Siemens ET 200SP CM PtP Modbus Master Error 8281 Troubleshooting

Problem Overview

When a working Modbus RTU master application on a SIMATIC S7-1200 CPU 1214 (with a CM 1241 serial module) is migrated to a SIMATIC S7-1513 CPU controlling a distributed ET 200SP station with an IM 155-6 PN ST interface module and a CM PtP communication module, communication can become intermittent. The classic symptom pattern is:

• Modbus_Comm_Load returns STATUS = 16#7000 (no error reported at load time).
• Modbus_Master returns STATUS = 16#8281 on every call.
• The instance-DB static variable MB_DB_SPORT remains at its initial value W#16#FFFF instead of being populated with the connection identifier from Modbus_Comm_Load.
• The underlying WRREC call reports status 16#C080_9300 (identifier/address invalid) when the master attempts to start a request.
• Forcing MB_DB_SPORT manually (for example to W#16#0136) makes the master poll successfully until the next cold restart, but the override is not a sustainable solution.

This article documents the root cause of the MB_DB_SPORT not being automatically updated, the meaning of error 16#8281, the meaning of 16#C080_9300, and the correct TIA Portal configuration that allows the connection identifier to be written back into the Modbus_Master instance automatically.

System Architecture: S7-1200 to S7-1500 + ET 200SP Migration Path

The migration path that triggers this fault is structurally different from the original configuration, even when the same project blocks and slaves are used.

Original Configuration (Working)

• Controller: S7-1214 DC/DC/DC (firmware 4.x) with a CM 1241 RS422/485 plug-in serial module.
• Topology: Point-to-point, CM is in the local S7-1200 rack and is configured directly under the CPU in the device view.
• Hardware identifier of the CM: assigned by TIA Portal locally (small integer, typically 260–263).
• Modbus_Comm_Load LADDR: the local CM identifier.

New Configuration (Intermittent / Failing)

• Controller: S7-1513-1 PN (firmware 2.9 or later), with a PROFINET line to the distributed I/O.
• Distributed station: ET 200SP with IM 155-6 PN ST (article number 6ES7155-6AU00-0BN0 or 6ES7155-6AU30-0BN0 depending on firmware).
• Communication module: ET 200SP CM PtP (6ES7137-6AA00-0BA0) plugged to the right of the IM in the BaseUnit chain.
• Hardware identifier of the CM PtP: assigned by TIA Portal in the distributed I/O namespace (typically a much larger integer, for example 4113 or 4138 in a real project, depending on slot index).
• Modbus_Comm_Load LADDR: must reference the distributed CM PtP identifier, not the local identifier of the CPU.

Two of the most common port-identifier mistakes during migration are:

1. Leaving the old local LADDR of the CM 1241 in the Modbus_Comm_Load block while the project now points to a CM PtP under an IM 155-6 PN ST. WRREC to the wrong slot returns 16#C080_9300 immediately.
2. Compiling only the changed S7-1500 program without re-doing the device configuration of the ET 200SP head, leaving the MB_DB_SPORT in the static area pointing to a slot that exists in the old project but is no longer mapped.

Modbus Communication Blocks in TIA Portal

The Modbus RTU master on an S7-1500/ET 200SP uses the library "MODBUS (RTU)" blocks from Siemens. The two blocks that interact are described in the Siemens Industry Online Support documentation set for the S7-1500/ET 200SP Modbus library (see also the ET 200S Modbus/USS module manual for the historical reference that defines the protocol-driver structure used by CM PtP).

The static variable MB_DB_SPORT is the connection identifier that the master uses internally to address the CM PtP port. The value is set by the Modbus_Comm_Load call from the moment DONE = TRUE is signaled. The master FB then uses that stored identifier for every subsequent request.

Root Cause Analysis: MB_DB_SPORT Not Populated

When MB_DB_SPORT remains at W#16#FFFF in the online view of the Modbus_Master instance DB, the most common root causes are:

1. LADDR mismatch. The HW identifier at the LADDR input of Modbus_Comm_Load does not match the actual CM PtP module that has been plugged and configured under the IM 155-6 PN ST. The most frequent cause after a hardware migration is that the LADDR constant was not updated when the device was re-assigned from a local CM 1241 to a distributed CM PtP.
2. CM PtP not configured for "Modbus master" in the device view. In the ET 200SP CM PtP properties, the operating mode must be set to Modbus master (RTU) under Operating mode > Module parameters > Protocol. If the protocol is left as Freeport / Transparent, the module rejects the parameter record write from Modbus_Comm_Load and the load block never writes back a valid MB_DB_SPORT.
3. Multiple Modbus_Comm_Load calls on the same instance. Re-invoking Modbus_Comm_Load against an already-loaded instance with a different MB_DB reference clears the stored port. The block then cannot validate which instance owns the port, and the master sees W#16#FFFF.
4. Project compile not propagated. The S7-1500 program was downloaded, but the ET 200SP submodule (the CM PtP itself) was not re-downloaded. The CPU has the new LADDR constant, but the actual submodule still has the old PROFINET slot configuration. In this case the WRREC in the load block returns 16#C080_9300 ("wrong ID").
5. Different Modbus library versions for S7-1200 and S7-1500. The S7-1200 and S7-1500 Modbus libraries use different FB numbers (FB 1200/1201 on S7-1200 versus FB 1800/1801 on S7-1500). Migrating a project copies the old block tags, but the internal MB_DB_SPORT offset may differ. The result is that the load block writes the value into a different byte of the master instance DB than the master reads, and the master still sees W#16#FFFF.

