Debugging CMS-600 Modbus communication

I'm looking for advice on how to debug CMS-600 modbus communication any further.

I'm using a Siemens C7-1200 PLC (1212 fw v4.2) with an RS485 module (CB1241) to read current values from CMS-600 via RS485 modbus-RTU.

Reading the CMS-600 manual I have sent it the sequence of bytes it requires and confirmed by measuring the signal from the wires using an oscilloscope:

This is what is sent to it:
01 03 00 00 00 01 84 0A

01 = address of CMS-600
03 = function for reading static registers
00 00 = reading sensor 1
00 01 = reading one register value
84 0A = CRC

However the CMS-600 does not respond at all to this. Siemens error code status is 80C8 Slave not responding. However I can see that there is no response also with the oscilloscope

The RS485 bus wires are only 10cm long, twister and terminated.

I've tried different bus speed and parity setting but nothing works.

Has anyone gotten this CMS to work with Siemens PLCs ?