CP 443-5 RS-232 RS-485: S7-400 Serial Communication Guide

Problem Definition: Why CP 443-5 Cannot Read RS-232/RS-485 Serial Data

The question "Can I read data on RS-232 or RS-485 using CP 443-5?" is one of the most common misapplications of the SIMATIC S7-400 communication processor family. CP 443-5 is a Profibus DP master module designed exclusively for the Profibus protocol on a two-wire RS-485 physical layer; it does not expose a general-purpose serial character stream that a user program can read as ASCII or Modbus frames. Confusing the physical connector (a 9-pin Sub-D that happens to be wired to RS-485 transceiver pins) with a programmable UART is the root cause of the question.

The CP 443-5 implements Profibus DP-V0/V1 master functionality according to IEC 61158/EN 50170. Its on-board ASIC is the Profibus ASPC2 (or its successor, the DPC31) - a hardware state machine that handles token passing, telegram encoding (NRZ, 9.6 kbit/s to 12 Mbit/s), and DP slave diagnostics. There is no accessible shift register, no user-configurable baud rate generator, and no Modbus RTU interpreter inside the module. Trying to "tap" serial traffic from the CP 443-5 is therefore architecturally impossible without a separate Profibus-to-serial gateway.

CP 443 Module Family Identification

Before selecting any alternative, verify exactly which CP 443 variant is installed in the S7-400 rack. Each variant is dedicated to one bus type:

Note the consistent answer across the family: none of these modules presents a user-accessible serial UART. The selection below therefore must come from outside the CP 443 family.

Solution 1: Install a CP 441 Serial Communication Module

The Siemens-designated answer to point-to-point serial communication on the S7-400 is the CP 441 module family. The CP 441 plugs into any free slot in the S7-400 central rack or expansion rack, occupies 16 bytes of I/O address space (configurable), and provides one or two fully programmable serial channels.

CP 441 Variants

Both modules use a 15-pin Sub-D female connector on the front panel. The interface type is selected by inserting the appropriate sub-module (T-socket adapter) shipped with the module: a V.24 adapter for RS-232, or an X27 adapter for RS-422/485. Each adapter is a small PCB that converts the internal TTL-level UART to the differential signaling required by RS-485.

The CP 441 supports ASCII, 3964(R), and RK-512 protocols natively through loadable drivers. Modbus RTU and Modbus ASCII master/slave drivers are available as a separately licensed option (see "Modbus Master/Slave for CP 441", order number 6ES7870-1AA01-0YA0).

CP 441 Technical Specifications

Solution 2: Profibus-DP to Serial Gateway

If installing a CP 441 is not feasible (slot full, budget, lead time), a Profibus-DP slave gateway can convert serial traffic into Profibus cyclic I/O. The CP 443-5 polls the gateway like any DP slave and presents the received bytes in the process image.

Common third-party gateways include:

• Siemens DP/AS-i Link 20E (6GK1415-2AA10) - bridges DP to AS-Interface, not directly serial but useful for low-level sensor data.
• Helmholz RPI 3964R-DP gateway - converts RS-232/422/485 to Profibus DP, supports 3964R protocol.
• ProSoft Technology ILX34-PBM - Modbus RTU master/slave on RS-232/485 to Profibus DP.
• Woodhead/Brad Harrison APBI-DP - generic serial-to-DP bridge.

The functional penalty: only a small cyclic data window (typically 32-244 bytes per direction, depending on DP configuration) is passed through. Frames longer than that must be segmented in the PLC user program. There is no native Modbus RTU master - the gateway emulates one with a limited buffer, and timing characteristics differ from a CP 441 (DP scan time vs. serial byte time).

Solution 3: Smart Profibus Slave with Integrated Serial Port

A low-cost alternative is a Profibus DP slave that exposes a serial port on its own front panel. The Siemens ET 200S with a 1SI serial interface module (6ES7138-4DF01-0AB0) is a textbook example. It sits on the Profibus network as a slave, and the PLC reads/writes the serial bytes as 32 bytes of cyclic I/O.

Configuration steps:

1. Mount the ET 200S IM 151-1 (Profibus interface module) on DIN rail.
2. Add the 1SI serial module in a free slot of the ET 200S.
3. Insert the appropriate Siemens serial sub-module (RS-232 6ES7138-4DF00-0AB0 or RS-422/485 6ES7138-4DF01-0AB0).
4. Configure the 1SI in STEP 7 with HW Config: assign Profibus address, set baud rate, protocol (ASCII, 3964R, Modbus RTU master/slave).
5. Read incoming bytes from the 1SI's input word range via standard SFC 14 / SFC 15 calls.
6. Configure CP 443-5 as the DP master and ensure the ET 200S GSD file is installed in the STEP 7 catalog.

This approach leverages the existing CP 443-5 without firmware changes. The CP 443-5 continues to act as DP master; the 1SI looks like a 32-byte I/O slave. The trade-off is increased Profibus cycle load and the inability to support protocols longer than the 32-byte window per cycle.

RS-232 vs RS-485: Electrical and Protocol Differences

Before connecting any device, match the electrical standard exactly. Mismatched signaling is the #1 cause of "I connected it but got no data" calls.

