Resolving S7-1200 Modbus RTU Slave Lockup After Line Noise

1. Problem Summary

Two S7-1200 CPUs communicating peer-to-peer over Modbus RTU on CM 1241 RS-485 communication modules run normally for hours, days, or weeks. When a transient electrical disturbance (drive switching, relay coil kick, VFD PWM edge, or induced surge on a long cable run) hits the RS-485 segment, the slave CPU ceases to respond. Diagnostic LEDs confirm the receiver continues to toggle (RX blinks), but the transmitter stays dark (no TX). The fault is non-recoverable in software: only a power cycle, STOP/RUN toggle, or re-download to the slave CPU restores the link.

Symptom signature:

• Master MB_MASTER reports DONE=0 and ERROR=1 for every request to the affected slave.
• Slave CM 1241 RX LED continues blinking in step with master requests.
• Slave CM 1241 TX LED remains off indefinitely.
• Replacing the cable with a short, bench-quality jumper does not recover communication.
• Only a slave CPU restart (power cycle, STOP→RUN, or download) returns the link to service.

This is a deterministic software/firmware defect in early S7-1200 Modbus RTU library and CPU firmware combinations, not a hardware failure. The same condition has been reproduced reliably with sudden galvanic transients shorter than the master timeout window.

2. Affected Hardware and Software Versions

The lockup has been observed on the following combination:

CPU 1214C order numbers include 6ES7214-1AE30-0XB0 (DC/DC/DC), 6ES7214-1BG31-0XB0, and later 6ES7214-1AG40-0XB0. The CM 1241 RS-485 module is 6ES7 241-1CH30-0XB0 (RS-485/422) and the RS-232 sibling is 6ES7 241-1AH30-0XB0. Always cross-check the printed MLFB on the module against the latest Siemens Industry Online Support firmware list before ordering spares.

3. Root Cause Analysis

The Modbus RTU library distributed with the original S7-1200 image relied on a UART receive path that, when interrupted by a framing error mid-reception, left the receive state machine in a state that would only clear on a CPU restart. The symptom mask is:

1. CM 1241 detects a partial or noise-corrupted byte on the bus.
2. The on-module UART raises a framing or overrun error.
3. The library's receive state machine advances into an off-spec branch that does not consume the remainder of the frame.
4. Subsequent valid master requests arrive, but the slave's response path is gated on a flag that the corrupted path never clears.
5. Master sees a timeout; slave sees valid requests (RX toggles) but never transmits (TX dark).

The defect is sensitive to:

• Slave cycle load – heavier OB1 logic increases the window in which the corrupted flag persists.
• Inter-frame silence (3.5 character times) – at 9600 baud this is ~4 ms; slow OB1 execution can lengthen the inter-frame gap and force the slave state machine into the corrupt branch.
• Single-character noise hits shorter than the configured response timeout – the master treats them as a normal silence, but the slave locks up.

Siemens addressed the issue with cumulative updates to the Modbus RTU library blocks (V3.0, V4.0, V5.0) and to the CPU system firmware. Updating both the CPU firmware and the Modbus library version in the project is required; updating one without the other is not sufficient.

4. Solution Overview

The corrective action is a coordinated firmware and library update applied to both stations, followed by wiring hardening so that the residual noise floor stays below the receiver's noise rejection. The procedure is:

1. Update the CPU firmware on both the master and slave to the latest release available for the hardware.
2. Update the CM 1241 RS-485 module firmware.
3. Replace the legacy Modbus RTU library (V2.x) in the TIA Portal project with the current release (V3.x / V4.x / V5.x as shipped with the installed portal version).
4. Re-validate cycle time, instance DBs, and the static parameters on every MB_COMM_LOAD instance.
5. Apply RS-485 wiring best practices: shielded twisted pair, single ground point, 120 Ω termination, fail-safe bias.
6. Add diagnostic HMI tags for DONE, ERROR, STATUS of every Modbus block so a recurrence is observable.

