Resolving CM1241 RS485 No-Signal Fault with LD4-B Loop Detector

Problem Summary

An S7-1200 station equipped with a CM 1241 RS485 communication module (article number 6ES7241-1CH30-1XB0 or the redesigned 6ES7241-1CH31-1XB0) is configured for freeport (PtP, point-to-point) ASCII operation in TIA Portal. The remote device is an LD4-B inductive loop detector used for vehicle counting, exposing a two-wire RS485 interface. The PLC executes the standard point-to-point blocks (Send_P2P, Receive_P2P) but the receive buffer is never updated, the STATUS word of the receive FB returns 0 or 0x7000/0x7001 errors, and the RX LED on the CM 1241 stays dark even when a vehicle crosses the loop and the LD4-B is generating bus traffic.

This article enumerates the root causes observed in similar field cases, gives a deterministic verification procedure, and shows working TIA Portal code for the freeport polling master.

Hardware Identification

Before debugging the bus, confirm the exact part numbers in the cabinet. The label on the front of the communication module contains the article number (MLFB) and the firmware version. The module is described in detail in the CM 1241 RS422/RS485 module manual.

Verify the LD4-B loop detector model and the firmware/dip-switch revision. Loop detectors are usually configured via DIP switches for the protocol parameters (baud, parity, data bits, terminating resistor). The default configuration is 9600 bit/s, 8N1, RS485, half-duplex, address 1 for most traffic detector families. Confirm with the vendor datasheet for the LD4-B specifically because the "-B" suffix often denotes a different output option (relay, open-collector, or bus interface).

Root Cause Matrix

Use the following matrix as a triage guide. The "Symptom" column describes what is observed in TIA Portal or on the module front. The "Most likely cause" column lists the root cause(s) that produce that symptom.

Wiring and Physical Layer Verification

RS485 is differential and requires three wiring practices that are frequently missed in field installations: 120 Ω termination at each end, bias resistors to keep the idle state defined, and a single-point shield ground. The CM 1241 does not include internal bias in the base product. Some CH31 firmware revisions expose a software-controlled 620 Ω pull-up/pull-down through the TIA Portal hardware catalog "Terminating resistor" property; this is not the same as a 120 Ω termination and must be used together with external termination.

Pinout of the CM 1241 RS485 terminal block

Step-by-step wiring verification

1. Power down the S7-1200 and the LD4-B. Wait 30 s for the bus capacitors to discharge.
2. Disconnect the LD4-B and measure the resistance between A and B at the cable end. With a healthy 120 Ω termination installed at each end you must read 60 Ω (two 120 Ω in parallel). An open circuit (OL) means termination is missing at least on the LD4-B side.
3. With the LD4-B powered and the CM 1241 unpowered, measure the DC voltage between A and B at the PLC end. A healthy bus shows between +200 mV and +5 V (the biasing pulls the line to a defined idle state). A value near 0 V means bias is missing on the LD4-B and you are seeing a floating bus.
4. Connect an oscilloscope or a logic analyzer to A and B at the PLC end. Trigger on a single rising edge on B (non-inverting). You must see clean differential pulses, not ringing, not chopped edges. Ringing longer than 25% of a bit time is a sign of missing termination.
5. Reconnect the LD4-B and trigger the loop with a metal object. Verify that a frame appears on the bus and that the RX LED on the CM 1241 blinks. If the LED does not blink at all, swap A and B and repeat. The LED will light even if the frame is garbled.

Topology diagram

TIA Portal Device Configuration

The CM 1241 is added in the device view of TIA Portal under Communications modules > CM 1241 > 6ES7241-1CH30-1XB0. Once the module is placed, the following parameters must match the LD4-B detector. Wrong values in any of these fields will cause a silent receive failure. The complete parameter list is documented in the S7-1200 programmable controller system manual.

1. Open the project in TIA Portal, expand the S7-1200 station, and double-click the CM 1241 module.
2. Select the Properties > Port configuration tab.
3. Set the protocol to Freeport. The dropdown exposes "ASCII", "3964(R)", and "Modbus".
4. Set the transmission speed, parity, data bits, and stop bits to match the LD4-B. Click "Apply".
5. Compile the hardware (HW) configuration and download to the CPU.
6. Power-cycle the CPU so the new port configuration is loaded by the CM 1241 firmware.

Freeport Send/Receive Programming

The freeport blocks in the S7-1200 instruction set are Send_P2P (SFB_9) and Receive_P2P (SFB_13). They are found in the "Instructions > Communication > Communication processor > Point-to-point" task card. The receive block requires a configured start condition (start character, any character, line idle, line break) and a configured end condition (character count, timeout, end character). The most common mistake in the field is to set the start condition to "Start character" and forget to specify the character — leaving it at the default 0x00 — while the LD4-B is sending ASCII text starting with 'V' or '$'. The complete programming interface is documented on the PtP function block reference page.

Polling master code (structured text)

The following block issues a generic poll every 200 ms. If the LD4-B is in ASCII push mode it will reply with a CR/LF-terminated string for every vehicle. If it is Modbus RTU the same code works without changes thanks to the protocol selection in the hardware config.

