Resolving Modbus RTU CM1241 G2 Error 7000 on S7-1200 G2

Problem Statement: Modbus RTU Error 7000 Series on S7-1200 G2

A recurring field problem occurs when commissioning Modbus RTU communication on a second-generation S7-1200 CPU paired with a CM1241 G2 communications module under TIA Portal V21. The Modbus_Comm_Load instruction cycles through STATUS values of 16#7000, 16#7001, and 16#7002, the TX LED on the CM1241 G2 module pulses at the configured baud rate, and the RX LED never illuminates. The Modbus_Master block returns DONE = FALSE, ERROR = FALSE, and STATUS cycling through the same range. External test tools such as Modbus Poll show a connection error and never receive a valid response frame. The PLC, the module firmware, and TIA Portal are all current, yet the RTU bus remains silent in the receive direction.

Symptomatically this is not a single root cause. The 0x70xx range is a status-class code emitted by the Modbus_Comm_Load block, not a true Modbus protocol error. The error must be diagnosed at the layers below the protocol engine: the port initialization state machine, the RS485 physical layer, the hardware identifier assignment, and the configuration of TIA Portal V21 against the new G2 module firmware footprint.

Affected System Configuration

The following hardware and software versions are confirmed to exhibit the symptom and are the primary target of this article:

Although the user-visible parameters (9600 baud, 8 data bits, no parity, 1 stop bit) match the slave, the bus remains silent. The mismatch is somewhere in the layers below the user parameters, most often the hardware identifier passed to Modbus_Comm_Load.PORT or the physical wiring between the CM1241 G2 spring terminals and the slave device.

Decoding Modbus Status Codes 7000, 7001, 7002

Codes 16#7000 through 16#7002 are not errors. They are state-machine outputs from the Modbus_Comm_Load instruction that describe the port configuration lifecycle. The TIA Portal V21 documentation for the instruction defines the relevant status values for the G2 platform as follows:

The user-reported cycle of 0x7000 → 0x7001 → 0x7002 with a 1 Hz clock means the port is repeatedly re-initializing, and Modbus_Comm_Load is not reaching a stable "no error, idle" state because the subsequent call to Modbus_Master is being rejected (or because the MB_DB reference is wrong, see below). This is the first diagnostic that must be confirmed in the online STATUS field of the DB. The presence of 0x7002 specifically — not a 0x80xx code — rules out hardware identifier and physical port failures; the module is accepting the configuration. The failure is downstream.

Root Cause Analysis: TX-Only Behavior on CM1241 G2

When the TX LED pulses but the RX LED never lights, the differential driver is sourcing data and the receiver is either disabled, never enabled, or being over-driven by an incorrectly biased bus. The most common causes in this configuration are:

1. Hardware identifier (PORT) mismatch. TIA Portal V21 with the G2 HSP can reassign hardware identifiers when the device configuration is rebuilt. If the symbolic name in the project points to HW ID 274 but the online view shows 275, the call to Modbus_Comm_Load with the stale name is rejected silently. STATUS remains 0x7000-class because the FB call is technically valid; the kernel just routes the configuration to the wrong port (or to no port). This was directly observed in the affected project.
2. Termination and bias resistors missing or duplicated. The CM1241 G2 provides on-board termination that must be enabled with DIP switches at the ends of the bus. Without termination, the 9600 baud edges reflect and the receiver cannot lock. The user attempted to set LINE_PRE to 2 — this is a software concept in the Modbus library for "port preconditioning," not the physical DIP switch. Setting the parameter does not enable the resistors.
3. RS485 half-duplex vs. full-duplex wiring. MODE = 4 in the user's code selects RS422 (full-duplex, 4-wire). If the slave is on a 2-wire bus, the master and slave TX lines collide and the receiver sees garbage. The default for a 2-wire Modbus RTU bus is MODE = 0 (RS485 half-duplex).
4. Modbus_Master MB_DB reference. Modbus_Comm_Load takes an MB_DB input that must point to the instance DB of Modbus_Master. If the user passes a different DB, the master will not function and the comm state machine may oscillate.

