Wiring a 6-Wire Load Cell to a Siemens S7-200 via RS485 Transmitter
Six-wire load cells are the standard for high-accuracy weighing because their remote-sense leads cancel voltage drops in the excitation cable, but those extra conductors make the wiring easy to get wrong. This guide documents the field-proven wiring between a generic 6-wire strain-gauge load cell and an RS485 weight-transmitter module, plus the integration of that transmitter with a Siemens SIMATIC S7-200 CPU through the RS485 signal board (6ES7 241-1CH30-1XB0) or the equivalent signal module (6ES7 241-1CH30-0XB0). It covers every terminal, the function of each sense lead, RS485 termination, and the MODBUS RTU master ladder that the S7-200 needs to read the weight value reliably.
1. Overview
The signal path runs from a 350 Ω (or 700 Ω / 1,000 Ω) strain-gauge bridge through a shielded six-conductor cable to an RS485 weight transmitter. The transmitter excites the bridge with a stable 5 V or 10 V reference, digitises the differential millivolt output, and publishes the result as a 32-bit signed integer or 32-bit IEEE-754 float over MODBUS RTU on an isolated RS485 port. The Siemens S7-200 acts as a MODBUS RTU master, reads the weight register on a freewheel interval, and stores the value in V memory where the user's ladder can scale, tare, and display it.
The S7-200 is a legacy platform, but it remains in service across thousands of filling, batching, and checkweighing machines worldwide. Two options exist for adding a true RS485 master port:
- 6ES7 241-1CH30-1XB0 – signal board, plugs into the front of the CPU (CPU 224, 224 XP, 226). Mounts underneath the terminal cover and does not consume a slot in the I/O chain.
- 6ES7 241-1CH30-0XB0 – signal module, mounts in the I/O expansion chain to the right of the CPU. Used when the signal board slot is already populated (for example by a battery board) or when the application requires electrical isolation between the CPU and the field bus.
Both modules expose a 9-pin sub-D male connector with the standard Siemens RS485 pin-out (3 = B', 8 = A', 5 = GND, 4 = RTS, 1 = shield). They are powered from the S7-200 backplane, so no external 24 V supply is required.
2. Prerequisites
Before you begin, confirm the following parts, tools, and documents are on hand:
- SIMATIC S7-200 CPU (CPU 224, 224 XP, or 226). The CPU 224 XP is recommended because its 24 V sensor supply is rated for the 0.5 A the transmitter typically draws.
- RS485 signal board (6ES7 241-1CH30-1XB0) or signal module (6ES7 241-1CH30-0XB0).
- RS485 weight transmitter with MODBUS RTU support and 6-wire load-cell input. Common vendors include Mettler-Toledo, Rice Lake, Cardinal, HBM, Scaime, and Anyload. Verify that the input stage is rated for 350 Ω / 700 Ω / 1 kΩ bridges at the mV/V output of your cell.
- 6-wire shielded load cell cable (Belden 8404 or equivalent, 22 AWG, twisted, overall foil + braid shield).
- STEP 7 Micro/WIN V4.0 SP9 (or Micro/WIN SMART for the S7-200 SMART family – the program code is similar but the PLC firmware differs).
- Modbus Master library v1.2 (or the v2.x library if running on the S7-200 SMART).
- 120 Ω 1 % termination resistors, 0.25 W, two pieces.
- PC/PPI USB cable (6ES7 901-3DB30-0XA0) for programming and online monitoring.
- Calibration masses covering 0 %, 50 %, and 100 % of the load cell's rated capacity, traceable to a national standard for legal-for-trade work.
- Wire ferrules (0.5 mm², 10 mm) and a proper ferrule crimper.
3. Component Identification
3.1 Siemens S7-200 RS485 Modules
| MLFB | Form Factor | Mounting | Galvanic Isolation | Max Baud |
|---|---|---|---|---|
| 6ES7 241-1CH30-1XB0 | Signal board (SB) | CPU front slot | No | 187.5 kbps |
| 6ES7 241-1CH30-0XB0 | Signal module (EM) | Expansion chain | Yes (500 V RMS) | 187.5 kbps |
The signal-board variant draws 5 V from the CPU and is the more compact choice. The signal-module variant provides galvanic isolation between the field bus and the backplane – mandatory when the weighing system sits more than a few metres from the PLC in an electrically noisy plant. Both are addressable as Port 1 in STEP 7 Micro/WIN; Port 0 is the CPU's own RS485 port.
