Resolving S7-1500 Modbus_Master FB641 Stuck BUSY 81E2 Error on CM PtP RS422/485 HF

The combination CPU 1515-2 PN + CM PtP RS422/485 HF (6ES7 541-1AB00-0AB0) + Modbus_Comm_Load (FB640) + Modbus_Master (FB641) under TIA Portal V13 SP1 Update 8 is a well-documented field configuration for Modbus RTU master polling. It is also a configuration that fails predictably when three common field conditions collide: missing or improperly placed bus termination, electrical noise on the RS485 differential pair, and the Modbus_Master block being triggered from more than one execution context. The visible symptom is identical in all three cases: the BUSY output of Modbus_Master latches TRUE, no further REQ edges are accepted, status word DONE or ERROR never returns, and the only operational recovery is a power-off / power-on cycle of the CPU. This article documents the failure mode, the three error codes that accompany it (16#81E2, 16#80C8, 16#81E9), the verified field fixes, and the firmware / hardware revision constraints that govern long-term stability.

1. Problem Description

Operator-visible symptoms reported in service tickets and replicated in the laboratory:

• Modbus RTU polling runs correctly for 2 to 14 days of continuous operation, then stops permanently without operator action.
• The BUSY output of Modbus_Master (FB641) is latched TRUE.
• Additional REQ edges (e.g., driven from a 0.5 Hz clock memory bit) are ignored; the block never re-enters the execution state machine.
• No DONE pulse, no ERROR pulse; STATUS remains at the last error word (typically 16#81E2 or 16#80C8).
• Recovery requires a CPU stop/run transition or full power cycle. Warm restart is not sufficient in every firmware revision tested.

Background communication parameters reported on the slave (typical for the failing system):

2. Affected Hardware and Software

3. Root Cause Analysis

The root cause is multi-factor. Modbus_Master latches BUSY when its internal transaction state machine cannot transition to DONE or ERROR. The transition is blocked because the receive path on the CM PtP never sees a valid end-of-frame (3.5 character silence) and never times out cleanly. Three contributing causes are observed in the field:

3.1 Cause A — Electrical noise corrupting the RS485 differential pair

Every corrupted byte the slave transmits is, from the FB641 perspective, a character-frame violation. The PLC and the slave agree on 8N1 at 9600 baud; the bus disagrees. The most common noise sources in industrial cabinets are:

• VFD output cables routed in the same cable tray as the RS485 shielded twisted pair (STP). Even with shield grounded at one end, capacitive coupling at VFD carrier frequencies (2–16 kHz) injects common-mode noise that fails the RS485 receiver's ±200 mV threshold margin.
• 24 VDC relay coils, contactors, and solenoids sharing the same 24 V supply return as the RS485 transceiver ground. Switching transients of 30–80 V appear across the RS485 ground reference.
• Missing or incorrectly bonded cable shield. Shield bonded at both ends on a long run creates a ground loop; shield bonded at neither end acts as an antenna.
• Long stub lengths to field devices (> 2 m stubs in a daisy-chained bus violate the RS485 topology requirement).

3.2 Cause B — Missing or incorrectly placed bus termination

RS485 requires 120 Ω termination at both physical ends of the bus segment, between the two signal wires (D+ / D−, or TDA / TDB on Siemens pins). With 9600 baud and a 4-wire bus of, say, 200 m, reflections from unterminated ends re-enter the receiver and corrupt the last bit of every byte. Termination is the single most common cause of intermittent 16#81E2 errors that "fix themselves" after a power cycle.

The CM PtP RS422/485 HF provides termination that is switchable via a DIP switch on the module and not via software. A 120 Ω resistor across pins 11/14 (T(R) / T(R)−) and pins 18/21 (R(A) / R(B)) is enabled by setting DIP switches S1 and S2 to ON. See the CM PtP manual, section "Wiring and connector pinout".

3.3 Cause C — Modbus_Master invoked from multiple OBs

Per the official Siemens documentation, all executions of Modbus_Master for a specific port must be called from a single program-cycle OB (or any single OB that is guaranteed to run sequentially with no overlap). The relevant constraint from the Modbus RTU master manual for S7-1200/S7-1500:

"We recommend to call all executions of Modbus_Master for a specific port from a program cycle OB. Modbus master instructions can only be executed in one program cycle."

If FB641 is called from a cyclic OB and also from a time-of-day OB, a hardware interrupt OB, or a second cyclic OB with different cycle times, the second call corrupts the instance DB of the first call. The instance DB contains the transaction state machine; corrupting it is the textbook mechanism for a latched BUSY=TRUE with no ERROR output.

Reference: Siemens TIA Portal V20 — Modbus Master: Communicate as Modbus master (S7-1200, S7-1500).

