S7-1200 CM1241 RS485 Rx Not Working: Field Troubleshooting Guide

The classic first-time S7-1200 serial-port symptom is a fully functional transmit path combined with a completely silent receive path. SEND_PTP pushes bytes to the terminal without error, the Tx LED pulses on every character, and the remote PC echoes the data back. Yet the CM 1241 RS422/485 Rx LED never flashes, RCV_PTP never sets NDR, and the STATUS word holds a stale value. Almost every instance of this failure traces back to one of three causes: differential pair polarity, RS485 driver-mode selection on the converter, or a receive-block trigger that never gets armed.

This reference walks through the engineering-level diagnosis, configuration, and verification needed to recover the receive path on a 6ES7241-1CH30-0XB0 module programmed from TIA Portal. It is built around a real commissioning case in which the only defect turned out to be the pinout of the MOXA USB-to-RS485 adapter on the bench, but it expands into the broader half-duplex, end-condition, and termination pitfalls that any S7-1200 RS485 integrator will eventually meet.

1. Hardware Identification: CM 1241 RS422/485 (6ES7241-1CH30-0XB0)

The CM 1241 RS422/485 is a plug-in communication module that mounts on the left side of an S7-1200 CPU. It exposes a single 9-pin female sub-D connector that supports both RS422 (4-wire full duplex) and RS485 (2-wire half duplex) on the same physical port. From the S7-1200 manual collection:

Source: CM 1241 RS422/485 Specifications - TIA Portal Manual Collection. Additional product detail is available from the Siemens 6ES7241-1CH30-0XB0 product support page.

1.1 Pinout Reference

Although the same sub-D is used for RS422 and RS485, the active pins change. The two lines of interest for 2-wire RS485 are the differential pair A (non-inverting) and B (inverting). The convention is strict: A on the PLC must connect to A on the remote device, and B on the PLC must connect to B on the remote device. Crossing them produces a fully working transmitter and a permanently dead receiver, which is exactly the symptom in the case under study.

Pin numbering, signal names, and the P5V/M5V termination supply are taken directly from the TIA Portal S7-1200 Manual Collection. Field experience has shown that the exact pin labelling on the converter side (especially on multi-port MOXA NPort and UPort families) varies from unit to unit, so always cross-check with the converter's hardware manual before applying power.

2. Problem Description

The bench setup that produces this failure has the following characteristics:

• S7-1200 CPU (any FW that supports the CM 1241) with a 6ES7241-1CH30-0XB0 mounted in slot 101 or 102.
• TIA Portal project with SEND_PTP and RCV_PTP instructions from the "Communication -> Point-to-point" library.
• SEND_PTP.REQ driven from a discrete input (a pushbutton on a simulator board).
• RCV_PTP.EN_R driven from a separate discrete input, held TRUE while the user expects to receive data.
• Remote partner is a PC running HyperTerminal (or any TTY terminal such as Bray Terminal, PuTTY, Tera Term).
• Connection between the CM 1241 and the PC is made through a USB-to-RS485 converter (in the original case, a MOXA UPort 1150/1150I) or an RS485 terminal server (NPort 5600 series).

Observed behaviour:

1. SEND_PTP transmits successfully. The CM 1241 Tx LED flashes for every byte, and the remote terminal displays the data.
2. Pressing keys in the terminal or sending characters from the PC produces no activity on the CM 1241 Rx LED.
3. RCV_PTP.NDR never sets. RCV_PTP.STATUS remains 0x0000 or shows a "no receive active" code, depending on the firmware.
4. Removing the receive trigger and probing the bus with a scope shows the PC is in fact generating the correct differential levels, but the CM 1241 is not seeing them as a valid frame.

3. Root Cause Analysis

Half-duplex RS485 on a CM 1241 has a very small set of ways to fail silently on receive. The ranked list below comes from the symptom and from the case resolution.

