S7-1200 Modbus RTU 80C8 Slave Timeout: MB_Master Fix Guide

1. Problem Description

An S7-1200 CPU (firmware V4.x or V5.x, programmed in TIA Portal V15.1 or later) is configured as a Modbus RTU master through a CM 1241 RS-485 / RS-232 communication module or through the onboard PtP interface of the CPU. The remote station is an Allen-Bradley (Rockwell) MicroLogix, SLC 500, CompactLogix, or ControlLogix controller exposing the following data over Modbus RTU slave mode:

The user's program calls one MB_Comm_Load block followed by four MB_Master blocks, each linked to a different data area of the remote controller. After some operating time the link begins to drop with:

• Status word = 16#80C8 – "Slave device timeout".
• Polling then halts for the rest of the cycle or, depending on the call sequence, all four master requests fail.

The remote Allen-Bradley controller and the physical RS-485 layer are otherwise healthy. The error appears intermittently and is reproducible only after a few hours of runtime, which is the classic signature of a request-handling or buffering problem in the master rather than a wiring issue.

2. System Architecture

The logical topology is point-to-point RS-485 between a single S7-1200 master and a single AB slave, although the principle applies to a multi-drop bus as well.

Key electrical parameters that must match on both ends of the bus:

• Baud rate: 9600 / 19200 / 38400 / 57600 / 115200 bit/s.
• Parity: 8E1 (even) is the default for Allen-Bradley Modbus. Avoid "none" unless the slave explicitly supports 8N1.
• Slave address: 1..247 (AB commonly uses 1).
• Inter-character and inter-frame silence: 3.5 character times at the chosen baud rate.

3. Allen-Bradley Modbus Address Map

Modbus defines a fixed memory layout. Allen-Bradley controllers expose their internal tag and I/O databases through the addresses below. The address the master sends in the protocol frame is the last four or five digits of the address family; the leading digit identifies the area.

For the 8 real (32-bit IEEE-754 float) values starting at address 41002 the master must read 16 holding registers (8 × 2 = 16). The S7-1200 MB_Master instruction stores the response in a byte buffer; the application program re-assembles each float from two words using WORD_TO_REAL or by direct pointer dereference, because Modbus RTU is always big-endian on the wire while the S7-1200 is little-endian in memory.

4. MB_Comm_Load and MB_Master – Block Behavior

Two instructions from the SIMATIC Modbus RTU library are involved:

• MB_Comm_Load (FB / block class 3, instance DB required). Configures the CM 1241 or onboard PtP port: baud rate, parity, flow control, and the response timeout. The instruction is edge-triggered on REQ and only needs to be executed once after a restart of the CPU, after a STOP/RUN transition, or after a port re-parameterization.
• MB_Master (FB / block class 3, instance DB required). Sends one Modbus request and waits for the slave response. Each instance carries MB_ADDR, MODE, DATA_ADDR, DATA_LEN, and a DATA_PTR that points to the data buffer in the S7-1200 memory.

The crucial rule – taken verbatim from the TIA Portal online help – is:

If multiple calls of the Modbus_Master instruction with different settings for MB_ADDR, MODE, DATA_ADDR or DATA_LEN are placed in your program, you must ensure that only one of these call is active at any given time. Otherwise, the error message 0x8200 is output (interface is busy with an ongoing request). If a call cannot be processed in full, the watchdog is activated by the Blocked_Proc_Timeout parameter and terminates the ongoing command.

In other words, the hardware interface (CM 1241 channel) is single-threaded. Although a single MB_Comm_Load can in principle serve several MB_Master instances, the master blocks must be sequenced by the application; they cannot all be called in the same OB1 cycle without arbitration. The TIA help explicitly permits the "one Comm_Load – many Master" pattern; it does not permit parallel Master calls.

