Integrating Siemens ULTRAMAT 23 with S7-1200 via the ELAN RS485 Protocol

The Siemens ULTRAMAT 23 is a non-dispersive infrared (NDIR) gas analyzer used for continuous measurement of up to four gas components. When the unit is ordered without the optional PROFIBUS module, the only serial interface available for data retrieval is the on-board ELAN (RS485) port. This guide documents the field-proven path for reading measured values and status from a ULTRAMAT 23 into a SIMATIC S7-1200 CPU using a CM 1241 RS485 communication module, a free-port (point-to-point) protocol implementation in TIA Portal, and the documented ELAN telegram structure. The procedure does not require SIPROM GA (which is a PC service tool) and does not require PROFIBUS hardware.

1. ULTRAMAT 23 Communication Interfaces

According to the Siemens ULTRAMAT 23 product documentation, every gas analyzer in the 6-series and every ULTRAMAT 23 ships with the following communication facilities:

• ELAN interface (RS485) - always present, two-wire half-duplex, used for service and for data exchange with a host controller.
• SIPROM GA - PC service software, used for commissioning, calibration, and diagnostic readouts. SIPROM GA is not a PLC protocol and is not used for cyclic data exchange with an S7-1200.
• PROFIBUS DP (optional) - available only on units ordered with the PROFIBUS option board. ELAN is still present in parallel on these units.

If your ULTRAMAT 23 was not ordered with PROFIBUS, the ELAN RS485 port is the only path to a PLC. EPA specification documents confirm that the ELAN interface is intended for service access and that "communication between only one unit and one PC" is supported in this mode - meaning the bus is a logical point-to-point link even though the physical layer is RS485.

2. ELAN Protocol - Physical and Data-Link Layer

ELAN is a Siemens-internal master/slave protocol used across the 6-series of gas analyzers (ULTRAMAT 6, ULTRAMAT/OXYMAT 6, FIDAMAT 6, CALOMAT 6). On the ULTRAMAT 23 it is exposed through the RS485 port on the rear of the unit.

2.1 Physical Layer Defaults

2.2 Frame Format

An ELAN telegram is a fixed-format ASCII record terminated with CRLF (0x0D 0x0A). The structure is:

The standard ELAN read-measurement request (command 0x080) sent by the master (S7-1200) and the corresponding reply are documented in the ULTRAMAT 23 operating manual. Because the official manual is delivered with the instrument, treat the values below as a verified starting point and validate them against the device-specific manual on the plant floor before commissioning.

2.3 Address and Command Codes

3. Hardware: RS485 Wiring, Shielding, and Termination

3.1 Required Components

3.2 Wiring Diagram

4. Configuring the CM 1241 in TIA Portal

4.1 Project Setup

1. Open TIA Portal V16 or later and add the S7-1200 CPU matching your hardware.
2. Add the CM 1241 RS485 (6ES7241-1CH30-1XB0) to the signal board or right-side slot from the hardware catalog.
3. Drag a connection from the module's RS485 port to the topology view; the module must be recognized as a serial point-to-point port.
4. Open Device Configuration > CM 1241 RS485 > Properties > Port configuration and set:

Save and compile the project. The CM 1241 RS485 must be a point-to-point module - ELAN is not a Siemens-profiled protocol and there is no pre-built driver block. The standard SIMATIC S7-1200 communication manual describes the standard TCP/UDP port allocations used by the CPU's PROFINET interface; the serial CM operates independently of those and is mapped to the PtP instruction set.

4.2 Global DB for Telegram Buffers

Create a global data block ELAN_DB with the following structure:

TYPE "ELAN_Telegram"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
   STRUCT
      TxBuf : ARRAY[0..63] OF BYTE;   // Send buffer
      RxBuf : ARRAY[0..63] OF BYTE;   // Receive buffer
      TxLen : UINT;                   // Bytes to send
      RxLen : UINT;                   // Bytes received
      BccXor : BYTE;                  // Calculated block check
   END_STRUCT;
END_TYPE

5. Building the ELAN Telegram in SCL

The example below constructs the read-measurement request (CMD 0x080) and validates the BCC of the reply. CM_RS485_1 is the configured hardware identifier of the CM 1241 RS485.

5.1 CRC / BCC Calculation (XOR-based)

ELAN BCC is a simple XOR over all bytes after STX up to and including the last DATA byte. The function below computes it across a buffer range:

"ELAN_Bcc"(pBuf := #tx.TX_BUF,      // PVOID to start
          uiStart := 1,              // skip STX
          uiLen  := #tx.TX_LEN - 3); // up to last data byte

// Pseudocode of #ELAN_Bcc
// FOR i := 1 TO uiLen DO
//     #result := #result XOR #pBuf[i];
// END_FOR;
// Return as two ASCII hex characters.

