S7-1200 CB 1241 RS485 SEND_PTP: Swapped A/B Wire Diagnosis

S7-1200 CB 1241 RS485 SEND_PTP: Swapped A/B Wire Diagnosis

Engineers integrating the SIMATIC S7-1200 CPU with a CB 1241 communication board frequently hit a wall when the first loop-back test returns corrupted bytes. The transmit side reports DONE and ERROR = 0, the receive buffer fills, yet every byte is mangled. This reference walks through the root cause, the oscilloscope evidence, and the field-proven fix for one of the most common point-to-point commissioning traps: a mislabeled or swapped RS-485 differential pair between the CB 1241 and a USB-to-RS485 converter on the engineering PC.

1. Problem Overview

A bench test is set up with the following hardware:

• CPU: SIMATIC S7-1200 (any firmware ≥ V4.0 that supports legacy PtP instructions on the CB slot)
• Communication board: CB 1241 (RS485 half-duplex), catalog number 6ES7241-1CH30-1XB0
• Host PC: Generic USB-to-RS485 adapter, typically based on FTDI FT232R + MAX485 or CH340 + SP485E
• Terminal program: RealTerm, PuTTY, or the TIA Portal online serial monitor

The PC sends a single byte from a terminal program. The S7-1200 receives the data in a BYTE buffer pointed to by SEND_PTP's companion RCV_PTP block. The receive byte is supposed to match what was sent, but instead a deterministic-but-wrong byte appears:

The transformation is not random. Every payload bit has been inverted relative to the differential pair, the original start bit has been promoted to a stop, and the original stop bit has been demoted to a start. The UART inside the CB 1241 re-synchronizes on a false edge and reports a "successful" reception because no STATUS word error such as 0x1A (parity) or framing error is set in the legacy RCV_PTP instruction. This is the textbook fingerprint of a polarity-inverted RS-485 bus.

2. SEND_PTP and CB 1241 Configuration

The SEND_PTP (Transmit send buffer data) instruction moves the contents of a user buffer to the CB 1241 transmit FIFO. Execution is non-blocking: the CPU continues to the next network while the on-board UART engine shifts the bytes out at the configured baud rate. The companion instruction is RCV_PTP, which deposits received bytes into a user-defined buffer. For a polled, character-echo bench test, both instructions are wired into OB1 with a one-second enable pulse.

Key SEND_PTP input parameters:

For a round-trip echo bench test the configuration block of the CB 1241 port must be set as follows:

• Protocol: Freeport (the only mode exposed on the CB 1241 RS485 hardware)
• Baud rate: 38400 bit/s (default 9600 also acceptable for diagnosis)
• Data bits: 8
• Parity: None
• Stop bits: 1
• Flow control: None (RS485 half-duplex is direction-controlled by the driver, not RTS/CTS)
• End-of-receive timeout: 200 ms is a safe default for human-typed characters

If Freeport is not selectable in TIA Portal for the CB 1241, the CPU firmware is older than V4.2. Upgrade to the latest firmware in the Siemens Industry Online Support portal before continuing, as legacy SEND_PTP and RCV_PTP require that profile.

3. RS485 Electrical Layer Reference

RS-485 is a differential, balanced signalling standard described in TIA-485-A and IEC 60896. A transceiver generates V_A - V_B on the bus:

• Mark (logic 1, idle): V_A - V_B < -200 mV, typically the driver forces B high, A low
• Space (logic 0, active): V_A - V_B > +200 mV, typically A high, B low
• Receiver threshold: ±200 mV, ±7 V common-mode range, ±12 V fault tolerant on most modern transceivers

Because the receiver simply looks at the difference, polarity is the only thing that distinguishes A from B. The Texas Instruments RS-485 Design Guide (Rev. D) lists the TIA-485-A convention: terminal A is the inverting line (sometimes labelled Y or -), terminal B is the non-inverting line (sometimes Z or +). The Siemens CB 1241 sub-D pinout (looking at the male connector on the module) follows the convention used by SIMATIC ET 200 and S7-200 RS485 ports:

On a half-duplex RS485 bus, the transmit and receive pairs are tied together at the transceiver (TA shorted to RA, TB shorted to RB). That means a single twisted pair carries data in both directions, and only one driver may be enabled at a time. The CB 1241 uses on-board auto-direction: the driver chip's /RE and DE pins are tied together by the firmware so the module is listening whenever the line is idle and switches to transmit the instant SEND_PTP is called.

