Troubleshooting Modbus Timeout Errors RS-485, RTS/CTS, and S7-200

Problem Overview

A Modbus timeout error is raised by a master client (PLC, SCADA, HMI, or Modbus master library) when no valid response frame is received from a slave within a configured response time window. On a Siemens S7-200 CPU, this condition typically surfaces as exception code 0x0B (gateway target device failed to respond) returned by the MBUS_CTRL/MBUS_MSG library or as a generic "no response" / "slave timeout" flag from a Freeport-based Modbus master routine. The same error class is observed in the Modbus specification under exception responses, but the timeout itself is a transport-layer symptom, not a Modbus protocol error.

Three failure layers dominate the root cause pool:

1. Physical layer wiring (RS-485 A/B polarity, shield, termination, RS-232 vs RS-485 vs RS-422 selection on the converter).
2. Data-link / handshake layer (RTS/CTS hardware flow control mis-wiring, half- vs full-duplex mode).
3. Application layer (slave address, function code, parity, baud rate mismatch, port mode on the S7-200 CPU).

Modbus Timeout Root Cause Matrix

RS-485 Wiring and A/B Polarity

RS-485 uses a differential pair. On most converter and PLC terminals, Data+ (non-inverting, B in TIA-485 nomenclature, A in many vendor datasheets) and Data− (inverting) must be connected to the matching terminal on the slave. Mixing them produces inverted framing; the slave will typically hold the line silent and the master will time out.

For the S7-200 CPU port 0 (RS-485) and the typical industrial converter (e.g., B&B, Advantech, or generic RS-232/485 adapter), the common pin map is:

Standard 2-wire RS-485 bus rules:

1. Maximum of 32 unit loads on a single segment (1/8 UL transceivers allow up to 256).
2. 120 Ω termination at each physical end of the bus, never in the middle.
3. Fail-safe bias resistors (typically 680 Ω pull-up on D+ and 680 Ω pull-down on D−) on at least one node to hold the line idle-high.
4. Shield grounded at one end only to avoid ground loops.
5. Stub length less than 1/10 of the driver rise time × propagation speed (practically < 3 m for 115.2 kbps).

RS-232 Hardware Flow Control (RTS/CTS)

RS-232 is a single-ended point-to-point standard. Two control lines govern hardware flow control:

The most common wiring fault on a converter is RTS connected to RTS. This is not a valid handshake pair; the master driver never sees its own CTS asserted if the slave uses an active-low CTS, or the slave is held off if the master drops its own RTS. The valid handshakes are:

• No flow control: Tie CTS high (or enable "always-asserted" in the driver) and leave RTS disconnected on both ends.
• Hardware flow control (RTS/CTS): Master RTS → Slave CTS, Slave RTS → Master CTS. Cross-over.
• Loopback fallback: RTS tied to CTS on the same device (e.g., DB-9 pins 7-8 shorted on the slave). This satisfies the transmitter's CTS requirement but provides no real flow control. Acceptable for short bench testing only.

Siemens S7-200 Port Configuration

On the S7-200 (CPU 224, 226, 224XP, 226XM) the port used for Modbus must be switched from PPI to Freeport mode by the MBUS_CTRL subprogram. The library is delivered in the Modbus Slave Library (USS/MODBUS instruction set, part of STEP 7-Micro/WIN). The relevant mode/symbol bit is SM0.7 for port 0 (RUN mode = PPI, STOP = free).

Step 7-Micro/WIN also requires the CPU to be in Freeport mode for the chosen port. The port assignment is configured under System Block → Communication Ports:

1. Set the port to Freeport (not PPI/MPI) when running a user Modbus routine.
2. Match baud rate and parity exactly to the slave.
3. Calculate the inter-character timeout: 3.5 char-times minimum. At 9600/8N1 that is 3.5 × 1.04 ms ≈ 3.6 ms; at 19200/E71 it is 3.5 × 1.146 ms ≈ 4.0 ms.

Adapter DIP Switch and LED Diagnostics

Generic RS-232/485 converters expose a 4- or 8-position DIP switch that selects:

• RS-232 vs RS-485 vs RS-422 (some triple-mode units use 2 switches).
• 2-wire vs 4-wire (half-duplex vs full-duplex).
• Termination 120 Ω ON/OFF (switch per end of bus).
• Fail-safe bias ON/OFF.

For an S7-200 to a single Modbus slave, the canonical configuration is:

1. RS-485 mode enabled, RS-422 disabled.
2. 2-wire half-duplex (not 4-wire).
3. 120 Ω termination ON if the converter is at the bus end.
4. Bias ON if the converter is the only device on the segment (or no slave provides bias).

