S7-1200 CB 1241 Modbus RTU Keypad Integration: Setup Guide

S7-1200 CB 1241 Modbus RTU Keypad Integration: Setup Guide

Overview

This guide documents the field-proven procedure for integrating an industrial numeric/directional keypad — originally wired to a Schneider Electric Modicon PLC — onto a Siemens SIMATIC S7-1200 CPU 1214C using the CB 1241 RS485 communication module and the Modbus RTU master instruction set available in TIA Portal. The procedure focuses on the CB 1241 as the physical RS485 transceiver, the Modbus RTU library blocks (MB_MASTER, MB_COMM_LOAD) for the protocol stack, and the data block sizing rules that govern successful register polling of an unknown slave device.

The reference design was validated against a CPU 1214C DC/DC/DC with firmware V4.x and TIA Portal V16/V17. Where firmware-dependent differences exist, the divergence is called out explicitly.

Prerequisites

Before commissioning, gather the following:

• SIMATIC S7-1200 CPU 1214C (or 1211C/1212C/1215C/1217C) with at least one free signal-board slot for the CB 1241. Verify with the CB 1241 RS485 Specifications page that the slot position is supported on your CPU revision.
• CB 1241 RS485 (6ES7241-1CH30-1XB0) communication module or signal board (6ES7241-1CH32-1XB0).
• TIA Portal V16 or later with the "S7-1200 Modbus RTU" library installed (part of the standard installation under "Libraries" → "Modbus RTU").
• A USB-to-RS485 converter (FTDI FT232 or equivalent) plus a serial monitor tool — Hercules SETUP, Modbus Poll, or an industrial protocol analyzer — to capture the keypad's native output if the protocol is unknown.
• Original keypad documentation or a known-good wiring diagram from the prior Schneider installation. If unavailable, the keypad must be characterized empirically as described in the Protocol Identification section.
• 24 V DC control power for the keypad supply and termination resistors (typically 120 Ω at each end of the RS485 segment).

CB 1241 RS485 Hardware Specifications

The CB 1241 RS485 module is a 2-wire half-duplex transceiver that meets the EIA-485 (TIA-485) standard. The following table summarizes the electrical limits that govern field wiring decisions; refer to the official CB 1241 RS485 Specifications document for full values.

RS485 Wiring and Signal Considerations

RS485 relies on a differential pair (Data+ / Data-) with a shared reference ground. The CB 1241 terminal block has the following pinout:

Vendor labeling mismatch is the single most common wiring fault. Schneider, Siemens, and many keypad vendors all label the non-inverting line differently. Always verify with a multimeter and an oscilloscope before energizing:

1. Power the keypad and measure the idle-line voltage between the two data lines with no PLC connected. The idle (mark) state should show Data+ more positive than Data- (typical +200 mV to +5 V differential).
2. Press a key and observe the differential waveform. Confirm the polarity matches the CB 1241 pinout above.
3. If polarity is reversed, swap the two data conductors at the CB 1241 terminal block only — never at the keypad, because the keypad may share its ground with a shielded cable that is bonded at one end.

Terminate the segment with a 120 Ω resistor between Data+ and Data- at the far end (at the keypad) and optionally at the CB 1241 end, depending on cable capacitance. Never place termination in the middle of the run.

Protocol Identification Strategy

Because the keypad is being migrated from an unknown Schneider configuration, the first engineering task is to determine what protocol the keypad actually emits. Use a USB-to-RS485 converter connected to a PC and a serial monitor to capture raw bytes.

1. Disconnect the keypad from the CB 1241.
2. Connect the USB-to-RS485 converter across the keypad's data lines with the same reference ground.
3. Configure the serial monitor at the most common defaults: 9600, 8N1, no flow control.
4. Open the port in HEX display mode and press a key on the keypad.
5. Observe the frame:
   • If the frame begins with 01 03 ... (slave address 1, function code 3 = Read Holding Registers), the device is a Modbus RTU slave and the PLC must be the master.
   • If the frame begins with a vendor-specific header (e.g., 5A A5 or FE FE) and is followed by a fixed-length payload with checksum, the device uses a proprietary protocol and the CB 1241 must be switched to Freeport mode with user-defined send/receive logic.
   • If no frames appear, the keypad may be polled (slave) and only transmit when addressed. In that case, use Modbus Poll (WinTech) as a master simulator to poll common addresses (1, 2, 247) with function codes 01, 02, 03, 04 and observe the response.