The presence of STATUS = 16#7000 on Modbus_Comm_Load while MB_DB_SPORT remains W#16#FFFF is the diagnostic fingerprint of cause 5 above, or of cause 1 with a stale instance DB that was not re-initialised after download. The fingerprint of cause 1 with a live configuration mismatch is STATUS = 16#C080_9300 on the load block, with the master still showing 16#8281.

Decoding Error 16#8281 in Modbus_Master

The status code 16#8281 is documented in the TIA Portal help for the Modbus library. The two production-grade interpretations are:

• Configuration mismatch. The Modbus_Master instance has been loaded by Modbus_Comm_Load with parameters that are inconsistent with the current hardware configuration of the CM PtP (different baud, parity, or port). The internal state machine aborts before issuing the request.
• No valid connection ID. The static MB_DB_SPORT in the Modbus_Master instance DB is W#16#FFFF, meaning the load block has not yet written a valid connection identifier into the instance. The master therefore has no port to address and refuses the request.

In the migration case, the second interpretation is the one that matches the observation: MB_DB_SPORT = W#16#FFFF, master status 16#8281, and forcing the value to W#16#0136 makes the master work until the next restart. The connection identifier W#16#0136 is the TIA Portal-assigned handle for the CM PtP submodule under the IM 155-6 PN ST in this particular project layout.

PROFINET IO Error 16#C080_9300 in WRREC

The status 16#C080_9300 is a PROFINET IO controller / device record error returned by the standard WRREC instruction when the parameter record write is rejected by the addressed IO device. In the context of a Modbus load call against a CM PtP, this status means "identifier/address invalid": the HW ID at LADDR does not match any IO submodule currently configured in the device view of the ET 200SP head.

This is consistent with:

• The original CM 1241 being unplugged from the S7-1200 (and thus the LADDR from the old project no longer exists in the new project), or
• The CM PtP being added to the ET 200SP under a different slot than the one referenced by the LADDR input.

When this error appears simultaneously with the master's 16#8281, the resolution path is to fix the LADDR in the load block, recompile, and re-download the ET 200SP configuration to the field.

Step-by-Step Resolution

The procedure below resolves the issue without manually editing the instance DB. It assumes the project is opened in TIA Portal V17 or later and the target is an S7-1500 CPU with ET 200SP.

Prerequisites

• TIA Portal project with the migrated S7-1500 CPU and ET 200SP station.
• CM PtP module physically installed in the ET 200SP BaseUnit chain, seated and locked.
• Online connection to the S7-1500 CPU (PROFINET or Ethernet).
• The Modbus library installed: Modbus_Comm_Load (FB 1800) and Modbus_Master (FB 1801) for S7-1500, or the equivalent for ET 200SP CPU.

Procedure

1. Re-validate the ET 200SP device configuration. In the project tree, open Devices & networks > ET 200SP station > Device view. Verify the slot order: IM 155-6 PN ST in slot 0, the CM PtP in slot 1 (or wherever the project intends it). The slot number becomes part of the HW identifier of the submodule.
2. Set the CM PtP operating mode. Select the CM PtP module in the device view, open Properties > Operating mode, and choose Modbus master (RTU). Set baud, parity, data bits, stop bits, and flow control to match the slave.
3. Read the correct HW identifier of the CM PtP. With the project selected, open PLC > Accessible devices or place the cursor on the CM PtP in the device view and read the System constants / HW identifiers. For a typical ET 200SP configuration the CM PtP interface identifier will be a value in the high 4000s or low 5000s. Record this value.
4. Update the Modbus_Comm_Load instance. Open the OB that calls Modbus_Comm_Load (typically OB 1 or a cyclic OB). At the LADDR input, replace the constant with the HW identifier of the CM PtP recorded in step 3. Do not use a local CM identifier from a previous S7-1200 project. Confirm the MB_DB input references the correct Modbus_Master instance DB.
5. Delete and re-create the Modbus_Master instance DB. This forces TIA Portal to regenerate the static structure with the offsets of the current library version. Right-click the instance DB, choose Delete block, then drag a fresh Modbus_Master instance from the library into the call. Re-link any user code that referenced the old instance.
6. Recompile hardware and software. Right-click the S7-1500 CPU > Compile > Hardware and software (rebuild all). TIA Portal will recompute the HW identifiers and propagate the new LADDR constants into the program.
7. Download hardware configuration first, software second. Use Download to device > Hardware configuration, confirm the ET 200SP station comes up with no diagnostic interrupts, then Download to device > Software (all). This order ensures the CM PtP submodule exists in the actual field configuration before the Modbus_Comm_Load issues a record write to it.
8. Run Modbus_Comm_Load once with REQ = TRUE. In online mode, force or trigger a single execution of Modbus_Comm_Load with REQ = TRUE. Verify that DONE = TRUE, ERROR = FALSE, and STATUS = 16#0000 on the rising edge of DONE.
9. Confirm MB_DB_SPORT in the instance DB. Open the Modbus_Master instance DB in online view and inspect the static MB_DB_SPORT. The value must now be a TIA Portal-issued connection identifier (a non-FFFF word). It will typically look like W#16#0136 for the first configured Modbus master port in the project, or any other value TIA Portal assigned for that specific HW identifier.
10. Issue one Modbus_Master call. Set REQ = TRUE on the master FB. The first call returns STATUS = 16#7001 (first call) or 16#7002 (intermediate), and within the Modbus response time the call returns DONE = TRUE and ERROR = FALSE with STATUS = 16#0000. No more 16#8281 should appear.