Hardware Wiring and Termination Requirements

The CM 1241 G2 (6ES7241-1CH32-0XB0) has a 6-pin removable spring terminal block with the following pinout when operated as 2-wire RS485 (the default for Modbus RTU):

For 2-wire operation, pins 3 and 4 are the only data lines in use. The GND pin must be connected to the slave's GND; floating grounds produce a receiver that never sees a valid differential signal at the configured threshold. A common field error is leaving pin 5 disconnected when using a USB-RS485 converter that does not provide a logic ground reference.

DIP switches on the rear of the module must be set to match the bus position:

• Switch 1 (TERM): ON at each physical end of the bus to engage the 390 Ω termination resistor. For a two-node bus (one CM1241 G2 + one slave), both ends must be ON.
• Switch 2 (BIAS): ON at exactly one node to engage the fail-safe bias (pull-up on B+, pull-down on A−). Engage at the master or at the slave, never at both.

TIA Portal V21 Port Configuration and G2 Compatibility

The S7-1200 G2 series introduced a new device footprint and a new Hardware Support Package (HSP). TIA Portal V21 will compile a project against the G2 CPU but the CM1241 G2 module requires the matching HSP installed under "Manage HSP" before its firmware V1.0.2 descriptor is recognized. Without the HSP, TIA Portal defaults to a generic CM1241 V1.0 descriptor that compiles but does not match the physical module's behavior.

Configuration steps to verify:

1. In the device view, right-click the CM1241 G2 slot and open "Properties > Module parameters > Port configuration." Confirm the operating mode is set to RS485 half-duplex (2-wire) for a 2-wire Modbus RTU bus, or RS422 full-duplex (4-wire) only if the slave is wired accordingly.
2. Verify the baud rate dropdown offers 9600 — this is supported in firmware V1.0.2. Lower rates (1200, 2400) and higher rates (19200, 38400, 57600, 115200) must be matched between master and slave.
3. Confirm "No parity" and "1 stop bit" in the parity/stop-bit dropdowns. The CM1241 G2 supports 8N1, 8E1, 8O1, 8N2, 8E2, 8O2. If the slave is 8N1 and the master is accidentally set to 8E1, the frame check fails and the master increments the parity error counter without producing a DONE.
4. Read the Hardware identifier of the port from the device view's properties page or from the project tree. This is the value that must be passed (or symbolically referenced) into the PORT input of Modbus_Comm_Load. The reported value of 275 in the user's online view is the actual identifier; 274 was the stale value held in their project.

Implementing Modbus_Comm_Load and Modbus_Master in SCL

The block call itself is correct in principle. Two adjustments are required for stable behavior on a 2-wire bus. First, the MODE input of Modbus_Comm_Load should be set to 0 for RS485 half-duplex, not 4. The MODE input defines the serial port mode that the CM module is initialized to, and 4 corresponds to RS422 (4-wire). The second adjustment is the MB_DB reference. Modbus_Comm_Load must receive the instance DB of the Modbus_Master block; not a copy, not a different DB.

Reference code for a stable configuration on a 2-wire RS485 bus at 9600 baud, 8N1, polling slave address 1 holding register 40001:

// FB or OB1 in SCL

// --- Modbus_Comm_Load: configure the port once ---
"Modbus_Comm_Load_DB"(REQ   := "FirstScan",            // one-shot
                      PORT  := "Local~CM_1241_(RS422_485)_1",  // symbolic HW ID
                      BAUD  := 9600,
                      PARITY:= 0,                     // 0 = no parity
                      RESP_TO := 1000,                 // ms, response timeout
                      MB_DB := "Modbus_Master_DB");    // instance DB of master

IF "Modbus_Comm_Load_DB".DONE THEN
    "CL_Done"     := TRUE;
    "CL_Error"    := FALSE;
    "CL_Error_Nr" := 0;
END_IF;
IF "Modbus_Comm_Load_DB".ERROR THEN
    "CL_Done"     := FALSE;
    "CL_Error"    := TRUE;
    "CL_Error_Nr" := "Modbus_Comm_Load_DB".STATUS;
END_IF;

// --- Modbus_Master: cycle the request at a controlled rate ---
"Modbus_Master_DB"(REQ      := "Clock_1Hz" AND "CL_Done" AND NOT "MB_Busy",
                   MB_ADDR  := 1,                       // slave address
                   MODE     := 0,                       // 0 = read holding registers
                   DATA_ADDR:= 40001,                   // Modbus address (1-based)
                   DATA_LEN := 1,                       // number of words
                   DATA_PTR := "Value_Received");       // PLC tag, must be WORD or WORD array