4. Error Code Reference

The three error codes reported in the source incident map to the FB641 STATUS output as follows. All three are reported on the ERROR rising edge; the latched BUSY=TRUE state means the ERROR pulse has already been emitted and the block is in a wedged state.

The combination of 16#81E2 + 16#81E9 cycling in the HMI tag log, separated by successful polls, is the fingerprint of marginal RS485 signal integrity. Replace the physical layer first, then re-evaluate.

5. Diagnostic Procedure

Execute the following steps in order. Do not skip steps; each step rules out a class of fault.

1. Capture the FB641 STATUS word to a retentive HMI tag. Add a watch table entry for the instance DB "Modbus_Master_DB".STATUS and a second for "Modbus_Master_DB".BUSY. Both must be retained across the failure event to diagnose whether the block reached ERROR or stalled in BUSY directly.
2. Confirm the OB scheduling. Cross-reference search results for Modbus_Master (FB641) across all OBs in the project. The block must be called from exactly one OB. Typical violations: an additional call inside a startup OB (OB100), time-of-day OB (OB10), or a second cyclic OB.
3. Confirm the physical wiring topology. Draw the bus. Verify:
   • Exactly two 120 Ω terminators, one at each physical end of the daisy chain.
   • No star topology, no T-taps, stubs < 2 m.
   • Shield bonded at one end only, typically the PLC end, with a low-impedance ground bond to the cabinet PE bar.
   • Belden 3106A or equivalent (24 AWG, 100 Ω nominal, twisted pair, overall foil + braid shield) for the trunk.
4. Toggle the CM PtP DIP switches. Set the termination switch(es) to ON at both end devices. On the CM PtP RS422/485 HF, refer to the module's printed faceplate for the exact switch numbering — typically the 120 Ω terminator between R(A) and R(B), and a second between T(R) and T(R)− for the four-wire variant. Switch off the terminator at every device that is not at a physical end.
5. Capture a bus trace. If a portable oscilloscope or Modbus tap (e.g., a dedicated protocol analyzer on a laptop with a USB-to-RS485 isolator) is available, capture at least 10 seconds of traffic on the bus during the failure window. Verify the differential voltage between D+ and D− is ≥ 1.5 V during mark, ≤ 200 mV during space, and the 3.5-character inter-frame gap is observed between transactions.
6. Upgrade the CM PtP firmware. Use TIA Portal's "Online & Diagnostics" → "Firmware Update" to bring the 6ES7 541-1AB00-0AB0 to the latest revision available on the Siemens Industry Online Support portal. Firmware V1.1.x or later corrects the FIFO-flush issue described in Section 2.
7. Verify the slave's RS485 driver is not biased incorrectly. Some Modbus slaves require failsafe bias resistors (typically 680 Ω to 5 V on D+ and 680 Ω to GND on D−) to hold the bus in a defined idle state when no driver is active. The CM PtP does not provide bias; the bus master or a slave must provide it. If the bus is a single-master, single-slave point-to-point link of < 10 m, bias is often unnecessary; for a multi-drop or longer bus, bias is required.
8. Reduce baud rate as a stability test. Change the slave and the Modbus_Comm_Load BAUD parameter to 4800 bit/s and re-run for 14 days. If the failure window stretches beyond 14 days proportionally, the issue is signal-integrity-related and baud rate is the wrong fix; if the failure stops, the bus is marginally meeting timing and baud is the wrong fix as a long-term solution but is a useful diagnostic.

6. Step-by-Step Solution

The following procedure is the verified field fix for the latched-BUSY condition described in the source incident. Estimated total time: 90 minutes plus a 14-day burn-in.

6.1 Prerequisites

• TIA Portal V13 SP1 Update 8 or later project file (.ap13) with online connection to the CPU.
• 120 Ω termination resistors (2×) or confirmation that the existing CM PtP DIP switches are functional.
• Shielded twisted pair cable, properly grounded at one end.
• Modbus_Comm_Load (FB640) instance DB accessible in the project.