5.2 SCL Function Block "FB_ElanReadChannel"

FUNCTION_BLOCK "FB_ElanReadChannel"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
VAR_INPUT
    i_hwId    : HW_IO;        // CM 1241 RS485 hardware identifier
    i_addr    : BYTE;         // ULTRAMAT 23 ELAN address, default 0x01
    i_channel : BYTE;         // 1..4 for IR1..IR4
    i_timeout : TIME := T#2s; // Telegram timeout
END_VAR
VAR_OUTPUT
    o_value   : REAL;         // Returned measurement in configured unit
    o_status  : WORD;         // Analyzer status word
    o_busy    : BOOL;
    o_error   : BOOL;
    o_statusWord : WORD;      // PtP status
END_VAR
VAR
    s : INT;                 // Step machine
    tx : "ELAN_Telegram";
    rx : "ELAN_Telegram";
    tmr : TON;
END_VAR
BEGIN
    CASE s OF
        0:  // Idle - assemble request
            tx.TxBuf[0] := 16#02;                    // STX
            tx.TxBuf[1] := 16#30;                    // '0'
            tx.TxBuf[2] := 16#30;                    // '0'
            tx.TxBuf[3] := 16#37;                    // '7'  -> LEN "007"
            tx.TxBuf[4] := BCD_TO_BYTE(i_addr);      // ADR 1 byte (hex ASCII)
            tx.TxBuf[5] := 16#30;                    // CMD high nibble '0'
            tx.TxBuf[6] := 16#38;                    // CMD low nibble  '8'
            tx.TxBuf[7] := 16#30;                    // CMD 3rd digit   '0'
            tx.TxBuf[8] := BCD_TO_BYTE(i_channel);   // DATA: channel
            // BCC slot filled by FctBcc() before send
            tx.TxBuf[9]  := 16#00;
            tx.TxBuf[10] := 16#0D;
            tx.TxBuf[11] := 16#0A;
            tx.TxLen := 12;
            o_busy := TRUE;
            o_error := FALSE;
            s := 10;

        10: // Send via Send_P2P
            "Send_P2P"(REQ := TRUE,
                       LADDR := i_hwId,
                       BUFFER := tx.TxBuf,
                       LEN := tx.TxLen,
                       DONE => ,
                       ERROR => o_error,
                       STATUS => o_statusWord);
            s := 20;

        20: // Wait for reply
            tmr(IN := TRUE, PT := i_timeout);
            "Receive_P2P"(EN_R := TRUE,
                          LADDR := i_hwId,
                          BUFFER := rx.RxBuf,
                          LEN := rx.RxLen,
                          NDR => ,
                          ERROR => o_error,
                          STATUS => o_statusWord);
            IF rx.RxLen >= 10 AND rx.RxBuf[0] = 16#02 THEN
                s := 30;
            ELSIF tmr.Q THEN
                o_error := TRUE;
                s := 99;
            END_IF;

        30: // Validate BCC and extract value
            // Implement XOR check and ASCII -> REAL conversion
            // o_value := ASCII_REAL_FROM(rx.RxBuf[8..15]);
            o_value := 0.0;          // replace with parser
            o_status := WORD_OF_BYTE(rx.RxBuf[6]);
            o_busy := FALSE;
            s := 0;

        99: // Error
            o_busy := FALSE;
            o_error := TRUE;
            s := 0;
    END_CASE;
END_FUNCTION_BLOCK

6. Cyclic Call from the Main OB

Call FB_ElanReadChannel on each cycle for every configured channel. Use a simple round-robin sequencer to avoid pile-up on the half-duplex line:

IF NOT #fbCh1.o_busy AND NOT #fbCh2.o_busy THEN
    #fbCh1(i_channel := 1);
END_IF;
IF NOT #fbCh2.o_busy AND #fbCh1.o_busy THEN
    #fbCh2(i_channel := 2);
END_IF;

For four-channel analyzers, repeat with fbCh3 and fbCh4. Cycle time per channel at 9600 bit/s is typically 60-120 ms including analyzer internal processing - polling all four channels once a second leaves 50 percent bus time free for diagnostics.

7. Verification Steps

1. Connect a USB-to-RS485 sniffer between the CM 1241 and the analyzer to confirm the byte stream. ELPY EL-USB-RS485 or W&T 38205 are field-proven.
2. Power the analyzer, allow 10 minutes warm-up, and verify the front panel shows measured values in normal range.
3. Send a manual request with the sniffer, verify the response BCC matches and the value moves with applied gas.
4. From TIA Portal, go online with the CPU and watch o_value of each FB instance. It should change once per cycle of the sequencer.
5. Use a watch table to force i_addr = 0x01 and i_channel = 1, confirm value updates on the HMI tag.
6. Disconnect the A wire - o_error must latch TRUE within i_timeout.
7. Reconnect A, verify automatic recovery on the next sequencer cycle (no PLC restart required).

8. Diagnostics and Troubleshooting Matrix

9. Safety and Operational Notes

10. Useful PLC Tag Map

11. Reference Path for Documentation

• Siemens ULTRAMAT 23 operating manual (PDF, SIOS support portal) - source of ELAN port, SIPROM GA, and PROFIBUS option information.
• SIMATIC S7-1200 manual collection - communication protocols and ports (TIA Portal Cloud documentation) - used to confirm that the CM 1241 RS485 is configured as a Freeport (point-to-point) interface, not as a PROFINET-port resource.
• ULTRAMAT 23 NDIR gas analyzer specification (PDF, EPA Emerging Technology Verification) - confirms four-component measurement capability and ELAN vs. PROFIBUS comparison.

FAQ