S7-1200 MB_COMM_LOAD: Configuring Modbus RTU Master Communication

S7-1200 MB_COMM_LOAD: Configuring Modbus RTU Master Communication

MB_COMM_LOAD on the SIMATIC S7-1200 configures a CM 1241 or CB 1241 communications module for Modbus RTU master or slave operation. Most first-time integration faults on these blocks are not programming errors; they trace to baud-rate, parity, and slave-address mismatches between the CPU's serial port and the field device. This field-proven reference walks through hardware selection, library version pinning, block parameters, the 40001→MW0 address map, RS-485 wiring, and the corrective steps that resolve the "no signals to/from the device" symptom reported in actual commissioning cases.

Overview

The legacy Modbus RTU master/slave instructions for the S7-1200 are distributed as a TIA Portal global library. The library version is dictated by the CPU firmware:

• MODBUS_RTU_V2.1 – CPU firmware V2.1 and earlier.
• MODBUS_RTU_V2.2 – CPU firmware V2.2 through V3.x.
• MODBUS_RTU_V3.0 – CPU firmware V4.0 and newer (uses optimized blocks).

Mixing library revision with CPU firmware is the single most common root cause of "MB_COMM_LOAD does not work" complaints on legacy S7-1200 projects. If the library is too new for the firmware, MB_COMM_LOAD and MB_MASTER may be hidden, grayed out, or compile-clean but never raise the DONE bit on the first call. If the CPU firmware is older than V2.1, the legacy instructions cannot be used and the application must move to a different platform or upgrade the CPU.

According to the official SIMATIC S7-1200 Programmable Controller System Manual, MB_COMM_LOAD "configures a port for communication using the Modbus RTU protocol" and "must be called once to configure the port for the Modbus RTU protocol. On completion of the configuration, the port can be used by the MB_MASTER and MB_SLAVE instructions." Each call deletes the communications buffer, so it should only fire when parameters change.

Prerequisites

• S7-1200 CPU with firmware ≥ V2.1 for the standard Modbus RTU library, or firmware V4.2+ for the V3 optimized variant.
• TIA Portal V13 SP1 or newer; legacy instructions remain available back to TIA V11 SP2 + Update 4. TIA V11 (the version that originally shipped with very early S7-1200 work) is no longer recommended for new projects – upgrade before commissioning.
• One CM 1241 (RS485 or RS232) or CB 1241 RS485 communication module mounted to the left of the CPU. Up to three CM 1241 modules can be plugged on a single S7-1200 CPU.
• MODBUS_RTU_V2.x or MODBUS_RTU_V3.x library from the TIA Portal Libraries task card (right-side panel under Global Libraries → Modbus RTU).
• Commissioning tooling: STEP 7 online monitor, a PC-side Modbus scanner (Modbus Poll, Modbus Doctor), or a serial-line analyzer to capture the bytes on the wire.
• Reading access to the target device's serial-port specification sheet – most "the link is dead" cases come down to the slave side being set at a baud rate the master never matched.

Hardware Options

Modbus RTU on the S7-1200 requires the PtP-capable CM/CB modules. The CPU's PROFINET port does not run Modbus RTU; use MB_CLIENT/MB_SERVER over the PROFINET port for Modbus TCP instead.

Maximum CM/CB count per CPU is three. Each module's "Hardware identifier" is what MB_COMM_LOAD sees as the PORT input. The hardware ID is assigned by STEP 7 during device configuration and appears under Properties → Port → System constants; in most projects it falls in the 271–285 range. Always select the port via the instruction editor's PORT drop-down rather than typing the integer.

MB_COMM_LOAD Block Parameters

Drop the block from the MODBUS_RTU library, instance it in a global DB (single instance per port), and assign the following input pins from the project data.

Output pins: DONE (BOOL), ERROR (BOOL), STATUS (WORD). Press F1 on the block inside TIA Portal to open the inline help, which shows the full STATUS code table per library version.

MB_MASTER Block Parameters

MB_MASTER executes a single Modbus transaction per call when REQ sees a rising edge. Place the block in a cyclic OB and trigger it on a process-driven edge or with a periodic timer.

Output pins: DONE, ERROR, STATUS. The DONE bit goes TRUE for one cycle after a successful transaction; ERROR goes TRUE if the slave returns an exception or the frame is malformed.

Modbus Function-Code Map (MB_MASTER MODE)

Modbus RTU Frame Format Reminder

A Modbus RTU frame consists of an idle line (≥ 3.5 character times), 1 byte address, 1 byte function code, N bytes payload, 2 bytes CRC-16 (little-endian), and a second silent interval of ≥ 3.5 character times. At 9600 baud, 3.5 character times is about 3.65 ms; the CM 1241 enforces this through the RESP_TO and the underlying UART FIFO. If a non-Modbus device is attached to the bus, it must respect this interval or it will appear as a corruption source to the CM.