4. A/B Signal Convention Pitfalls

Three conventions for the A/B labels co-exist in the wild, and the failure mode in this article is the direct result of a clash between two of them:

1. TIA-485-A standard: A is the inverting line (idle low), B is the non-inverting line (idle high). Most transceiver datasheets (TI SN65HVD75, MAX MAX3485, Analog Devices ADM485) follow this convention.
2. Siemens SIMATIC convention: Matches TIA-485-A on the S7-1200, S7-200, ET 200SP and ET 200MP RS485 ports — A inverting, B non-inverting.
3. Some USB-to-RS485 adapters (low-cost FTDI modules from Asia, CH340 boards, certain Prolific designs): The silkscreen labels A and B are reversed relative to the TIA-485-A standard. A on the dongle is the non-inverting line, B is the inverting line. This convention was popularised by Maxim and was adopted by several Asian reference designs.

The convention clash is not a hardware fault, it is a documentation error. The dongle is functional; the silkscreen is simply inverted with respect to the PLC. When the harness is built "A-to-A, B-to-B" using the dongle's labels, the differential pair is inverted relative to what the PLC expects, and every bit on the bus is the logical NOT of the bit the driver intended to send.

5. Root Cause Analysis

With the bus polarity inverted, the UART inside the CB 1241 sees the inverted waveform. Three consequences explain the observed garbled bytes:

1. Start bit inversion: The driver asserts a space (low) as the start bit. The inverted line presents a mark (high) at the receiver. The UART inside the CB 1241 samples on the falling edge of start, so it never sees the start bit. Instead, it samples on the first falling edge of the data stream — which, after inversion, is the original stop bit.
2. Payload bit inversion: Every payload bit arrives flipped. The byte that the driver wanted to send as 0x01 (binary 00000001, LSB first) is seen on the bus as 11111110. With the LSB-first framing the receiver interprets 11111110 as a different byte depending on where the new frame begins.
3. Stop-bit redefinition: The original stop bit (a mark, high) becomes a space (low) on the inverted bus, so the receiver treats the line idle as a continuous stream of zeros and re-arms for the next start bit one bit-time later than it should. The re-synchronisation can shift the bit sampling window by half a bit period or a full bit period depending on the dominant edge.

The combined effect for 0x01 is the receiver decoding 0x7F (or 0xFE if no start-bit search runs) with the UART reporting no error because the parity, if any, still matches (no parity in our case) and the stop-bit sampling on the inverted bus lands on what the receiver thought was the data LSB. The CB 1241 firmware does not flag this as an error in STATUS; legacy RCV_PTP only reports errors such as buffer overflow, parity mismatch, or hardware fault — not a polarity problem.

6. Oscilloscope Diagnostic Procedure

The most reliable way to confirm polarity inversion is to capture the bus on a two-channel oscilloscope. A USB logic analyser with Sigrok / PulseView is an acceptable substitute. The procedure takes less than five minutes once the probes are connected.

1. Power the bench in idle: CB 1241 powered, USB dongle plugged in, no traffic on the bus. Probe CB 1241 pin 8 (TA) on channel 1 and pin 9 (TB) on channel 2.
2. Trigger on TB rising edge: Set channel 2 (TB) as trigger, edge rising, threshold 1.0 V, hold-off 1 ms.
3. Send a single ASCII character from the PC terminal: Use a printable character such as 'U' (0x55). The CB 1241 will see the inverted frame and discard it (or report garbage in the receive buffer), which is the point of the test.
4. Inspect the captured waveform: The signal on TA (inverting, expected low at idle) and TB (non-inverting, expected high at idle) should show TB high, TA low when the bus is idle. If TB is low and TA is high at idle, the dongle has the inverted silkscreen — the bus is wired backwards relative to the PLC.
5. Cross-check with a known good adapter: Borrow a converter from a working S7-1200 PROFIBUS or USS installation. Repeat the capture. If the idle state now shows TB high and TA low, the original dongle is the source of the inversion.

7. Wiring Correction and Termination

Once polarity inversion is confirmed, the fix is mechanical: swap the A and B conductors on the dongle side of the harness. There are three implementation options, in order of preference:

1. Re-pin the sub-D connector on the harness: Cut and re-crimp pins 4/5 (RA/RB) and 8/9 (TA/TB) on the dongle side, leaving the PLC sub-D untouched. This preserves the SIL rating of the PLC connector and makes the change obvious to the next commissioning engineer.
2. Add a crossover in the cable: Use a short crossover pigtail (DB9 male-to-female) that swaps pins 4↔5 and 8↔9 between the PLC and the dongle. This is the fastest fix in the field but introduces a second connector that can be unplugged by mistake.
3. Replace the dongle with a model whose silkscreen matches TIA-485-A: Industrial-grade converters from ICPCON, Moxa UPort 1130/1150, or Phoenix Contact FL COMSERVER always follow the standard convention. This is the right answer for a permanent installation.

