Resolving CP 341 Error 080C with SIMEAS T 7KG600 IEC 60870-5-103

1. Problem Statement

A SIMEAS T transducer (Siemens 7KG600 8EA) reports measurement data over RS-485 using the IEC 60870-5-103 companion standard. The system integrator selected the SIMATIC S7-300 CP 341 point-to-point module (6ES7 341-1CH02-0AE0) on a CPU 315-2 DP to read the transducer and applied the standard P_SND and P_RCV blocks (FB7/FB8) from the STEP 7 "CP 341 Point-to-Point Communication" library. After exercising every legal combination of baud rate (1 200 / 2 400 / 4 800 / 9 600 / 19 200), parity (none/even/odd) and stop bits (1/2), the S7 program continues to read status 0x080C from the CP 341. Polling never produces a valid ASDU; the SIMEAS T never replies.

The persistent 0x080C status is a frame/character timeout, not a parameter assignment fault. The receiver waits for the FT 1.2 frame end delimiter and never sees one, so it discards the partial buffer. The root cause is not the wiring, the baud rate, or the CPU firmware: it is a protocol mismatch. The CP 341 hardware family does not ship with an IEC 60870-5-103 driver; only IEC 60870-5-101 (the telecontrol protocol) is available as a loadable driver. The SIMEAS T 7KG600 8EA cannot respond to Modbus RTU or 3964R polling because it does not speak those protocols.

2. System Architecture

The original wiring topology and the CPU/CP relationship are summarized in the diagram below. The SIMEAS T provides an RS-485 link with two-wire (A/B) or four-wire (TX/RX) options; the CP 341 in this configuration uses the two-wire RS-485 mode on its 9-pin D-sub connector.

3. IEC 60870-5-103 Protocol Profile

IEC 60870-5-103 is a companion standard derived from IEC 60870-5-1 to IEC 60870-5-4. It defines the protected-data and general-data transfer procedures for protection equipment, protection controllers, and measurement transducers such as the SIMEAS T. The link layer is FT 1.2 (asynchronous, 11 bits per character: 1 start, 8 data, 1 parity, 1 stop) with two frame types:

The SIMEAS T 7KG600 8EA uses the variable-length FT 1.2 frame exclusively for measurement data (class-2-data, spontaneous or polled). A standard poll for instantaneous measurands uses ASDU type 0x03 (measured value II, normalized) or 0x04 (measured value II, scaled). The SIMEAS T default baud rate is 9 600 bit/s, even parity, 1 stop bit, 8 data bits, with link address 1 by default.

Two key consequences for the CP 341 design follow from this profile:

1. The 11-bit character format (1 start, 8 data, parity, 1 stop) requires the S7 UART to honor parity in hardware. The CP 341 RS-485 front connector does honor parity; however, the link layer has no inter-character gap, so the receiver must be configured for the smallest possible inter-character timeout (1.5 character times) to be able to detect frame end.
2. Both the FT 1.2 fixed-length frame and the variable-length frame share an end delimiter 0x16 followed by an optional checksum byte. An ASCII driver looking only for CR/LF or user-defined end markers will not synchronize on 0x16, so it never releases a complete frame to FB8.

4. CP 341 Loadable Driver Inventory

The CP 341 firmware supports exactly five loadable drivers, distributed on the "CP 340/CP 341 Communication Software" CD. The current catalog is reproduced below from the CP 341 Point-to-Point Communication manual (Siemens order 6ES7 341-1xxxx):

The IEC 60870-5-103 driver is not part of this catalog. The SIMEAS T manual itself recommends either a CP 340 preceded by an RS-485/RS-232 converter, or a CP 441-1/CP 441-2 direct on RS-485, because neither CP 340 nor CP 341 natively implements -103. Only the SIPLUS RIC bundle (Robust Communication in the extreme environment) offers IEC 60870-5-101/103 libraries specifically built around the CP 340/341. The bundle ships with an FB/UDT library under the name "SIPLUS RIC IEC 60870".

