S7-1200 CM 1241 Error 80A0 with LS2208 Barcode Scanner

1. Problem Statement and Field Context

The most common error condition encountered when integrating a Motorola (now Zebra) Symbol LS2208 handheld barcode scanner with a Siemens SIMATIC S7-1200 controller through the CM 1241 RS422/485 module is the 16#80A0 status code returned by the PORT_CFG instance. The error is generated on the rising edge of DONE after the REQ input has been pulsed, or it appears statically on the STATUS output once ERROR becomes TRUE. The 80A0 result traps the application in a non-functional state because until PORT_CFG completes successfully, the port's baud rate, parity, and protocol remain at their hardware-default values, and downstream RCV_PTP calls cannot deliver valid data frames.

LS2208 scanners ship from the factory with RS232 enabled, default parameters of 9600 baud, 8 data bits, no parity, 1 stop bit, and no handshaking. The cable ending in a DB9 female uses a DCE configuration with TX on pin 3 and RX on pin 2 relative to the host's DTE. Because the S7-1200 CM 1241 RS422/485 module exposes only an RS422/RS485 port, a passive or active level converter is required. Field installations commonly use a HEXIN HE-XSCOM-220 or similar 9-pin RS232-to-RS485 auto-transceiver that operates as a 2-wire half-duplex device on the RS485 side. Once the physical layer is bridged, the remaining problem is purely a configuration discrepancy: PORT_CFG detects that the protocol requested by the program does not align with the protocol configured in TIA Portal for the CM module, or that the parameters requested by the program conflict with the port's permitted range.

This reference analyzes the 16#80A0 error, traces each probable root cause to the underlying TIA Portal hardware configuration of the CM 1241, and provides a reproducible software template — including the background data block declaration, the call order of PORT_CFG → RCV_PTP, and the diagnostic watch-table values — that eliminates the error on first commissioning.

2. System Topology and Signal Flow

The data path is strictly half-duplex; scanner transactions never overlap with PLC transmissions:

  LS2208            HEXIN              CM 1241            S7-1200
  +-------+        +-------+           +-------+          +-------+
  | RJ45  |  RS232 |RS232  |  RS485    | DB9   |  backplane  | CPU  |
  | Plug  |  TX RX |side   |  half-dup  |female |   I/O       | 1214 |
  |  /DU  |---DB9--| DB9   |----DB9----| /B/A  |------------|      |
  +-------+        +-------+           +-------+          +-------+
   pin 5 TXD  ----> RXD                 pin 7/8 ----------> input
   pin 6 RXD  ----> TXD                 pin 4    ----------> M
   pin 4 GND  ----- GND                  termination = OFF

The HEXIN device accepts RS232 TxD/RxD/GND on the host side and converts them into a self-biased RS485 differential pair on the field side. Because the CM 1241 in 2-wire RS485 mode listens on the same pair, both ends share the bus and the HEXIN auto-direction switching toggles the driver in synchrony with the LS2208 byte stream.

2.1 DB9 Pin Assignments

Use pin 8/7 (or pin 2/1, the inner pair) as the active differential pair. The outer pair (8 + 9, 7 + 1) belongs to the four-wire RS422 mode and is unused for half-duplex operation with a passive converter.

3. CM 1241 RS422/485 Hardware Specifications

The CM 1241 RS422/485 module (Siemens 6ES7241-1CH32-0XB0, firmware V2.0 or higher for TIA Portal V17 and newer) is the only CM 1241 variant with differential RS485 signaling. Other catalog numbers such as 6ES7241-1CH30-0XB0 and 6ES7241-1CH31-0XB0 are RS232 only. Verify the part number printed on the module faceplate before applying this guide; the markings follow the form 6ES7 241-1CH32-0XB0.

Authoritative specification source: SIMATIC S7-1200 Manual Collection — CM 1241 RS422/485 Specifications. The CM module must be configured for the ASCII / Freeport protocol in TIA Portal. To do this, open Properties → Communication interfaces → CM 1241 → Port configuration → Protocol selection and select ASCII. Selecting Modbus RTU for an ASCII scanner produces an immediate 80A0 error the first time PORT_CFG executes.

4. Zebra LS2208 Default Communication Parameters

The LS2208 leaves the factory with a configuration suitable for retail POS deployments. Most field installations using the LS2208 with industrial controllers need to reconfigure the scanner to match host parameters exactly. The default settings are summarized below.

