Resolving S7-1200 MB_MASTER Error 8383: Modbus RTU Address Fault

Modbus RTU communication on the SIMATIC S7-1200 (and the functionally equivalent S7-1500 path) is normally a drop-in task using the MB_MASTER instruction from the "MODBUS (RTU)" library (formerly MODBUS_PN_COM, replaced by the "PtP Modbus" instructions in TIA Portal). When the block reports a non-zero STATUS output, the field engineer must decode the hex code, then correlate it to the slave's exception response and the configured MODE / DATA_ADDR pair. Two of the most common field-reported codes are 16#8200 and 16#8383. This article documents the root cause, the addressing model that produces them, and the deterministic procedure to clear them.

1. Problem Summary

A S7-1200 CPU (any firmware in the V4.x line that supports PtP Modbus, e.g. CPU 1211C / 1212C / 1214C / 1215C / 1217C with FW 4.0 or later) is exchanging data over RS485 with a Modbus RTU slave (a VFD, energy meter, sensor head, or generic I/O module). The MB_MASTER instance reports:

• STATUS = 16#8200 — timeout / no response / frame error detected by the local serial driver.
• STATUS = 16#8383 — the slave answered, but the response contained Modbus exception function code 0x02 (Illegal Data Address).

Both codes leave the master in a healthy state, but the request was not serviced. The two codes have entirely different root causes and require different corrective actions.

2. MB_MASTER STATUS Code Reference

The full STATUS word emitted by MB_MASTER on S7-1200 / S7-1500 is documented in the TIA Portal help under "PtP Modbus → Error messages S7-1200, S7-1500". The relevant subset:

The full table is maintained in the official TIA Portal documentation: Error messages S7-1200, S7-1500 — TIA Portal V20 documentation.

3. Root Cause Analysis

3.1 16#8200 — "No answer from the bus"

This is a transport-layer fault. The S7-1200 has transmitted a complete RTU frame (8-bit address, 8-bit function, N×8 data, 16-bit CRC) onto the differential pair, but the receive window has expired without a legal response. The most common root causes, in descending order of field frequency:

1. Wrong slave ID in MB_MASTER.MB_ADDR. The slave simply ignores the frame because the address byte does not match its configured station number.
2. A / B polarity reversed on the RS485 link. Many drivers are not polarity-tolerant; some clones are, which makes the fault intermittent.
3. Termination / bias missing. The CM 1241 and CB 1241 modules do not include on-board 120 Ω termination or fail-safe bias. A multi-drop bus longer than a few metres must be terminated at both ends and biased at one end (typically the master) with a 680 Ω pull-up to +5 V on B and 680 Ω pull-down to GND on A.
4. Baud / parity / stop bits mismatch between the port configuration in the device configuration (CB 1241 / CM 1241 properties) and the slave. The S7-1200 default is 19200 / 8 / even / 1; many VFDs ship at 9600 / 8 / none / 1.
5. Slave powered down or in fault (e.g. LS iG5A in E04 / over-current trip will not respond to RTU polls).
6. Ground potential difference > ±7 V between the two cabinets, which causes the line driver to saturate and lose the differential signal.

3.2 16#8383 — "Slave answered with Illegal Data Address"

This is an application-layer fault. The slave received the request, parsed the address field, and replied with a Modbus exception response:

Tx: 01 03 00 00 00 0A C5 CD   (Read holding registers 0..9)
Rx: 01 83 02 C0 F1            (Exception function 0x83, code 0x02, CRC)

The MB_MASTER block recognises the high bit set in the function code (0x83 for a response to 0x03) and maps exception code 0x02 to STATUS 16#8383. The documentation states this explicitly: "Response frame from Modbus slave with the following error message: Invalid data address in the request frame."

The address field sent by MB_MASTER is built as DATA_ADDR - 1 in PDU space, because the wire protocol uses zero-based addressing. The slave then translates that PDU-space address back into its own register map. The mismatch arises because the S7-1200 and the slave interpret the Modbus addressing model differently.

4. The Modbus Addressing Model

Modbus is formally defined with two layers:

The conversion rule is:

wire_offset  =  application_address - prefix_base
            =  application_address - 40000   (for holding registers)
            =  application_address - 30000   (for input registers)
            =  application_address - 10000   (for coils)
            =  application_address - 00000   (for discrete inputs)

The PDU uses a 0-based offset, so PDU address 0 == application address 40001 (holding), 30001 (input), 10001 (coil), or 00001 (discrete).

