Configuring CP341 Modbus RTU on S7-300 and WinCC Web Navigator

1. Overview: Modbus Communication Options for the SIMATIC S7-300

The SIMATIC S7-300 family of PLCs (CPU 312 through CPU 319F) does not embed native Modbus master or slave capability in the CPU firmware. Modbus integration is therefore implemented by adding a dedicated communication processor (CP) to the S7-300 rack and loading the appropriate Modbus driver. Two distinct physical layers are supported:

• Serial Modbus RTU over RS-485 or RS-232 using the CP341 point-to-point module with a Modbus dongle.
• Ethernet Modbus TCP/IP using the CP343-1 Lean, CP343-1, or CP343-1 Advanced Ethernet processor plus the OPEN_COMM function blocks (FB12/FB13 AG_SEND/AG_RECV, or FB100/FB105/FB120 for connection-oriented TCP) or a third-party gateway.

For HMI/SCADA browser access, the WinCC 7.x Web Navigator add-on converts runtime graphics into HTML pages served by Microsoft Internet Information Server (IIS). This article details hardware selection, licensing, STEP 7 V5.x configuration, Modbus FB programming, and Web Navigator deployment for an S7-300 + WinCC 7.x station, including part numbers, dongle licensing, FB/FC block calls, error-code mapping, and a commissioning checklist.

2. CP341 Hardware Variants and Order Numbers

The CP341 is a single-slot point-to-point communication processor that occupies one slot in the S7-300 rack. Three electrical variants exist; each supports Modbus RTU only when paired with the matching Modbus dongle (Section 3). CP341 is functionally identical to the lower-cost CP340 except that CP341 supports loadable drivers (including Modbus), while CP340 supports only 3964R/ASCII drivers.

The -1CH02-0AE0 variant is the default selection for any plant-floor Modbus RTU integration because most field devices (VFDs, energy meters, weigh scales, third-party controllers) expose an RS-485 Modbus port. RS-485 supports up to 32 unit loads (UL) per segment, 1200 m at 9600 bit/s, and terminated at both ends with 120 Ω resistors between the differential pair. The CP341 internally provides a switchable 220 Ω fail-safe bias network; verify the cable shield, drain wire, and chassis-ground bonding per Modbus Organization cable recommendations.

Hardware revision and firmware version are stamped on the front of the CP341 (field "FW x.x.x"). The Modbus Master dongle for firmware V1.x is not interchangeable with the V2.x dongle; always order the dongle matching the module's firmware family. Confirm the firmware against the Siemens Product Support page (entry ID 109745422 is the CP341 manual index) before ordering.

3. Modbus RTU Dongle and Loadable Driver Licensing

The CP341 ships with no Modbus firmware. Each role — Master or Slave — requires a physical license dongle, a loadable driver executable, and the matching documentation on DVD. The dongle is a small PCB with DIL switches that mechanically keys the driver to the specific CP341 serial number. Without the dongle, the Modbus protocol entry in HW Config remains greyed out.

Installation flow:

1. Insert the dongle PCB into the CP341 module with power OFF.
2. Install the Modbus Master/Slave loadable driver on the programming PC from the Siemens DVD or download package.
3. In STEP 7 HW Config, right-click the CP341 → "Load Driver" → select "Modbus Master RTU" or "Modbus Slave RTU".
4. The driver binary is downloaded to the CP341 on the next PLC download; the CP341 restarts and the SF LED clears within 5 s.

For systems that must switch between Modbus Master and Modbus Slave at runtime, the CP341 supports loading only one protocol driver at a time. Re-loading requires a CPU STOP → RUN transition and the matching dongle physically present.

4. CP343-1 Ethernet Processor for Modbus TCP/IP

Where the Modbus device exposes an Ethernet port (Modbus TCP/IP, TCP port 502 — standardized by the Modbus Organization), a CP343-1 Ethernet processor is added to the S7-300 rack. Unlike CP341, CP343-1 does not include a Modbus protocol firmware; Modbus TCP/IP must be implemented in the PLC program using the OPEN_COMM library or by front-ending a third-party gateway.

The standard approach for Modbus TCP/IP master on S7-300 is to use the AG_SEND / AG_RECV blocks (FB12 / FB13) supplied with STEP 7 to construct the 8-byte MBAP header + function code + data payload, then parse the response in the user program. Siemens publishes a free application example "Modbus TCP via CP343-1" containing reusable FBs (commonly labelled "MOD_TCP" or "MB_CLIENT" in customer variants) — search the Siemens Online Support for the latest revision.

