Configuring S7-1200 CB 1241 RS485 for Non-Modbus P2P Communication

The CB 1241 RS485 communication board is a plug-in module for the SIMATIC S7-1200 CPU that adds a single RS485 (RS-422 selectable) port without occupying a signal-module slot. Beyond the standard Modbus RTU (master/slave) libraries, the module exposes a generic point-to-point (PtP) instruction set that lets an integrator implement any user-defined, character-oriented protocol on top of UART framing. This makes the CB 1241 the typical interface of choice when a third-party sensor, drive, weigh scale, barcode reader, GPS, or proprietary instrument speaks a vendor-specific serial protocol that is not Modbus.

This reference covers the full engineering workflow: hardware selection, wiring, TIA Portal hardware configuration, the four PtP instructions (PORT_CFG, SEND_P2P, RECV_P2P, RCV_RESET), parameter-by-parameter programming, status-word interpretation (including the recurring 16#7000 return code), and a structured troubleshooting matrix for the classic "TXD LED flashes, DONE goes ON, but the slave sees nothing" failure mode.

1. CB 1241 RS485 Hardware Overview

The CB 1241 RS485 (Siemens article number 6ES7241-1CH30-1XB0) is a low-profile board that mounts on the left side of the S7-1200 CPU. It exposes one serial port on a removable 6-pin terminal block. The same hardware can be operated as RS-422 (4-wire full-duplex) or RS-485 (2-wire half-duplex) depending on which terminal pairs are wired.

The official specification page for the module is published in the Siemens TIA Portal documentation collection and should be cross-referenced when sizing cable runs: CB 1241 RS485 technical specifications.

2. Prerequisites

Before commissioning non-Modbus PtP traffic, confirm that the following prerequisites are satisfied.

1. CPU firmware. The S7-1200 CPU must be at firmware V4.0 or later; earlier firmware exposes the older USS/MODBUS instruction variants but not the generic PORT_CFG / SEND_P2P pair. Update the CPU from TIA Portal's "Online & Diagnostics" view if necessary.
2. TIA Portal version. TIA Portal V13 SP1 with HSP 0099 (or later) is required so the CB 1241 RS485 (BAU) module appears in the hardware catalog. Use the most recent V15/V16/V17/V18 installation to pick up updated help content for the PtP library.
3. PtP instruction library. In the project tree, navigate to Options → Manage Instructions and ensure "PtP Communication" (instruction package "SIMATIC PtP") is installed and licensed. The library is free of charge for S7-1200.
4. Slave protocol documentation. Obtain the third-party device's serial protocol document. The following parameters are mandatory:
   • Baud rate, data bits, parity, stop bits (line discipline)
   • Frame format (binary, ASCII, framed with STX/ETX, length-prefixed, custom delimiter)
   • Request/response timing: minimum interval between requests, response timeout
   • Half-duplex direction control: implicit (RS-485 driver auto-toggle on data) or explicit (RTS line toggled by the application)
5. Termination. Provide a 120 Ω termination resistor at each physical end of the RS-485 trunk. The CB 1241 board does not contain an internal terminator; install it across the A/B pair at the terminal block.

3. Hardware Configuration in TIA Portal

Insert the CB 1241 into the device view of the CPU. The module occupies the dedicated "communication board" slot, not slot 101 like a signal module. Right-click the CPU → Properties → Communication Board → CB 1241 RS485.

Configure the following:

• Port configuration: 9600 bit/s, 8 data bits, no parity, 1 stop bit (set to match the slave; common defaults but not universal).
• RS-485 mode: enable the "RS-485" half-duplex profile. This is what ties the transmitter enable to the UART's data state so the driver auto-releases the line when idle.
• Initial line state: select "Recessive (high)" - matches the Modbus and most vendor defaults and is required for proper multi-drop bus release.
• Receive line initialization: leave at the default. The PtP library initializes the receive buffer when the user program calls RCV_P2P with EN_R = TRUE; HW configuration does not pre-arm it.

