Multi-Vendor Modbus RTU on Siemens CP341: GE and Siemens Relays

Overview

Connecting protection relays from different manufacturers on a single RS-485 segment is a routine substation integration task. A single Siemens SIMATIC S7-300 CP341 communication processor can interrogate both GE Multilin and Siemens SIPROTEC relays over Modbus RTU on the same twisted-pair bus, provided three constraints are satisfied: identical serial port parameters, non-overlapping slave addresses, and correct register map interpretation for each vendor. This reference consolidates the physical layer, CP341 driver configuration, register addressing, and commissioning verification required to build a deterministic multi-vendor Modbus RTU network.

Modbus RTU Fundamentals and Multi-Vendor Compatibility

Modbus RTU is an open, master-slave protocol standardized as MODBUS Application Protocol V1.1b3 (Modbus Organization, 2006). Because it is an open specification, any conforming device can act as a slave regardless of the protection relay vendor. The CP341 with the Modbus Master RTU driver is itself a Modbus RTU master, and it can poll any number of conforming slaves on the same physical bus.

The protocol frame structure is identical for every vendor:

The fundamental compatibility rules are therefore protocol-level, not vendor-level. As long as both relays implement the standard Modbus function codes (typically 03 for holding registers, 04 for input registers, 06/16 for write), the master will not see a "vendor conflict." The only conflicts that arise are configuration conflicts: baud rate, parity, data bits, stop bits, slave address, and base register offset.

Hardware: Siemens CP341 Communication Processor

The 6ES7340-1AH02-0AE0 (CP341) is a serial point-to-point or multi-drop module for the SIMATIC S7-300 rack. Variants differ in physical interface:

For multi-vendor Modbus RTU networks, the RS-485 variant (6ES7340-1BH02-0AE0) is the correct choice. The RS-485 transceiver provides the differential signaling required by the Modbus over Serial Line specification (1.5 V minimum differential, ±7 V common-mode tolerance on the bus).

The Modbus Master RTU loadable driver is a separately orderable software package: 6ES7870-1AA01-0YA0 (Modbus Master RTU for CP341/CP440/CP441-1). It must be installed on the S7-300's programming device and downloaded into the CP341. The corresponding slave driver is 6ES7870-1AB01-0YA0. After installation, the driver is selected in the CP341 hardware configuration under Protocol > Modbus Master.

Physical Layer: RS-485 Topology and Cabling

A correctly terminated RS-485 bus is the foundation of a stable Modbus RTU network. The Modbus over Serial Line reference (MODBUS over Serial Line – Specification and Implementation Guide V1.02) defines the bus topology as a daisy chain. Star, stub, and tee topologies cause reflections that corrupt frames.

Key physical layer rules:

• Cable type: Twisted pair, characteristic impedance 120 Ω, e.g. Belden 3106A or Lapp ETHERLINE 2-pair.
• Termination: 120 Ω resistor across D+ and D- at each end of the bus segment only. Termination on intermediate devices is forbidden.
• Biasing: Fail-safe bias resistors (typically 680 Ω to +5 V on D+ and 680 Ω to GND on D-) on at least one node. The CP341 RS-485 interface provides internal bias that can be enabled in the hardware configuration; external bias is required only if the CP341 is not at the master end.
• Max nodes: 32 unit loads per segment. The CP341 presents 1 unit load; a typical GE Multilin relay presents 1 unit load; a SIPROTEC 5 presents 1 unit load. A 32-relay substation is therefore legal without a repeater.
• Max length: 1200 m at ≤ 93.75 kbps. At 115.2 kbps (the CP341 maximum), the limit is approximately 1000 m. Beyond this, install a Siemens 6ES7972-0AA02-0XA0 RS-485 repeater.

Communication Parameter Matching

All slaves on a single Modbus RTU segment must agree on the link layer parameters. The CP341 allows each of the following to be set independently of any other slave on the bus; therefore every relay must be configured to the same values. Mismatches are the single most common source of "Modbus won't talk" calls.

Slave Address Planning

Modbus RTU slave addresses occupy the range 1 to 247 (address 0 is broadcast). Two slaves on the same bus must never share an address. The conventional layout in a substation:

Address blocks separated by tens (1–9 Siemens, 10–19 GE-UR, 20–29 GE-SR) make future expansion cleaner and allow you to write a simple polling scheduler in the S7-300 OB1 that loops over a range.

Register Map Differences: GE Multilin vs Siemens SIPROTEC

Both vendors use function codes 03 (read holding registers), 04 (read input registers), 06 (write single), and 16 (write multiple), but their register maps are vendor-specific. The address offset convention also differs.

The practical consequence: when you read "IA magnitude, phase A" from a B30 at address 0x1000, the same data point on a 7SA86 is at a completely different address defined in the SIPROTEC Modbus map. Always export the vendor's Modbus map as a CSV (DIGSI 5 > IEC 61850/MMS > Modbus mapping > Export) before starting PLC programming.

CP341 Configuration in STEP 7 (Classic)

The CP341 is configured with the supplied "PtP Param" (or, in TIA Portal, "Point-to-Point") tool. Configuration is project-wide, not per-port: one CP341 supports one protocol on one port.

1. Insert the CP341 from the hardware catalog (6ES7340-1BH02-0AE0) into the S7-300 rack. Assign an I/O address space, e.g. PIW 256..271 (CP341 occupies 16 input / 16 output bytes for handshake/status).
2. Open Properties > Protocol and select Modbus Master RTU. The driver is detected from the installed 6ES7870-1AA01-0YA0 package.
3. Configure the port: 19200 bps, 8E1, inter-frame silence 3.5 character times (or 4 ms minimum for 19200/11/2 ≈ 0.57 ms/char).
4. Define the Modbus master job table. The CP341 driver accepts up to 250 jobs, each specifying: slave address, function code, start address, quantity, and a DB number / byte offset where the returned data is stored.
5. Call the loadable function blocks FB7 P_SND_RK and FB8 P_RCV_RK from the Modbus driver library in OB1. The driver uses these internally; user code triggers jobs and reads responses through the LDB (Loadable Driver Block) instance.

