Resolving V20 Modbus Write Issues with S7-1200 MB_MASTER

1. Symptom Summary

The symptom is misleading. The PLC reports MB_MASTER.DONE = TRUE with no error code, the V20 raises no fault or warning, the diagnostic counter r2024 increments on every poll, and the MB_MASTER background DB shows STATUS = 0 (no Modbus exception) — yet the target setpoint never deviates from 0 Hz. The PLC is transmitting valid Modbus frames and the V20 is acknowledging them. The problem is not transport; it is what those frames are telling the drive to do, or how the drive is configured to interpret them.

Failure signature on a 16-drive Modbus RTU network with a SIMATIC S7-1200 CPU 1214C and a CB 1241 RS485 communication board:

• MB_MASTER.DONE pulses high; MB_MASTER.ERROR stays low.
• V20 parameter r2024 (RS485 valid-telegram count) increments — the V20 is receiving the message.
• V20 parameter r2025 (RS485 invalid-telegram count) stays at 0 — there is no framing or CRC error.
• Register 40101 (main setpoint, HSW) appears to accept the write but the motor reference stays at 0 Hz.
• In some configurations, drives 1 and 2 respond while drives 3–16 do not (collisions or address duplication).
• A first-scan restart routine that writes a non-zero control word to 40100 with bit 10 set "fixes" the problem on every subsequent cycle — confirming the drive is not in Modbus-control authority when the user expects it to be.

2. Root Cause Matrix

The following failure modes all produce the "DONE but no change" signature. Diagnose from top to bottom — items 1–3 account for roughly 80 % of field calls on this exact symptom.

3. Required V20 Parameterization for Modbus Control

Before any Modbus write is meaningful, the V20 must be told to accept commands and setpoints from the RS485 bus. Set these parameters on every drive (via BOP, IOP, or a startup wizard) and save by holding the green OK button for approximately 5 s. P0003 controls parameter access level (0 = read-only, 3 = expert). Set P0003 = 3 to allow edits.

Reference the official SINAMICS V20 product page for the full parameter list, and consult the V20 operating instructions in Siemens Industry Online Support (search "SINAMICS V20 operating instructions" for the current document ID matching your firmware).

4. V20 Modbus Register Map

The V20 uses 1-based Modbus addressing for the documented register names. The first holding register is 40001, so register "40100" in the manual means the 100th holding register. The most relevant registers for a standard start/stop + setpoint application:

HSW scaling formula: HSW_value = round(target_Hz × 16384 / P2000). With P2000 = 50 Hz, 30 Hz → HSW = round(30 × 327.68) = 9830 (0x2666). With P2000 = 60 Hz, 30 Hz → HSW = 8192 (0x2000).

5. Control Word Structure (Register 40100)

Writing 0 to 40100 means "OFF1" — the drive immediately commands the inverter to ramp down and inhibit pulses. Writing any value with bit 10 clear is interpreted as "no PLC control" and the drive ignores the rest of the bits; the V20 falls back to whatever its P0700 fallback is (terminals, BOP, etc.).

The minimum useful control word for a forward run is 0x047F (1151 decimal). Reverse run is 0x0C7F (3199 decimal). Coast stop (OFF2 active) is 0x047C. Quick stop (OFF3 active) is 0x047D. Run released, Modbus authority held, is 0x047E.

Decoded constants for the most common states:

• 0x047E = 1150 — Ready, OFF1 released, PLC authority, ON not yet asserted.
• 0x047F = 1151 — Run forward, 0 Hz default setpoint (CW only, no HSW change yet).
• 0x0C7F = 3199 — Run reverse (adds bit 11).
• 0x047C = 1148 — Coast stop (OFF2 clear).
• 0x047D = 1149 — Quick stop (OFF3 clear).
• 0x0480 = 1152 — Setpoint enable cleared (bit 6 = 0); useful for jogging-style HSW injection.

