Resolving MODBUS RTU Bad CRC Errors on S7-1200 CM 1241 RS485

Problem Overview

Intermittent Bad_CRC_Count increments and silent slave lock-ups are a classic failure mode on S7-1200 MODBUS RTU multi-drop RS485 networks. A field-typical signature is:

• Master CPU: SIMATIC S7-1200 (e.g. CPU 1214C DC/DC/DC, 6ES7214-1AG40-0XB0) with one CM 1241 RS422/485 communication module (6ES7241-1CH32-0XB0).
• Slave #1: SENTRON PAC3100 power monitoring device (7KM3100-0CA01-1AA0) via its integrated RS485 Modbus port.
• Slave #2: SIMATIC S7-1200 (e.g. CPU 1212C, 6ES7212-1AE40-0XB0) with its own CM 1241 RS422/485, configured as a Modbus RTU slave using the MB_SLAVE instruction from the TIA Portal "Modbus" library.
• Polling cadence: master issues Modbus requests every 500 ms to each slave.

After 2 to 3 hours of stable operation, the slave S7-1200 stops responding, while the PAC3100 keeps communicating normally. The MB_SLAVE_DB instance data block shows Bad_CRC_Count = 1 and the MB_MASTER status remains 0000. The bus appears to be wedged in a state that only a CPU restart of the slave clears. This article documents the root cause and the four canonical remediations used by Siemens support.

Affected Components and System Configuration

The hardware base is documented in the SIMATIC S7-1200 Programmable Controller System Manual and the CM 1241 RS422/485 device manual, both available on the Siemens Industry Online Support portal (entry IDs 109751587 and 90553589 respectively).

Symptom Signature

The failure pattern reproduces deterministically when the following conditions coincide:

1. Two or more Modbus RTU slaves share one CM 1241 RS485 segment.
2. The master polls at a fixed cycle of 200 ms to 1000 ms.
3. At least one slave returns a register block larger than approximately 60 to 100 bytes of application data (≥ 30 holding/input registers per transaction).
4. The CM 1241 is configured in RS485 two-wire half-duplex mode (the most common configuration).
5. The slave PLC's MB_SLAVE is called in OB1 (lowest priority cyclic OB).

Observable symptoms on the master side:

• MB_MASTER.Done toggles, but the response data is frozen at the last good value.
• Status word MB_MASTER.status cycles through 0x0000, 0x80C8 (CRC error returned by the CM), or 0x80D0 (no response / timeout).
• Diagnostic buffer of the master CM 1241 contains the entry "The CM or CB returned a received message with a length greater than the length parameter allowed" with error code 0x8083 (decimal 32899).

Observable symptoms on the slave S7-1200 side:

• MB_SLAVE_DB.Bad_CRC_Count increments to 1 and stops incrementing.
• MB_SLAVE_DB.Received_Count no longer advances.
• The RX FIFO inside the CM 1241 stays loaded with the corrupt frame; no further frames are serviced.
• A STOP/RUN or power-cycle of the slave CPU is the only way to resume normal polling.

Root Cause: Receive Buffer Overflow (Status 0x8083)

The CM 1241 RS422/485 exposes a fixed receive FIFO of 256 bytes per port. When the CM hands a complete Modbus PDU up to the MB_SLAVE instruction, the FB performs CRC validation and posts the payload into the configured holding register range. If the physical frame arriving on the bus is longer than the length parameter configured in MB_COMM_LOAD (the MB_LEN input on the MB_SLAVE instruction) and longer than the FIFO can buffer before the cyclic OB processes it, the CM raises status 0x8083:

"The CM or CB returned a received message with a length greater than the length parameter allowed."

The MB_SLAVE FB does not automatically drain the receive buffer on error. Once a single over-length or corrupted frame is latched, every subsequent Modbus request is still accepted by the CM hardware, but the MB_SLAVE instance is unable to ingest it because its internal state machine is parked in the error state. The Bad_CRC_Count tag increments exactly once because the bad frame is counted, then the slave effectively goes deaf. The PAC3100 continues to respond normally because it is a dedicated measurement device with hardware-managed framing; it does not run the Siemens Modbus RTU library and therefore does not exhibit the same lock-up path.

