Troubleshooting ET 200SP CM PtP Modbus RTU Master Communication

The ET 200SP CM PtP communication module (catalog number 6ES7 137-6AA00-0BA0) is a serial point-to-point interface used in distributed I/O stations with SIMATIC S7-1500 CPUs. When configured as a Modbus RTU master, it exchanges data with field devices such as inverters, instruments, and third-party controllers over RS-485 or RS-232. Engineers repeatedly report three symptom clusters on commissioning: a dimly blinking Tx LED with no Rx activity, transmit without a slave reply, and successful transmit followed by corrupted payload. This reference consolidates the root causes, the diagnostic path, and the corrective actions drawn from the official Siemens application example and the device manual.

1. Module Identification and Firmware Baseline

Always read the module firmware version with the online diagnostics of TIA Portal before changing parameter sets. The official Siemens application "Master-Slave Communication via a CM PtP Using the Modbus RTU Protocol" (entry ID 68202723) is the primary reference document for parameterizing the module and for selecting the FBs of the PtPModbus library. Download the PDF directly from the Siemens support portal:

Siemens application 68202723 - S7-1500 Modbus RTU via CM PtP (PDF, v2.1)

2. Symptom Catalogue

Three symptom clusters dominate the support threads for the 6ES7 137-6AA00-0BA0:

1. Dim Tx LED, no slave response. The Tx indicator on the CM is illuminated at roughly 10-20 % of normal intensity; the Rx indicator on the test converter (Moxa uPort 1150, USB-RS-485) is dark. The CPU diagnostic buffer contains no error.
2. Tx blink, Rx silent, no Modbus reply. The Tx LED flashes briefly per request, but the slave never answers. Status outputs of the Modbus master FB report a send success and a receive timeout.
3. Reply arrives but the payload is corrupted. After the user changes the Mode parameter of COMM_LOAD_DB to 4, the Moxa Rx LED starts to flicker, but the bytes returned do not match the requested register map.

Each cluster maps to a specific root-cause group. Resolve them in the order presented because fixing cluster 1 typically resolves 2 and 3 as a side-effect.

3. Root Cause 1 - Grounding, Common-Mode Voltage, and Cable Topology

The single most common cause of a dimly blinking Tx LED with an inactive Rx LED on the test converter is a missing or incorrect common reference between the master and the slave. RS-485 requires that the signal ground (M terminal of the CM and pin 5 of the D-sub or terminal 8 of the BaseUnit) be bonded to the reference ground of the remote Modbus device. When this connection is absent, the differential driver of the CM still toggles, but the common-mode voltage at the receiver is outside the RS-485 input range. The receiver therefore never asserts the start bit; the host PC sees no Rx activity.

Secondary checks at the cable level:

• Use a twisted-pair cable with characteristic impedance of 100-120 Ω (e.g., Belden 3106A or Lapp UNITRONIC Li2YCY).
• Verify the polarity of A (+) and B (-). A swap does not damage the hardware but it produces exactly the dim-Tx, silent-Rx symptom because the receiver in the slave is biased the wrong way.
• Place a 120 Ω termination at each end of the bus. The CM itself does not include internal termination; an external resistor across A and B is required.
• Keep the stub length from the trunk to each device below the baud-rate-dependent limit (a rule of thumb is 0.3 m at 115.2 kbit/s).

4. Root Cause 2 - Protocol and Frame Mismatch

The ET 200SP CM PtP does not know which protocol to use until the PtPModbus library loads it. The mode value is written to COMM_LOAD_DB.Mode before FB640 - Modbus_Master is called. The valid Mode values for the CM PtP are documented in the library help:

Other frame-level mismatches that produce silent slaves:

• Baud rate - 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200 bit/s are supported. Both ends must match exactly.
• Parity - None, Even, Odd. RTU commonly uses Even.
• Stop bits - 1 or 2. RTU uses 1 when parity is set, 2 when no parity is configured.
• Slave address - 1-247. The CM never accepts address 0 on a master request; the address in FB640 - Modbus_Master must be the polled station's address.

