Configuring S7-1200 Modbus RTU to Carlo Gavazzi EM24 via CB 1241

Overview

This guide covers commissioning a Modbus RTU link between a Siemens SIMATIC S7-1200 CPU 1215C and a Carlo Gavazzi EM24 DIN rail energy meter using the CB 1241 RS485 communication module. The S7-1200 acts as the Modbus RTU master, the EM24 acts as a slave, and the CB 1241 supplies the isolated RS485 physical layer. Programming is performed in TIA Portal using the library instructions MB_COMM_LOAD and MB_MASTER.

Prerequisites

• SIMATIC S7-1200 CPU 1215C (firmware V4.0 or later recommended for stable Modbus library behavior; V4.4+ recommended for S7-1200 firmware in the V16+ TIA Portal environment)
• CB 1241 RS485 communication module (6ES7241-1CH30-1XB0)
• Carlo Gavazzi EM24 (variants: EM24 DIN, EM24 Ethernet, EM24-DIN.AV5, EM24-DIN.AV6, EM24-DIN.AV7, EM24-DIN.AV9 - confirm RS485 variant before wiring)
• TIA Portal V13 SP2 or later (V15.1, V16, V17, or V18 recommended)
• Modbus RTU library instructions from Siemens (auto-installed with TIA Portal V14+; legacy V13 requires manual import of the "Modbus_Comm_Load" and "Modbus_Master" FB blocks)
• Shielded twisted pair RS485 cable (Belden 3106A or equivalent, characteristic impedance 120 Ω, 24 AWG)
• 120 Ω termination resistors at each bus end
• 24 VDC power supply for the S7-1200 and EM24

Hardware Architecture and Wiring

RS485 Bus Topology

The CB 1241 RS485 module uses a 9-pin sub-D connector or a removable terminal block (TB) on the bottom of the module. For the CB 1241, the relevant pins are:

Per the CB 1241 RS485 technical specifications:

• Bias: 10 kΩ to +5 V on B (Pin 3); 10 kΩ to GND on A (Pin 4)
• Optional termination: short Pin TB to Pin T/ to engage the on-board 120 Ω termination across the bus

Recommended Wiring

1. Connect CB 1241 Pin 3 (B) to EM24 terminal B+ (or D+ on Carlo Gavazzi label).
2. Connect CB 1241 Pin 4 (A) to EM24 terminal A- (or D- on Carlo Gavazzi label).
3. Connect CB 1241 Pin TB to EM24 reference terminal (often marked GND or COM).
4. Enable 120 Ω termination on the CB 1241 by placing a jumper or wire between TB and T/ on the terminal block (this engages the on-board resistor).
5. If the EM24 is the last device on a long bus, also enable its 120 Ω termination dip switch (consult EM24 datasheet; typically the third dip switch on the side of the unit).
6. Connect cable shield to functional earth at one end only (typically at the cabinet ground bar) to avoid ground loops.

Maximum Bus Length and Devices

RS485 supports up to 32 unit loads on a single bus (the CB 1241 presents 1 unit load, the EM24 also presents 1 unit load). Maximum cable length at 19200 baud is 1200 m; at 115200 baud it is approximately 200 m. The EM24 is typically operated at 9600 or 19200 baud over cable runs under 200 m.

Carlo Gavazzi EM24 Configuration

The EM24 is configured via the front-panel push buttons or, on the AV5/AV9 Ethernet variants, via web interface. For Modbus RTU operation:

Set the slave address using the front-panel menu: SETUP → ADDRESS → n (where n is 1-247). Confirm the value is stored by power-cycling the meter.

TIA Portal Hardware Configuration

1. Open your TIA Portal project and the device view of the S7-1200.
2. Drag the CB 1241 RS485 (6ES7241-1CH30-1XB0) from the catalog onto slot 1 of the S7-1200 (slot 101 for the CPU's left-side communication module bay).
3. Double-click the CB 1241 to open its properties.
4. Under RS485 Interface → Port Configuration, set:
   - Baud rate: 9600 (or matching EM24)
   - Parity: None
   - Data bits: 8
   - Stop bits: 1
   - Flow control: None
5. Under I/O Link / Module Parameters, set the transmission mode. For Modbus RTU master operation, no special mode is required - the CB 1241 operates in transparent point-to-point mode with user-controlled RTS.
6. Compile and download the hardware configuration to the CPU.

Programming the Modbus Master

Block Architecture

Siemens provides two FB (Function Block) instructions for Modbus RTU master operation on the S7-1200:

• MB_COMM_LOAD (DB 1 by default): configures the port, executes once on startup or cold restart to initialize the CB 1241.
• MB_MASTER (DB 2 by default): sends a single Modbus request and triggers on the rising edge of the REQ input.

