Resolving S7-1200 Modbus Master Errors 16#8281 and 16#7001

Resolving S7-1200 Modbus Master Errors 16#8281 and 16#7001 When Polling RS-485 Slaves

An S7-1200 CPU communicates with a Modbus RTU slave (such as the Imeon 9.12 Hybrid inverter) over an RS-485 physical layer using the SIMATIC Modbus RTU library blocks Modbus_Comm_Load and Modbus_Master. When the master alternately reports STATUS = 16#7001 and STATUS = 16#8281, the user typically assumes both values are errors. In reality, 16#7001 is a benign transient status that confirms a new frame has been queued, and 16#8281 is a real negative-acknowledgment fault from the underlying WRREC system block. Misclassifying the two code families is the most common reason field engineers cannot make progress.

1. Problem Description

The classic symptom pattern looks like this when you monitor the STATUS word of the Modbus_Master instance DB online in TIA Portal:

Because ERROR latches low for the 7001 cycle and high for the 8281 cycle, Modbus_Master never reports DONE = 1 and the request never completes. The slave never replies with valid Modbus data because the master treats every attempted transmission as a failed write.

2. Root Cause Analysis

According to the official Siemens Modbus RTU documentation, code 16#8281 is generated by the internal WRREC (Write Record) system block and is documented as: "Negative acknowledgment when writing module - Check the input at the PORT parameter." This means the point-to-point (PtP) communication module (e.g., CM 1241, CB 1241, or the CPU's onboard RS-485 interface) returned a non-acknowledgment to the Modbus library when the library tried to push the request frame to the hardware.

The five most probable root causes, ranked by frequency in field service:

1. Incorrect PORT input on Modbus_Comm_Load. The PORT parameter must reference the configured PtP port's hardware identifier (HWID). In TIA Portal V16 and later this is set automatically when you drag the Modbus_Comm_Load instance onto the wire to the module; in older projects it is a manual constant.
2. RS-485 polarity reversal (A/B swapped). Siemens labels the modules' pins as T/R+ (A) and T/R- (B), while many third-party inverters label them with the same letters but reversed polarity. A crossed pair silently produces no replies.
3. Missing or misapplied bus termination and bias. Modbus RTU over RS-485 requires a 120 Ω termination at each physical end and biasing resistors that hold the bus in the idle-mark state. Without bias, noise on the floating differential pair triggers UART framing errors at the slave.
4. Slave address mismatch. The Slave input of Modbus_Master must match the inverter's Modbus address (commonly 1 for Imeon, but configurable).
5. Baud rate / parity / data bits mismatch. Imeon 9.12 default is 19200 8E1 (8 data bits, even parity, 1 stop bit). The Siemens side must match exactly or the UART will reject every byte.

3. Status vs. Error: Why 16#7001 Is Not the Problem

Code 16#7001 is documented in section 5.4.1.3 of the Siemens Modbus RTU master manual as: "Initial call for a new frame: Data transmission initiated." The library raises this status the first cycle a new request is submitted and indicates that the request was successfully accepted into the internal queue. On every subsequent cycle that the request is still pending, the library raises 16#7002 (subsequent call) until either DONE or ERROR latches true.

If you write logic that branches on STATUS = 16#7001 as if it were an error, you will mask the real fault and create spurious alarms. Always gate your alarm logic on ERROR = TRUE and inspect STATUS only when ERROR = TRUE (or DONE = TRUE for success).

4. Decoding 16#8281: Negative Acknowledgment When Writing

Code 16#8281 comes from the lower layer of the Modbus library, specifically the WRREC SFB. The library uses WRREC internally to push each Modbus PDU down to the PtP module's firmware. When the module cannot accept the write (because the port is not configured, the port is busy, the baud rate is wrong, or the hardware identifier is invalid), WRREC returns the NACK code 16#8281, which the library surfaces verbatim on its STATUS output.

For complete fault isolation, read both Modbus_Master.STATUS and the static Send_Config.WRREC.STATUS field of the instance DB. The latter reveals the exact PtP firmware-level reason. Common companion codes:

The full Siemens error catalog for S7-1200 and S7-1500 Modbus RTU masters is published at the official TIA Portal documentation site: Error messages (S7-1200, S7-1500) – MODBUS (RTU) – TIA Portal V20. Cross-reference every code you observe with that page before assuming a particular hardware fault.

5. Physical Layer Verification (RS-485 Wiring)

Because 16#8281 is overwhelmingly caused by link-layer issues, perform these checks before touching the PLC program.

1. Confirm shield and ground reference. Tie the cable shield to earth ground at one end only (typically the inverter end) to avoid ground loops. Reference the Siemens Modbus RTU Master manual (entry ID 59057093) for the recommended grounding topology.
2. Verify A/B polarity. Siemens: pin 8 = T/R+ (A), pin 3 = T/R- (B). Imeon 9.12: A on terminal 1, B on terminal 2. If communication is one-way or zero-way, swap A and B at one end.
3. Measure idle-line voltage. With the PLC in STOP and the inverter powered, measure DC voltage across A and B. A healthy idle bus should read between +200 mV and +5 V (B higher than A). Anything near 0 V indicates missing bias.
4. Install 120 Ω termination at both physical ends only. The CM 1241 has a switchable internal terminator (DIP switch on the side of the module) - leave it ON if the PLC is at the end of the trunk, OFF if it is in the middle.
5. Check cable type. Use a twisted-pair cable with characteristic impedance of 100–120 Ω (e.g., Belden 3106A or Lapp UNITRONIC Li2YCY). Maximum stub length is 30 cm; the trunk should not exceed 1200 m at 19200 baud.

