CP341 Modbus Master RTU FB7 FB8 Multi-Slave Polling in PCS7 V9.0

1. Overview

The CP 341 communication processor is a serial point-to-point module for SIMATIC S7-300 (and ET 200M in PCS 7) that hosts the licensed Modbus Master RTU driver. The driver is implemented as a loadable firmware on the CP 341 and exposes two standard function blocks on the CPU side: FB 8 "P_SND_RK" for sending Modbus request frames and FB 7 "P_RCV_RK" for receiving response frames. Together they form the deterministic, half-duplex master layer for polling up to 247 Modbus RTU slaves on RS-232 or RS-485.

This reference documents a working PCS 7 V9.0 implementation that polls five Modbus RTU slaves using OB 32 as the cyclic dispatcher, DB 10 as the rotating parameter set, and DB 11 as the rolling receive buffer. It also clarifies how the NDR output of FB 7 behaves when a slave fails to respond, and how to detect that condition without losing the master state machine.

2. Hardware Selection and Wiring

For PCS 7 V9.0 with five slaves on a single bus, the practical hardware choice is the RS-485 variant of the CP 341. RS-485 supports multi-drop, longer cable runs, and proper bus termination that RS-232 cannot provide.

For an RS-485 bus, observe the following physical rules:

1. Terminate both ends of the trunk with 120 Ω resistors between the data lines (P and N). The CP 341 RS-485 variant includes a slide switch on the front connector to enable the internal termination.
2. Never put termination in the middle of the bus; only at the physical extremes.
3. Use twisted-pair cable with shield grounded at one end only (typically the cabinet ground).
4. Set the cable shield to FE on the CP end; do not loop it back to multiple grounds.
5. Limit stubs (drop cables) to less than 30 cm. Daisy-chain from CP → slave 1 → slave 2 → slave 3 → slave 4 → slave 5 → termination.

3. Software Stack and Licensing

The Modbus Master RTU driver is loaded onto the CP 341 once, using the SIMATIC Manager / PCS 7 Engineering "Modbus Master CP341" parameterization tool. The license is bound to the CP's serial number and survives firmware updates as long as the hardware is not replaced.

After loading the driver, the CP 341's online diagnostics ("Diagnostic buffer of the CP") will report "Modbus Master RTU active". Until the driver is loaded, FB 7/FB 8 calls will return STATUS = W#16#818C ("CP not ready").

4. CP 341 Configuration in HW Config

Insert the CP 341 in the S7-300 rack at the slot planned for it (typically slot 4 through 11, depending on the CPU and existing modules). In the object properties, set:

5. Modbus Master Driver Configuration

Open the CP 341's "Protocol" object. The dialog lets you assign a Modbus Master configuration block. This is a DB that the driver parses on power-up to know which slave polling pattern to run automatically. In PCS 7 V9.0, the typical approach is to leave the CP in "Driver-controlled" mode and dispatch from the CPU via FB 7/FB 8 instead, giving the application full control of which slave is queried when.

The application-controlled pattern works as follows:

1. The CPU writes the next Modbus request (slave address, function code, register offset, register count) into a shared parameter DB (here DB 10).
2. The CPU calls FB 8 (P_SND_RK) with the parameter DB reference. The CP transmits the request on the wire.
3. The CPU calls FB 7 (P_RCV_RK) on the same LADDR. When the CP has assembled a complete response, FB 7 returns NDR = TRUE and writes the response into a receive DB (here DB 11) at the offset supplied via DBB_NO.
4. The application interprets the response, advances state, and after a defined inter-frame delay repeats for the next slave.

6. Function Block Architecture (FB 7 / FB 8)

FB 8 (P_SND_RK) and FB 7 (P_RCV_RK) live in the standard SIMATIC library under "Communication Blocks". They are instance-free (use the standard instance DBs that the library assigns automatically) and are called from OB 1 in this implementation:

1. FB 8 — P_SND_RK: Sends a Modbus request buffer to the CP. Triggers the CP to transmit the request on the bus.
2. FB 7 — P_RCV_RK: Reads the response buffer assembled by the CP. Returns NDR when a new response has been received since the last call.

Both blocks share the same LADDR input (the I/O base address of the CP 341 in HW Config). Calling FB 7/FB 8 with a different LADDR than the CP's logical base address will silently fail with STATUS = W#16#8183 or W#16#818C.

