S7-1200 RS232 to Omron CQM1H: Modbus and Hostlink Setup

Replacing a legacy Hilscher Profibus-to-RS232 converter with native S7-1200 serial communication requires planning across three layers: physical (RS232C signal levels and DB9 wiring), data-link (frame format, baud rate, parity), and application (Modbus or Omron Hostlink). The Omron CQM1H-CPU51 belongs to a generation of controllers that pre-dates Ethernet and was designed primarily for Hostlink (SYSWAY) serial polling from Omron NS-series HMIs and CX-Programmer. The same physical port can be repurposed for Modbus RTU slave operation through a protocol-macro ladder or by installing a CQM1H-SCB41 communication board on the CPU option slot.

A modern S7-1200 with a CM 1241 (6ES7241-1AH32-0XB0) communication module provides RS232C signal generation, hardware flow control, and a Siemens-supplied PtP instruction set. The MB_MASTER instruction (available from TIA Portal V13 SP1 with the S7-1200 Modbus RTU Master library) implements Modbus RTU master function codes 0–6, 15, and 16 against any compliant slave, including a properly configured CQM1H. The legacy CB 1241 RS485 board (6ES7241-1CH30-1XB0) cannot be used here because the CQM1H port 1 is RS232C, not RS485.

Two viable protocol paths exist for this migration:

1. Modbus RTU — the lower-friction path if both sides are rewritable. The CQM1H port is placed in Modbus RTU slave mode through CX-Protocol or through a small ladder that drives the protocol-macro. The S7-1200 calls MB_MASTER with function code 03 (read holding registers) or 16 (write multiple registers), using the DM area as the Modbus register base.
2. Hostlink (SYSWAY C-mode) — a character-based ASCII protocol that is the CQM1H default out of the box. The S7-1200 transmits a Hostlink frame such as @00RD0001000258*<CR> and parses the response. No firmware change is required on the CQM1H, but a custom SCL block must compute the FCS (Frame Check Sequence) byte and assemble ASCII frames.

The choice depends on how much of the existing Omron program is locked. If the original Hilscher bridge used Modbus, stay on Modbus. If the existing Omron application already speaks Hostlink to an HMI, Hostlink is the lower-risk path. Modbus RTU is roughly 2.5× more compact on the wire and runs noticeably faster on the S7-1200 side.

Hardware Prerequisites

The CQM1H-CPU51 is supplied with one RS232C port on the CPU body. Port 1 follows the Omron convention: pin 2 = SD, pin 3 = RD, pin 4 = RS (RTS), pin 5 = CS (CTS), pin 7 = SG, pin 9 = ER (DTR). This is functionally equivalent to a DCE pinout with non-standard naming, and it mates directly with a Siemens CM 1241 (DTE-style) using a 1:1 straight-through cable in most cases. Always verify with an oscilloscope or breakout box before energising either PLC.

RS232C Physical Layer and Cable Assembly

RS232C specifies a ±3 V to ±15 V signal swing on data lines. Cable length is limited to 15 m at 19 200 bit/s and falls to approximately 3 m at 115 200 bit/s per the EIA/TIA-574 annex. The CM 1241 RS232 module is rated to 15 m with shielded cable. The CQM1H port 1 supports 9 600 bit/s reliably and 19 200 bit/s on CPU revisions manufactured after 2005.

The following table shows the required pin-to-pin wiring when interfacing a Siemens CM 1241 to an Omron CQM1H-CPU51 port 1. The CM 1241 is wired as DTE; the CQM1H port is DCE with Omron pin numbering.

A common installer mistake is to wire a null-modem crossover cable between two RS232C ports. This is required when both devices are DTEs (PC-to-PC), but the CQM1H port is wired as DCE; the signals cross inside the Omron connector. Therefore a 1:1 (straight-through) cable is the correct topology. If you use a 9-pin gender changer to verify with a laptop, you must apply a null-modem adapter on the PC side.

For 5 m or less, unshielded cable is acceptable. For 10–15 m, use Belden 9940 or equivalent (24 AWG twisted pair, overall foil + braid shield), terminate the shield to the DB9 metal shell on the S7-1200 end only, and leave the Omron end floating or bonded through a 100 nF capacitor to chassis.

Cable Topology Diagram

The diagram below shows the cross-connection between the two DB9 connectors, with the signal direction indicated by arrow colour. Note the direct 1:1 mapping of data and handshake signals and the single-point shield termination.

Protocol Selection: Modbus vs Hostlink

Both protocols transport the same register data, but the engineering effort and runtime behaviour differ substantially.