5. STEP 7 V5.x Hardware Configuration

With STEP 7 V5.5 SP4 (or higher) and the matching Hardware Support Package (HSP) installed, drag the CP341 from the hardware catalog under "SIMATIC 300 / CP 300 / Point-to-Point / CP341" into the S7-300 rack. The slot must respect the S7-300 rack rules — up to 8 CPs per station, distributed across multiple racks via IM360/IM361 if needed.

Double-click the CP341 to open its properties dialog:

1. Interface tab: select RS-422/485 full-duplex (4-wire) or half-duplex (2-wire) to match the bus wiring. Most RS-485 Modbus trunks are 2-wire half-duplex.
2. Protocol tab: select "Modbus Master RTU" (the dongle must be present or this option is greyed out).
3. Message monitoring tab: enable "Output of the receive line to a diagnostic DB" to capture raw frames for diagnostics.
4. Transmission parameters: baud rate (default 9600 bit/s), parity (None/Even/Odd), data bits (8), stop bits (1). Slave parity must match the Modbus slave device exactly — mismatched parity is the most common cause of "no response" faults.
5. Modbus-specific tab: frame turnaround time (default 50 ms), inter-character timeout (default 4 character times), and retry count (default 2).

RS-485 wiring convention on the X27 D-sub (verify against the CP341 manual before energising):

Termination: place a 120 Ω resistor between T/R+ and T/R- at each physical end of the trunk. The CP341 contains an internal switchable 220 Ω fail-safe bias (T/R+ pulled to +5 V through 560 Ω; T/R- pulled to GND through 560 Ω). Enable this only on the master end if no other device on the bus provides bias.

Save the configuration and download HW Config to the CPU. The CP341 transitions to RUN with the new firmware; the SF (System Fault) LED should extinguish within 5 s. A solid SF LED indicates dongle missing or driver not loaded; a flashing SF LED indicates receive timeout or framing errors from the bus.

6. CP341 Function Blocks for Modbus Data Exchange

The Modbus Master loadable driver ships with a library of FB/FC blocks designed for STEP 7 V5.x. The exact set of blocks depends on the driver revision; common blocks (Modbus Master driver V2.x):

A typical cyclic read of holding register 40001 from slave #1 into DB100.DBD0 is invoked in OB1 as:

// Call instance: Modbus master FB on CP341
CALL FB 80, DB 80
REQ        := TRUE          // Edge-triggered request
SLAVE_ADDR := 1             // Modbus slave address 1
FC_CODE    := 3             // Read Holding Registers
REG_ADDR   := 1             // Register 40001
REG_COUNT  := 10            // 10 registers (20 bytes)
RD_DB      := 100           // Target data block
RD_OFFSET  := 0             // Target byte offset
DONE       := M 100.0       // Request complete
ERROR      := M 100.1       // Error flag
STATUS     := MW 102        // Modbus status word
CP_START   := FALSE
CP_RESET   := FALSE
SLAVE_ID_USED := FALSE

Modbus status codes returned in STATUS:

7. WinCC 7.x Web Navigator Architecture

WinCC 7.x Web Navigator extends the WinCC runtime database, alarms, and graphics to remote clients served by a Microsoft IIS web server. Two licensed components are required:

• WinCC/Web Navigator Server — runs on the same PC as WinCC Runtime, hosts the IIS virtual directory, manages user accounts.
• WinCC/Web Navigator Client — Internet Explorer (ActiveX host) on remote workstations. Each concurrent client requires a license counter.

Typical order numbers for Web Navigator V7.x (verify exact suffix against the WinCC version in service):

Architecture overview:

8. Web Navigator Installation, Licensing, and IIS Configuration

Pre-requisites:

• Microsoft Windows Server 2008 R2 / 2012 R2 / 2016 with the IIS role enabled. WinCC V7.0 requires IIS 6.0 compatibility; WinCC V7.5 supports IIS 7.x and 8.5.
• Microsoft Internet Explorer 11 on every client PC (the only browser with ActiveX support; WinCC 7.x Web Navigator does not support Edge, Chrome, or Firefox).
• WinCC Runtime installed, licensed, and tested locally before adding Web Navigator.
• Web Navigator license (see Section 7) installed via the Automation License Manager on the WinCC server.
• Static IP address on the WinCC server; DHCP reservations recommended for the operator network.

Step-by-step install:

1. From the WinCC V7.x DVD or installer package, launch the setup; select "Custom" install and tick "Web Navigator Server" and "Web Navigator Client".
2. Insert the license key into a USB port of the WinCC server and start the Automation License Manager; transfer the license from the USB stick to the local hard drive C:\Program Files\Siemens\Automation\License\.
3. The setup wizard prompts for IIS configuration. Accept the default virtual directory name "WebNavigator" and TCP port 80 (change to 8080 or 443 if another IIS site uses port 80).
4. When prompted for user authentication mode, select "WinCC user administration" to enforce the same user database as the WinCC Runtime, or "Windows user administration" for Active Directory integration.
5. After setup completes, restart the WinCC server. Verify the virtual directory exists by browsing to http://localhost/WebNavigator/ from the server itself — the WinCC login dialog should appear within 3 s.