Save and compile, then download the hardware configuration to the CPU. The TXD/RXD LEDs on the CB 1241 should briefly flash during download, then extinguish.

4. The PtP Instruction Set

Four FBs make up the generic PtP library. All of them are located in Instructions → Communication → PtP Communication after the library is enabled.

Each instance DB must be created as a multi-instance or single-instance; Siemens recommends single-instance for clarity. The instance DB holds the line state, error counters, and the status word. The status word is the single most useful diagnostic value and is mapped to the DONE, ERROR, and STATUS outputs of every FB.

5. Step-by-Step Programming Example

The program below is the minimum viable PtP block sequence for a half-duplex request/response cycle. The sequence is wrapped in a periodic OB (typically OB1 with a slower cycle, or a cyclic interrupt OB such as OB35) and gated by a one-second timer so the slave is polled at a fixed interval.

5.1 Tag declarations

Create the following tags in a default tag table:

// Inputs
iStartCycle        : Bool        // Edge from poll timer
iClearReceiver     : Bool        // Operator reset

// Outputs
oSendBusy          : Bool
oRecvBusy          : Bool
oLastError         : Bool
wStatusSend        : Word        // Last SEND_P2P STATUS
wStatusRecv        : Word        // Last RECV_P2P STATUS

// Data
abTxBuffer         : Array[0..255] of Byte  // 256-byte send buffer
abRxBuffer         : Array[0..255] of Byte  // 256-byte recv buffer
iTxLen             : UInt        // Payload length 1..256
iRxLen             : UInt        // Bytes received

5.2 OB1 - Polling cycle

// ------------------------------------------------------------
// Block 1 - Reset receiver on operator command
// ------------------------------------------------------------
RCV_RESET_DB(REQ := iClearReceiver, PORT := 0, STATUS => wStatusRecv);

// ------------------------------------------------------------
// Block 2 - Port configuration (one-shot on cold start)
// Use a one-time M-bit to avoid re-configuring on every scan
// ------------------------------------------------------------
PORT_CFG_DB(REQ := bFirstScan,
            PORT := 0,                            // 0 = CB 1241
            BAUD := 9600,                         // 9600 bit/s
            PARITY := 0,                          // 0 = None
            DATABITS := 8,
            STOPBITS := 1,
            FLOWCTRL := 0,                        // 0 = None
            XONCHAR := 16#11,
            XOFFCHAR := 16#13,
            STATUS => wStatusSend);

// ------------------------------------------------------------
// Block 3 - Periodic send trigger
// ------------------------------------------------------------
IF iStartCycle THEN
  SEND_P2P_DB(REQ := TRUE,
              PORT := 0,
              BUFFER := abTxBuffer,
              LENGTH := iTxLen,
              DONE => oSendBusy,
              ERROR => oLastError,
              STATUS => wStatusSend);
END_IF;

// ------------------------------------------------------------
// Block 4 - Continuous receive arm
// EN_R is held TRUE so the receiver stays armed
// ------------------------------------------------------------
RECV_P2P_DB(EN_R := TRUE,
            PORT := 0,
            BUFFER := abRxBuffer,
            LENGTH := iRxLen,
            DONE => oRecvBusy,
            ERROR => oLastError,
            STATUS => wStatusRecv);

5.3 Status-word reference (16#7000 case)

The status word reported on the STATUS output follows a fixed structure documented in the PtP help. The two most common values seen during commissioning are:

When a polled slave is wired correctly and the line parameters match, a healthy idle system reports 16#7000 on both SEND_P2P.STATUS and RECV_P2P.STATUS. Seeing 16#7000 after a transmit attempt is therefore good news: it means the UART accepted the bytes and the transmit FIFO drained without any line-driver error. The next diagnostic step is on the wire, not in the PLC.

6. The Classic "TXD Flashes, DONE = TRUE, Slave Sees Nothing" Failure

This failure mode appears frequently during the integration of any S7-1200 PtP link and almost always traces to one of the following root causes.

