Troubleshooting S7-1200 Modbus RS-485 Communication in TIA Portal

1. Problem Definition: S7-1200 Modbus RTU over RS-485 Not Responding

The reported symptom is a Siemens SIMATIC S7-1200 CPU connected to a host PC running Modbus Poll (or any Modbus master) through the PLC's onboard RS-485 port (via a CB 1241 RS-485 or CM 1241 RS-485 communication module), with a passive RS-485 to RS-232 converter on the PC side. The slave side (the S7-1200) has been configured with the TIA Portal libraries MODBUS_MASTER and MOD_SLAVE, yet no coherent data is being read into the slave holding registers. The PC side either returns Illegal Function (01), Illegal Data Address (02), or shows timeout/exceptions.

This reference consolidates the wiring, parameterization, instruction configuration, and diagnostic checks required to bring up a clean Modbus RTU link between an S7-1200 and a PC-based master.

2. Supported S7-1200 RS-485 Hardware

Two hardware paths exist for RS-485 on the S7-1200 platform. Choose the one matching your installed catalog number before configuring software.

The CPU's RS-485 port is not isolated on the CB 1241; the CM 1241 module is isolated. For noisy industrial environments, prefer the CM 1241. Refer to the S7-1200 Programmable Controller System Manual for the official pinout and isolation class.

3. RS-485 Electrical Characteristics and Termination

RS-485 is a 2-wire (half-duplex) differential bus. The S7-1200 module exposes three terminals on the front connector: T/R+ (Data+), T/R- (Data-), and GND (common reference). The shield is connected to the module's shield clamp.

• Cable: Use a twisted-pair, shielded cable such as Belden 3106A or LAPP EIB 2x2x0.8. The shield must be bonded at one end only to avoid ground loops.
• Termination: 120 Ω across T/R+ and T/R- at each physical end of the bus. The CB 1241 RS-485 and CM 1241 RS-485 expose a built-in 120 Ω resistor selectable via a switch/parameter on the device configuration.
• Fail-safe bias: On long runs add 680 Ω pull-up to +5 V and 680 Ω pull-down to GND on one node only, so the line idles in a defined MARK state. The CM 1241 RS-485 does not include internal bias; external resistors are required.

4. RS-485 to RS-232 Converter Pitfalls

Passive converters (e.g., generic CH340/MAX485 boards sold for < $10) frequently introduce the following problems on the S7-1200 side:

1. Auto-direction jitter: Cheap converters switch the driver with a debounce of 1-2 ms. Modbus RTU 3.5 character times at 9600 baud is only ~4 ms, so a half-duplex turnaround can drop the last byte. Use a converter with hardware flow control or an external DE/RE pin tied to RTS.
2. No fail-safe bias: If neither the S7-1200 nor the PC provides bias, the bus idles in an undefined state and the PLC's UART interprets noise as the start bit. Confirm bias by measuring T/R+ to T/R- with a scope: idle voltage should be > 200 mV (logic 1).
3. Ground reference missing: Some converters are isolated, others are not. If the converter is not isolated, you must run a GND wire between the PLC and the converter; otherwise the receivers see the wrong common-mode voltage.
4. Wrong polarity: Verify T/R+ on the PLC maps to D+ (or A) on the converter, and T/R- to D- (or B). Reversing polarity is the single most common cause of CRC Error storms on the master.

For production setups use an industrial-grade converter such as the Moxa TCC-80 or Advantech ADAM-4520; these have galvanic isolation and reliable auto-direction logic.

5. TIA Portal Prerequisites

Before configuring the instructions, verify the engineering environment.

• TIA Portal: V15.1, V16, V17, or V18 with HSP matching the CPU.
• CPU firmware: V4.2 or higher is required for the modern MODBUS_MASTER V4 block. CPUs with firmware V4.0 to V4.1 must use the legacy V3 instruction.
• Library: Install "MODBUS TCP" package from Siemens — the RTU instruction is bundled in the "Point-to-Point (PtP) Communication" library distributed with TIA Portal.

6. Device Configuration: Communication Module Properties

Open Device > Properties > RS-485 interface and apply the following values to match the master exactly.

7. MODBUS_MASTER Instruction (S7-1200 as Master to PC)

When the S7-1200 is acting as a master (typical for retrieving data from a 3WL breaker or third-party device), insert the MODBUS_MASTER block from Libraries > Communication > MODBUS. The key input pins are:

REG_DB    := "ModbusData".HoldingRegisters  // background DB of type MODBUS_MASTER_REG
REQ       := %M0.0                          // rising edge triggers one transaction
MB_ADDR   := 1                              // slave address 1-247
MODE      := 0                              // 0=Read, 1=Write, 2=Read/Write single
DATA_ADDR := 40001                          // Modbus address (1-based)
DATA_LEN  := 10                             // number of words
DONE      := %M10.0
ERROR     := %M10.1
STATUS    := %MW12                          // 16-bit status code

Note that DATA_ADDR is 1-based for Modbus, but the REG_DB mapping inside the instruction uses 0-based offset. For example, requesting Modbus register 40001 with length 10 will populate HoldingRegisters[0..9] in the register DB.