Once the protocol is confirmed as Modbus RTU, note the slave address, baud rate, parity, and the register mapping for at least one key. This dataset becomes the basis for the PLC program.

TIA Portal Hardware Configuration

With the keypad confirmed as a Modbus RTU slave, configure the CB 1241 hardware object:

1. In the TIA Portal project tree, open Devices & Networks and select the S7-1200 CPU.
2. Locate the signal-board slot on the front of the CPU. Drag the CB 1241 (RS485) into the slot. TIA Portal auto-assigns the module name (e.g., CB_1241_1) and the diagnostic address space.
3. Open the CB 1241 properties and select Port configuration:

Modbus RTU Program Structure

The Modbus RTU library consists of two blocks:

• MB_COMM_LOAD (FB / background DB) — initializes the port once on startup. Mode 4 = RS485 half-duplex. This block must run once and only once per port transition from STOP to RUN.
• MB_MASTER (FB / instance DB) — performs individual Modbus transactions. Multiple instances are allowed as long as they share the same port background DB.

The wiring is straightforward: MB_COMM_LOAD writes the port configuration into the CB 1241 hardware identifier, then MB_MASTER issues read/write requests. Each master call uses a request/response pair and increments DONE or ERROR.

Sample MB_MASTER call

The following structured text excerpt shows a polled read of holding registers (function code 03) from slave address 1, register 0, length 19 words, into Slave_data:

// MB_MASTER call - poll keypad holding registers
MB_MASTER_1.DB(REQ := TRUE,                       // Trigger on rising edge
               MB_ADDR := 1,                       // Keypad slave address
               MODE := 0,                          // 0 = Read holding registers (FC 03)
               DATA_ADDR := 0,                     // Starting register (Modbus 0-based)
               DATA_LEN := 19,                     // Number of words to read
               DATA_PTR := "Slave_data".Data);

Note the explicit cast "Slave_data".Data: the DATA_PTR parameter of MB_MASTER requires a ARRAY[0..n] OF WORD or ARRAY[1..m] OF WORD element depending on the block version. TIA Portal V16+ accepts a flexible array; older versions are strict on the lower bound.

Data Block Sizing and Array Structure

This is the point where most first-time integrations fail silently. The Modbus master block uses DATA_PTR as both source and destination. Its element count must exactly equal DATA_LEN, and the array bounds must be valid for the block's lower-bound check.

Create a global DB called Slave_data with the following structure:

DATA_BLOCK "Slave_data"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
  STRUCT
    Data : ARRAY[1..19] OF WORD;   // Must match DATA_LEN in MB_MASTER
    Error : WORD;                  // Last error code from MB_MASTER STATUS
    LastKey : WORD;                // Decoded key value
  END_STRUCT;
END_DATA_BLOCK

Once the data lands in Slave_data.Data[1..19], the application logic can decode the pressed key. Most numeric keypads report the digit value in the first word and direction flags in subsequent words. Consult the keypad vendor datasheet for the exact register map.

Verification and Commissioning

After the program compiles and downloads, perform the following checks in order:

1. Hardware check: With the CPU in STOP, verify the CB 1241 TX and RX LEDs are off. Place the CPU in RUN and confirm the port LED blinks green briefly during MB_COMM_LOAD.
2. Initialization check: Monitor MB_COMM_LOAD.DONE = TRUE and MB_COMM_LOAD.ERROR = FALSE. If ERROR is true, the configuration parameters are rejected before any Modbus traffic.
3. Master polling: Trigger MB_MASTER.REQ once per scan or via a periodic timer (50–100 ms typical) and monitor DONE. Pressing a key on the keypad should clear DONE momentarily and set it again on the next poll completion.
4. Payload verification: Place a watch table on Slave_data and press each numeric key and direction key. Confirm each press updates a unique word or bit pattern in the array. Cross-reference with the captured USB-to-RS485 trace from the Protocol Identification step.
5. Error recovery: If MB_MASTER.STATUS returns 0x80C8, the array size is wrong. If it returns 0x80C9, the slave address is wrong or the slave is not responding. If it returns 0x80CA, a CRC error was detected — check wiring and termination.

Modbus RTU Error Code Reference

Troubleshooting Matrix

Frequently Asked Questions