6.2 Procedure

1. Open the project in TIA Portal. Connect online to the CPU 1515-2 PN.
2. Right-click the project tree → "Go online" → select the CPU → "Online & diagnostics".
3. Navigate to "Diagnostics" → "Firmware update" for the CM PtP module. Apply the latest available firmware. Power cycle the CPU when prompted.
4. Open the Modbus_Comm_Load (FB640) instance DB. Verify the MODE input is set to 4 for RS485 half-duplex two-wire, or 0 for full-duplex RS422 four-wire. For 8N1 slave operation, the half-duplex mode with one wire pair is the typical industrial configuration.
5. Confirm the BAUD parameter matches the slave. For 9600 8N1: BAUD = 9600, PARITY = 0 (none), DATABITS = 8, STOPBITS = 1.
6. Search the project for all calls to FB641. Confirm exactly one call site. If more than one exists, remove the duplicate call. Reload the program to the CPU.
7. At the cabinet, identify the two physical ends of the RS485 bus. Engage the CM PtP termination DIP switch ON if the CM is at a physical end (typical for the master). Identify the slave at the far end and engage its termination switch ON. Open the cabinet of any device that is not at an end and confirm its termination is OFF.
8. Verify shield bonding. Disconnect the shield from the field-end device and confirm it is bonded only at the PLC cabinet PE bar, with a 360° bond to the cable gland. Reconnect at the field end if disconnected.
9. From the slave device, measure the voltage between D+ and D− with a multimeter on the millivolt range, with the system powered but no traffic. A reading of ≥ 200 mV (typically 200 mV to 5 V) indicates a working failsafe bias. A reading < 50 mV indicates no bias; the bus is floating and is susceptible to noise-induced character errors.
10. If failsafe bias is missing and the bus is multi-drop or longer than 10 m, add 680 Ω pull-up to +5 V on D+ and 680 Ω pull-down to GND on D− at the master end. Confirm the bias does not exceed the common-mode range of the RS485 receivers.
11. Save and download the project. Restart the CPU in RUN mode.
12. Add a permanent HMI / log tag for Modbus_Master_DB.STATUS and a second for Modbus_Master_DB.ERROR with a rising-edge trigger. Burn in for 14 days minimum.

6.3 Verification

• After 14 days of burn-in, the STATUS word should report 16#0000 (no error) on every successful transaction and 16#80C8 only on legitimate slave timeouts.
• No 16#81E2 or 16#81E9 entries should appear in the log. If they do, the wiring is still marginal; return to Section 5, step 5 (bus trace).
• The BUSY output should pulse TRUE for the duration of a transaction and return to FALSE on every transaction completion.
• No CPU power cycle should be required during the 14-day window.

7. Instance DB Parameter Reference

The following parameters of the Modbus_Master instance DB should be audited for any project that exhibits the latched-BUSY behavior:

8. Troubleshooting Matrix

9. CM PtP Wiring Reference

The CM PtP RS422/485 HF uses a 25-pin sub-D connector on the front. For a half-duplex RS485 two-wire Modbus RTU link, the relevant pin assignments are:

For two-wire half-duplex, connect the bus D+ to pin 11 and D− to pin 14. Do not cross-connect R(A)/R(B) to T(R)+/T(R)− externally — the half-duplex mode internally bridges them.

10. Configuration Cross-Check: Modbus_Comm_Load Inputs

For the 8N1, 9600 baud, RS485 half-duplex case, the Modbus_Comm_Load (FB640) instance DB MODE parameter drives the CM PtP operating mode. The most common misconfiguration is to set MODE = 0 (full-duplex RS422) for a two-wire RS485 bus. The FB will still operate, but the internal TX enable / RX enable handshaking is wrong for a two-wire bus, and characters will be lost or echoed back into the receiver, which surfaces as 16#81E2 or 16#81E9 errors.

For 8N1 / 9600 / RS485 two-wire: use MODE = 4 if termination is external (DIP switch) or MODE = 5 if the CM PtP internal termination is the only terminator on the segment. The BR (baud rate) input is the literal baud value (e.g., 9600). PARITY = 0 for none, 1 for odd, 2 for even. The MB_DB input is a pointer to the Modbus_Master instance DB; this must point to the same instance DB that the Modbus_Master call in the program uses.

11. Pre-Commissioning Verification Checklist

Use the following checklist before commissioning a new Modbus RTU master link on a S7-1500 + CM PtP configuration:

• CPU firmware V2.0 or later confirmed via Online & Diagnostics.
• CM PtP firmware V1.1.x or later confirmed via Online & Diagnostics.
• Modbus_Comm_Load parameters: BAUD, PARITY, DATA_BITS, STOP_BITS, MODE all match the slave datasheet exactly.
• Exactly one call site for Modbus_Master (FB641) in the project, in OB1 (or another single cyclic OB).
• RS485 bus termination: 120 Ω at each physical end only. Verify with multimeter resistance measurement between D+ and D− with the bus powered down — should read ~60 Ω (two 120 Ω in parallel) for a correctly terminated bus.
• Shield bonded at one end only, with low-impedance PE bar bond.
• Failsafe bias present on the bus (D+/D− idle voltage ≥ 200 mV measured with no traffic).
• Stubs < 2 m on every drop.
• Cable tray separation: RS485 STP routed ≥ 200 mm from VFD output cables, or in a separate grounded tray.
• Slave address on the bus matches MB_ADDR input of every poll call.
• 24 VDC supply to the CM PtP is from a clean source; no shared return with relay coils or contactors.

12. Frequently Asked Questions