Complete detailed description of Modbus (RTU) for Siemens 1200 PLC

Modbus has two serial transmission modes: ASCII and RTU. Modbus is a master-slave communication mode with a single master station. Only one master station can exist on the Modbus network, and the master station does not have an address on the Modbus network. Each slave station must have a unique address, with the address range of 0 - 247, where 0 is the broadcast address, and the actual address range of slave stations is 1 - 247. Modbus RTU communication performs data transmission in a master-slave manner. During transmission, the Modbus RTU master station is the initiator, that is, the master station sends data request messages to the slave stations, and the Modbus RTU slave stations return response messages. The following modules of S7-1200 support Modbus RTU communication:

Communication module/communication board	Order number
CM1241 RS232	6ES7 241-1AH32-0XB0
CM1241 RS485	6ES7 241-1CH30-0XB0
CM1241 RS422/485	6ES7 241-1CH32-0XB0
CB 1241 RS485	6ES7 241-1CH30-1XB0

Note 1. When using the communication module CM 1241 RS232 as a Modbus RTU master, it can only communicate with one slave. 2. When using the communication module CM 1241 RS485 as a Modbus RTU master, it is allowed to establish communication with up to 32 slaves. 3. When using the communication board CB 1241 RS485, the CPU firmware must be V2.0 or higher, and the software used must be STEP 7 Basic V11 or STEP 7 Professional V11 or higher. With the continuous updates of TIA PORTAL software and S7-1200 CPU firmware, different versions of S7-1200 Modbus RTU instructions have emerged. Users need to correctly select and use the appropriate S7-1200 Modbus RTU instructions according to the software and hardware being used to implement Modbus RTU communication. The software, hardware requirements, and instruction version descriptions are as follows. S7-1200 Modbus RTU instructions in STEP 7 V11 software Starting from STEP 7 V11 version, the "MB_COMM_LOAD" and "MB_MASTER" or "MB_SLAVE" instructions can be directly called from "Instructions" → "Communication Processor" → "MODBUS", as shown in Figure 1 below: Figure 1 Modbus RTU instructions There are two versions of Modbus RTU instructions: V1 and V2. Version V1 was initially provided in STEP 7 Basic V10.5; version V2 is provided in STEP 7 Basic/Professional V11. S7-1200 Modbus RTU instructions in STEP 7 V13 SP1 software The TIA V13 SP1 software version provides two versions of Modbus RTU instructions. As shown in Figure 2 below: The early version of Modbus RTU instructions (MODBUS (V2.2) in Figure 2) can only perform Modbus RTU communication through the CM1241 communication module or CB1241 communication board. The new version of Modbus RTU instructions (MODBUS(RTU) V3.0 in Figure 2) extends the functionality of Modbus RTU. In addition to supporting the CM1241 communication module and CB1241 communication board, this instruction also supports Modbus RTU communication through the PTP communication module on a PROFINET or PROFIBUS distributed I/O rack. Note: Restrictions on the use of the new version of Modbus RTU instructions When using the new version of Modbus RTU instructions for Modbus RTU communication through the CM1241 communication module or CB1241 communication board, the following conditions must be met: a. The firmware version of the S7-1200 CPU must not be lower than V4.1; b. The CM1241 communication module must be V2.1 or above, or the CB1241. Figure 2. Two versions of Modbus RTU instructions Common problems   1. Siemens does not provide ready-made instructions that support MODBUS-ASCII communication mode, requiring users to program in free port mode.   2. The Modbus RTU instruction version V2 adds the parameters "REQ" and "DONE" to the "MB_COMM_LOAD" instruction. Furthermore, the "MB_ADDR" parameter of the "MB_MASTER" and "MB_SLAVE" instructions now allows a UInt value for extended addressing.   3. It is not possible to use both V1 (V1.x) and V2 (V2.y) instruction versions simultaneously in the same CPU program. The Modbus instructions in the user program must have the same major version number; individual instructions within the major version group can have different minor version numbers.   