Implementing Modbus ASCII Communication with S7-1200 PLC

Overview

The challenge described in the source material — a Siemens S7-1200 CPU trying to read and write a third-party device (a PRO2 Valley irrigation control panel) that only exposes Modbus ASCII on an RS-232 port — is one of the most common Siemens Industrial Online Support requests for serial instrumentation. The S7-1200 Modbus instruction library (MB_MASTER, MB_SLAVE, FB 1100, FB 1101) is hard-coded for Modbus RTU and rejects ASCII frames because the character framing is fundamentally incompatible (7 data bits, LRC checksum, framed by : and CRLF characters vs. 8 data bits, CRC16, framed by 3.5-character silent intervals). Four viable hardware / firmware paths exist:

1. Replace the head CPU with an ET200S IM151-8 PN/DP and add a 1SI Modbus ASCII module (the cleanest no-code-change solution).
2. Add an external CP340 / CP341 behind a S7-300 or S7-400 with the loadable Modbus ASCII driver.
3. Use a third-party Modbus ASCII ↔ Modbus RTU / TCP gateway (Anybus X-gateway, HMS Communicator) so the S7-1200 can speak RTU.
4. Keep the S7-1200 in place but drive its RS-232 CM 1241 in Freeport mode with custom user code that assembles the LRC, ':' and CRLF characters manually using Send_P2P/Receive_P2P.

This reference compares the four options side-by-side, gives the frame-by-frame differences engineers must respect, lists concrete catalog numbers and configuration values, and provides a commissioning checklist that works for a PRO2 Valley panel or any similar Modbus ASCII only device.

Modbus ASCII vs Modbus RTU — Fundamental Differences

Modbus is a single-master multi-drop application-layer protocol defined by Modicon in 1979 and still actively published as Modbus Organization reference material and on the Modbus Protocol specification pages. The difference between ASCII mode and RTU mode is purely a transmission choice; the PDU (function code, register space, coils, input registers) is identical, which is why a transparent protocol converter works.

An RTU-only Modbus master will simply fail to interpret the leading : of an ASCII frame: the MB_MASTER instruction in TIA Portal measures inter-character timeouts relative to one byte at 8 bits, so a 7-bit ASCII slave will silently drop or jam the bus.

Why the S7-1200 Instruction Library Cannot Handle Modbus ASCII

The S7-1200 Modbus library shipped from firmware V1.0 of the CM 1241 / CB 1241 modules is the S7-1200 Modbus Master/Slave library exposed in TIA Portal under Instructions > Communication > Communication Processor > Modbus. The instructions physically force the CM 1241 port into 8-bit data mode and manage the RTU silent interval timers. No TIA Portal option exposes a 7-bit ASCII variant. The library calls are:

• MB_MASTER (FB 1100 / earlier MB_MASTER_v2_v3_v4) — issues function codes 01, 02, 03, 04, 05, 06, 15, 16.
• MB_SLAVE (FB 1101) — Passive server mode for the S7-1200 side.
• MB_CLIENT / MB_SERVER — Open user communication on the CPU's PROFINET port for Modbus TCP.

None of these blocks generate LRC, none accept a : start byte, and none of the CM 1241 hardware parameters in the device configuration allow selection of 7E1 framing. This is a documented constraint in the S7-1200 System Manual. Therefore any Modbus ASCII master strategy requires either a different Siemens hardware (ET200S 1SI, CP341) or a third-party conversion layer.

Solution Path A — ET200S IM151-8 PN/DP plus 1SI ASCII Module (Recommended)

Hardware

• IM 151-8 PN/DP CPU — Siemens catalog number 6ES7151-8AB00-0AB0 or 6ES7151-8FB00-0AB0 (later revision). Acts as a PROFINET I/O device under the S7-1200 (as a PROFINET IO controller), so it appears in TIA Portal just like a remote rack. The program inside the IM 151-8 still controls the 1SI directly.
• ET200S 1SI Modbus / USS ASCII module — Catalog 6ES7138-4DF01-0AB0 (older 6ES7138-4DF00-0AB0 also works). The 1SI can be configured as Modbus Master or Modbus Slave in either ASCII or RTU; what the application needs is Modbus ASCII Master.
• Terminal module — 6ES7193-4CA00-0AA0 (screw) or 6ES7193-4CA10-0AA0 (spring) for the 1SI.

