Resolving Modbus Error 8383 on Siemens S7-1200 with CP1241

Problem: Modbus Master Returns Exception 0x8383 on S7-1200

An S7-1200 CPU 1212C (AC/DC/RLY) equipped with a CM 1241 (CP 1241) RS-485 communication module is configured as a Modbus RTU master that polls a remote annunciation module over a 2-wire RS-485 link. After loading the TIA Portal V11.0 SP2 project, every write of process values to the slave's user registers (slave data area 1122–1169) returns the status code 0x8383 from the MB_MASTER / MB_CLIENT instruction. Read requests against the same area succeed, but no write transaction ever reaches the slave's holding register bank.

Root Cause: MB_HOLD_REG Addressing Convention Violated

The Modbus reference model defines four separate address spaces: coils (0xxxx), discrete inputs (1xxxx), input registers (3xxxx), and holding registers (4xxxx). On a Modbus RTU slave, registers 1122–1169 are interpreted in the 4xxxx (holding register) address space. However, the Modbus RTU protocol packet itself does not contain the leading "4"; the four-digit number 1122 is sent on the wire as a 16-bit address equal to 1121 (Modbus uses zero-based register addressing inside each function code).

The S7-1200 MB_MASTER / MB_CLIENT instructions expose the MB_HOLD_REG data block as a single flat array and require a prefixed address string. The four-digit leading digit is a routing selector that tells the master which address space to use:

The original project entered the address as 1122. Because the master interprets the leading digit 1 as "discrete input / coil area" (a 1xxxx space, not 4xxxx), the request was assembled as a discrete input read against register 122 — well outside the slave's actual holding register map — and the slave rejected it with Modbus exception code 02 (Illegal Data Address). The S7-1200 then mapped that exception to its local status 0x8383.

Changing the address literal from 1122 to 41122 forces the master into the 4xxxx address space, so the request is correctly serialized as FC 16 against holding register 1122 (wire address 0x0461). The slave accepts the request, the writes complete, and 0x8383 no longer appears.

Decoding Siemens S7-1200 Modbus Master Status Codes

The STATUS output of MB_MASTER and MB_CLIENT on the S7-1200 is a 16-bit word. The MSB indicates the source (bit 15 = 1 ⇒ protocol / error class from the master; bit 15 = 0 ⇒ user/program error). Codes starting with 0x8 in the high byte are slave-originated Modbus exception codes mirrored by the master; codes starting with 0x8 in the low byte are local master-internal diagnostics. The most frequently seen codes are reproduced in the table below.

The line between "0x80E2" (slave-side illegal data address) and "0x8383" (master-side data address out of range) is the most common source of confusion. The pragmatic diagnostic rule used on commissioning sites is:

• If STATUS is in the 0x80xx range and the slave echoes a clean Modbus exception frame on a bus analyzer, the problem is in the slave's data map.
• If STATUS is in the 0x83xx range, the request never made it onto the bus or it was assembled with the wrong address prefix — focus on the MB_HOLD_REG DB layout, the DATA_ADDR literal, and the DATA_LEN parameter.

Modbus Function Code and Register Map for the Annunciation Slave

Annunciation / alarm-annunciator modules typically expose their user-visible registers in a fixed 4xxxx area. Although the exact register map is vendor-specific, the canonical layout for the device class shown in the source case is reproduced below; refer to the slave's own manual for the authoritative map.

Modbus RTU write transactions to the bank are typically issued with Function Code 16 (Write Multiple Registers, 0x10) because 48 contiguous registers is well below the FC 16 limit of 123 registers per PDU. The byte sequence on the wire is:

where 01 is the slave address, 10 is FC 16, 04 61 is the big-endian starting register address (1122 − 1 = 1121 = 0x0461, per Modbus zero-based numbering), 00 30 is the quantity of registers (48 = 0x30), and the payload is 96 bytes (48 × 16-bit words).

Step-by-Step Fix in TIA Portal V11.0 SP2

1. Open the project and navigate to the MB_MASTER or MB_CLIENT instance DB.
2. Locate the call site that issues the FC 16 write (typically a function block named FB_Annunc_Write or similar). Identify the input pin wired to DATA_ADDR.
3. Confirm that the input is a WORD / UINT literal that contains only the four-digit register number, not a 5- or 6-digit prefixed value. The literal 1122 will silently be reinterpreted as "1-prefix → coil / discrete input area → register 122" by MB_MASTER.
4. Change the literal to 41122 (decimal) so that the prefix digit 4 selects the holding register space and the trailing four digits select register 1122.
5. Recompile and download the program block. Power-cycle the S7-1200 only if TIA Portal prompts for a cold restart (typical for V2.x firmware when the MB_HOLD_REG DB size changes; not required if only the literal was changed).
6. Force a single write cycle and observe the STATUS output of MB_MASTER. The expected value is now 16#0000 for a successful transaction.
7. Read back the same register bank (FC 03, DATA_ADDR = 41122, DATA_LEN = 48) and confirm the written values match the source DB.

Hardware and Cabling Checks (RS-485)

Even after the addressing issue is resolved, persistent 0x8383 / 0x80E2 faults sometimes reappear when the physical layer is marginal. Confirm the following before declaring the issue closed:

The CM 1241 RS-485 module ships with an internal 390 Ω pull-up on D1 (B) and 390 Ω pull-down on D0 (A) that acts as a weak fail-safe bias. If the bus is otherwise unterminated, you can leave the internal bias enabled; disable it if you install a third-party repeater or terminator that already provides bias, to avoid loading the line.

Verification Procedure

1. Place the S7-1200 in RUN with the corrected program. Open a watch table on the MB_MASTER instance DB and monitor DONE, ERROR, and STATUS.
2. Trigger a single write. Confirm DONE = 1 and STATUS = 16#0000 within one scan of the master's REQ falling edge.
3. Issue a read against the same register bank and compare the returned values to the written values in the source DB. A byte-level match confirms end-to-end integrity.
4. Cycle power to the slave and re-issue the write. The slave should accept the broadcast without re-initialization (Modbus RTU is stateless on the master side; the slave may need to refresh its NVRAM-mirrored parameters).
5. Capture a Modbus RTU trace on a third-party analyzer (e.g., a laptop running Modbus Poll in sniffer mode) and verify that the on-wire PDU matches the expected FC 16 frame shown above.

Alternate Addressing Forms and Edge Cases

Siemens has used three addressing schemes for the S7-1200 Modbus master over the product's lifetime. Knowing which scheme your firmware uses prevents the 0x8383 trap from re-appearing in a future firmware upgrade.

Note that some annunciator manufacturers publish register maps that number from 40001 (1-based with the 4 already factored in) rather than from 1. The conversion rule is: modbus register number = slave map address − 40000 (e.g., map address 41122 ⇒ register 1122 ⇒ use DATA_ADDR = 41122 in the S7-1200 because the leading 4 selects the HR space and the remaining 1122 is the offset within that space). A discrepancy here is the second most common cause of 0x8383 in the field.

Troubleshooting Matrix

Documentation References

For the commissioning engineer, the authoritative references for this case are the Siemens S7-1200 Modbus/USS programming manual and the CM 1241 RS-485 module manual, plus the Modbus Organization's specification for protocol-level behavior. Use these documents to validate any register map or error code interpretation before applying it in production.

• Siemens Industry Online Support — S7-1200 product pages and KB articles
• Modbus Organization — Modbus Application Protocol V1.1b3 specification
• Modbus Organization — Introduction to Modbus
• ABB Modbus RTU Communication Module (>125A) product page (representative of Modbus-RTU annunciation-class peripherals)

FAQ