5. Root Cause Analysis of the 80C8 Error

Status word 16#80C8 is generated by the Modbus master when the round-trip time of a request exceeds the configured response timeout. The 80C8 code, by itself, does not distinguish between the following physical/logical causes:

In the scenario described, cause #1 is the dominant one. The TIA Portal online help snippet quoted in the field report confirms that the 0x8200 busy error precedes a slave timeout, because a request that the master cannot dispatch within its watchdog window is aborted by Blocked_Proc_Timeout and the slave reply that eventually arrives is then treated as orphan traffic. The orphan reply is not associated with a pending master call, the watchdog expires, and the next scheduled request is reported as 80C8.

6. State Machine for Multiple MB_Master Calls

The recommended, vendor-supported pattern is a cyclic state machine in OB1 or in a cyclic OB (e.g. OB35 at 100 ms) that advances through the four masters one at a time. A typical implementation in SCL follows.

// State machine in OB1 (or OB35)
CASE iState OF
  0:  // idle – start first request
      MB_Master_1(REQ := TRUE, ...);
      IF MB_Master_1.DONE OR MB_Master_1.ERROR THEN
          MB_Master_1(REQ := FALSE, ...);
          iState := 10;
      END_IF;

  10: // settle 50 ms before next request
      IF tDelay.Q THEN iState := 20; END_IF;

  20: MB_Master_2(REQ := TRUE, ...);
      IF MB_Master_2.DONE OR MB_Master_2.ERROR THEN
          MB_Master_2(REQ := FALSE, ...);
          iState := 30;
      END_IF;

  30: IF tDelay.Q THEN iState := 40; END_IF;
  40: MB_Master_3(REQ := TRUE, ...);
      IF MB_Master_3.DONE OR MB_Master_3.ERROR THEN
          MB_Master_3(REQ := FALSE, ...);
          iState := 50;
      END_IF;
  50: IF tDelay.Q THEN iState := 60; END_IF;
  60: MB_Master_4(REQ := TRUE, ...);
      IF MB_Master_4.DONE OR MB_Master_4.ERROR THEN
          MB_Master_4(REQ := FALSE, ...);
          iState := 0;  // wrap around
      END_IF;
END_CASE;

Rules to obey:

1. Only one REQ input may be TRUE at any instant.
2. Do not set REQ on the same call that DONE or ERROR just became TRUE; reset REQ first so the next scan does not re-trigger the request.
3. Insert a small delay (50–100 ms) between requests to let the slave turn-around its RS-485 transceiver.
4. Use a different instance DB for each MB_Master call; the instance DB holds the working counters, status and the diagnostic word.
5. Read DONE on the falling edge of REQ to avoid missing a one-cycle pulse.

7. Step-by-Step Fix Procedure

1. Keep one MB_Comm_Load, four MB_Master. The original architecture (one Comm_Load, four Master) is correct and is supported by Siemens. The bug is in how the four Master blocks are scheduled, not in the number of Comm_Load blocks.
2. Replace parallel calls with the state machine in §6. Remove any logic that sets REQ on more than one Master per scan. A common cause of parallel calls is the use of four TP (pulse) timers driven by the same clock – do not use that pattern.
3. Set Blocked_Proc_Timeout to 5 s (default is 1 s). In the MB_Comm_Load instance DB raise Static.ActiveBits.Blocked_Proc_Timeout from 1000 ms to 5000 ms. This gives the application time to schedule the next request without aborting the previous one.
4. Set the response timeout in MB_Comm_Load. For 9600 8E1, start with 1500 ms; for 19200 8E1, 1000 ms. Formula: Timeout_ms >= (4 × N_chars × 10 / Baud) × 1000 + ScanTime_slave. For 8 real values (16 registers) the response payload is 37 bytes, so the frame is 8 + 37 = 45 characters; at 9600 8E1 each character is ~1.04 ms, hence ~47 ms of pure air time – well inside any reasonable timeout.
5. Add 120 Ω termination at both ends of the bus and verify the shield is grounded at one end only.
6. Confirm parity and stop bits match the AB controller. Use 8E1 unless the AB project is configured for 8N1.
7. Verify the AB Modbus map is published correctly. On MicroLogix 1100/1400, open the Modbus mapping table in RSLogix 500 and confirm that the addresses 10400..10431, 10440..10471, 10101..10148 and 41002..41017 are bound to real tags.
8. Download the modified program to the S7-1200 and watch the four instance DBs online. Expect STATUS = 0, DONE rising once per poll period, ERROR = FALSE indefinitely.

