATA_LEN   := 20;                   // 20 holding registers
        mbSlave.DATA_PTR   := "DB_HoldingRegs".Holding[0];
        mbSlave();

        IF mbSlave.ERROR THEN
            slaveError  := TRUE;
            slaveStatus := mbSlave.STATUS;
        ELSE
            slaveError  := FALSE;
        END_IF;
    END_IF;
END

Modbus_Comm_Load: REQ Edge Behavior

Modbus_Comm_Load is not a continuously called driver. It is a one-shot configurator. A positive edge on REQ instructs the block to:

1. Stop any active job on the port.
2. Reprogram the UART parameters and protocol mode.
3. Enable the port for the selected protocol (RTU slave in this case).
4. Assert DONE=TRUE for one scan with STATUS=16#0000 on success.

If REQ is held TRUE every scan, the block repeatedly re-enters the configuration path, which can prevent the slave from processing telegrams. Always drop REQ after the first successful trigger, as shown in the SCL pattern above.

Modbus_Slave: Cyclic Operation

Unlike Modbus_Comm_Load, Modbus_Slave is called on every PLC scan. It does not require REQ — it inspects the receive FIFO of the CM 1241 and processes any frame whose address byte matches SLAVE_ADDR. The block:

• Reads incoming bytes from the UART ring buffer.
• Validates the inter-frame silence (≥ 3.5 character times at the configured baud).
• Validates the CRC-16 (Modbus polynomial 0xA001).
• Dispatches the function code to the matching handler (01/02/03/04/05/06/15/16).
• Builds the response, appends the CRC, and queues it for transmission.
• Returns to idle (STATUS=16#7000) until the next telegram arrives.

For the official instruction help, refer to the TIA Portal inline help or the S7-1200 Modbus RTU instruction reference.

Verification with ModScan

To confirm the slave is functional despite the 16#7000 status, run ModScan32 (or any Modbus RTU master test tool) on a PC connected to the CM 1241 RS-232 port through a null-modem cable:

1. Set ModScan: Connection → Serial Port → select COMx → Baud 9600 → 8E1 → RTU mode.
2. Set Slave Address = 1 (matching SLAVE_ADDR).
3. Set Function = 03 (Read Holding Registers) and length = 20.
4. Click Connect. The Poll indicator should flash green at the configured scan rate.
5. Verify the displayed register values match the data block content in TIA Portal.

If registers update continuously, the Modbus slave is fully operational. The 16#7000 online status is the documented idle state of the instruction between telegrams and can be safely ignored.

Wiring Reference: CM 1241 RS-232 to PC

Use a null-modem (crossover) cable. Do not connect DCD/DSR/DTR unless the application specifically requires them; the CM 1241 does not implement those signals on the 9-pin sub-D.

Troubleshooting Matrix

Special Case: Slave Without an Active Master

During commissioning, the slave is often running before any Modbus master is connected. The block continues to cycle through its idle state at the PLC scan rate, consuming virtually no CPU time and writing STATUS=16#7000 on every call. This is the intended behavior and does not indicate a problem. The block waits passively for a valid Modbus frame in the UART FIFO. No polling interval or watchdog must be configured; the slave is fully event-driven from the UART hardware interrupt.

Cross-Reference: Modbus Master Instruction

If the same S7-1200 must poll a remote Modbus device, replace Modbus_Slave with Modbus_Master (FB 1804). The same DONE/ERROR pulse and status-latching rules apply. A typical pattern uses a state machine that triggers Modbus_Master.REQ only after the previous transaction has reached DONE or ERROR with latched status capture. Refer to the S7-1200 System Manual, section on Modbus RTU, for the recommended ladder example.

Firmware and Library Version Notes

The Modbus instruction library has been refined across TIA Portal versions. Key compatibility points:

• TIA Portal V13 SP1 / V14 introduced the unified MODBUS instruction group used by both S7-1200 and S7-1500.
• CPU firmware V4.0+ is required for the MODE parameter supporting RTU slave on the onboard serial port of CPUs with that interface.
• CM 1241 (6ES7241-1AH32-0XB0) supports baud rates up to 115 200 baud in RTU mode; the older 6ES7241-1AH30-0XB0 is limited to 38 400 baud.

For the latest firmware and HSP files, refer to the Siemens Industry Online Support portal.

Best-Practices Summary

1. Treat STATUS=16#7000 as the documented idle state of every Modbus block — not as a fault.
2. Always latch the STATUS word on the scan where DONE or ERROR transitions to TRUE.
3. Drop Modbus_Comm_Load.REQ after the first successful edge; never hold it permanently.
4. Call Modbus_Slave in OB1 (or a cyclic OB matched to your scan time) — do not place it in a time-interrupt OB with strict deadlines.
5. Use a non-optimized DB for DATA_PTR with absolute addressing, declared as ARRAY OF WORD for registers or ARRAY OF BOOL for coils.
6. Verify with ModScan32 or a known-good Modbus master before assuming a fault.
7. Byte-swap data when exchanging with big-endian Modbus masters (most non-Siemens devices).