CP341 Modbus RTU in TIA Portal: Drivers, FBs, and Licensing

Overview: CP 341 as a Modbus RTU Node

The SIMATIC CP 341 (6ES7 341-1xx02-0AE0 hardware family) is a serial point-to-point communication processor for the S7-300 and S7-400 PLC families. It is most commonly deployed in retrofit and brownfield environments where RS-485 or RS-232C infrastructure already exists and Modbus RTU is the de-facto fieldbus. Unlike the S7-1200/1500 onboard serial ports, the CP 341 does not execute Modbus in the base firmware. The Modbus RTU frame engine, the Modbus function code interpreter, the CRC16 verifier, and the messaging FBs are delivered as a loadable driver package that must be installed in TIA Portal (or STEP 7 V5.5) and licensed on the physical CP 341 hardware.

This article is the practical reference for configuring the CP 341 as a Modbus RTU master or slave inside TIA Portal V13, identifying the correct FBs (MOD_MASTER, MODB_341), determining the licensing requirement, and resolving the most common commissioning faults. It is written for engineers who have already attempted to use the S7-1200/1500 Modbus blocks (MB_COMM_LOAD, MB_MASTER, MB_SLAVE) and discovered — correctly — that they are not compatible with the CP 341.

Hardware Identification and Interface Submodules

The CP 341 is sold as a base unit plus a pluggable interface submodule. The base unit and the interface module must be matched against the physical wiring. The following table covers the most common configurations in service as of TIA Portal V13 (2014) and still supported in V20 documentation.

The 6AG1 (SIPLUS) and 6ES7 341-1NF00-0AE0 (RS-485 with PG/OP socket) variants exist for harsh environments and should be substituted into the same driver/license framework without code change. TIA Portal V13 Service Pack 1 and later support the -1xH02 hardware revision. Older -1xH01 modules (pre-2007) require the legacy Modbus driver version and will not appear in the TIA Portal device catalog on a clean install.

For Modbus RTU the RS-485 variants are by far the most common. Confirm 2-wire vs 4-wire termination, fail-safe bias, and the line termination resistor (typically 120 Ω at each bus end) before commissioning. The CP 341 does not supply line bias internally on the RS-485 models; bias must be applied externally or via a terminating connector with built-in failsafe.

Why Modbus_Comm_Load and Modbus_Master Cannot Be Used

The S7-1200/1500 Modbus library is bound to the CPU's serial port or the dedicated CM PtP modules (CM 1241, CM PtP for S7-1500). The relevant instruction names are MB_COMM_LOAD, MB_MASTER, MB_SLAVE in TIA Portal, or the older MODBUS_Comm_Load / Modbus_Master / Modbus_Slave variants in the S7-1200 program editor. These FBs call the CPU's integrated serial driver directly and carry an MB_DB background data block whose MODE, DATA_ADDR, and DATA_LEN parameter signatures are specific to the S7-1200/1500 data type semantics.

The CP 341 is an external module and exposes its own application interface through the standard P_SND_RK / P_RCV_RK primitives (FBs from the Standard Library > Communication > Point-to-Point). The Modbus RTU state machine for the CP 341 is implemented on top of these primitives in a separately shipped driver DLL and matching FBs (MOD_MASTER and MODB_341). The MB_* instructions do not link to the CP 341 P_SND_RK layer and will not compile against the CP 341 instance DBs.

Loadable Driver Packages

Two Modbus RTU loadable drivers are supplied by Siemens for the CP 341 family. They are distributed on the "CP PtP Param / Modbus Master / Modbus Slave" CD and are also available through the Siemens SiePortal / Industry Online Support entry MODB_341 — Modbus slave instruction for CP 341 (S7-300, S7-400).

The driver package contains the parameterization tool (PTP Param), the Modbus master and slave wizards, the compiled .APO / .PAR files for the CP 341, and the FBs that are placed into the project library. After installation, restart TIA Portal so that the new device versions and instruction folders are recognized. In TIA Portal V13 the CP 341 Modbus slave instruction is documented in the function manual as MODB_341; the master is MOD_MASTER. In STEP 7 V5.5 the same functions exist as FB 81 / FB 82 (or FB 80 depending on the version of the driver CD).

Licensing the Modbus Driver

Yes, a license is required. The Modbus master and Modbus slave drivers are licensed, not free, and the license is bound to the serial number of the physical CP 341 module. Licensing is per CP 341, not per project, not per S7 CPU, and not per TIA Portal installation.

1. Install the Modbus driver from the CD. The installation copies the parameterization data and the FBs to the engineering system and registers them with the Automation License Manager.
2. Open the Automation License Manager. Locate the slot for "CP 341 Modbus Master" and/or "CP 341 Modbus Slave".
3. Transfer the license to the USB license stick or to the PG/PC that is online with the target CP 341.
4. In TIA Portal, go online to the target CP 341. Right-click the CP 341 > "License > Transfer License to Module". This writes the right-to-use into the CP 341's CF/SD or internal non-volatile memory (depending on the -H02 hardware revision).
5. Power cycle the CP 341 once after license transfer. The license is then persistent across power-downs and CPU restarts.