Configuration in TIA Portal

1. Insert the IM151-8 from the catalog under Other Controllers > ET200S as a PROFINET device on the S7-1200 network.
2. Slot 1: 1SI 9.6 KBd Modbus/USS ASCII — slot configured in device view.
3. Open the 1SI properties > Protocol: select Modbus master (not USS).
4. Open Interface: set Frame = 7E1 for PRO2-class devices; if the panel demands 7N2 see its manual.
5. Open Addresses for the input data. The 1SI places receive register 4 words above the start in the IM151-8 I area.

Function Blocks Shipped With the 1SI

The 1SI Modbus/USS ASCII ships with its own step-7-compatible FB library downloadable from Siemens support. The principal blocks are:

• S_SI (FB 200 standard) or S_MODB (FB 202) — Send Modbus frame / initiate request.
• R_SI / R_MODB — Receive response.
• S_USS / R_USS — For the USS parameter channel on inverter drives (does NOT apply here).

Example SCL call for Holding Register 40001 read of PRO2 panel

// FB R_MODB call from cyclically triggered OB1
// Slave = 1, Function Code = 03 (Read Holding Register)
// StartAddress = 0 (PRO2 maps 40001 = offset 0)
// Qty = 8 (8 registers = one telemetry block)

#Status      := 16#0000;      // initial state machine
#Req         := TRUE;         // one-shot per OB cycle
#Unit        := 1;            // 1SI slot number (rack position)
#Slave       := 1;            // PRO2 Modbus address
#Function    := 3;            // Read Holding Register
#DataPtr     := P#DB100.DBX 0.0 BYTE 16; // 8 words destination
#DataLen     := 16;
#Start_Addr  := 0;

// R_MODB also returns:
// .Done  BOOL  -> one-shot success
// .Error BOOL  -> check StatusWord
// .Rd_DB / .Rd_Adr / .Rd_Len show where the response buffer lives

Acceptance / verification

In online > monitor R_MODB, .Error=0 and .Status=16#0700 (or whatever codes the Siemens FB returns for "request finished with no error") indicates a live bus. Place a Watch table on the data DB; values must update every cycle at the configured polling rate.

Solution Path B — S7-300 / S7-400 with CP341 and Loadable Modbus ASCII Driver

Hardware

• CP 341: order numbers 6ES7341-1AH01-0AE0 (RS-232C/RS-422, ASCII driver applicable), 6ES7341-1CH01-0AE0 (RS-422/RS-485), or 6ES7341-1BH01-0AE0 (20 mA current loop).
• Loadable driver: 6ES7870-1AC01-0YA0 ("Modbus ASCII Master, 16-bit") or the matching Slave version. The license is hardware-bound to the CPU serial number of the CP341.
• RS-232 null-modem cable from CP341 port to PRO2 DB9 (see cabling section below).

Project integration

1. Open the CP341 in HW Config > Properties > Protocol; load the MODB_MAST.EXP driver via the supplied Parameterization Tool (the PT runs in standalone mode and writes the database back into HW Config as a system data block).
2. The parameter tool forces 7E1 framing and sets the slave number prefix.
3. From STEP 7, call FB 80 P_SEND / FB 81 P_RCV to drive the raw channel, or the Modbus-specific wrapper FBs FB 82 MODBMA4 / FB 83 MODBSLA that the driver library supplies.

Typical master request through FB 82

Any non-zero STATUS value is documented in the CP341 manual appendix. Common values: 0x8001 slave timed out, 0x8101 LRC mismatch, 0x8103 framing error on the wire.

