Bridging Siemens CP341 Modbus RTU to ABB PLC TCP/IP

System Overview

This reference documents the field architecture, gateway selection, and commissioning steps required to extend Modbus RTU communication from a Siemens SIMATIC S7-300 CP341 slave to an ABB AC500-class PLC acting as a Modbus TCP master over a total run of 1600 metres. The original installation uses an ABB PLC for plant-wide Modbus TCP OPC aggregation, while the field device cluster retains RS485 RTU on the CP341 for legacy reasons: existing shielded twisted-pair cable, FTAB-licensed Modbus slave function blocks in STEP 7, and validated I/O mapping. The 1600 m physical distance exceeds the TIA-485-A cable reach envelope at any standard Modbus baud rate, so a mid-span conversion device is required either as a true RS485 repeater/segmenter or as a media converter that re-emits the Modbus transaction as Modbus TCP on the Ethernet side facing the ABB PLC.

The CP341 in question is loaded with the Modbus Slave firmware license (CP 341 order number 6ES7341-1AH02-0AE0 or 6ES7341-1BH02-0AE0 depending on RS232/422-485 interface variant). The ABB master is expected to issue Modbus TCP requests on TCP/502 against the converter IP, and the converter in turn translates those requests into Modbus RTU frames addressed to the CP341 slave unit identifier. This reference consolidates the four viable converter choices raised in field discussions (Moxa MGate MB3170, Advantech ADAM-4572, Lantronix XPress-DR-IAP, and Siemens CP343-1 with Open ModbusTCP) and adds RS485 wiring, topology, and fault-diagnostics content drawn from ABB, Endress+Hauser, and Honeywell Modbus instrumentation manuals.

RS485 Physical Layer Limits at 1600 m

TIA-485-A specifies a maximum line length of 1200 m (4000 ft) between two 120 Ω termination resistors at data rates up to 100 kbit/s when using 24 AWG twisted pair with characteristic impedance of 100-120 Ω and a stub length below one-tenth of the unit interval. Above 100 kbit/s the cable loss budget becomes baud-rate dependent. The conservative field rule is:

A 1600 m link therefore cannot be run as a single RS485 segment at any practical Modbus baud rate. There are two industry-accepted solutions:

1. Insert an RS485 repeater at the 800 m midpoint (e.g. Phoenix Contact PSI-REP-RS485/W2, Advantech ADAM-4510/ADAM-4520). Each segment then respects the 1200 m budget and the cable behaves as two isolated electrical segments sharing a common logic.
2. Convert the medium at the midpoint: place a Modbus RTU-to-Modbus TCP gateway at 800 m, run Ethernet (CAT 6, fibre, or industrial wireless) for the remaining 800 m to the ABB PLC. The gateway terminates the RS485 segment and presents a Modbus TCP server on Ethernet.

Because the user explicitly requested a repeater-cum-converter rather than a transparent electrical repeater, the converter-at-midpoint topology is the target architecture in this reference. The RS485 segment stays bounded at 800 m, well inside the TIA-485-A budget for 9600-19200 bit/s, while the second 800 m hop is run on Ethernet, where 100 m copper limits per segment are irrelevant because industrial Ethernet can use fibre or managed copper extenders.

CP341 Modbus Slave Constraints

The CP341 in Modbus Slave mode exposes the following field-relevant constraints:

• Physical interface: RS485 half-duplex (2-wire) on variant 6ES7341-1BH02-0AE0, RS232 on -1AH02. The RS485 variant is required for the multi-drop field installation.
• Protocol: Modbus RTU (8-N-1 or 8-E-1) only; ASCII is available but rarely used on CP341.
• Baud rates: 300, 600, 1200, 2400, 4800, 9600, 19200, 38400, 57600, 76800, 115200 bit/s.
• Function codes supported in slave mode: 01, 02, 03, 04, 05, 06, 15, 16.
• Addressing: 1-based for the STEP 7 DB layout, mapped transparently to Modbus addresses 0-based on the wire.
• Timing: CP341 response delay (turnaround) is configurable from 0 to 65535 ms. Default 0 ms. Set this to at least 5 ms when a gateway in RTU-master mode is in front of the CP341 to avoid premature frame detection.
• Buffer length: up to 4096 bytes per PDU; in Modbus mode the application buffer is sized at commissioning via the Modbus Slave FB parameters.