Diagnostic Procedure

1. Read the CM 1241 diagnostic buffer. In TIA Portal, expand the device configuration of the master CPU, select the CM 1241, and open Online & Diagnostics → Diagnostic Buffer. Look for entry "Point-to-point status: 0x8083" with timestamp aligned to the failure window.
2. Monitor MB_SLAVE tags in a watch table. Add the following tags to a watch table on the slave PLC and observe with Monitor all:
   MB_SLAVE_DB.Bad_CRC_Count
MB_SLAVE_DB.Received_Count
MB_SLAVE_DB.Error_Count
MB_SLAVE_DB.Slave_Message_Count
   If Received_Count freezes while the master continues to send requests, the buffer is stalled.
3. Capture the bus with a protocol analyzer. Connect a Modbus RTU sniffer (e.g. a tap on the differential pair) and log 30 minutes of traffic. Look for frames whose length exceeds the configured MB_LEN on the slave, or for back-to-back requests without inter-character gaps that violate the Modbus RTU 3.5-character silence rule.
4. Isolate the failure to a single transaction. Reduce the master's polling to one slave at a time. If the issue disappears with only the PAC3100, the slave S7-1200's receive path is the bottleneck. If both slaves fail in isolation, the wiring (termination, biasing, cable type) is the primary suspect.

Solution 1: Reduce Modbus Register Block Size

Modbus function codes 03 (Read Holding Registers) and 04 (Read Input Registers) allow a maximum of 125 registers per request. The CM 1241 buffer is more than sufficient for a single legal request, but the MB_SLAVE instruction must be able to post the full payload to the process image in a single OB pass. The pragmatic rule of thumb is:

• Limit each read request to ≤ 25 registers (50 bytes application data) when the bus is shared.
• Limit each write request to ≤ 20 registers (40 bytes application data).
• Split large data sets into multiple smaller transactions at the master level.

This is the single most effective remediation and the one most field engineers confirm resolves the issue without further changes.

Solution 2: Lower the Baud Rate

The CM 1241 supports 300, 600, 1200, 2400, 4800, 9600, 19200, 38400, 57600, 76800, and 115200 bps. The 1.5- and 3.5-character inter-frame gaps that Modbus RTU requires scale with the bit time. At 115200 bps the 3.5-character gap is approximately 0.3 ms; at 9600 bps it is 3.6 ms. A PLC whose OB1 cycle time drifts above the inter-frame gap can interleave replies with the next master request, corrupting the bus.

For 2-3 slave networks with mixed Siemens and third-party slaves, 19200 bps is the most reliable default. Reserve 115200 bps for point-to-point links where the master's cycle time is deterministic.

Solution 3: Increase OB Priority

Place the MB_SLAVE call in a higher-priority cyclic OB, typically OB30 (or any OB3x) configured to a 1 ms to 5 ms cycle. The MB_SLAVE FB is non-blocking and re-entrant, so a 1 ms cyclic call is safe and drains the CM FIFO promptly. This eliminates the gap between "frame received" and "frame handed to the application".

Configuration in TIA Portal:

1. Add OB30 (Cyclic interrupt) to the slave project.
2. Set cycle time to 1000 µs (1 ms) for baud rates ≥ 19200, or 2000 µs (2 ms) for 9600 bps and below.
3. Move the MB_SLAVE_DB call from OB1 to OB30. Keep the MB_COMM_LOAD call in OB100 (warm restart) so it executes once after power-up.

Solution 4: Switch to RS422 with Hardware Handshaking

If the network is strictly point-to-point, the CM 1241 supports RS422 four-wire full-duplex with hardware RTS/CTS flow control. The dedicated RTS pin (TTL level) signals the line driver direction. With RTS controlled by the CM firmware, the receive buffer cannot be overrun by stray characters because the slave's transmitter is gated off when the master is transmitting.

This solution is only viable when the slave count is 1. It is mentioned here as a fallback for installations where reducing baud rate or register count is not acceptable.

