S7-1200 Barcode Reader Integration: 6-Scanner Architecture Guide

David Krause15 min read
SiemensTIA PortalTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Problem Definition and Engineering Constraints

Connecting six barcode readers to a single control system for raw-material entry on a production line requires careful architectural planning. The scanner data must be available simultaneously in the PLC (for control decisions), in WinCC (for operator visibility), and in a database (for traceability and ERP integration). The interface on the barcode reader side—RS-232, RS-422, RS-485, USB, Ethernet, or PROFINET—drives the entire design.

Field deployments on similar lines repeatedly show four constraints that shape the architecture:

  • Maximum of three CM 1241 communication modules plus one CB 1241 signal board per S7-1200 CPU (1214C / 1215C / 1217C).
  • Each serial port is a half-duplex or full-duplex point-to-point link; RS-232 cannot be multi-drop chained.
  • PROFINET-capable scanners occupy a PROFINET IO slot like any other IO device and do not consume CM 1241 resources.
  • Database integration must be transactional, not polled, to avoid record loss during production peaks.
Decision prerequisite: Identify the exact model and interface of every barcode reader before selecting hardware. Two readers in the same product family may ship with USB-only firmware in one variant and RS-232 + Ethernet in another. Selecting wrong at this step forces a return-to-vendor cycle of two to four weeks.

2. Prerequisites

2.1 Hardware Required

  • Siemens S7-1200 CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0) or 1215C DC/DC/DC (6ES7215-1AG40-0XB0) as the minimum for three CM 1241 modules.
  • CM 1241 RS-232 module (6ES7241-1AH32-0XB0), one per RS-232 scanner.
  • CM 1241 RS-422/485 module (6ES7241-1CH32-0XB0) for any RS-485 multi-drop scanner cluster.
  • CB 1241 RS-485 signal board (6ES7241-1CH30-1XB0) for the fourth serial port on a single CPU.
  • PROFINET-native scanners (for example, the Keyence SR-series code readers) for direct fieldbus integration.
  • Shielded D-sub 9-pin cables rated for industrial use, with shell grounding at the PLC end only.
  • PROFINET patch cabling (Cat 6 SF/UTP, industrial grade) where scanners carry PROFINET.

2.2 Software Required

  • TIA Portal V17 or later; V18 is recommended for new deployments.
  • S7-1200 CPU firmware V4.4 or later for full PROFINET scanner compatibility.
  • PtP (Point-to-Point) instruction library, included with TIA Portal.
  • WinCC Comfort/Advanced V17 or later for HMI design.
  • WinCC Database Connectivity option, a custom OPC UA server, or a S7-1200 user program that pushes records to a SQL database via TCP.

2.3 Site-Survey Information Required

  1. Scanner model and firmware version for each of the six positions.
  2. Physical interface (RS-232, RS-422/485, USB, Ethernet, PROFINET, EtherNet/IP).
  3. Default serial parameters (baud, parity, data bits, stop bits) and protocol framing (CR/LF, STX/ETX, none).
  4. Trigger source (continuous, hardware trigger via DI, command trigger from PLC).
  5. Maximum cable length between scanner and panel; RS-232 is rated for 15 m typical, 30 m at lower baud rates with low-capacitance cable.
  6. Power source: 24 VDC at scanner or PoE for Ethernet variants.

3. Architecture Comparison

Three viable architectures exist for the six-scanner application. Selection depends on the scanner inventory already on site and on whether the PLC order is still open.