7. FB 8 P_SND_RK Parameterization

Wire FB 8 as follows. Inputs marked constant should be declared as local constants in the calling FC 10 to keep OB 1 clean.

The output DONE (here M10.1) signals successful transmission. A negative edge on DONE is the natural moment to clear the SF trigger.

8. FB 7 P_RCV_RK Parameterization

FB 7 reads the response that the CP 341 has buffered since the last successful send.

The two outputs you monitor are:

• NDR (New Data Ready) — pulses TRUE for one cycle when a complete response has been fetched. This is the application-level "slave answered" signal.
• ERROR + STATUS — surfaces Modbus errors, frame errors, timeouts, and CP errors.

9. OB 32 Cyclic Polling Implementation

OB 32 in PCS 7 runs at a configurable base time. The recommended base for Modbus RTU at 9600 baud with 5 slaves is 1 s; the implementation in question uses a 5 s phase to be conservative on slow slaves. The OB 32 logic is the rotating index over the five slaves.

Pseudo-code for OB 32 (SCL-style for readability, equivalent ladder exists):

// State variable in a global DB
iSlaveIdx := (iSlaveIdx + 1) MOD 5;

// Populate DB 10 from a static array of 5 slave descriptors
DB10.SlaveAddr    := SlaveDesc[iSlaveIdx].Addr;     // e.g. 1..5
DB10.FunctionCode := SlaveDesc[iSlaveIdx].FC;       // e.g. 03 = Read Holding
DB10.StartAddr    := SWAP_WORD(SlaveDesc[iSlaveIdx].Reg); // Modbus is big-endian
DB10.Quantity     := SWAP_WORD(SlaveDesc[iSlaveIdx].Qty);
DB10.ByteCount    := SlaveDesc[iSlaveIdx].Qty * 2;
DB10.RequestLen   := 8;
DB10.ReceiveOffset := iSlaveIdx * 64;               // 64 bytes per slot in DB 11

// Arm the send trigger for OB 1
M10.0 := TRUE;

// Latch the OB 32 "ready" flag so OB 1 knows DB 10 has been refreshed
M11.0 := TRUE;

OB 1 calls FC 10, which in turn calls FB 8 and FB 7 in the sequence:

// FC 10 (called from OB 1)
IF M11.0 THEN                       // OB 32 just refreshed DB 10
  FB8.DB_NO  := 10;
  FB8.DBB_NO := 0;
  FB8.LEN    := DB10.RequestLen;
  FB8.SF     := M10.0;             // rising edge starts send
  FB8.LADDR  := 256;

  IF M10.1 THEN                    // send done (DONE flag)
    M10.0 := FALSE;                // clear trigger (negative-edge clear in OB 1)
    FB7.EN_R  := TRUE;
    FB7.DB_NO := 11;
    FB7.DBB_NO := DB10.ReceiveOffset;
    FB7.LEN    := 256;             // receive buffer max
  END_IF;

  IF FB7.NDR THEN                  // response received
    // parse DB11 starting at DB10.ReceiveOffset
    M11.0 := FALSE;                // clear "OB 32 ready" flag
  END_IF;
END_IF;

10. Multi-Slave Data Structure

The recommended layout is a single DB 10 holding the active request (8 bytes + 1 length byte) and DB 11 holding the rolling response buffer with one fixed slot per slave. This keeps OB 32 trivial and makes commissioning differences between slaves easy to diagnose.

10.1 DB 10 — Active Request

10.2 DB 11 — Rolling Response Buffer

Each slave occupies a 64-byte slot. Five slaves = 320 bytes. Reserve at least 8 bytes of header inside each slot for the parsed fields (slave address echo, FC echo, byte count, CRC status, timestamp).

11. Slave Failure Detection via NDR

There are three failure modes to handle explicitly. The NDR signal alone is insufficient — it must be paired with a watchdog and an explicit "expecting response" flag.

11.1 Slave does not respond (timeout)

Symptom: SF rises → DONE rises (request transmitted) → NDR never rises → STATUS stays at W#16#7000.

Detection: Start a TON timer (e.g., 500 ms above the CP's configured reply monitoring). If the timer elapses without NDR, set a "slave N comm fault" flag.

11.2 Slave responds with Modbus exception

Symptom: NDR rises, but the FC byte in the response has bit 7 set (e.g., 0x83 instead of 0x03). The exception code in the next byte indicates ILLEGAL FUNCTION (01), ILLEGAL DATA ADDRESS (02), ILLEGAL DATA VALUE (03), etc.