If the license is missing, the CP 341 will accept the configuration but every Modbus transaction returns STATUS = W#16#0801 (No license found). The CP 341 will not enter the run state for Modbus application tasks without a valid license. A trial / demo license of 14 days is available from the Automation License Manager for testing; it is converted to a full license by purchasing the appropriate order number and re-activating.

Configuring the CP 341 in TIA Portal V13

Prerequisites

• TIA Portal V13 (Service Pack 1 minimum recommended) installed with the Modbus driver CD for CP 341.
• S7-300 or S7-400 project created with the matching CPU firmware version.
• CP 341 inserted into the rack (slots 4-11 on S7-300) and a valid interface submodule selected in the device configuration.
• Automation License Manager with the correct license present on the PG/PC.

Step 1 — Device Configuration

1. Open the project and the device view of the S7-300 / S7-400 station.
2. Drag the CP 341 from the catalog into the rack. Use the order number that matches the physical hardware you have on the shelf (RS-485 variant for typical Modbus RTU bus).
3. Open the CP 341 properties. In the "Interface" tab select the correct submodule and set the protocol to "Modbus Master" or "Modbus Slave".
4. Set the physical parameters: baud rate (1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200 are supported — verify with the slave device), parity (None / Even / Odd), data bits (8 for Modbus RTU), stop bits (1 or 2), and the inter-character / inter-frame timeouts.
5. In the "Modbus" tab configure the addressing model: for a master, set the polling table, the response timeout (typical 1000 ms), and the inter-request pause. For a slave, set the slave address (1-247) and the data block used to expose Modbus registers.

Step 2 — Hardware Identifier (HWID)

Every CP 341 is addressed in the user program by its hardware identifier (HWID), assigned automatically by TIA Portal. Note the HWID — it is used as the LADDR input on the MOD_MASTER / MODB_341 call and is the same identifier that the diagnostic FB PNI_DIAG uses. The default value in a single-CP 341 project is usually 264 (decimal), but do not assume; check the CP 341 properties > "System constants".

Step 3 — Insert the Modbus FB

1. In the project library, expand the "CP 341 Modbus Master" or "CP 341 Modbus Slave" folder.
2. Drag the MOD_MASTER or MODB_341 FB into OB1 (or a dedicated OB for Modbus handling such as OB35, the cyclic interrupt OB).
3. TIA Portal will ask for an instance DB; accept the default name. The instance DB is created automatically and must remain a singleton — never reuse the same instance DB across multiple calls.
4. Open the instance DB and verify that the static section matches the CP 341's parameterization. The Modbus driver writes the protocol configuration into the instance DB at startup.

Programming the Master (CP 341 as Modbus Master)

The MOD_MASTER FB has the following parameter signature. Some parameters are renamed across TIA Portal V13 service packs, but the contract is the same.

Sample SCL Code — Master Reading 16 Holding Registers from Slave 1

FUNCTION_BLOCK "ModbusMasterPoll"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1

VAR
    TriggerCycle : BOOL;       // one-second tick from OB35
    Busy         : BOOL;
    ErrorLatch   : BOOL;
    StatusWord   : WORD;
END_VAR

BEGIN
    // Edge-triggered call
    IF "IO_Cycle_1Hz" AND NOT Busy THEN
        "ModbusMaster_DB".REQ := TRUE;
    ELSE
        "ModbusMaster_DB".REQ := FALSE;
    END_IF;

    "ModbusMaster_DB"(REQ       := "ModbusMaster_DB".REQ,
                      CONT      := TRUE,
                      LADDR     := 264,                  // CP 341 HWID
                      UNIT      := B#16#01,
                      MODE      := B#16#00,              // FC 03 holding register read
                      DATA_ADDR := DW#16#0000,           // Modbus address 40001
                      DATA_LEN  := 16,                   // 16 registers
                      DATA_PTR  := P#DB100.DBX0.0 BYTE 32,
                      DONE      => Busy,
                      ERROR     => ErrorLatch,
                      STATUS    => StatusWord);
END_FUNCTION_BLOCK

This is the most common pattern: a slow cyclic interrupt (e.g. OB35 at 1000 ms) sets REQ for one cycle, the FB executes the request, and the next OB35 call does not raise REQ again until Busy drops. The Modbus master FB then orchestrates the P_SND_RK / P_RCV_RK primitives internally and the user code does not call them directly.

Programming the Slave (CP 341 as Modbus Slave)

The MODB_341 FB is the slave counterpart. It has a smaller signature because the slave does not poll — it only receives requests and dispatches them to a configured data block.

Sample SCL Code — Slave exposing 100 Holding Registers

BEGIN
    // One-shot start, then continuous operation
    IF "FirstPass" THEN
        "ModbusSlave_DB".REQ := TRUE;
        "FirstPass" := FALSE;
    ELSE
        "ModbusSlave_DB".REQ := FALSE;
    END_IF;

    "ModbusSlave_DB"(REQ      := "ModbusSlave_DB".REQ,
                     CONT     := TRUE,
                     LADDR    := 264,
                     DATA_PTR := P#DB200.DBX0.0 BYTE 200,
                     DONE     => "ModbusDone",
                     ERROR    => "ModbusError",
                     STATUS   => "ModbusStatus");
END_FUNCTION_BLOCK

The 200-byte area in DB200 is mapped to the Modbus address space as 100 16-bit holding registers (Modbus address 40001-40100). Coils, discrete inputs, and input registers can be exposed in additional non-overlapping regions of the same data block by configuring the slave mapping in the CP 341 properties.

