Troubleshooting Siemens CP441-2 Modbus RTU Communication Drop

Problem Overview

The Siemens CP 441-2 communication module (order number 6ES7 441-2AA0x-0AE0) is widely deployed in S7-300 and S7-400 automation cells as a Modbus RTU master or slave over RS-232C, TTY (20 mA), or RS-485 (2-wire / 4-wire). A particularly stubborn failure mode surfaces when the 24 V supply of a downstream Modbus slave island is cycled: even after the slave power returns to nominal, the CP 441-2 holds its serial port in a latched fault state. SFB12 BSEND (or SFB13 BRECV for receive) returns ERROR = TRUE with STATUS = W#16#0002 (job rejected because the previous job is still active) or STATUS = W#16#0013 (decimal 19, communication error in the loadable driver). The green TxD / RxD LEDs on the front of the module stay dark, a PLC STOP -> RUN transition does not recover the link, and the only reliable recovery is a hard power reset of the PLC rack (PS 307 / PS 405 power off, hold, restore).

This article decomposes the failure, walks through the official Siemens diagnostic procedure, and presents a tiered recovery strategy that escalates from a soft CP reset to a full power cycle, including a resilient OB1 call pattern that prevents the latched state in the first place.

CP 441-2 Hardware and Modbus RTU Architecture

The CP 441-2 is a plug-in point-to-point module that occupies one slot in the S7-300 or S7-400 central/expansion rack. It contains a protocol processor that offloads the serial frame handling from the CPU. Modbus RTU is not in firmware; it is delivered as a loadable driver that must be assigned to the interface (IF1 or IF2) using HW Config and STEP 7 / TIA Portal.

Modbus RTU on the CP 441-2 is implemented through the parameterized loadable driver "Modbus Master RTU" or "Modbus Slave RTU" selected in Properties > CP 441-2 > Parameter Assignment > Protocol. The driver handles framing (3.5-character silent interval, CRC-16), inter-frame timeout, broadcast suppression, and turn-around delay.

SFB12 / SFB13 Error Code Reference

The CP 441-2 communicates job results to the user program through SFB12 BSEND (send), SFB13 BRECV (receive), SFB14 GET, and SFB15 PUT. The relevant error codes for a "silent" RS-485 port are tabulated below; all values are returned in STATUS as WORD with the schema WWXX where WW is the class and XX is the detail. Hex codes use the W#16# prefix.

Root Cause Analysis

The CP 441-2 silicon implements the Modbus RTU state machine in a loadable driver stored on the CP's flash. The driver is bound to the interface at startup. When the RS-485 differential pair is left floating (slave PS removed) the receiver sees continuous noise. The Modbus RTU driver interprets the lack of a valid frame within its response timeout window (default 2000 ms in STEP 7 / TIA Portal) as a line error. After a configurable number of consecutive failures the driver enters a hard fault state, de-asserts the TxD enable, and refuses further SFB12 jobs.

Three concurrent conditions cause the latched fault:

1. RS-485 bias and termination not present - without a fail-safe bias resistor network (typically 680 ohm pull-up to +5 V and pull-down to GND on the CP side, or integrated in the slave) the line idles to an indeterminate state. During a slave PS cycle the noise floor pushes the UART into constant BREAK detection.
2. Response timeout too short for the cold-start slave - many Modbus slaves take 1-3 seconds to boot, complete self-test, and present valid registers. If the master queries before this window expires, every poll fails and the driver escalates to a hard fault.
3. No inter-job guard in OB1 - calling SFB12 every PLC cycle with a rising-edge trigger is correct, but a re-trigger while the previous job is in the "fault" state will simply generate STATUS = W#16#0002 forever, masking the underlying driver fault and preventing the CP from auto-recovering.

The reason a full power cycle restores the link while a STOP/RUN does not is the CP 441-2's CP-STOP state. STOP/RUN of the CPU issues a partial restart of the CP's host interface but does not reload the loadable driver; only a power-down resets the protocol processor. To reset the CP without dropping the whole PLC, use the CP-STOP / CP-RUN switch accessible in STEP 7 / TIA Portal.

Diagnostic Buffer and Status Evaluation

Before any reset, capture the diagnostic buffer of the CP 441-2. In STEP 7 V5.x open SIMATIC Manager > PLC > CP 441-2 > Diagnostic Buffer. In TIA Portal open the device view of the CP and select Online & Diagnostics > Diagnostic buffer. The buffer entries are timestamped OB events posted by the CP firmware; typical entries for the present fault are:

If the buffer shows 0x1371 "too many timeouts" followed by silence, the loadable driver has latched. SFB12 requests will continue to return STATUS = W#16#0002 until the CP processor is reset.

