Resolving Modbus RTU Errors on Siemens ET200SP S7-1500

Overview: Modbus RTU on ET200SP S7-1500

The SIMATIC ET200SP distributed I/O system with an S7-1500 class CPU (including the compact CPU 1510SP, 1512SP, 1514SP, and 1515SP) can host Modbus RTU master or slave communication through a CM PtP (Point-to-Point) communication module plugged into the ET200SP baseUnit. The CM PtP module provides the RS-485 or RS-232 physical interface required for Modbus RTU on a 2-wire or 4-wire bus, and the Modbus protocol is implemented inside the CPU firmware as library blocks:

• Modbus_Comm_Load (FB 1078 / FB 1080 depending on firmware) — ports and parameterizes the CM PtP module for Modbus RTU mode.
• Modbus_Master (FB 1080) — implements an RTU master when the S7-1500 is the polling device.
• Modbus_Slave (FB 1081) — implements an RTU slave when the S7-1500 is the responder.

This article consolidates field-proven diagnostics for the three most disruptive error families encountered when commissioning Modbus RTU on an ET200SP:

1. Runtime error codes 16#81E2 and 16#81E7 returned by the Modbus master/slave blocks.
2. CPU stop with diagnostic buffer entry "Error in read access to the periphery (address I 0) in FB 613".
3. Address-mapping confusion between S7 data-block offsets and the Modbus register model presented to the external master or slave device.

Hardware Prerequisites

Modbus RTU on ET200SP requires the following configuration. None of the blocks will work without every item below being correct.

The CM PtP module's hardware identifier (HID) — referred to in TIA Portal as the Port or Hardware Identifier of the module — must be passed correctly to Modbus_Comm_Load on input PORT. Typical HID values for ET200SP systems are in the range of 100–1023 depending on the slot index. The example field experience below uses HID 263 for a CM PtP inserted in slot 3 of an ET200SP station, which is a legitimate value for a 1510SP / 1512SP station when the slot numbering uses the default configuration.

Register Addressing: Modbus Convention vs S7 Data Block Offsets

The most common source of confusion when an external master (or an external slave device's documentation) requests a Modbus register address is the offset translation between the Modbus 5-digit register number and the byte offset inside the S7 data block referenced by the Modbus block.

The Modbus specification defines four address spaces, and the leading digit of the 5-digit address selects which space is being referenced. Function code pairs govern each space:

Concretely, the answer to the source's first question is yes: the holding register 40001 maps to the data word at byte offset 0 of the Modbus DB — i.e. DBW0 — and the register 40002 maps to DBW2. The full linear formula is:

Equivalently: byte offset = 2 × (register − base). For input registers, replace the base with 30001. Discrete inputs and coils are bit-based and use:

DBB_offset = floor((Modbus_bit − 10001) / 8)   // for 1xxxx
DBX_bit    = (Modbus_bit − 10001) MOD 8

The Modbus DB used as the data backing store must be created with non-optimized access in TIA Portal. Optimized (symbolic-only) DBs do not expose the fixed byte offsets the Modbus blocks need for the DATA_ADDR / DATA_PTR parameters.

Block Architecture: Where Each Block Is Called

Three blocks form a Modbus RTU point-to-point link. Each is called from a specific OB and never from any other OB.

The answer to the second question in the source is therefore: only one of Modbus_Master or Modbus_Slave is called, never both. The two blocks are mutually exclusive on a single CM PtP port. If the external device is the master, the S7-1500 calls only Modbus_Slave. If the S7-1500 must poll an external device, it calls only Modbus_Master plus the initial Modbus_Comm_Load.