Termination, Biasing, and Cable

RS485 requires termination at both physical ends of the bus segment, never in the middle. The termination resistor value should match the characteristic impedance of the cable, typically 120 Ω, and must not exceed 200 Ω. Place 120 Ω between A and B (PROFIBUS pins 3 and 8) at the device that is at each end of the trunk.

RS485 also benefits from a defined idle-state bias on the differential pair. The PROFIBUS convention is:

• Pull-up resistor (typically 10 kΩ or 680 Ω) from B (Pin 3) to +5 V termination voltage.
• Pull-down resistor (same value) from A (Pin 8) to GND.

These pull-ups are not termination; they are fail-safe biasing and prevent noise from being interpreted as a start bit. The biasing network is typically installed once per segment, near the master or at a powered node. The CM 1241 RS422/485 does not include internal biasing resistors; they must be added externally.

Cable selection: use a twisted-pair with overall shield, characteristic impedance 100 to 120 Ω, capacitance ≤ 60 pF/m. Belden 3106A or Lapp ETHERLINE 2-pairs are common choices. The shield must be bonded to ground at one end only to prevent ground loops.

MB_SLAVE_DB Reset Procedure

There is no documented instruction that resets the MB_SLAVE instance data block while preserving configuration. The supported recovery options are:

1. CPU restart (STOP/RUN). This re-initializes the instance DB and re-issues MB_COMM_LOAD from OB100.
2. Reinitialize the instance DB. Open the slave project in TIA Portal, mark MB_SLAVE_DB, and use Online → Reset to initial values. This forces the FB to re-enter its initial state and is faster than a full restart.
3. Re-trigger MB_COMM_LOAD. A boolean edge on the REQ input of MB_COMM_LOAD forces the CM to reconfigure, which clears the FIFO and the internal state machine without dropping the CPU into STOP.

Manual clearing of the Bad_CRC_Count tag is not a recovery action. Writing a 0 to the tag clears the counter but does not drain the FIFO; the next request will continue to fail because the bad frame is still queued in the CM hardware buffer.

Status Code Reference

For the complete set of MB_SLAVE status codes refer to the TIA Portal help topic "MB_SLAVE: Modbus slave" in your installed STEP 7 version, and the CM 1241 RS422/485 device manual (Siemens support entry ID 90553589).

Implementation Walk-through

1. Library version. Confirm the Modbus RTU library version matches your TIA Portal version. Library "Modbus RTU" V2.x or higher is required for S7-1200 CPUs with firmware 4.2 or higher. Older library versions (V1.x) did not have the Bad_CRC_Count tag and use a different status word layout.
2. MB_COMM_LOAD configuration. Set the baud rate to a value that all slaves support (PAC3100 supports up to 19200 bps; the S7-1200 CM supports up to 115200 bps — the common denominator wins). Configure parity = None, data bits = 8, stop bits = 1, flow control = None for RS485 two-wire mode.
3. MB_SLAVE wiring. In the slave S7-1200, wire the MB_SLAVE FB with MB_ADDR = 2 (the slave's station address), MODE = 0 (full Modbus RTU server), and the register ranges mapping to your data block.
4. MB_MASTER on the master. In the master S7-1200, configure MB_MASTER with two separate read requests per cycle, one addressed to slave 1 (PAC3100) and one to slave 2 (PLC 1212C). Use a small DATA_ADDR / DATA_LEN per request, e.g. 16 registers, polled every 500 ms.

Verification Checklist

• ☐ Continuous poll for at least 24 hours with no Bad_CRC_Count increment.
• ☐ Master MB_MASTER.status = 16#0000 for every transaction.
• ☐ Slave MB_SLAVE_DB.Received_Count advances at the configured poll rate.
• ☐ Master CPU diagnostic buffer contains no 0x8083 entries for the CM 1241.
• ☐ Oscilloscope capture of the differential pair shows clean edges, no ringing, and 3.5-character inter-frame silences between transactions.
• ☐ Measured A-B idle voltage ≥ 200 mV (biasing present).
• ☐ Measured A-B voltage during transmission between 1.5 V and 5.0 V differential.