To exit USB-HID mode and revert to RS232C, scan the "Enable RS-232 (Standard)" barcode in the LS2208 Product Reference Guide. To set 9600 baud unambiguously, scan the four-digit baud-rate barcode "0960" from chapter three of the LS2208 programming guide. To enforce a termination, scan the "Add Suffix = CR" code from the data-formatting chapter. If you do not change anything else, the scanner on first power-up sends characters at 9600/8/N/1 with CR — exactly the parameters PORT_CFG expects on the CM module.

Any mismatch between the scanner (set via the configuration barcodes) and the CM (set in TIA Portal hardware config or via PORT_CFG) produces corrupted framing in the receive ring and a raised ERROR flag in RCV_PTP with STATUS 16#8180 or 16#81B0. Those error codes are distinct from 16#80A0 — see Section 5 for the full disambiguation.

5. Decoding 16#80A0 on PORT_CFG and RCV_PTP

The status code 0x80A0 in the Siemens PtP library has different meanings depending on which block produced it. Always read both ERROR and STATUS outputs of both PORT_CFG and RCV_PTP to disambiguate.

If the only error appears on RCV_PTP after a successful PORT_CFG, the physical layer is suspect, not the parameter set. Substitute Section 2 wiring and Section 11 matrix first.

6. Configuring the CM 1241 in TIA Portal — Static (Hardware) Setup

The simplest way to avoid 80A0 is to skip PORT_CFG entirely and configure the port once in TIA Portal, letting the program use the resulting default values. This is the static configuration path.

1. In the device tree, right-click CM 1241 (RS422/RS485) → Properties.
2. Select Port configuration; then set the following:
   • Protocol selection: ASCII
   • Operating mode: RS485 (2-wire) — Half-duplex (must match the HEXIN converter's auto-transceiver mode)
   • Baud rate: 9600
   • Parity: None
   • Data bits: 8
   • Stop bits: 1
   • Receive line termination: On (only one device on the bus segment; the CM 1241 is the master end).
   • Flow control: None (the HEXIN passive converter does not implement hardware flow control).
3. Press Ctrl+Shift+B to compile the hardware, then download to the CPU. Re-evaluate and run once. The CPU will detect the CM in slot 1 and proceed to RUN.

If you do not call PORT_CFG in the user program at all, the runtime never tries to reconfigure the CM, and 80A0 cannot originate from this block. Dynamic reconfiguration is only required when multiple scanner types share the same port and need differing parameters at runtime, which is rare on LS2208 installations.

7. Dynamic Reconfiguration with PORT_CFG

When you need to change protocol parameters at runtime — for example, switching from 9600-8-N-1 to 19200-8-E-1 to support a different end device — use the PtP library block PORT_CFG. This library is delivered with every TIA Portal installation since V13 SP1 (Master copies under Global libraries → PtP → Communication).

7.1 Parameter Data Block Declaration

Pre-declare the configuration DB once:

DATA_BLOCK "PtP_Cfg_Param"
AUTHOR : PLC_ENG
VERSION : 1.0
  STRUCT
    BaudRate   : WORD := W#16#850;   // 9600 bps
    StartDelay : WORD := W#16#0;     // 0 character-times
    EndDelay   : WORD := W#16#0;
    Parity     : BYTE := B#16#0;     // 0=none, 1=even, 2=odd, 3=force-0, 4=force-1
    StopBits   : BYTE := B#16#1;     // 1=1 stop, 2=2 stop
    DataBits   : BYTE := B#16#8;     // 7 or 8
    FlowControl: BYTE := B#16#0;     // 0=none (mandatory for HEXIN passive converter)
    Protocol   : BYTE := B#16#1;     // 1=ASCII / Freeport
  END_STRUCT;
END_DATA_BLOCK

7.2 PORT_CFG Call

Call only once in OB100 (warm restart) so the CM has time to initialize:

// OB100 "Complete restart"
"RCV_PTP_DB".EN_R := FALSE;
"RCV_PTP_DB".R    := TRUE;   // purge FIFO

"PORT_CFG_DB"(REQ        := TRUE,
              PORT        := "Local~CM_1241_1",
              WRITE_CFG   := TRUE,
              READ_CFG    := FALSE,
              USER_DATA   := "PtP_Cfg_Param",
              DONE        => "Tag_PortCfgDone",
              ERROR       => "Tag_PortCfgError",
              STATUS      => "GVL.PortCfgStatus");

7.3 PORT_CFG Argument Mapping

• REQ: rising edge triggers the configuration. Re-assert only after DONE returns; otherwise the library reports 80A2 (overlap protection).
• PORT: System constant of the CM 1241 (drag from System constants — default name "Local~CM_1241_1").
• WRITE_CFG: TRUE means write; FALSE means only read the active parameters.
• USER_DATA: pointer to a tag of type USIF_DATA_REC declared in the PtP library. The data block must use standard (absolute) addressing in library versions below V5.0; from V5.0 onward, optimized blocks are accepted.
• DONE / ERROR / STATUS: standard completion outputs (one cycle wide, must be latched externally).

