S7-1200 G2 Modbus RTU: Resolving CM/CB 1241 Errors 80C8/81E2

1. Problem Overview

The SIMATIC S7-1200 G2 generation introduced a stricter Modbus RTU stack behavior that breaks a configuration pattern that worked reliably on first-generation S7-1200 CPUs (for example CPU 1215C AC/DC/Rly, article number 6ES7 215-1BG40-0XB0). When an engineer ports a working project to a G2 CPU, the same RS-485 wiring, the same CM 1241 or CB 1241 module, and the same Modbus_Comm_Load / Modbus_Master instance block combination suddenly produce one of two status words on the master block:

• STATUS = 16#80C8 on a CM 1241 (6ES7 241-1EA50-0XB0) — the transmit LED flashes once, the slave never sees a request, and no response is ever returned.
• STATUS = 16#81E2 on a CB 1241 (6ES7 241-1CA50-0XB0) — both Tx and Rx LEDs blink, the slave receives a request and answers, but the master rejects the response as invalid.

Both symptoms are typically misdiagnosed as baud-rate mismatches, parity problems, or defective cabling. On the G2 platform the actual root cause is the operating mode of the RS-485 transceiver, which is no longer forced by the hardware configuration (HW Config) alone; it must be written into the Modbus_Comm_Load_DB instance data block at runtime via the static variables MODE and LINE_PRE. First-generation S7-1200 firmware ignored these tags, which is why projects migrated without changes suddenly fail on the G2.

2. Affected Hardware and Firmware

3. Modbus RTU Error Code Reference (S7-1200 / S7-1500 / S7-1200 G2)

The status words reported by Modbus_Master and Modbus_Comm_Load for the S7-1200, S7-1500, and S7-1200 G2 families are documented in the TIA Portal help under MODBUS (RTU) → Error messages (S7-1200, S7-1500, S7-1200 G2). The codes that matter for this fault pattern are listed below.

Reference: MODBUS (RTU) — Error messages for S7-1200, S7-1500, S7-1200 G2 (TIA Portal help).

4. Root Cause Analysis

On the first-generation S7-1200 (FW ≤ 4.x), the hardware configuration dialog for CM 1241 and CB 1241 exposed the protocol type (Modbus Master, Modbus Slave, USS, Freeport) and the operating mode (RS-485 full-duplex / RS-485 half-duplex / RS-422) as configuration bits in the system data. The Modbus_Comm_Load block read those bits and set the transceiver automatically. Engineers who moved from CPU 1215C + CM 1241 to S7-1200 G2 + CM/CB 1241 expected the same dialog, but on the G2 the operating mode is no longer mirrored in HW Config; it is a static variable of the load DB.

The two symptoms map to two distinct physical-layer problems:

1. 16#80C8 on CM 1241 — the CM 1241 is a true RS-422/RS-485 transceiver that defaults to RS-422 full-duplex unless told otherwise. In RS-422 mode the master listens on a separate pair and never enables its transmitter, so no voltage ever appears on the bus. Modbus Poll therefore never receives a request. Setting MODE = 4 forces half-duplex RS-485, which is the only mode Modbus RTU supports on a two-wire bus.
2. 16#81E2 on CB 1241 — the CB 1241 is hard-wired to RS-485 half-duplex, so MODE = 4 alone is not enough. The transceiver still needs a pre-send delay (LINE_PRE) long enough for the bus to settle before the first byte is clocked out. With LINE_PRE = 0 or 1, the first byte collides with the bus turnaround and is either missed by the slave or echoed into the master’s receiver, producing the port-mismatch error.

Both values must be written before Modbus_Comm_Load executes its REQ edge. The simplest pattern is to assign them in a startup OB (OB100) or in a one-shot segment that runs once on first scan.

5. Solution: Writing MODE and LINE_PRE into the Modbus_Comm_Load_DB

Open the instance data block generated for your Modbus_Comm_Load call (default name Modbus_Comm_Load_DB). Expand the Static section. You will see the following tags that are hidden in the first-generation block interface but are now first-class members of the FB on the G2:

5.1 Code: One-Shot Initialization in OB100

The cleanest way to guarantee that MODE = 4 and LINE_PRE = 2.0 are written exactly once is to place an initialization segment in the warm-restart OB (OB100) or in a one-shot network driven by a first-scan flag.