4. Configure and program the S7-1200 communication module CM1241 to call the "MB_COMM_LOAD" instruction, which can be set to Modbus RTU communication mode. By programming and calling the "MB_MASTER" instruction, the S7-1200 communication module CM1241 can act as a Modbus RTU master station, or by calling the "MB_SLAVE" instruction, the S7-1200 communication module CM1241 can act as a Modbus RTU slave station.   5. Whether the S7-1200 communication module CM1241 functions as a Modbus RTU master or slave, it is necessary to utilize the "MB_COMM_LOAD" instruction for programming.   6. The S7-1200 CM1241/CB1241 Modbus RTU communication supports two stop bits. The stop bits can be set in the properties of the S7-1200 CM1241/CB1241, but when this module is used for Modbus communication, the set stop bits are invalid. It is necessary to modify the STOP_BITS value to 2 statically in the background DB of the Modbus_Commload instruction. As shown in Figures 3 and 4 below: Figure 3. CM1241 configuration stop bit parameter The Static modification of the STOP_BITS value to 2 (default=1) in the background DB of the Modbus_Commload instruction Figure 4. Modifying the Modbus RTU communication stop bits Introduction to the new version of Modbus RTU instructions The TIA V13 SP1 version of software provides two versions of Modbus RTU instructions: Figure 1. Two versions of Modbus RTU instructions The early version of the Modbus RTU instructions (MODBUS (V2.2) in Figure 1) can only perform Modbus RTU communication through the CM1241 communication module or CB1241 communication board. The new version of the Modbus RTU instructions (MODBUS(RTU) V3.0 in Figure 1) expands the functionality of Modbus RTU. In addition to supporting the CM1241 communication module and CB1241 communication board, this instruction also supports PTP communication modules on PROFINET or PROFIBUS distributed I/O racks for Modbus RTU communication. The PTP modules supported by the new version of the Modbus RTU instructions are shown in Figure 2 below: Figure 2. PTP modules supported by the new version of Modbus RTU instructions Usage of the new version of Modbus RTU instructions The new version of the Modbus RTU instructions includes both Modbus RTU master and slave instructions. This article takes the CPU1217C+CM1241 RS422/485+ET200SP CM PTP module as an example to introduce the programming steps for master-slave communication using the new version of the Modbus RTU instructions. In this configuration, the CPU rack CM1241 RS422/485 serves as the Modbus RTU slave, and the CMPTP module in the distributed rack ET200SP serves as the Modbus RTU master. The network structure diagram is as follows: Figure 3. Modbus RTU network communication structure diagram The hardware and software used are as follows: Hardware: ① CPU1217C (order number: 6ES7 217-1AG40-0XB0), firmware version V4.1.3 ② CM1241 RS422/485 module (order number: 6ES7 241-1CH32-0XB0), firmware version V2.1 ③ 24V power supply PS307 (order number: 6ES7307-1KA02-0AA0) ④ ET200 SP IM155-6PN HF (order number: 6ES7155-6AU00-0CN0) ⑤ CM PTP module (order number: 6ES7137-6AA00-0BA0) Software: ① TIA V13 SP1 UP 9 I. Device Configuration 1 Configure the CM1241 RS422/485 module Open the device view, add the S7-1200 CPU, and navigate to the "Communication Modules" → "Point-to-Point" → "CM1241 (RS422/485)" in the hardware directory. Drag this module to the left side of the CPU, as shown in Figure 4 below: Figure 4. Add CM 1241 RS422/485 module Note: Only CM 1241 RS422/485 modules with firmware version >= V2.1 support the new version of Modbus RTU instructions. Next, select the CM1241 (RS422/485) module in the "Device View" and configure the hardware interface parameters of this module in "Properties" → "Port Configuration". In this example, the transmission rate is set to 9.6Kbps, parity is set to "No Parity", data bits are set to "8-bit characters", and stop bits are set to "1". Figure 5. Port configuration of CM1241 RS422/485 module Finally, confirm