S7-1200 to Danfoss FC 202: Modbus RTU via the CB 1241

1. Overview: The Real Problem (and the Real Solution)

Connecting a Siemens SIMATIC S7-1200 to a Danfoss VLT AutomationDrive FC 202 over Modbus is one of the most common VFD integration tasks in water/wastewater, HVAC, and material handling. The cleanest path is native Modbus RTU on the PLC side through a Siemens CB 1241 RS-485 communication board (order number 6ES7 241-1CH30-1XB0). It avoids a third-party converter, removes an extra failure point, eliminates the 3.5-character inter-frame timing issues that plague generic serial-to-Ethernet adapters, and is fully supported by TIA Portal's MB_COMM_LOAD and MB_MASTER instructions.

The typical "wrong" path comes from three assumptions: that the S7-1200 has no RS-485 port, that the drive speaks a different protocol than the PLC, and that an Ethernet-to-RS-485 converter will transparently bridge them. None of those assumptions are correct. The S7-1200 has no built-in RS-485, but it accepts a snap-on communication board at the left side of the CPU. Modbus RTU is a serial protocol that both the CB 1241 and the FC 202 speak natively. And a generic Ethernet-to-RS-485 converter is not a Modbus bridge unless its firmware is explicitly designed for Modbus RTU timing on the serial side and Modbus/TCP on the Ethernet side.

This article documents the correct path end-to-end, then closes with a converter-selection guide for projects that genuinely require an Ethernet gateway (long cable runs, existing plant Ethernet, third-party SCADA on the Ethernet side).

2. Why the Ethernet-to-RS-485 Converter Is the Wrong Tool

Devices such as the Planet ICS-100, Moxa NPort 5100, Waveshare RS485 TO ETH, USR-TCP232, and Elfin EW-11 are generic serial device servers. They convert a byte stream, not a protocol. For Modbus RTU to Modbus/TCP bridging, the converter must:

1. Run Modbus/TCP server firmware on the Ethernet side so a Modbus/TCP client on the PLC can connect to a known IP:port.
2. Run Modbus RTU master or slave firmware on the RS-485 side, configured for the role of the attached device — not for the role of the TCP client.
3. Enforce the 3.5-character inter-frame silence, 1.5-character inter-byte, and 1.5-character inter-frame timing required by the Modbus RTU specification. Generic TCP-to-serial tunnels ignore these and produce silent CRC failures.

The FC 202 is a Modbus RTU slave. It cannot initiate messages. It will not respond until a Modbus RTU master polls it. A generic ICS-100 configured as a "TCP server → transparent serial tunnel" forwards the TCP payload as raw bytes to the RS-485 bus. The PLC must then act as a Modbus RTU master on the serial side. But the PLC is on the Ethernet side. The S7-1200 has no way to issue a Modbus RTU master frame through an Ethernet socket. The result is a stack mismatch: the PLC can only speak Modbus/TCP, the drive can only respond to Modbus RTU, and the converter does not translate between them.

There is a second, subtler problem: addressing. Modbus RTU uses a 1-byte slave address (1–247) inside every frame. Modbus/TCP replaces that with a Unit Identifier (UID) in the MBAP header. A Modbus-aware converter is required to map UID → slave address. Generic transparent converters do not.

3. Modbus Architecture: Master/Slave vs Client/Server

The terms "master/slave" and "client/server" are often used interchangeably, but they belong to different protocol families and have slightly different meanings inside Modbus. The Modbus Application Protocol V1.1b3 and the Modbus over Serial Line V1.02 specifications draw the line explicitly.

The FC 202 is a Modbus RTU slave. It will only respond to messages addressed to its configured slave address (parameter 8-31). The S7-1200 must therefore be a Modbus RTU master on the serial side. With the CB 1241 installed, this is what the PLC becomes natively; the MB_MASTER function block implements the master role.

If the project requires the S7-1200 to be a Modbus/TCP client — e.g., an Ethernet-based SCADA or HMI polls a drive through a serial-server gateway — the converter's Ethernet side becomes a Modbus/TCP server and its RS-485 side becomes a Modbus RTU master that polls the drive and returns the result as a Modbus/TCP response. The PLC is then a Modbus/TCP client; the MB_CLIENT function block handles it. This is the only configuration in which a serial server acts as a meaningful "Modbus bridge."