LED mapping (typical Phoenix Contact, B&B, Advantech, Antaira converter family):

Modbus TCP Timeout Special Case

On Modbus TCP the same "timeout" symptom often comes from the slave or gateway closing an idle TCP socket. HMS Networks documents this on the Anybus Communicator Modbus TCP server KB as a configurable keep-alive / idle-close window. A common default is 10 s, so if the master polls slower than 10 s the next poll will hit a fresh TCP handshake and appear as a 1-2 s timeout.

Remedies:

• Reduce master poll interval to ≤ 5 s.
• Enable TCP keep-alive (5 s interval, 3 retries) on the master socket.
• Disable idle-close on the slave/gateway where supported.

Step-by-Step Diagnostic Procedure

1. Confirm power and bus integrity. Measure the converter supply (typically 5 V DC or 10–30 V DC depending on model) and verify a green power LED. Resolve any red fault LED first.
2. Eliminate the PC/PC software from the equation. Loop back the converter on the bench: TX+ to RX+ and TX− to RX− on the same converter, with 120 Ω termination. Run a Modbus master (e.g., Modbus Poll) against a known-good slave simulator (e.g., Modbus Slave by WinTech) on the same PC over a virtual COM port. If this works, the wiring is the next suspect.
3. Verify physical wiring to the slave. Use a multimeter in continuity mode from the converter's D+/D− to the slave's A/B terminals. Confirm shield is grounded at one end only.
4. Verify A/B polarity. If the activity LED blinks green but no Modbus response is received, swap D+ and D−. Watch the amber LED — a steady amber often indicates reversed polarity on some converter families.
5. Disable hardware flow control. On both the master (Modscan/Modbus Poll/SCADA) and the converter, set flow control to None. Do not short RTS to RTS.
6. Match serial parameters. 9600 8N1 vs 9600 8E1 vs 19200 8N1 are three different buses. Confirm baud, data bits, parity, and stop bits on every device on the bus, including the S7-200 System Block.
7. Confirm slave address. Read the slave's address DIP switch or configuration register. The Modbus RTU address range is 1–247; 0 is broadcast and is never acknowledged — broadcast requests will always timeout.
8. Try a different function code. Use FC03 (Read Holding Registers) at register 0x0000, quantity 1. This is the most widely supported register type and almost never restricted by the slave firmware.
9. Capture the bus. Place an RS-485 tap or use the converter's monitor (echo) mode with a USB logic analyzer or Wireshark-compatible serial sniffer. Decode the Modbus frame to confirm the master is actually transmitting the slave address you think it is.
10. Capture the response. If the master transmits and the slave never replies, the fault is on the slave side: power, address, firmware, or a slave already in a "listen-only" / fault state.

Verification

A timeout is considered resolved only when the following are all true:

1. The S7-200 MBUS_CTRL Done flag goes true within 1 poll cycle and Error = 0.
2. The MBUS_MSG Done flag goes true within the configured timeout window and Error = 0.
3. The holding register read in the verification step matches the expected value (write a known value with the slave's configuration tool, then read it back from the PLC).
4. Repeat the poll for 100 consecutive cycles with zero timeouts. Long-run soak testing catches intermittent termination or bias issues that a single pass misses.
5. Re-introduce a poll interval of 5 minutes (or the production rate) and confirm no timeout occurs when the bus is briefly idle — this catches the Modbus TCP idle-close case.

Common Slave-Side Causes

Once the master and wiring are proven, the timeout is almost always on the slave:

• Slave is in a fault state and its Modbus stack is suspended (look for alarm LED on the slave device).
• Slave address has been changed by a previous configuration tool and no longer matches the project.
• Slave is on a different bus segment behind a repeater that is not powered.
• Slave is configured for ASCII when the master is RTU (or vice versa).
• Slave requires a "wake-up" or unlock sequence before responding to general polls (rare, but seen on some Despatch Protocol 3 controllers and similar PID controllers).

Safety and Field Notes

• Never hot-plug RS-485 while the bus is active on a non-isolated converter. Differential transients can latch the transceiver; the bus will appear to time out until power is cycled.
• When commissioning, start at the lowest supported baud (1200 or 9600) and step up. A marginal cable that works at 9600 often fails at 115200 with intermittent timeouts that look like slave faults.
• Isolated converters (e.g., Advantech ADAM-4520, Phoenix Contact MINI MCR) survive ground potential differences of up to 1 kV. Non-isolated adapters (generic B&B/EL-USB types) do not. Field cabinets with VFDs or motors on the same ground bus benefit from isolation.