Modbus RTU is binary, has a 3.5-character silent interval between frames, uses a 16-bit CRC-16, and supports up to 247 slaves on a bus (although RS232 is point-to-point). The frame is compact (8 bytes overhead for an 8-byte payload) and runs at 19 200 bit/s with sub-10 ms cycle times on the S7-1200. Function code 03 reads the CQM1H DM area when the slave address range is mapped through the protocol-macro or through DM area "transparent" mode.

Hostlink C-mode is ASCII, comma-delimited, terminated with <CR> (0x0D), and uses a 2-character hex FCS (XOR of all bytes between @ and *). The frame is roughly 2.5× the binary equivalent. The S7-1200 must convert numeric register addresses to BCD-then-ASCII, then compute the FCS byte. The S7-1200 needs a custom SCL block; no Siemens-supplied FB exists for Hostlink. The CQM1H, however, requires no configuration change because Hostlink is the default protocol on the RS232C ports with the default DIP switch settings.

Selection rule: Choose Modbus RTU if you have write access to the CQM1H program and can install a small protocol-macro on a CQM1H-SCB41. Choose Hostlink if the CQM1H is locked, the Hilscher previously used Hostlink, or you need a low-risk read-only link to DM/IR/HR areas.

The Omron CQM1H-CPU51 supports Hostlink on the built-in port 1 and on either port of an optional CQM1H-SCB41 communication board. The communication parameters are stored in the CQM1H's CPU Setup area, specifically DM6645–DM6649 for port 1 and DM6650–DM6654 for the SCB41 ports. Default values (9 600 bit/s, 7 data bits, even parity, 2 stop bits) are exactly the Hostlink defaults; no DM edits are required for Hostlink C-mode.

S7-1200 CM 1241 RS232 Module Configuration

In TIA Portal, add the CM 1241 RS232 to the device configuration of the S7-1200 rack. The module appears in the catalog under Communication modules → RS232. Double-click the module slot to open the port configuration.

The port configuration dialog exposes three pages: Port configuration, Transmission protocol, and (in some firmware versions) Hardware identification. The relevant parameters are:

If the CQM1H port is configured for 2 stop bits (Hostlink default), the CM 1241 must match exactly. Mismatched stop bits are the single most common cause of intermittent frame errors and the Status bits toggling in the receive FB.

For the Modbus RTU master, install the SIMATIC S7-1200 Modbus RTU Master library from the global library repository. This library is part of the standard TIA Portal install from V13 SP1 onwards. Place the MB_MASTER instance in a cyclic OB (typically OB1 with a 100 ms cycle or OB200 for fast loops). The MODE input selects the function code: 0 = read coils, 1 = read discrete inputs, 2 = read holding registers, 3 = read input registers, 4 = write single coil, 5 = write single register, 6 = write multiple coils, 15 = write multiple registers. The DATA_ADDR and DATA_LEN inputs use Modbus addressing (4x00001 = first holding register). To address the CQM1H DM area starting at DM0000, use DATA_ADDR = 40001. The MB_MASTER block handles the CRC-16 and inter-frame timing automatically.

The MB_COMM_LOAD block must be called once at startup (in OB100) to push the port configuration into the CM 1241 firmware. Without this call, the port remains in its factory default (which is RS232, but with different defaults that rarely match a CQM1H). The MB_COMM_LOAD background DB holds the baud rate, parity, flow control, and the receive line idle time in character counts.

Omron CQM1H-CPU51 Serial Port Configuration

The CQM1H-CPU51 has a built-in RS232C port (port 1) on the CPU front face, plus a peripheral port (port 0) that is dedicated to CX-Programmer upload/download. An optional CQM1H-SCB41 (3G2CQM1-SCB41) adds a second port (port 2, RS232C) and a third port (port 3, RS422/485).

The port protocol is selected by writing to the CPU Setup DM area:

The format word is encoded as 4 hex digits. The first digit sets the baud rate (0 = 9 600, 1 = 19 200, 2 = 300, 3 = 600, 4 = 1 200, 5 = 2 400, 6 = 4 800, 7 = 9 600, 8 = 19 200, 9 = 38 400), the second sets the frame (7E2, 8N1, 8E1, 8O1, 7N2, 8N2, 7E1, 8O1 — verify with the CQM1H Operation Manual W363), the third and fourth are reserved.

After editing the DM area from CX-Programmer (or from the S7-1200 via a one-time write), the CQM1H requires a power cycle for the new port settings to take effect. There is no live reconfiguration of port parameters.