5. Root Cause 3 - DIL Switch Setting on the BaseUnit

The 6ES7 137-6AA00-0BA0 module snaps onto a BaseUnit whose DIL switches select the physical interface. The 4-position DIL on the BaseUnit typically controls:

If the switches are set for RS-232 while the slave is RS-485 (or vice-versa), the differential pairs are not connected to the screw terminals. This produces a Tx-blink with no Rx activity even with the ground wire correctly installed. The device manual of the BaseUnit (BU15-P16+A0+2B for the dark variant, BU15-P16+A0+2D for the light variant) provides the exact switch map.

6. TIA Portal Configuration Procedure

The following procedure works with STEP 7 V17 or later. Older V15.1/V16 projects require the legacy ModbusCommPool library; the steps are similar but the FBs are FB803 - Modbus_Master and FB805 - Modbus_Slave.

1. Add the ET 200SP station under the S7-1500 CPU and insert a CM PtP (article number 6ES7 137-6AA00-0BA0) into the slot list.
2. Open the module's Properties > Module parameters and set:
   • Operating mode: Modbus RTU master
   • Baud rate: matches the slave
   • Parity: Even (typical for Modbus RTU)
   • Data bits: 8, Stop bits: 1
   • Response timeout: 1000 ms (increase to 2000 ms for slow slaves)
3. Import the PtPModbus library from the Siemens support portal (the application 68202723 ships the library as a project with reference to PtPModbus_V2_x).
4. Create an instance DB for FB640 - Modbus_Master and call it in OB1. The REQ input is edge-triggered; the MB_DB parameter references a data DB that contains one or more Modbus_Master requests with the slave address, function code, start address, and quantity.
5. Call FB641 - Modbus_Master_Poll or the Modbus_Poll background DB to drive the request list. Polling is internal; do not pulse REQ on every cycle.
6. Create an instance DB for FB642 - Modbus_Comm_Load (the newer library name) and call it once during cold restart (OB100). This DB replaces the legacy COMM_LOAD_DB global DB. Verify the MODE input matches the protocol selected in the hardware config. The most common commissioning error is leaving the MODE input at its default or at the value used by an ASCII project.
7. Compile, download the hardware configuration, and reset the CPU to apply the new module parameters.

7. Sample Program Skeleton (SCL, TIA V17+)

// OB100 - Cold restart, parameterize the CM
#inst_Comm_Load(REQ := TRUE,
                LADDR := 256,            // HW identifier of the CM, take from device view
                MODE  := 4,              // 4 = Modbus RTU master
                BAUD  := 9600,
                PARITY := 1,             // 0=None, 1=Even, 2=Odd
                TIMEOUT := 2000,
                DONE => #load_done,
                ERROR => #load_err,
                STATUS => #load_status);

// OB1 - Read holding register 40001 from slave 1, length 10 words
IF #poll_enable THEN
  #inst_Modbus_Master(REQ := #req_edge,
                      MB_DB := "Modbus_Request_DB",
                      DONE => #m_done,
                      BUSY => #m_busy,
                      ERROR => #m_err,
                      STATUS => #m_status,
                      DATA_PTR := #data_area);
END_IF;

The DATA_PTR is a POKE area of length matching the Quantity in the request DB. The STATUS word follows the standard Modbus exception code in the high byte and a Siemens-internal sub-code in the low byte (see section 9).

8. LED Behaviour Reference

9. STATUS Word Decoding

Both FB640 - Modbus_Master and the Modbus_Comm_Load FB return a 16-bit STATUS word. The high byte is the standardized Modbus exception code (when applicable); the low byte is a Siemens sub-code that pin-points the failure inside the library. Common values for the CM PtP:

