S7-1200 CM 1241 RS-485 Only Sends 00: Modbus Troubleshooting

A Siemens S7-1200 CPU equipped with a CM 1241 RS422/485 communication module is observed to transmit only the byte 00 on the Modbus RTU link to a 2-wire RS-485 pressure sensor. The byte recurs at the configured poll period (here, every 1 s). No proper Modbus RTU frame—address, function code, payload, or CRC—appears on the bus. The PLC and module had previously worked with the same sensor, were removed for a period during which the sensor was tested on a Mitsubishi platform using a different cable, and now fail to communicate after being re-installed. This reference walks through the diagnostic path from symptom to root cause and explains why the dominant fault mode is almost always RS-485 physical-layer wiring—not a defective CM 1241 module.

1. Symptom Definition

The fault signature is unambiguous:

• An external USB-to-RS-485 adapter, wired as a passive tap on the 2-wire bus, captures an unbroken stream of 00 bytes repeating at the polling interval.
• The CM 1241 TX LED continues to flash, indicating that the master instruction is firing and the UART is shifting data out of the module.
• No exception is raised in the MB_COMM_LOAD instance (ERROR = FALSE, STATUS = 0000).
• No response is ever received from the slave; MB_MASTER.DONE never toggles, ERROR stays FALSE but the data is never refreshed.

The byte 00 corresponds to the bus's idle (recessive) line state in RS-485, and the symptom is a classic case where the CM 1241 transmitter is active but the differential voltage it produces on the wire pair is being absorbed, shorted, reversed, or unloaded by the cable/sensor front-end. The PLC cannot tell the difference between "the slave never responded" and "what I sent never left the connector cleanly."

2. CM 1241 RS422/485 Hardware Overview

The CM 1241 (catalog numbers 6ES7241-1CH30-0XB0 and 6ES7241-1CH32-0XB0) is a plug-in communication module that adds an isolated serial port to any S7-1200 CPU. Each module provides one 9-pin sub-D female port configured as either RS-422 (4-wire, full duplex) or RS-485 (2-wire, half duplex). The CM 1241 is rated for a common-mode voltage range of -7 V to +12 V for 1 second and 3 V RMS continuous on the signal lines, per the official CM 1241 RS422/485 Specifications entry in the S7-1200 Manual Collection.

Front-panel LEDs vary by part number but always include:

A TXD blink that is not matched by any valid traffic on the external analyzer confirms that the fault is downstream of the UART—either inside the RS-485 transceiver, in the cable, or at the sensor terminal block.

3. Reference Modbus RTU Frame on the Bus

The application’s known-good Modbus RTU request against the sensor is shown below. Every byte of this frame must appear on the bus for correct communication.

Byte 0  Byte 1  Bytes 2-3   Bytes 4-5   Bytes 6-7
01       04      00 02       00 02       D0 0B
|        |       |           |           |
|        |       |           |           +--- CRC-16 (Modbus), low byte first
|        |       |           +--------------- Quantity of registers: 2
|        |       +--------------------------- Starting address: 0x0002
|        +----------------------------------- Function code: 04 (Read Input Registers)
+-------------------------------------------- Slave address: 1

At 9 600 bps with 8 data bits, Even parity, and 1 stop bit (commonly shortened to "8E1"), each character is 11 bit-times or ~1.146 ms. Modbus RTU requires:

• 3.5 character-times of silence between frames (~4.0 ms at 9 600 bps)
• 1.5 character-times maximum inter-character gap (~1.7 ms at 9 600 bps)

If the interval between consecutive 00 bytes is roughly 1 s and matches the request cycle of MB_MASTER, the bus is being driven with valid UART output, but the polarity is reversed such that the differential pair never represents the intended marks.

4. TIA Portal Hardware Configuration

The CM 1241 must be configured for 2-wire RS-485 half-duplex operation in the project, not as RS-422. This is set on the module's properties > "Port configuration" in the device view:

Selecting the wrong transmission mode is a common reason for a "silent" CM 1241. In 4-wire (RS-422) mode the transmitter and receiver are on different pairs, so 2-wire sensors will not see valid data and the CM 1241 will not see their replies. The serial-port configuration on the device view must match the physical wiring, otherwise the firmware direction-control logic will deassert the driver at the wrong moment and the bus will idle low (0x00).

5. MB_COMM_LOAD and MB_MASTER Parameter Reference

The Modbus master is implemented in two function blocks from the "MODBUS_PCBCP" library (or its successor in TIA Portal V17+).

MB_COMM_LOAD — port initialization

MB_MASTER — request

Re-verify that both blocks are in the same cyclic OB and that REQ on the first MB_MASTER is edge-triggered correctly. If MB_MASTER.REQ is glued permanently high, the master will issue continuous requests and you will see a much higher bus-utilization trace than one 00 byte per second.