For the latest MLFB suffix, always cross-check against the Siemens Industry Online Support product tree before ordering: SIMATIC S7-200 accessories – 6ES7 241 series.
3.2 Load Cell Cable Identification
The colour code in this guide is the one shipped on the load cell and matches a popular European cell manufacturer. Always verify against the cell's calibration certificate, because the colour code is not universal – US-made cells (Rice Lake, Tedea-Huntleigh, Vishay Celtron) use red/black/green/white/yellow/blue or red/black/white/green/blue/yellow per NIST HB-44 conventions, while Japanese cells often use red/white/green/blue/yellow/black.
4. Why a 6-Wire Load Cell?
A strain-gauge load cell is a Wheatstone bridge. The bridge is fed with an excitation voltage (typically 5 V or 10 V) and produces a differential output proportional to the applied force, scaled by the mV/V rating (commonly 2 mV/V, 3 mV/V, or 4 mV/V). With a 4-wire connection, the same two conductors carry the excitation current and sense the excitation voltage at the cell. Any voltage drop in the cable (caused by copper resistance, connector resistance, or temperature drift) appears as a true excitation error at the cell, which the transmitter cannot distinguish from a real load signal. The result is scale-factor error, zero drift with cable temperature, and reduced repeatability.
A 6-wire cell adds a dedicated pair of sense conductors. The sense pair is connected directly to the top of the bridge resistors at the cell, bypassing the cable drop. The transmitter uses the sensed voltage in a closed loop to regulate the excitation at the bridge terminals, holding it constant within 0.01 % over the full industrial temperature range. Six-wire cells are mandatory for accuracy class III (OIML R76) and above, and for any installation where the cable run exceeds 3 m or where ambient temperature varies by more than 10 °C.
For the engineering math: if the excitation cable is 10 m of 22 AWG copper, the loop resistance is roughly 0.6 Ω. At 5 V excitation and a 350 Ω bridge, the excitation current is 14.3 mA and the cable drop is 8.6 mV – almost 0.2 % of the excitation, which translates to a 0.2 % span error on a 2 mV/V cell. The sense leads reduce this to a few microvolts of residual error. The general formula is:
Span error ≈ (2 · R_cable · R_bridge-1) / mV/V
where R_cable is the round-trip excitation cable resistance and R_bridge is the bridge resistance. For the 10 m example, 2 · 0.6 / 350 = 0.0034 → 0.34 % of full scale, which exceeds the OIML R76 class III limit of 0.1 % for verification scale interval.
5. Wire Colour Code and Pin Mapping
Map the six conductors of the load cell to the transmitter terminal block exactly as shown. The terminal numbers are the silkscreen labels on a typical single-channel weight transmitter; always cross-check against the specific transmitter's manual before powering up.
| Load Cell Conductor | Function | Transmitter Terminal | Terminal # |
|---|---|---|---|
| Green | + Excitation | +EX | 2 |
| Blue | + Sense (Reference) | +REF | 3 |
| Red | + Signal Output | +SIG | 6 |
| Black | − Excitation | −EX | 1 |
| Brown | − Sense (Reference) | −REF | 4 |
| White | − Signal Output | −SIG | 5 |
6. RS485 Network Topology
RS485 is a half-duplex differential bus. The two data lines (D+ and D−) carry the same signal with opposite polarity; a differential receiver rejects common-mode noise that would otherwise corrupt the millivolt-level signal coming back from the load cell. For reliable operation above 100 kbps the cable must be twisted pair with a characteristic impedance near 120 Ω, and both ends must be terminated with 120 Ω resistors to prevent reflections. The shield should be earthed at one end only – the transmitter enclosure – to drain high-frequency interference while breaking any DC ground loop.
7. Step-by-Step Wiring Procedure
- Power down the S7-200 and the transmitter. Lock-out / tag-out the 24 V supply and the 120/230 V mains feeding the transmitter.
- Mount the signal board into the front of the CPU (or the signal module into the expansion chain). Torque the captive screws to 0.3 N·m. The module's 9-pin sub-D must be accessible from the front of the panel.
- Route the load cell cable through a dedicated cable gland on the transmitter enclosure. Keep at least 200 mm of separation from VFD power cables and any cable carrying more than 5 A. Cross at 90° if a crossing is unavoidable.
- Land each conductor on the transmitter's spring or screw terminal block. Use ferrules (0.5 mm² / 10 mm) on stranded conductors. Tighten to the terminal's specified torque, typically 0.5 N·m.
- Connect the shield to the transmitter's shield terminal (or to a 360° backshell on the cable gland). Tape back the shield at the load cell end so it does not short to the cell body. Do not connect the shield to the S7-200 side.
