Connecting an MP3 Player to a Siemens S7-1200 via the CB 1214 Communication Board
Process voice prompts and audio cues from a Siemens S7-1200 PLC by driving a UART-based MP3 player module through the on-board RS485 interface of the CB 1214 communication board (Siemens catalog number 6ES7241-1CH30-1XB0). This tutorial walks through hardware wiring, TIA Portal device configuration, the player frame format (7E FF 06 03 00 00 01 FF E6 EF), checksum generation, and the SEND_P2P program structure required to play tracks 0 through 2999 on demand.
1. System Overview
The target stack consists of three components:
| Component | Model / Part | Role |
|---|---|---|
| PLC CPU | SIMATIC S7-1200 CPU 1214C DC/DC/RLY (6ES7214-1AG40-0XB0 or compatible) | Master, holds the audio command logic |
| Communication board | CB 1214 (6ES7241-1CH30-1XB0), firmware V1.0 or later | Adds one RS485 (half-duplex) point-to-point port on the left side of the CPU |
| Audio module | Generic UART-controlled MP3 player (DFPlayer-style frame protocol) | Decodes serial commands and plays the selected track from a microSD card |
The CB 1214 plugs into the left slot of the CPU and exposes terminals 1-5 used here as a 2-wire RS485 (A, B, GND). Only one CB 1214 is permitted per S7-1200 station, and it occupies the lower address area, below any signal boards on the right.
2. Prerequisites
- STEP 7 / TIA Portal V15.1 or later installed; V16 or V17 recommended for the latest S7-1200 HSPs.
- S7-1200 CPU 1214C with firmware V4.2 or higher (older V3 CPUs limit serial features).
- CB 1214 board, article
6ES7241-1CH30-1XB0. - MP3 player module documentation (frame structure, default baud rate, track addressing).
- USB-to-RS485 adapter (e.g., FTDI FT232-based) for off-line bench testing.
- Free serial terminal application (Hercules SETUP utility or Realterm) for raw-byte capture.
3. Wiring the RS485 Link
Terminate the CB 1214 at screw terminals 1 through 5. The recommended assignment for a 2-wire MP3 link is:
| CB 1214 terminal | Signal | Connect to MP3 player |
|---|---|---|
| 1 | Shield / ground reference | Shield / GND of player |
| 2 | M (signal ground) | Player GND |
| 3 | RxD / TxD - (B) | Module A (or Data-) |
| 4 | RxD / TxD + (A) | Module B (or Data+) |
| 5 | n.c. or shield | Shield continuation |
For runs longer than 5 m, place a 120 Ω termination resistor across A/B at the far end. The CB 1214 has no on-board termination; if the bus is short and single-drop, leave both ends unterminated.
Confirm the baud rate the MP3 player ships with (commonly 9600 bps, 8N1). The CB 1214 supports 300, 600, 1 200, 2 400, 4 800, 9 600, 19 200, 38 400, 57 600, 76 800 and 115 200 bps in 8-bit configurations. See the S7-1200 System Manual for the complete list.
4. Configuring the CB 1214 in TIA Portal
- Add the CPU 1214C to the project, then drag the CB 1214 from the catalog onto the CPU's left slot. The board appears as
CB 1214in the device tree. - Open the Properties > Port configuration tab of the CB 1214. The relevant parameters:
| Parameter | Recommended value | Meaning |
|---|---|---|
| Enable | Checked | Activates the port |
| Baud rate | 9600 | Must match the player default |
| Parity | None | Player expects 8N1 |
| Data bits | 8 | Fixed for this protocol |
| Stop bits | 1 | Fixed for this protocol |
| Flow control | None | DFPlayer-style modules do not use RTS/CTS |
| Line idle state | Active high (default) | Matches most audio modules |
- Leave Port configuration in the device view at these static values. Do not use the
PORT_CFGinstruction in the program unless you have a confirmed need to change parameters at runtime; dynamic reconfig adds ERROR/STATUS paths that a beginner application does not need. - Compile the hardware configuration and download it to the CPU before any test.