3.1 Differential Pair Polarity Reversed (Most Common)

Reversing A and B on the converter side leaves the transmitter functioning because the CM 1241's own driver still swings both lines; it just drives them onto the wrong pair on the other device. The receiver on the CM 1241, however, expects a specific idle polarity: a stop bit reads as the idle state of the line. With A and B crossed, the CM 1241 sees continuous framing errors and discards every byte. The Tx LED will still flash because the line is being driven, but the Rx LED will not. This is the failure mode the original case resolved to: a different MOXA product on the bench used a different sub-D pinout, so the A/B lines were inadvertently crossed.

3.2 Converter Driver Mode Set to RS422 (4-Wire)

Many USB-to-RS485 adapters default to RS422 4-wire mode, where the transmitter and receiver are on separate differential pairs. If the converter is set this way and is connected to a 2-wire CM 1241, the converter's transmitter drives its own pair (which the CM 1241 is not even listening to) and its receiver watches a different pair (which the CM 1241 is not driving). The CM 1241 then receives nothing because nothing is on the bus it monitors. Set the converter to "RS485 2-wire" (PORT = 1 in the case of the MOXA UPort 1150 driver) before continuing.

3.3 Receive Block Not Armed

The RCV_PTP instruction does not listen to the line until EN_R is TRUE and the configured start condition has been met. If EN_R is wired to a discrete input that is FALSE, the receiver sits idle and the Rx LED will only flash for line-idle transitions, never for incoming characters. Holding EN_R TRUE is mandatory for any of the receive diagnostics in this article to work.

3.4 End Condition Mismatch Causing Buffer Starvation

Even when EN_R is TRUE, the receive block buffers characters internally until the configured end condition is met. If the end condition is set to "end-of-receive character" and the terminal is not sending that character, the buffer never closes, RCV_PTP never reports NDR, and the user interprets this as "Rx does not work." The standard recommendation for terminal-style traffic is to set the end condition to a receive-line idle timeout (ENDCOND = 4) of about 50 ms to 200 ms.

3.5 Termination and Bias

RS485 2-wire buses need bias resistors at one node to guarantee a defined idle state, and termination resistors (typically 120 Ω) at both ends of long runs. On a short bench cable (under 5 m) termination is usually unnecessary, but biasing is still required for any node whose receiver is enabled. Many commercial USB-to-RS485 converters integrate 1 kΩ pull-up on A and pull-down on B; the CM 1241 does not. Without bias, the line can float and the CM 1241's receiver can produce intermittent frame errors at higher baud rates.

4. RS485 Half-Duplex Operation on the CM 1241

The CM 1241 RS422/485 module does not expose a hardware direction-control (RTS) line to the application; the firmware handles the transceiver direction automatically. After power-on or after the port is reinitialised, the module is in listening mode: the RS485 transceiver is set to receive. When SEND_PTP is triggered with a positive edge on REQ, the firmware switches the transceiver to transmit, shifts out the bytes, returns the line to idle, and switches the transceiver back to receive. This transition is invisible to the user program; the DONE bit on SEND_PTP only rises after the line has returned to listening.

Implications:

• The application cannot simultaneously send and receive on a CM 1241 RS485 port. Half-duplex protocols such as Modbus RTU fit this model; full-duplex protocols do not.
• There is no "RTS toggle" to wire up. Earlier serial-port libraries required the application to set an RTS coil before sending; on the S7-1200 this is handled internally.
• If the partner device is also a CM 1241, the firmware on both sides will collide if they attempt to transmit at the same time. A higher-level protocol (master/slave, token-passing) must arbitrate.

This automatic direction control is the reason the receiver is "always armed" once EN_R is TRUE, but it is also the reason a wiring polarity error shows up as a fully-dead receiver while the transmitter appears normal: the driver swings the line whether or not the receiver can decode it.

5. TIA Portal Configuration of the CM 1241 Port

Open the device configuration of the CM 1241 in TIA Portal, select the RS422/485 interface, and configure the port properties. The fields that matter for the Rx-not-working case are listed below.

Save the configuration and download it to the CPU. Port configuration parameters are documented in the S7-1200 Communication Interfaces manual.

6. SEND_PTP and RCV_PTP Block Configuration

For an S7-1200 programmed in TIA Portal, the point-to-point instructions are dragged from the "Communication" task card. The two blocks relevant to a terminal-echo application are:

• SEND_PTP (FB 4) - transmit a buffer over the configured port.
• RCV_PTP (FB 5) - receive characters into a buffer, signalled by NDR when the configured end condition is met.