8. Buffer Sizing and Data Type Mapping

The size of the data buffer that DATA_PTR points to must equal or exceed the byte length of the Modbus PDU. Sizing rules:

For the analog area (8 real values), the buffer is a 16-element WORD array in a global DB. Conversion to REAL requires byte-swap, because Modbus is big-endian and the S7-1200 is little-endian. The SCL snippet below shows the safe conversion path:

// Read 16 WORDs from data area starting at 41002
// MB_Master_4.DATA_PTR := P#DB20.DBX 0.0 BYTE 32
// DB20 is a global DB with 16 WORDs at offset 0
FOR i := 0 TO 7 DO
    // High word first on the wire (big-endian):
    wHi := DB20.DW[i*2];
    wLo := DB20.DW[i*2 + 1];
    rAnalog[i] := DWORD_TO_REAL( (wHi << 16) OR wLo );
END_FOR;

9. Cabling, Termination, and Physical Layer

The 80C8 timeout is frequently attributed to the master logic but in a brownfield installation it is most often the cable. Apply the following physical-layer checklist before changing program code:

• Cable type: Belden 3106A, 9841, 9842 or equivalent twisted pair, 120 Ω characteristic impedance, ≤ 1200 m at 9600, ≤ 200 m at 115200.
• Termination: 120 Ω across A/B at both physical ends of the bus, never in the middle of a stub.
• Bias: Fail-safe bias resistors (typically 680 Ω pull-up to 5 V on B and 680 Ω pull-down to GND on A) are required when the master and slave do not provide internal bias. The CM 1241 does not provide bias; the AB port typically does not either – bias must be added externally.
• Shield: Connect shield to protective earth at one end only. Avoid routing RS-485 parallel to VFD power cables (≥ 200 mm separation).
• Common-mode voltage: Stay within -7 V to +12 V on the AB / CM 1241 common.
• Connector pinout on CM 1241 (RS-485): Pin 8 = T/R+ (D1 / A), Pin 9 = T/R- (D0 / B), Pin 5 = GND. Verify against the AB port; some AB devices label A as "−" and B as "+".

10. Commissioning Verification

Use the following procedure to confirm the fix is stable over at least 24 hours of continuous operation.

1. Open the S7-1200 online view and place the four MB_Master instance DBs in a watch table. Poll DONE, ERROR and STATUS every scan.
2. Set a rising-edge trigger on ERROR = TRUE; if 80C8 reappears, capture the timestamps of the last 20 scans and the values of MB_ADDR, MODE, DATA_ADDR, DATA_LEN of the failing instance.
3. Run a free Modbus scanner (e.g. Modbus Poll, QModMaster, or the in-built Modbus master test in TIA Portal's "Modbus RTU Master" support package) on a laptop with a USB-to-RS485 adapter connected to the same A/B lines. Verify that the four addresses return the expected data with a sub-200 ms round-trip at the chosen baud rate.
4. Force a STOP/RUN transition on the S7-1200 and confirm that all four master blocks re-acquire the data within the first second of the OB1 cycle.
5. Disconnect the AB controller. The four MB_Master calls should all return STATUS = 16#80C8 (or 16#80C0, 16#80C1, 16#80C2) – no 0x8200 must be observed. The 0x8200 busy code proves that the application is still calling more than one master in parallel.
6. Reconnect and log STATUS continuously for 24 h. The expected value is 0x0000 the whole time.

11. Modbus Error Code Reference

The STATUS output of MB_Master uses the following canonical values. Knowing them short-circuits troubleshooting.

12. Frequently Asked Questions