that the hardware identifier is 269 in the "Hardware Identifier" section (this parameter will be used in program programming), as shown in Figure 6 below: Figure 6. Hardware Identifier In addition, S7-1200 also provides system and clock memory functions. To facilitate subsequent instructions, it is recommended to enable this function. Enable the system and clock memory functions in the CPU "Properties" → "General" → "System and Clock Memory", as shown in Figure 7. Figure 7. System and Clock Memory Functions 2 Configuring ET200 SP CM PtP Module a. Insert an ET200SP Distributed Station. Open the Network View and drag in an ET200SP Station, assigning it to the corresponding IO Controller (in this example, CPU1217C is the IO Controller), as shown in Figure 8. Figure 8. Inserting ET200SP Station b. Configure ET200SP Station. In the "Device View" environment of ET200SP, add signal, communication, and server modules to the ET200SP Station. In this example, only the CM PTP Module and server module are added. Note: The server module must be configured in the ET200SP Station. The server module is purchased together with the interface module and does not need to be purchased separately. The ET200SP Interface Module requires an IP address and Device Name to be assigned. For detailed steps on configuring the ET200 SP Distributed IO, please refer to the "Quick Start Guide for ET200 SP". Download link for "Quick Start Guide for ET200 SP": https://support.industry.siemens.com/cs/cn/zh/view/78304711 In the ET200SP "Device View", select CM PTP with the mouse, and configure the hardware interface parameters of this module in "Properties" → "General" → "Interfaces" → "Operation Mode". In this example, set the "Specified Operating Mode" to "Half-Duplex (RS485) 2-Wire Operation" and "Initial State of Receiving Line" to "None". As shown in Figure 9 below: Figure 9. CM PTP Operation Mode Next, configure the port configuration parameters of this module in "Properties" → "General" → "Interfaces" → "Port Configuration". In this example, set the "Protocol" to "Freeport/Modbus"; Figure 10. CM PTP Port Configuration Finally, it is necessary to confirm the hardware identifier of the CM PTP module in the "Hardware Identifier" section, as this parameter will be used in program programming. II. Software Programming 1 Modbus RTU Master Programming Modbus RTU master programming requires the use of the Modbus_Comm_Load and Modbus_Master instructions. The Modbus_Comm_Load instruction configures the communication module through the Modbus RTU protocol, while the Modbus_Master instruction can communicate as a Modbus master through the port configured by the Modbus_Comm_Load instruction. The MB_DB parameter of the Modbus_Comm_Load instruction must be connected to the (static) MB_DB parameter of the Modbus_Master instruction. In this example, the CM PTP module in the distributed rack ET200SP serves as a Modbus RTU master, and the relevant programming steps are as follows: a. Insert an FC function in OB1, and drag the Modbus_Comm_Load and Modbus_Master instructions into the function. As shown in Figure 11. Figure 11. Dragging Modbus RTU Master Instructions The parameters of the Modbus_Comm_Load instruction are described in Table 1 below:

Pin	Description
REQ	Rising Edge Trigger
PORT	Hardware Identifier of the Communication Port
BAUD	Baud Rate Selection: 3600, 6000, 12000, 2400, 4800, 9600, 19200, 38400, 57600, 76800, 115200
PARITY	Parity Selection: 0 - None; 1 - Odd Parity; 2 - Even Parity
FLOW_CTRL	Flow Control Selection: 0 - (Default) No Flow Control
RTS_ON_DLY	RTS Delay Selection: 0 - (Default)
RTS_OFF_DLY	RTS Off Delay Selection: 0 - (Default)
RESP_TO	Response Timeout: Default = 1000 ms. The time (in milliseconds) allowed by MB_MASTER for a slave to respond.
MB_DB	Reference to the background data block of a Modbus_Master or Modbus_Slave instruction. The MB_DB parameter must be connected to the static variable MB_DB parameter in the Modbus_Master or Modbus_Slave instruction.
DONE	If the previous request is completed without errors, the DONE bit will become TRUE and remain so for one cycle.