4. Prerequisites and Bill of Materials

5. Installing the CB 1241 Communication Board

1. Power down the S7-1200 CPU. The CB 1241 is hot-pluggable in some firmware versions, but Siemens documentation always specifies a power-off install.
2. Remove the blank cover on the left side of the CPU. The cover is retained by a single captive screw; do not discard it.
3. Seat the CB 1241 onto the 20-pin connector. Press firmly until the plastic latch clicks.
4. Tighten the captive screw to 0.2 N·m (hand-tight). The board's plastic frame is the alignment feature, not the screw.
5. Wire the RS-485 bus to the CB 1241's removable terminal block. The CB 1241 terminal block has the following pinout:

   Pin	Signal	Notes
   1	Shield (functional earth)	Bond to panel ground at one end only.
   2	RS-485 P+ (Data+)	To drive terminal 69.
   3	RS-485 N− (Data−)	To drive terminal 70.
   4	NC	Do not connect.
   5	GND (signal common)	Recommended for long cables to give the receivers a defined common-mode reference.

6. Power up the CPU. In TIA Portal, "Online → Accessible devices" should list the CB 1241 under the CPU's device configuration with no diagnostic errors.

6. RS-485 Physical Layer, Topology, and Termination

Modbus RTU over RS-485 is a 2-wire half-duplex multidrop bus. Every node is wired in parallel across the same two conductors; the FC 202 connects through terminals 69 (Data+ or P+) and 70 (Data− or N−) on the control card. The bus must be a single daisy-chain; star topologies and stubs longer than ~1 m create reflections that corrupt the differential signal at higher baud rates.

Termination rules:

• Install a 120 Ω resistor at the two physical ends of the bus only. The FC 202 has an internal termination resistor enabled by jumper on the control card (see the FC 202 installation guide); engage it only if the drive is at the end of the bus.
• Do not terminate the middle of the bus. Three or more terminations form an over-damped network that attenuates the signal.
• Bond the cable shield to panel ground at one end only (typically the PLC end). Multi-point grounding creates ground loops that inject 50/60 Hz onto the bus.
• Maximum nodes per bus: 32 unit loads. The FC 202 presents 1/8 unit load, so up to 256 drives is theoretically possible, but the Modbus Organization recommends 247 (the address space limit) as the practical maximum.

7. Configuring the Danfoss FC 202 for Modbus RTU

Drive-side configuration is done at the LCP (Local Control Panel) under parameter group 8-** (Communications) and 9-** (Profibus/DeviceNet). Reference the VLT FC 300/302 Modbus RTU Operating Instructions and the VLT AQUA Drive FC 202 product page for full parameter context.

8. TIA Portal: MB_COMM_LOAD and MB_MASTER Setup

The Modbus RTU master logic for the S7-1200 consists of two instructions, both in the "Communication → Modbus" folder of the Instructions task card. The Siemens S7-1200 Modbus RTU Master Instructions entry documents the full block interface.

MB_COMM_LOAD configures the CM/CB 1241 port and runs once on cold restart to load the port parameters into the module. Use an OB100 / first-scan trigger.

REQ       := TRUE                       // one-shot on first scan
PORT      := 4096                        // CB 1241 identifier
BAUD      := 9600                        // 9600, 19200, 38400, 57600, 115200
PARITY    := 2                           // 0=None, 1=Odd, 2=Even
DATABITS  := 8
STOPBITS  := 1
FLOW_CTRL := 0
RTS_ON_DLY := 0
RTS_OFF_DLY := 0
RESP_TO   := 1000                        // 1000 ms response timeout
DONE      => "DB_Modbus_Load".DONE
ERROR     => "DB_Modbus_Load".ERROR
STATUS    => "DB_Modbus_Load".STATUS

MB_MASTER is the polling function block. It takes a MODE input (0 = Read Holding Registers, 1 = Write Multiple Registers, 2 = Read/Write, 3 = Read/Write Multiple), the slave address, the Modbus data address (1-based), the quantity, and a data pointer.

