S7-1200 CM 1241 RS485 Communication with KEPServerEx on TIA

Overview

When the integrated PROFINET port of a SIMATIC S7-1200 CPU (for example, CPU 1214C DC/DC/DC, 6ES7214-1AG40-0XB0) is fully occupied by an HMI panel such as a KTP600, an additional communication path to a supervisory PC is still feasible through the left-side communication module (CM) bus. The CM 1241 family — available in RS232 (6ES7241-1AH32-0XB0) and RS422/485 (6ES7241-1CH32-0XB0) variants — provides a galvanically isolated serial interface that maps cleanly to an OPC server such as KEPware's KEPServerEx using either the Modbus RTU/ASCII or the Siemens ASCII driver.

This reference walks through the full path: module selection, TIA Portal V17 hardware configuration, serial parameter assignment, Send_Config / Receive_Config / Send_P2P / Receive_P2P instruction wiring, KEPServerEx channel/device setup, and end-to-end verification. Where a limitation exists on the Ethernet side (CPU firmware, PG/PC and HMI connection budget), an unmanaged CSM 1277 (6GK7277-1AA10-0AA0) is documented as a valid fallback.

Prerequisites

• CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0) with firmware V4.2 or higher. The CM 1241 point-to-point protocol blocks were promoted from the PtP library in TIA V13 to the S7-1200 base instruction set from firmware V4.0 onward; V4.4 is recommended for current TIA Portal V17 projects.
• CM 1241 RS422/485 (6ES7241-1CH32-0XB0) — supports both 2-wire RS485 and 4-wire RS422. Use this article's part for the 2-wire RS485 multidrop case; for true RS232 flow, swap to the 6ES7241-1AH32-0XB0 variant.
• TIA Portal V17 (or V16 with HSP 0294) for the CM 1241 V2.1 hardware catalog entry.
• KEPServerEx V4.0 (as referenced) or current V6.x with the Siemens TCP/IP Ethernet or Modbus RTU/ASCII driver enabled. The KEPServerEX Modbus RTU/ASCII driver is the typical path for an RS485 bus.
• Shielded twisted-pair cable (e.g. Belden 9841 for RS485), shield grounded at one end, 120 Ω termination at both physical ends of the RS485 segment.
• 24 V DC supply for the CM 1241, 0.5 A minimum headroom beyond the CPU 24 V budget.

CM 1241 RS422/485 Technical Specifications

Per the CM 1241 RS422/485 technical specifications page in the SIMATIC S7-1200 Manual Collection, the module is rated for the values summarized below.

Hardware Topology

Pin-out for the CM 1241 RS422/485 in 2-wire mode (terminal block on the bottom of the module):

Step 1 — Configure the CM 1241 in TIA Portal

1. In the project tree, open Devices & Networks and select the S7-1200 CPU.
2. In the Hardware catalog, navigate to Communication modules → CM 1241 → RS422/485. If only the older V1.0 catalog entry appears, install Hardware Support Package HSP 0294 (TIA V17) or the matching HSP for your installed TIA version.
3. Drag the module to slot 101 of the CPU. The 1214C supports up to three CM/CP modules; slot 101 is the leftmost.
4. Open the module's Properties → Port configuration and set the values that match KEPServerEx.

Step 2 — Program the Modbus Master in OB1

Insert the standard S7-1200 Modbus master blocks from Instructions → Communication → Modbus. The order of instantiation matters: Modbus_Comm_Load must execute once on the rising edge of REQ to bind the CM to the DBs.

// Modbus_Comm_Load – executed once on cold start
#Modbus_Comm_Load.REQ      := TRUE;            // pulse TRUE for one cycle
#Modbus_Comm_Load.PORT     := 0;               // CM slot index 0 = first CM
#Modbus_Comm_Load.BAUD     := 19200;
#Modbus_Comm_Load.PARITY   := 2;               // 0=None, 1=Odd, 2=Even
#Modbus_Comm_Load.FLOW_CTRL:= 0;               // 0=None, 1=Hardware, 2=XON/XOFF
#Modbus_Comm_Load.TIMEOUT  := 1000;            // ms per request
#Modbus_Comm_Load.MODE     := 0;               // 0=Full duplex RS232, 1=RS485 half-duplex
#Modbus_Comm_Load.DONE     => #cfg_done;
#Modbus_Comm_Load.ERROR    => #cfg_err;
#Modbus_Comm_Load.STATUS   => #cfg_stat;

Then issue a Modbus request — for example read holding registers from the PC side. Note that the CM 1241 acts as a master toward KEPServerEx acting as a virtual slave; if KEPServerEx is the OPC concentrator and the S7-1200 must be polled, the CM is the master. If you prefer KEPServerEx to poll, swap the role: on the CM, switch protocol to Modbus slave in the port configuration.

