Home / Knowledge Base / PLC & Controllers

How to Fix Modbus RTU Timeout Error 16#80C8 on Siemens S7-1200

PROTOCOL: MODBUS RTU Applies to: TIA Portal V14-V18, CM 1241, CB 1241
⚡ TL;DR Diagnostic Quick-Card
Symptom:
MB_MASTER function block fails to communicate with slave device. The ERROR output drops to TRUE and status locks.
Status Code:
16#80C8 (Siemens CM/CB 1241 Serial Timeout)
Root Cause:
RS485 EIA standard polarity inversion (A/B wires reversed), missing port initialization, or polling collisions on the half-duplex bus.

If you connect a third-party Modbus RTU device to a Siemens S7-1200 PLC (using the CM 1241 or CB 1241 modules), the MB_MASTER instruction block frequently encounters a communication fault where the ERROR bit goes high, and the STATUS output remains locked at 16#80C8.

TIA Portal Diagnostic Buffer / Watch Table
Block: MB_MASTER (FB 43)
REQ:   TRUE
DONE:  FALSE
ERROR: TRUE
STATUS: 16#80C8

Description: Timeout during Modbus RTU communication. The slave device did not respond within the defined RESP_TO time.

In Siemens TIA Portal, 16#80C8 strictly indicates a “Timeout”. The PLC was able to send out a Modbus request frame but did not receive any valid response from the slave device. Verify the following engineering checklist before replacing the communication module or assuming hardware failure. Most of those timeout errors (roughly 90 percent) are caused by physical layer inversions or logical polling collisions.

Step 1: The RS485 Polarity Trap (A/B Wires)

This is the leading cause of initial communication failure when bridging Siemens hardware with third-party inverters, power meters, or VFDs.

The EIA-485 Standard Trap

Unlike generic RS485 devices where “A” is commonly marked as positive (+) and “B” as negative (-), the official standard defines A as inverting (negative) and B as non-inverting (positive). Siemens strictly adheres to this standard, while many third-party vendors do not.

The Fix: If 16#80C8 occurs consistently and the slave’s RX/TX indicators show no activity, swap the A and B wires on the slave side (Siemens Pin 3 to positive, Pin 8 to negative). Reversing the polarity will not cause electrical damage; it merely prevents signal interpretation.

Step 2: Execution Order (MB_COMM_LOAD)

In the PLC cycle the CM 1241 serial port must be fully initialized before any polling requests can be made.

  • Ensure the MB_COMM_LOAD block executes only once (typically triggered by the FirstScan system memory bit during startup).
  • Do not trigger the REQ pin of the MB_MASTER block until MB_COMM_LOAD.DONE returns TRUE. Polling an uninitialized port will immediately yield an 80C8 timeout.

Step 3: Polling Collisions & Bus Decoupling

Modbus RTU is inherently a half-duplex serial protocol. Aggressively polling slave devices without allowing sufficient processing and response time will result in bus collisions.

  • Check your RESP_TO parameter: In the MB_COMM_LOAD background Data Block (DB), the Response Timeout defaults to 1000 ms. When polling older legacy devices that are slower it is recommended to increase this value to 2000ms.
  • Implement a State Machine: Never utilize a continuous clock pulse (e.g., a 1Hz Clock Memory bit) to trigger MB_MASTER. Instead, utilize the DONE or ERROR outputs of the block to trigger a short delay timer (e.g., 50ms), and use that timer’s completion to trigger the subsequent REQ.
💻 TIA Portal SCL Template: Safe Polling Sequence Open-Source
// Step 1: Wait for Device to finish (DONE or ERROR)
IF "MB_MASTER_DB".DONE OR "MB_MASTER_DB".ERROR THEN
    "Polling_State" := 10;
END_IF;

// Step 2: Enforce a breathing delay for RS485 bus
"Inter_Frame_Delay".TON(IN := ("Polling_State" = 10),
                        PT := T#50ms);

// Step 3: Trigger next Request ONLY after delay
IF "Inter_Frame_Delay".Q THEN
    "MB_MASTER_REQ" := TRUE;
    "Polling_State" := 20;
END_IF;
💡 Why 50ms Delay? Slave transceivers require a physical cooldown period (inter-frame silence) after transmitting their RX buffer before they can listen for a new TX pulse from the Siemens CM 1241.

The Architectural Bottleneck in Multi-Slave Networks

No matter how you optimize the SCL ladder logic, if you ask the S7-1200 to poll several devices over a large daisy-chain network, the half-duplex limitations of RS485 will inevitably cause bus collisions and random 16#80C8 timeouts.

In standard industrial architectures, engineers resolve this by decoupling the PLC from the physical serial layer entirely—using a gateway to cache Modbus RTU registers independently.

Writing state machines for dozens of Modbus devices?

Managing cascading timers, error handling, and polling tokens for 10+ slaves in TIA Portal wastes hours of engineering time and increases S7-1200 CPU scan cycle load.

❌ CM 1241 Direct Polling
  • Complex SCL state machine code required.
  • High vulnerability to sequential 16#80C8 timeouts.
  • One slow device stalls polling for the entire bus.
✅ Valtoris Storage Gateway
  • Zero Modbus RTU polling code in PLC.
  • Gateway autonomously polls & caches slave memory.
  • S7-1200 reads clean data in 1ms via Ethernet / TCP.