Resolving CM 1241 RS232 Truncation with Zebra LS2208 Scanner

1. Problem Overview

A common field issue when integrating a Zebra (formerly Motorola/Symbol) LS2208 handheld barcode scanner with a SIMATIC S7-1200 CPU through a CM 1241 RS232 communications module is partial-data reception: the receive DB ends up holding only the trailing three characters of every scan (for example, the barcode 72-71882-01 arrives as -01). The RCV_PTP instruction reports a successful reception, the LED on the CM 1241 flashes once per scan, and Hyperterminal displays the complete string without alteration, which makes the symptom point at the PLC-side interface or cabling rather than the scanner firmware.

The root cause sits in the interaction between the scanner's default handshaking expectation and the cable shipped with the LS2208. The vendor-supplied cable (CBA-R02-C09PAR, an RJ48 to DB9 RS232 coiled cable) wires the full RS232 signal set, including RTS/CTS and DTR/DSR. The CM 1241 RS232 does not actively drive these handshake lines in the same way a PC COM port does, so the scanner either stalls mid-transmission or drops leading characters when it does not see the expected clear-to-send behaviour. The cure is to limit the physical cable to the three-wire minimum (pins 2, 3, and 5 of the DB9) and to match the scanner's Flow Control host parameter to None.

2. CM 1241 RS232 Hardware Characteristics

The CM 1241 RS232 (order number 6ES7241-1AH32-0XB0) is a plug-in communications module that occupies one slot of the S7-1200 CPU. The on-board RS232 transceiver is designed for point-to-point full-duplex serial communication and exposes a female DB9 connector on the front bezel. The relevant electrical and protocol limits per the S7-1200 Manual Collection CM 1241 RS232 specifications are summarised below.

Three important behavioural points are implied by the table:

1. The transceiver is RS232-compliant and tolerates ±30 V on RxD, so a passive cable rewire cannot damage the port.
2. Hardware handshaking is optional: the port will transmit and receive correctly with no RTS/CTS loopback as long as the connected device does not assert flow control.
3. Default TIA Portal project configuration sets Flow control = None in the module properties unless the engineer explicitly changes it. This is the configuration that should be paired with a 3-wire scanner cable.

3. Zebra LS2208 Scanner Defaults

The LS2208 is a rugged linear-imaging scanner. Per the Zebra LS2208 Quick Start Guide (MN000753A04EN), the device automatically detects the host interface type by examining the cable and the incoming signal levels. With the RS232 cable fitted, the scanner scans host-interface parameter set Host = RS-232 by default. The default sub-parameters for the RS232 host are:

On paper these defaults match the CM 1241 defaults exactly, which is why a field engineer can be misled into thinking the issue is in the PLC program. In practice, the LS2208 still presents its hardware handshake lines on the RJ48 connector, and a passive RS232 cable that wires those lines through to the DB9 can confuse the CM 1241 receiver logic if the scanner momentarily transitions the lines while it is in the middle of transmitting a string.

4. Anatomy of the CBA-R02-C09PAR Cable

The Symbol/Motorola cable referenced in the original field report is the CBA-R02-C09PAR: an RJ48 (10P10C) plug on the scanner side, a coiled 9 ft / 3 m section, and a DB9 female on the host side. The scanner's RJ48 breakout used by this cable family is:

The LS2208 Quick Start Guide notes that pin 6 of the RJ48 carries +5 V from the host when the host supplies it; the LS2208 itself does not draw operating current from this pin, so a passive cable is safe. The relevant data-path signals for ordinary ASCII traffic are RJ48 pins 3, 4, and 5, which the cable routes to DB9 pins 2, 5, and 3 respectively.

5. Root Cause: Handshake Line and RCV_PTP Interaction

The truncation of a complete barcode to its trailing three bytes is the signature of one of two underlying mechanisms. Both point at the cable/handshake interaction rather than at the RCV_PTP logic itself.

5.1 Mechanism A — RTS line stalls the scanner

The CBA-R02-C09PAR cable carries the LS2208's RTS output to the CM 1241's CTS input. If the CM 1241 does not assert a valid logic level on its RTS line (pin 7, which the module uses for outgoing hardware flow control), the LS2208 may treat this as CTS not asserted for a brief window after power-up or after each trigger pull, and will simply hold the first N bytes in its internal FIFO until the condition clears. Once the FIFO finally drains, only the last three bytes remain in the PLC's receive DB because the receive length reported by RCV_PTP reflects the bytes available at the time the block is called.

5.2 Mechanism B — CM 1241 input buffer handshake mis-decode

The CM 1241 serial firmware in firmware versions V2.x and earlier had an edge case in which a floating or actively toggling CTS line at the start of a transmission was interpreted as a temporary not-ready state. The receiver discarded bytes until the line stabilised. In firmware V3.0 and later, the buffer controller was tightened, but the same symptom can still be induced by the wrong cable.

Both mechanisms are eliminated by removing the handshake lines from the signal path entirely. The cure is a three-wire RS232 connection.

6. The Three-Wire RS232 Solution

The minimum RS232 connection that supports full-duplex asynchronous communication without any form of flow control is three wires:

• DB9 pin 2 — RxD (host receive; scanner transmits on RJ48 pin 3)
• DB9 pin 3 — TxD (host transmit; scanner receives on RJ48 pin 5)
• DB9 pin 5 — GND (signal ground; scanner ground on RJ48 pin 4)

All other DB9 pins (1, 4, 6, 7, 8, 9) are left unconnected on the host side. With this wiring, the scanner and the PLC can communicate bidirectionally only if both devices are configured for No Flow Control. The LS2208 satisfies this requirement by default. The CM 1241 must be set to None in the module's port configuration in TIA Portal.