6.1 A/B polarity swap

The TXD LED on the CB 1241 reflects only the activity of the UART, not the actual voltage on the bus. With A and B crossed, the UART still transmits; the slave simply receives inverted bits and rejects them. Verification: disconnect the PLC end and measure the bus with an oscilloscope or a USB-RS-485 dongle that exposes the raw signal - the dominant (active) state should be +V on A relative to B.

6.2 Missing or wrong termination

RS-485 is a multidrop bus and must be terminated at both ends with 120 Ω in parallel with the differential pair. Without termination, signal reflections corrupt bits at higher baud rates, and slaves with weak input hysteresis may decode the message as framing errors. For a single-master / single-slave bench test, place one 120 Ω resistor at the CB 1241 end and one at the slave end; remove the third-party device's internal bias if it disturbs the idle state.

6.3 LEN / buffer length mismatch

If the LENGTH input on SEND_P2P exceeds the actual number of meaningful bytes, the UART transmits the entire array including stale buffer content. A common pattern is to declare a 256-byte array and pass LENGTH := 256; if only the first 10 bytes contain the request, the trailing 246 garbage bytes desynchronize the slave. Fix: pass exactly the number of payload bytes and either zero the unused portion of the array or use a tighter Array[0..N] declaration that matches the protocol.

6.4 Slave timing not respected

Many vendor protocols (e.g., "Open Protocol" on weigh scales, "Toyopuc PC-Link", "FINS-on-serial") require a silent inter-frame gap of 3.5 character times or a fixed quiet-line delay between request and response. The default S7-1200 PtP library does not insert this gap automatically. If the slave receives the request but its response overlaps the master's next poll, the bus collides. Solution: time the poll cycle to be > 1 character time longer than the slave's worst-case response time, and use a single SEND_P2P call followed by a RECV_P2P call with an application-level timeout based on a TON timer.

6.5 RS-422 vs RS-485 mode mismatch

If the third-party device is true 4-wire RS-422 (separate TX and RX pairs), the CB 1241 must be configured for RS-422 full-duplex and the device's TX+/TX- must be wired to the PLC's R+/R- (not T+/T-). Wiring an RS-422 device as RS-485 often produces a one-way link where the master hears echoes of its own transmission and never the response.

7. Structured Troubleshooting Matrix

8. Recommended Verification Procedure

After the program is downloaded, perform the following verification in order. Each step is independent and adds one minute at most to the commissioning effort.

1. Loopback test. With the slave disconnected, place a wire jumper between T/R+ (pin 1) and R+ (pin 3) and another between T/R- (pin 2) and R- (pin 4). Send a known 10-byte pattern. The same pattern should appear in abRxBuffer with iRxLen = 10. This proves the UART, the port configuration, and the receive path.
2. Scope the bus. Connect a two-channel oscilloscope across A and B. Confirm dominant state is positive A relative to B, the bit period matches 1/baud, and the line returns to recessive (> +200 mV) between bytes. The CB 1241 RS485 has no internal pull-up/pull-down; an external fail-safe bias network (typically 680 Ω to +5 V on A, 680 Ω to GND on B at the master end) is required if the slave does not provide bias.
3. Slave echo test. Many protocols echo each command before the response. If the slave is configured to echo, the first received frame should be a copy of the sent frame; if it never appears, A/B polarity or termination is the cause.
4. Increase inter-frame gap. Add a 50 ms TON after each SEND_P2P completes and before the next call. If reception suddenly works, the slave's response window was being violated by the original poll cadence.
5. Monitor STATUS in HMI. Tag wStatusSend and wStatusRecv to the HMI. This is the cheapest way to detect intermittent parity / overflow errors that a one-off look would miss.

9. Sample State Machine for a Non-Modbus Polled Slave

The state machine below summarizes the recommended pattern for a request/response protocol. It is implemented in ladder or SCL and guarantees that the receiver is always armed and that REQ is edge-triggered.