Criterion Arch A: Direct Serial (CM 1241) Arch B: PROFINET Scanners Arch C: Serial-to-PROFINET Gateway
Scanners supported RS-232 / RS-422 / RS-485 PROFINET-native readers RS-232 / RS-422 / RS-485
Hardware per scanner 1× CM 1241 module 1× PROFINET port on scanner 1× gateway serial port
Maximum scanners per CPU 3 CM + 1 CB = 4 16 (PROFINET IO limit) 16 (gateway dependent)
Total PLCs for 6 scanners 2 S7-1200s with PROFINET tie 1 S7-1200 sufficient 1 S7-1200 + 1 gateway
CPU scan-time impact PtP block executed per port every cycle Cyclic PROFINET IO update Single PROFINET IO update
Cable length 15–30 m typical RS-232 100 m per segment, switched 15 m RS-232 + 100 m PROFINET
Wiring complexity Highest (six point-to-point cables) Lowest (one PROFINET ring) Medium (six short + one trunk)
Field diagnostic Per-port LED + STATUS word PROFINET alarms + Web server Gateway web server + port LEDs
Approx. cost per scanner (hardware) CM 1241 list ~€300 Built into PROFINET scanner Gateway port ~€80 amortised
Multi-vendor scanner mix Yes, any RS-232 vendor No, requires PROFINET firmware Yes, any RS-232 vendor
Recommendation: If scanner procurement is still open, standardize on PROFINET-native readers (Architecture B). It reduces the PLC count to one and consolidates diagnostics through the PROFINET stack. If readers are already on site with RS-232 only, Architecture C with a single multi-port gateway is the lowest-risk retrofit path.

4. Architecture A: Direct Serial with CM 1241 and CB 1241

The user's original plan—six serial cards and two S7-1200 CPUs—is technically workable but rarely optimal. A single S7-1200 with three CM 1241 modules plus one CB 1241 signal board provides four serial ports; the remaining two scanners must therefore either go on a second CPU linked by PROFINET, or be migrated to PROFINET or to a gateway as in Architecture C.

4.1 Module Variants and Catalog Numbers

Module Order Number Interface Mounting
CM 1241 RS-232 6ES7241-1AH32-0XB0 RS-232, full-duplex Left of CPU on DIN rail
CM 1241 RS-422/485 6ES7241-1CH32-0XB0 RS-422 or RS-485, switchable Left of CPU on DIN rail
CB 1241 RS-485 6ES7241-1CH30-1XB0 RS-485 half-duplex Signal board on CPU front
CB 1241 RS-232 6ES7241-1AH30-0XB0 RS-232 full-duplex Signal board on CPU front

4.2 RS-232 Pinout (D-Sub 9 Male, PLC Side, DTE Convention)

Pin Signal Direction (PLC) Scanner DTE connection
2 RXD Input TXD (pin 3)
3 TXD Output RXD (pin 2)
5 GND — GND (pin 5)
7 RTS Output CTS (pin 8)
8 CTS Input RTS (pin 7)

Handshake: most barcode readers default to no flow control. Hardware RTS/CTS is required only when the scanner firmware sets Hardware handshake in its serial menu; connecting pins 7–8 straight-through at the PLC end without scanner-side handshake may cause the PLC to drop characters under burst load. Software XON/XOFF is acceptable but ties up two ASCII codes (DC1/DC3) that must not appear in the barcodes themselves.

5. Architecture B: PROFINET-Native Scanners

PROFINET-capable scanners expose barcode data, decoded symbol type, and read quality as cyclic IO. The PLC reads them like any other PROFINET device. The Keyence SR-700 and SR-1000 series, for example, support PROFINET IO with a GSDML file that integrates directly into the TIA Portal device catalog; readers can be linked to share operating status and trigger results across the network.

Key advantages for the six-scanner use case:

  • One CPU, one PROFINET network, six scanners, no CM 1241 modules required.
  • Per-scanner read diagnostics (decoded count, decode time, match-string) available as cyclic IO.
  • Scanner web server exposes read images and statistics without extra software.
  • Replacement of a faulty scanner is a PROFINET device swap; the new unit inherits the IO configuration.

5.1 Typical Cyclic Data Layout (vendor-specific; verify against the supplied GSDML)

Slot / Byte Offset Direction Length Meaning
Input 0–63 PLC ← Scanner 64 bytes Decoded ASCII string (null-terminated)
Input 64 PLC ← Scanner 1 byte Read status (0 = no read, 1 = read OK, 2 = read error)
Input 65 PLC ← Scanner 1 byte Symbol type (Code 39, Code 128, QR, DataMatrix, …)
Input 66–67 PLC ← Scanner 2 bytes Match-string length in bytes
Output 0 PLC → Scanner 1 byte Trigger command (rising edge starts a read)
Output 1 PLC → Scanner 1 byte Read acknowledge (rising edge clears the read-complete flag)
Verify before deployment: The exact slot/byte layout is vendor-specific and firmware-revision-specific. Always confirm against the GSDML revision supplied with the scanner and re-import it whenever the scanner firmware is updated.