7. Building the Custom Cable

The field fix is to build a short adapter that breaks out only the three required conductors from the vendor cable, and to leave all other conductors open. The cleanest way to do this is to prepare a female DB9 pigtail wired to the male DB9 of the CBA-R02-C09PAR cable through a backshell, but it is faster to cut the existing cable at a convenient point and re-terminate.

1. Strip approximately 30 mm of the outer jacket from the CBA-R02-C09PAR cable at a point about 30 cm from the scanner end. This keeps wear-and-tear on the heavy scanner-side portion intact.
2. Identify the six conductors that the cable uses (per the table in §4). The cable is unshielded twisted pair, with each signal on a coloured wire; the typical colour map is Red = +5 V/RTN, Black = GND, White = TxD, Green = RxD, Blue = RTS, Yellow = CTS. Verify with a continuity tester against RJ48 pins 1–6 rather than relying on the colour code.
3. Cut and insulate the Blue (RTS) and Yellow (CTS) conductors with heat-shrink. They are no longer used and any stray contact with the DB9 shell or with each other will re-introduce the truncation.
4. Crimp or solder a new male DB9 connector onto the remaining four conductors (TxD, RxD, GND, RTN).
5. Map the conductors to DB9 pins as follows: White → pin 2, Green → pin 3, Black → pin 5, Red → leave unconnected (or optionally to pin 9, which is a no-op on the CM 1241 RS232).
6. Apply a 360° cable clamp to the backshell so the jacket carries any pulling force.

Continuity-test the finished cable end-to-end with a multimeter. Expected resistance from RJ48 pin to DB9 pin should be below 1 Ω on each of the three active pairs, and infinite on pins 1, 4, 6, 7, 8, and 9 at the DB9.

8. TIA Portal Module Configuration

Open the device configuration of the S7-1200 in TIA Portal and select the CM 1241 RS232 in the slot. In the inspector window under Properties > Port configuration, set:

The End of message criteria tell the CM 1241 when the current string is complete and the RCV_PTP block can be released. The LS2208 appends a CR (0x0D) to every scan, so the more reliable trigger is the Character end criterion set to 0x0D. Using the idle-line criterion at 40 ms is acceptable but a single dropped byte in the transmission may push the last two characters past the timeout window and split one barcode into two receive events.

9. RCV_PTP Block Programming

The receive block is a multi-instance DB or a stand-alone FB of type RCV_PTP from the Communication > Point-to-Point palette. The typical signature in a SCL implementation is:

// FB "LS2208_RCV" — receive barcode from CM 1241 RS232
#RCV_PTP_Instance(REQ     := bTrigger,
                  PORT    := 3,                  // CM 1241 hardware identifier
                  BUFFER  := P#DB_Recv.DBX0.0 BYTE 256,
                  LENGTH  := 0,                  // output
                  DONE    => bDone,
                  ERROR   => bError,
                  STATUS  => wStatus);

Notes for stable operation:

• Call RCV_PTP once per scan event. The simplest way to detect a scan is to wire its execution to a cyclic OB1 call with a debounced trigger, or to a hardware input from the LS2208's trigger signal if your scanner variant supports it.
• Allocate the receive buffer as a plain Array of Byte in a global DB. The BUFFER parameter expects a pointer; a 256-byte array comfortably holds the longest Code 39 barcode plus terminators.
• Do not read LENGTH until DONE is set; reading the output before completion can return a partial value that does not reflect the actual number of bytes received.
• Clear the buffer to 0x00 at the start of each reception by writing zeros to the array slice from index 0 to LENGTH-1. This prevents the previous barcode's tail from being interpreted as part of the current one when the new barcode is shorter than the previous one.

STATUS error codes that matter most in this scenario:

10. Receive Buffer Sizing and Sizing Math

At 9600 bps, 8N1, each character occupies 10 bit-times (start + 8 data + 1 stop). The number of characters received per second is:

char_per_sec = 9600 / 10 = 960 characters/second

A typical LS2208 scan in Code 39 produces 5 to 18 characters plus a CR terminator. Even a worst-case 32-character Code 128 barcode completes in:

t_msg = 32 * (1 / 960) = 33.3 ms

The CM 1241 FIFO is 256 bytes by default and is wide enough for any practical barcode string. Field engineers do not need to enlarge it unless they are queuing multiple scans before the PLC reads them out, in which case the RCV_PTP call rate must be faster than the worst-case inter-scan delay divided by the message length.

11. Verification and Commissioning

After building the custom cable and loading the project, run a structured commissioning sequence.

1. Power the S7-1200 and the LS2208 from the same 24 V supply to share ground reference.
2. Open TIA Portal in Online & Diagnostics mode on the CM 1241. Confirm that the module's status field shows OK and that the configured port parameters are reported back (9600, 8, None, 1).
3. Place the CPU in RUN with a watch table open on the receive DB. Set a breakpoint on the RCV_PTP DONE output.
4. Scan a 12-character barcode. Verify that LENGTH returns a value greater than or equal to the barcode length plus 1 (for the CR terminator). For 72-71882-01, expect LENGTH = 12 and the buffer to contain the bytes 0x37 0x32 0x2D 0x37 0x31 0x38 0x38 0x32 0x2D 0x30 0x31 0x0D.
5. Scan a second barcode of a different length. Confirm that no bytes from the previous scan remain in the buffer (the trailing 0x00s after the new LENGTH should be present).
6. Run a sustained test of 50 scans of mixed-length codes. Confirm that the DONE counter increments by 50 and that ERROR remains false on all 50 events.
7. If a STATUS of 0x80C1 (framing error) appears, re-check the cable for swapped Tx/Rx and verify the scanner host parameters with a test against Hyperterminal or a serial analyser.

12. Troubleshooting Matrix