6. TIA Portal Configuration Steps

Configure the PtP port and Modbus blocks in the following order. These steps are valid for TIA Portal V16, V17, V18, V19, and V20; the screenshots may vary slightly but the parameter names are identical.

6.1 Configure the CM 1241 (or CB 1241) hardware

1. In the device tree, open CM 1241 (RS-485) → Properties → Port configuration.
2. Set Operating mode = Modbus RTU master (this is automatic once Modbus_Comm_Load is instantiated, but you can set it manually).
3. Set Baud rate = 19200 bit/s.
4. Set Parity = Even (8E1).
5. Set Flow control = None.
6. Enable the hardware identifier (HWID) in the project - this is the value you will wire to Modbus_Comm_Load.PORT.

6.2 Instantiate Modbus_Comm_Load

Drag the block from Libraries → Communication → Modbus → Modbus_Comm_Load into OB1. Wire the inputs as follows:

6.3 Instantiate Modbus_Master

The most common mistake that produces 16#8281 is leaving the PORT input on Modbus_Master unconnected or pointing to the wrong HWID. In TIA Portal V16 and later, the editor auto-fills PORT from the background data block when the block is dropped onto the network, but in older projects you must wire it manually. Use a constant of type HW_IO matching the CM 1241 hardware identifier.

7. Capturing Error States Programmatically

Because STATUS changes every cycle while a request is in flight, you must latch it the cycle that ERROR transitions from FALSE to TRUE. The recommended pattern is:

// SCL example
IF "Modbus_Master_DB".ERROR THEN
    "Saved_MB_Master_Status" := "Modbus_Master_DB".STATUS;
    "Saved_MB_Master_FaultTime" := DWORD_TO_ULINT(TIME());
END_IF;

IF "Modbus_Comm_Load_DB".ERROR THEN
    "Saved_MB_Load_Status" := "Modbus_Comm_Load_DB".STATUS;
END_IF;

For the MB_Send_Error / MB_Send_Status pattern referenced in field documentation, the same logic applies: only overwrite the saved status on the rising edge of ERROR. Otherwise your HMI will display a rolling list of transient codes.

8. Imeon 9.12 Hybrid Inverter – Slave-Specific Notes

The Imeon 9.12 Hybrid inverter exposes a Modbus RTU slave interface on its RS-485 port. Before assuming a hardware fault on the Siemens side, verify the following against the Imeon installation manual:

If you are issuing function code 06 or 16 to a register the inverter does not advertise, the inverter returns exception code 0x02 (Illegal Data Address). The Siemens master surfaces that as 16#8381 (negative ack on write) or 16#8380 (negative ack on read), not 16#8281. The presence of 16#8281 therefore strongly suggests the link layer itself is failing before any Modbus function code is even transmitted.

9. Verification Procedure

1. After fixing the wiring, place the PLC in RUN and observe Modbus_Comm_Load.STATUS. Confirm it transitions to 16#0000 within one second.
2. Trigger a single Modbus_Master call to read a known register (e.g., register 0x0000, FC 03, count 1). Expect DONE = TRUE within the response timeout and STATUS = 16#0000.
3. Enable online monitoring of the Modbus master DB and confirm that DATA_PTR is populated with non-zero data.
4. Use a Modbus RTU scanner or a laptop running Modbus Poll on the same trunk to confirm that the inverter replies to function code 03 from a known-good master. This isolates the PLC as the variable under test.
5. Disconnect the laptop scanner, reconnect the PLC, and re-trigger the read. If the read now succeeds, the previous PLC fault was link-layer contention, not a configuration error.

10. Troubleshooting Matrix

11. Standards and Reference Documents

When troubleshooting link-layer issues, refer to the Modbus serial line specification published by the Modbus Organization for the timing requirements (3.5 character inter-frame silence, 1.5 character intra-frame silence). The relevant Siemens-published document for the master library is the manual referenced throughout this article: SIMATIC Modbus RTU Master - Manual (entry ID 59057093). For the consolidated error catalog, use the TIA Portal help page: Error messages (S7-1200, S7-1500) – MODBUS (RTU) – TIA Portal V20.

12. Summary of the Fix Path

Treat 16#7001 as a healthy status, ignore it in your alarm logic, and focus exclusively on 16#8281. Confirm in this order: (a) the PORT HWID is correct on both Modbus_Comm_Load and Modbus_Master, (b) A/B polarity matches between the CM 1241 and the Imeon terminals, (c) termination and bias are present, (d) baud rate and parity are identical on both ends, and (e) the slave address in the master call matches the configured address on the inverter. Once these five items are correct, STATUS will return 16#0000 on the first successful transaction and DONE will latch high on every cycle.