6. Architecture C: Serial-to-PROFINET Gateway

When the existing scanners are RS-232 only and the cable lengths from the scanners to the panel exceed 30 m, a multi-port serial-to-PROFINET gateway consolidates the six serial links onto a single PROFINET device. Gateways of this type (for example, the Prosoft PLX31 series) translate ASCII data from each serial port into PROFINET IO input bytes, exposing each barcode string as a 64- or 128-byte input area that the PLC can read directly.

For projects that mix Modbus RTU scanners and ASCII scanners, the same gateway can also act as a Modbus-to-PROFINET bridge; the Prosoft application note on barcode-to-controller integration describes the typical mapping in detail.

6.1 Gateway Port Budget

Scanner Interface Gateway Port Count Gateway Series (example) PROFINET Slots Consumed
RS-232 × 4 4 Prosoft PLX31-PNDBS-4 4
RS-485 × 2 (multi-drop) 2 Prosoft PLX31-PNDBS-2 2
Mixed 6 ports 6 Single PLX31 with 6-port license 6

7. TIA Portal Configuration for Serial Architecture A

7.1 Hardware Configuration

  1. Open the project and double-click Devices & networks.
  2. From the catalog, drag three CM 1241 (RS-232) modules into slots 101, 102, and 103 of the S7-1200 CPU.
  3. Insert a CB 1241 RS-485 signal board into the CPU slot if a fourth serial port is required.
  4. For each port, set Port configuration: baud 9600 (or as required by the scanner), 8 data bits, no parity, 1 stop bit, no flow control.
  5. Enable Receive line initial state = HIGH if the scanner idles in the mark state (most do).
  6. Set End-of-receive criteria = On receiving the character configured as end delimiter, delimiter = 0x0D (CR) or 0x0A (LF) per scanner default.

7.2 PtP Instruction Blocks

The PtP library provides three core blocks. For six scanners, instantiate six of each.

  • Receive_P2P — copies the buffered characters into a per-scanner data block.
  • Send_P2P — sends a trigger or configuration string to the scanner.
  • Receive_Reset — clears the receive buffer after the application has consumed the string.

7.3 SCL Code Skeleton (per Scanner)

// FB_ScannerPort — one instance per CM 1241 port
// Trigger pulse: rising edge of bTrigger starts a read
// Received string lands in sBarcode[1..64] of instance DB

IF #bTrigger AND NOT #bTriggerOld THEN
    "Send_P2P_DB"(REQ := TRUE,
                  PORT := #hwID,           // hardware ID of the CM 1241
                  BUFFER := 'TRG\r',       // ASCII trigger command
                  LENGTH := 4,
                  DONE => #sendDone,
                  ERROR => #sendError,
                  STATUS => #sendStatus);
END_IF;
#bTriggerOld := #bTrigger;

// Receive runs every cycle; only consumes when complete
"Receive_P2P_DB"(EN_R := TRUE,
                 PORT := #hwID,
                 BUFFER := #sBarcode,
                 LENGTH := 64,
                 NDR => #ndr,
                 ERROR => #rcvError,
                 STATUS => #rcvStatus);

IF #ndr THEN
    // String consumed — log it, route to WinCC, push to DB
    #bNewString := TRUE;
    "Receive_Reset_DB"(REQ := TRUE, PORT := #hwID, DONE => #rstDone);
END_IF;

7.4 Distinguishing Scanner Sources in the PLC

Each scanner is tied to its own CM 1241 port and its own receive instance data block. Identification is therefore implicit: the instance DB number or the hardware ID is the scanner number. A recommended practice is to populate a Source word in the per-scanner DB that mirrors the slot number of the CM 1241 module (101, 102, 103, …) so the HMI and database receive a single field identifying the source.