Reset Procedures Hierarchy

Escalate through the four methods in order. Each step is less invasive than the next. Stop only when communication resumes, and capture the diagnostic buffer at each successful level to identify the lowest-impact fix.

Method 1 - CP-STOP / CP-RUN Toggle (Soft Reset, No PLC Downtime)

1. Open TIA Portal or STEP 7 with the project online.
2. In the device tree, right-click the CP 441-2 and select Online & Diagnostics.
3. Open the Operating Mode panel.
4. Click STOP. Wait for the CP's SF / BF LEDs to indicate STOP state (BF may blink red).
5. Wait 5 seconds. This allows the loadable driver to release the RS-485 transmitter.
6. Click RUN. The CP reloads the driver and re-initializes the serial engine.
7. Monitor SFB12 STATUS. A successful reset returns STATUS = W#16#0000 within 1-2 seconds of the first job.

Method 2 - Re-Trigger with Inter-Job Guard

If the soft reset does not clear the latch, the driver may be re-entering fault on the first poll. Implement the OB1 pattern in Section 9 to suppress the trigger for at least 3 seconds after a fault is observed, allowing the driver to complete its internal recovery sequence.

Method 3 - Re-Download the Loadable Driver

1. Open HW Config and select the CP 441-2.
2. Open Properties > Parameter Assignment > Protocol.
3. Change the protocol assignment for the affected interface (IF1 or IF2) to a different value (e.g. ASCII), download, then change it back to "Modbus Master RTU" or "Modbus Slave RTU".
4. Re-download the HW Config. The CP will unload and re-load the driver, equivalent to Method 1 plus driver re-initialization.

Method 4 - Hard Power Cycle (Last Resort)

1. Bring the CPU to STOP (do not restart yet).
2. Power down the PLC power supply (PS 307 / PS 405). Confirm 24 V indicator OFF.
3. Wait a minimum of 30 seconds to allow the CP's bulk capacitors to discharge below the brown-out threshold.
4. Restore 24 V to the PS module. Power-on sequence runs; CP reloads driver.
5. Bring the CPU to RUN. Verify the first SFB12 job returns STATUS = W#16#0000.

RS-485 Physical Layer Requirements

The single most common root cause for a CP 441-2 latching into fault after a slave PS cycle is improper RS-485 termination and bias. The Modbus over Serial Line specification (see the official Modbus Organization implementation guide) requires:

• Termination: 120 ohm resistor between D1 (A) and D0 (B) at both ends of the trunk. The CP 441-2 sub-D pin 1 / pin 2 are the termination-pad pair; place a 120 ohm across them and switch in the on-board termination if the CP variant supports it.
• Fail-safe bias: pull-up on D1 to +5 V (or 3.3 V on newer variants) through 680 ohm and pull-down on D0 to GND through 680 ohm. This pulls the line to a defined "mark" state when no driver is active, preventing the receiver from noise-triggering.
• Maximum stubs: stub length from trunk to slave must be < 1/10 of the trunk length; for 19200 baud on 24 AWG twisted pair this typically caps at ~30 cm stubs.
• Cable shield: ground the shield at one end only (typically the CP side) to avoid ground loops.
• Baud rate: 19200 baud or 9600 baud is the Modbus RTU sweet spot. The CP 441-2 supports up to 38400, but higher rates shorten the maximum cable length and reduce noise immunity.

Verify these in the field with an ohmmeter across D1-D0 with the PS off: 60 ohms indicates both terminators present and working; 120 ohms indicates one terminator; open circuit indicates no termination. Bias resistors add parallel paths and reduce this reading; isolate them when measuring.

CP 441-2 Loadable Driver and Firmware

Siemens has revised the Modbus RTU loadable driver several times to address stability issues. The driver is selected in HW Config by name ("Modbus Master RTU" or "Modbus Slave RTU") and downloaded with the HW configuration; the actual firmware revision is stored on the CP and is reported in the diagnostic buffer at startup. The official Siemens Industry Online Support entry "Modbus communication (S7-300, S7-400)" lists the supported CP variants and the function codes (01, 02, 03, 04, 05, 06, 15, 16) supported in master mode, as well as the slave variant (CP 441-2 (S7-300, S7-400) - Modbus master (RTU)).

To update the firmware, open TIA Portal or STEP 7, connect online, navigate to the CP, and select Online & Diagnostics > Firmware Update. A typical update takes 3-5 minutes and the CP will reboot. Always update both the CP firmware and the Modbus loadable driver together.

PLC Program Structure for Resilient Communication

Implement an OB1 call pattern that prevents the CP from re-entering fault on a single transient. The pattern enforces a one-job-at-a-time discipline with a configurable cool-down after errors.

