S7-1200 Modbus RTU Configuration MB_COMM_LOAD and MB_MASTER Guide

Overview: Modbus RTU on the SIMATIC S7-1200

Modbus RTU on the S7-1200 platform is implemented through three instruction blocks from the TIA Portal "Communication" palette: MB_COMM_LOAD, MB_MASTER, and MB_SLAVE. MB_COMM_LOAD configures the serial port of a CM1241 communication module (RS232 or RS485). MB_MASTER initiates Modbus requests on the configured port; MB_SLAVE makes the S7-1200 respond as a server. The blocks operate over the PtP (Point-to-Point) layer of the CM1241 module, so the module must be inserted in the device configuration and the port parameters must match the slave device exactly.

Modbus is a master/slave protocol where a single client initiates transactions against one or more server devices on a shared bus. For a more general description of the protocol and its physical layer requirements, see the Schneider Electric reference What is Modbus and How does it work?. This article focuses on the S7-1200-specific implementation details: first-scan execution, output capture, timing parameters, and the most common synchronization errors.

Hardware: CM1241 RS232 vs CM1241 RS485

Two CM1241 communication modules are typically used for Modbus RTU:

RS232 is restricted to point-to-point links. For multi-drop Modbus RTU networks the RS485 module is mandatory. The RS485 module is the correct choice for any field-installed Modbus network (drives, instruments, remote I/O) and supports up to 32 nodes on a single segment. Termination (typically 120 Ω at each end of the trunk) and biasing must be wired externally unless the slave device integrates them.

Prerequisites and System Memory Configuration

1. Insert a CM1241 module in the device configuration of the S7-1200 station and assign it to a submodule slot.
2. Open the S7-1200 Properties > System and Clock Memory tab and enable "Use system memory byte". This exposes a system byte whose first bit pulses for one PLC scan on the first cyclic pass after a STOP-to-RUN transition, restart, or power-on.
3. Note the configured system memory byte address (default is byte 1, exposing bit M1.0 as the first-scan pulse). MB_COMM_LOAD must be wired to this bit so it executes exactly once per startup and writes the port configuration into the CM1241 module.
4. Create an instance data block for MB_COMM_LOAD (e.g. MB_COMM_LOAD_DB) and a separate instance DB for MB_MASTER or MB_SLAVE.

MB_COMM_LOAD: One-Shot Port Configuration

MB_COMM_LOAD programs the CM1241 port with the baud rate, parity, data bits, stop bits, and flow control. It must run exactly once at startup; subsequent calls are not harmful but are unnecessary because the parameters remain latched in the module.

The RTS_ON_DLY and RTS_OFF_DLY parameters have no meaning on an RS485 module. The CM1241 RS485 port does not expose an RTS handshake line in half-duplex Modbus RTU, so leave both at 0. Setting them to non-zero values does not cause harm, but they will have no observable effect on the bus.

MB_MASTER and MB_SLAVE: Polled Execution

MB_MASTER and MB_SLAVE can be called every scan. They are not restricted to the first-scan pulse. The REQ input of MB_MASTER is a level-triggered edge: a positive edge initiates a new request. The block handles queuing, turn-around timing, and CRC generation internally.

MB_SLAVE uses a similar interface: it exposes MB_ADDR, a holding-register pointer (MB_HOLD_REG), and the same set of DONE/BUSY/ERROR/STATUS outputs. The slave block does not need REQ; it answers automatically when the master addresses its station.

Timing Parameters: RESP_TO and Retransmission

RESP_TO is the most important timing parameter. It defines the maximum time (in milliseconds) the master waits for a slave response after transmitting a request. MB_MASTER retransmits a failed request up to three times before reporting an error. Between each retry, the block waits the configured RESP_TO interval.

The total time before a transaction is declared failed is therefore roughly:

For a typical 8-byte query/response at 9600 baud 8N1 (≈ 9.6 ms per character, ≈ 96 ms per frame), a RESP_TO of 1000 ms yields a worst-case fail time near 3.3 seconds. If the application polls multiple slaves cyclically, this becomes the lower bound of the cycle time. Reduce RESP_TO to a few hundred milliseconds for fast slaves and increase it for slow devices (wireless gateways, cellular RTUs, or slaves with long processing delays).

