Resolving S7-1500 CM PtP Modbus Master Error 16#7002 Timeout

Problem Description

An S7-1500 CPU communicating with a DEIF AGC genset controller through a CM PtP (RS422/485 HF) point-to-point module returns Modbus error code 16#7002 on the Modbus_Master instruction. The BUSY output latches TRUE, no response data appears in the receive buffer, and the instance DB STATUS word never advances. Verifying the link with a PC running Modbus Poll and a USB-to-RS485 converter returns valid battery voltage data, confirming the field wiring and slave address are physically intact.

The signature — master busy but silent, slave proven good — points to a configuration or addressing fault inside the S7-1500 Modbus_Master / COMM_LOAD pair, not a layer-1 cable problem.

Error Code 16#7002 — Meaning in the Modbus_Master Context

The Modbus_Master (FB) block from the Siemens Modbus library reports STATUS codes from two ranges:

The latched 16#7002 reported in the source case is therefore the waiting-for-response state, not the final timeout error. It is normally a transient value (a few character-time equivalents) that the block replaces with 16#0000 (success) or 16#8188 (timeout) on the next OB1 cycle. If the code never advances past 16#7002 while BUSY remains TRUE, the master is hanging in the receive window. Typical root causes are listed in the matrix below.

Root Cause Matrix

Architecture: COMM_LOAD, Modbus_Master, and the Instance DB

The S7-1500 Modbus RTU master is built from two function blocks that must be wired in a specific way:

• Modbus_Comm_Load (FB) — initializes the CM PtP port for Modbus RTU. It is executed once on cold/warm restart and on a rising edge of COM_RST. Outputs include BAUD, PARITY, FLOW_CONTROL, RTS_ON, RTS_OFF, STOP_BITS, and the MB_DB parameter (a system data block generated when you call the block; it is not the same as the user's instance DB).
• Modbus_Master (FB) — performs a single Modbus transaction per rising edge of REQ. Inputs include MB_ADDR (slave address), MB_MODE (function-code class), DATA_ADDR (Modbus register), DATA_LEN (number of registers/coils), DATA_PTR (any tag of a matching data type), and the all-important MB_DB connection to the COMM_LOAD output.

Both blocks have an instance DB. Many first-time users conflate the two instance DBs with each other and with the MB_DB system DB, which is the single most common cause of the "busy latched, STATUS frozen" symptom observed with error 16#7002.

Step-by-Step Resolution

1. Verify slave with an external master. Keep Modbus Poll wired to the bus. Confirm the exact three settings the DEIF AGC is exposing:
   • Slave address (1–247)
   • Baud rate and parity (the AGC typically runs 9600 or 19200 8E1; check the AGC Modbus table in the DEIF utility software)
   • Register address that returned valid battery voltage — e.g., 30567 — and its native data type (INT, UINT, FLOAT, LONG).
2. Reconcile Modbus register addressing. The Modbus protocol uses zero-based addresses on the wire. The DEIF AGC documentation usually lists 1-based addresses in its user manual. Siemens Modbus_Master expects the value in the form required by the FC:
   • For FC 03 / FC 04 (read holding/input registers), pass DATA_ADDR as the register number from the slave manual minus 1. If the manual says register 30567 and the FC is 03, use 30566 as the value in the PLC.
   • For FC 01 / FC 05 / FC 15 (coils), again subtract 1.
   A wrong DATA_ADDR makes the slave return exception code 02 (illegal data address). Many DEIF AGC firmware versions do not produce a serial exception on the bus if the address is out of range, leaving the master waiting — exactly the 16#7002 symptom.
3. Wire the COMM_LOAD correctly. Sample ST code (TIA Portal V15 / V17; adaptable to V13):