Verification

Validate the fix at three levels: instance state, runtime status, and physical line.

Error Code Reference Matrix

Use the following matrix when triaging Modbus RTU on an S7-1500 with ET 200SP CM PtP.

Preventive Configuration Best Practices

When designing a Modbus RTU master on an ET 200SP CM PtP, the following rules prevent the 16#8281 fault from reappearing in future projects.

1. Pick the right library per CPU generation. Use the S7-1500/ET 200SP library (FB 1800/1801) for an S7-1500 CPU. The S7-1200 library (FB 1200/1201) is functionally compatible at the wire level but produces a different instance-DB static layout. Mixing them after migration is the most common root cause of MB_DB_SPORT not being written back.
2. Assign a unique MB_DB per port. Each physical CM PtP port must be loaded by exactly one Modbus_Comm_Load call referencing exactly one master (or slave) instance DB. Multiple load calls against the same instance corrupt the stored port.
3. Use symbolic HW identifiers. Reference the CM PtP through a tag of type HW_INTERFACE populated from the system constants of the device configuration, not a raw integer constant. The compiler then re-validates the symbol when the slot changes.
4. Run Modbus_Comm_Load only on cold start and on parameter change. Calling the load FB every OB1 cycle is unnecessary once DONE = TRUE. Use a one-shot pattern with a rising-edge on the cold-restart bit or a parameter-change flag.
5. Watch the diagnostic buffer of the CM PtP after download. PROFINET port-down events on the ET 200SP head will tear down the CM PtP submodule connection; the load block must be re-run after such an event. A watchdog on Modbus_Master.ERROR and STATUS = 16#8182 (no response) is a good trigger.
6. Maintain RS485 bias and termination. For multi-drop RS485, enable the fail-safe bias on the ET 200SP CM PtP (per the device manual) and place 120 Ω termination at both physical ends only. Missing bias explains the "sometimes working, sometimes not" symptom pattern that often accompanies 16#8182 in field installations.
7. Match the inter-frame timeout. The Modbus RTU spec requires a 3.5-character silence between frames. At 9600 baud this is roughly 4 ms; at 19200 baud it is roughly 2 ms. Use a Modbus tap or a serial analyser to confirm the CM PtP is actually emitting this gap; some slave devices are very strict about it.

Hardware and Software Compatibility Notes

Field-Commissioning Checklist

Use this condensed checklist when commissioning a fresh migration from an S7-1200 CM 1241 setup to an S7-1500 + ET 200SP CM PtP setup.

• [ ] CM PtP physically installed in the correct BaseUnit slot, locked.
• [ ] PROFINET cable from CPU 1513 to IM 155-6 PN ST verified with PROFINET diagnostics (no port-down events).
• [ ] TIA Portal device view shows the CM PtP in the correct slot and protocol mode = Modbus master (RTU).
• [ ] LADDR input of Modbus_Comm_Load uses the symbolic HW identifier of the distributed CM PtP, not the legacy CM 1241 identifier.
• [ ] Modbus_Comm_Load.MB_DB references the correct Modbus_Master instance DB.
• [ ] Baud, parity, data bits, stop bits match the slave datasheet exactly.
• [ ] RS485 bias enabled (internal) or external resistor network fitted.
• [ ] Termination resistors (120 Ω) at the two physical ends of the bus only.
• [ ] First Modbus_Comm_Load call returns DONE = TRUE, STATUS = 16#0000.
• [ ] MB_DB_SPORT in the master instance DB is a non-FFFF word and survives STOP/RUN.
• [ ] First Modbus_Master call returns DONE = TRUE, STATUS = 16#0000; data is in the configured target area.
• [ ] Long-run monitor (≥ 1 h) shows zero 16#8281 and zero 16#C080_9300 occurrences.