ABB Modbus TCP Master Requirements

The ABB master side is typically implemented on an AC500 platform (PM571/PM581/PM582/PM590/PM591) with the onboard Ethernet port or a CM564-ETH communication module. ABB provides Modbus TCP client/server support either through:

• The AC500 Modbus TCP library on the Control Builder Plus / Automation Builder IDE.
• An OPC DA/UA server bridging to Modbus TCP (e.g. ABB OPCServer, Matrikon OPC, Kepware).

Regardless of the upstream interface, the ABB PLC expects to:

1. Open a TCP connection to the gateway IP on port 502 (default Modbus TCP well-known port).
2. Issue a Modbus request PDU wrapped in an MBAP header (transaction ID, protocol ID 0, length, unit identifier).
3. Receive the response within a poll timeout typically configured at 1000-3000 ms.

The unit identifier in the MBAP header is the bridge to the CP341 slave address. Most gateways default to mapping unit ID 1 to the only slave on the RS485 side; verify that the CP341 Modbus Slave FB has Modbus Address = 1 or remap as needed.

Architecture: Mid-Span Converter Placement

The recommended topology places the gateway at the electrical midpoint, 800 m from each end. The gateway in this configuration runs in two roles that are not simultaneous:

• RS485 side: Modbus RTU master (because the CP341 is the slave and a master must poll it).
• Ethernet side: Modbus TCP slave (because the ABB PLC is the master and the gateway answers it).

If the gateway only supports a transparent bridge mode (TCP server ↔ serial slave), then the ABB master still has to issue Modbus RTU frames by routing through the gateway as if the CP341 were attached locally. This works on the Moxa MGate MB3170 and Advantech ADAM-4572 in their default RTU Master ↔ TCP Slave mode and is the most common field deployment. Lantronix XPress-DR-IAP in "Tunnel" mode can also be configured this way, although Lantronix's strength is mode 1 (master on serial, slave on TCP) where the device actively polls.

Gateway Comparison and Selection

Selection guidance:

• Pick Moxa MGate MB3170 for the default CP341-to-ABB scenario. It has explicit master/slave mode selection, very robust web UI, and a 10-year hardware lifecycle typical for industrial gateway suppliers.
• Pick Advantech ADAM-4572 when the customer standardises on Advantech ADAM-4000 I/O and already uses the ADAM.NET utility stack for commissioning.
• Pick Lantronix XPress-DR-IAP when the gateway must be installed in a high-vibration, outdoor, or extended-temperature cabinet. Industrial-rated (-40 °C to +70 °C) and isolated serial port.
• Pick CP343-1 + Open ModbusTCP only if the S7-300 station can host a CP343-1 and the user is willing to migrate the CP341 Modbus slave code to an Open ModbusTCP server on the S7. The 341 hardware stays for legacy I/O but the Modbus transaction becomes TCP-native at the S7-300 end.

Moxa MGate MB3170 Configuration

The MB3170 firmware revision 3.x or later is required for full transparent bridging with per-request unit-ID mapping. Order number: MB3170-T for wide-temp (-40 to 75 °C), MB3170 for standard temp.

1. Wire RS485 to the DB9-M serial port: pin 1 = Data+ (D+), pin 2 = Data- (D-), pin 5 = SGND. Connect shield to chassis ground at one end only (gateway end preferred).
2. Set the DIP switch on the bottom of the unit to RS485 2-wire (position 1 ON, position 2 OFF, position 3 OFF). Termination resistor (120 Ω) is enabled by DIP switch 4 ON.
3. Apply 12-48 VDC on the removable terminal block. Verify the PWR LED is solid green.
4. Set the laptop to 192.168.127.254 / 24 and connect to the gateway's Ethernet port. Open the web UI at http://192.168.127.253 (default).
5. In Network Settings, assign the static IP that the ABB PLC will poll, e.g. 192.168.10.50/24, gateway 192.168.10.1.
6. In Serial Settings: baud 9600, parity none, data 8, stop 1, interface RS485 2-wire, flow control none.
7. In Modbus Mode: select RTU Master ↔ TCP Slave. Add a Slave rule with IP 0.0.0.0 (any) and unit ID 1 mapping to slave address 1 on RS485.
8. Set Response Timeout to 1000 ms and Inter-Character Timeout to the Modbus standard of 3.5 character times (e.g. 4 ms at 9600 bit/s).
9. Save, restart the gateway, and watch the MB3170 LEDs: P1 (serial) flashes green on each transaction, P2 (Ethernet) flashes on TCP exchanges.