RS-485 termination pitfalls: A Profibus network uses 220 Ω termination; a generic RS-485 Modbus network uses 120 Ω. Mixing the two resistor values on the same cable changes the impedance and produces signal reflections. See the Siemens TIA Portal documentation on RS232/RS422/RS485 for the wiring diagrams applicable to SIMATIC interfaces.

CP 441 Configuration in STEP 7 / TIA Portal

Configuration is identical conceptually between classic STEP 7 V5.5 and STEP 7 (TIA Portal) V16+. The procedure below uses TIA Portal nomenclature.

Hardware Configuration

1. Open the S7-400 station in the project tree.
2. In the device view, drag the CP 441-1 or CP 441-2 from the catalog (Hardware Catalog → SIMATIC S7-400 → Communication → CP 441) into a free slot.
3. Right-click the module → Properties → "Serial Interface" tab.
4. Select the interface type: V.24 (RS-232) or X27 (RS-422/485).
5. Set the baud rate, parity, data bits, stop bits, and the protocol driver (ASCII, 3964R, RK-512, or Modbus master/slave).
6. Compile the hardware configuration and download to the CPU.
7. Note the I/O start address (LADDR) shown in the device view - this is the parameter passed to FB 7/FB 8.

Software Interface (LAD/FBD/ST)

Two function blocks are needed: FB 7 "P_RCV_RK" / "P_RCV" for receiving, and FB 8 "P_SND_RK" / "P_SND" for transmitting. Both are supplied with the CP 441 Param tool and copied into the project during the CP 441 setup wizard.

// Receive ASCII data on CP 441-1, channel 1
DATA_BLOCK DB_PRCV
STRUCT
   START    : BOOL;          // start trigger
   DONE     : BOOL;          // operation complete
   ERROR    : BOOL;          // error flag
   STATUS   : WORD;          // status word (0x0000 = OK)
   LADDR    : INT  := 256;   // I/O start address from HW config
   DB_NO    : INT  := 100;   // receive DB
   DBB_NO   : INT  := 0;     // start byte in DB
   LEN      : INT  := 200;   // max bytes to receive
   RCV_T    : DWORD := T#2s; // timeout
END_STRUCT
END_DATA_BLOCK

CALL "P_RCV", DB_PRCV
   START  := M10.0
   DONE   := M10.1
   ERROR  := M10.2
   STATUS := MW12
   LADDR  := 256
   DB_NO  := 100
   DBB_NO := 0
   LEN    := 200
   RCV_T  := T#2s

The STATUS word is the prime diagnostic: 0x0000 = OK, 0x0E01 = receive timeout, 0x0E02 = framing error, 0x0E03 = parity error, 0x0E08 = buffer overflow. Cross-check against the CP 441 manual's STATUS table.

Serial Protocol Selection on CP 441

Wiring and Termination

For RS-485 multidrop Modbus, the correct termination is non-negotiable. A standard Profibus purple cable uses 220 Ω; a generic RS-485 cable (e.g., Belden 3106A) uses 120 Ω. Never reuse Profibus segments for serial traffic without re-terminating.

Bias resistors (typically 560 Ω to +5 V on A and 560 Ω to GND on B, or 390 Ω + 680 Ω divider pairs) must be present to keep the bus in a defined idle state. The AutomationDirect ACN drive RS-485 wiring chapter shows a textbook bias + termination network for a master-side terminator.

Modbus RTU Master Example on CP 441

Reading a Modbus holding register from a flow meter (slave address 17, register 0x0001) using CP 441 requires only the licensed Modbus driver plus one FB call per transaction.

// Function code 03 (Read Holding Registers), slave 17, register 1, count 2
CALL "MODB_MAST" , DB_MODB
   REQ    := M20.0           // rising edge starts the transaction
   CONT   := TRUE            // keep CP active between calls
   LADDR  := 256             // CP 441 I/O start address
   SLAVE  := 17              // Modbus slave address
   MODE   := B#16#03         // function code 03
   DATA_PTR := P#DB100.DBX0 BYTE 6  // Tx/Rx buffer: 1B slave + 1B FC + 2B start + 2B count
   DONE   := M20.1
   ERROR  := M20.2
   STATUS := MW22
   WRITE_READ := FALSE       // read operation

For multi-slave polling, increment the SLAVE parameter inside an FB cycle and call MODB_MAST cyclically at OB1 priority. Response bytes land at DATA_PTR + 5 of the user buffer. See the Modbus Master/Slave for CP 441 manual for the full buffer layout and STATUS codes.

Troubleshooting Matrix

Commissioning Verification Steps

After configuring the CP 441, perform the following sequence to verify the serial channel:

1. Connect a loopback plug (TX → RX on the same channel) and verify P_SND/P_RCV returns STATUS 0x0000 with the test pattern intact.
2. Remove loopback; connect the actual field device. Verify that the SF LED on the CP 441 is OFF.
3. Trigger a single transmit from the CPU and confirm the device receives the bytes (logic analyzer on the line).
4. Trigger a receive from the device and confirm P_RCV DONE bit sets within the configured timeout.
5. Run the system for 24 hours with diagnostics enabled (CP 441 → Properties → Diagnostics → "Frequent diagnostics") and review the CP 441 event log via the CP 441 Param tool.
6. If Modbus RTU, run a single register poll continuously for 1 hour and compare CRC failures to total transactions; allow < 1 error per 100,000 frames for a healthy link.

Frequently Asked Questions