CP 341 Receive Error FxC8:0836 / FxC8:0837 Modbus Modem

Overview

The Siemens CP 341 (6ES7341-1AH02-0AE0 / 6ES7341-1BH02-0AE0) is a point-to-point communication module for the SIMATIC S7-300 station that implements RS-232C, TTY (20 mA current loop), and RS-422/485 serial links. When the CP is loaded with the Modbus Slave protocol driver (loadable firmware order number 6ES7341-1xH02-0AE0 with Modbus master or 6ES7341-1xH01-0AE0 family for the slave), it exchanges Modbus RTU frames with a remote master. In the configuration described in the field case, a CPU 315-2DP (6ES7315-2AG10-0AB0) hosts the CP 341, the link is wired to a U.S. Robotics 56K fax modem on the plant side, and a remote PC dials the same modem over the PSTN to poll the slave.

Direct cable connection between the CP 341 and the laptop COM port works. The PSTN/modem path fails and the CP 341 diagnostic buffer logs:

• IF 1: Receive Error — Event ID FxC8:0836
• IF 1: Receive Error — Event ID FxC8:0837

Simultaneously the FB 80 P_RCV_RK status word shows CP_START_OK = 1 and ERROR = 0 / ERROR_INFO = 0, which indicates the CP itself is healthy, parameterized, and the link to the CPU is up. The error therefore lies below the Modbus/PBK layer — in the physical/RS-232 receive path of interface IF 1.

Problem Summary

Understanding Diagnostic Event FxC8:0836 and FxC8:0837

CP 341 diagnostic events use a two-part identifier: the upper byte FxC8 identifies the event class Interface disturbance / receive error in the CP 341 firmware, and the lower word is the specific event subtype. Both 0836 and 0837 are interrupted / aborted receive frame errors detected by the CP's UART (16C950-compatible) on IF 1. The distinction between 0836 and 0837 maps to the UART status flags captured at the moment the error was latched.

Both events are interface-level events and are written to the CP's diagnostic buffer regardless of the Modbus driver running on the CP. That is why the FB 80 application interface stays clean: the CP is functional, the Modbus state machine simply never received a complete, valid frame.

Root Cause Analysis

The fact that direct serial works and the PSTN path does not — while the CP's own error counters are clean — points to the modem pair and the RS-232C signal discipline between the CP 341 and the U.S. Robotics modem. The five root causes observed in the field for the FxC8:0836 / FxC8:0837 pattern on a CP 341 in Modbus Slave mode are:

1. Modem-to-modem speed / framing mismatch. The remote PC dials at 19200, 38400 or 57600, the modem negotiates a different V.90/V.34 rate, and the serial side of the local modem re-clocks data back to the CP at an effective rate (or with escape sequences / flow-control bytes) the CP 341 UART cannot reconcile with the 9600-8N1 Modbus RTU contract.
2. DTR / DCD handshaking disabled. U.S. Robotics modems default to &D0 (ignore DTR) and may echo the carrier-detect transition. The CP 341 expects either no handshake or a fixed RTS always ON setting. If the modem drops characters during carrier transitions, the CP's 3.5-character inter-frame timer expires and aborts the partial frame, generating 0836.
3. Half-duplex echo / DTE echo on AT-command channel. The remote PC issues AT setup strings (e.g. ATE0 for echo-off) after the connection. If ATE1 remains active, every slave response is echoed back on the receive line, corrupting the next Modbus request and tripping 0837 (UART break / abort).
4. Modbus ASCII / Modbus RTU mode mismatch. The remote PC or the modem's PPP/V.42bis layer transparently expands certain byte values (0x11, 0x13, 0x1A). Modbus RTU requires the raw 8-bit byte stream; any byte expansion or character translation produces 0836.
5. RS-232C signal crossover / missing hardware flow control. The CP 341 is a DTE; the U.S. Robotics modem is also a DTE on its DB-25 (or DB-9) side. A null-modem adapter is required so that TXD-RXD, RTS-CTS, DTR-DSR are crossed. A straight-through cable (used in the direct test) works for the PC, but the modem pinout and the CP 341 pinout differ.

CP 341 IF 1 Pinout and Wiring

Step-by-Step Diagnostic Procedure

Follow the sequence below in order. Each step verifies one layer; do not skip ahead.

Step 1 — Confirm FB 80 / FB 81 Status

1. In STEP 7, open the OB 1 / cyclic OB that calls FB 80 P_RCV_RK and FB 81 P_SND_RK.
2. Monitor the output parameters:
   • CP_START_OK must be TRUE after startup.
   • ERROR must be FALSE.
   • ERROR_INFO must be 0.
3. If any of these is non-zero, the CP has a startup/parameterization error. Re-run HW Config → CP 341 → Properties → Parameter Assignment and re-download the protocol driver.

Result in this case: FB 80 reports healthy. Proceed to step 2.

Step 2 — Open the CP 341 Diagnostic Buffer

1. Right-click the CP 341 in SIMATIC Manager → Accessible Nodes.
2. Select “Module Information” → “Diagnostic Buffer”.
3. Locate the entries with ID FxC8:0836 and FxC8:0837.
4. For each entry, double-click to open the STEP 7 online help — the text gives the exact UART condition (framing error, parity error, break, overrun).