Solution Path C — Modbus ASCII to Modbus RTU Gateway (Anybus Communicator)

A protocol converter sits on the RS-232 side, parses the ASCII frames, and re-emits them as Modbus RTU on a chosen downstream interface (RTU over RS-485 or Modbus TCP). The S7-1200 then talks to the gateway over its native CM 1241 RS-485 with MB_MASTER.

Hardware Candidates

• Anybus X-gateway Modbus TCP / EtherNet/IP with a free serial sub-port (e.g., ABC3012 RS-232 sub-port).
• HMS Anybus Communicator family — configurable as Modbus ASCII Master on the serial port, Modbus TCP/RTU on the network port. The standard PN, EtherNet/IP, Modbus TCP variants are listed on the Anybus Communicator product page.

Configuration Workflow

1. Install Anybus Configuration Manager X on a Windows PC.
2. Select Sub-network > Modbus RTU (Master) on the network port facing the S7-1200, and Modbus ASCII (Master/Slave) on the serial port facing the PRO2.
3. Import a Modbus map: for every register the PRO2 exposes, define a node > register > mapping line (target node / register).
4. Set serial framing: 9600 / 19200 baud to match the PRO2, 7E1.
5. Set cycle time and request order for cyclical reads.
6. Download the configuration to the gateway and power-cycle it.

S7-1200 Side Configuration

The gateway will appear either as a Modbus TCP node (port 502) or as a Modbus RTU node on RS-485. Configure MB_MASTER on the S7-1200 to poll the gateway with function codes 03 (holding), 04 (input), 02 (input status), or 01 (coil) depending on the PRO2 map you built on the gateway. Coils and discrete inputs are essentially ignored because the PRO2 panel exposes simulation but the field wires connect only to registers; keep the gateway map unidirectional for register read/write.

Solution Path D — S7-1200 CM 1241 in Freeport Mode (Custom ASCII Implementation)

If the goal is to keep the CPU as S7-1200 only (no ET200S, no extra CP), the CM 1241 can be operated in Freeport (point-to-point) mode via the user library S7-1200 Basic Controller Communication — PtP. This is the path taken on factory automation lines where the control panel is more than 20m away and you already have a Freeport-capable CM 1241.

Steps

1. Insert a CM 1241 RS-232 (order 6ES7241-1AH32-0XB0) into the S7-1200 rack and configure its device properties: Protocol = Freeport, Baudrate = 9600 (or whatever the panel requires), Parity = Even, Data bits = 7, Stop bits = 1.
2. Add the instruction RCV_PTP for receiving, and SEND_PTP for transmitting. Both are in the PtP instruction tree in TIA Portal.
3. Implement in SCL an LRC calculation function: take all bytes between : and CR LF, cast to bytes, modulo-256 two's complement.
4. Build the transmit buffer as ASCII. Example for "Read Holding Register 0, 8 words, slave 1":

// ASCII-frame buffer (all hex nibbles as ASCII)
// Request bytes (after the leading colon ':', before LRC):
// 01 03 0000 0008
// So the full hex character stream the wire must carry is:
// 3A 30 31 30 33 30 30 30 30 30 30 30 38 LRC_HI LRC_LO 0D 0A
// where LRC is the two's-complement modulo 256 of the SUM of bytes 0..12.

// Pseudo-code
FUNCTION_BLOCK FB_BuildModbusAscii
VAR
    txBuf  : ARRAY[0..16] OF BYTE := (
        16#3A,  // ':'
        16#30, 16#31,  // '0','1'  = slave 1
        16#30, 16#33,  // '0','3'  = function 03
        16#30, 16#30, 16#30, 16#30,  // '0','0','0','0' = address 0
        16#30, 16#30, 16#30, 16#38,  // '0','0','0','8' = qty 8
        16#??, 16#??,  // LRC ASCII HI/LO nibbles
        16#0D, 16#0A); // CR LF
END_VAR

5. Calculate LRC: LRC = (256 - ((SUM of all bytes) MOD 256)) MOD 256; convert the LRC byte to two ASCII hex characters and append before CRLF.
6. Use SEND_PTP(REQ:=TRUE, BUFFER:=#txBuf, LEN:=17, PORT:=...) when Ready.
7. Configure RCV_PTP with a start condition of 0x3A and end condition of 0x0D 0x0A so the receive instruction times the silent interval to the LF byte.
8. Verify LRC of incoming frames and check function code byte to drop exception responses (FC | 0x80).