IIS hardening notes:

• Disable anonymous authentication on the WebNavigator virtual directory; enable Windows Authentication or Basic Authentication as configured in step 4.
• Restrict IP addresses via IIS IP security to the operator subnet only; do not expose Web Navigator to the public internet.
• For encrypted transport, enable HTTPS with a server certificate signed by an internal CA — the Web Navigator protocol payload is unencrypted over HTTP.

9. Publishing Screens and Configuring User Administration

Every WinCC screen in the Graphics Designer can be published to the Web Navigator, or individual screens can be flagged for web-only access. Open the WinCC Explorer → "Web Navigator" → "Web Configurator" → "Web View" and toggle "Publish" for each screen PDL file. Screens not flagged are invisible to remote clients.

User administration:

1. WinCC Explorer → "User Administrator".
2. Create operator accounts; assign them to the "WebAccess" authorization level for read-only monitoring, or to the operator level with appropriate tag/alarm rights.
3. Configure a password rotation policy (90 days recommended) and minimum password length of 8 characters with mixed case and a digit.
4. Confirm the configured users are accessible from the web by clicking "Test Web Login" inside the Web Configurator.
5. Optionally import users from Active Directory via the "Windows user administration" option in step 4 of the installation.

Custom homepage and branding:

• Replace the default default.aspx in the IIS virtual directory with a project-branded splash page that links to Start.aspx.
• Set screen refresh interval in the Web Configurator (default 1000 ms); aggressive refresh (< 500 ms) increases CP341 bus load if WinCC tags are bridged to Modbus polling.
• Limit concurrent client sessions per user via the Web Configurator "Session Limits" tab to prevent license exhaustion by a single user opening multiple IE windows.

Alarm publishing:

1. Web Configurator → "Alarm pages" → enable "Publish" for each alarm class that should appear in the web client.
2. Define the alarm filter (priority, class, time range) for the web view — full alarm logs should not be exported to remote clients to control bandwidth.
3. Verify alarm acknowledgement propagates back to the WinCC server by clicking "Ack" in the web client and checking the alarm state in the WinCC Alarm Logging.

10. Verification, Diagnostics, and Troubleshooting Matrix

After configuration, perform the following commissioning sequence:

1. From the programming PC, open the Web Configurator and click "Test Connection" — expect a 200 OK response from IIS.
2. From a separate client PC on the same subnet, browse to http://<wincc-server>/WebNavigator/. The WinCC login dialog must appear within 3 s; an HTTP 500 indicates the IIS application pool is stopped.
3. Log in with the configured operator account; the published screen must load and live values must update within 2 seconds of a tag change in WinCC Runtime.
4. Disconnect the RS-485 termination at the slave end and observe Web Navigator alarms; verify alarm acknowledgement propagates back to the WinCC server.
5. Force a Modbus fault by writing an out-of-range register and confirm STATUS reflects the slave exception code (e.g., 0x0004 for Illegal Data Address).
6. From a client PC outside the operator subnet, confirm the IIS IP-security restrictions correctly block unauthorized access.

Common fault matrix:

11. Performance, Bus Load, and Migration Notes

Modbus RTU bus load on the CP341 follows the formula:

T_frame_ms = ((N_bytes × 11) / baud_rate) × 1000 + turnaround_ms
where N_bytes ≈ 8 + 2 × register_count (typical FC 03 read of 16-bit registers)

For 32 slaves each scanned once per second with 16 registers (N = 40 bytes) at 9600 bit/s and 50 ms turnaround: T ≈ 96 ms per transaction × 32 = 3070 ms of bus time, leaving only ~7 ms headroom in a 1 s scan cycle. Reduce to 8 registers per slave or increase the scan interval to 2 s to recover margin.

Web Navigator concurrent client load on the WinCC server: each client maintains a TCP socket to the WinCC Runtime and consumes one license counter. A 16 GB RAM WinCC server can typically sustain 25 concurrent Web Navigator clients before tag update latency exceeds 2 s. Beyond that, deploy a WinCC Client-Server topology with a dedicated Web Navigator Server and a redundant WinCC Server pair.

Migration to modern browsers: WinCC 7.x Web Navigator cannot be migrated to Edge or Chrome because the ActiveX model is EOL. New projects should use WinCC Unified (V16+) which provides native HTML5 web access; the CP341 path remains valid because the S7-300 PLC program and WinCC Unified driver both consume Modbus RTU frames through the CP341 dongle unchanged.

12. Frequently Asked Questions