Modbus Address Map to S7 Data

MB_MASTER preserves the legacy MODICON address-map layout. The 65 536 address space is divided into reference types:

The rule most often surfaced in field cases: address 40001 always maps to the first word of the area selected at the DATA_PTR pin of MB_MASTER. If DATA_PTR = P#MW0, then 40001 → MW0, 40002 → MW1, 40003 → MW2, 40004 → MW3, and so on. This is the cause of the most-common report that "MB_MASTER reads 40001 but MW0 isn't updating". Selecting the wrong reference type in the slave's address map (30001 vs 40001 for the same register) references different data on the slave, even if the byte offsets happen to coincide.

Wiring: RS-485 Bus for Modbus RTU

RS-485 is a 2-wire or 4-wire differential bus. Modbus RTU always uses 2-wire (half-duplex), driving the A+ and B− pair. The PLC is the only master on the segment and each A/D converter, drive, sensor, or I/O block counts as one slave node.

• Twisted pair, characteristic impedance ≈ 120 Ω, shielded (e.g., Belden 9841 or equivalent).
• Terminate both ends with 120 Ω between A+ and B−. Never terminate mid-bus.
• Bias: pull-up / pull-down on A+ / B− on the master or first node if no slave provides bias. The CM 1241 RS485 does not provide bias; the slave must provide it or an external bias must be installed. Bias values typically 560 Ω–680 Ω to 5 V / GND.
• Shield bonded to earth at one end only (master end preferred).
• Common-mode reference: connect the cable shield drain or a third conductor (signal ground) to the 0V reference of every node only if the nodes share protective earth; otherwise leave the shield floating at the far end.
• DB-9 converter: industrial-grade isolated RS-485 to DB-9 (Phoenix Contact SUBCON-PLUS-PROFIB / SUBCON-PLUS-MODBUS, Phoenix PSI-MODEM-RS485, or equivalent). Hobby-grade cables have been the root cause of CRC errors with no diagnostic beyond rising MB_MASTER error counts.

RS-485 Topology Diagram

Configuration Procedure

Step 1 — Update TIA Portal and Library

1. Open the S7-1200 project in TIA Portal.
2. In Project tree → PLC → Device configuration, confirm the CPU part number and firmware version.
3. In Options → Global Libraries → Modbus RTU, add the matching MODBUS_RTU revision.
4. If the version dropdown only shows a single option (V2.1 in older portals), update TIA Portal to V13 SP1+ or apply the latest HSP for full V3.x coverage.

Step 2 — Wire the CM 1241 and Add to Device View

1. Insert the CM 1241 RS485 (or RS232) module next to the CPU in the hardware catalog and drag it into the device configuration left of the CPU.
2. Open the port properties and note the "Hardware identifier" (e.g., 271). This is the PORT input for MB_COMM_LOAD.
3. Set baud rate and parity in the hardware view only as a default; MB_COMM_LOAD overrides these every time it runs.
4. Download the device configuration and confirm the CM 1241 errors-free in the online diagnostics.

Step 3 — Call MB_COMM_LOAD Once on First Scan

In OB1 (or OB100 for warm restart), insert the following STL/ST-style logic. The instance DB names below are illustrative; substitute project-specific names.

"DB_MODBUS_CFG"(REQ := "FirstScan",
                PORT := 271,            // hardware ID of CM 1241 RS485
                BAUD := 9600,
                PARITY := 2,            // 2 = Even (mandatory for Modbus RTU 8-E-1)
                FLOW_CTRL := 0,         // 0 = No flow control
                RTS_ON_DLY := 0,
                RTS_OFF_DLY := 0,
                RESP_TO := 1000,        // ms
                MB_DB := "iDB_MBMaster",
                DONE => "mbCommLoadDone",
                ERROR => "mbCommLoadErr",
                STATUS => "mbCommLoadStatus");

Acceptable PARITY values for a Modbus RTU link are 1 (odd) or 2 (even). PARITY 0 (None) is permitted only when both ends agree to ignore the parity bit and 2 stop bits are used. Industrial instruments almost universally run 8-E-1.

Step 4 — Drive MB_MASTER in a Cyclic OB

"DB_MBMaster"(REQ := "reqReadHolding",       // rising edge fires one transaction
              MB_DB := "iDB_MBMaster",
              MODE := 2,                      // 2 = Read Holding Registers (0x03)
              DATA_ADDR := 40001,             // first address in the 4xxxx range
              DATA_LEN := 4,                  // read 4 registers: 40001..40004
              DATA_PTR := P#M 100.0 WORD 4,
              DONE => "mbMasterDone",
              ERROR => "mbMasterErr",
              STATUS => "mbMasterStatus");

For a write, change MODE to 5 (single register, 0x06) or 7 (multiple registers, 0x10). Pulse REQ with the DONE bit or a periodic timer (e.g., 250 ms).

Step 5 — Match the Slave's Serial Settings

Use the slave vendor's configuration tool or its keypad to confirm:

• Slave address (1–247). Default is often 1; some A/D converters ship at 247.
• Baud rate exactly equal to the PLC side.
• Parity exactly equal (Even is the most common in instrument networks).
• Data bits = 8, Stop bits = 1 for "8-E-1" or "8-O-1"; use "8-N-1" only if the slave supports it.
• Register base offset: many industrial devices quote 4xxxx = "register 1"; if the device documentation says "register 40011", enter DATA_ADDR = 40011. Do not subtract 40001.

