Modbus connection between PLC S7-200 and RTK Series 725 Annunciator


Thread Starter

Do Quang Tung

I designed a network to connect PLC S7-200 with four RTK Series 725 Annunciators via RTU Modbus. But I can't communicate between them. Baud rate, parity, RTU are same for all node of the network.

I configured PLC is master, 4 P725 are Slaves. I used function MBUS_CTRL and MBUS_MSG on PLC.

The Error code when PLC Running is 3 (Mean: Receive timeout: There was no response from the slave within the Timeout time. Some possible causes are bad electrical connection to the slave device, master and slave are set to a different baud rate/parity setting, and incorrect slave address)

Anyone has ever done with these instruments, please support me
Thank you very much.

Lynn August Linse

Does indeed sound like bad wiring - 2-vs-4 wire RS-485, which wire is A or B or + or -.

Try swapping wires around for a bit. Some companies label 'A' what other companies label 'B'. '+' and '-' is a bit more standard, but still left up to the vendor's imagination since RS-485 doesn't mention what +/- mean.

Do Quang Tung

I wired correctly (manufacturer confirmed).

I wonder problem may be in address of holding register. Holding register address of P725 is 2016 (Use modbus function 3 to read) meanwhile On PLC S7-100 with function 3, the modbus address have to from 40001 to 49999.

Do you have any suggestion to help me

William \(Bill\) L Mostia Jr PE

One thing I ran across was an annunciator which could connect to both RS-232 and RS-485 and had a jumper to select which one. I'd see if this annunciator has the same and if it is in the wrong position.

You can also find on the Internet programs which you can simulate a Modbus master or slave and see the actual transmitted bytes. Use of these can help isolate whether the problem is with the master or slaves. Looking at the bytes can also sometimes spot problems.

Ones I have used is the Advanced Serial Port Monitor ( and ModScan32 ( There are others available.

William (Bill) L. Mostia, Jr. PE
Sr. Consultant
SIS-TECH Solutions, LP
Any information is provided on Caveat Emptor basis.
1) Have you confirmed all the suggested faults?

- bad electrical connection to the slave device (Mr. Linse suggested swapping A/B or +/- lines)

- master and slave are set to a different baud rate/parity setting (you're double sure that they're right?)
You checked the wiring from the diagram in the manual?

- incorrect slave address (did you set different slave addresses for each panel?)

2) Are all HMI panels wired or are you just starting with one? If it were me, I'd start with one and get it working to avoid problems of multiple slaves on an RS-485 link.

3) the missing 4 in 4xxxx
Historically, the modbus master command function "read holding register" addresses the 4xxxx range of memory, as opposed to other commands that address other ranges of memory.

Nowadays, some Modbus masters "show" the 4, many don't. Those who leave it out assume the leading numeral 4 because it's merely an indicator of which range of memory and the leading numeral 4 is not included in the Modbus message packet. The same goes for many slaves.

The address/register table frequently just shows the register 'index' without the leading numeral 4, in your case, 2016. Historically, it would have been 42016.

If the PLC 'requires' a 4 in the destination register address, make your 2016 into 42016 by adding the leading numberal 4.

4) I once ran into an HMI panel that required 4 wire, full duplex RS-485 communication. It would not run half duplex (even jumpering the lines). The master was half duplex only. Are both your PLC and HMI panels happy with the half or full duplex 485, whichever, that you've wired?

5) I'm an unlucky guy. Nobody will go to a movie with me because when I go, the film breaks and there's that 10 minute pause while the guy in the projection booth fixes it. Same deal at work, I get lots of brand new pieces of equipment that are dysfunctional, right out of the box. So I'm always suspicious the devices don't work properly out-of-the-box.

So I do what Mr. Mostia recommends and I check a slave's functionality with a generic Modbus Master on a Windows PC. I want to confirm that the port is functioning, that the slave address is correct, which register address returns my expected (arbitrary) 4256 value. It's really easy to change the settings on the generic masters.

Do Quang Tung

Thank you for your help

Refer to your suggestions, my answers of mine is:

1/ I swapped A/B lines but result haven't been ok yet. I used RS482 2 wires, electric connection is right( I wrote email with drawing of wire connection and Expert of manufacturer confirmed that I wired right)

2/ I just start with one HMI panel

3/ I added the leading number 4 into 2016 and result is no error. But I don't get any value from holding register of P725 (value = 0000 although I forced to change some inputs)

I don't know why cause is, please help me by give me any your suggestions. (I don't have RS232-485 converter therefore I can't check connection P725 with PC)

Thank you very much
Best Regards,
How do you know that the HMI serial port that you are connecting to is setup to be a Modbus slave?

HMI's are frequently Modbus masters. How do you know that yours isn't setup as a Modbus master. If it is the PLC master is trying to address another master.

Do Quang Tung

Thank you for all your help
I connected and got data successfully.
Reason: address of holding register must from 2017. not 2016 such as show in the catalog
Best regards
Thank you for telling us how it went.

I'm kicking myself because I deliberately omitted an explanation of the dreaded 'One offset' issue, but you discovered it and solved it on your own. Good going.

It depends what you're looking at. If you check the actual Modbus message with a protocol analyzer, you'll see 2016 in the address field. However, the typical Modbus register numbering scheme will use 2017. As far as I recall there is something in the manual about this. It's up to the controller's manufacturer how the Modbus configuration is implemented.