5. Root Cause Analysis of Error 080C

The status word 0x080C belongs to the CP 341 data-flow control error class 0x08xx. The bit pattern, decoded against the CP 341 manual, indicates a frame / character timeout:

Three failure paths converge on 0x080C in the SIMEAS T case:

1. Frame-format mismatch. The ASCII driver does not understand the FT 1.2 delimiter 0x16, so FB8 P_RCV returns STATUS = 0x080C after the inter-character timer expires.
2. Wrong protocol (semantic mismatch). The SIMEAS T expects a class-2 poll with the FT 1.2 control field structure; FB7 P_SND sends a raw user buffer without link-layer handshaking, so the slave never answers.
3. Driver / firmware mismatch. STEP 7 must load the IEC 60870-5-101 driver (or SIPLUS RIC IEC 60870-5-103 library) into the CP 341 before the CP is configured. Without that loadable driver, the SIMEAS T is electrically present on the bus but logically mute from the S7 side.

6. CP 341 Error Code Reference

The complete driver-independent subset of CP 341 status words is documented in the CP 341 manual. The codes most often encountered on a SIMEAS T integration are listed below:

7. Resolution Path A - SIPLUS RIC IEC 60870 Bundle

The SIPLUS RIC (Robust Industrial Communication) bundle packages a CP 340 or CP 341 with a CPU 315-2 DP, an MMC, and a licensed IEC 60870-5-101/103 function-block library. The bundle is documented for use with PCS 7 V8.x and STEP 7 V5.5, and it can be used as a Step 7 V5.5 SP3+ library without PCS 7 by importing the S7 program of the example project supplied with the bundle. The product is listed on the SIPLUS RIC landing page at siemens.com/siplus-ric.

7.1 Prerequisites

• CPU 315-2 DP with firmware ≥ V2.6 (6ES7 315-2AG10-0AB0) and STEP 7 V5.5 SP3 or later.
• CP 341 6ES7 341-1CH02-0AE0 with firmware ≥ V1.0 (front connector 6ES7 392-1BJ00-0AA0).
• SIPLUS RIC IEC 60870 library: "SIPLUS RIC IEC 60870 -103/-101" v1.2 or later (per SIPLUS RIC brochure).
• SIMEAS T configured for IEC 60870-5-103 at 9 600 bit/s, 8E1 (default), link address 1, with the desired ASDUs enabled in the transducer's IEC 103 setup menu.

7.2 Step-by-Step Commissioning

1. Open the SIPLUS RIC STEP 7 example project; locate the FBs for -103 (typically FB1010 ... FB1099 with UDT1010) and copy them into the target project.
2. Open HW Config, insert the CP 341 6ES7 341-1CH02-0AE0, double-click it, and load the IEC 60870-5-101 master driver (DRV_101M) into the module via "Load driver". Confirm that the driver file shows "6AG6 003-0BA01-0AA0" or the standard equivalent 6ES7 870-1AB01-0YA0.
3. Set the protocol-specific parameters: baud rate 9 600, character frame 8E1, link address of the SIMEAS T (default 1), and the inter-character timeout. For -103, set the inter-character timeout to 30 ms (3 character times at 9 600 bit/s) to cover the FT 1.2 maximum inter-character gap.
4. Compile and download the HW Config. After download, the CP 341 starts up with the -101/-103 driver; the diagnostic buffer should report "Driver loaded: IEC 60870-5-101/103".
5. Configure the SIMEAS T side: navigate to the IEC 103 menu, set link address = 1, baud = 9 600, parity = even, and enable spontaneous class-1 transmission for the required measurements.
6. Wire RS-485 A to CP 341 pin 3 (TxD/RxD+ / A), RS-485 B to pin 8 (TxD/RxD- / B), and tie the cable shield to PE at one end only. Add 120 Ω termination at the SIMEAS T end and at the CP 341 end if the line is long (> 3 m).
7. Call the SIPLUS RIC FB1010 (POLL_103) in OB35 with a 100 ms cycle, pass DB1010 (UDT1010) configuration, and evaluate the return STATUS. Valid responses carry STATUS = 0x0000 and a populated ASDU buffer.

8. Resolution Path B - CP 340 with RS-485/RS-232 Converter

This is the path recommended in the SIMEAS T manual. The CP 340 is RS-232 only; an external RS-485 to RS-232 converter (Phoenix PSM-ME-RS485/RS232-P, Weidmuller IE-CS-RS232-485, or similar) is placed in the field to convert the differential pair to single-ended RS-232. The CP 340 is then loaded with the ASCII driver, and the IEC 60870-5-103 frame is parsed in the S7 CPU with a custom FB.