Detection: After NDR, inspect the FC byte. If FC >= 0x80, branch into the exception handler and surface the exception code in a global alarm DB.

11.3 Slave responds with corrupt frame (CRC error)

Symptom: CP rejects the frame internally; FB 7 raises STATUS = W#16#8187 (frame error) instead of NDR.

Detection: Treat STATUS > W#16#8180 as a transport-level fault, do not advance the state machine, and log the slave ID + STATUS value.

Suggested watchdog implementation in FC 10:

// Run only while a response is expected
IF M10.1 AND NOT M10.6 THEN        // sent but not yet received
  iWatchdog := iWatchdog + 1;
  IF iWatchdog > 50 THEN           // 50 × 100 ms = 5 s
    bSlaveFault[DB10.SlaveAddr] := TRUE;
    M11.0 := FALSE;                // advance to next slave anyway
    M10.0 := TRUE;                 // arm next poll cycle
    iWatchdog := 0;
  END_IF;
ELSE
  iWatchdog := 0;
END_IF;

12. Modbus Exception Code Mapping

When a Modbus slave answers with an exception, the response FC byte has the high bit set (0x80 OR'd with the original FC) and a one-byte exception code follows. The application must decode this and surface it to the operator.

13. Status and Error Code Reference

The following STATUS codes are surfaced on FB 7 and FB 8 when the Modbus Master RTU driver is loaded. They are returned in W#16# notation and should be mapped 1:1 into an operator-visible diagnostic block.

14. OB 32 / OB 1 Timing

The following diagram illustrates the interlock between OB 32 (slow dispatcher) and OB 1 (fast driver caller). The 5 s phase is the OB 32 base time; the actual Modbus cycle is on the order of 50–200 ms at 9600 baud.

15. Troubleshooting Matrix

16. Verification and Commissioning Procedure

1. Driver load verification: In HW Config, open the CP 341 → "Operating Mode" → confirm "Modbus Master RTU driver loaded". Without this, every send returns W#16#818C.
2. Loopback test: Connect the CP 341 RS-485 ports together (T/R+ ↔ T/R- on both ends) with a short jumper. Run the master against slave address 1 with FC 03 reading 1 register from offset 0. The CP will echo its own request; the CRC will fail and STATUS = W#16#8187. This confirms wiring and baud, isolating it from the slaves.
3. Single-slave test: Connect one known-good slave (e.g., a Modbus simulator or a Schneider electric meter). Confirm NDR pulses and STATUS = W#16#0000 on the first request.
4. Multi-slave sequential test: With OB 32 stepping through five slaves at 5 s, observe the slave LED activity on each physical device. Each slave should see one request per cycle of five phases.
5. Negative test: Power down slave 3. Confirm that the master continues polling slaves 1, 2, 4, 5 and that the slave 3 fault flag sets within the configured watchdog window.
6. Watchdog boundary test: Reduce the slave reply time below the CP's configured reply monitoring to force STATUS = W#16#8185. Verify the application flags the correct slave and recovers automatically when the slave reappears.
7. Long-run stability: Run for 24 h, log all STATUS values to a circular buffer, and verify zero unexpected codes.
8. CPU scan budget: Profile OB 1 with FB 7 + FB 8 active. The blocks add roughly 1–3 ms per call to the scan. At 5 s OB 32 phase this is negligible; at 100 ms phase it becomes visible and should be re-measured.
9. WinCC faceplate check: If the Modbus data drives a WinCC faceplate, verify the scaling block (engineering units → raw 0–27648 or floating point) is correct on each faceplate instance, and that the value is being read from the right DB 11 slot.

17. Related Siemens Documentation

For reference, the SIMATIC Modbus documentation set shipped with the driver and the TIA Portal documentation portal cover the same FBs from a different angle. The MODB_341 instruction, for example, is the modern equivalent used when the CP is configured via TIA Portal V20 instead of STEP 7 V5 / PCS 7:

• MODB_341: Modbus Slave instruction for CP 341 (S7-300, S7-400) — TIA Portal V20 documentation

The PCS 7 V9.0 / STEP 7 V5.6 path uses FB 7 / FB 8 (P_SND_RK / P_RCV_RK) and is documented in the Modbus Master CP 341 manual that ships on the driver CD (Siemens/Documentation shortcut after install).

18. Frequently Asked Questions