- Wire the RS485 bus from the transmitter's D+ / D− terminals to pins 3 and 8 of the 6ES7 241 module's DB-9. Connect the shield drain to pin 1 and the signal ground to pin 5.
- Install 120 Ω termination resistors at both ends of the RS485 bus, between D+ and D−. The transmitter often has a DIP switch or a built-in resistor; the S7-200 module does not, so add an external resistor across pins 3 and 8 inside the cable's D-sub hood.
- Verify the bridge resistance with the transmitter powered down. Measure between +EX and −EX; you should see the bridge nominal resistance (350 Ω, 700 Ω, or 1 kΩ ± a few percent). Then measure +REF to +EX and −REF to −EX; both should show the same resistance. If you read an open circuit on either sense line, the conductor is broken – re-pull the cable.
- Power up the S7-200 first, then the transmitter. Watch the transmitter's status LED: a solid green typically means a healthy bridge and a stable reading; a red or flashing pattern indicates an open sense lead, reversed polarity, or an out-of-range signal.
8. STEP 7 Micro/WIN MODBUS Master Configuration
STEP 7 Micro/WIN includes a free Modbus Master library that you add through the Instructions → Libraries toolbar. Drop the MBUS_CTRL and MBUS_MSG subroutines into your project, then add a call to MBUS_CTRL in the first-scan subroutine and a periodic call to MBUS_MSG in the main OB1. The library is also available on the Siemens Industry Online Support portal at Modbus Master Library for SIMATIC S7-200.
8.1 Initialise the Master (MBUS_CTRL)
Call MBUS_CTRL exactly once, on the first PLC scan, to put Port 1 (or Port 0 if you are using the CPU's own port) into MODBUS RTU mode. The control byte SMB30 must be set to 0x09 (9600 baud, no parity, 8 data bits) before the call, although the library writes it for you when the Baud parameter is set.
| SM0.1 MBUS_CTRL_EN MBUS_CTRL |
|---|/|--+-----( EN )-----------------------( )--------------|
| | Mode := 1 Done := M0.0 |
| | Baud := 9600 Error := MB_ERR |
| | Parity := 0 (none) |
| | Timeout := 1000 (ms) |
Mode = 1 enables the MODBUS master protocol and disables the native PPI. The Timeout sets how long the master waits for a slave response before reporting error 3. A 1,000 ms value is generous for a single-slave bus; tighten to 300 ms once the link is stable.
8.2 Poll the Weight Register (MBUS_MSG)
Most weight transmitters expose the gross weight as a 32-bit signed integer in holding register 0x0000 (function code 03). The MBUS_MSG call below reads two consecutive 16-bit registers into V memory starting at VW200. The instruction should be called only after the previous MBUS_MSG has completed (Done = 1) so that the same port is not driven by two requests at once.
| M0.0 SM0.5 MBUS_MSG |
|---|/|--+---|/|--+----( EN )------------------( )-----------|
| (MB_Done) (0.5 s pulse) Slave := 1 Done := M0.1 |
| RW := 0 (read) Error := MB_EX |
| Addr := 0001 |
| Count := 2 |
| DataPtr:= &VW200 |
In Siemens MODBUS addressing, Addr 0001 in the MBUS_MSG call refers to holding register 40001 in MODBUS notation, which is the first holding register of the slave. To read holding register 0x0000 in zero-based notation, use Addr = 1. Some transmitters use one-based MODBUS addressing; check the slave's register map and add 1 if necessary.
8.3 Convert 32-Bit Integer to Engineering Units
After MBUS_MSG completes, VW200 contains the low word and VW202 the high word. Reassemble the 32-bit signed value and apply the calibration factor:
// Network 3 - reconstruct 32-bit signed weight (raw counts)
LD M0.1
AB= MB_EX, 0
MOVW VW200, VW210 // low word
MOVW VW202, VW212 // high word
ITD VW210, VD214 // combine -> 32-bit signed in VD214
// Network 4 - scale to kilograms (calibration factor 10000 raw counts per 1 kg)
LD SM0.0
MULR 0.0001, VD214, VD218 // VD218 = weight in kg (real)
// Network 5 - apply zero (tare) offset stored in VD300
LD SM0.0
SUBR VD300, VD218, VD310 // VD310 = net weight
For 32-bit IEEE-754 floats (used by some transmitters as register 0x0002), swap the byte and word order of the four bytes stored at VW200..VW206, then copy into a real variable. The Modbus Master library does not auto-swap floats – if you skip the swap you will see garbage values (e.g. 0.0, NaN, or wildly large numbers).
