Resolving MB_MASTER Error 8188: S7-1200 Modbus Mode 104/106

Problem Overview: Error 8188 on MB_MASTER

When the legacy MB_MASTER instruction is called on a Siemens SIMATIC S7-1200 CPU (for example the S7-1215C) paired with a CM1241 (RS422/485) communications module in TIA Portal V15 or later, configuring MB_MODE = 106 returns error code 8188 in the STATUS output ("Invalid Mode specified for broadcast request"), while MB_MODE = 104 executes without raising the error. The same symptom appears on any CPU firmware that still resolves MB_MASTER from the legacy Modbus RTU library (V3.x or earlier). It also surfaces after migrating an older program to TIA Portal V18, V19, or V20 if the master block signature has not been re-linked to the current Modbus library.

The root cause is a documented discrepancy in the MB_MODE validation table: the Modbus RTU library distributed before V4.0 only accepts Modes 0 to 6, while the Modbus library V4.0 and later exposes Modes 100 to 116 that map one-to-one to standard Modbus function codes (FC 01 through FC 16). When the legacy block receives a Mode value it does not recognize, the validation logic inside FB 1105 fails the request and sets STATUS = 16#2004 (8188 decimal). The trigger condition is the combination of an unrecognized MB_MODE and the implicit broadcast address range (slave ID = 0 or address inside the 0xxxx coil space).

Affected Hardware, Firmware, and Library Versions

On CPU firmware V2.2 the only available master is the legacy MB_MASTER (FB 1105). Starting with firmware V4.0, Siemens replaced it with the DB-based Modbus_Master (FB 1090). The two blocks coexist in a TIA Portal project library but cannot be cross-compiled without re-mapping the instance DB and the parameter list.

MB_MASTER vs. Modbus_Master: Block Comparison

The mixed behavior reported in the source thread — Mode 104 working while Mode 106 fails — is the classic fingerprint of the V4.x+ Modbus_Master block sitting next to a CPU still running firmware V2.2 documentation. The user is most likely reading the TIA Portal V20 MB_MODE documentation while executing the legacy FB 1105.

MB_MODE, MB_DATA_ADDR, and MB_DATA_LEN Parameters

Per the TIA Portal V20 documentation for the Modbus TCP library versions V4.0 and later (applies structurally to Modbus RTU on the same firmware generation), MB_MODE carries both the read/write direction and the function-code mapping:

The TIA Portal redundant MB_RED_CLIENT documentation confirms the same Mode set for the V5.0+ library: "Read: MB_MODE = 0, 101, 102, 103 and 104. Write: MB_MODE = 1, 2, 105, 106, 115 and 116."

MB_DATA_ADDR: How the Address-Class Trick Works

Legacy MB_MASTER uses the Modbus address-class convention to infer the function code:

• 0xxxx → FC 01 (Read Coils)
• 1xxxx → FC 02 (Read Discrete Inputs)
• 3xxxx → FC 04 (Read Input Registers)
• 4xxxx → FC 03 (Read Holding Registers) and FC 06/16 writes

The block subtracts the address-class prefix before transmitting, so MB_DATA_ADDR = 30023 with MB_MODE = 0 sends FC 04 at Modbus register 22. This is the exact behavior reported in the source thread: 30023 + Mode 0 = function 04, address 22 on the wire.

Current Modbus_Master abandons the address-class trick and forces the user to specify MB_MODE explicitly. MB_DATA_ADDR is now the literal Modbus register address (1-based) with no prefix offset.

Root Cause Analysis

Three independent causes can produce STATUS 8188 with Modes 104 and 106:

1. Library/block mismatch. The legacy MB_MASTER (FB 1105) shipped with library V3.x does not recognize Modes 101–116. The block's internal switch table only contains values 0–6 and a few reserved codes. When the call resolves to FB 1105 with MB_MODE = 106, the validation rejects the mode and returns 8188. Mode 104 may pass in some builds only because the validation includes an FC 04 escape through the address-class decoder when the function code is implied by the address prefix.
2. CPU firmware vs. library version skew. The S7-1200 System Manual specifies a minimum CPU firmware for each Modbus library version. Library V4.0 requires CPU firmware V4.0+; library V3.x is paired with firmware V2.2 – V3.x. If you compile a V15/V16/V17 project with library V4.x but download to a V2.2 CPU, the block signature and mode table diverge and 8188 appears.
3. Broadcast bit collision. For legacy MB_MASTER, slave ID = 0 is the broadcast address. If MB_DATA_ADDR evaluates inside the broadcast segment together with a write function code, the block returns 8188 to prevent accidental writes to all slaves. Mode 106 (FC 06) is a single-register write — it is legal, but only outside the broadcast address space (slave IDs 1–247).