Example OB1 segment to trigger a Modbus read of holding register 0x1000 (5 registers) from slave 10 (GE B30) into DB100:

// Trigger job 0 from CP341 instance DB12 (LDB)
CALL  "S_MODB" , DB12
  REQ    :=TRUE            // rising edge starts the job
  MODE   :=B#16#01          // 1 = single job, 0 = cyclic
  JOB     :=0                // job index 0 = slave 10, FC 03, addr 0x1000, qty 5, dest DB100.DBB0
  DONE   :=M 100.0
  ERROR  :=M 100.1
  STATUS :=MW 102

The job definition is created in the protocol tool, not in user code. Job 0 above would be preconfigured as: SLAVE=10, FC=03, ADDR=4096, QTY=5, DB=100, OFFSET=0 in the PtP Param editor.

CP341 Configuration in TIA Portal

For S7-300 projects migrated to TIA Portal V16 or later, the CP341 with Modbus Master RTU is supported through the legacy device proxy. The configuration path is:

1. Device view > CP341 > Properties > Point-to-Point > Protocol > Modbus Master RTU.
2. Under Modbus Master > Jobs, add a job. For each job set: Slave, Function code (03 for read, 06/16 for write), Start address (decimal or hex with 0x prefix), Length, and Target DB.
3. The LDB is now generated automatically; user code calls the standard LDB instance with S_MODB for cyclic and S_MODBUS for triggered reads.

Step-by-Step Commissioning

1. Verify wiring. With a DMM, measure the resistance between D+ and D- on a powered-down bus. You should see ~60 Ω at the master end (two 120 Ω terminations in parallel). Reading open or short indicates broken termination.
2. Confirm slave addresses. Use a Modbus master simulator (such as a laptop running Modbus Poll or QModMaster) to scan the address range 1–247 at 19200/8E1. Each present relay responds with its Modbus echo. Record the addresses.
3. Capture a reference frame. With a USB RS-485 tap, capture one polling cycle. Verify that every request has a valid CRC and a corresponding response within the configured timeout. A timeout on one slave blocks all subsequent jobs in a cyclic job table.
4. Configure the CP341. Build the job table in order of priority. Place status reads (FC 04) first, then metering reads (FC 03), then write commands (FC 06/16) last to minimize bus contention.
5. Insert the data into the S7 program. Map each relay's holding register block to a known DB offset. Document the mapping in a global variable comment so that HMI/SCADA tag imports are straightforward.
6. Loopback test. Disconnect the bus and connect a hardware loopback (D+ to D+, D- to D-, with termination). Issue a read of input registers 0x0001 from slave 99. The CP341 should report "CRC error" or "slave not responding" rather than a generic protocol fault. This confirms the driver is running.
7. Run with one relay. Connect only the Siemens SIPROTEC first. Validate timing and DB contents. Then add the GE B30, then the C70, then the SR750. Adding one device at a time isolates conflicts.

Troubleshooting Matrix

Verification and Long-Term Diagnostics

After commissioning, configure the S7-300 to count Modbus error events per slave. The CP341 driver returns a status word in the LDB instance for each job completion. Build a simple diagnostic FB that increments a counter in a global DB whenever STATUS > 0 and resets it on every successful DONE. Expose the counter to the SCADA HMI as a single tag per slave:

// Diagnostic counter for slave 10 (GE B30), job 0
A M 100.0      // DONE rising edge
FP M 110.0     // one-shot
SPBNB nxt1
L DB200.DBD 0  // load counter for slave 10
L 0
==I
SPBNB clr1
L 0            // reset on transition to success after errors
T DB200.DBD 0
clr1: SET
SAVE
nxt1: A M 100.1 // ERROR rising edge
FP M 110.1
SPBNB nxt2
L DB200.DBD 0
L 1
+I
T DB200.DBD 0  // increment error counter
nxt2: NOP 0

For a Modbus TCP integration (e.g., forwarding the S7-collected data to a SCADA at the control center), the Siemens Modbus TCP Connector on the Industrial Edge platform acts as a Modbus TCP client that polls the S7-300 via S7-comm and exposes the registers to higher-level systems. This is a different code path from the CP341's serial master and should be planned separately.

Safety and Substation Considerations

Protection relays are the last line of defense for the power system. Communication failures on a metering-only bus do not affect protection; protection is always handled by the relay's hard-wired logic, not by the Modbus link. However, several engineering hygiene rules apply:

• Never place the Modbus cable in the same conduit as the CT/PT secondary wiring. Cross-coupled noise on the secondary side can saturate the relay's input and cause misoperation. Use separate, dedicated cable trays.
• Use shielded, twisted pair with shield grounded at one end only to prevent ground loops.
• Optical isolation: The CP341 RS-485 interface is not optically isolated. For substation-grade isolation, use a third-party RS-485 isolator (e.g., Phoenix Contact PSM-ME-RS485) or a fiber converter (Siemens 6GK1500-0FC10) between the CP341 and the bus.
• Time synchronization: Do not rely on Modbus timestamps for protection event records. Use IRIG-B or PTP (IEEE 1588) for the relays' internal clocks; pull event records via Modbus only for display in HMI.
• Cybersecurity: Modbus RTU has no authentication. If the bus runs outside the substation, terminate it with a VPN or, preferably, use Modbus TCP on a private VLAN with a firewall.

FAQ