Inside MB_MASTER the engineer sets DATA_ADDR to the PDU offset (0-based), not the application address. The block automatically prepends the correct function code based on MODE:

A frequent engineering mistake is to enter the application address (e.g. 40001) into DATA_ADDR. The block then sends PDU offset 40001, which the slave truncates to 16 bits and reads as 40001 mod 65536 = 40001, an address far beyond the device's actual register file. The slave responds with exception 0x02 and the master reports 16#8383.

5. Worked Example — Reading an LS iG5A Frequency Reference

The LS iG5A manual (SV-iG5A, firmware versions 2.0 / 2.5 / 3.0) defines:

• Parameter drv 0 — command source — at holding register address 0x0005 (application address 40006).
• Parameter drv 3 — output frequency — at holding register address 0x0006 (application address 40007).

The correct MB_MASTER call to read drv 3 is therefore:

// INSTANCE: "MB_MASTER_DB"
MB_ADDR    := 1;        // slave ID
MODE       := 2;        // FC 0x03, Read Holding Registers
DATA_ADDR  := 6;        // PDU offset = 40007 - 40001 = 6
DATA_LEN   := 1;        // one 16-bit register
DATA_PTR   := P#DB20.DBX0.0 WORD 1;   // destination tag

If the engineer mistakenly enters DATA_ADDR := 40007, the wire frame is 01 03 9C 47 00 01, and the slave (whose register file ends well below 0x9C47) returns 01 83 02 C0 F1. The master reports STATUS = 16#8383.

6. Step-by-Step Diagnostic Procedure

1. Confirm the physical layer first. With a USB-RS485 sniffer or a Modbus scanner (e.g. simply Modbus Poll) on the bus, verify that the slave responds to a manual request. If the scanner also times out, the issue is electrical (16#8200 root cause) and not the S7-1200 program.
2. Capture the wire frame with a logic analyser or the trace buffer of the CM 1241 (FW 4.2 and later). The PTP_PN_COM trace can export the raw bytes that produced the failing status.
3. Decide which code you have:
   • If there is no response frame at all → 16#8200 path (Section 7).
   • If there is a response starting with the function code + 0x80 (e.g. 0x83, 0x84) → 16#83xx path (Section 8).
4. For 16#8383: read the slave's manual, identify the application-layer address of the desired register, and convert it to PDU offset using the table in Section 4. Update DATA_ADDR in the MB_MASTER call.
5. For 16#8200: walk the Section 7 checklist, then re-test with a Modbus scanner before bringing the S7-1200 back online.
6. Re-test by toggling REQ := TRUE on the MB_MASTER instance in the watch table and observing STATUS = 16#0000 on completion, with the expected data in the destination tag.

7. Clearing 16#8200 — Transport-Layer Checklist

1. Power: confirm the slave is powered and out of fault. For an LS iG5A, clear the trip via drv 91 = 0 if applicable.
2. Slave ID: confirm the slave's station number (LS iG5A: drv 5 = 0..31) and that the same value is set in MB_MASTER.MB_ADDR.
3. Baud / parity / stop: match drv 6, drv 7, drv 8 on the iG5A against the port configuration in the device view of the CM 1241. Save the drive and power-cycle.
4. Polarity: swap the A and B wires at one end only. The S7-1200 CM 1241 (6ES7241-1CH30-1XB0) and CB 1241 (6ES7241-1CH30-1XB0) label the terminals T/R+ and T/R- (or D+ / D- on the RS485 piggy-back); the iG5A uses S+ / S-. Many Chinese-market RS485-to-USB adapters mark the lines "A / B" but A is actually the inverting line; verify with a multimeter against the Siemens manual.
5. Termination: install a 120 Ω resistor between A and B at each end of the trunk, but NOT on stub nodes. Drop the resistor if the total stub length exceeds 1/10 of the driver rise time — in practice, if a node is not the physical end of the bus, do not terminate it.
6. Bias: install 680 Ω pull-ups from B to +5 V and 680 Ω pull-downs from A to GND at one node (typically the master). The S7-1200 CM 1241 does not include internal bias; failure to bias produces floating idle that is interpreted as a framing error on the first byte.
7. Shield / ground: ground the cable shield at one end only. Bond cabinet grounds with ≤ 1 Ω to avoid circulating current.
8. Inter-frame silence: confirm the inter-character timeout T_inter in the port configuration is at least 3.5 character times at the chosen baud. The default of 3.5 c is correct for ≤ 19200 baud; at 38400 / 115200 some slaves require it to be raised to 4 ms.

