Configuring Siemens CP 341 as Modbus Slave: S7-300 Setup Guide

Overview

The Siemens CP 341 point-to-point communication processor turns an S7-300 (or ET 200S with IM 153) station into a Modbus RTU slave that any third-party master (PLC, HMI, SCADA, gateway) can poll over RS-232C, 20 mA TTY, or RS-422/RS-485. The module is loaded with a vendor-specific driver and parameter set through the CP PTP Param and CP PTP Modbus Slave packages, and the data exchange between the S7 CPU and the CP 341 is handled by the MOD_SLAVE function block — FB80 in classic STEP 7, or MODB_341 in the current TIA Portal release for S7-300/S7-400.

This guide walks through every step: module ordering, dongle installation, hardware configuration, protocol parameter assignment, Modbus register/coil mapping, the FB80/MODB_341 program interface, and the diagnostics you use to verify traffic on the wire.

CP 341 Module Variants and Order Numbers

The CP 341 family shares the same Modbus slave driver, but the physical interface differs. Pick the variant that matches the cable and signalling on the master side.

For a real Modbus RTU fieldbus, the RS-485 variant (6ES7341-1CH01-0AE0) is by far the most common choice. The RS-232C variant is used for direct masters such as a PC running Modscan or a panel.

Prerequisites

Before you start the configuration, make sure the following are available on the engineering station and the S7 station.

1. STEP 7 V5.x (classic) with Hotfix/HF for the latest CP 341 HSP, or TIA Portal V16 or later with the S7-300/S7-400 MODB_341 option package installed.
2. Modbus Slave driver dongle (CP 341 parameterization memory). The dongle is keyed to the Modbus Slave protocol; a different dongle is required for Modbus Master, RK-512, ASCII, or 3964(R).
3. CP PTP Param and CP PTP Modbus Slave packages (classic STEP 7). These install the Modbus Slave driver, the FBs (FB7, FB8, FB80), and the parameter mask in HW Config.
4. Slot in the S7-300 rack or ET 200S station. The CP 341 occupies one slot. In an ET 200S it is mounted behind an IM 153 interface module and behaves the same as in the central rack.
5. Modbus RTU master already configured with the slave address, baud rate, parity, and stop bits you intend to use.

Hardware Installation

1. Power down the S7-300 rack (or ET 200S station) and insert the CP 341 into a free slot. Slot rules are the same as for any SM module; CP 341 does not have process image restrictions.
2. Plug the Modbus Slave dongle into the front of the CP 341. The dongle is keyed — it only fits one way.
3. Wire the field cable to the sub-D connector (X27 for RS-485, X21 for RS-232C). For RS-485 multi-drop, terminate the two ends of the bus with 120 Ω and switch the bus terminator on the connector.
4. Power the rack back up. The CP 341 enters the configured protocol mode once HW Config is downloaded (see next section).

Hardware Configuration in STEP 7 (Classic)

The HW Config editor is where the CP 341 is told which protocol to load and which memory ranges to expose to the Modbus master.

Step 1 — Insert the CP 341 in the rack

1. Open SIMATIC Manager > HW Config for the S7-300 station.
2. Drag the CP 341 (matching your MLFB) from the hardware catalog onto a free slot.
3. Assign a valid diagnostic interrupt OB (OB82) and, if used, a hardware interrupt OB; otherwise leave the defaults.

Step 2 — Load the Modbus Slave driver

1. Double-click the CP 341 to open its Properties dialog.
2. Switch to the Parameters tab.
3. Open the Protocol sub-tab. In the Protocol selection field, set Modbus Slave.
4. Click Load driver. STEP 7 prompts you to download the Modbus Slave driver to the CP 341. Confirm; the dongle must be present or the download will fail.

Step 3 — Configure the protocol parameters

In the same Protocol dialog, fill in the link layer and Modbus parameters:

Step 4 — Map S7 memory to Modbus registers and coils

The Modbus master sees a flat address space of coils (1-bit), discrete inputs (1-bit), input registers (16-bit, read-only), and holding registers (16-bit, read/write). The CP 341 driver maps those four address spaces to S7 areas using the Parameter assignment > Modbus mapping mask.

For each range you specify:

• The starting Modbus address (1-based for 0xxxx, 0-based for 4xxxx depending on the master convention).
• The number of points/registers to expose.
• The S7 source (DB number + byte offset, or M area, or process image).
• The offset within the S7 source where the data lives.

Step 5 — Compile and download

1. Station > Save and Compile, then PLC > Download to Target.
2. On the first download after a dongle change, the CP 341 may report SF (group error) until the driver download from Step 2 completes — clear it with PLC > Clear/Reset or pull the diagnostics buffer.