Migration Path to CJ-series

The same Hostlink and Modbus RTU patterns apply to modern CJ2M and CP1H controllers with a CJ1W-SCU21-V1 or CP1W-CIF01 communication module. The CJ-series supports Hostlink C-mode on the default port, and Modbus RTU is supported with a one-time Setup DM edit (DM30000+ on CJ2M). For a worked CJ-series example, see the official Omron CJ-series RS-232C Connection Guide (PDF) which documents the same physical layer, protocol selection, and DM setup procedure applied to a MARS barcode reader.

Modbus RTU Master Implementation

The MB_MASTER block is the only Modbus RTU master primitive needed. Its instance DB and call structure look like this:

// SCL pseudo-code for one polling request
IF "poll_trigger" AND NOT "busy" THEN
    "inst_MB_MASTER"(REQ := TRUE,
                     MB_ADDR := 1,           // CQM1H slave address
                     MODE := 2,              // 03 hex = read holding registers
                     DATA_ADDR := 40001,     // DM0000
                     DATA_LEN := 20,         // 20 words = DM0000..DM0019
                     DATA_PTR := P#DB20.DBX0.0 WORD 20,
                     DONE => "done",
                     BUSY => "busy",
                     ERROR => "error",
                     STATUS => "status_word");
    "poll_trigger" := FALSE;
END_IF;

The MB_MASTER must be called on a single CM 1241 port. Multiple masters on one port require user-written arbitration; the S7-1200 firmware does not allow two MB_MASTER calls against the same port simultaneously. The PORT parameter in the MB_MASTER background DB identifies the CM 1241 hardware ID.

If the CQM1H is set up as a transparent Modbus slave (function code 03 maps directly to DM0000+offset), the read/write is straightforward. The CQM1H protocol-macro ladder typically consists of 60–80 steps that receive the Modbus frame on the port, validate the CRC, and copy the requested DM words into the protocol macro's send buffer. Many third-party protocol-macro examples are bundled with CX-Protocol (the separate Omron protocol-macro tool) for the CQM1H-SCB41.

For larger register counts, break the request into 50-word blocks. The CQM1H protocol-macro transmit buffer is 256 bytes total, and 50 Modbus words plus the 9-byte frame overhead fits comfortably. Requests larger than 50 words on the CQM1H built-in port are not reliable because the protocol-macro RX buffer is only 256 bytes.

Modbus Address Mapping

The CQM1H does not support function codes 01, 02, 04, 05, 15 out of the box. Use the protocol-macro to map the desired function code to the equivalent read or write of the DM/IR/HR area.

Omron Hostlink Protocol Implementation

Hostlink C-mode uses ASCII frames. The general read request is:

For example, reading 5 words starting at DM0000 from unit 0:

The CQM1H replies with:

The FCS is the 2-character hex representation of the XOR of all ASCII bytes between @ and * (exclusive). The SCL function below performs the calculation at runtime.

// Calculate Hostlink FCS in SCL
FUNCTION "Hostlink_FCS" : BYTE
VAR_INPUT
    pBuffer : POINTER TO BYTE;
    length  : INT;
END_VAR
VAR_TEMP
    i : INT;
    fcs : BYTE;
END_VAR
BEGIN
    fcs := 0;
    FOR i := 0 TO length - 1 DO
        fcs := fcs XOR pBuffer^i;
    END_FOR;
    "Hostlink_FCS" := fcs;
END_FUNCTION;

The full Hostlink master FB typically contains: (1) a string-builder that converts a start address and count into the ASCII command, (2) the FCS calculation above, (3) a transmission call to the SEND_PTP instruction, (4) a receive state machine driven by the RCV_PTP instruction, (5) FCS validation on the response, and (6) ASCII-to-INT conversion of the data words. The full block is approximately 200 lines of SCL and runs in 2–4 ms per request on an S7-1212C.

The CQM1H default Hostlink unit number is 00. While 00 is the broadcast unit for some commands, it is also a valid slave unit for read commands. In practice, set the CQM1H unit to 01 (write 01 hex to DM6648) so the S7-1200 explicitly addresses a single device.

Hostlink Receive State Machine

The receive state machine on the S7-1200 side tracks five states:

1. IDLE — waiting for a poll trigger; no characters on the line.
2. BUILD — construct the request frame from start address and word count; call Hostlink_FCS to compute the checksum.
3. SEND — call SEND_PTP with the constructed frame including <CR> terminator.
4. WAIT_RX — poll the RCV_PTP status word until the receive complete flag is set, or the timeout elapses (1 000 ms typical for CQM1H).
5. PARSE — validate the response starts with @, ends with *<CR>, recompute FCS over the bytes between @ and *, and convert the ASCII hex data into a 16-bit word array.