// OB100 — Startup (S7-1200 G2)
// Initialize Modbus RTU master port
#Init_Done := FALSE;

"Modbus_Comm_Load_DB".MODE     := 4;        // RS-485 half-duplex
"Modbus_Comm_Load_DB".LINE_PRE := 2.0;      // 2 ms pre-send delay

"Modbus_Comm_Load_DB".REQ      := TRUE;     // Arm first load
#Init_Done := TRUE;

5.2 Code: Per-Cycle Re-Arming in OB1

The REQ input of Modbus_Comm_Load is edge-sensitive. Drive it from a flip-flop so the load executes on the rising edge of a start command, then re-arms automatically after the configuration has been applied.

// OB1 — Main cycle (S7-1200 G2)
IF "Start_Load" AND NOT "Load_Armed" THEN
    "Modbus_Comm_Load_DB".REQ := TRUE;
    "Load_Armed" := TRUE;
END_IF;

IF "Modbus_Comm_Load_DB".DONE THEN
    "Modbus_Comm_Load_DB".REQ := FALSE;
    "Modbus_Load_Done" := TRUE;
END_IF;

IF "Modbus_Comm_Load_DB".ERROR THEN
    "Modbus_Comm_Load_DB".REQ := FALSE;
    "Modbus_Load_Error" := TRUE;
    "Modbus_Load_Status" := "Modbus_Comm_Load_DB".STATUS;
END_IF;

5.3 Code: Modbus_Master Trigger in OB1

Only call Modbus_Master after Modbus_Comm_Load reports DONE = TRUE and ERROR = FALSE. This guarantees the port is fully configured before the first Modbus transaction is sent.

// Modbus_Master call example: read holding register 40001 from slave 1
IF "Modbus_Load_Done" AND NOT "Modbus_Load_Error" THEN
    "Modbus_Master_DB".REQ       := "Trigger_Read_40001";
    "Modbus_Master_DB".MB_ADDR   := 1;
    "Modbus_Master_DB".MODE      := 0;                  // 0 = read holding register
    "Modbus_Master_DB".DATA_ADDR := 1;                  // Modbus address 40001
    "Modbus_Master_DB".DATA_LEN  := 10;                 // 10 words
    "Modbus_Master_DB".DATA_PTR  := "Holding_Reg_Buffer";
END_IF;

6. Step-by-Step Configuration Procedure

1. Open the project in TIA Portal V20 Update 3. Confirm the device catalog shows the S7-1200 G2 CPU under SIMATIC S7-1200 → CPU → S7-1200 G2. If it is missing, install the G2 HSP first.
2. Add the CM 1241 (6ES7 241-1EA50-0XB0) or CB 1241 (6ES7 241-1CA50-0XB0) to the device configuration. Do not rely on the “Operating mode” drop-down — on the G2 it is read-only for Modbus RTU.
3. Insert Modbus_Comm_Load (FB 1800 / 1580 depending on TIA version) and Modbus_Master (FB 1801) from Libraries → Communication → MODBUS RTU. Accept the auto-generated instance DB names.
4. Open Modbus_Comm_Load_DB and confirm that MODE and LINE_PRE appear under Static. If they do not, the project is still linked to the legacy block — reinsert from the G2 library.
5. Set BAUD = 9600, PARITY = 0 (none), STOP_BITS = 1 on the Modbus_Comm_Load call. The slave must be set identically.
6. Write MODE = 4 and LINE_PRE = 2.0 into the static tags of the load DB. Use the OB100 pattern from §5.1.
7. Wire PORT to the symbolic port name of the CM/CB (e.g. "CM_1241_1"). Wiring a hardware identifier here will return 16#8280.
8. Compile the project (Ctrl+B) and download to the CPU. Go online and watch Modbus_Comm_Load_DB.STATUS; it must read 16#0000 after the first DONE pulse.
9. Trigger one Modbus_Master transaction. Watch Modbus_Master_DB.STATUS; it must read 16#0000 on success.

7. Verification Checklist

8. Wiring and Topology Notes

RS-485 Modbus RTU is a two-wire, half-duplex, multi-drop bus. The electrical rules below are mandatory for the S7-1200 G2 CM/CB 1241; failing any of them is the second most common source of 16#81E2 / 16#81E9 after the MODE / LINE_PRE issue.