10. Diagnostic Procedure (Step-by-Step)

1. Verify the 24 V supply on the BaseUnit with a multimeter. Confirm the CPU diagnostic buffer is empty.
2. Disconnect the field cable from the CM. Connect an RS-485 line monitor or a USB-RS-485 dongle (the Moxa uPort 1150 is a typical field tool) directly to the CM terminals.
3. Trigger a single Modbus request via the watch table on the instance DB. Observe the Tx line on the dongle. With a known-good reference, you should see an 8-byte request frame every polling cycle.
4. Loop-back test: with the dongle removed, bridge A to A and B to B on the CM terminals. Configure a slave on the same address as the polled device. The Modbus master receives its own echo. If echo works, the CM is functional; the failure is in the field cable or the remote slave.
5. Verify signal ground continuity between the CM M terminal and the slave GND. A missing ground is the dominant root cause for dim-Tx, no-Rx.
6. Re-check the DIL switch on the BaseUnit. Most field cabinets are wired for RS-485; if the BaseUnit was delivered pre-set to RS-232, the green Tx LED behaves exactly as the symptom describes.
7. Set MODE := 4 in the parameter DB of Modbus_Comm_Load. Recompile and download.
8. Capture a Modbus trace with a third-party tool (Digi RealPort, Eltima Advanced Serial Port Monitor, or Wireshark with a serial capture). Decode the bytes. RTU frames start with at least 3.5 character times of silence, then slave_id, function_code, address_hi, address_lo, qty_hi, qty_lo, CRC_lo, CRC_hi. If you see 7-E-1 ASCII framing (colon : as start delimiter, LRC instead of CRC), the CM is still in ASCII mode.
9. Read the slave's documentation for register map. A common mistake is reading holding registers (function 03) when the device only supports input registers (function 04), or starting at register 1 when the device's address 0 maps to the first register.

11. Verification

After the corrective actions, perform a closed-loop verification:

1. Trigger a single read from the slave in the watch table. The DONE output must pulse to TRUE for one cycle and the STATUS output must read 16#0000.
2. Monitor BUSY: it must fall back to FALSE within the configured timeout (typically 200-500 ms for healthy slaves).
3. Compare DATA_PTR contents against the slave's reference value (e.g., a known register 40001 should always return the same value for a given process state). Repeat for at least 100 cycles to catch intermittent framing errors.
4. Toggle the slave address via the HMI and confirm the CM stops receiving a reply for non-existent addresses and that the STATUS returns 16#8083 (timeout) rather than 16#0000.
5. Open the CPU diagnostic buffer in TIA Portal. No entry related to the CM or to point-to-point communication should be present.
6. For long-term stability, log the STATUS word in an HMI trend and verify that no exception codes appear during normal operation.

12. Common Pitfalls and Field-Proven Cautions

• Mode parameter is evaluated only at cold restart. Many engineers call Modbus_Comm_Load from OB1 and never see the protocol re-applied after a parameter change. Call it from OB100 or, alternatively, issue a re-initialization by toggling the module's EN input and the REQ input of Modbus_Comm_Load.
• Two Modbus libraries exist. PtPModbus (since TIA V14) replaced the older ModbusCommPool. Do not mix FBs from the two libraries - the data structure of MB_DB is incompatible.
• Length of the request queue. The internal polling buffer of the CM holds a finite number of requests. Exceeding it produces silent drops with no error code. Reduce the request count to a few essential transactions and prioritize by update rate.
• CPU 1512SP1 hardware identifier. The hardware identifier of the CM is assigned by the slot number, not by the catalog number. Read the system constants of the project or look up the start address in the device view before passing it to LADDR.
• USB-RS-485 dongle biases. Dongles such as the Moxa uPort 1150 apply their own 4.7 kΩ failsafe bias on A and B. When the dongle is left in-circuit, the bus bias is not at the Modbus idle mark. Disconnect the dongle from the trunk for permanent installation.
• Address offset. Modbus addresses in the user request DB are zero-based in the Siemens library, even though most slave manuals list the registers with the Modbus-tradition one-based offset. A request for holding register 40001 must be written as address 0 in the request DB.
• RS-232 half-duplex. The CM PtP on RS-232 still uses a half-duplex discipline when the DIL switch is set accordingly. RTS/CTS handshaking is not supported on the CM; do not attempt to wire flow-control signals.

13. Quick Reference - Where to Look First

14. Document References

Siemens application 68202723 - Master-Slave Communication via a CM PtP using Modbus RTU (PDF, v2.1)

Siemens support entry 109769912 - S7-1500/ET 200SP CM PtP (6ES7137-6AA0x) device manual and firmware downloads

Siemens support entry 109751614 - PtPModbus library for SIMATIC S7-1500 and ET 200SP