IF "Modbus_Master_DB".DONE THEN
    "MB_Done"     := TRUE;
    "MB_Error"    := FALSE;
    "MB_Error_Nr" := 0;
    "MB_Busy"     := FALSE;
END_IF;
IF "Modbus_Master_DB".ERROR THEN
    "MB_Done"     := FALSE;
    "MB_Error"    := TRUE;
    "MB_Error_Nr" := "Modbus_Master_DB".STATUS;
    "MB_Busy"     := FALSE;
END_IF;
IF "Modbus_Master_DB".BUSY THEN
    "MB_Busy" := TRUE;
END_IF;

The MB_Busy latch prevents a new request from being submitted while the previous one is still being timed out. Without it, STATUS will cycle 0x7000-class as the kernel queues and cancels overlapping requests.

Diagnosing Port Number Mismatches in Online View

The user observed that the project view referenced port HW ID 274 while the online view showed 275. This is the single most common G2-series commissioning defect and is worth a dedicated diagnostic section.

1. Open the project tree and select the CM1241 G2 device.
2. Open the device view and select the port sub-module (typically shown as "Local~CM_1241_(RS422_485)_1").
3. Open the Inspector window under Properties > General > "Name" and "Hardware identifier."
4. Go online to the CPU and right-click the CM1241 G2 in the online device view. Select "Module information" and compare the hardware identifier listed there with the offline value.

If the two values differ, the offline project is stale relative to the physical configuration. Recompile the project, perform a full download (not delta), and confirm the values now match. The symbolic name "Local~CM_1241_(RS422_485)_1" can also be dragged from the device view directly into the PORT input of Modbus_Comm_Load, which eliminates the manual entry error.

RS485 LINE_PRE, DIP Switches, and Bus Pre-Conditioning

The CM1241 G2 has two physical mechanisms that affect bus behavior and one library parameter that is often confused with them:

For a CM1241 G2 acting as the master at the end of a short (<10 m) bus to a single USB-RS485 slave, the recommended switch setting is TERM = ON, BIAS = ON at the master. The slave's own termination, if present, is typically internal and not switchable. On a longer bus, only the two physical end nodes have TERM = ON and exactly one node has BIAS = ON.

Verification Procedure

After correcting the configuration, perform the following verification in order:

1. Watch table STATUS field: Add the Comm_Load and Modbus_Master instance DBs to a watch table. Confirm CL_Error_Nr is 0 and CL_Done is TRUE after the first scan.
2. LED state: TX should flash once per request, RX should flash once per valid slave response. With a 1 Hz request rate and 9600 baud, the flashes will be sub-millisecond blips — extend the cycle or shorten the request to 1 word to see them clearly.
3. Modbus_Poll diagnostic: Set the slave to address 1, holding register offset 0, function 03. Confirm a poll every 1000 ms returns the value programmed into "Value_Received" if the loopback is closed, or the value supplied by the slave.
4. Error counters: In TIA Portal, open Online > Diagnostics > Module information. The CM1241 G2 reports frame errors, parity errors, and overrun counts. All should remain at 0.
5. Oscilloscope check (optional): Probe the A−/B+ pair during a request. Valid Modbus RTU frames show a 3.5 character idle, 8-N-1 data, and a 3.5 character idle before the slave response begins. A bouncing baseline with no clean idle is a termination fault.

Troubleshooting Matrix

Preventive Recommendations

Three practices eliminate the majority of S7-1200 G2 + CM1241 G2 Modbus RTU commissioning defects at first power-up:

1. Always drag the port symbolic name from the project tree into the PORT input. Never type the literal value, never copy from an older project. The G2 HSP will assign new identifiers that do not match V18 or V19 values.
2. Default to RS485 half-duplex (MODE = 0) for any Modbus RTU bus. Only switch to MODE = 4 when the slave is wired to a 4-wire RS422 channel and confirmed to ignore echo suppression.
3. Wire GND pin 5 and the shield before the first request. A floating logic ground is the single most common cause of "TX only" on a brand-new bus.

Reference Documentation

Official Siemens TIA Portal V21 documentation for the Modbus_Comm_Load instruction, including the full STATUS code table and the CM1241 G2-specific parameters, is available at the TIA Portal V21 Modbus_Comm_Load reference page.