CP341 Modbus Slave: Master Request Monitoring with FB80

Overview

The Siemens CP 341 communication processor is a serial interface module for the S7-300 and S7-400 PLC families that implements RS-232C, RS-422, and RS-485 point-to-point links. When loaded with the Modbus slave or Modbus master loadable driver, the CP 341 acts as a Modbus RTU node under the control of STEP 7 function blocks. This article focuses on the slave role: how to detect whether a Modbus master is actually polling the station, how to interpret FB 80 (MODB_341) status outputs, why the NDR (New Data Received) flag may stay permanently FALSE even though traffic is flowing, and how to implement a robust master-life watchdog.

The reference platform described throughout is a CPU 315 with one CP 341 (RS-485 half-duplex), STEP 7 V5.5, MODB_341 driver, and FB 80 / DB 80 (or equivalent instance DB) for Modbus slave operation. The same principles apply to the CP 341-1 variants and to CP 441-2 with the appropriate driver load.

CP 341 Hardware and Modbus Slave Topology

The CP 341 occupies one slot in the S7-300 rack and presents itself to the CPU as a logical device that is addressed through I/O access (PII/PIQ area). Communication is controlled by a loadable driver stored on the CP 341 itself; the driver is selected in HW Config > CP 341 properties > Parameter > Protocol. For Modbus RTU, the driver Modbus slave (RTU) must be loaded into the module via the CP 341 parameter assignment dialog (right-click CP 341 → Load driver to target system).

The MODB_341 instruction, described in the official Siemens documentation at MODB_341 - Modbus slave instruction for CP 341 (S7-300/S7-400), encapsulates the older FB 80 / FB 81 / UDT 80 pair into a single reusable block for STEP 7 V5 and TIA Portal. The driver-level manual at CP 341 / CP 441-2 Modbus slave (RTU) manual remains the definitive reference for status codes and parameter structures.

FB 80 (MODB_341) Function Block Architecture

FB 80 is the slave-side Modbus handler. Each FB 80 instance owns an instance DB that contains a parameter block describing the Modbus mapping (coils, holding registers, input registers, etc.), the receive buffer descriptor, and the CP 341 channel handle. The block calls the lower-level P_SND_RK (send) and P_RCV_RK (receive) point-to-point primitives internally. The application programmer normally never calls P_RCV_RK directly.

The internal flow of FB 80 is, simplified:

1. On START rising edge, send CP_START command to CP 341 via P_SND_RK and wait for completion. Set CP_START_OK or CP_START_ERROR.
2. Issue a CP_RCV command via P_RCV_RK so the CP waits for the next valid Modbus frame from the master.
3. When a frame arrives, the CP executes the Modbus function code, prepares a response, and returns the receive event to FB 80. FB 80 copies the user-relevant data into the DATA buffer and pulses NDR for one OB1 cycle.
4. If REQ is set, FB 80 sends the prepared response via P_SND_RK and pulses DONE on completion.

MODB_341 Instruction Parameters and Instance Data

When using the higher-level MODB_341 instruction, the same logic applies but the parameter block is generated automatically from the Modbus configuration wizard in STEP 7. The instruction provides additional symbolic status words:

Always verify the exact offsets by opening the instance DB in STEP 7 — the layout depends on the MODB_341 version shipped with your STEP 7 installation (V5.5 SP2 or later).

Error Code Analysis: ERROR_NR 16#0110 and ERROR_INFO 16#0200

A commonly reported anomaly on CP 341 Modbus slave stations is the pair:

• CP_START_OK = FALSE
• CP_START_ERROR = FALSE
• ERROR_NR = 16#0110
• ERROR_INFO = 16#0200

Despite these status flags, master traffic appears to function normally — requests are answered, registers are updated. The reason is that the values shown above are not initialisation errors: they are stale values from a previous error path that was overwritten by a later successful CP_START sequence in the same instance DB. The FB 80 internal state machine clears CP_START_OK only on the next START rising edge; once cleared, it stays FALSE until the next successful initialisation cycle. ERROR_NR 16#0110 typically corresponds to "Driver initialisation: parameter block invalid" during the very first call after download, before the CP has been initialised.

ERROR_INFO 16#0200 in this context is the "CP start pending" sub-status — the FB is between the START command and the CP's acknowledgement. The values will be overwritten by the next successful start. To force a clean status, pulse the START input from a one-shot on OB1 cold-restart (OB100) and verify CP_START_OK = TRUE afterwards.

NDR Signal Behavior: Why It Stays FALSE

The NDR pulse on FB 80 is generated from the DONE output of the internal P_RCV_RK call. P_RCV_RK is a true level-triggered primitive: it requests a receive from the CP, the CP holds the request until a frame arrives, and P_RCV_RK returns with DONE = TRUE for one cycle. FB 80 then re-issues the receive command immediately, so DONE/NDR is a momentary pulse.

Three conditions can keep NDR permanently FALSE while traffic is actually flowing:

1. P_RCV_RK is not being called. If the OB1 cycle is too short or FB 80 is in an error branch, the internal P_RCV_RK never re-arms.
2. The CP_START_OK flag is FALSE. Many FB 80 implementations gate the internal P_RCV_RK call behind a successful CP start; until START_OK is TRUE, no receive command is issued.
3. The NDR evaluation point is wrong. NDR is only TRUE for a single cycle. If the application samples it asynchronously (e.g. via a cross-reference from another FC), it may miss the pulse entirely.

Master Life Monitoring Strategies

A Modbus slave has no inherent heartbeat: it only knows the master is alive when a frame addressed to its station arrives. Three field-proven approaches are available, in order of complexity.