REQ       := "Poll_Trigger"              // 100 ms cyclic clock from a TON
MB_ADDR   := 1                            // FC 202 slave address = 8-31
MODE      := 0                            // 0 = Read Holding Registers
DATA_ADDR := 2                            // Holding register 2 (status word), 1-based
DATA_LEN  := 6                            // Read 6 registers: status, MAV, I, Torque, P, V
DATA_PTR  := P#DB_Drive_Word_DB.DBX0.0 WORD 6
DONE      => "DB_Modbus_Poll".DONE
ERROR     => "DB_Modbus_Poll".ERROR
STATUS    => "DB_Modbus_Poll".STATUS

To start the drive, write the FC-profile control word 0x047C (pre-magnetize, then start with ramp enable) to holding register 1 (PDU address 0):

REQ       := "Start_Cmd"                 // edge-triggered from HMI/PLC logic
MB_ADDR   := 1
MODE      := 1                            // 1 = Write Multiple Registers
DATA_ADDR := 1                            // Holding register 1 (control word)
DATA_LEN  := 2                            // Control + reference
DATA_PTR  := P#DB_Drive_Word_DB.DBX12.0 WORD 2
DONE      => ...
ERROR     => ...
STATUS    => ...

FC profile control word bit definitions:

To command "start with reference 50%" the FC profile control word is 0x047C and the reference register (PDU address 1) is 0x2000 (0x2000 = +50.00% in 0.01% units).

9. FC 202 Modbus Register Map and Process Data

10. Verification, Diagnostics, and Fault Clearing

Loopback test procedure (no drive required):

1. Disconnect the RS-485 cable from the FC 202.
2. Short P+ to P+ and N− to N− at the drive end with a wire. P+ does not loop back to N−.
3. Run MB_MASTER with MB_ADDR = 1, DATA_ADDR = 1, DATA_LEN = 1, MODE = 0.
4. The PLC should read back exactly the value it just wrote (after a Write+Read cycle in MODE = 2). If it does, the wiring and the CB 1241 are good. If it doesn't, the bus itself is the problem.

11. If You Still Need an Ethernet Gateway: Converter Selection Guide

For projects where the PLC must communicate with the drive over an existing Ethernet plant network — e.g., a VFD located more than ~100 m from the panel, or a drive that shares a Modbus/TCP SCADA network — the CB 1241 is no longer sufficient and a Modbus-aware serial server is required. Selection criteria:

1. Explicit Modbus/TCP server + Modbus RTU master/slave firmware. Generic TCP-to-serial tunnelling firmware will not work.
2. Configurable per-port role: the RS-485 port must be assignable as "Modbus RTU master" so it can poll the FC 202.
3. Configurable Modbus slave address timeout, inter-character timeout, and "silent interval" handling. The Modbus RTU spec requires 3.5-character silences between frames; the converter must enforce this.
4. Multi-drop models (e.g., Moxa MGate MB3170/MB3270, USR-ICR-3201, Atop AB5608) let one Modbus/TCP client reach multiple drives by setting the UID per connection.
5. RJ-45 port label is not a guarantee of Ethernet: confirm the datasheet, not the connector. RJ-45 also carries RS-422 and proprietary serial protocols.

Once selected, the S7-1200 side changes from MB_MASTER (Modbus RTU master) to MB_CLIENT (Modbus/TCP client). The TIA Portal configuration uses the converter's IP address as the connection target, port 502 (default Modbus/TCP), and the FC 202's slave address as the MB_UNIT parameter.

Reference architectures: the Yokogawa VJET Ethernet/RS-485 converter (Bulletin 77J01E11-01E) is a documented Modbus/TCP ↔ Modbus RTU implementation. The Waveshare RS485 TO ETH module (Amazon ASIN B07RQK56TM) is a hobbyist/light-industrial version with Modbus gateway firmware available as a configuration option in the web UI; expect to spend time validating Modbus timing on noisy plant cabling before deploying it in a production control loop.

12. FAQ