Slave Configuration: External Master Reads the S7-1500

When the third-party SCADA is the master and reads analog values from the ET200SP, the program structure is:

// OB 100 - warm restart, runs once
IF "First_Scan" THEN
    "Modbus_Comm_Load_DB"(REQ := TRUE,
                          PORT := 263,
                          BAUD := 9600,
                          PARITY := 0,        // 0 = even, 1 = odd, 2 = none
                          FLOW_CTRL := 0,     // 0 = no flow control
                          RESP_TO := 1000,    // ms
                          MODE := 0);         // 0 = RTU
END_IF;

// OB 1 - cyclic
"Modbus_Slave_DB"(MB_ADDR := 1,        // slave number 1..247
                  MODE := 0,            // RTU
                  DATA_ADDR := 0,       // pointer to MB_DB starts at offset 0
                  DATA_LEN := 100,      // number of holding-register WORDS exposed
                  DATA_PTR := "MB_DB");

The MB_DB must be a non-optimized DB containing at least 200 bytes (100 words). Holding register 40001 maps to MB_DB.DBW0, 40002 to MB_DB.DBW2, and so on. The external master reads with function code 03 and registers 40001..40100 to obtain the full block.

Master Configuration: S7-1500 Writes to an External Slave

When the third-party device is the slave and the S7-1500 is the polling master, the program structure is:

// OB 100 - one-shot
IF "First_Scan" THEN
    "Modbus_Comm_Load_DB"(REQ := TRUE,
                          PORT := 263,
                          BAUD := 9600,
                          PARITY := 0,
                          FLOW_CTRL := 0,
                          RESP_TO := 1000,
                          MODE := 0);
END_IF;

// OB 1 - cyclic, one transaction per call
"Modbus_Master_DB"(REQ       := "Mbus_Trigger",
                   MB_ADDR   := 1,
                   MODE      := 0,
                   DATA_ADDR := 40001,
                   DATA_LEN  := 1,
                   DATA_PTR  := "MB_DB",
                   WRITE_READ := 0);   // 0 = read, 1 = write

For deterministic behaviour at 100 ms the Modbus_Master call is best placed in OB 35 (cyclic interrupt) with a 100 ms period. The master will not initiate a second transaction while Modbus_Master.DONE or Modbus_Master.ERROR is TRUE from a previous call. Driving REQ from a 100 ms clock pulse gated by the inverse of DONE OR ERROR produces reliable, single-shot transactions.

Field-Proven Workaround: Single-Word Cyclic Sweep

When the master is the S7-1500 and must write several consecutive words to a slave that is sensitive to multi-register write timing, a deterministic single-word sweep eliminates the problem. This is the technique the source author used successfully:

1. Create a non-optimized Sweep_DB with a structure of { index : INT; payload : ARRAY[0..49] OF WORD }.
2. On every 200 ms OB 35 tick, increment Sweep_DB.index modulo 50.
3. Copy the current Sweep_DB.payload[index] to the head of MB_DB at byte offset 0.
4. Trigger Modbus_Master with DATA_ADDR = 40001, DATA_LEN = 1.
5. Reset the trigger once DONE or ERROR is set.

Total update period for 50 words is 10 s, which is acceptable for non-critical analog mirroring. For sub-second update rates, group the writes into 8-word FC16 frames and increase OB 35 to 50 ms; the multi-word write problem reported in the source is generally a slave-device limitation, not a Modbus protocol issue.

Error Code Reference: 16#81E2 and 16#81E7

Both error codes are returned in Modbus_Master.STATUS (or Modbus_Slave.STATUS) and indicate failures of the Modbus transaction at the protocol level. They are not PLC error codes — the CPU does not stop — but they do mean that the current REQ was not completed.

Both codes typically appear at the start of communication and may be transient on some slave devices during the first transaction after link establishment. If they appear once and then disappear on subsequent transactions, they are usually caused by the slave's UART not yet being ready when the first poll arrives; the recommended mitigation is to ignore ERROR for the first three transactions, or to add a 500 ms post-MB_Comm_Load delay using a TON timer before triggering the first Modbus_Master call.

