CP 341 Modbus Slave Data Limit: Resolving the 125-Register Cap

A field-engineering complaint that recurs across every Modbus-on-PtP commissioning of a Siemens CP 341 communication module is "my Modbus master asks for 300 registers but the CP only delivers 256." The cap is not a bug in the CP 341 firmware, not a misconfiguration of the MODB_341 function block, and not a quirk of the radio modem or RS-485 driver. It is a hard ceiling of the Modbus application layer, replicated identically across every compliant slave regardless of vendor. This reference explains the protocol math, the CP 341 driver constraints, and the multi-transaction strategy required to read registers beyond the 125-register boundary.

1. Problem Statement

The reported fault is consistent and easy to reproduce:

• The CP 341 is parameterised as a Modbus RTU slave in STEP 7 (HW Config, CP 341 properties, Protocol tab).
• A third-party Modbus master (often an HMI/SCADA package such as iFIX, Citect, WinCC, or a stand-alone Modbus scanner) issues an FC 03 (Read Holding Registers) request for a quantity above the slave's maximum supported block size.
• The CP 341 returns a valid response, but the data field is truncated to the maximum allowed length. The master sees fewer registers than requested and either re-requests, raises an exception code 02 (Illegal Data Address), or logs a timeout.

The user-visible "256" is a tell. It is the value of the Modbus byte count field (1 byte = 0..255) doubled by the 16-bit register width of FC 03, minus the encoding overhead. Solving the symptom requires understanding why that 1-byte field exists and why it cannot be widened.

2. CP 341 Hardware Identification

The CP 341 family is the S7-300 point-to-point (PtP) communication processor. Variants relevant to Modbus RTU on RS-485 or RS-232 are summarised below.

The CP 341 communicates with the S7-CPU over the backplane using the standard S7 communication mechanism; the application interface is the MODB_341 function block for Modbus slave operation. The module requires a hardware dongle (Siemens 6ES7870-1AA01-0YA1 or current equivalent) to enable the Modbus protocol option. Without the dongle the CP falls back to ASCII / 3964(R) only and the Protocol tab will not list Modbus master or slave.

3. Modbus Application Protocol Frame Layout

The Modbus Application Protocol (current published revision V1.1b on modbus.org) defines two Application Data Unit (ADU) layers for serial RTU: the PDU (Protocol Data Unit) inside, and the ADU (Application Data Unit) wrapping the PDU with address and CRC. For FC 03 (Read Holding Registers), both the request and the response have a fixed shape.

3.1 FC 03 request ADU

Total request length: 1 + 1 + 2 + 2 + 2 = 8 bytes.

3.2 FC 03 response ADU

Total response length for N registers: 1 + 1 + 1 + 2N + 2 = 2N + 5 bytes.

4. Root Cause: The 1-Byte Byte Count Field

The ceiling comes from a single field: Byte count. It is defined as 1 byte (8 bits) in the response PDU, giving a numeric range of 0..255. The value of this field must equal 2 * N, where N is the quantity of 16-bit registers being returned.

From the inequality 2N ≤ 255 we get N ≤ 127.5. Modbus tightens this further in the specification: the Quantity of registers field in the request PDU is restricted to 0x0001..0x007D (1..125). The two limits converge on N = 125 as the maximum number of holding registers that any compliant slave may return in a single FC 03 transaction.

The same logic applies to FC 04 (Read Input Registers) and to FC 23 (Read/Write Multiple Registers, read portion). Function codes that carry one byte per coil or one byte per discrete input such as FC 01 (Read Coils) and FC 02 (Read Discrete Inputs) are bounded by 2N + 5 ≤ 255 as well, but their unit is the bit-packed byte, so the cap there is 2000 points per transaction.

5. CP 341 Modbus Slave Driver (MODB_341)

The Modbus slave runtime on the CP 341 is implemented by the MODB_341 function block, documented in the Siemens TIA / STEP 7 manual for the Modbus slave RTU package. Reference: MODB_341 - Modbus slave instruction for CP 341 (S7-300, S7-400).

The block copies data between a CPU-side data block (the "base DB") and the CP 341 internal Modbus image. Function codes 03, 06, 16 (FC 04 is supported on a separate base DB) are mapped to contiguous register ranges of the base DB. Relevant inputs and outputs of MODB_341:

The base DB may hold up to 512 Modbus registers (1024 bytes). That is the CP 341's internal ceiling on the accessible Modbus data window, which is twice the size of a single transaction. The implication is direct: a single FC 03 request cannot read the entire 1024-byte window in one go; the master must issue at least two transactions of 125 registers each, then a third smaller transaction to cover the remaining 262 registers if the window is fully populated.

6. Hardware Configuration: PTP_Param

PTP_Param is the parameterisation tool launched from HW Config when the CP 341 is opened. It writes the protocol frame, baud rate, parity, and Modbus mapping into the CP's project database. The Modbus-relevant tabs are:

• Protocol: select Modbus slave. The drop-down is greyed out if the Modbus dongle is missing.
• Frame: baud rate (1200..19200 typical, up to 115200 on -1CH02), parity (none / even / odd), character delay, and the base DB number for FC 03, FC 06, FC 16 and FC 04.
• FC mapping: enter the start address (0-based) and the corresponding byte offset into the base DB. The CP 341 subtracts the configured start address from the requested Modbus register address to derive a byte offset into the DB.
• Timeouts: response timeout, character timeout, and acknowledgement timeout. For radio-modem links these must be widened from the defaults.

If the base DB is shorter than the address space announced by the master, or if the Modbus address window exceeds 512 registers, the CP 341 returns Modbus exception code 02 (Illegal Data Address). If the FC mapping points to a DB that does not exist, the CP 341 raises a parameterisation error visible in the diagnostic buffer.