5. The MP3 Player Frame Protocol
The player uses a fixed 10-byte frame for the play-track command. The canonical example for "play track 1 with no response required" is:
7E FF 06 03 00 00 01 FF E6 EF
| Position | Byte | Meaning |
|---|---|---|
| 0 | 0x7E | Start byte |
| 1 | 0xFF | Version information |
| 2 | 0x06 | Data length (bytes that follow, not including checksum or end byte) |
| 3 | 0x03 | Command number (0x03 = select track / play) |
| 4 | 0x00 / 0x01 | Ack flag (0x01 = request response, 0x00 = no response) |
| 5 | 0x00 | Track high byte (DH) |
| 6 | 0x01 | Track low byte (DL). 0x0001 = track 1 |
| 7-8 | 0xFF 0xE6 | 16-bit checksum (big-endian) of bytes 1-6 |
| 9 | 0xEF | End byte |
The player supports tracks numbered 0 through 2 999 when organized in folders 01..99/xxx.mp3. Higher counts are technically possible but degrade scan time; stay within the documented 0-2 999 envelope for a robust install.
6. Checksum Calculation
The checksum is the 16-bit two's-complement negation of the sum of bytes 1 through 6, transmitted high byte first.
Sum = VER + LEN + CMD + ACK + DH + DL
Checksum = (0x10000 - Sum) AND 0xFFFF
CH_HI = (Checksum >> 8) AND 0xFF
CH_LO = Checksum AND 0xFF
For track 1 with no acknowledgement:
Sum = 0xFF + 0x06 + 0x03 + 0x00 + 0x00 + 0x01 = 0x109
0x10000 - 0x109 = 0xFEF7
Checksum = 0xFEF7 (no overflow wrap, value fits in 16 bits)
CH_HI = 0xFE, CH_LO = 0xF7
That produces 7E FF 06 03 00 00 01 FE F7 EF. If you received a different pair (e.g., FF E6) from the player's vendor example, recompute and confirm with a Hercules round-trip test - the difference is most often an off-by-one in the length byte or a swapped byte order.
7. TIA Portal Program - Building and Sending a Frame
7.1 Data block for the transmit buffer
Create a global DB "MP3_DB" with the following structure:
DATA_BLOCK "MP3_DB"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
NON_RETAIN
STRUCT
txBuf : ARRAY[0..9] OF BYTE; // 10-byte frame
txLen : INT; // 10
playTrack : INT; // 0..2999
sendBusy : BOOL; // edge-holding bit
sendTrig : BOOL; // rising edge triggers SEND_P2P
sendDone : BOOL;
sendError : BOOL;
sendStatus : WORD;
END_STRUCT;
END_DATA_BLOCK
7.2 SCL function block - build frame and trigger send
FUNCTION_BLOCK "FB_MP3_PlayTrack"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
VAR_INPUT
iReq : BOOL; // request to play
iTrack : INT; // 0..2999
iAck : BOOL; // TRUE = request response from player
END_VAR
VAR_OUTPUT
oBusy : BOOL;
oDone : BOOL;
oError : BOOL;
oStatus : WORD;
END_VAR
VAR
sTrigOld : BOOL;
idx : INT;
tHi, tLo : BYTE;
sum16 : DWORD;
cs : DWORD;
END_VAR
BEGIN
// Clamp track to supported range
IF iTrack < 0 THEN iTrack := 0; END_IF;
IF iTrack > 2999 THEN iTrack := 2999; END_IF;
// Split track into DH/DL
tHi := WORD_TO_BYTE(SHR(INT_TO_WORD(iTrack), 8));
tLo := WORD_TO_BYTE(INT_TO_WORD(iTrack) AND 16#00FF);
// Static frame fields
"MP3_DB".txBuf[0] := 16#7E; // start
"MP3_DB".txBuf[1] := 16#FF; // version
"MP3_DB".txBuf[2] := 16#06; // length
"MP3_DB".txBuf[3] := 16#03; // cmd: play track
"MP3_DB".txBuf[4] := BOOL_TO_BYTE(iAck); // 0 or 1
"MP3_DB".txBuf[5] := tHi; // DH