7.4 Failure Conditions That Produce 80A0 from PORT_CFG

1. Calling PORT_CFG while RCV_PTP is still active. Reset RCV_PTP first (EN_R := FALSE; R := TRUE for one cycle).
2. Selecting a baud rate outside the documented code list. Use only:
   

   W#16#840 = 2400, W#16#848 = 4800, W#16#850 = 9600, W#16#858 = 19200,
       W#16#1020 = 38400, W#16#1040 = 57600, W#16#1080 = 115200

   .
3. USER_DATA pointer refers to a tag inside a non-optimized DB but the DB has been auto-overwritten by a newer library version. Right-click → "Update block" (V5 only).
4. The CM module's hardware configuration in TIA Portal still has Protocol = Modbus RTU; the runtime then refuses to overwrite.
5. Calling PORT_CFG on the very first OB1 scan (some users do this with a "FirstScan" tag). Delay the call by at least 2 OB1 cycles after RUN. The CM module needs roughly 150 ms before any configuration accepts.

8. PLC Program: Receiving LS2208 Frames with RCV_PTP

The LS2208 finishes each scan by transmitting the decoded value followed by a CR (0x0D) terminator. Use RCV_PTP to assemble the frame and store it in a data block.

8.1 Receive Buffer Data Block

DATA_BLOCK "Barcode_Buffer"
  STRUCT
    Received : BOOL := FALSE;
    NewData  : BOOL := FALSE;
    Error    : BOOL := FALSE;
    Status   : WORD := W#16#0;
    Length   : UINT := 0;
    Payload  : ARRAY[0..255] OF BYTE;
    Ascii    : STRING[256] := '';
  END_STRUCT;
END_DATA_BLOCK

8.2 RCV_PTP Call in OB1

// OB1 cyclic section
"RCV_PTP_DB"(PORT         := "Local~CM_1241_1",
             BUFFER       := "Barcode_Buffer.Payload"[0],
             BUFFER_LENGTH := 256,
             EN_R         := TRUE,
             R            := FALSE,
             CR           := 16#0D,            // LS2208 default CR terminator
             NDR          => "Barcode_Buffer".NewData,
             ERROR        => "Barcode_Buffer".Error,
             STATUS       => "Barcode_Buffer".Status,
             LEN          => "Barcode_Buffer".Length);

The CR input (PtP library V5.0+) replaces the older TBL (terminator table). When RCV_PTP detects byte CR in the receive ring, it commits the accumulated buffer to BUFFER and raises NDR for one OB1 cycle. For LS2208 with CR terminator only, set CR := 16#0D. For CR+LF (rare on LS2208; default on industrial scanners like Keyence SR-1000), use SGN_CNT or a multi-byte terminator pattern.

8.3 Byte-to-String Conversion

After NewData = TRUE, convert the payload to an ASCII string and acknowledge the receive:

// FC "FC_Convert_Scan" on rising edge of Barcode_Buffer.NewData
FOR #i := 0 TO UINT_TO_INT("Barcode_Buffer".Length) - 1 DO
    IF "Barcode_Buffer".Payload[#i] = 16#0D OR
       "Barcode_Buffer".Payload[#i] = 16#0A THEN
        CONTINUE;
    END_IF;
    #ch := CHAR_FROM_BYTE("Barcode_Buffer".Payload[#i]);
    IF #ch <> CHAR#8 THEN    // strip incoming backspaces if any
        "Barcode_Buffer".Ascii := INSERT("Barcode_Buffer".Ascii,
                                            #ch,
                                            INT_TO_UDINT(#i + 1));
    END_IF;
END_FOR;