   // Cold-restart OB100 — one-shot initialization
   IF "FirstScan" THEN
       "Modbus_Comm_Load_DB".REQ   := TRUE;     // start COMM_LOAD
       "Modbus_Comm_Load_DB".PORT  := "CM_PtP_RS485_HF"; // HW identifier from device config
       "Modbus_Comm_Load_DB".BAUD  := 9600;
       "Modbus_Comm_Load_DB".PARITY:= 2;         // 0=none, 1=odd, 2=even
       "Modbus_Comm_Load_DB".STOP_BITS := 1;
       "Modbus_Comm_Load_DB".FLOW_CTRL := 0;     // 0=none (required for RS485 half-duplex)
       "Modbus_Comm_Load_DB".RTS_ON  := 0;       // 0 = automatic RS485 direction control
       "Modbus_Comm_Load_DB".RTS_OFF := 0;
   END_IF;
   
   // Periodic execution in OB1
   "Modbus_Comm_Load_DB"(COM_RST := FALSE, DONE => "mb_load_done",
                         ERROR => "mb_load_err", STATUS => "mb_load_status");
   

4. Wire the Modbus_Master with the corrected address.

   // Trigger a single read transaction per cycle
   IF "poll_enable" AND NOT "Modbus_Master_DB".BUSY THEN
       "Modbus_Master_DB".REQ       := TRUE;
       "Modbus_Master_DB".MB_ADDR   := 1;          // DEIF AGC Modbus slave ID
       "Modbus_Master_DB".MB_MODE   := 0;          // 0 = Read Holding Registers (FC 03)
       "Modbus_Master_DB".DATA_ADDR := 30566;      // 30567 (manual) - 1 = 30566 on the wire
       "Modbus_Master_DB".DATA_LEN  := 1;          // one register
       "Modbus_Master_DB".DATA_PTR  := "battery_voltage_int"; // INT tag
       "Modbus_Master_DB".MB_DB     := "Modbus_Comm_Load_DB".MB_DB;
   ELSE
       "Modbus_Master_DB".REQ := FALSE;
   END_IF;
   
   // Read status ONLY from the instance DB
   "Modbus_Master_DB".DONE   => "mb_done";
   "Modbus_Master_DB".BUSY   => "mb_busy";
   "Modbus_Master_DB".ERROR  => "mb_error";
   "Modbus_Master_DB".STATUS => "mb_status";
   

5. Set CM PtP hardware interface. In TIA Portal device view, on the CM PtP RS422/485 HF module, set:
   • Port configuration: RS485 2-wire (half-duplex), or RS422 4-wire if the DEIF AGC exposes a 4-wire port.
   • Receiver initial state: Match the DEIF AGC idle state — typically Signal R(A) 0 V, R(B) 5 V (fail-safe bias).
   • Termination: ON at both ends of the RS485 trunk. The CM PtP exposes a DIL switch for internal 390 Ω pull-up / 390 Ω pull-down / 120 Ω termination. Enable all three at the master and at the last slave.
6. Disable UNIVERSAL optimization if response is long. When reading more than ~100 registers, the CM PTP buffer can overflow and produce a separate 16#8087 in the diagnostic buffer, which the master may interpret as a never-arriving response. Clear the Optimized for short response times (UNIVERSAL = 0) checkbox in the CM PTP properties. See the Siemens error reference Error messages (S7-1200, S7-1500) - STEP 7.
7. Check the DEIF AGC exception response. If you have a serial tap (or you temporarily switch the cable back to Modbus Poll and replay the same request), look for an exception frame: 01 83 02 C3 A1 indicates FC 03 with exception 02 (illegal data address). That confirms an addressing mismatch and lets you correct DATA_ADDR deterministically.