ERROR	If the previous request is completed with errors, the ERROR bit will become TRUE and remain so for one cycle. The error code in the STATUS parameter is only valid during the cycle when ERROR = TRUE.
STATUS	For port configuration error codes, please refer to the TIA software online help or the S7-1200 system manual.

Table 1: Meaning of MB_COMM_LOAD Instruction Parameters The meanings of the parameters for the Modbus_Master instruction are shown in Table 2 below:

Pin	Description
EN	Enable terminal
REQ	TRUE = Request to send data to a Modbus slave. It is recommended to use rising edge triggering.
MB_ADDR	Modbus RTU slave address. Default address range: 0 to 247; extended address range: 0 to 65535. The value 0 is reserved for broadcasting messages to all Modbus slaves.
MODE	Mode selection: Specify the request type (read or write).
DATA_ADDR	Starting Address in Slave: Specify the starting address of the data to be accessed in the Modbus slave.
DATA_LEN	Data Length: Specify the number of bits or words to be accessed in this request.
DATA_PTR	Data Pointer: Point to the tag or data block address for data writing or reading.
DONE	DONE Bit: After the previous request has been completed without error, the DONE bit will remain TRUE for one scan cycle time.
BUSY	FALSE – Modbus_Master has no active command: TRUE – Modbus_Master command is in execution
ERROR	Reference to the background data block of the Modbus_Master or Modbus_Slave instruction. The MB_DB parameter must be connected to the static variable MB_DB parameter in the Modbus_Master or Modbus_Slave instruction.
STATUS	If the previous request is completed without error, the DONE bit will become TRUE and remain TRUE for one cycle.
ERROR	If the previous request is completed with an error, the ERROR bit will become TRUE and remain TRUE for one cycle. The error code in the STATUS parameter is only valid during the cycle when ERROR = TRUE.
STATUS	Error Code

Table 2: Meaning of Modbus_Master Instruction Parameters Note ① The Modbus_Comm_Load instruction is not recommended to be called in the startup block OB100, and it is recommended to call it in OB1. When the Modbus_Comm_Load instruction is called in OB1, its input bit "REQ" needs to be triggered by a rising edge, and in this example, the input bit uses the "FirstScan" system memory bit. ② The static variable "MODE" in the background data block of the Modbus_Comm_Load instruction is used to describe the working mode of the PTP module, and the valid working modes include: · 0 = Full Duplex (RS232) · 1 = Full Duplex (RS422) Four-wire mode (Point-to-Point) · 2 = Full Duplex (RS 422) Four-wire mode (Multi-drop Master, CM PtP (ET 200SP)) · 3 = Full Duplex (RS 422) Four-wire mode (Multi-drop Slave, CM PtP (ET 200SP)) · 4 = Half Duplex (RS485) Two-wire mode The default value of this static variable "MODE" is 0 (RS232 Full Duplex mode), and it needs to be modified according to the actual configuration of the CM PTP module. In this example, the CM PTP module operates in RS485 Half Duplex mode, and the value needs to be modified to 4, as shown in Figure 12. Figure 12. Modify the static variable "MODE" in the Modbus_Comm_Load background data block to 4 ③ The "DATA_PTR" parameter of the Modbus_Master instruction is used to point to the address of the data area for data writing or reading. This data area supports optimized access data blocks or non-optimized (standard) data blocks, and it is recommended to use non-optimized access data blocks. Figure 13. Setting data blocks to non-optimized access When the "DATA_PTR" of the Modbus_Master instruction points to a data block that is not optimized for access, this input parameter needs to be filled in using a pointer method, such as P#DB3.DBX0.0 WORD 5. ④ When there are multiple Modbus RTU slaves in the Modbus RTU network or when a single Modbus RTU slave requires both read and write operations simultaneously, multiple Modbus_Master instructions need to be invoked, and the Modbus_Master instructions should be invoked using a polling method. Figure 14 below illustrates the polling method for invoking two Modbus_Master instructions. Figure 14. Modbus_Master Polling Call Mode b. Insert "Pull or plug of modules" to interrupt OB83. In this example, the Modbus RTU master module is installed on a distributed IO site, so the program needs to consider faults such as distributed IO site failures and module insertion/removal of the CM PTP module. When modules are plugged in or out of the distributed IO site, the operating system will call OB83 once. The faulty module and type can be determined through the input variable "16#Event_Class" in the OB83 interface area: event type 16#39 indicates module removal, and event type 16#38 indicates module insertion. When the CM PTP module is re-inserted, the Modbus_Comm_Load instruction needs to be called in interrupt OB83 to reconfigure the communication module, as shown in Figure 15. Figure 15. Re-calling Modbus_Comm_Load Instruction in OB83 Note ① The background data block for calling the Modbus_Comm_Load instruction in OB83 needs to be the same as the background data block for calling the Modbus_Comm_Load instruction in OB1. ② The hardware identifier of the CM PTP module can also be queried in "PLC Variables" ---> "System Constants", as shown in Figure 16. Figure 16. System Constants c. Insert "Rack or Station failure" to interrupt OB86. When the distributed IO site fails and recovers, the operating system will call OB86 once. The faulty module and type can be determined through the input variable "16#Event_Class" in the OB86 interface area: event type 16#39 indicates site failure, and event type 16#38 indicates site recovery. When the IO site where the CM PTP module is located recovers, the Modbus_Comm_Load instruction needs to be called in interrupt OB86 to reconfigure the communication module, as shown in Figure 17. Figure 17. Calling the Modbus_Comm_Load instruction in OB86 Attention ① The background data block for the Modbus_Comm_Load instruction called in OB86 must be the same as the background data block for the Modbus_Comm_Load instruction called in OB1. ② The hardware identifier of the distributed IO site can also be queried in "PLC Variables" ---> "System Constants". 2 Modbus RTU Slave Programming Modbus RTU Slave programming requires the use of the Modbus_Comm_Load and Modbus_Slave instructions. The Modbus_Comm_Load instruction configures the communication module via the Modbus RTU protocol, while the Modbus_Slave instruction enables communication as a Modbus slave through the port configured by the Modbus_Comm_Load instruction. The MB_DB parameter of the Modbus_Comm_Load instruction must be connected to the (static) MB_DB parameter of the Modbus_Slave instruction. In this example, the CPU rack CM1241 RS422/485 serves as a Modbus RTU slave, and the relevant programming steps are as follows: Insert an FC function in OB1, and drag the Modbus_Comm_Load and Modbus_Slave instructions into the function. As shown in Figure 18. Figure 18. Dragging the Modbus RTU Slave Instruction The parameters of the Modbus_Slave instruction are described in Table 3 below:

Pin	Description
MB_ADDR	Standard addressing for Modbus slaves: Standard addressing range (1 to 247) Extended addressing range (0 to 65535)
MB_HOLD_REG	Data pointer, pointing to the address of the Modbus hold register, which can be either the M memory area or the DB data area. If the Modbus hold register is in the DB data area, the DB data area supports optimized access data blocks or non-optimized access data blocks, and it is recommended to use non-optimized access data blocks.
NDR	Available new data: · FALSE - No new data · TRUE – Indicates that new data has been written by the Modbus master. If the previous request is completed without errors, the NDR bit will become TRUE and remain so for one cycle.
DR	Read data: · FALSE - No new data · TRUE – Indicates that the instruction has stored the data received by the Modbus master in the target area. If the previous request is completed without errors, the DR bit will become TRUE and remain so for one cycle.
ERROR	If the previous request is completed with errors, the ERROR bit will become TRUE and remain so for one cycle. If execution is terminated due to an error, the error code in the STATUS parameter is only valid during the period when ERROR = TRUE.