8. MOD_SLAVE Instruction (S7-1200 as Slave to Modbus Poll)

When the PC (Modbus Poll) is the master and the S7-1200 is the slave, use the MOD_SLAVE block:

REG_DB    := "ModbusData".HoldingRegisters
MB_ADDR   := 1                              // slave ID; must match Poll setup
NDR       := %M20.0
DR        := %M20.1
ERROR     := %M20.2
STATUS    := %MW22

Place MOD_SLAVE in a cyclic OB (OB1) and call it on every scan. The instruction consumes one instance DB. Confirm that the REG_DB is created automatically as a global DB of type MODBUS_SLAVE_REG with arrays for holding, input, and coil registers.

9. Addressing and Register Numbering

Modbus Poll uses 1-based human addresses (40001 = first holding register). The S7-1200's MOD_SLAVE register DB uses 0-based array indices. The mapping is therefore:

If the REG_DB arrays are not sized large enough to cover the master's read range, the slave returns Modbus exception code 0x02 Illegal Data Address. This is a frequent cause of "not getting proper results" on the PC side.

10. Common STATUS / Error Codes

The STATUS output of the Modbus instructions gives a hex code. The most relevant values per the Siemens system manual are:

For the complete list, see the S7-1200 System Manual, Section on Modbus STATUS codes and the MODBUS_MASTER example project FAQ.

11. Slave Exception Codes Returned by MODBUS_MASTER

When the master reports an exception (e.g., 0x83 = exception of FC 0x03), the high byte of STATUS contains 0x80E0 and the low byte holds the slave's exception code:

12. Diagnostic Procedure (Step-by-Step)

1. Confirm the wiring. With a multimeter, measure DC voltage between T/R+ and T/R- with the bus idle. Expect +200 mV to +5 V. Reading 0 V indicates missing bias.
2. Loopback test on the converter. Short T/R+ to T/R- at the converter input and verify the PC's COM port sees echo (e.g., a terminal application). This isolates the PC side from the PLC.
3. Loopback test on the PLC module. Configure the RS-485 port in TIA Portal as a freeport user, send a known string, and have the same module echo it back with terminators shorted. This isolates the PLC side.
4. Match parameters. Open Modbus Poll, choose Connection > Connection Setup. Verify the COM port number, baud rate, parity, and slave ID match the PLC exactly. A common slip is Modbus Poll set to 8E1 while the PLC is set to 8N2.
5. Set a small DATA_LEN. Read just one word from holding register 40001 to confirm framing. Only after this works should you extend to multi-word or multi-register requests.
6. Trigger REQ on a 1-second pulse generator. Reading the data from the buffer too often causes collision on the half-duplex bus; reading too slowly hides the problem. A 1 Hz pulse is ideal for bench debugging.
7. Watch STATUS live. In TIA Portal, place the STATUS value on a watch table and observe the hex code changing after each request.
8. Monitor electrical noise. On an oscilloscope, capture T/R+ to T/R- during the request. The waveform should rise cleanly to 1.5-5 V and fall below 0.2 V. Ringing or slope issues indicate termination or bias problems.

13. Verification Checklist

• [ ] Modbus Poll displays the same integer values that the PLC program writes to the HoldingRegisters array.
• [ ] DONE pulses on the master instruction each transaction.
• [ ] ERROR remains FALSE.
• [ ] STATUS returns to 0x0000 or 0x7000 after each request.
• [ ] Disconnecting the cable or stopping the CPU causes the master to time out within the configured response timeout (default 2 s in Modbus Poll).
• [ ] For multi-drop, disconnecting one slave does not collapse the bus signal for the others.

14. Field-Proven Tips

• Match parity before matching baud. Parity mismatches raise 0x80D1; baud mismatches raise 0x80C8. The error code tells you which side to fix first.
• Prefer Modbus RTU 19200 8E1 for bench work. It is the most common factory default on third-party devices and the easiest to debug.
• Place the slave address function on a single background DB. Sharing a DB between MOD_SLAVE and the application logic avoids race conditions where the application writes to the array while the master is reading.
• Use the diagnostic trace on TIA Portal: Right-click the CPU → Online & Diagnostics > Diagnostics buffer. Modbus-related events are logged with their STATUS code and the buffer instance DB number.
• When in doubt, measure the A-B idle voltage. > 200 mV means the bus is biased correctly. < 50 mV means the bus is floating — guarantee of erratic behaviour.