Output Validity and Data Capture

The status outputs of MB_MASTER and MB_SLAVE (DONE, BUSY, ERROR, STATUS) are valid for only one PLC scan when the corresponding event occurs. Likewise, the data written to DATA_PTR is overwritten in place only when a read transaction completes; if the application logic does not sample it on the same scan, the data is replaced by the next transaction.

To capture diagnostic information reliably, latch the values into global markers or a diagnostic data block. A common pattern is:

// Capture error code on rising edge of ERROR
IF "MB_Master_DB".ERROR THEN
  "LastModbusError" := "MB_Master_DB".STATUS;  // Word
  "ErrorTimestamp"  := SYSTEM_RTC();           // DTL or Date_And_Time
END_IF;

// Capture read data on rising edge of DONE
IF "MB_Master_DB".DONE THEN
  // Copy from DATA_PTR to a holding DB here
END_IF;

For diagnostic data that must persist across scans (last error code, transaction counters, slave response time), use a global DB rather than a marker word; markers are limited to 16 bits and are vulnerable to cross-references in the program.

Error Codes and the 16#81E7 Synchronization Error

Error codes returned on the STATUS output come from two sources: the Modbus protocol layer (standard exception codes 1, 2, 3, 4, etc., returned by the slave) and the CM1241/PtP layer (S7-1200 internal errors). The most common synchronization error is 16#81E7.

The 16#81E7 error is the most frequently reported problem in field installations and almost always traces to MB_COMM_LOAD not being executed. The CM1241 port remains in an uninitialized state, the internal Receive_P2P buffer is not synchronized, and any Modbus request is rejected before leaving the master block.

Verification with Modbus Test Tools

Bench-test every Modbus link with a known-good master or slave simulator before commissioning. Two commonly used tools on the bench are:

• Modscan32 (Win-Tech) — simulates a Modbus master, useful when the S7-1200 is the slave.
• Modsim32 (Win-Tech) — simulates a Modbus slave, useful when the S7-1200 is the master and you need a deterministic peer.

Modscan32 and Modsim32 are trial-licensed; the trial cuts the connection after a short interval but is sufficient for verification. Always confirm a round-trip read and write between the simulator and the PLC before connecting the real field device.

1. Start Modsim32. Configure slave ID 1, holding registers starting at 40001, and a small register count (e.g. 10).
2. On the S7-1200, configure MB_COMM_LOAD for 9600 8E1 (the Modbus RTU default) and RESP_TO = 1000 ms.
3. In MB_MASTER, set MB_ADDR = 1, MODE = 3 (Read Holding Registers), DATA_ADDR = 0 (address 40001), DATA_LEN = 10.
4. Pulse REQ from a clock memory bit or a manual input.
5. Monitor DONE, ERROR, and STATUS in the watch table. On success, the destination DB shows the simulated values.
6. Repeat with MODE = 16 (Write Multiple Registers) to verify both directions.

If the test passes with a simulator but fails with the real field device, the problem is almost always electrical (wiring, termination, grounding) or parameter mismatch (slave's baud/parity, register base). Re-verify the slave's communication settings against the values programmed in MB_COMM_LOAD.

Commissioning Procedure for an RS485 Network

1. Confirm the CM1241 RS485 module is seated and visible in the device configuration. Note the HW identifier for the PORT input.
2. Enable the system memory byte and confirm the address matches the first-scan bit in the program (default M1.0).
3. Place MB_COMM_LOAD, MB_MASTER (or MB_SLAVE), and their instance DBs in the program. Wire MB_COMM_LOAD.REQ to M1.0.
4. Compile, download, and go to RUN. In a watch table, verify that MB_COMM_LOAD.DONE rises on the first scan and stays latched.
5. Send a single diagnostic request to each slave on the bus at low baud, one at a time, to isolate wiring and address problems before adding the full polling table.
6. Once every slave responds, increase baud to production rate and add the cyclic polling logic.

Troubleshooting Matrix

Frequently Asked Questions

For a deeper reference on Modbus protocol fundamentals (frame structure, addressing, exception codes, RS485 electrical characteristics) see the Schneider Electric Modbus overview and the Siemens FAQ entry on establishing Modbus-RTU communication with STEP 7 (TIA Portal) V11 for the SIMATIC S7-1200, available on the Siemens Industry Online Support portal.