// Inputs and outputs
VAR
    SendRequest  : BOOL;            // Pulse to start a transaction
    Busy         : BOOL;
    Done         : BOOL;
    Error        : BOOL;
    Status       : WORD;
    RxBuf        : ARRAY[0..63] OF BYTE;
    RxLength     : INT;
    SendBuf      : ARRAY[0..7] OF BYTE;
END_VAR

// Build a generic poll frame
SendBuf[0] := 16#01;     // Slave address
SendBuf[1] := 16#03;     // Function code: read holding registers
SendBuf[2] := 16#00;     // High byte of register address
SendBuf[3] := 16#00;     // Low byte of register address
SendBuf[4] := 16#00;     // High byte of register count
SendBuf[5] := 16#02;     // Low byte of register count
// CRC will be appended by the Send_P2P block when Modbus is selected;
// for Freeport ASCII, append <CR><LF> (0x0D 0x0A) and the LD4-B replies with a comma-separated list

// Send poll
IF SendRequest THEN
    "Receive_P2P_DB"(REQ := FALSE, PORT := "Cm1241", BUFFER := RxBuf);
    "Send_P2P_DB"(
        REQ       := TRUE,
        PORT      := "Cm1241",
        BUFFER    := SendBuf,
        LENGTH    := 8,
        PTRCL     := FALSE,    // No XON/XOFF
        DONE      => Done,
        ERROR     => Error,
        STATUS    => Status
    );
END_IF;

// Receive with line-idle + length end condition
IF NOT "Receive_P2P_DB".EN_R AND NOT "Receive_P2P_DB".ERROR THEN
    "Receive_P2P_DB"(
        REQ        := TRUE,
        EN_R       := TRUE,
        PORT       := "Cm1241",
        BUFFER     := RxBuf,
        LENGTH     := 64,
        // Start condition: line idle for 3.5 character times
        // End condition:   end character 0x0A (LF)
        DONE       => Done,
        ERROR      => Error,
        STATUS     => Status,
        LEN        => RxLength
    );
END_IF;

Receive state machine

Loopback Self-Test Procedure

Before suspecting the LD4-B, validate that the CM 1241 is able to drive and receive its own bus. The following procedure takes five minutes and isolates the PLC module from the field wiring.

1. Power down. Disconnect the LD4-B from the cable at the PLC end.
2. Connect a jumper between pin 2 (T/R-) and pin 3 (T/R+) — leave pin 1 (GND) open. This forces a constant MARK state on the bus; the CM 1241 should report a permanent idle with no errors.
3. Power up the PLC. The CM 1241 should report STATUS = 0 and the RX LED should be dark. If the RX LED is lit or the STATUS is non-zero, the module or the wiring at the PLC side is faulty.
4. Remove the jumper. Leave both pin 2 and pin 3 open. Power up. The bus is now floating. Bias resistors must be enabled (software setting in CH31 modules) or the STATUS should still be 0. Many firmware versions tolerate the floating bus; if you see STATUS = 16#80A8 (no start condition), the bias is not present.
5. Connect an external 120 Ω resistor between pin 2 and pin 3. With LD4-B still disconnected, the bus is terminated. Run the Send_P2P block sending the byte 0x55. The TX LED must light for the duration of the transmission. If the TX LED does not light, the port is not enabled — verify the port name and the hardware configuration download.
6. Connect two 620 Ω bias resistors: 620 Ω from pin 3 (T/R+) to +5V and 620 Ω from pin 2 (T/R-) to GND. Trigger a send of "TEST<CR><LF>". Because nothing is connected, no echo is expected. The STATUS must remain 0 and no error must be raised.

Protocol Frame Analysis for the LD4-B

The LD4-B loop detector typically exposes a push mode (continuous ASCII or Modbus transmission on each event) or a poll mode (the master requests a snapshot). Identify which mode is active by disconnecting the bus and watching the TX LED on the detector (or its equivalent). If the LED blinks on each vehicle pass without a request from the PLC, the detector is in push mode and the PLC is only acting as a listener. If the LED is dark until the PLC requests, the detector is in poll mode.

LED Diagnostics and Module Status

If the RX LED never lights up despite a known traffic event on the loop, the problem is physical. If the RX LED lights up but the receive FB never finishes, the problem is protocol. Apply this rule before changing code.

Verification Checklist

1. Confirm the CM 1241 article number is 6ES7241-1CH30-1XB0 or 6ES7241-1CH31-1XB0, not the RS232 variant.
2. Confirm the LD4-B is in RS485 mode via DIP switch; some detectors ship in RS232 or current-loop mode.
3. Measure 60 Ω between A and B at the LD4-B end with the bus terminated (or 120 Ω if the CM 1241 is the only termination).
4. Measure +200 mV to +5 V idle voltage between A and B with the LD4-B powered.
5. Confirm baud, parity, data bits, and stop bits match between TIA Portal and the LD4-B DIP switch.
6. Confirm the receive start condition is appropriate: line idle for the first test, any character for ASCII push mode, start character only if you know the exact first byte.
7. Power-cycle the PLC after a port configuration change.
8. Use the online watch table to monitor STATUS, LEN, and the first few bytes of RxBuf.
9. Run a Modbus master test (TIA Portal example project "Modbus_Master_CM1241") to confirm the bus plumbing without depending on the LD4-B behaviour.
10. Capture a single frame on a logic analyzer to confirm the differential signal is clean and that the A/B polarity is correct.

Frequently Asked Questions