6. Root Cause: RS-485 Cable Polarity and Termination

The CM 1241's RS-485 transceiver uses a differential pair: TXD/RXD-A (positive data line) and TXD/RXD-B (negative data line). Polarity is defined by the driver IC inside the CM 1241, not by the sensor. The sensor manufacturer, however, gets to label its terminals arbitrarily. Common conventions are:

• A / B (TIA-485 recommended, Siemens style)
• D+ / D− (USB-RS-485 adapter style)
• Y / Z (legacy Japanese instrumentation convention)
• T+ / T− / R+ / R− (4-wire sensors mislabelled)

If the cable is wired straight through (pin 2 of the D-sub to A on the sensor, pin 3 to B), but the sensor is internally wired with A and B swapped at its terminal block, the bus will appear to be continuously idling because every mark the CM 1241 transmits as +V_{diff} is presented to the sensor as −V_{diff}, then reflected back as +V_{diff} during the slave's reply window. On a half-duplex 2-wire bus with no echo suppression, the master receives its own bits inverted and the receiver's internal de-glitching logic discards them.

A second, equally common defect is reversed termination: a 120 Ω resistor is installed across the pair at both ends, or worse, at the mid-point. RS-485 requires termination at the two physical ends of the bus only, never in the middle. Over-termination pulls the bus into a linear region where the driver's differential swing is below the receiver threshold of the CM 1241 (~200 mV) and the UART sees no transitions—only the recessive 00.

A third defect is a shield short to one of the data lines. When the shield is pinched under a terminal screw and contacts the positive data conductor, the data line is held at shield potential. The CM 1241 still tries to drive the line, but the differential voltage at the sensor terminals collapses to near zero.

7. Step-by-Step Diagnostic Procedure

1. Watch the CM 1241 LEDs. A blinking TXD proves the UART is being serviced. If TXD never blinks, the problem is the application code (MB_MASTER not called) or MB_COMM_LOAD has ERROR = TRUE; inspect STATUS in OB1.
2. Verify MB_COMM_LOAD status. After every download, watch the rising edge of DONE then read ERROR. If ERROR is true with a non-zero STATUS, reference the TIA Portal help topic "MB_COMM_LOAD STATUS parameter". The most common values are 80C8 (slave did not respond in time) and 80C9 (CRC error).
3. Capture the bus with a USB-to-RS-485 adapter. Use an analyzer that records raw UART frames rather than only the decoded payload, then look at the bytes. Compare to the expected frame in section 3.
4. Measure the differential voltage on the bus. A working RS-485 bus shows a swing of roughly ±1.5 V to ±5 V between the A and B lines during transmission. If the meter reads <100 mV, the bus is being shorted or over-terminated. If it reads the full swing but the analyzer shows only 00, the wiring is reverse-polarity at one end.
5. Swap the RS-485 cable. This is the single highest-yield action in any Modbus RS-485 troubleshooting case. Cables fail more often than modules.
6. Swap the CM 1241 module with a known-good spare. If two modules produce the same symptom on the same cable, the cable is the fault, not the module.
7. Re-validate TIA Portal port configuration. Project > Devices & Networks > CM 1241 > Properties > Port configuration > ensure "Half duplex (RS-485) 2-wire" is selected and that the baud, parity, and data bits match the sensor datasheet exactly.
8. Verify slave ID and register map. Confirm with the sensor vendor documentation that the slave address on the bus is 0x01 and that input register offset 0x0002 is the pressure reading.

8. RS-485 Cable Construction for 2-Wire Mode

Wiring a CM 1241 to a 2-wire sensor requires only two data conductors plus shield/ground. Pin assignments on the CM 1241 sub-D are:

Best-practice rules:

• Use twisted pair, characteristic impedance 100–120 Ω, capacitance < 60 pF/m.
• Place a 120 Ω termination at the PLC end and another at the sensor end, only.
• Connect the shield to ground at exactly one point, typically the cabinet ground near the PLC.
• Keep stub length < 1/10 of the rise time (~1 m max at 9 600 bps).
• Never ground either data line to chassis; RS-485 is a floating differential bus.

9. Verification Procedure

After the corrective action, validate end-to-end with the following steps:

1. Repower the PLC and sensor. Wait for MB_COMM_LOAD.DONE = TRUE and ERROR = FALSE.
2. Watch the MB_MASTER.DONE bit toggling at the configured polling rate.
3. Capture the bus with the USB-RS-485 adapter and confirm the request frame matches 01 04 00 02 00 02 D0 0B.
4. Confirm a response frame from the sensor is present (e.g., 01 04 04 PP PP CC CC [CRC]) and that the CRC validates.
5. Verify the PLC's DWORD tag updates with valid pressure data and that the value changes when the sensor's process pressure changes.
6. Run a 24-hour soak test under normal operating conditions to catch intermittent cable or sensor faults.

10. Troubleshooting Matrix

11. Practical Field Notes

• Always mark the "master-end" of a custom RS-485 cable and the polarity of each conductor. A field tech changing the cable six months later should see the markings and not have to re-trace polarity.
• When documenting the project, save the captured working frame (e.g., 01 04 00 02 00 02 D0 0B) into the PLC's project notes. Future engineers will see the baseline immediately and will not waste time re-deriving it.
• Use TIA Portal's online watch on MB_MASTER.DONE and MB_MASTER.ERROR as a free, no-instrument "go/no-go" indicator before deploying a USB-RS-485 sniffer.
• When switching between PLC brands (Mitsubishi and Siemens in this case), the RS-485 cable is the most likely casualty. Mitsubishi and Siemens do not define the A/B polarity identically at the cable-end terminal block, so a single cable cannot be reused between the two vendors without rewiring the terminal block.