Configuring Siemens CP 341 as Modbus RTU Master for ABB Drive

1. Overview

The integration scenario covered by this reference consists of a Siemens SIMATIC S7-300 station equipped with a CP 341 point-to-point communication module, an ABB serial data converter (commonly an ABB CRS-50 bridging RS-232/422/485 onto an industrial fieldbus), and a downstream GE Fanuc PLC acting as the data source. The intended use case is reading analog process values from the GE Fanuc slave and transporting them into the S7-300 data area.

Among the four protocol options presented on the CP 341 — 3964(R), ASCII Driver, RK 512, and Printer — none of them is the correct choice for this topology. The only protocol that simultaneously allows the CP 341 to talk to a generic Modbus RTU device (the ABB converter configured as a transparent RS-485 bridge) and to a Modbus RTU slave (the GE Fanuc PLC) is Modbus RTU, which requires the Modbus master dongle and the MODB_341 loadable driver.

2. CP 341 Hardware Variants and Order Numbers

The CP 341 family comprises three electrically distinct variants. Selecting the correct variant is mandatory before ordering the matching Modbus dongle, because the dongle is keyed to the physical interface.

For Modbus RTU communication against an ABB converter operating on a 2-wire RS-485 multidrop segment, the CP 341 RS-422/485 (6ES7 341-1CH01-0AE0) is the correct variant. The RS-232C variant cannot drive an RS-485 bus directly and would require an external converter, which is undesirable because the ABB converter itself is the protocol translator in this topology.

3. Protocol Selection — Why Modbus RTU

The four loadable drivers offered by the CP 341 firmware are mutually exclusive on the dongle. Each dongle enables exactly one protocol:

Modbus RTU is the only driver in the family that provides:

• CRC-16 integrity checking on every frame
• Standardized function codes (01, 02, 03, 04, 05, 06, 15, 16, etc.)
• Slave addressing 1–247 on a shared bus
• Half-duplex turn-around discipline suited to RS-485
• Register-level read/write semantics that map cleanly to analog I/O

Because the GE Fanuc slave exposes its analog values as Modbus holding/input registers, the master function codes 03 (read holding registers) and 04 (read input registers) are the only ones required for read-only acquisition.

4. Modbus Dongle Installation Procedure

The loadable driver on the CP 341 is enabled by a small EPROM dongle plugged into the back of the module. Each dongle is sold separately and is supplied with a diskette containing the parameter assignment tool and the function blocks. The Modbus RTU master dongle has MLFB 6ES7 870-1AA01-0YA0; the matching slave dongle is 6ES7 870-1AB01-0YA0.

1. Power down the S7-300 rack. The CP must be removed from the rack to access the dongle socket.
2. With the module removed, locate the dongle socket on the back of the CP 341, above the backplane bus connector. The socket is keyed to accept the dongle in one orientation only.
3. Insert the dongle firmly into the socket. The dongle is keyed so that pin 1 aligns with the marked position; do not force it.
4. Re-seat the CP 341 in the rack, then power the station back up.
5. Open the CP 341 parameter assignment tool (in STEP 7 V5.x, it appears as a CP 341 slot in HW Config → Properties → Parameter Assignment).
6. Verify that the Modbus driver is now selectable. If only the four base protocols are still listed, the dongle is not detected — remove and re-seat it.

5. CP 341 Configuration as Modbus RTU Master

After the dongle is detected, the CP is configured from the Parameter Assignment dialog in STEP 7 → HW Config. The following table summarises the parameters relevant to the S7-300 ↔ ABB CRS-50 ↔ GE Fanuc topology.

Save and download the hardware configuration. The CP 341 will not enter Modbus data exchange until the user program issues a send/receive job via the P_SND_RK / P_RCV_RK function blocks.

6. ABB CRS-50 Converter Integration

The ABB CRS-50 is a serial-to-Modbus gateway that exposes the host fieldbus as a transparent RS-232/422/485 channel. For use in the present topology the CRS-50 must be configured as a Modbus RTU bridge rather than as an ASCII gateway — the two modes are mutually exclusive and the converter does not auto-detect.