"MP3_DB".txBuf[6] := tLo; // DL
// Checksum over bytes 1..6
sum16 := DWORD#0;
FOR idx := 1 TO 6 DO
sum16 := sum16 + "MP3_DB".txBuf[idx];
END_FOR;
cs := (DWORD#16#10000 - sum16) AND DWORD#16#FFFF;
"MP3_DB".txBuf[7] := WORD_TO_BYTE(SHR(DWORD_TO_WORD(cs), 8));
"MP3_DB".txBuf[8] := WORD_TO_BYTE(DWORD_TO_WORD(cs) AND 16#00FF);
"MP3_DB".txBuf[9] := 16#EF; // end
"MP3_DB".txLen := 10;
// Rising-edge trigger
IF iReq AND NOT sTrigOld THEN
"MP3_DB".sendTrig := TRUE;
END_IF;
sTrigOld := iReq;
oBusy := "MP3_DB".sendTrig;
oDone := "MP3_DB".sendDone;
oError := "MP3_DB".sendError;
oStatus := "MP3_DB".sendStatus;
END_FUNCTION_BLOCK
7.3 OB1 - call the block and SEND_P2P
Drop a SEND_P2P instance DB into OB1. The REQ pin is wired to MP3_DB.sendTrig; the FB clears the trigger inside SEND_P2P's DONE path. Inspect DONE, ERROR, and STATUS on every scan. See the S7-1200 System Manual, point-to-point chapter for the full status code list.
// Pseudo-code wiring in OB1
"iReq" := "MP3_HMI".playButton; // momentary push
"iTrack" := "MP3_HMI".trackNumber; // 0..2999
"iAck" := FALSE;
"FB_MP3_PlayTrack_DB"();
"SEND_P2P_DB"(REQ := "MP3_DB".sendTrig,
LEN := "MP3_DB".txLen,
DATA := "MP3_DB".txBuf,
DONE => "MP3_DB".sendDone,
ERROR => "MP3_DB".sendError,
STATUS=> "MP3_DB".sendStatus);
IF "MP3_DB".sendDone THEN
"MP3_DB".sendTrig := FALSE;
END_IF;
REQ from a rising edge only. A cyclic TRUE will re-arm SEND_P2P every scan and can stall or reset the player. The block above and the explicit edge in OB1 make the trigger strictly one-shot per operator press.
8. Bench Test with Hercules or Realterm
Before connecting the MP3 module, prove the bytes are correct on a PC.
- Connect the USB-to-RS485 adapter to the same CB 1214 terminals (A on adapter to A on CB, B to B, GND to M).
- Open Hercules SETUP utility, switch to the Serial tab, set 9600 8N1, click Open.
- In the Send field type the hex sequence
7E FF 06 03 00 00 01 FE F7 EFand press Send. The player - once attached - will play track 1. - Compare with the PLC's output: with the USB adapter still connected, watch the receive side in Hercules while you trigger the FB from TIA Portal online. The frame printed in the Hercules receive pane must match
7E FF 06 03 00 00 01 FE F7 EFbyte-for-byte.
Document the exact bytes the player documentation mandates. If the vendor's reference frame uses FF E6 as the checksum, calculate it yourself and check whether the difference is an older checksum variant or a misprint in the manual. Common variants include summing bytes 0-6 or using XOR. Always validate with a working bench test before trusting a single document.
9. Verification
- After download, open an online watch table on
MP3_DB. Press the play button and confirmtxBuf[0..9]equals the expected frame. - Watch
sendStatus. A clean run returns16#0000onDONEwithERROR = FALSE. A common transient is16#7000(no job active) which is normal between requests. - Listen for the track. If silence persists, swap the A and B wires - the MP3 link is polarity-sensitive on most modules.
- Trigger the same track ten times in succession. The player should respond identically and never require a power cycle.
