Modbus RTU master no reply and address errors: fix both

Why does the Modbus RTU master get no reply from the slave?

In most first-time installations the A/B pair is reversed at one end of the two-wire cable. The receiver never sees a valid difference and the slave stays silent. Swap the two wires at one device and the slave answers on the next poll. Sort the symptoms before you open the manual again:

Each row needs a different fix, and no fix from one row repairs another row's symptom. The rest of this page works the rows top to bottom.

Does RS-485 label A and B the same way on every device?

No. TIA-485 calls the A terminal negative and B positive, but some vendors print the letters the other way. Two ports both marked A can sit at opposite polarities. Trust the plus and minus markings, or a multimeter, ahead of the letters. RS-485 carries the signal as a voltage difference between two conductors, so the pair has a polarity. The letters alone do not settle it across vendors, and both lettering habits appear in shipped equipment. Match plus to plus and minus to minus from each device's terminal description. When documents disagree, a multimeter settles it. On an idle, correctly biased bus the voltage between the B and A terminals sits on the mark side of the receiver's ±200 mV switching threshold in TIA-485, a few hundred millivolts or more. A reading pushed to the wrong side of zero says the pair is crossed.

Where do the two 120 ohm termination resistors go?

One 120 ohm resistor goes across A and B at each of the two physical ends of the trunk, and nowhere else. The value matches the roughly 120 ohm characteristic impedance of the twisted pair and damps the reflections that corrupt frames on longer runs. Devices in the middle get no resistor, or the bus loads down along its whole length. On the bench, a 2 m cable between two devices communicates with no termination at all. The same parts on an installed trunk with several drops lose frames intermittently. Termination is a reflection fix only: adding resistors never repairs a crossed pair. Keep every drop off the trunk a short stub, because a stub is an unterminated branch.

What baud rate and framing must match at both ends?

Every serial parameter must be identical at both ends. The common working set is 9600 baud, 8 data bits, even parity, 1 stop bit, or 8 data bits, no parity, 2 stop bits. One mismatched parameter produces total silence, not occasional errors. At that rate the TIA-485 electrical layer supports a trunk of roughly 1200 m, and the usable length falls as the rate rises. Silence is the signature. A slave that gets a frame it cannot decode discards it and says nothing, which looks exactly like a wiring fault.

Write the meter's settings down from its communication menu with the menu still open, then enter the same values in the master. A transcription slip in a notebook is a real failure mode. The Modbus serial-line convention pairs 8 data bits with either even parity and one stop bit, or no parity and two stop bits, keeping the frame length constant. Confirm the combination you pick is selectable on both devices.

The slave address belongs to this layer too. Valid RTU slave addresses run 1 to 247, and the address set in the meter's menu must be the one your request carries. The same byte-level discipline applies to a serial display taking commands on its port: command byte encoding for display control.

What does master status 8189, invalid data address, mean?

It means the master block rejected the register reference locally, before one byte reached the wire, so wiring changes cannot clear it. The number in your address parameter sits outside the reference convention that block expects for the register area you asked to read. Two address spaces are involved and they never interact. The slave address, 1 to 247, picks one device on the bus. The register reference picks a location inside that device. A meter at slave address 31 and a holding register referenced as 40031 are unrelated. 31 is the door; 40031 is a shelf behind some door.

Master blocks of this family accept holding-register references from 40001 to 49999, or 400001 to 465535 in six-digit form. The mode input plus the reference area together select the wire function code. To read holding registers with function 03, set mode 0 and enter a 4xxxx reference. Convert the meter's published offset to a reference once, then stop. Applying a second offset after the conversion is the most common way to request a register the device does not have.

How do you convert a hex offset to a register reference?

Treat the hex value as a zero-based protocol offset: convert it to decimal and add 40001. 1000h becomes 4096, and the five-digit holding-register reference you enter is 44097, or 404097 where the block takes six-digit references. The formulas are 40001 + decimal offset for five digits and 400001 + decimal offset for six. The same arithmetic carries across the other register types on the same map. Check the map's base before you trust it. If the document numbers its first register 0, it is zero-based and the formula holds as written. If it numbers the first register 1, subtract 1 from the printed value before adding. The entries that follow on the same map carry the same arithmetic:

How does a worked example read one two-register voltage?

Poll slave 31 with function 03 at reference 44097 for a quantity of 2 registers. When the reply words come back as 0 and 400, assemble high word first and the measurement reads 0 × 65536 + 400 = 400 volts. On the wire the request is slave 1Fh (31 decimal), function 03h, start offset 4096 decimal, quantity 0002h. Then come the two CRC bytes the master appends. The reply is 1Fh, 03h, byte count 04h, then four data bytes: 0000h as the high word and 0190h as the low word. 0190h is 400 decimal.

Every failure of this step is visible in the decoded number. Ask for one register and you receive 0000h, decode zero, and think the meter is dead. A 32-bit measurement needs quantity 2. Get 26,214,400 instead of 400 and the words are swapped, because 400 × 65536 = 26,214,400. Most maps send the high word first, a few send it last, and one word swap fixes it. Current channels on this class of meter report in milliamps, so 5 A arrives as 5000. Read the unit column of the map before you scale. Once the decoded values look right, where they appear on the floor is its own decision between a dashboard and a signage screen for live factory data.

In what order should you check a dead Modbus RTU link?

Check in this order: swap the A/B pair at one end, read the serial settings from both device menus, confirm the slave address, verify the register arithmetic, and only then adjust termination. Each step clears failures the earlier steps cannot touch. One safety note first: meter serial terminals often sit beside live 400 V terminals under the same cover. Treat the cabinet as energized, use insulated tools, and make the swap with one hand.

1. Swap the A/B pair at one end. Fastest single test on the list, and it restores most dead links.
2. Read baud, parity and stop bits from the meter's communication menu and enter the same values in the master. Confirm both devices support that combination.
3. Confirm the slave address in the meter menu matches the address the request carries, within 1 to 247.
4. Convert the register: decimal offset plus 40001 for a five-digit reference, quantity 2 for a 32-bit measurement.
5. Set the master response timeout to at least 100 ms on a short trunk. Meters answer in tens of milliseconds, and a timeout of 50 ms or less truncates healthy replies.
6. Let one request finish before the next one starts; the bus is half-duplex. The Modbus frame delimiter is a silent interval of 3.5 character times. At 11 bits per character and the rate in the common working set, one character is 1.146 ms, so the delimiter is about 4 ms.
7. If two blocks can ever issue requests back to back from different program parts, PLC execution order across task layers shows where the sequence breaks.

The decision for each case:

• No reply, every poll timing out: physical layer. Swap the pair, then match settings, then match the address.
• Local invalid-address status at the block: arithmetic layer. Redo 40001 + offset and check the map's base.
• Exception 02 from the slave: range layer. Check offset, quantity, and that the register exists on that exact device.
• Replies with absurd values: decoding layer. Quantity 2, word order, unit column.

Recommendation: On any new two-wire Modbus RTU link, swap the A/B pair at one end as the first test, match baud, parity and stop bits from the device menus, and enter holding registers as 40001 plus the decimal offset before you spend time on termination. If the block reports a local invalid-address status, stop changing wiring and fix the reference; the wire never produced that status.

Questions