7. P_SND_RK and P_RCV_RK Function Block Programming

Data transfer between the S7-300 CPU and the CP 341 is performed exclusively through two library function blocks from the CP 341 Point-to-Point Communication package:

• FB 8 / FB 9 — P_SND_RK (Send) — hands a send job to the CP 341 and returns once the job has been accepted by the firmware
• FB 7 / FB 8 — P_RCV_RK (Receive) — fetches the next received frame from the CP 341 and writes it into a CPU data area

The block interface is identical for the Modbus driver; the FB numbers depend on the STEP 7 version and the library variant. In STEP 7 V5.5 with the Modbus master library installed, the standard assignments are FB 8 (P_SND_RK) and FB 7 (P_RCV_RK).

7.1 Send Job Structure (Modbus Master Read Request)

The send buffer for a Modbus master read job is built by the user program and is structured as a Modbus Application Data Unit (ADU) without the slave address and CRC — the CP 341 driver appends both automatically.

DATA_BLOCK "dbSend"
  STRUCT
    FunctionCode : BYTE := 16#03;  // Read Holding Registers
    StartingHi   : BYTE := 16#00;  // Start address high byte
    StartingLo   : BYTE := 16#00;  // Start address low byte
    QtyHi        : BYTE := 16#00;  // Quantity high byte
    QtyLo        : BYTE := 16#0A;  // Quantity low byte = 10 registers
  END_STRUCT;
END_DATA_BLOCK

For a request to slave address 1, register 0, quantity 10, the resulting wire frame (CP 341 appends the slave ID and CRC-16) is:

01 03 00 00 00 0A C5 CD

7.2 Receive Job Structure (Modbus Master Response)

The receive buffer is sized for the expected payload plus a 1-byte function-code echo and a 1-byte byte-count prefix:

DATA_BLOCK "dbRcv"
  STRUCT
    FunctionCode : BYTE;          // Echoed by slave, must match request
    ByteCount    : BYTE;          // 2 × number of registers
    RegWord      : ARRAY[1..20] OF WORD;  // Up to 10 holding registers
  END_STRUCT;
END_DATA_BLOCK

7.3 OB1 Call Skeleton

// Trigger every 200 ms — adjust to application update rate
CALL "P_SND_RK" , DB108
   REQ    := TRUE                         // rising edge starts a new job
   R      := FALSE
   LADDR  := 256                          // logical I/O address of CP 341 slot
   DB_NO  := 200                          // DB containing the send buffer
   DBB_NO := 0                            // start at byte 0 of DB 200
   LEN    := 5                            // 5 bytes: FC + start(2) + qty(2)
   R_CPU  := FALSE
   R_LIFE := FALSE
   DONE   := M 100.0                      // job accepted by CP 341
   ERROR  := M 100.1                      // job rejected, see STATUS
   STATUS := MW 102
;

CALL "P_RCV_RK" , DB109
   EN_R   := TRUE                         // receive permanently enabled
   R      := FALSE
   LADDR  := 256
   DB_NO  := 201                          // DB for the receive buffer
   DBB_NO := 0
   LEN    := 21                           // 1 + 1 + 2 × 10 = 21 bytes max
   NDR    := M 110.0                      // new data received
   ERROR  := M 110.1
   STATUS := MW 112
   S_BUF  := ANY-pointer (not used here)
;

8. RS-485 Half-Duplex Wiring

Because Modbus RTU is a half-duplex, master-slave protocol on a 2-wire RS-485 bus, the wiring must follow the EIA-485 standard strictly. Pin assignments on the CP 341 RS-422/485 (6ES7 341-1CH01-0AE0) 15-pin sub-D connector when jumper-configured for 2-wire RS-485 are:

Wiring rules:

• Maximum stub length from the main trunk to each device: ≤ 30 cm at 9600 bit/s
• Cable: twisted pair, characteristic impedance 100–120 Ω, capacitance ≤ 50 pF/m, e.g. Belden 3106A or equivalent
• Shield: bonded to functional earth at one point only (typically the cabinet ground), to avoid ground loops
• Termination: 150 Ω across A/B at both physical ends of the trunk. The CP 341 has a slide switch inside the connector housing to insert 150 Ω; enable it only if the CP is the physical end of the bus
• Total cable length: ≤ 1200 m at 9600 bit/s, but in noisy industrial environments the practical limit is 500–700 m