"RCV_PTP_DB".R := TRUE;     // one cycle, clears the FIFO

9. Step-by-Step Commissioning Procedure

1. Wire the HEXIN converter between the LS2208 and the CM 1241 as in Section 2. Tighten both DB9 connector shells into the converter housing to ensure shield continuity.
2. Enable RS232 on the LS2208 by scanning the "Set RS-232 (Standard)" barcode from the LS2208 Product Reference Guide. Retail SKUs ship in USB-HID mode and must be switched.
3. Set the LS2208 baud rate to 9600 by scanning the "*0960*" configuration barcode. Add the "Carriage Return Suffix" barcode to enforce 0x0D terminator.
4. In TIA Portal, open the project. Drag the CM 1241 RS422/RS485 from the hardware catalog (search by 6ES7241-1CH32-0XB0) into the device configuration under the CPU. The firmware revision (typically V2.0) appears under the Identification tab.
5. Apply the static protocol settings per Section 6. Save, compile (Ctrl+Shift+B), download to the CPU.
6. Add the PtP library functions to the project: Project → Global libraries → Library → PtP → PtP Communication. From the master-copies pane, drag PORT_CFG, RCV_PTP, and the type USIF_DATA_REC into your program.
7. Instantiate the two function blocks under a shared instance DB (FB 105 "PtP_Instance" with multi-instance calls) or as discrete instance DBs.
8. Build a one-shot trigger for PORT_CFG in OB100 (warm restart) or first OB1 cycle. Use a retentive tag like "System.firstScan" := TRUE on cold start.
9. Open a watch table and inspect PORT_CFG_DB.STATUS; the expected value is 16#0000.
10. Scan a test barcode with the LS2208. RCV_PTP should set NDR (NewData) within ~50 ms. The ASCII string in Barcode_Buffer.Ascii must match the printed barcode.

If STATUS is 16#80A0 at step 9, proceed to Section 11. The error is configuration-derived and is the first thing to verify before any physical-layer diagnosis.

10. Verification — Watch Tables and Online Trace

10.1 Watch-Table Verification

A reproducible watch table for daily use:

// WT_PtPDiag
"PORT_CFG_DB".STATUS         // expected 16#0000 after DONE
"PORT_CFG_DB".DONE           // expected TRUE one cycle
"RCV_PTP_DB".STATUS          // expected 16#0000 or 16#80A0 (no data yet)
"RCV_PTP_DB".ERROR           // expected FALSE
"Barcode_Buffer".NDR         // expected TRUE on scan
"Barcode_Buffer".Length      // expected >0 after scan
"Barcode_Buffer".Ascii       // expected = "<scanned value>"

10.2 Online Trace (TIA V17+)

1. Open Online → Traces → Configure.
2. Add the following tags at a sampling interval of 1 ms:
   • RCV_PTP_DB.NDR
   • RCV_PTP_DB.ELAPSED
   • RCV_PTP_DB.STATUS
   • RCV_PTP_DB.ERROR
3. Trigger a scan. The rising edge of NDR must appear within the 1-character time after the audible beep:
   9600 baud × 10 bits per character (8-N-1) = ~1.04 ms per character. For a 13-character payload + CR, expected delay ≈ 14 × 1.04 = ~14.5 ms. Allow up to 50 ms before declaring a fault.

10.3 Loop-Back Test

Before scanning any barcode, verify the CM 1241 can self-echo. Loop pins 7 and 8 together (short the differential pair to itself) and run a terminal-emulator program on the PLC side. If characters transmitted via SEND_PTP return in the receive buffer, the CM module and termination are healthy; the problem is upstream (HEXIN converter or LS2208).

11. Troubleshooting Matrix

12. Operational Notes and Safety Caveats

• The HEXIN converter is a passive device. Operating temperature range is 0 °C to +60 °C. Industrial-grade converters from Phoenix Contact (PSM-ME-RS485) or Wago (857-418) provide -25 °C to +70 °C operation and surge protection compliant with IEC 61000-4-5.
• The CM 1241 supplies a maximum of 80 mA on pin 6 (P5V). If the HEXIN converter draws more than this, supply the converter locally from a Siemens 6EP1 SITOP power supply.
• Always check the LS2208 Product Reference Guide for the specific SKU. The LS2208-SR20007R-NA ships with the USB cable, not RS232; the LS2208-SR20001R-NA ships RS232 — verify the part number before commissioning.
• Do not bridge D+ to D- across the CM 1241's differential pair with a low-impedance connection. The default HEXIN 2-wire conversion provides ~120 Ω termination at the device end; doubling that on both ends reduces bus amplitude below the CM 1241's differential threshold (~ 0.2 V min).