8. Routing Data to WinCC

Each per-scanner instance DB is exposed to WinCC as an HMI tag array. The recommended tag structure is:

HMI Tag PLC Address Type Update
Scanner1_Source DB1.DBX0.0 WORD UINT Cyclic, 100 ms
Scanner1_Barcode DB1.STRING[64] STRING On change
Scanner1_NewData DB1.DBX70.0 BOOL On change
Scanner1_Status DB1.DBB71 BYTE Cyclic, 100 ms
… ×6 … … …

On the HMI screen, build one Barcode List View with six rows, each bound to the matching tag set. The NewData bit drives a flashing icon and resets on operator acknowledgement via an HMI button that writes back to the corresponding bit in the same DB.

For raw-material entry, an additional HMI popup should request operator confirmation of Material and Quantity when NewData goes high; the combination of barcode + operator-entered quantity is what flows onward to the database.

9. Database Logging

Three viable paths exist for moving barcode records to a database. Selection is driven by the existing IT landscape and the acceptable record-loss window.

Path Mechanism Record-Loss Risk Latency
WinCC SQL Connector WinCC tags to SQL via ODBC tag logging Low with buffering 1–2 s
OPC UA + external server PC node reads S7-1200 symbols, writes to SQL Very low with retry 100–500 ms
Direct PLC TCP write S7-1200 user program opens TCP connection, sends INSERT Medium; depends on PLC OB1 timing Cycle-time dependent

9.1 Recommended Table Schema

CREATE TABLE dbo.barcode_log (
    log_id        BIGINT IDENTITY(1,1) PRIMARY KEY,
    log_time      DATETIME2(3)  NOT NULL  DEFAULT SYSUTCDATETIME(),
    scanner_id    SMALLINT      NOT NULL,
    barcode       NVARCHAR(64)  NOT NULL,
    material      NVARCHAR(32)  NULL,
    quantity      DECIMAL(18,3) NULL,
    operator      NVARCHAR(32)  NULL,
    shift_id      SMALLINT      NULL,
    plc_timestamp DATETIME2(3)  NULL
);
CREATE INDEX ix_barcode_log_time ON dbo.barcode_log (log_time);

9.2 OPC UA Path (Preferred for Lossless Logging)

  1. Enable the OPC UA server on the S7-1200 (CPU firmware V4.4 or later, security level configured).
  2. Expose each scanner's instance DB as an OPC UA node set with read access.
  3. On a PC node, run a small service (for example, a .NET console host or a Node-RED flow) that subscribes to the NewData nodes and writes the new records to SQL via a parameterized stored procedure.
  4. Maintain an in-memory buffer keyed on scanner_id so that a database write failure is retried on the next poll rather than dropped.

10. Verification and Commissioning Checklist

Run this checklist per scanner before declaring the line production-ready.

  1. LED on CM 1241 (or scanner PROFINET port) shows Active (steady green) and Link on the Ethernet side where applicable.
  2. From the TIA Portal Online & Diagnostics view, the CM 1241 port shows Port status = OK and the diagnostic buffer is free of receive-overrun warnings.
  3. A loopback test on each cable: connect pins 2–3 of the D-sub at the scanner end and verify that a sent ASCII string is echoed back into the receive DB.
  4. Trigger 50 production-coded barcodes; verify that all 50 appear in the instance DB, the HMI list view, and the SQL barcode_log table with identical strings.
  5. Cycle power on the S7-1200; verify that the last received barcode from each scanner is preserved in the instance DB (set Retain on the data block or on the string fields that must survive restart).
  6. Force a CM 1241 module out of the rack in TIA Portal; verify that WinCC raises a connection-loss alarm within the configured polling time and that the database log records the gap.
  7. Load-test: trigger all six scanners at a 1 Hz rate for 10 minutes; verify that no records are lost and that the CPU scan time remains below 80 percent of the OB1 watchdog.