Programming the FB80 / MODB_341 Interface

The CP 341 itself manages the Modbus state machine. From the CPU point of view, a single function block hands a job to the CP, waits for completion, and reports the result. The block calls two lower-level FBs (FB7 P_RCV_RK and FB8 P_SND_RK) that handle the handshake with the CP 341 over the backplane — those two blocks must be present in the program container, even if you do not call them directly.

Classic STEP 7 — FB80 (MOD_SLAVE)

Insert the following calls. The DB for FB80 should be an instance DB (or a multi-instance inside a higher-level FB).

// OB100 — one-shot warm restart
CALL FB 80, DB 80
  REQ      := FALSE             // no startup request
  LADDR    := W#16#100           // logical base address of CP 341 in HW Config
  STARTUP  := TRUE               // initialize after restart
  DONE     :=                    // not evaluated at startup
  ERROR    :=                    // not evaluated at startup
  STATUS   :=                    // not evaluated at startup
  LADDR_IRT :=                   // not used for Modbus
  LADDR_PRT :=                   // not used for Modbus

// OB1 — cyclic call, rising edge on REQ triggers one CP service cycle
CALL FB 80, DB 80
  REQ      := M 10.0             // user-controlled trigger, e.g. 1 s tick
  LADDR    := W#16#100
  STARTUP  := FALSE
  DONE     := M 10.1             // CP 341 returned successfully
  ERROR    := M 10.2             // CP 341 returned an error
  STATUS   := MW 12              // 16-bit status word, see below
  LADDR_IRT := 0
  LADDR_PRT := 0

TIA Portal — MODB_341

In TIA Portal V16 and later, the same functionality is exposed as the MODB_341 instruction. The block face is functionally identical: an input REQ to trigger a service cycle, a LADDR matching the HW identifier of the CP 341, and outputs DONE, ERROR, and STATUS. Refer to the TIA Portal help for the exact version-specific block layout.

Reference: MODB_341 — Modbus slave instruction for CP 341 (S7-300/S7-400).

STATUS word decoding

When ERROR goes true, the STATUS output encodes the failure cause. The high byte is the event class, the low byte is the detail code. Common values:

Modbus Function Codes Supported by the Slave Driver

The Modbus Slave driver on CP 341 supports the most common subset of the Modbus function code space. Enable only what your master will request.

Verification

After the HW Config has been downloaded and FB80 / MODB_341 is being called cyclically, verify the link from both ends.

1. CP 341 status LEDs. The green TXD and RXD LEDs should flicker with every master poll. A solid red SF indicates a configuration or driver error — read the diagnostic buffer.
2. PLC diagnostic buffer. Open Module Information > Diagnostic Buffer on the CP 341. The most recent entries should show driver start and successful parameter assignment, with no repeated framing or timeout events.
3. Master poll test. From the Modbus master tool, read the holding-register range that the CP 341 is mapped to. The values should return the S7 data. Try FC 06 to write a single register and confirm the S7 DB updates.
4. FB80 STATUS. Force REQ from a VAT and watch DONE go true. If ERROR goes true, decode the STATUS word with the table above.
5. Bus monitor. A passive RS-485 tap (or a serial line monitor on RS-232C) shows the request/response on the wire and is the fastest way to spot framing, address, or CRC mismatches.

Troubleshooting Matrix

NetPro and Connection Configuration — Why You Do Not Need It

Unlike the larger CP 441 module, the CP 341 does not use NetPro for Modbus communication. The driver is downloaded as a firmware extension and the slave responds to any master that addresses it correctly. Trying to create a "Modbus connection" in NetPro for a CP 341 will fail with "no protocol configured for the connection." Treat the CP 341 Modbus link as a loadable-driver configuration, not an S7 connection.

Commissioning Checklist

• ☐ CP 341 variant matches the field wiring (RS-485 for multi-drop).
• ☐ Modbus Slave dongle is plugged in before the first download.
• ☐ HW Config: protocol set to Modbus Slave, driver loaded.
• ☐ Baud rate, parity, stop bits identical on master and slave.
• ☐ Slave address is unique on the bus (1…247).
• ☐ Modbus register / coil ranges mapped to a DB (or M area) that the user program reads/writes.
• ☐ FB7, FB8, and FB80 (or MODB_341) present in the S7 program.
• ☐ OB100 calls FB80 with STARTUP := TRUE; OB1 calls it cyclically.
• ☐ RS-485 termination 120 Ω enabled at both bus ends.
• ☐ Master poll test passes for at least FC 03, FC 06, and FC 16.

FAQ