Resolving ET200SP Modbus Master Error 7000 with PtP Blocks

Resolving ET200SP Modbus Master Error 7000 with PtP Blocks

When a SIMATIC ET 200SP distributed I/O station is configured as a Modbus RTU master and paired with a SIMATIC S7-300, S7-400, S7-400H, S7-1200, or S7-1500 controller, the most common commissioning symptom is that the MODBUS_COMM_LOAD (STEP 7 V5.5: FB640 "Modbus_Master"; TIA Portal: MODBUS_COMM_LOAD_DB) function block reports status code 7000 on its STATUS output, never sets the DONE bit, and the CPU diagnostic buffer records an area access error on the backplane serial module. The block is then disabled (EN never propagates) and no Modbus traffic is generated. This article explains why status 7000 is reported, what is missing in the program, and the exact block sequence required to clear the fault and bring up the link.

1. Problem Overview

Symptom summary observed on a typical S7-400H station with an ET 200SP on PROFIBUS or PROFINET:

• The block instance of MODBUS_COMM_LOAD / FB640 executes, but the DONE output never goes TRUE.
• The STATUS output reads 16#7000 continuously.
• The S7 CPU diagnostic buffer lists "Area access error" on the ET 200SP interface module (e.g., IM 155-6 DP HF (6ES7155-6BA01-0CN0)) and the PtP communication module (e.g., CM PtP, 6ES7137-6AA00-0BA0 or 6ES7137-6AA01-0BA0).
• No REQ pulses reach the Modbus master block, or the block remains disabled.
• Status LEDs on the CM PtP module do not progress through the typical initialization sequence.

2. What Status 7000 Actually Means

Siemens Modbus and PtP function blocks return status codes from a shared numbering scheme. Status 7000h is the inactive code emitted when the block has not yet been called with an active job, or when the referenced channel is not ready. The relevant excerpts from the Modbus RTU status table are summarized below.

Status 7000 should not be treated as a fault in isolation. When it persists on every cycle, the context is missing initialization, and the CPU diagnostic buffer's area access error confirms this: the block is trying to access process image addresses that have not been mapped because the serial port configuration is incomplete.

3. Root Cause: Missing PtP Communication Blocks

The ET 200SP CM PtP module does not perform Modbus RTU on its own. It is a generic serial interface (RS-232, RS-422, RS-485) that requires the user program to load a protocol stack and channel parameters at run time. In STEP 7 V5.5, this is done with the PtP communication library for distributed I/O (Siemens entry ID 69124220). In TIA Portal, the protocol is loaded by the MODBUS_COMM_LOAD instruction itself, but on STEP 7 V5.5 / S7-300/400, the equivalent Modbus master block (FB640) only operates once the lower-level PtP blocks have been added and processed.

The blocks that must be present in the program are:

• FB611 – PtP send/utility block
• FB612 – PtP receive/utility block
• FB613 – PtP protocol utility block
• FB614 – PtP protocol utility block
• FB617 – PtP protocol/initialization block for the serial port

If any of these blocks is missing from the S7 program container, the call to MODBUS_COMM_LOAD / FB640 cannot acquire the initialized channel and falls back to status 7000. Adding these blocks resolves both the persistent 7000 status and the area access error in the CPU diagnostic buffer.

4. Hardware and Software Prerequisites

Before reconfiguring the software, verify that the hardware configuration matches the assumed topology. The following items are required.

Refer to the SIMATIC ET 200SP manual collection for the latest configuration limits, status/error codes, and module firmware requirements. The IM 155-6 DP HF status and error display page is the authoritative source for LED codes on the head module.

5. Required Function Block Architecture

The program sequence on the CPU is split into two layers: an initialization layer (PtP blocks) and an application layer (Modbus master/slave blocks). The initialization layer is one-shot per port. The application layer is cyclic.

5.1 Initialization layer (call once per port)

In OB100 (warm restart) or in a startup section, instantiate and call:

1. FB617 with the configured port index, baud-rate code, parity, and data bits. Wire the instance DB to a global DB for visibility.
2. FB613 and FB614 to register the protocol state machine.
3. FB611 and FB612 to expose the send/receive buffers used by the higher layer.

These blocks write configuration records into the CM PtP module through the backplane of the ET 200SP. The ET 200SP interface module then enables the channel and reports the channel state to the CPU.

5.2 Application layer (cyclic in OB1)

Once the initialization layer has run, the Modbus master block FB640 "Modbus_Master" can be called cyclically. The relevant input parameters are:

After the application layer is in place and OB100 has executed, the persistent 7000 status is replaced by a one-shot DONE pulse followed by either 0 (success) or one of the 80xx error codes. The CPU diagnostic buffer no longer logs an area access error on the CM PtP module.