Status Code Reference

Both blocks expose a 16-bit STATUS word. The high byte carries protocol-level events; the low byte carries instruction-level errors. The inline help (F1 on the block in TIA Portal) shows human-readable text for the full WORD.

MB_COMM_LOAD — Common STATUS Codes

MB_MASTER — Common STATUS Codes

Always pair MB_MASTER's STATUS with a Modbus exception reference. Exception code 0x02 "Illegal Data Address" most often means the requested register is read-only or out of range on the slave.

Troubleshooting Matrix

Loop-Back Test Procedure

When commissioning fails with 0x7080 or 0x8080, isolate the cable with a loop-back:

1. Disconnect the A/D converter and place a screw terminal jump across A+ ↔ A+ and B− ↔ B− on the cable at the slave end.
2. Force MB_MASTER with MODE = 0 (read coils, 0x01), DATA_ADDR = 1, DATA_LEN = 8, DATA_PTR = P#M 200.0 BOOL 8.
3. Trigger REQ. The CM 1241 should echo back its own transmit frame; without bias, most hardware will flag the slave's apparent silence.
4. Replace the loop-back with a passive RS-485 echo plug (bridging TX+/TX− together) to drive an artificial response if the cable is otherwise intact.
5. Reconnect the real slave and run a parity / baud scan with a Modbus scanner.

Performance and Timing

On a CM 1241 RS485, a single Modbus RTU read of 4 holding registers at 9600 baud completes in approximately 25–35 ms (10-byte request + 13-byte response + 4 idle intervals at 3.5 character times each). For higher update rates, raise BAUD to 38 400 (≈ 8 ms per round-trip) or 115 200 (≈ 4 ms). At 115 200 the slave's serial port and the cable length are usually the bottleneck; RESP_TO should be set to 50–100 ms to avoid premature timeouts when the PLC scan time stretches.

Each MB_MASTER transaction occupies the CM port until DONE or ERROR rises. Holding REQ high in the same OB cycle does not queue another transaction; the block simply pulses through. To read multiple slaves in fast rotation, use a state machine in OB1 that toggles REQ per the previous DONE/ERROR edge.

Multi-Master and Multi-Slave Rules

• Only one master per Modbus RTU segment. Two masters fighting for the bus produce CRC errors and exception 0x06 "Slave Device Busy" on the slave.
• Up to 32 unit loads per RS-485 segment without repeaters. The CM 1241 is one unit load. Modern drivers exceed 32 nodes, but stay conservative.
• Master and at least one slave must provide bias. If none does, install a 620 Ω pull-up to +5 V on A+ and 620 Ω pull-down to GND on B− at the master end.
• Stub length to each slave < 1 m for 1 Mbit/s links; for 9600 baud, stubs can be longer but keep them short anyway to suppress reflections.

Migration Notes: S7-200 / MODBUS_PARA-Variants

Engineers upgrading from S7-200 PPI / Modbus RTU libraries should re-map the data. The S7-200 mapping is byte-arranged differently from the S7-1200: on the S7-200, 40001 = VW0 (a 16-bit word); on the S7-1200 the same DATA_ADDR with DATA_PTR = P#MW0 yields 16-bit word alignment. If the legacy code used bit-level addressing (e.g., 00001 = Q0.0), port the same address to MODE = 0 with a BOOL pointer. Verify each parameter against the slave's manual before re-running in production.

Verification

1. Go online (TIA Portal → Online → Go online), open the project tree and the program editor.
2. Force FirstScan = TRUE once by setting the FirstScan tag. MB_COMM_LOAD should pulse DONE TRUE for one cycle and STATUS = 0x0000.
3. Open the Watch table for the master DB and force DATA_PTR or the holding-register word area to verify the destination.
4. Force REQ TRUE on MB_MASTER. Observe DONE → TRUE within RESP_TO (default 1 s). Watch STATUS collapse from 0x0001 → 0x0000.
5. Check the slave's LEDs: most converter modules flash "Rx" while answering and "Tx" when sending; if Tx of the master is on but Rx never lights, the slave sees a corrupt frame.
6. Run a PC-side Modbus scanner (Modbus Poll, "Modbus Doctor", or the vendor's service tool) on the same RS-485 segment to confirm the slave's view of the bus.
7. Trace 60 s of MODBUS traffic with a portable analyzer; look for the 3.5-character idle interval and CRC-16, both little-endian.

TIA Portal Hardware Support Package Reference

If MB_COMM_LOAD or MB_MASTER is not visible in the instruction tree, install the matching HSP for your CPU firmware revision (HSP 0093 for S7-1200 CPUs, HSP 0101 for newer firmware). The HSP unlocks the matching MODBUS_RTU revision and prevents the "library object missing" compile error. Re-check after any TIA Portal upgrade; a fresh service pack can roll library revisions silently.

Frequently Asked Questions