Drawbacks: every project must re-write the same LRC and frame builder, status/error code coverage is worse than the Siemens libraries, and performance is lower because Freeport lacks DMA buffering. For one-off PRO2 integration this is acceptable; for production cells it is not.

Modbus ASCII Frame Anatomy (Reference for Verification)

An oscilloscope trace on the TX line will show 17 bytes of traffic (assuming a 4+nibble data length) with regular tiny gaps between ASCII characters; a bus analyzer (Accutek, Pitekom) will de-multiplex the LRC and confirm it. Modbus tools such as the Modbus Master / Modbus Poll toolkit can also log ASCII frames directly for debugging from a PC during commissioning.

RS-232 Cabling Between PRO2 and Master (DB9 Wiring)

The PRO2 Valley panel presents an RS-232 DB9 male DTE connector. Pin mapping standard for DTE-like device:

To connect to a CP341 RS-232 (DTE), wire a null-modem cable: TX-to-RX crossed, RX-to-TX crossed, RTS-to-CTS crossed, DTR/DSR crossed, GND-to-GND straight. On an ET200S 1SI (which uses Phoenix screw terminals labeled A+ A- / TX RX), the same logic applies: cross the directions.

Implementation Comparison Matrix

Engineering Recommendation Order

1. If the S7-1200 was selected only because of its CPU price and is otherwise an ET200S-friendly PROFINET controller, deploy the ET200S IM151-8 + 1SI. This is the lowest-risk option from a Siemens-vendor standpoint and reuses the same TIA Portal project.
2. If the system already has a free S7-300 or S7-400 slot, the CP341 + Modbus ASCII driver is the standard solution; documentation exists for both the Master and Slave variants.
3. If the S7-1200 is fixed and the panel is more than a few meters away, deploy an Anybus ASCII-to-RTU gateway on the panel side and standard RTU on the S7-1200 side. This avoids any custom code.
4. Use the S7-1200 Freeport option only when there is one panel and zero willingness to buy hardware; document the LRC function so other engineers can read it.

Verification and Commissioning Procedure

1. Static checks

• Confirm DB9 pin mapping with a multi-meter (continuity between chassis GND and pin 5).
• Confirm the baud rate selection on the PRO2 (typically 9600/19200 set via the panel keypad). Match the master.
• Confirm the panel is in Modbus ASCII mode (not Modbus RTU, not ECLink/VLan); there is usually a menu item.
• Confirm the slave ID the PRO2 responds to (default 1, but consult the Valley PRO2 manual page on Communication).

2. Dynamic checks

1. Connect the previously-tested MODSCAN32 (already proven by the source user) to the same RS-232 port; read holding register 0 and confirm it changes when you press keys on the panel. This confirms the panel side is alive.
2. Swap the cable to the chosen master (1SI/CP341/CM 1241) and observe status LEDs or status words.
3. Drive a single read (function 03, address 0, qty 1) and check the returned register value matches what MODSCAN reported.
4. Drive a single write (function 06, register 0 to a known value) and verify the panel screen or MODSCAN reflects the change.

3. Stress checks

• Sustained continuous read for at least 1 hour at a 100-ms cycle. Look for rising LRC error rates, an indication of electrical noise from VFD cables — add ferrite cores if so.
• Reboot the panel mid-polling; confirm the master recovers without operator intervention.
• Disable and re-enable the polling DB to confirm the master re-establishes cleanly.

Common Fault Code Mapping

FAQ