Resolution Path Selection

Use the decision tree below to choose the correct fix.

Resolution Steps for Legacy MB_MASTER (Firmware V2.2)

1. Open TIA Portal → project tree → "Program blocks". Locate the MB_MASTER call.
2. Read MB_DATA_ADDR on the wire (capture with a Modbus sniffer if necessary). Identify the Modbus register the third-party slave expects.
3. Add the appropriate Modbus address-class prefix:
   • FC 04 (Read Input Registers): MB_DATA_ADDR = slave_register + 30000
   • FC 03 (Read Holding Registers): MB_DATA_ADDR = slave_register + 40000
   • FC 06 (Write Single Register): MB_DATA_ADDR = slave_register + 40000, MB_MODE = 6
   • FC 16 (Write Multiple Registers): MB_DATA_ADDR = slave_register + 40000, MB_MODE = 16
4. Set MB_MODE = 0 for reads and 5, 6, 15, or 16 for writes — never 101–116.
5. Compile and download. Watch STATUS return 0.

Resolution Steps for Modbus_Master (Firmware V4.0+)

1. Right-click "PLC → Program blocks → System blocks → Library". Confirm the "Modbus" library version is V4.0 or later and matches the CPU firmware generation.
2. Delete the calls to MB_COMM_LOAD and MB_MASTER.
3. From "Libraries → Modbus → Master/Client", drag Modbus_Comm_Load (FB 1089) and Modbus_Master (FB 1090) into OB1. The library auto-creates an instance DB "Modbus_Master_DB".
4. Wire the parameters:
   • REQ: rising-edge trigger (e.g., %M0.0 from a 100 ms clock or a one-shot)
   • MB_DB: connect to the Modbus_Master_DB data block
   • MB_MODE: use 102 (FC 03), 104 (FC 04), 106 (FC 06), 116 (FC 16)
   • MB_DATA_ADDR: literal slave register (no 3xxxx/4xxxx offset)
   • MB_DATA_LEN: number of registers or coils to transfer (max 125 words per FC 03/04 request)
   • MB_DATA_PTR: any ARRAY OF WORD, BOOL, or INT tag in a global DB
5. Wire the DONE, BUSY, ERROR, and STATUS outputs to your HMI or status DB.
6. Compile, download, and run online. Verify STATUS = 0 on the first successful exchange.

Address-to-Function-Code Mapping Reference

Verification

1. Trigger REQ on Modbus_Master once for each MB_MODE in use. Confirm STATUS = 0 and that DONE pulses true for one scan.
2. Check the CM1241 diagnostic LEDs. The TX and RX LEDs must flicker at the expected polling rate; sustained OFF means the slave is not responding.
3. Open "Online → Diagnostics → Diagnostic buffer" on the S7-1200. Confirm no entry references error W#16#2004 (8188) or W#16#80C8 (timeout).
4. Capture the bus with a Modbus sniffer (e.g., a USB RS485 tap and Wireshark with the Modbus dissector). Validate that the transmitted packet shows the expected FC byte (04 for Mode 104, 06 for Mode 106) at the expected register.
5. Force a write to a single register (Mode 106, register 1, value = 16#1234). Read back the same register with Mode 102. If the value matches, the round-trip is correct.

Compatibility Matrix: Library vs. CPU Firmware

Troubleshooting Matrix

Notes on Third-Party Devices

Many third-party Modbus slaves (variable-frequency drives, energy meters, environmental sensors) do not strictly follow the Modbus address-class convention. They expose input registers at low addresses (for example register 22) and require FC 04 regardless of the address. Two clean fixes exist:

• Legacy firmware (V3.x or earlier): Specify MB_DATA_ADDR = 30023 with MB_MODE = 0. The block subtracts the 3xxxx prefix and transmits FC 04 at Modbus register 22. This is the workaround observed in the source thread.
• Current firmware (V4.0+): Specify MB_MODE = 104 with MB_DATA_ADDR = 22 (literal). The block transmits FC 04 at register 22 without any offset trick.

Both approaches send the identical byte sequence on the wire. Pick the one that matches your CPU firmware to avoid STATUS 8188.