// States
CONST
  ST_IDLE      := 0;
  ST_SENDING   := 1;
  ST_WAIT_RESP := 2;
  ST_PROCESS   := 3;
  ST_ERROR     := 4;
END_CONST

CASE iState OF
  ST_IDLE:
    IF iPollTick THEN                    // 100 ms tick from cyclic OB
      iState := ST_SENDING;
    END_IF;

  ST_SENDING:
    SEND_P2P_DB(REQ := bSendTrig := NOT bSendTrig,
                PORT := 0,
                BUFFER := abTxBuffer,
                LENGTH := iTxLen,
                DONE => bSendDone,
                ERROR => bSendError,
                STATUS => wStatusSend);
    IF bSendDone OR bSendError THEN
      bSendTrig := FALSE;
      IF bSendError THEN
        iState := ST_ERROR;
      ELSE
        iTimer(IN := TRUE, PT := T#200ms);   // slave response window
        iState := ST_WAIT_RESP;
      END_IF;
    END_IF;

  ST_WAIT_RESP:
    RECV_P2P_DB(EN_R := TRUE,
                PORT := 0,
                BUFFER := abRxBuffer,
                LENGTH := iRxLen,
                DONE => bRecvDone,
                ERROR => bRecvError,
                STATUS => wStatusRecv);
    IF bRecvDone OR bRecvError OR iTimer.Q THEN
      iTimer(IN := FALSE);
      IF bRecvDone AND iRxLen > 0 THEN
        iState := ST_PROCESS;
      ELSIF bRecvError THEN
        iState := ST_ERROR;
      ELSE                                  // timeout
        RCV_RESET_DB(REQ := TRUE, PORT := 0);
        RCV_RESET_DB(REQ := FALSE, PORT := 0);
        iState := ST_IDLE;
      END_IF;
    END_IF;

  ST_PROCESS:
    // Application code consumes abRxBuffer, sets up next request
    FillTxBuffer();
    iState := ST_IDLE;

  ST_ERROR:
    oLastError := TRUE;
    iState := ST_IDLE;
END_CASE;

Note how the state machine avoids common pitfalls: REQ is toggled to create an edge, the receiver stays armed continuously, an application-level timeout invokes RCV_RESET to drop any partial frame, and the next cycle is delayed until the current state is fully resolved.

10. CB 1241 RS485 Terminal Pinout

For RS-485 2-wire operation, only pins 1, 2, and 5 need to be connected to the third-party device. Pins 3 and 4 are unused externally; the internal UART receives the echo of its own transmission on the T/R pair.

11. Common Pitfalls and Field-Proven Caveats

• Faulty "RS-485 to USB" adapters. Many sub-$10 adapters auto-toggle the driver without fail-safe bias; the PLC may detect the adapter's echo as framing errors. Industrial-grade isolators (B&B Electronics, Phoenix Contact) are recommended for bench debugging.
• Common-mode voltage. If the third-party device is powered from a different phase or has a grounded secondary, the bus common-mode voltage can exceed the EIA-485 common-mode range (± 7 V). An isolated repeater (e.g., Phoenix Contact PSI-REP-RS485) on the PLC side resolves it.
• Shield grounding. Ground the shield at one end only. Multiple ground points create ground loops that inject noise into the bus. Pin 6 (SHIELD) on the CB 1241 is the recommended single-point.
• CPU run/stop behavior. In CPU STOP, the CB 1241 transmitter is disabled and the bus is released. A half-duplex slave polled only by the PLC will not see requests during STOP; design handshaking or fail-safe behavior accordingly.
• Library versioning. The PtP instruction help text was rewritten in TIA V16 to clarify that STATUS = 16#7000 is the idle indicator. Engineers who learned on TIA V13 sometimes still treat 7000 as a warning. It is not.

12. Related Communication Modules on the S7-1200

If the project requires more than one RS-485 port, the same PtP instruction set supports the following siblings:

All four share the same PORT_CFG / SEND_P2P / RECV_P2P / RCV_RESET FBs. The only difference is the PORT input value, which matches the module's slot index in the device configuration.

13. FAQ