7. Engineering the Multi-Block Read Strategy

To read 300 registers beginning at 40001, the master must issue three FC 03 transactions, each smaller than or equal to 125 registers. The split is chosen by the master, not the slave; the CP 341 is transparent within each transaction. A canonical split:

1. Transaction 1: starting address 40001, quantity 100, range 40001..40100.
2. Transaction 2: starting address 40101, quantity 100, range 40101..40200.
3. Transaction 3: starting address 40201, quantity 100, range 40201..40300.

The boundary alignment matters only because the master polls faster when transactions are contiguous and non-overlapping. Each transaction must arrive within the CP 341's inter-character timeout (default 4 character times, set in PTP_Param) to be treated as a single Modbus frame.

7.1 Worked example with byte counts

For a 125-register transaction the response frame grows to 2 * 125 + 5 = 255 bytes, the maximum permitted by the byte count field. Going above 125 cannot be encoded, regardless of CP 341 capability.

8. Sample Project: zXX21_05_PtP_Com_MODSL

Siemens ships a fully wired sample project with the Modbus driver package: zXX21_05_PtP_Com_MODSL. The project name pattern encodes the hardware family and protocol: XX is a placeholder for the STEP 7 version (e.g. zEn21_05_... for STEP 7 V5.x English), PtP indicates the CP 341/CP 441 family, and MODSL identifies the Modbus slave example. The project contains:

• A pre-wired S7-300 station with a CP 341-1CH02 on a free slot.
• A base DB (DB100 by default) holding 512 registers of process image.
• An OB1 call of MODB_341 with the documented parameter mapping.
• A watch table for forcing register values.

Open the project, download the HW Config and the software to the CPU, then use a Modbus master tool (such as Modbus Poll, CAS Modbus Scanner, or the diagnostic panel built into many HMI runtimes) to read the sample window. This validates the driver independently of the end-user application before connecting the real master.

9. Diagnostic Buffer and Error Codes

The CP 341 maintains a non-volatile diagnostic buffer readable from STEP 7 via PLC > Module Information > Diagnostic Buffer. The events of interest for Modbus slave operation are:

The CP 341 also reports a status word at STATUS output of MODB_341. The full list of status codes is in the Modbus driver manual on the Siemens documentation portal; the codes most often encountered on slave-mode commissioning are 0x0001 (job running), 0x0004 (job complete), and a small family of negative values beginning with 0x8xxx for communication-level faults.

10. Verification Procedure

After reconfiguring the master for multi-block reads, validate the data path end-to-end:

1. Force the base DB. In STEP 7 open the base DB used by MODB_341, set distinctive values in registers 0..299 (e.g. W#16#1111, W#16#2222, ...), and download.
2. Run the master poll. From the Modbus master tool, poll 40001..40300 in three blocks of 100. Confirm all 300 register values match the forced pattern.
3. Read the diagnostic buffer. Verify no new diagnostic events have been entered during the polling. Re-read after 5 minutes of continuous polling to catch intermittent faults.
4. Watch the SF LED. A sustained SF (group fault) LED on the CP 341 means the module is in error state and will not respond to Modbus traffic; clear by acknowledging the diagnostic buffer.
5. Cycle power. Power-cycle the S7-300 station and confirm the CP 341 re-establishes slave operation within 5..10 seconds (depending on CP startup and dongle validation).
6. Confirm CPU load. Heavy Modbus polling against the CP 341 can raise the OB1 cycle time; monitor with the cycle-time watch table on the CPU.

11. Hardware-Damage Case: Lightning and Surge

One variant of the symptom is not a protocol issue at all. If the CP 341 is connected to a radio modem whose antenna line lacks adequate surge protection, a nearby lightning strike can damage the RS-485 transceiver inside the CP. The observable behaviour is asymmetric: the CP 341 will receive FC 06 / FC 16 writes correctly but will fail to transmit responses to FC 03 reads, producing exactly the "master can write but not read" pattern often misread as a software bug.

Diagnostic confirmation steps for this hardware case:

• Inspect the CP 341's diagnostic buffer; if the radio link is the only path and the buffer is clean, the failure is downstream of the CP, not in the CP itself.
• Loop-back test: disconnect the field cable, install a short RS-485 jumper between TX+ and RX+, drive a Modbus master against the CP, and confirm reads succeed. If they do, the field wiring or the modem is suspect; if they do not, the CP is suspect.
• Replace the CP 341 with a known-good spare and retest. If the replacement restores both directions, the original CP has a damaged transceiver and must be returned for repair.

12. Field-Proven Notes

• Quantity vs byte count: If the master logs a "byte count too large" error, the symptom is the opposite of the one above: the master is requesting more than 125 registers. Re-aim the master at a sub-range.
• DB length mismatch: A 512-register base DB is the practical ceiling. If the Modbus data model needs more registers, add a second base DB and configure FC 03 mapping to a different DB number; the CP 341 supports multiple mapped ranges.
• Endianness: Modbus RTU is big-endian (Hi byte first). The CP 341 swaps as required; the base DB always stores the Modbus word value in big-endian byte order. STEP 7 word display shows the same value but with a different byte swap, which can confuse the unwary when reading from VAT.
• RS-485 termination: Enable termination and fail-safe bias only at the two physical ends of the bus, never at intermediate nodes. Mis-terminated buses produce intermittent CRC faults that look like software bugs.
• Master polling rate: Polling faster than the CP can serve (typically > 20..30 transactions/second sustained) will queue requests and risk inter-character timeouts. Throttle the master if the diagnostic buffer reports repeated timeouts.

Frequently Asked Questions