MB_COMM_LOAD Input Wiring

Example parameter assignment (drag from a global data block "ModbusConfig"):

REQ         := TRUE                       // Always TRUE in OB100 (one-shot)
PORT        := 1                          // RS485 port index on CB 1241 (0 or 1)
BAUD        := 9600                       // Must match EM24
PARITY      := 0                          // 0=None, 1=Odd, 2=Even
FLOW_CTRL   := 0                          // 0=None for Modbus RTU
RTS_ON_DLY  := 0                          // ms; 0 for Modbus RTU
RTS_OFF_DLY := 0                          // ms; 0 for Modbus RTU
RESP_TO     := 1000                       // ms response timeout; 1000-2000 typical
DONE        => mbLoadDone                // Boolean: configuration complete
ERROR       => mbLoadError                // Boolean: configuration error
STATUS      => mbLoadStatus               // Word: detailed status (see table below)

MB_MASTER Input Wiring (Read Holding Registers Example)

To read voltage, current, power, and energy from the EM24, poll Function Code 0x03 (Read Holding Registers) at the EM24's measurement register base. A typical request to read the first 10 measurement registers:

REQ         := pollTrigger                // Bool; rising edge fires request
MB_ADDR     := 1                          // EM24 slave address (set on meter)
MODE        := 0                          // 0=Read, 1=Write (single), 2=Write multiple
DATA_ADDR   := 300001                     // Modbus address; library converts to 0x0000 internally
DATA_LEN    := 10                         // Number of 16-bit words to read (max 125)
DATA_PTR    := P#DB20.DBX0.0 WORD 10      // Destination pointer; must be at least DATA_LEN words
DONE        => pollDone                  // TRUE for one cycle on success
ERROR       => pollError                 // TRUE for one cycle on failure
STATUS      => pollStatus                 // Word: see error code table

Reading the EM24 Register Map

The Carlo Gavazzi EM24 has a documented Modbus register map. Key registers (Function Code 0x03, Read Holding Registers):

Note: register scaling and addresses vary by EM24 firmware revision. Always consult the official Carlo Gavazzi EM24 Modbus protocol guide for your firmware level (typically downloaded from the product support page of gavazziautomation.com) before commissioning.

STEP 7 / TIA Portal Sample Code

Below is a minimal OB1 ladder excerpt for reading 10 holding registers from EM24 address 1, on a 200 ms cycle, storing into DB20:

Network 1: Trigger poll every 200 ms
      "Clock_200ms"   "pollTrigger"
     ─┤ ├──────(P)─────

Network 2: Call MB_MASTER (FC rising edge only)
      "pollTrigger"    MB_MASTER.DB2
     ─┤↑ ├──────────┬── EN
                     ├  REQ     := "pollTrigger"
                     ├  MB_ADDR := 1
                     ├  MODE    := 0      // Read
                     ├  DATA_ADDR:= 1
                     ├  DATA_LEN := 10
                     ├  DATA_PTR := P#DB20.DBX0.0 WORD 10
                     └  ...

Network 3: Error handling
      "pollError"     "Alarm_Comm"
     ─┤ ├──────────( S )─
      "pollStatus"    "MB_Error_Code"
     ─┤MW├──────────(MW)─

Verification

1. Online watch table: Open a watch table on DB20 and force a single poll. Confirm DONE goes TRUE and STATUS = 0 within RESP_TO milliseconds.
2. Read individual words: Word 0 of DB20 (EM24 register 0x0000) should display a value corresponding to L1-N voltage × 10. If your line-to-neutral voltage is 230.4 V, expect a value of 2304.
3. Cross-check on the meter: The EM24 front display and the value scaled from the register must match within ±1 LSB.
4. LED indication on CB 1241: The green "TxD" LED should blink on each master transmission; the yellow "RxD" LED should blink on each slave response. If only TxD blinks and RxD never activates, the wiring or slave address is wrong.
5. Traffic capture (optional): A USB-RS485 sniffer (e.g., FTDI USB-RS485-WE-1800-BT) running Modbus Poll or modbus-cli confirms the request frame: 01 03 00 00 00 0A C5 CD (address 1, function 03, start 0, count 10, CRC).

Troubleshooting Matrix

Best Practices and Field Tips

• Always cold-start the S7-1200 after editing hardware configuration so MB_COMM_LOAD reinitializes the CB 1241 in OB100 before the first MB_MASTER call in OB1.
• Place MB_MASTER in a periodic OB (e.g., OB30 cyclic interrupt at 100 ms) to avoid jitter from OB1 scan time.
• Limit the number of registers per MB_MASTER call to 16-32 for fast polling; use multiple MB_MASTER instances with staggered REQ pulses for larger datasets.
• Compute CRC in advance only when benchmarking; trust the library CRC unless you have a confirmed silent-corruption issue.
• Use the EM24's "reset partial energy" writable register (Function Code 0x06, Write Single Register) to zero the partial counter at shift changes - place the write in a single-shot trigger to avoid bus flooding.
• Set CB 1241 termination only when the module is at a physical bus end; otherwise, leave the TB/T jumper open and place 120 Ω at the two end devices only.
• Document the MB_ADDR, baud, parity, and DATA_ADDR for each slave in the HMI tag comment - this saves hours of commissioning time when scaling to multi-meter panels.

Frequently Asked Questions