8. Clearing 16#8383 — Address-Layer Checklist

1. Identify the function class the engineer wants to access (coil, discrete input, holding, input) and the application-layer address from the slave's documentation.
2. Compute the PDU offset:
   • Application 40001 → PDU 0 (holding)
   • Application 30001 → PDU 0 (input)
   • Application 10001 → PDU 0 (coil)
   • Application 00001 → PDU 0 (discrete input)
3. Pick the matching MODE in MB_MASTER (see table in Section 4). For example, the LS iG5A exposes its control word in the 4xxxx range, so MODE = 2 (Read) or 7 (Write multiple) is correct.
4. Confirm DATA_LEN matches the slave's data layout. Reading two consecutive 16-bit registers to a single DWORD tag requires DATA_LEN := 2. Reading a 32-bit value to a REAL tag requires DATA_LEN := 2 as well; the byte-swap and word-swap are then handled by the destination tag's symbolic name (e.g. use REAL_TO_DWORD variants or symbol packing on the slave side).
5. Test the corrected call with MB_ADDR alone first (a single 1-register read on a known register such as an inverter's output current). Confirm STATUS = 16#0000 and valid data in the destination tag.
6. Iterate for every register. Keep a project register map (CSV or DB) that stores slave name, application address, PDU offset, MODE, and engineering units.

9. Companion Code: Self-Resetting Error Latch

The following SCL snippet latches the last non-zero MB_MASTER status into a static tag, increments a fault counter, and clears the latch when a successful transaction (STATUS = 0) returns. Drop it in an FB called from OB1 with the master instance as IN_OUT.

// FB_ModbusDiag
IF #mbMaster.DONE AND #mbMaster.ERROR = FALSE THEN
    #lastStatus := 16#0000;
    #okCount   := #okCount + 1;
elif #mbMaster.ERROR THEN
    #lastStatus := #mbMaster.STATUS;
    IF #lastStatus <> #lastStatusLatch THEN
        #lastStatusLatch := #lastStatus;
        #faultCount      := #faultCount + 1;
        CASE #lastStatus OF
            16#8200: #diagText := 'TIMEOUT / NO RESPONSE';
            16#8383: #diagText := 'ILLEGAL DATA ADDRESS';
            16#8384: #diagText := 'ILLEGAL DATA VALUE';
            16#8385: #diagText := 'SLAVE DEVICE FAILURE';
            16#8180: #diagText := 'CRC ERROR';
            ELSE      #diagText := 'SEE TIA PORTAL HELP';
        END_CASE;
    END_IF;
END_IF;

Connect REQ on a 100 ms cyclic clock, gate the trigger through a "ready" bit from the slave (e.g. drv 0 = 9 for "drive ready" on the iG5A), and let the MB_MASTER instance's BUSY output protect the buffer.

10. Related Codes Often Confused With 8383

11. Verification

1. In online → watch table, force the master instance and confirm STATUS = 16#0000 within one transaction cycle (typically < 50 ms at 9600 baud, < 5 ms at 115200).
2. Place the watch table cursor on the destination tag and verify the value changes when the slave's input is stimulated (e.g. ramp the iG5A frequency reference and watch the drv 3 read-back).
3. Add the FB_ModbusDiag above and confirm okCount increments monotonically and faultCount stays at zero over a 10-minute soak test.
4. For 16#8200 cases, capture the line with a sniffer and confirm a valid response frame appears within 3.5 character times after the request.

12. Field Notes & Edge Cases

• CM 1241 firmware 4.2+ exposes an integrated trace buffer; right-click the module in the device view, choose "Trace", and you can see the exact bytes that the master placed on the bus, plus the CRC. This is the fastest way to confirm a 16#8200 versus a 16#8383 in the field.
• LS iG5A address 0x0000 is reserved (returns the device ID). Use it as a loopback test once at commissioning to confirm wiring end-to-end.
• Modbus TCP and Modbus RTU use the same PDU addressing. If a device with the same model number is reachable as RTU on one site and TCP on another, the PDU offset (0-based) is identical — only the transport wrapper changes.
• Some Chinese VFD clones number the holding registers starting at 1 (PDU offset = application address − 1), while others start at 0 (PDU offset = application address). The vendor manual is authoritative; if no manual exists, sniff the wire and see what offset the device answers on.
• Multi-drop: with more than one slave, the polling order matters. If the second slave always times out, the first slave's response may be holding the bus if the master's RS485 turnaround delay is too short. Increase the inter-frame delay in the CM 1241 port configuration from 0 to 10 ms and retest.

13. FAQ