6.1 SEND_PTP

6.2 RCV_PTP

The minimum programme to bring the receive path up is:

1. Declare a global tag, e.g. RxBuf : ARRAY[0..99] OF BYTE;
2. Call RCV_PTP with EN_R latched TRUE and BUFFER := RxBuf.
3. Watch NDR rise. On the rising edge, copy LEN bytes out of RxBuf for processing.

The end condition that closes the receive frame is set on the port configuration, not on the RCV_PTP input. For a free-form terminal stream where there is no fixed end-of-message character, the only safe choice is a receive-line idle timeout (ENDCOND = 4).

7. End Condition = Timeout (ENDCOND = 4)

For terminal-style input, where the user may type one character or one hundred, the only practical end condition is a line-idle timeout. The CM 1241 starts a timer on the first received character; if no new character arrives before the timer expires, the firmware closes the frame and RCV_PTP reports NDR.

Timeout value selection rule of thumb: pick a value that is at least three character times but short enough that the user does not notice latency. For 9600 bit/s, 8E1, one character is roughly 1.15 ms (start + 8 data + parity + stop = 11 bit times). A 50 ms timeout closes the frame about 43 character times after the last byte, which is fast enough to feel responsive. Lower baud rates need proportionally longer timeouts.

8. Converter Mode: PORT = 1 (RS485 2-Wire)

The MOXA UPort 1150/1150I and similar USB-to-RS485 adapters expose a driver setting that selects the electrical mode. The relevant value for the CM 1241 2-wire RS485 port is:

• PORT = 1 (RS485 2-wire) - A and B form a single differential pair used for both transmit and receive. Driver direction is handled automatically by the converter, just like on the CM 1241.
• PORT = 2 (RS422) - A/B is the transmit pair, Y/Z is the receive pair. Will not work against a CM 1241 in 2-wire mode.
• PORT = 3 (RS485 4-wire) - Treats A/B as Rx and Y/Z as Tx. Will not work against a 2-wire CM 1241.

Set PORT = 1 in the MOXA UPort driver before opening the COM port. The PC's terminal software will then have a working COMx that echoes any incoming bytes back to the S7-1200.

9. Step-by-Step Diagnostic Procedure

The procedure below isolates each failure mode in order of likelihood. It assumes a CM 1241 RS422/485, a TIA Portal project with SEND_PTP and RCV_PTP, and a PC partner running a terminal program.

1. Confirm port mode. In TIA Portal device configuration, expand the CM 1241, select the RS422/485 interface, and verify "Port configuration" is "RS485 2-wire (half duplex)". Change it if necessary, save, and download to the CPU. (Section 5.)
2. Confirm converter mode. On the PC, open the MOXA UPort configuration (or the equivalent tool for your adapter) and set PORT = 1 (RS485 2-wire). Restart the terminal program so the new mode takes effect. (Section 8.)
3. Verify wiring polarity with a continuity test. With both ends powered down, ring out the cable: A on the CM 1241 (pin 7) to A on the converter, and B on the CM 1241 (pin 3) to B on the converter. Reverse the cable or swap pins at one end if the converter's manual labels A and B on different physical pins than the Siemens pinout. (Section 1.1.)
4. Send a known string and confirm Tx on the partner. Trigger SEND_PTP with a known ASCII string ("TEST\r\n"). The CM 1241 Tx LED should flash and the PC terminal should display the string. If this fails, the issue is on the transmit path; fix that first.
5. Set RCV_PTP to a known armed state. Latch EN_R TRUE permanently during diagnostics. Watch the RCV_PTP instance DB in online mode; the EN_R input should be visible as TRUE.
6. Set the end condition to timeout. In the port configuration, set ENDCOND = 4 and a 50-200 ms timeout. Save and download. (Section 7.)
7. Type a single character in the terminal. Press the spacebar or any printable key. The CM 1241 Rx LED should flash. If it does not, the differential pair polarity is wrong - go back to step 3.
8. Wait for the timeout. Within 200 ms the RCV_PTP instance should pulse NDR. LEN should equal the number of characters sent (1 for a single keypress).
9. Capture the buffer. In the online watch table, read the first LEN bytes of RxBuf. They should match the ASCII code of the character typed.
10. Repeat at production baud. If the bench baud was 9600, repeat steps 7-9 at 19200 and 38400. If the Rx LED starts missing flashes at higher baud, suspect bias or termination issues on long cable runs.