Structured Text (SCL) Implementation

FUNCTION_BLOCK FB_ModbusMaster
VAR
    bTrigger     : BOOL;        // rising edge from sequencer
    bBusy        : BOOL;
    bError       : BOOL;
    wStatus      : WORD;
    tRetryTimer  : TON;          // cool-down after error
    tRetryPreset : TIME := T#3S; // 3-second cool-down
    iInstance_DB : INT := 12;    // instance DB number for SFB12 call
END_VAR

// Trigger guard - block re-trigger while busy or in cool-down
IF NOT bBusy AND NOT tRetryTimer.Q AND bTrigger THEN
    bBusy  := TRUE;
    bError := FALSE;
    wStatus := 0;
    SFB12_DB.SEND := TRUE;       // set REQ on SFB12 instance
END_IF;

// Call SFB12 BSEND
SFB12(REQ := SFB12_DB.SEND,
      R   := FALSE,
      ID  := 1,                  // connection ID 1 = IF1 Modbus Master
      R_ID:= 0,
      DONE:= SFB12_DB.DONE,
      ERROR:= SFB12_DB.ERROR,
      STATUS:= SFB12_DB.STATUS,
      SD_1 := P#DB100.DBX0.0 BYTE 32);  // any-pointer to send data

// On completion, clear REQ, evaluate status, start cool-down on error
IF SFB12_DB.DONE OR SFB12_DB.ERROR THEN
    SFB12_DB.SEND := FALSE;
    bBusy := FALSE;
    IF SFB12_DB.ERROR THEN
        wStatus := SFB12_DB.STATUS;
        bError  := TRUE;
        tRetryTimer(IN := TRUE, PT := tRetryPreset);  // start cool-down
    ELSE
        bError := FALSE;
        tRetryTimer(IN := FALSE);
    END_IF;
END_IF;

// Cool-down timer
tRetryTimer(IN := bError AND tRetryTimer.Q = FALSE,
            PT := tRetryPreset);
IF tRetryTimer.Q THEN
    bError := FALSE;             // re-arm trigger after cool-down
END_IF;

Ladder Logic Equivalent

Network 1: Trigger guard
   |    NOT bBusy            NOT tRetryTimer.Q     bTrigger   |
---|------|/|------------------|/|--------------------( )-------|

Network 2: Reset SFB12 REQ on DONE or ERROR
   |    SFB12_DB.DONE            SFB12_DB.ERROR            |
---|------| |----------------------| |----- ( SFB12_DB.SEND )-|

Network 3: Start cool-down on error
   |    SFB12_DB.ERROR                                     |
---|------| |------------------( tRetryTimer, IN := TRUE )--|

Network 4: Re-arm after cool-down
   |    tRetryTimer.Q                                      |
---|------| |--------------------( bError := FALSE )--------|

Verification and Commissioning Checklist

After any of the reset methods above, perform the following verification before returning the system to production:

1. Driver load event: Confirm diagnostic buffer event 0x1370 "Driver loaded" appears after the reset.
2. First job success: Force a single read of holding registers (function code 03) and confirm STATUS = W#16#0000 and the response data is valid.
3. Loop test: Run 100 read polls back-to-back at the configured poll interval. Confirm zero error counts on the CP diagnostic counters.
4. Cold start test: Power-cycle the slave island while the CP 441-2 is in steady-state polling. The driver should log a single timeout, but the cool-down should prevent re-entry to the fault latch. Verify SFB12 recovers within 5 seconds of slave PS restoration.
5. Hot swap test: Replace a single slave module on the bus. Confirm the CP does not latch; the new slave should be polled successfully on the next cycle.
6. Bias / termination check: With the bus powered, measure voltage on D1 and D0 referenced to signal ground. D1 should be 0.2-0.5 V higher than D0 in idle state (mark). Reversed polarity indicates mis-wired bias.

Troubleshooting Matrix

Related Siemens Documentation

For deeper study of the CP 441-2 in S7-300 and S7-400 systems, the official TIA documentation portal hosts the configuration and parameterization manual: CP 441-2 (S7-300, S7-400) - Modbus master (RTU). The same portal documents Modbus function codes 01 (Read Output Coils), 02 (Read Input Coils), 03 (Read Holding Registers), 04 (Read Input Registers), 05 (Write Single Coil), 06 (Write Single Register), 15 (Write Multiple Coils), and 16 (Write Multiple Registers) for the CP 441-2 master. Always cross-reference the relevant SFB status codes against the most recent STEP 7 or TIA Portal help file for the firmware revision in use.