8.4 MODBUS Exception Codes
The MBUS_MSG error byte can return one of the following values. The first three are protocol-level errors; the rest are MODBUS exception codes returned by the slave itself.
| Error | Meaning | Typical Cause |
|---|---|---|
| 0 | No error | Successful poll |
| 1 | Illegal function | Slave does not support the function code sent (most common when the transmitter is set to a different mode) |
| 2 | Illegal data address | Register number out of range; check the Addr parameter against the transmitter's register map |
| 3 | Illegal data value | Data length not supported, or the slave is in a state that prevents the read (e.g. calibration mode) |
| 4 | Slave device failure | Internal transmitter fault (sense lead open, ADC out of range, EEPROM error) |
| 5 | Acknowledge | Long-running command accepted; not an error for a normal read |
| 6 | Slave device busy | Slave is processing a previous command; increase the inter-message delay |
| 7 | Negative acknowledge | Password-protected register; send the unlock command first |
| 8 | Memory parity error | Slave has detected corrupt memory; re-flash the transmitter firmware |
9. Verification
- Status LEDs – Confirm the transmitter shows a stable green LED and the S7-200's Port 1 RX/TX LEDs flicker once per polling cycle. A continuously lit RX or TX LED usually means a stuck port; power-cycle the S7-200 to clear.
- Loop-back test – Disconnect the load cell and place a 1 mV precision source across +SIG and −SIG with a 350 Ω dummy bridge across the excitation terminals. The PLC should read a value within ±2 raw counts of the expected scaled result.
- Calibration – With the load cell mechanically unloaded, send the transmitter's zero command (or capture the raw value into VD300 through a one-shot pushbutton). Apply a known mass at 50 % capacity and adjust the scale factor in the multiplier (0.0001 in the example) until the displayed weight matches the known mass to within the required resolution.
- Repeatability – Run five load/unload cycles at 0 %, 50 %, and 100 % of capacity. The standard deviation should be ≤ 0.01 % of full scale for a properly installed Class III cell.
- Communication diagnostics – Open STEP 7 Micro/WIN's Modbus Master Trace window. Each poll should complete with Done = 1 and Error = 0 within the configured timeout. Any recurring Error = 1 or 2 indicates a register-map mismatch; Error = 3 points to wiring, termination, or baud-rate problems.
- Long-term stability – Log VD310 (net weight) over 24 hours with the cell mechanically unloaded. The drift should be less than 0.05 % of full scale, and any step change correlated with HVAC or production equipment switch-on indicates inadequate shielding.
10. Troubleshooting Matrix
| Symptom | Likely Cause | Corrective Action |
|---|---|---|
| MBUS_MSG Error = 3, no LEDs on transmitter | No 24 V to transmitter, or polarity reversed | Check 24 V supply; verify polarity on the transmitter power terminals |
| MBUS_MSG Error = 3, TX LED on PLC flashes, no RX echo | A/B wires reversed, or termination missing | Swap D+ / D−; confirm 120 Ω at both ends; check shield is not shorted to D+ or D− |
| MBUS_MSG Error = 1 or 2 | Slave address or register number does not match the transmitter map | Re-read the transmitter's MODBUS register table; adjust Slave and Addr parameters |
| Weight drifts with cable temperature | Sense leads shorted to excitation, or 4-wire cell being driven from 6-wire input | Measure resistance between +REF and +EX at the cell end; should equal the bridge resistance, not 0 Ω |
| Reading is exactly zero or stuck at 32767 / −32768 | Bridge open circuit, or +SIG / −SIG reversed | Measure bridge resistance (350 / 700 / 1,000 Ω); reverse the red/white pair if necessary |
| Reading has noise of more than 50 raw counts | Missing or poor shield termination, or VFD cable in same tray | Re-terminate the shield at the transmitter end only; separate the load cell cable by ≥ 200 mm from any VFD output cable; add a ferrite at the transmitter gland |
| Negative weight when cell is loaded | +SIG and −SIG reversed | Swap red and white conductors on the transmitter terminals 5 and 6 |
| Weight is correct at zero but reads low at full scale | Sense leads open, transmitter is regulating on cable drop, or excitation cable is too thin | Check +REF and −REF continuity from cell to transmitter; upgrade to 20 AWG if cable run is longer than 10 m |
| Reading alternates between valid value and 0xFFFF | Bus contention: two devices driving the bus, or RTS switchover not configured | Verify only one master and one slave on the bus; on the S7-200, ensure SMB30 is configured for freeport mode with no RTS delay |
| PLC fault SF LED on, MB_ERR = 6 | Slave address conflict or duplicate node | Set each slave to a unique address using the transmitter's configuration software or DIP switches |
11. Maintenance and Long-Term Considerations
A correctly wired 6-wire system is largely maintenance-free, but two failure modes are common in the field. The first is moisture ingress in the cell's cable gland, which slowly degrades the sense-lead insulation. Symptoms are a slow zero drift correlated with rain, wash-down cycles, or overnight condensation. Apply self-amalgamating tape or replace the gland with an IP68 EMC version that maintains shield continuity. The second is mechanical fatigue of the cell's sense wire at the strain-gauge termination, which presents as a sudden open circuit. This is detected by the transmitter's sense-error flag and a zero reading on the PLC. Replace the cell; do not attempt to repair the gauge – the compensation resistors are laser-trimmed during manufacture and any rework invalidates the calibration certificate.