8.1 Pros / Cons

9. Resolution Path C - CP 441 Direct Connection

The SIMEAS T manual identifies the SIMATIC S7-400 CP 441-1 (6ES7 441-1AA04-0AE0) and CP 441-2 (6ES7 441-2AA04-0AE0) as supporting direct RS-485 connection to the transducer. The CP 441 loads the IEC 60870-5-103 driver as a separate option module under the SIMATIC "CP 441 Point-to-Point" parameterization tool. This path is viable only on S7-400 systems; it cannot be used on an S7-300 with CPU 315-2 DP without replacing the CPU and rack.

10. Fallback - FB7/FB8 ASCII Driver with Manual FT 1.2 Parser

If the project cannot change hardware or purchase the SIPLUS RIC bundle, the existing CP 341 with the ASCII driver can still poll the SIMEAS T. The integration engineer must implement a STEP 7 FB that builds a class-2 poll in a DB, calls FB7 P_SND to transmit it, and then calls FB8 P_RCV with an end-of-frame detection on 0x16 plus checksum validation. The S7 FB is non-trivial but workable; the relevant CP 341 parameters are:

The poll frame for instantaneous measurands (ASDU 8, INF 0x01 - general interrogation) has the following structure (hex):

10 5A 01 4A 16        // Class-2 fixed-length poll (no data, link addr 1)
// Or for class-1 spontaneous enable on SIMEAS T:
68 0B 0B 68 73 01 0A 01 06 00 01 00 00 00 84 16
// 68 LL LL 68 ctrl addr ASDU_type 0x0A 0x01 (INF=1) ... CSUM 16

The S7 program must build this frame in a DB and call FB7 P_SND; FB8 P_RCV returns when the configured 0x16 end character is received. The S7 FB then checks the CSUM and the FT 1.2 control field before populating the destination DB. The risk of a frame timeout returning 0x080C is high if the end character is not received within the configured timeout, or if the SIMEAS T rejects a frame with a CSUM error.

11. RS-485 Wiring Topology

Two-wire RS-485 from the SIMEAS T (terminals A and B) to CP 341 pins 3 and 8 with a twisted and shielded cable (LiYCY 2 x 2 x 0.5 mm² or equivalent). Place a 120 Ω termination resistor between A and B at both line ends. Bond the cable shield to PE at the SIMEAS T end only; the CP 341 PE pin is connected to the backplane earth bar. Maximum cable length at 9 600 bit/s is 1 200 m; keep the length under 100 m to avoid ground potential differences in the substation.

12. Verification and Diagnostics

1. Open the CP 341 online diagnostic buffer (STEP 7 > PLC > Module Information > Diagnostic Buffer). The most recent entries should show Driver loaded: IEC 60870-5-101/103 and Line OK; no further 0x08xx entries should appear after a successful poll.
2. Force a general-interrogation poll from the S7 side; the SIMEAS T should answer with the configured class-2 ASDUs. The SIPLUS RIC FB returns STATUS = 0x0000 on a valid response.
3. With the CP 340 + converter path, capture the raw RS-232 stream with a serial line analyzer. Look for a frame starting 0x68 0x0B 0x0B 0x68 followed by ASDU bytes 0x06 0x01 ... and ending 0x16. If the analyzer shows no 0x16 delimiter at all, the SIMEAS T is not transmitting (link-layer issue) rather than the S7 side.
4. Use the SIMEAS T service port: the diagnostic register should show 0x00 when the master is in the RESET_CONFIRMED state. If the register shows 0x0E or 0x0F, the transducer is in a fault state and the master must send a class-2 reset before polling can resume.
5. After a successful poll, save the project and export the S7 program for repeatability; the SIPLUS RIC example project ships with a test sequence that runs the bus through a general interrogation and reports the number of received ASDUs.

13. Troubleshooting Matrix

14. References to Official Documentation

• CP 341 Point-to-Point Communication - Installation and Parameter Assignment manual (PDF)
• CP 341 (S7-300, S7-400) configuration in TIA Portal V21
• SIPLUS RIC brochure (Siemens AG)
• SIPLUS RIC product page