Step 3 — Verify the Modem Pair Configuration

1. Connect a PC with HyperTerminal / PuTTY (9600, 8N1) directly to the local U.S. Robotics modem's serial port.
2. Issue the following AT command set and write the profile (&W0):

   AT
   ATE0V1Q0&C1&D2&S0S0=1
   AT&K0
   AT+MS=V90,0,56000,56000
   ATS2=255
   AT&W0

3. Repeat the same AT profile on the remote PC's modem so both ends match.

Step 4 — Verify the Cable and Pinout

1. With the modem powered off, measure continuity on the null-modem cable:

2. Loop the test: connect the laptop to the CP 341 through the same null-modem cable and the same modem pair instead of direct. Confirm that direct cable worked only because the cable was straight-through between two DTE-like ports. Switch to the crossover/null-modem cable for the CP 341.

Step 5 — Verify Modbus Slave Parameter Assignment

1. Open HW Config → CP 341 → Properties → Parameter Assignment.
2. Confirm the protocol layer is Modbus Slave (RTU), 9600 bit/s, 8 data bits, no parity, 1 stop bit.
3. Set “RTS line” to “RTS always ON” (unless you wire hardware flow control; for modem use, “RTS always ON” is the recommended setting in the CP 341 manual, Point-to-Point Communication, Installation and Parameter Assignment).
4. Disable XON/XOFF in the protocol layer; only RTS/CTS is supported by the CP 341 RS-232C IF 1.

Step 6 — Check FB 80 Error and Status Registers

The FB 80 / FB 81 error structure:

CALL FB 80, DB 80
  EN_R        := TRUE
  R_KBUS_ID   := 0           // CP index, 0 = first CP
  R_TLG       := DB 81       // receive buffer DB
  LADDR       := 256         // I/O base address from HW Config
  R_REC       := P#DB 82.DBX0.0 BYTE 200
  ...
  ERROR       := MW 100
  ERROR_INFO  := MW 102
  STATUS      := MW 104

If any of CP_FRAMING_OK, CP_PARITY_OK, or CP_OVERRUN_OK is 0, a corresponding FxC8 event is being raised. Reset the latches with a CP_START (FB 7 “CP_START”) sequence and re-dial.

Recommended Solution

1. Replace the cable between CP 341 and the local U.S. Robotics modem with a null-modem (crossover) cable wired as shown in the table above. A straight-through cable worked against the laptop by accident because both were DTE; the modem is also a DTE and the CP 341 needs a cross.
2. Program both modems with the AT profile from Step 3 (ATE0 &C1 &D2 &K0 S0=1 S2=255 &W0) and store it in profile 0.
3. Set CP 341 IF 1 to “RTS always ON” in the protocol parameter assignment. The CP 341 will not toggle RTS, which is what the modem needs once the carrier is up.
4. Confirm the remote master issues raw Modbus RTU with no ASCII translation, no PPP, no Telnet, and no V.42bis. Use Wireshark on the remote PC with a serial capture adapter to verify the bytes on the line match Modbus RTU exactly (no 0x11/0x13 byte substitution).
5. Re-test the link. Once the new cable is in place and both modems are reprogrammed, dial in, and the FxC8:0836 / FxC8:0837 events should stop appearing. The FB 80 STATUS word will report CP_FRAMING_OK = 1, CP_PARITY_OK = 1, and CP_OVERRUN_OK = 1.

Verification

Advanced: Driving the CP 341 with the Modbus Master Driver Instead

If the application allows, switch the CP 341 to the Modbus Master protocol driver (loadable order number 6ES7341-1xH02-0AE0 + Modbus master option) and poll the remote slave yourself. This avoids third-party Master PC software that may be transparently corrupting frames. The CP 341 supports the Modbus master functions 01, 02, 03, 04, 05, 06, 07, 08, 11, 12, 15, 16 via the FB 80/81 P_RCV/P_SND_RK and the Modbus FB set.

Diagnostics via STATUS Output of the Function Blocks

The CP 341 manual (s7300_cp_341_manual_en_en-US.pdf) defines three diagnostic paths:

1. STATUS output of FB 80 / FB 81 — bit-level status (CP_START_OK, CP_FRAMING_OK, CP_PARITY_OK, CP_OVERRUN_OK).
2. Diagnostic buffer of the CP 341 — event-log view, including FxC8 subtypes.
3. Diagnostic alarm via OB 82 — if “Enable Diagnostic Interrupt” is set in HW Config, OB 82 is entered on every FxC8 event and provides the event ID at OB82_MDL_DEFECT / OB82_EVENT_CLASS.

For this case, the most efficient path is the FB 80 STATUS + diagnostic buffer combination, which together pinpoint whether the FxC8 is a framing, parity, or overrun error.

Reference: CP 341 Diagnostic Event Class FxC8

Related Tools and Documentation

• CP 341 Point-to-Point Communication — Installation and Parameter Assignment (PDF) — definitive manual for protocol parameterization, FB 80 / FB 81 error codes, and cable diagrams.
• CP 341 in TIA Portal (TIA Cloud documentation) — Modbus master and slave configuration under TIA Portal V21.
• Siemens Industry Online Support — searchable ID for FxC8:0836 and FxC8:0837, plus the latest STEP 7 / TIA Portal service packs.

FAQ