6. Step-by-Step Configuration Procedure

1. Verify HW config. In SIMATIC Manager (STEP 7 V5.5) or TIA Portal, open HW Config and confirm the ET 200SP station contains the CM PtP module (6ES7137-6AA01-0BA0) on the correct slot. The module must be assigned to a logical port index. The port address assigned in HW config is what FB640 uses internally.
2. Install the PtP library. From Siemens support entry 69124220, install the S7-300/400 PtP library for distributed I/O. Copy the FBs into the S7 program container.
3. Install the Modbus RTU library. From Siemens support entry 109474714, install the Modbus RTU master/slave example for S7-300 and ET 200S. This provides FB640 (Modbus_Master) and FB641 (Modbus_Slave) along with their instance data blocks.
4. Insert initialization FBs in OB100. Drop FB611, FB612, FB613, FB614, and FB617 into OB100. Connect the configuration inputs (port, baud-rate code, parity, data bits) and let the FBs run once on startup.
5. Insert FB640 in OB1. Place FB640 "Modbus_Master" in OB1 (or in a slow cyclic OB such as OB35 if you want a fixed scan period for polling). Wire the application-layer inputs and connect REQ to a free-running clock or to a previous DONE to chain jobs.
6. Set BAUD parameter. For 9600 baud, set BAUD = W#16#0006 (see Section 7 for the full table). The number 6 is the code, not the baud rate itself.
7. Compile and download. Compile the S7 program, perform a full download to the S7-400H, and ensure the ET 200SP head module is online and the CM PtP module reports no fault (green status LED, no BF / SF).
8. Run OB100 once. Trigger a CPU restart (STOP → RUN on the active S7-400H controller) so that OB100 executes and the PtP blocks initialize the port. If the program is downloaded to a running CPU, force a restart of the user program.
9. Monitor STATUS. In a VAT or in the HMI tag list, monitor the STATUS output of FB640. The 7000 code should clear within a single scan after OB100 runs, replaced by 7001 / 7002 during a transaction and 0 (or an 80xx error) at the end.

7. FB640 Baud Rate Parameter Encoding

Many engineers miss the fact that the BAUD input on FB640 is an index, not a value in bits per second. The mapping is fixed and reproduced below from the FB640 documentation.

For 9 600 / 8 / N / 1 (the most common Modbus RTU default) the configuration is: BAUD = W#16#0006, PARITY = 0 (none), DATA_BITS = 8 (implicit), and STOP_BITS = 1 (implicit). The MODE input selects RTU (typically 1) or ASCII (typically 0).

8. Common Configuration Errors

The most frequent field reports correspond to rows 1 and 7. The area access error in the diagnostic buffer is often misread as a hardware fault. In reality, the CPU is logging the I/O access failure caused by the missing initialization blocks, not by the module itself.

9. Diagnostics and Area Access Errors

When the PtP initialization blocks are absent, the CPU diagnostic buffer records an entry of the form:

"Area access error when reading I/O address x (module slot y)"

The exact wording depends on the CPU firmware level. The SIMATIC ET 200SP status and error codes page lists all such entries, including the invalid configuration states and the supply voltage L+ loss on BaseUnit types BU...D that are also commonly confused with this symptom.

To filter the buffer, open the CPU in SIMATIC Manager, navigate to CPU › Diagnostic Buffer, and apply a filter for "Area length error" or "I/O access error". Once the PtP blocks are added, no further entries of this type should be logged for the same slot.

10. Cross-Platform Compatibility

The behavior and the fix differ depending on the controller generation. The table below summarizes the engineering paths.

For S7-1200 / S7-1500 stations, the only block required to load the port is MODBUS_COMM_LOAD, and the only block required for the master is MODBUS_MASTER. The status 7000 symptom rarely appears on these controllers, because the instruction set includes internal initialization. The symptom is essentially STEP 7 V5.5 / S7-300/400 specific.

11. Verification Procedure

1. Diagnostic buffer clean. Force a warm restart and verify that no new "Area access error" entry is logged for the CM PtP slot.
2. STATUS transitions. Watch the STATUS output of FB640 in a VAT. Expected sequence: 7000 (idle) → 7001 (job starting) → 7002 (job in progress) → 0 (DONE pulse) on success. On failure, expect an 80xx code with ERROR pulsing high.
3. DONE pulse. Confirm that the DONE output generates one positive edge per successful poll, with no double-pulsing or hanging HIGH.
4. Slave response. Connect a Modbus RTU slave (or a simulator) and verify that the response data appears in the configured receive DB. Cross-check the CRC-16 of the response with a Modbus protocol analyzer.
5. LEDs on CM PtP. Observe the TXD / RXD activity LEDs on the CM PtP module. Periodic flashes during polling confirm the physical layer is alive.
6. CPU LEDs. No SF (red) on the CPU, no BF / SF on the ET 200SP IM 155-6 head module, no group fault on the CM PtP module.
7. Long-duration test. Run the polling loop for at least one hour and confirm that no status regresses to 7000 and that no diagnostic buffer entries are appended.

If all seven checks pass, the Modbus RTU master on the ET 200SP is healthy. If a check fails, return to Section 8 and use the error matrix to isolate the new symptom.