5. Step-by-Step Fix

5.1 Prerequisites

• Latest TIA Portal installed with the HSP matching the CPU order number.
• CPU and CM 1241 firmware files (download from Siemens Support entry for the relevant MLFB).
• PG/PC with Ethernet to the S7-1200 subnet or USB-PPI cable.
• Project backup (.ap11 / .ap12 / .ap13 / later).
• RS-485 commissioning kit: shielded twisted pair, 120 Ω terminators, grounding lugs.

5.2 Update the CPU Firmware

1. Open the project in TIA Portal.
2. Online → Accessible devices → select the slave CPU.
3. Right-click the CPU → Online & diagnostics → Firmware update.
4. Browse to the unpacked firmware folder supplied by Siemens.
5. Select the CPU and click Run update. The CPU goes to STOP and re-initializes.
6. Repeat for the master CPU.

5.3 Update the CM 1241 Module Firmware

1. Online & diagnostics of the CM 1241 → Firmware update.
2. Select the matching firmware file (e.g., V2.1.7 or the version published in the S7-1200 firmware readme).
3. Click Run update. The module reboots; the PLC remains in RUN if the CPU firmware supports online module update, otherwise brief STOP is expected.

5.4 Replace the Modbus Library in the Project

1. In the project tree, delete the existing MB_COMM_LOAD, MB_MASTER, MB_SLAVE instances.
2. Open the Instructions task card → Communication → Modbus RTU. Drag the current version of MB_COMM_LOAD, MB_MASTER, and MB_SLAVE into the OB1 or instance DB caller.
3. Confirm the instruction version in the block properties (Properties → Information → Version).
4. Reconnect the static inputs and outputs to the existing tags. The interface is backward compatible for MODE, BAUD, PARITY, FLOW_CONTROL, RESP_TIMEOUT, and the data pointer parameters.

5.5 Reconfigure MB_COMM_LOAD Parameters

Use the parameters below as a baseline for a 9600-8-N-1 link with a single slave:

5.6 Reconfigure MB_MASTER for a Single Peer

The master block for an S7-1200 peer-to-peer link uses a single instance of MB_MASTER. For multiple slaves, use one MB_MASTER per logical channel (multi-instance works). The status output is essential for diagnostics:

MB_MASTER_DB(
    REQ       := bTrigMaster,   // pulsed TRUE on each request
    MB_ADDR   := 1,             // slave station address
    MODE      := 0,             // 0=Read, 1=Write, 2=Read/Write single, etc.
    DATA_ADDR := 40001,         // Modbus holding register start
    DATA_LEN  := 10,            // number of words
    DATA_PTR  := pDataBuffer,   // P#M100.0 WORD 10
    DONE      => bDoneMaster,
    BUSY      => bBusyMaster,
    ERROR     => bErrMaster,
    STATUS    => wStatusMaster);

5.7 Reconfigure MB_SLAVE

The slave is configured once at startup. The instruction exposes a hold-data pointer; writes from the master land directly into the mapped area. Per the official Modbus_Slave instruction documentation, the slave supports the standard Modbus function codes 01, 02, 03, 04, 05, 06, 15, and 16. Supported address ranges depend on the function code; holding register reads/writes use Modbus addresses 40001–4xxxx, mapped to DATA_PTR as a word array.

MB_SLAVE_DB(
    MB_ADDR   := 1,
    MODE      := 0,             // 0=standard, reserved values per doc
    DATA_ADDR := 40001,
    DATA_LEN  := 100,
    DATA_PTR  := pSlaveHolding,
    DONE      => bDoneSlave,
    BUSY      => bBusySlave,
    ERROR     => bErrSlave,
    STATUS    => wStatusSlave);

Key constraint: MB_SLAVE must be called every cycle. If it is placed in a slow cyclic OB (e.g., OB35 at 100 ms) and the master polls at a faster rate, the slave response time increases and the master RESP_TIMEOUT will be exceeded. Place MB_SLAVE in OB1 (or OB200 fast OB on later firmware) for the lowest deterministic latency.