10. Troubleshooting Matrix
| Symptom | Likely cause | Fix |
|---|---|---|
| SEND_P2P ERROR = TRUE, STATUS = 16#80C0 / 16#80C1 | Port not enabled or baud mismatch | Confirm CB 1214 "Enable" is checked and baud rate matches the player; re-download HW config |
| STATUS = 16#80A1 | Hardware fault / cable | Check A/B polarity, GND reference, and that the shield is grounded at one end only |
| Frame looks correct on Hercules but player is silent | Checksum variant or off-by-one length | Recompute per section 6; try summing bytes 0-5 only, or 1-5; verify with vendor |
| First track plays, second press hangs the player | Cyclic REQ or back-to-back frames faster than 100 ms | Use rising-edge trigger; add a 200 ms on-delay between requests |
| Random extra bytes on the bus | Missing termination on long cable | Add 120 Ω at far end; lower baud to 4800 as a test |
| Player prints gibberish in Hercules | Wrong parity or stop bits | Set 8N1; some modules ship 8N1 with inverted idle - check Line idle state in CB 1214 properties |
| sendStatus = 16#7002 / 16#7003 | Job in progress / queued | Wait one scan; the instruction will clear on the next cycle |
11. Performance and Timing Notes
- At 9 600 bps, a 10-byte frame takes roughly 10.4 ms on the wire, including start/stop bits.
- One SEND_P2P call typically completes inside one or two PLC cycles (1-10 ms OB1) once the port is free.
- Avoid queueing more than one request per scan. If you must fire several tracks, insert a small timer (>= 100 ms) between SEND_P2P invocations to let the player's command parser reset.
- The CB 1214 has a 1 024-byte internal buffer. Frames are well under that; no flow control is required for a one-way play-command stream.
12. Extending the Design
The same frame structure supports several other commands by changing byte 3 and the data payload:
| Command | Byte 3 | Payload (after ACK) |
|---|---|---|
| Pause | 0x0E | 0x00 |
| Resume | 0x0D | 0x00 |
| Stop | 0x16 | 0x00 |
| Volume up | 0x04 | 0x00 |
| Volume down | 0x05 | 0x00 |
| Set volume (0-30) | 0x06 | 0x00, vol |
| Loop track | 0x08 | 0x00, 0x01 |
Add a new branch in the FB for each command, recompute the length byte (0x03 for a 1-byte payload, 0x04 for 2-byte payloads), and rebuild the checksum. Keep the start (0x7E), version (0xFF), and end (0xEF) bytes constant.
13. Frequently Asked Questions
Do I need a Signal Board (SB) instead of a CB 1214 for the MP3 link?
No. The CB 1214 is the correct slot for adding a single RS485 point-to-point port to an S7-1200. Signal boards (SB) are 24 V digital I/O or analog, not serial. If you need a second serial port, use an SB 1241 (RS485) on the right slot - both can coexist with the CB 1214.
Can I use the S7-1200 onboard RS485 (CPU 1215C / 1217C) instead of the CB 1214?
Yes. CPUs with an integrated RS485 port use the same SEND_P2P / RCV_P2P instructions and the same 9 600 8N1 configuration. The CPU 1214C you are using has no native serial port, which is exactly why the CB 1214 is required.
What does the status word 16#80C3 from SEND_P2P mean?
It is a parity/framing error from the receiver. The most common cause on a one-way MP3 link is that the player's idle line state is inverted relative to the CB 1214. Open the CB 1214 properties and try the opposite "Line idle state" value, or add a 120 Ω termination across A/B.
Is PORT_CFG required to change the baud rate at runtime?
Only if you need to switch baud rates from the program. For a fixed 9 600 8N1 audio link, configure the port once in the device view and do not call PORT_CFG in the user program. Calling it from a cyclic OB causes a recurring reconfiguration that some MP3 modules interpret as noise.
How do I confirm the checksum I generate is correct?
Use the bench test in section 8. Connect a USB-to-RS485 adapter to the CB 1214, open Hercules, and send the frame. If the player responds correctly, the checksum is correct. If not, recompute and try the alternative variants (sum bytes 1-5 or 1-6) until the player accepts the frame.