9. Master / Slave Role Decision Matrix

Before commissioning, the role of the S7-300 must be fixed. The decision is dictated by which device holds the initiative to read/write registers, not by the physical wiring:

For the present use case — the S7-300 wants to read analog values from the GE Fanuc — the first row applies: the CP 341 is the Modbus RTU master, the CRS-50 is a transparent RS-485 bridge, and the GE Fanuc is the Modbus RTU slave. This is the only configuration in which the CP 341 initiates the read requests.

10. Verification and Commissioning

1. Physical layer check: with the station powered and the CP 341 in run, measure the DC bias on the bus. A healthy RS-485 segment shows approximately 200 mV between A and B, and the 5 V / 0 V bias on the master side from the fail-safe resistors.
2. Diagnostic buffer: open STEP 7 → PLC → Diagnostic Buffer. No "Modbus driver not loaded" or "dongle missing" entries must be present.
3. Test frame with a Modbus poll utility: temporarily disconnect the CP 341 from the bus and connect a laptop running a Modbus master test tool (e.g., Modbus Poll, QModMaster) at the same baud / parity. Confirm that the GE Fanuc slave responds correctly to function codes 03 and 04.
4. First successful cyclic read: in the S7 user program, monitor NDR on P_RCV_RK and the ByteCount byte in the receive DB. A non-zero ByteCount with the expected function-code echo is the first sign of life.
5. Timestamp check: log the time between two consecutive NDR events; it must equal the application cycle time and must not vary by more than one Modbus frame time (≈ 30 ms at 9600 bit/s for 10 registers).
6. Long-run stress test: run for at least 4 h, capturing any ERROR and STATUS values. A healthy bus produces zero errors per hour at 9600 bit/s; occasional single errors (1 per 24 h) are acceptable.

11. Troubleshooting Matrix

12. Field-Commissioning Notes and Edge Cases

• Baud-rate drift on the GE Fanuc serial module: some older GE Fanuc serial modules (e.g., IC693CMM311) drift by up to 2 % at 9600 bit/s. The CP 341 tolerates ±2 %, but a combination of 2 % drift on both ends pushes the cumulative error to 4 %, producing occasional CRC failures. Use 4800 bit/s on long cable runs if the GE Fanuc module is at the limit of its specification.
• ABB converter not in pass-through mode: if the CRS-50 is left in its Modbus master role on the fieldbus side, it will inject its own requests onto the segment. The CP 341 master requests will then collide with the CRS-50 master requests. Force the CRS-50 into transparent / pass-through operation.
• CP 341 in S7-400 vs. S7-300: the CP 341 is mechanically compatible with both, but the slot numbering and logical I/O address differ. In S7-300, the LADDR is 256 in the example above. In S7-400, re-derive it from HW Config → Properties of the CP 441/443 (the S7-400 equivalent is the CP 441, not the CP 341; the CP 341 cannot be used in an S7-400 rack).
• Mixing master and slave dongles on the same CP: only one dongle fits in the socket. If the application later requires the same CP 341 to act as a slave to another device, the dongle must be physically swapped and the configuration re-loaded.
• Character delay tuning: the 1.5-character inter-frame silence is critical. If the GE Fanuc module is slow to turn the line around, increase the inter-character timeout to 3.5 character times, but only if the same CP is the only master — multiple masters require the strict 1.5 character timing per Modbus RTU.

13. Cross-References and Standards

• MODB_341: Modbus slave instruction for CP 341 (S7-300, S7-400) — Siemens TIA Portal documentation, parameter interface and error codes for the CP 341 Modbus loadable driver.
• EIA/TIA-485-A — Electrical characteristics of generators and receivers for use in balanced digital multipoint systems. Governs the physical layer of the RS-485 segment.
• Modbus Application Protocol V1.1b3 and Modbus over Serial Line V1.02 — Modbus Organization reference documents for function codes, exception codes, and the 1.5 / 3.5 character inter-frame timing.