Status and Error Code Reference

Both MOD_MASTER and MODB_341 return a 16-bit STATUS word. The most common values engineers will see in commissioning are listed below. These are documented in the CP 341 Modbus master/slave function manuals in the TIA Portal online help system.

Diagnostics and Online Behavior

Three online checks belong in every CP 341 Modbus commissioning:

1. CP 341 LEDs: Green "DC24V" indicates power, green "TXD" flashes on transmit, green "RXD" on receive. A steady red "SF" (System Fault) indicates either a configuration download error or a missing license. A flashing red "SF" indicates a runtime fault (timeout, CRC). A steady red "BF" (Bus Fault) on the front of the CP 341 indicates the line interface is not connected or shorted.
2. TIA Portal online > CP 341 > Diagnostics: Right-click the CP 341 in the device view, go online, and open "Diagnostics". The "Modbus status" tab shows the current MODE, the last STATUS word, the number of valid transactions, the number of errored transactions, and the inter-character timing histogram. This is the single best tool for confirming that messages are physically leaving the RS-485 driver.
3. PNI_DIAG (FB 11): Place the standard PNI_DIAG FB in OB82 (diagnostic interrupt) or call it cyclically in OB1. It surfaces hardware-level diagnostics (module removed, submodule mismatch, channel fault). On a CP 341, the channel fault is the most useful indicator that the RS-485 interface submodule is not seated properly.

Wiring Notes for RS-485 Modbus RTU

Modbus RTU over RS-485 is a 2-wire, half-duplex, multi-drop bus. The CP 341's RS-485 interface module exposes a 15-pin SUB-D connector. Pin assignments and practical wiring rules:

• Pin 11 = T(R)DA / T(R)DB (the differential A/B pair). On the CP 341 these are the same pair in both directions — half duplex — so a single twisted pair is sufficient.
• Pin 6 + 13 = +5 V supply for fail-safe bias resistors. Many termination connectors (e.g. Phoenix Contact PSI-MODEM-CONF) take 5 V from this pin and apply failsafe bias; do not connect to external supplies.
• Shield = pin 5 / connector housing. Bond the shield to ground at one end only to avoid ground loops; Siemens recommends bonding at the cabinet entry, not at the device.
• 120 Ω termination at both bus ends, not in the middle. Most slaves and the CP 341 do not include internal termination — external resistor across A/B at each end is required.
• Maximum cable length: 1200 m at 9600 baud, less at higher baud rates. For 115200 keep total cable length well below 100 m.
• Maximum nodes: 32 standard RS-485 unit loads. Modbus RTU slaves often present 1/8 or 1/32 unit loads, allowing 256 nodes in theory, but the CP 341 can typically drive up to 32 slaves cleanly at 9600 baud.

Verification: How to Confirm the Link Is Live

1. Watch the CP 341 RXD LED while the master is running. It must flash on every Modbus response. If it never flashes, the slave is not transmitting — check the slave's serial port enable and the A/B polarity.
2. In TIA Portal online monitoring, force REQ := TRUE for one cycle and watch the STATUS output. A clean loop returns STATUS = 0x0001 then 0x0000 with DONE = TRUE.
3. Use a Modbus master simulator on a PC (e.g. "Modbus Poll" or "QModMaster") on a virtual COM port via a USB-RS485 converter, and read the same registers the CP 341 is configured to read. If the simulator sees traffic but the CP 341 does not, the issue is on the CP 341 side. If the simulator does not see traffic either, the issue is on the physical bus.
4. Run a 24-hour soak test in OB35 with the STATUS word latched into a watch table. Verify the error counter does not increment. A healthy bus shows 0x0000 in STATUS and DONE toggling on every cycle.

Troubleshooting Matrix

Migration Notes: From STEP 7 V5.5 to TIA Portal V13+

Projects originally written in STEP 7 V5.5 with FB 80 / FB 81 / FB 82 (legacy Modbus driver) can be migrated to TIA Portal V13, but the FBs must be replaced. The V5.5 FBs are not compatible at the interface level with the TIA Portal V13 Modbus driver, and the instance DB structure is different. The migration path is:

1. Migrate the S7-300 / S7-400 station to TIA Portal. The CP 341 device version migrates automatically.
2. Install the TIA Portal Modbus driver CD for CP 341.
3. Delete the old FB 80 / FB 81 / FB 82 calls and the corresponding instance DBs.
4. Drag the new MOD_MASTER or MODB_341 FB from the project library.
5. Rewire the parameter list to match the new signature (in particular, the LADDR / HWID may change because TIA Portal assigns hardware identifiers differently from STEP 7 V5).
6. Re-test on hardware with a Modbus simulator on a free COM port.

FAQ