The bus also needs correct termination. RS485 must be terminated at both ends of the trunk with 120 Ω resistors in parallel with the differential pair. The CB 1241 has an internal 120 Ω termination that can be enabled by closing the "Term" switch on the module or by a software toggle in the device configuration in TIA Portal. The USB dongle should also have its 120 Ω termination enabled if it is the far end of the trunk. A common bench error is to enable termination on the dongle and the PLC and add a third 120 Ω in the cable — that loads the drivers to 40 Ω, exceeds the RS485 common-mode minimum, and creates a new set of reflections.

Recommended cable: shielded twisted pair, 24 AWG, characteristic impedance 120 Ω, e.g. Belden 3106A or Lapp UNITRONIC Li-2YCY. Shield bonded to chassis at the PLC end only. Maximum stub length from trunk to device 1 m for 38400 bit/s; the 1/10 rule of thumb (stub ≤ trunk/10) is conservative and safe.

8. Verification Tests

After the A/B swap, repeat the bench test with the following sequence:

1. Send 0x01 from the PC. The CB 1241 receive buffer must contain 16#01 exactly.
2. Send the printable ASCII sequence ABCDEFGH. The buffer must contain the same characters, no byte inversion, no framing error, no STATUS non-zero.
3. Run the long-running pattern test: from the PC, send bytes 0x00 through 0xFF at 38400 bit/s, 10 ms gap between bytes. The receive buffer must reproduce the sequence identically.
4. Reverse the test: trigger SEND_PTP from a marker bit, capture the bus on the oscilloscope, confirm that pin 9 (TB) is high at idle and pin 8 (TA) is low at idle, then drops during the start bit and the inverted payload.
5. Sustain 1 hour of round-trip echo at 38400 bit/s to detect thermal drift in low-cost dongle transceivers. Industrial-grade converters are usually stable; consumer-grade CH340 boards can lose the bus after 30-60 minutes in a hot cabinet.

If any test produces a different byte, stop and re-probe the bus. Do not assume a software bug — RS485 commissioning problems are wiring problems 90% of the time.

9. Field Commissioning Checklist

Use this checklist on every new S7-1200 RS485 node, regardless of the symptoms reported.

• Confirm TIA Portal project protocol is Freeport, baud matches the partner device, 8N1.
• Confirm the CB 1241 hardware identifier in the SEND_PTP ID input matches the device configuration.
• Confirm the receive buffer pointer is correctly typed (BYTE, not WORD or DWORD) and the length is right.
• Confirm termination: 120 Ω at both ends only, no third terminator.
• Confirm shield bonding at one end only (typically the PLC end).
• Confirm A/B polarity with an oscilloscope on the first install. Mark the harness polarity on the schematic.
• Confirm the dongle's silkscreen convention against the TIA-485-A standard before wiring.
• Run the 0x00-0xFF pattern test on commissioning, save the trace to the project archive.
• Log the partner device's protocol, slave address, byte order (little-endian for S7-1200), and turnaround time in the project documentation.

10. Common Error Codes When Polarity Is Suspected

The legacy RCV_PTP instruction does not raise a polarity-specific error, but a polarity fault can cause some partner devices to assert timeouts that the CPU interprets as a bus fault. Watch for these:

If 0x0000 is reported and the bytes are wrong, polarity inversion is the most likely cause. If framing or parity errors are reported, the polarity is partially inverted (one side of the pair is correctly driven, the other is left floating, common with failed dongle transceivers).

11. Extended Diagnostic Notes

A few additional observations from real S7-1200 installations help close the loop on this issue.

Dongle quality matters. A dongle based on the FTDI FT232R + MAX3485 pair is the most reliable option. CH340 + SP485E dongles are the cheapest and the most likely to have a mislabeled silkscreen, plus they can overheat in a sealed panel. CP2102 + MAX485 dongles are usually correct but the MAX485 variant on the board is occasionally substituted with an SP485E that has the inverted convention.

Bias resistors. Fail-safe biasing (a pull-up on B and a pull-down on A through 680 Ω to +5 V and GND) is required when no device is driving the bus. The CB 1241 provides internal bias that can be enabled in the device configuration. Without bias, an idle inverted bus floats and produces random noise that triggers framing errors.

Ground loops. The PC's USB ground is rarely the same potential as the PLC's chassis ground. A ground loop of more than 7 V common-mode can push a properly-wired RS485 receiver outside its linear range and produce the same garbled bytes as a polarity inversion. Use a USB isolator (e.g. B&B USB-ISO or Phoenix Contact FL ISOLATOR) when commissioning on a noisy desk.

Cable capacitance. At 38400 bit/s the cable capacitance budget is generous, but cheap Cat-5 patch cables used as RS485 trunks have higher capacitance per metre than Belden 3106A. If the bench test passes on a 1 m cable and fails on a 20 m cable, suspect capacitance first, polarity second.

12. Frequently Asked Questions