• Cable: twisted pair, characteristic impedance 120 Ω, capacitance ≤ 60 pF/m. Belden 3106A or Lapp ETHERLINE® 2-AX are typical choices.
• Topology: daisy-chain, never star. Maximum stub length 30 cm at 9600 baud; stubs must be shorter as baud increases.
• Termination: 120 Ω resistor at each physical end of the bus. The CM 1241 has a slide switch for built-in termination; on the CB 1241 termination is external.
• Shield: grounded at one end only (typically the master end) to avoid ground loops. Use the shield terminal on the CM 1241 sub-D connector.
• Shield ground reference on CM 1241: pin 5 of the sub-D (or the dedicated shield clamp). The signal ground (pin 3 or 8 depending on revision) must be tied to the slave’s signal ground through the third wire of the cable.
• Maximum cable length at 9600 baud: 1200 m. Drop to 800 m for noisy industrial environments. Above 19200 baud the maximum drops sharply; do not exceed 115200 without re-evaluating the topology.
• CM 1241 vs CB 1241: CM 1241 can be configured as RS-422 (4-wire) or RS-485 (2-wire). For two-wire Modbus RTU only RS-485 half-duplex (MODE = 4) is valid. CB 1241 is RS-485 only.

9. Diagnostic Procedure for Recurring 16#81E2 on CB 1241

1. Capture the bus with a Modbus RTU sniffer (e.g. on a laptop in line with a transparent RS-485 tap). Compare the request bytes the master transmits against the response bytes the slave returns.
2. Check the parity bit of every byte with an oscilloscope or a logic analyzer. A parity mismatch at the bit level means the PARITY parameter is wrong, not the baud rate. The master is sending “8N1” while the slave is listening for “8E1” or vice versa.
3. Measure the time between the last falling edge of the request and the first falling edge of the response. Modbus RTU requires the inter-frame silence to be at least 3.5 character times. At 9600/8N1, 3.5 chars ≈ 4.1 ms. If the slave answers faster than that, the master drops the frame as noise.
4. If the response is correct and on time, but the master still returns 16#81E2, increase LINE_PRE to 5.0 ms and re-test. Long cable runs and large termination networks stretch the bus rise time and need a longer pre-send delay.
5. If 16#81E2 persists, swap the CM 1241 / CB 1241 module with a known-good spare to rule out a damaged transceiver (a damaged RS-485 driver can pass self-test but fail under bus load).

10. Diagnostic Procedure for 16#80C8 on CM 1241

1. Confirm that MODE = 4 is actually written to the static tag. In online monitor, right-click the instance DB and select Monitor/Modify. The value of MODE must be 4, not 0 or 1.
2. Verify the PORT input. On the S7-1200 G2 the PORT input expects the symbolic port name (for example "CM_1241_1"). Passing a hardware identifier (such as 269) is invalid and produces 16#8280, while leaving it unwired produces 16#80C8 because the block cannot resolve a port to transmit on.
3. Check Modbus_Comm_Load_DB.DONE and .ERROR. If .ERROR = TRUE and .STATUS = 16#80C8, the load itself failed — no master transaction can succeed until the load is healthy.
4. Loop the bus back to the CM 1241 Rx pins. If a self-transmitted request is echoed back, the transceiver is alive and the wiring to the slave is open. If nothing is echoed, the transceiver is dead or MODE is wrong.
5. Confirm the slave is configured to the same baud/parity/stop-bits and that the slave address matches the value at MB_ADDR on the Modbus_Master block.

11. Migrating an Existing Project from CPU 1215C to S7-1200 G2

1. Back up the original TIA project. Compile it against the G2 target; TIA will warn about unsupported blocks if any are used.
2. Replace the Modbus_Comm_Load and Modbus_Master FBs with the versions shipped in the G2 HSP. The new FBs expose MODE and LINE_PRE as static variables; old code that wrote them to the input side will now produce a compile error.
3. Add an OB100 segment (or a one-shot in OB1) that writes MODE = 4 and LINE_PRE = 2.0 into the new instance DBs.
4. Re-validate every Modbus_Comm_Load.PORT input. The symbolic port name format changed between firmware generations on the S7-1200 family.
5. Re-validate the MB_ADDR range. The G2 master rejects slave ID 0 (broadcast) on read operations; broadcast writes remain supported but cannot be echoed back, so the master reports 16#80C8 on every broadcast read.
6. Re-download to the G2 CPU and follow the verification checklist in §7.

12. Quick-Reference Parameter Set

13. Frequently Asked Questions