Verification Procedure

1. Download the corrected program to the S7-1500 and go online.
2. In the Modbus_Master instance DB, watch STATUS in real time. Expected sequence:
   • First OB1 cycle after REQ rise: STATUS = 16#7001 (sending).
   • Subsequent cycles while waiting: STATUS = 16#7002 (waiting for response).
   • On a successful response: STATUS = 16#0000, DONE = TRUE, BUSY = FALSE, and the data appears at DATA_PTR.
3. If the sequence never advances past 16#7002, capture the diagnostic buffer of the CM PTP module: Online → Accessible devices → CM PtP → Diagnostic buffer. Look for entry 16#8087 (receive overflow) or 16#8088 (parity/framing). These are the CM-PtP-level errors that propagate up to the Modbus_Master as a hung transaction.
4. Confirm with Modbus Poll on the same bus: send the exact FC 03 request the PLC is sending. If Poll succeeds and the PLC does not, the fault is in the COMM_LOAD wiring or the instance-DB mirroring — not in the slave.
5. Once DONE pulses TRUE and the battery voltage integer reads back plausibly (raw register value scaled per the DEIF AGC manual), mark the fault resolved and disable the poll_enable watchdog if no longer needed.

CM PtP Module Variants and Firmware

DEIF AGC — Modbus Map Cheat Sheet

The DEIF Automatic Genset Controller exposes its measurements as 16-bit registers, typically starting at address 30000 for input measurements and 40000 for control/setting registers. Battery voltage is one of the most common reads; the manual may list it as register 30567 with a 0.1 V scaling (i.e., a raw value of 240 = 24.0 V). Confirm the scaling before scaling it in the PLC: the S7 side just receives the raw INT, scaling is done in the user program.

• Default serial parameters: 9600 8E1, slave ID 1, RS485 2-wire.
• Supported FCs: 03 (read holding), 04 (read input), 06 (write single), 16 (write multiple).
• Exception codes returned on the bus: 01 (illegal function), 02 (illegal data address), 03 (illegal data value), 04 (slave device failure).

Field-Proven Diagnostic Checklist

1. Power-cycle the DEIF AGC after any wiring change — the AGC only re-scans the Modbus port on boot.
2. Re-confirm the AGC baud rate from the AGC front panel (Service menu → Communication → Modbus).
3. Use a scope on A/B lines; a healthy transaction shows the request and reply separated by the configured inter-frame delay (3.5 character times).
4. Add a 1-second poll_enable debounce in front of REQ so a single DONE pulse from one transaction cannot retrigger before COMM_LOAD has flushed its internal buffer.
5. Make sure MB_MODE matches the FC you intend. FC 03 vs FC 04 matters for the DEIF AGC: 30567 may be a holding register on one firmware and an input register on another.
6. Always check the CM PtP Diagnostic buffer, not just the Modbus_Master STATUS — the CM-level error 16#8087 (receive buffer overflow) is invisible at the FB level and produces a stuck 16#7002.

Safety and EMC Caveats for RS-485 Genset Buses

Genset rooms have high EMI from the alternator, cranking transients, and paralleling switchgear. The DEIF AGC and the CM PtP RS485 link are not immune:

• Use shielded twisted pair (Belden 9841 or equivalent) with the shield bonded at one end only, typically at the PLC cabinet ground bar.
• Route the cable at least 200 mm away from the alternator output cables and any VFD power conductors.
• Do not rely on the CM PtP internal 120 Ω termination alone on long trunks — install an external termination resistor at the physical end of the bus.
• Verify surge protection on any cable leaving the building envelope. The S7-1500 CM PtP lacks built-in TVS diodes rated for outdoor runs.

When to Replace the Library Version

If the project must remain on TIA Portal V13 Update 9 for legacy reasons, you are constrained to Modbus library V2.x. The known limitations of V2.x are:

• No support for FC 23 (read/write multiple registers).
• Maximum DATA_LEN per transaction: 125 words for FC 03 / FC 04.
• No built-in broadcast address support (slave 0).
• CM-level diagnostics require manual capture of the diagnostic buffer; there is no on-line STATUS bit per transaction.

If you must read more than 125 words at a time, or if you need finer diagnostics, upgrade TIA Portal to at least V15.1 and re-import the Modbus library V3.0 (FB Modbus_Master V3.0 / FB Modbus_Comm_Load V3.0). The V3.0 master exposes an extended STATUS word that maps CM-level events (e.g., 16#8087) directly, eliminating the silent 16#7002 hang.

FAQ