Advantech ADAM-4572 Configuration

Advantech ADAM-4572 (and successor ADAM-4572L) is a single-port RS232/422/485-to-Ethernet Modbus gateway with browser-based configuration. It is widely used in factory automation panels.

1. Wire the RS485 terminals: D+ / D- / SGND on the detachable terminal block. Insert 120 Ω termination if the gateway is the segment end (DIP switch SW1 position 1 ON).
2. Power the gateway with 10-30 VDC on the same terminal block (V+/V-). Status LED "Link" should turn green.
3. Default IP is 10.0.0.1/8. Set laptop to 10.0.0.2/8 and access http://10.0.0.1 in the browser. Default user admin, password 00000000.
4. In Network: assign the static IP for the ABB PLC network. Note: the ADAM-4572 supports only one Ethernet port, so it cannot bridge two IP subnets without a router.
5. In Serial: match the CP341 settings exactly (baud, parity, data bits, stop bits). Set interface to RS485 2-wire.
6. In Modbus Gateway: select RTU Master mode, add the CP341 as Slave ID 1, set TCP Port 502.
7. Configure the inter-frame timeout as 3.5 character times. ADAM-4572 calls this "Character Timeout" and exposes it in milliseconds.
8. Save and reboot. Verify traffic in the Diagnostic page: Tx/Rx counters should match the ABB OPC poll rate.

Siemens CP343-1 + Open ModbusTCP Path

The Siemens alternative to a third-party gateway is to use a CP343-1 Ethernet communication processor in the same S7-300 rack as the CP341, and to load the optional Open ModbusTCP software package on the CPU. The CP341 then remains as a Modbus RTU slave to local I/O, while the CP343-1 becomes a Modbus TCP server for the ABB PLC. Note that this does not make the CP341 itself reachable on TCP; it merely moves the gateway function inside the S7-300 station.

1. Verify that the S7-300 station has a CP343-1 (typical article 6GK7343-1EX30-0XE0 for 1-port, or 6GK7343-1CX10-0XE0 for the more recent 6GK7343 variant) installed and connected to the plant Ethernet.
2. Order the Open ModbusTCP license (article 6AV6676-6MB30-0AX0 or the current licence package) and install via SIMATIC Automation Tool / Automation License Manager.
3. In STEP 7 / TIA Portal, instantiate the MODBUS_PN FB block, configure CP343-1 as the Modbus TCP server, and bind the same DB that the CP341 Modbus slave FB writes into. This gives the ABB PLC direct register access without converting protocols at a separate box.
4. Set the CP343-1 IP, subnet mask, and gateway. Disable any router restrictions that would block TCP/502 from the ABB PLC subnet.
5. From the ABB master, poll CP343-1-IP:502. Use Modbus function codes 03 / 04 / 06 / 16 to read/write holding registers.

Lantronix XPress-DR-IAP Path

The Lantronix XPress-DR-IAP is a rugged industrial device server with isolated RS232/422/485 and Modbus RTU-to-TCP bridging firmware. It is rated -40 °C to +70 °C operating, 5-30 V DC, and is suited to outdoor cabinet or rooftop installations.

1. Wire the RS485 terminals on the XPress-DR-IAP: pin 2 = TX/RX+, pin 3 = TX/RX-, pin 7 = SGND. Enable 120 Ω termination in the web UI (Modbus Settings → Termination).
2. Apply 5-30 V DC. Wait 30 s for boot. Status LED "Link" solid and "Status" blinking 1 Hz indicates ready.
3. Use Lantronix DeviceInstaller on a laptop to discover the gateway. Default IP is on the 169.254.x.x link-local subnet (Lantronix default). Log in to the web UI (user admin, password is the device serial number printed on the label).
4. In Network: assign the static IP for the ABB PLC subnet. Disable DHCP.
5. In Modbus/RTU Settings: baud 9600 8-N-1, RS485 2-wire, inter-character timeout 4 ms (3.5 chars at 9600).
6. In Mode: select Modbus RTU ↔ Modbus TCP Gateway (Master on Serial). This is the equivalent of the Moxa "RTU Master ↔ TCP Slave" mode.
7. Configure the local Modbus slave address (CP341) = 1, the TCP port = 502.
8. From the ABB OPC server, poll XPress-DR-IAP-IP:502.

