Resolving ET200SP CM PtP Modbus RTU 7000/7002: RS232 Mode Fix

Problem Overview

A SIMATIC ET 200SP distributed I/O station equipped with a CM PtP communication module (order number 6ES7137-6AA00-0BA0, or the -0CA0 / -0DA0 variants for RS-232/422/485) appears to accept the Modbus_Comm_Load and Modbus_Master programming blocks without generating any hardware fault, but the Modbus link to the RTU slave (in this case a LUMEL energy meter) never establishes. Two distinct return codes are observed on the STATUS output:

• Modbus_Comm_Load.STATUS = 7000 (hex 0x1B58) persistently, even when the block is called in the startup OB (OB100) on the first cycle.
• Modbus_Master.STATUS = 7000 when BUSY = FALSE, and STATUS = 7002 (hex 0x1B5A) while BUSY = TRUE during a transmission attempt.

External verification with a MOXA USB-to-RS-485 converter and Modbus Poll confirms that the slave itself is healthy and the 2-wire RS-485 bus is wired correctly. The CM PtP is the only suspect. The root cause is almost always a physical-layer mismatch: the module is driving the socket in RS-232 mode while the user is wiring it as RS-485, or vice versa. The user-side fix is to commit the correct physical mode by writing the MODE input of Modbus_Comm_Load and re-triggering REQ.

Affected Components and Firmware

The condition has been observed on TIA Portal V15.1 through V18 with the Modbus RTU instruction library "MB_RTU" / "MB_CLIENT" variants. The exact return code values (decimal) are stable across the listed firmware revisions because they are part of the PtP block status list defined in the Siemens Modbus_Comm_Load instruction reference.

Decoding Status 7000 and 7002

The Modbus_Comm_Load and Modbus_Master return a hex-coded status. Always inspect them in HEX, because the decimal form is misleading at first glance.

Root Cause: Default RS-232 Physical Layer

Out of the box, the ET 200SP CM PtP is shipped with the device configuration parameter "Operating mode" set to RS-232 full duplex. This is also the default that the engineering tool writes when you first drop the module into the device view. Pin 1 (TxD) and pin 2 (RxD) of the sub-D socket carry voltage, while pins 12 / 14 (the RS-485 data pair on this family) are held at the line-idle bias but no driver is enabled.

Symptoms that confirm this is the failure mode:

1. MOXA or any USB-to-RS-485 tap on pins 12 / 14 shows no traffic LEDs when the CM PtP runs the load block.
2. Probing pins 1 / 2 on an oscilloscope reveals the expected Modbus RTU frames.
3. When you short the CM PtP side to the MOXA side, the MOXA RX/TX LEDs flash because it is receiving and echoing RS-232, not RS-485.
4. Modbus_Master STATUS swings to 7002 the moment REQ is pulsed, because the transmitter is enabled but the receiver never sees a return frame (because the LUMEL meter is on a 2-wire RS-485 bus and the CM is driving TxD/RxD separately).

The configuration page in TIA Portal that is normally expected to switch the physical layer is Properties > Port configuration > Operating mode / Protocol. In some TIA Portal / library combinations (specifically Modbus RTU library V4.x for CM PtP), this checkbox does not propagate to the load block. The block carries its own copy of the mode, and the block wins.

CM PtP Module Hardware Reference

The CM PtP front connector is a 15-pin D-sub male. Pinout for the RS-232 / RS-422 / RS-485 modes:

For a LUMEL ND10 / N14 / N30 energy meter (or any 2-wire RS-485 slave), the only signal pins that matter are 1/2 and 12/14 in 2-wire mode, plus GND. Verify with a multimeter in continuity mode: pin 1 short to pin 2 and pin 12 short to pin 14 will appear when the module is correctly configured for 2-wire RS-485.

Modbus_Comm_Load Configuration Parameters

The complete input pin map for the Modbus_Comm_Load block when targeting a CM PtP under PROFINET is given in the TIA Portal Modbus_Comm_Load manual page:

The MODE parameter is the only one that is unintuitively named. For the ET 200SP CM PtP it carries the following semantics, in the Modbus RTU instruction library variants V3.x and V4.x:

Step-by-Step Resolution

1. Open the S7 CPU program in TIA Portal and locate the instance DB of Modbus_Comm_Load in the project tree.
2. Set PORT to the hardware identifier of the CM PtP. In the project navigation, open Device view > CM PtP > Properties > System constants and copy the symbolic name (e.g. "CM_PtP_1~PORT_1").
3. Set the MODE input explicitly. For a 2-wire RS-485 link to a LUMEL energy meter where the CM PtP is the Modbus RTU master, use:

   Modbus_Comm_Load.MODE := 3;   // RS-485 half duplex, master role

   If the original symptom was 7000/7002 and the user found relief with MODE = 4, verify the actual role: in some field installations the CM PtP is a slave to a higher-level gateway and the LUMEL is a passive listener. In that case:

   Modbus_Comm_Load.MODE := 4;   // RS-485 half duplex, slave role

4. Keep the remaining parameters at safe values:

   Modbus_Comm_Load.BAUD      := 9600;
   Modbus_Comm_Load.PARITY    := 2;     // Even, matches most LUMEL defaults
   Modbus_Comm_Load.FLOW_CTRL := 0;     // No hardware handshake on RS-485
   Modbus_Comm_Load.RESP_TO   := 1000;  // 1 second, generous for slow meters

5. Force a positive edge on REQ. In SCL:

   IF "FirstScan" THEN
       Modbus_Comm_Load_Instance.REQ := TRUE;
   END_IF;
   // In OB1 or a cyclic OB, drop REQ after DONE is seen:
   IF Modbus_Comm_Load_Instance.DONE OR Modbus_Comm_Load_Instance.ERROR THEN
       Modbus_Comm_Load_Instance.REQ := FALSE;
   END_IF;

6. Download the program to the CPU. Cold-restart the CPU (MRES) so the CM PtP re-initialises with the new MODE. A warm restart will keep the previously latched physical layer if the configuration was already committed once.
7. Watch the STATUS output. After a single scan, STATUS must transition 7000 -> 7001 -> 7000 with DONE = TRUE. If 7000 persists, the REQ edge was lost (the block is edge-triggered, not level-triggered) or the PORT identifier is wrong.
8. Now trigger the Modbus_Master block. The first valid poll will return 7000/7001, and within RESP_TO ms the slave reply will set DONE = TRUE with the requested register values in the output buffer.

Verification Procedure

1. Open the online watch table for the Modbus_Master instance DB. Confirm:
   • BUSY toggles TRUE for the duration of the request.
   • DONE pulses TRUE one cycle after the reply arrives.
   • ERROR stays FALSE.
2. Compare the received holding-register payload (e.g. the 32-bit floating-point value of kWh) with a hand-held reading from the LUMEL meter's local display. The two must match to within the resolution declared by the meter's datasheet.
3. Capture the bus on a scope or an inexpensive USB tap. Verify the voltage swing on pins 12/14 is at least +/- 1.5 V differential (RS-485 spec allows +/- 200 mV receiver threshold, +/- 1.5 V driver minimum, with the CM PtP at +/- 3.3 V typical). A flat line or inverting-only signal indicates the line is still in RS-232 mode.
4. Power-cycle the entire station (CPU + IM + CM PtP + slave). The link must come up automatically after the cold start. If it does not, the Modbus_Comm_Load call is missing from OB100.

Diagnostic Matrix

Wiring and Termination Best Practices

• Use a twisted pair for the 2-wire RS-485 link. Shielded cable is recommended in panels with VFDs or servo drives within 200 mm of the run.
• Install a 120 ohm terminator at both ends of the bus. The CM PtP does not provide internal termination; add it at the D-sub connector backshell or at the LUMEL terminal block.
• Add a 10 kohm pull-up on the B line (pin 1) to +5 V and a 10 kohm pull-down on the A line (pin 12) to GND, at the master end only, if the meter is known to be a passive listener (no fail-safe bias).
• Ground the shield at one end only to avoid ground loops. CM PtP backshell must be metallically bonded to the DIN-rail grounding bar.
• Maximum stub length: 0.3 m from the trunk to the meter. The LUMEL energy meters are usually daisy-chained; do not branch into a star.

Common Pitfalls and Counter-Intuitive Behaviour

1. The device configuration checkbox does not always win. In TIA Portal, the Operating mode dropdown in Properties > Port configuration writes the default that survives a project re-download. The runtime MODE input on Modbus_Comm_Load, however, overrides it after the first call. If you set the dropdown to RS-485 and still see RS-232 traffic, the runtime MODE has been left at its default (1) and is overriding the project setting.
2. Cold restart is mandatory after changing MODE. A simple STOP -> RUN transition does not reset the port register inside the CM PtP. Use MRES or power-cycle.
3. REQ must be edge-triggered. Holding REQ = TRUE continuously does not re-parameterise the port every cycle; it only writes once. After a parameter change, you must drop REQ to FALSE and bring it back to TRUE.
4. Two-wire and four-wire share pins. On the CM PtP socket, pin 1 and pin 12 are the "A" side and pin 2 and pin 14 are the "B" side. Modbus RTU uses pins 12 and 14 as the differential pair. Do not assume pin 1/2 are always the right place to land a wire just because they are labelled in the diagram.
5. The slave address must be set on the meter. A Modbus poll for unit 1 against a meter addressed to unit 2 will return 7002 + ERROR with no slave reply; the port is functioning correctly, but the meter is silently ignoring the frame.