// Modbus_Master – read 10 holding registers starting at 40001
#Modbus_Master.REQ        := #poll_trig;      // 1-Hz pulse from cyclic OB
#Modbus_Master.MB_ADDR    := 1;               // slave ID on the bus
#Modbus_Master.MODE       := 0;               // 0=Read, 1=Write, 2=Read/Write, 3=Write multiple
#Modbus_Master.DATA_ADDR  := 0;               // 0-based Modbus address (40001 → 0)
#Modbus_Master.DATA_LEN   := 10;              // number of registers
#Modbus_Master.DATA_PTR   := #HoldingRegs;    // ARRAY[0..9] OF WORD in a global DB
#Modbus_Master.DONE       => #rx_done;
#Modbus_Master.ERROR      => #rx_err;
#Modbus_Master.STATUS     => #rx_stat;

Step 3 — KEPServerEx Channel and Device

1. Launch KEPServerEX Configuration. In V4.0, choose Edit → Add Channel. Pick Modbus RTU Serial for an RS485 bus.
2. Channel properties — COM port: assign the virtual COM the USB-RS485 adapter enumerated (e.g. COM4). Baud: 19200, Parity: Even, Data bits: 8, Stop bits: 1, Handshaking: None. Set Wait for Device Request to No if the S7-1200 is acting as master.
3. Add a Device. Use slave ID 1, ID format Decimal, and zero-based addressing for the holding-register block. Click Add Tag for each value, mapping it to an OPC tag the SCADA consumes (e.g. Channel1.Device1.HoldingRegister0000).
4. Right-click the channel → OPC Quick Client to verify the tag updates when the S7-1200 CM 1241 transmits.

Step 4 — Asynchronous Freeport (Siemens ASCII) Variant

If the SCADA application uses legacy ASCII frames, drop the Modbus master FB and use the PtP instructions instead. The flow is: configure once with Send_Config and Receive_Config, then trigger Send_P2P on demand and evaluate Receive_P2P on the line-idle interrupt from RCV_CFG.

// Send_P2P – push a 16-byte telemetry frame
#Send_P2P.REQ    := #tx_pulse;
#Send_P2P.PORT   := 0;
#Send_P2P.BUFFER := #txFrame;     // VARIANT to a POKE'd area, max 1024 bytes
#Send_P2P.LENGTH := 16;
#Send_P2P.DONE   => #tx_done;
#Send_P2P.ERROR  => #tx_err;

Verification

1. From TIA Portal, download the project to the CPU in RUN. Confirm that the CM 1241 is online (Online & diagnostics → Diagnostics → Port diagnostics shows Status OK and the configured baud).
2. Open KEPServerEx Quick Client. Force the CM to send with a watch-table value of TRUE on poll_trig. Holding-register tags must tick at the 1-Hz poll rate.
3. Inspect the LED of the CM 1241: green TxD flashes on each master query, amber RxD flashes on each slave response. Persistent red ERROR indicates framing or termination problems.
4. Use a USB protocol analyzer (e.g. Systembase PortView 7 / Moxa Uport 1100) on a Y-splitter to capture bus traffic and confirm the Modbus CRC16 (or ASCII LRC) matches the values returned to the PLC's #rx_stat.

Error Code Reference for the CM 1241 PtP / Modbus Blocks

Troubleshooting Matrix

CSM 1277 Alternative Path (When Ethernet Is Actually Open)

Before reaching for the CM 1241, verify whether the Ethernet path is exhausted. The S7-1200 PROFINET interface provides up to 16 active connections depending on CPU firmware, with the budget allocated as: 1 PG/PC (HMI use), 3 HMI panels, 8 PUT/GET, 4 S7 communication. A CSM 1277 (6GK7277-1AA10-0AA0) is an unmanaged 4-port switch that is not configured in TIA Portal — it is invisible in the project tree, requires only a 24 V supply, and is the canonical way to add a second Ethernet node to the same CPU port without consuming a HMI connection slot from the panel.

Field Commissioning Checklist

• Verify 24 V to the CM 1241; measure > 20.4 V at the module terminals under load.
• Enable internal termination (DIP 1) on the CM and at the KEPServerEx RS485 isolator. The standard 120 Ω RS485 termination lives at the two physical line ends only — never in the middle.
• Confirm 24 V common between the CPU and the USB-RS485 isolator (signal ground tied, PE separate).
• Capture the bus with a USB analyzer during a single Modbus_Master cycle and verify the round-trip is < 100 ms at 19 200 bps for a 10-register read.
• Disable any Windows power management on the USB-to-serial adapter (Device Manager → Power Management tab → uncheck "Allow the computer to turn off this device to save power").

FAQ