11. Troubleshooting Matrix

Assign PROFINET device name from TIA Portal topology; verify switch port
Symptom Likely Root Cause First Diagnostic Remediation
No characters received on a port TXD/RXD crossed or scanner in wrong serial mode Loopback test on cable; check scanner serial menu Swap pins 2 and 3; set scanner to RS-232 (not USB-CDC)
Characters received but garbled Baud or parity mismatch TIA Portal Port configuration vs scanner menu Match baud, data bits, parity, stop bits exactly
String truncated mid-read End-of-receive delimiter not set or set wrong Monitor raw buffer in TIA Portal watch table Set end delimiter to 0x0D or 0x0A per scanner; enable On character timeout as backup
Two scanners' data interleaves in one DB Same hardware ID reused or receive block wired to wrong port Watch table on each instance DB Assign one instance DB per CM 1241 slot; verify hardware IDs
PROFINET scanner shows Station failure Device name not assigned or scanner on wrong port TIA Portal Online & Diagnostics > PROFINET device
Database inserts stop after N records OPC UA service crashed or ODBC connection pool exhausted Service log; SQL sys.dm_exec_connections Restart service; raise connection pool; add retry buffer in service
HMI shows NewData stuck high Acknowledge bit never written back Watch table on DB bit Wire HMI button to clear the bit; verify write access on the HMI connection
CM 1241 STATUS returns 16#8381 Receive buffer overrun Reduce trigger rate or raise OB1 priority of the receive FB Lower trigger frequency; raise priority of the receive FB; enlarge receive buffer

11.1 Common CM 1241 Status Codes

STATUS (hex) Meaning Remediation
16#0000 No error —
16#8085 Buffer length zero or wrong type Verify BUFFER is a STRING or ARRAY of BYTE with non-zero LEN
16#8381 Receive overrun Raise priority of the receive FB; reduce trigger rate
16#8382 Parity / framing error Match serial parameters; check cable shielding
16#8383 Overrun error Increase OB1 cycle time slice for the PtP FB; reduce event density
16#80A1 Internal resource error Cycle power on CPU; check for duplicate hardware IDs

12. Field-Notes and Practical Caveats

  • Two-CPU plans rarely pay off. Running two S7-1200s with PROFINET in between doubles the HMI tag count and the engineering effort. Use Architecture B or Architecture C unless the second PLC is already on the bill of materials for a separate reason.
  • Retain on the receive DB is mandatory for any scanner whose last read must survive a power cycle; otherwise the operator sees an empty HMI field on restart and a phantom material entry in the database log.
  • Shielded D-sub shells must be grounded at the PLC end only. Grounding both ends of a long parallel run creates a ground loop that injects common-mode noise and corrupts characters at bursts above 5 Hz.
  • PROFINET scanner firmware updates change the GSDML revision. Re-import the GSDML on every firmware update and re-assign device names; the CPU will refuse to go online with a stale GSDML.
  • For raw-material traceability, store the PLC timestamp alongside the database timestamp. The PLC timestamp is what the audit trail must defend; the database timestamp is for forensic cross-checking.
  • Avoid XON/XOFF for barcode data. The XON (0x11) and XOFF (0x13) bytes are valid in some Code 128 symbologies and will trigger spurious flow control if enabled.

How many CM 1241 modules can one S7-1200 CPU support?

Three CM 1241 modules plus one CB 1241 signal board, for a maximum of four serial ports per CPU. CPU 1214C, 1215C, and 1217C all share this limit; the higher CPU models do not raise the communication-module count.

Can I mix RS-232 and RS-485 scanners on the same S7-1200?

Yes. CM 1241 RS-232 and CM 1241 RS-422/485 modules coexist on the same CPU. Each module occupies a separate slot (101, 102, 103, …) and is configured independently; the receive FB instances are wired to the matching hardware ID.

What baud rate is typical for industrial barcode readers?

9600 baud with 8-N-1 is the de-facto default for most RS-232 barcode readers. Higher rates (19200, 38400, 115200) are supported by some models and reduce transmit time on long codes, but the gain on a 20-character string is sub-millisecond and rarely justifies the noise sensitivity at 115200 over 15 m of unshielded cable.

How do I distinguish data from different scanners in the PLC?

Each scanner is wired to a dedicated CM 1241 port and a dedicated receive FB instance, with its own data block. Identification is implicit in the instance DB number or in the slot number of the CM module, which is copied into a Source word inside the per-scanner DB so the HMI and database see a single identifying field.

Can barcode data be sent directly to SQL Server from the S7-1200?

Yes, via a TCP connection in the user program and an INSERT statement, but it is not recommended for production. The PLC is not designed for high-availability database writes; an OPC UA bridge to a PC-side service with a parameterized stored procedure and a retry buffer is the field-proven pattern for lossless logging.

Back to blog