6. MB_MASTER Configuration

The MB_MASTER instruction (S7-1200, library "MODBUS" from TIA Portal V13+, renamed to Modbus_Master in V15+) is the workhorse. The MODE input selects the Modbus function code:

Symptom trap: in the original program shown in the thread, every MB_MASTER instance had MODE = 0. Mode 0 is a read; the request to write is silently reinterpreted as a read, the V20 answers with the current register value, and the PLC sees DONE=TRUE with no error. This is the single most common cause of "DONE but no change" on S7-1200 Modbus and explains why the user could not find a fault — there was no fault, the drive was just answering a different question than the user thought.

For the user's pattern (one register at a time, two writes per drive) the SCL call looks like:

// SCL example for 40100 control word write (one V20)
"MB_MASTER_DB"(REQ     := b_Trigger_CW[DriveNo],
              MB_ADDR := 100,        // V20 register 40100, 1-based
              MODE    := 1,          // FC 06 single register write
              DATA_ADDR := 0,        // unused for FC 06
              DATA_LEN := 1,
              DATA_PTR := pCW[DriveNo],
              DONE    => b_Done_CW[DriveNo],
              BUSY    => b_Busy_CW[DriveNo],
              ERROR   => b_Err_CW[DriveNo],
              STATUS  => w_Stat_CW[DriveNo]);

For an FC 16 (MODE = 2) multi-register write that updates both the control word and setpoint in one frame, fill a 2-word buffer and set DATA_LEN := 2:

// Build a 2-word block: [CW, HSW]
wBlock[0] := wCW[DriveNo];        // 40100
wBlock[1] := wHSW[DriveNo];       // 40101

"MB_MASTER_DB"(REQ     := b_Trigger_CW_HSW[DriveNo],
              MB_ADDR := 100,        // start at 40100
              MODE    := 2,          // FC 16 write multiple registers
              DATA_PTR := pBlock[DriveNo],
              DATA_LEN := 2,
              DONE    => b_Done_CW_HSW[DriveNo],
              ERROR   => b_Err_CW_HSW[DriveNo],
              STATUS  => w_Stat_CW_HSW[DriveNo]);

MB_ADDR offset rule (S7-1200): when MB_ADDR is in the 4xxxx range, the leading "4" is stripped and the remaining value is treated as 1-based. So MB_ADDR = 100 addresses V20 register 40100, not 40099 and not 40101. Do not subtract 1. Do not add 40001.

Pre-requisite — MB_COMM_LOAD: the matching MB_COMM_LOAD instruction must be called exactly once for the physical port, on the first scan, with the baud rate, parity, and flow-control values that match the V20. Without it, MB_MASTER never executes its request and reports DONE immediately. Place it in OB100 (startup) or guard it with a first-scan flag. Reference: S7-1200 Modbus RTU communication manual in Siemens Industry Online Support.

7. Addressing: 0-Based vs 1-Based

The Modbus specification does not define register numbering — every vendor chooses. The Siemens V20 uses 1-based for the documented register names (40100, 40101). The S7-1200 MB_MASTER also interprets MB_ADDR in the 4xxxx range as 1-based, so they line up directly. The mismatch only appears when:

• A third-party master that is 0-based is talking to the V20 (e.g. some Beckhoff, Schneider, or SCADA drivers). In that case the third-party master should be told the V20 register is 40100, not 100.
• The SCL/PLC code wrote MB_ADDR := 99 thinking it would map to the 100th register. On the V20 that is actually register 40099 (which is documented as reserved). The V20 echoes 0x0000, the PLC sees DONE, and the application "loses" one register of offset for the rest of the project's life.

Quick verification: write the value 12345 (0x3039) to register 40100 and immediately read it back with MODE = 0, MB_ADDR = 100. If you get 12345, addressing is correct. If you get 0 or a previous value, the offset is off by one and the master is treating the V20 as 0-based.

8. Token Ring Polling Architecture

With 16 drives on a single RS485 bus, a single PLC program must police the bus. Two viable patterns:

Pattern A — Time-division token ring (recommended for 16+ drives):

1. Each drive gets a 50–100 ms time slot.
2. Within its slot, the PLC writes the control word (or the CW+HSW block), waits for DONE, then moves on.
3. A 10–20 ms inter-slot delay (V20 RS485 transceiver direction-change time plus V20 protocol turnaround) prevents frame collisions when the next device answers.
4. Total cycle: 16 × 50 ms = 800 ms minimum. Set P2022 above this value (or to 0) to avoid spurious comm-loss faults.