Step-by-Step Commissioning Procedure

1. Power down both PLCs. Disconnect the field wiring on the RS232C ports. Verify zero voltage on pins 2, 3, 4, 5, and 7 relative to pin 7 (signal ground) of the CQM1H DB9.
2. Build the cable per the pinout table above. Use a continuity tester to confirm every required pin has a low-resistance (<1 Ω) end-to-end connection. Check that pin 5 on the S7 end connects only to pin 7 on the Omron end and to no other conductor.
3. Configure the CQM1H. Connect a laptop running CX-Programmer to the peripheral port (port 0). Edit the port-1 Setup DM per the table above for either Hostlink (default 0000) or Modbus (1000). Cycle power to the CQM1H.
4. Configure the CM 1241 in TIA Portal. Add the module to the device configuration, set the port parameters to match the CQM1H exactly (baud, parity, data bits, stop bits, flow control), and download the hardware configuration to the S7-1200.
5. Install the Modbus library if using Modbus. From the global library "Modbus RTU Master (S7-1200)" copy MB_MASTER and MB_COMM_LOAD into the project. Call MB_COMM_LOAD once in OB100 to configure the port and place MB_MASTER in OB1 or OB200.
6. Implement the Hostlink FB if using Hostlink. Copy the SEND_PTP, RCV_PTP, and the Hostlink_FCS function into the project. Wire the receive state machine to a tag that triggers on a rising edge of the CM 1241 status word bit "Receive complete".
7. Watch the Status LED on the CM 1241. The TX LED should flash on every master request; the RX LED should flash on every slave response. If TX flashes but RX is dark, the CQM1H is not transmitting — check DM6645, DM6648, and the cable RX line.
8. Test with a single read. Trigger a single read of DM0000 (function code 03 with DATA_LEN=1). Verify the response by reading MB_MASTER's DATA_PTR tag in the watch table.
9. Add the production polling list. Map the production DM range to MB_MASTER DATA_ADDR ranges. Use a small state machine to alternate between read blocks. Keep total request rate below 50 % of the line capacity (i.e., ≤80 requests/s at 9 600 bit/s) to leave headroom for the CQM1H scan time.
10. End-to-end verification. Force a known value in a CQM1H DM word, trigger the read from the S7-1200, and compare the value in the TIA Portal watch table. Repeat with a write to confirm round-trip integrity.

Diagnostics and Verification

The CM 1241 maintains a status word and a diagnostic interrupt structure accessible from the cyclic OB. The most useful diagnostics:

For Hostlink, the receive FB should also expose a hex dump of the last 64 bytes received. Always log this to a data block; it is the single fastest way to diagnose framing errors.

The CM 1241 also exposes hardware interrupts for the following events: receive complete, transmit complete, framing error, parity error, overrun error, break detected, and ID line change. Enable these interrupts in the device configuration (Properties → CM 1241 → Interrupts) and attach OB82 (diagnostic interrupt) and OB40 (hardware interrupt) to receive the events. The error bits in the CM 1241's input status word (e.g., 16#0001 = parity error, 16#0002 = framing error) are useful for tagging quality information on each received word.

Field-Proven Caveats

• CQM1H power-on reset: The CQM1H ignores all serial traffic for approximately 1.5 s after power-up. The S7-1200's first MB_MASTER call may time out. Add a startup delay (5 000 ms in OB100) before activating the polling trigger.
• CQM1H scan time impact: Every CQM1H cycle that processes a Modbus request adds 3–8 ms to the scan. For high-priority control loops, this can push the scan past 20 ms. Mitigate by either reducing request rate or installing a CQM1H-SCB41 with its own CPU-managed protocol-macro.
• CQM1H end-of-life: The CQM1H series reached end-of-production in 2015 and spares are limited. For new installations, migrate to a CJ2M-CPU33 with a CJ1W-SCU21-V1 communication module. The same Hostlink and Modbus RTU patterns apply; the DM word addresses for the CPU Setup area are DM30000+ on CJ2M.
• TIA Portal upgrade impact: The Modbus RTU master library was changed in TIA Portal V17 to add the new MB_CLIENT instruction. The legacy MB_MASTER and MB_SLAVE remain supported for backwards compatibility but are no longer recommended for new projects. If you start a new project, use MB_CLIENT with the CM 1241's user-defined port number.

Troubleshooting Matrix

For multi-drop or multi-master scenarios (e.g., the S7-1200 and an HMI both polling the same CQM1H port 1), use port 2 of a CQM1H-SCB41 for the HMI and reserve port 1 for the S7-1200. The CQM1H protocol-macro can arbitrate between the two physical ports, but port 1 alone cannot service two masters simultaneously without external handshake logic.

Frequently Asked Questions