Schedule a re-calibration check every 12 months for legal-for-trade applications (OIML R76 class III) or every 24 months for process control. Use the same calibration masses and the same mechanical load path as the original commissioning to keep the data comparable. After any maintenance on the mechanical structure, run a linearity check at 0 %, 25 %, 50 %, 75 %, and 100 % of capacity and compare against the as-commissioned values. A deviation of more than 0.1 % at any point warrants a full recalibration.
12. Frequently Asked Questions
Can I use a 4-wire load cell with a 6-wire transmitter input?
Yes. Jumper +REF to +EX and −REF to −EX on the transmitter terminals, but only at the transmitter end, never at the cell end. The cell will operate in 4-wire mode and lose its temperature-compensation benefit, which is acceptable for short cable runs (≤ 3 m) and ambient temperature variations below 10 °C.
Do I need the isolated signal module (6ES7 241-1CH30-0XB0) or is the non-isolated board (6ES7 241-1CH30-1XB0) sufficient?
For most bench-top and short-run installations the signal board is sufficient and saves a slot. Choose the signal module when the weighing platform is more than 10 m from the PLC, when the plant has a separate ground grid, or when the RS485 cable runs near a VFD. The 500 V isolation breaks ground loops that would otherwise inject common-mode noise into the bridge reading.
My S7-200 has only Port 0. Can I use the CPU's built-in RS485 port for MODBUS?
Yes. Set Port 0 to MODBUS master mode with SMB30 = 0x09 (9600, no parity) and use the same MBUS_CTRL / MBUS_MSG calls. You lose the diagnostic LEDs and the dedicated port, but the protocol is identical. Be aware that Port 0 is also the PPI programming port – if you leave the CPU in MODBUS mode, the STEP 7 Micro/WIN programming software cannot connect without first switching the port back to PPI from a panel, HMI, or a second CPU port.
What is the maximum cable length for the load cell side?
Keep the load cell cable under 30 m for 6-wire installations. Beyond 30 m, the sense leads pick up EMI and the cable capacitance (≈ 100 pF/m) starts to roll off the bridge bandwidth. Use a sense-line amplifier (remote-junction box) for very long runs, or switch to a 4-wire cell with an in-line amplifier at the platform. The RS485 side is much more forgiving: up to 1,200 m at 9,600 baud over a properly terminated cable.
Why does the S7-200 read the weight as a negative number when the cell is loaded?
The +SIG and −SIG conductors are reversed. Swap the red and white wires on transmitter terminals 5 and 6. The same condition on a US colour-code cell requires swapping green and white (NIST HB-44) or whatever pair the cell's certificate identifies as the signal pair. The excitation pair is correct because the bridge is still producing a valid reading – the polarity is the only error.
How do I read a 32-bit IEEE-754 float weight from the transmitter?
Set the MBUS_MSG Count parameter to 2 (two 16-bit holding registers), then in the S7-200 swap the byte and word order of the four bytes stored at VW200..VW206 and copy the result into a real (floating-point) variable. The Modbus Master library for the S7-200 does not auto-swap floats; a direct copy will return nonsense like 0.0 or NaN.
Can I run more than one weight transmitter on the same RS485 bus?
Yes. RS485 supports up to 32 unit loads on a single bus. Set each transmitter to a unique slave address (1 to 247) using its configuration menu or DIP switches, then poll each in turn from a single MBUS_CTRL / MBUS_MSG pair in the S7-200. The library's inter-message delay should be at least 3.5 character times (about 4 ms at 9600 baud) to give the slave time to release the bus.