RS485 Wiring, Termination, and Shielding

All four gateways share a common RS485 implementation, so the wiring rules are identical regardless of which box is installed:

Network Topology and IP Planning

The Ethernet side of the gateway must coexist with the ABB PLC's existing plant network. Recommended addressing plan:

Open TCP/502 from the ABB subnet toward 192.168.10.50:502 on the managed switch's ACL. If the plant uses VLANs, place the gateway in the same VLAN as the ABB PLC or trunk with explicit ACL rules. Keep management ports (HTTP 80, HTTPS 443, Telnet 23) on a separate VLAN or block them at the firewall because the gateway default passwords are widely known.

Commissioning Procedure

1. Pre-power checks. Verify RS485 cable continuity with a multimeter (D+ to D+ should read ~100-120 Ω across the segment, indicating two 120 Ω terminators in parallel). Verify shield continuity and one-end-only ground bond.
2. Gateway IP assignment. Connect laptop to gateway, set static IP out-of-the-box (e.g. Moxa default 192.168.127.253), configure plant IP via web UI, reboot.
3. Serial settings. Set baud, parity, data, stop to match CP341. Confirm RS485 2-wire DIP switch. Confirm 120 Ω termination.
4. Modbus mode. Set "RTU Master ↔ TCP Slave". Add slave rule with unit ID 1, slave IP 0.0.0.0 (any), TCP port 502.
5. Inter-character timeout. Calculate at the chosen baud rate:

   T_char = 11 bits / baud
           = 11 / 9600 = 1.146 ms
   T_interframe = 3.5 * T_char = 4.01 ms

   Set gateway inter-character timeout to 4 ms at 9600 bit/s. Lower values cause spurious frame aborts; higher values slow polling.
6. CP341 Modbus Slave FB. In STEP 7, set Modbus address = 1, response delay = 5 ms, hold-off = 50 ms.
7. Test loop. From a Windows host running mbpoll or Modbus Poll tool, connect to gateway-IP:502 and read holding register 0 (FC 03). Verify the CP341 returns the expected value.
8. ABB integration. In ABB Control Builder / Automation Builder, instantiate the Modbus TCP client FB, point it at 192.168.10.50:502, and bind to OPC tags. Monitor the OPC tag quality; it should go to Good within 5 s.

Troubleshooting Matrix

Verification and Acceptance Test

Before signing the loop into production, run the following checks and record the results in the loop folder:

1. Cable test. With gateway powered down, measure resistance D+ to D- at the gateway end: 60 Ω nominal (two 120 Ω in parallel), confirming both terminators are present. Reading > 130 Ω indicates a missing terminator; reading < 50 Ω indicates a short.
2. Bias test. With gateway powered and CP341 powered, measure D+ to SGND: should be > 200 mV (idle high). Measure D- to SGND: should be < -200 mV (idle low). This confirms bias resistors are functional.
3. Round-trip latency. From Modbus Poll on the engineering laptop, read 10 holding registers and record the request-to-response time. Expect < 50 ms at 9600 bit/s with one CP341 slave.
4. Soak test. Run continuous polling at the configured ABB OPC rate for 1 hour. Capture gateway diagnostic counters: Tx, Rx, CRC errors, timeouts. Acceptable: 0 CRC errors, < 0.1% timeouts.
5. Failover test. Power-cycle the CP341. Confirm the gateway returns Exception / Timeout gracefully (no ABB OPC card crash) and recovers within 5 s of CP341 returning.
6. Network test. Disconnect the Ethernet cable at the gateway. Confirm ABB OPC quality goes Bad. Reconnect, confirm quality returns to Good within 5 s.

For Modbus instrumentation integration context (mass flow, pressure, gas volume), review the ABB LVS Digital with UMC motor controller Interface Manual Modbus for ABB's own Modbus register conventions, the Endress+Hauser Proline Promag 53 Modbus RS485 operating instructions for vendor-specific function code behaviour typical of RS485 field devices, and the Honeywell EK205 volume converter operating instructions for diagnostic and exception-code mapping on Modbus RTU slaves sharing the same CP341 bus.