STATUS	Error code

Table 3: Meaning of Modbus_Slave instruction parameters Note ① The Modbus_Comm_Load instruction is not recommended to be called in the startup organization block OB100, and it is recommended to call it in OB1. When the Modbus_Comm_Load instruction is called in OB1, its input bit "REQ" needs to be triggered using a rising edge, and in this example, this input bit uses the "FirstScan" system memory bit. ② The static variable "MODE" in the background data block of the Modbus_Comm_Load instruction is used to describe the working mode of the PTP module, and the valid working modes include: · 0 = Full duplex (RS232) · 1 = Full-duplex (RS422) four-wire mode (point-to-point) · 2 = Full-duplex (RS422) four-wire mode (multi-drop master, CM PtP (ET 200SP)) · 3 = Full-duplex (RS422) four-wire mode (multi-drop slave, CM PtP (ET 200SP)) · 4 = Half-duplex (RS485) two-wire mode The default value of the static variable "MODE" is 0 (RS232 full-duplex mode), which needs to be modified according to the actual configuration of the CM1241 RS422/485 module. In this example, where the CM1241 RS422/485 module operates in RS485 half-duplex mode, the value needs to be changed to 4. Refer to Figure 12 for instructions on how to modify the "MODE" static variable. The "MB_HOLD_REG" of the Modbus_Slave instruction is used to point to the data area address of the Modbus hold register. This data area supports optimized access data blocks or non-optimized (standard) data blocks. It is recommended to use non-optimized access data blocks. In this example, the data area used is a non-optimized access data block, so this input parameter needs to be filled in using a pointer method, such as P#DB6.DBX0.0 WORD 100. Refer to Figure 13 for instructions on how to cancel "optimized block access" in the data block properties. Download the program to the PLC and connect the CM1241 RS422/485 to the CM PTP serial port module using a Profibus DP communication cable to test Modbus RTU communication. III. Summary of Common Problems 1. Are there any restrictions on the use of the new version of Modbus RTU instructions? a. The firmware version of the S7-1200 CPU must not be lower than V4.1; b. The firmware of the CM1241 communication module or CB1241 communication board cannot be lower than V2.1. The CPU firmware of S7-1200 V4.0 can be updated to version V4.1 through firmware updates, and the CM1241 communication module with V2.0 firmware can also be updated to version V2.1 through firmware updates. 2. What is the role of the static variable "MODE" in the background data block of the Modbus_Comm_Load instruction? Why is it necessary to modify this variable in general projects? The new version of the Modbus RTU instruction extends the functionality of Modbus RTU. In addition to supporting the CM1241 communication module and CB1241 communication board, this instruction also supports the PTP communication module on the PROFINET or PROFIBUS distributed I/O rack for Modbus RTU communication. The PTP communication module on the distributed I/O rack supports multiple working modes. Taking the ET200SP CM PtP module (order number: 6ES7137-6AA00-0BA0) as an example, it supports multiple working modes such as RS232, RS485, and RS422. The static variable "MODE" in the background data block of the Modbus_Comm_Load instruction is used to define the working mode of the PTP module. The default value of "MODE" is 0, representing the "full duplex (RS232)" working mode. In actual project configuration, this variable needs to be modified according to the actual working mode. 3. Can the Modbus_Comm_Load instruction be called in the start-up block OB100? It is not recommended to call the Modbus_Comm_Load instruction in the start-up block OB100. The new version of the Modbus RTU instruction extends the functionality of Modbus RTU. This instruction supports the PtP communication module on the PROFINET or PROFIBUS distributed I/O rack for Modbus RTU communication. The operating system needs to call instructions such as read data record and write data record to achieve Modbus RTU communication with the PtP module on the distributed I/O rack. The read data record and write data record instructions are asynchronous read and write instructions, and the execution of these instructions requires N scanning cycles. Therefore, it is not recommended to call the Modbus_Comm_Load instruction in the start-up block OB100. 4. How to query the error code when there is a Modbus RTU communication error? Taking the Modbus_Master instruction as an example, when a communication error occurs, the "ERROR" output bit of the Modbus_Master instruction will become TRUE but only remain TRUE for one scanning cycle. Therefore, it is impossible to query the error through TIA software program monitoring. Figure 19. Obtaining the communication error code STATUS