Strategy 1 — NDR-based Watchdog (single slave on bus)

1. Configure FB 80 with the slave's holding-register / coil image.
2. In OB1, evaluate NDR directly after the FB 80 call:

      CALL  "MODB_341", "Diag_DB"
       LADDR  := 256            // CP 341 base address
       START   := "FirstScan"
       REQ     := FALSE
       DATA    := P#DB100.DBX0.0 BYTE 200
       DB_NO   := 80
       NDR     := "mb_NDR"
       ERROR   := "mb_ERR"

      A     "mb_NDR"
      L     S5T#3S                // 3 second watchdog
      SD    "T 100"               // pulse timer, retriggerable

      A     "T 100"
      =     "Master_Alive"       // TRUE while master polled within 3 s
      NOT
      =     "Master_Dead"

The pulse timer SD (S_ODT extended) with S5T#3S retriggers on every NDR pulse; if NDR stops, the timer expires and Master_Dead goes TRUE. 3 seconds is a safe default for a single-slave bus with a 1 s poll period.

Strategy 2 — NDR plus address verification (multi-slave bus)

When several Modbus slaves share the RS-485 bus, FB 80 / P_RCV_RK receives every frame on the wire — including frames addressed to other slaves — because the CP filters at the Modbus level but the lower-level P_RCV_RK sees raw telegrams. The NDR pulse therefore occurs even when a different slave is being polled. To suppress this, the application must inspect the first byte of the receive buffer (the slave address):

      L     DB80.DBB    0          // first byte of P_RCV_RK receive buffer
      L     1                        // our slave address
      ==I
      =     "My_Station_Polled"

The watchdog timeout is then scaled to the master's full poll cycle, for example:

T_watchdog = N_slaves * T_poll_per_slave + 2 s margin

For 8 slaves at 200 ms per poll, set the timer to 4 s (8 × 0.2 + 2.4).

Strategy 3 — Dedicated receive-only CP 341

For deterministic monitoring independent of the slave CP, install a second CP 341 (or CP 341-1) on the same RS-485 bus configured as a transparent receive channel. Call P_RCV_RK against this second CP; it returns the raw bytes of every frame on the bus, allowing the application to compute Modbus CRC-16, decode the function code, and extract the addressed slave without any Modbus state-machine interference. This is the only approach that survives FB 80 internal state-machine bugs.

Accessing the Internal P_RCV_RK NDR Signal

The FB 80 source is shipped as protected know-how but the instance DB still contains the P_RCV_RK call's output structure. The receive buffer descriptor (often named P_Rcv) lives at a fixed offset inside the instance DB. Open the instance DB in STEP 7 > LAD/FBD/ST > Monitor/Modify and locate the BOOL field immediately preceding the Receive_Buffer_Length DWORD — that BOOL is the raw DONE output of P_RCV_RK.

Parameter Block Diagnostics

The parameter block (UDT 80 template, instance DB NO passed via the DB_NO input) defines the Modbus data model: which function codes are enabled, the address ranges mapped to holding registers / input registers / coils / discrete inputs, and the byte order. Common faults producing NDR = FALSE despite traffic:

• Mismatched slave address: the address in the parameter block differs from the HW Config slave address. The CP rejects every frame silently.
• Function code disabled: the master polls Function Code 03 (Read Holding Registers) but the parameter block only enables FC 04. The CP returns an exception 01 (Illegal Function) and FB 80 may not pulse NDR.
• Address range out of scope: the master requests register 40001 but the parameter block starts at 40010. Exception 02 (Illegal Data Address).
• Wrong byte order: on mixed-vendor buses, "Word Swap" may be required. Verify under CP 341 > Properties > Parameter > Modbus > Byte Order.

Enable the CP 341 diagnostic buffer (online → CP 341 → Diagnostic Buffer) to see every received frame, every exception, and every CRC error. The diagnostic buffer is the fastest way to confirm that the master is actually transmitting on the wire.

Diagnostic and Verification Procedures

Use the following checklist to bring a CP 341 Modbus slave station to a verified, monitorable state.

1. Verify hardware: RS-485 A/B wiring, termination resistor 120 Ω at both line ends, fail-safe bias (R(A) pulled to 5 V through 680 Ω, R(B) to 0 V through 680 Ω).
2. Verify driver: in HW Config, right-click CP 341 → Load Driver. The driver "Modbus slave (RTU)" should appear in the module's flash file list.
3. Verify parameter assignment: baud, parity, stop bits, slave address, inter-frame silence, byte order. All must match the master.
4. Download and cold-restart the CPU. Pulse START on FB 80 from OB100. Confirm CP_START_OK = TRUE.
5. Run a single Modbus poll from the master (e.g. read holding register 40001, length 1) and check that the CP diagnostic buffer shows a receive event and a transmit event.
6. Verify NDR in the instance DB. If NDR remains FALSE while the diagnostic buffer shows receive events, the FB 80 instance is not re-arming P_RCV_RK; check that FB 80 is called every OB1 cycle and that OB1 is not skipping due to a higher-priority error OB.
7. Implement the master-life watchdog using Strategy 1, 2, or 3 from this article, scaled to the poll cycle.
8. Force a master failure test by unplugging the RS-485 line at the master end. Confirm Master_Dead goes TRUE within the configured timeout.
9. Restore the line and confirm Master_Alive re-asserts within the first poll cycle after reconnection.

Related References

For the matching Modbus master implementation on the same CP 341 family, consult the Modbus master RTU manual at CP 341 / CP 441-2 Modbus master (RTU) manual. For the higher-level TIA Portal instruction, see the MODB_341 documentation in the Siemens documentation hub. The point-to-point primitives P_SND_RK and P_RCV_RK are documented in the STEP 7 Standard Library — Communication Blocks manual.