The FB 613 Peripheral Access Error

When the CPU enters STOP and the diagnostic buffer shows:

the root cause is almost always a misconfiguration of the hardware identifier passed to Modbus_Comm_Load or the slot assignment of the CM PtP module. FB 613 is the lower-level system FB that the Modbus library blocks use to read the CM PtP module's hardware configuration; when PORT is set to 0 or to a value that does not correspond to a real CM PtP slot, FB 613 attempts to read the I/O image at address I 0.0 of a non-existent peripheral and triggers an OB 121 peripheral-access fault, which in turn puts the CPU in STOP.

The corrective steps are:

1. Open the device configuration of the ET200SP station in TIA Portal.
2. Click the CM PtP module and note the value in the Properties → System constants → Hardware Identifier field. Typical values: 100, 101, 102 ... or higher depending on slot count. The example in the source used 263, which is a valid value for a slot 3 module on a fully loaded ET200SP station.
3. Confirm that the same value is wired to Modbus_Comm_Load.PORT, that the constant PORT_Constant used in any user code is also 263, and that the slot of the physical module matches the slot shown in the device view (a swapped module in a different slot will also cause this fault).
4. Recompile and download. The diagnostic-buffer entry will clear after the next STOP-to-RUN transition.

Diagnostic: SaveStatus Library Interpretation

For deeper diagnosis, Siemens publishes a sample library called SaveStatus on the Siemens Industry Online Support portal. The library contains a function block that copies the 4-byte STATUS and STATUS_2 outputs of the Modbus blocks into a 10-DWord array for trend recording and HMI display. The mapping inside the 10-DWord array is:

The 4-byte STATUS field is decoded as follows: the low word is the same value as in older single-word returns (e.g., 16#81E2). The high word indicates the call-stack location of the failure (0 = Modbus_Comm_Load, 1 = Modbus_Master / Slave, 2 = CM PtP firmware, 3 = driver). For example, STATUS = 16#000181E2 means: low word 16#81E2, raised in the Modbus_Master / Slave block (high word = 1).

Cable, Wiring, and Port Identifier Issues

Approximately 30% of all Modbus RTU commissioning problems on ET200SP are physical-layer issues. The most frequent mistakes are:

Verification and Commissioning Checklist

Run the following checks in order before declaring the link operational:

1. Hardware identifier check. Verify the Modbus_Comm_Load.PORT constant matches the value in TIA Portal's device view, and that the CM PtP's slot is populated in the physical rack.
2. Parameter consistency check. Confirm BAUD, PARITY, DATA_BITS, STOP_BITS and RESP_TO match between the CPU and the external device to the bit.
3. Loopback test. With the bus physically disconnected, connect a small terminal program (e.g., any Modbus master simulator) to the CM PtP and read holding register 40001 from MB_DB with DATA_LEN = 1. The result must match the value placed in MB_DB.DBW0.
4. Modbus_Comm_Load status. After the first scan, Modbus_Comm_Load.DONE must be TRUE and Modbus_Comm_Load.ERROR must be FALSE. If ERROR is TRUE, decode STATUS against the Modbus_Comm_Load error table before calling the master / slave block.
5. First-transaction check. Force a known value into MB_DB.DBW0 and poll register 40001 from the external master. The polled value must match.
6. Full register sweep. Step DATA_LEN through 1, 2, 5, 10, 50, 100 to find the slave's maximum supported multi-register read length.
7. Long-run stability check. Run the master for at least 30 minutes and log SaveStatus array index 1 (STATUS) to confirm no transient 16#81E2 / 16#81E7 values are still present.

Troubleshooting Matrix

Standards and Reference Material

For arbitration between two masters and for the electrical layer the following are the controlling documents; the implementation in the CM PtP module conforms to them.

• Modbus Application Protocol V1.1b3 — register model and function codes
• Modbus over Serial Line V1.02 — RTU framing, baud, parity, inter-character timing
• Siemens CM PtP manual (109769500) — wiring, RS-485 termination DIPs
• MODBUS_PN_CPU library documentation (109751302) — block interface and error codes