6. RS-485 Wiring Hardening

Even with patched firmware and library, a poor physical layer will re-create the conditions that triggered the lockup. Apply the following baseline:

• Cable type: Belden 3106A or equivalent, shielded twisted pair, 120 Ω characteristic impedance, 24 AWG.
• Topology: Daisy-chain only. No stubs, no star, no T-tap. Maximum stub length: 0.3 m at 9600 baud.
• Termination: 120 Ω resistor at each physical end of the segment, between the two data lines (A and B). On a 2-node peer link with two PLCs, place one terminator at each end.
• Fail-safe bias: On longer segments (> 100 m) or in noisy panels, add a 680 Ω pull-up on Data+ to +5 V and a 680 Ω pull-down on Data− to ground. Many CM 1241 installations do not require external bias; verify with an oscilloscope that the bus idles high.
• Shield grounding: Ground the shield at one end only (typically the panel entry point) to prevent ground loops. Do not bond both ends unless you can guarantee a single-point ground reference.
• Segregation: Run RS-485 cable at least 200 mm from VFD output cables, contactor coils, and any 24 VDC switched inductive load. Cross at 90° if a crossing is unavoidable.
• Connector torque: On the CM 1241 removable terminal block, tighten to 0.5 N·m. Loose strands are the most common cause of intermittent noise susceptibility.

7. Modbus Library Error Code Reference

Map the STATUS word of each block to the conditions most commonly seen in service. Numbers are library-version dependent; this list covers the V2.x and V3.x families used on S7-1200.

8. Verification Procedure

1. Watchdog recovery test: Drive a controlled noise source (e.g., relay coil in parallel with the bus, or a spark gap pulser) for 1 s. The slave should not lock up. Master status should show transient ERROR with non-fatal STATUS values, then self-recover on the next valid poll.
2. Long-duration soak test: Poll the slave every 100 ms for 72 h. Capture every ERROR transition; if any transition is not self-cleared by the next successful poll, the fix is incomplete.
3. Oscilloscope check: Probe A (Data+) and B (Data−) idle state. Idle should be high (> +200 mV differential). Low-idle bus indicates missing bias or failed termination, both of which reduce noise margin dramatically.
4. CPU diagnostic buffer: After the test, online & diagnostics → Diagnostic buffer. Look for serial-port or Modbus-related entries. Clean buffer = clean run.
5. Master-side log: Export the master status to an HMI or to a data log on a connected HMI panel (WinCC / Comfort Panel) for the duration of the soak test. Correlate errors with field events.

9. Recurrence Matrix

10. Related Considerations for Multi-Slave Networks

If the topology is extended to a multi-drop RS-485 network with one S7-1200 master and several S7-1200 slaves (or third-party slaves), add the following to the design:

• One MB_MASTER instance per logical poll cycle; do not use one MB_MASTER per slave inside a single OB1 sweep unless the master can confirm completion before issuing the next request. Use the DONE or ERROR rising edge to advance the slave index.
• Stagger the poll to avoid simultaneous responses; the CM 1241 will reject overlapping requests on the bus.
• For peer-to-peer S7-1200 to S7-1200, prefer the S7 Communication PUT/GET over Ethernet (or the Modbus TCP pair via CP1243) for new installations. Modbus RTU is appropriate when the site must interoperate with third-party RTU masters/slaves or when a legacy RS-485 cable plant already exists.

11. Safety and Commissioning Notes

• Take a project backup before every firmware update.
• Perform the firmware update with the CPU in STOP and the output modules de-energized at the field level where process safety requires it.
• After the update, perform a point-to-point I/O check (or virtual I/O check if the I/O is not wired) before placing the segment back in service.
• Document the firmware and library versions on the panel label or in the maintenance system for future reference.

12. Frequently Asked Questions