Pattern B — Event-driven write on change:

1. Track last written CW and HSW per drive.
2. Issue a write only when the value changes or on a heartbeat (every 5 s, configurable).
3. Read status / actual speed continuously at a slower rate (250–500 ms).

Pattern A is what the user implemented. The original bug was that every token carried a read request (MODE = 0), so even the drives that "worked" (1 and 2) were merely being polled for status, not actually being commanded to a new speed. The frequency "change" the operator saw was the BOP being touched, or the V20's local-mode fallback being interpreted elsewhere.

Bus timing budget at 9600 baud, 11 bits/char (1 start + 8 data + 1 parity + 1 stop), 8-byte typical request, 7-byte typical response:

Per transaction: 8 (request) + 3 (silence, 3.5 chars) + 7 (response) + 3 (silence)
              = 21 chars * 11 bits / 9600 bit/s
              = 24 ms per round trip
16 drives:     = 384 ms minimum cycle
+ 16 * 10 ms inter-token: 544 ms total (1.8 Hz update rate per drive)
+ 16 * 30 ms HSW/CW settle: 864 ms total (1.2 Hz update rate per drive)

At 19200 baud the transaction time halves to 12 ms; at 38400 it drops to 6 ms. The trade-off is shorter maximum cable length and tighter noise immunity — Siemens V20 supports baud rates up to 115200 on shielded twisted pair, but practical installations rarely exceed 38400 in electrically noisy panels.

9. The Required Initialization Sequence

Why does a "first-scan restart routine" fix the problem? Because the V20 latches command authority on a 0→1 transition of bit 10 ("Control from PLC"). If the PLC starts up with the bus already streaming requests, the V20 may receive its first control word with bit 10 = 0 and quietly enter "no remote authority" mode for the rest of the session. There is no fault; the drive is just being safe. Reasserting bit 10 with the restart routine forces a fresh 0→1 edge, and the drive takes Modbus authority from that point on.

The canonical first-scan sequence on each drive, executed in token order with the inter-token delay between drives:

1. Wait 500 ms after PLC startup to allow all 16 V20s to finish their own boot (the V20 takes ~250 ms to come ready on the BOP).
2. Write CW = 0x047E (1150) — clears OFF2/OFF3, sets bit 10, but no ON yet.
3. Wait 100 ms.
4. Write HSW = 0x0000 (0 Hz).
5. Wait 100 ms.
6. Write CW = 0x047F (1151) — ON, ready to ramp.
7. Write HSW = setpoint × 163.84 / P2000 (e.g. 30 Hz @ P2000 = 50 → 9830 = 0x2666).

Implement this as a state machine on each drive's first-scan handler (or as a one-shot sequence per drive during commissioning) so the bus does not get a burst of 16 simultaneous 0x047F writes. Sequence the writes with the same token ring used for steady-state updates.

Edge case: if any drive is in fault state at startup (red LED on the V20), bit 7 must be toggled (0→1) on the control word to clear it. The V20 will respond with status word bit 3 = 0 (no fault present) only after the edge is acknowledged. Allow up to 200 ms for fault clearance to propagate through the V20's internal state machine.

10. Verification & Diagnostics

After the fix, validate the link with the V20's built-in counters and the S7-1200's MB_MASTER STATUS output.

From the S7-1200 side, after each MB_MASTER call inspect .STATUS:

• 16#0000 — no error.
• 16#80C8 — slave device timeout (no response within timeout window; raise timeout or check cable).
• 16#80D1 — parity / framing error from the line.
• 16#80D2 — CRC error.
• 16#80E1 — illegal function code (V20 received an FC it does not support for that address).
• 16#80E2 — illegal data address (V20 received an address it does not map; check 1-based vs 0-based offset).
• 16#80E3 — illegal data value (e.g. writing a value out of range for that parameter).

For full STATUS code coverage see the S7-1200 Modbus RTU manual in Siemens Industry Online Support.

11. Common Pitfalls

12. FAQ