10. Verification

A working receive path satisfies all of the following checks:

If NDR pulses but the buffer contents are corrupt, suspect a baud, parity, or stop-bit mismatch between the S7-1200 port configuration and the terminal program. If STATUS returns 0x1E (framing error) or 0x1F (overflow) values, reduce the baud rate or check for noise on long cable runs.

11. Field-Proven Caveats

11.1 Common-Mode Voltage

The CM 1241 RS422/485 receiver accepts a common-mode voltage between -7 V and +12 V for 1 second, and 3 V RMS continuous. Long cable runs with poorly grounded shields can drive the bus outside this window and produce intermittent receive failures that look like wiring problems. Bond the cable shield to chassis ground at one end (typically the S7-1200 end) and let the other end float.

11.2 USB-to-RS485 Adapter Quality

Cheap USB-to-RS485 converters are a chronic source of mysterious receive failures. Symptoms include dropped bytes, inverted polarity, and inability to drive longer than a few metres of cable. Industrial-grade converters (MOXA, Phoenix Contact, Murr Elektronik) are strongly recommended for any production deployment. The bench-only nature of a USB converter is no excuse for a long cable run; if the production cable is more than a few metres, plan on a proper RS485 terminal server such as the MOXA NPort 5600 series.

11.3 TIA Portal Version Compatibility

The original case used TIA Portal V10.5, which is a very early release. Modern projects should be on V16, V17, or V18 with a matching S7-1200 CPU firmware. The SEND_PTP and RCV_PTP instructions have been stable across versions, but the surrounding configuration UI has changed. Always update both the TIA Portal software and the S7-1200 CPU firmware together; mismatched versions are a common cause of transient communication errors. The S7-1200 manual collection is available at the TIA Portal documentation portal.

11.4 RS485 Termination and Bias

For a multi-drop RS485 bus of more than a few metres, place a 120 Ω termination resistor across A and B at both physical ends of the cable. Add a 560 Ω to 4.7 kΩ bias network (pull-up on A to 5 V, pull-down on B to ground) at one node to define the idle state. The CM 1241 does not provide internal bias. Some converters include internal bias that can be enabled or disabled; check the converter manual before adding external resistors to avoid double-biasing the bus.

11.5 HyperTerminal Is Not a Test Instrument

HyperTerminal is no longer distributed with Windows and has well-known limitations (no configurable end-of-line behaviour, no raw byte view, no hex mode). For bench work, prefer PuTTY, Tera Term, or Bray Terminal. These tools make it possible to send raw bytes, observe hex values, and adjust line endings without confusing the S7-1200 receiver.

11.6 Half-Duplex Turnaround Delay

When the CM 1241 returns from transmit to receive, the bus takes a few bit times to settle. At 9600 bit/s this is invisible. At 115.2 kbit/s on long cables, the partner device may see the last byte as a framing error. If the partner reports framing errors on the first byte after the CM 1241 transmits, insert a 1-3 character delay between the last transmitted byte and the first expected received byte. The CM 1241 firmware already includes a small fixed turnaround, so this is rarely needed; mention it only when all other diagnostics are clean.

12. Related Modules and Migration Notes

If the project can be redesigned, the following options remove several of the failure modes above entirely.

For new projects targeting Modbus RTU or similar industrial protocols, consider using the MB_CLIENT and MB_SERVER instructions from TIA Portal instead of bare SEND_PTP/RCV_PTP. These encapsulate the framing, CRC, and end-condition logic, leaving only the wiring to verify. The S7-1200 Communication Interfaces manual documents the Modbus instruction set in detail.

13. Frequently Asked Questions