Resolving CP 341 Modbus Master Error 0xE62 with WEST 6100+

1. Problem Summary

When a Siemens SIMATIC S7-300 CPU 315-2DP controls a WEST 6100+ process controller over RS-485 using a CP 341 communications processor loaded with the Modbus master driver, an error code of 16#0E62 is returned in the STATUS output of the send function block after the request is triggered. The CP 341 TX and RX LEDs flash, confirming that a request is being transmitted and a response is being received, but the STATUS word shows that the CP 341 received a Modbus exception response from the slave. This article explains the meaning of the 0x0E62 status, the underlying Modbus exception code 2 ("Illegal Data Address"), the correct source DB structure for the CP 341 Modbus master driver, and the procedure to read the process value (PV) and write the setpoint (SP) of the WEST 6100+ on the same RS-485 segment.

2. Hardware and Software Context

Verify the CP 341 order number against the available backplane slot count and the required interface. The CP 341 must be parameterized for the Modbus master protocol in HW Config, not the default ASCII or 3964(R) driver. The Siemens Modbus master manual for CP 341 / CP 441-2 is the primary reference for the driver interface and error codes used throughout this article.

3. Decoding the CP 341 STATUS 0x0E62

The CP 341 Modbus master driver reports its status in two places: the DONE/NDR/ERROR output of FB 7 P_SND_RK and the STATUS parameter of FB 8 P_RCV_RK (or the equivalent Modbus-specific wrapper blocks generated by the parameterization tool). The value 16#0E62 is not an RS-485 hardware fault: it is the Modbus exception code 2 ("Illegal Data Address") returned by the slave and passed back to the STEP 7 program through the driver. The driver packs the Modbus exception number into the lower byte of STATUS and a class identifier into the upper byte.

4. WEST 6100+ Modbus Register Map

The WEST 6100+ exposes its process variable, setpoint, output power, and alarm status as Modbus holding registers. Confirm the exact map against the controller's Communications Option manual because the numbering convention (1-based "register N" vs. Modicon 4xxxx) is the most common source of the 0x0E62 fault.

Many WEST controller manuals quote the register as "1" or "2" in the communications section. This is the 1-based register number, not the Modicon 4xxxx address. The CP 341 Modbus master driver expects the Modicon address. Therefore the correct entry in the source DB for PV is 40001 and for SP is 40002. Using a raw value of "1" or "2" without the 4xxxx offset is the single most common cause of 0x0E62.

5. CP 341 Modbus Master Parameterization in STEP 7

Open the CP 341 in HW Config and assign the protocol Modbus master, RS-485 half-duplex. The parameterization tool generates a parameter DB and a frame DB that must not be edited manually. Configure the following before downloading to the CPU:

1. Interface: RS-485 half-duplex (two-wire). Match the termination resistor and biasing to the WEST 6100+ manual.
2. Baud rate: 9600 bit/s as a safe default; raise to 19200 if the controller supports it. Both sides must match.
3. Parity / data / stop: 8E1 (8 data bits, even parity, 1 stop bit) — required for Modbus RTU.
4. Character delay / response timeout: 50 ms. The Modbus standard requires 3.5 character times silence between frames; at 9600 8E1 one character is 11 bit times = 1.146 ms, so the silent interval is 4.01 ms. Use 50 ms for safety on electrically noisy plants.
5. Slave address: 1. Must match the WEST 6100+ address set on the controller front panel or in the configuration menu.
6. Function code: FC 3 for reading PV, FC 6 for writing a single SP register. FC 16 is acceptable for multi-register writes if you also write the ramp-rate or output-limit registers.

6. Source DB Layout for FC 3 (Read Holding/Input Registers)

The CP 341 Modbus master driver expects a fixed source DB layout. For a read request the layout is five bytes long, mixing single-byte fields and 16-bit fields:

The first five bytes must remain BYTE fields in the S7 source DB. The byte layout in the source DB (STL notation) is:

DATA_BLOCK DB100
TITLE = 'CP341_MASTER_READ_PV'
AUTHOR : ENG
FAMILY : COMM
VERSION : 1.0
STRUCT
  slave_addr   : BYTE  := B#16#01;   // WEST 6100+ address
  fc           : BYTE  := B#16#03;   // Read Holding Registers
  reg_addr     : WORD  := W#16#9C41; // Modicon 40001 = PV (do NOT use 1)
  qty          : WORD  := W#16#0001; // One register
END_STRUCT
END_DATA_BLOCK

The corresponding receive DB will contain the echoed slave and FC bytes, the byte count, the data word, and the CRC16. A typical receive DB for a single-word read of PV is:

DATA_BLOCK DB101
TITLE = 'CP341_MASTER_RECV_PV'
STRUCT
  slave_echo   : BYTE;   // 0x01
  fc_echo      : BYTE;   // 0x03
  byte_count   : BYTE;   // 0x02 (always 2 * quantity)
  pv_word      : WORD;   // raw PV (0-4095 for 0.0-100.0%)
  crc_lo       : BYTE;   // CRC16 low byte
  crc_hi       : BYTE;   // CRC16 high byte
END_STRUCT
END_DATA_BLOCK

The CRC bytes are appended by the CP 341 driver on transmit and stripped on receive; the application should not modify them. After a successful read, the application reads DB101.pv_word and scales it to engineering units before displaying it on the HMI.

7. Source DB Layout for FC 6 (Preset Single Register)

For a write request the source DB extends by two bytes for the register value:

DATA_BLOCK DB102
TITLE = 'CP341_MASTER_WRITE_SP'
STRUCT
  slave_addr   : BYTE  := B#16#01;
  fc           : BYTE  := B#16#06;
  reg_addr     : WORD  := W#16#9C42;  // Modicon 40002 = SP
  reg_value    : WORD  := W#16#0032;  // Setpoint = 50 (= 5.0% of span if scaled 0-1000)
END_STRUCT
END_DATA_BLOCK

The Modbus RTU response for FC 6 is an echo of the request, so the receive DB for a write has the same six-byte structure as the source DB. The application should check the echoed register value to confirm the slave accepted the write.

8. Why Read and Write Cannot Be Combined in a Single Modbus Transaction

Modbus function codes are unidirectional. The codes relevant to a WEST 6100+ application are:

• FC 3 / FC 4 — read holding registers / read input registers.
• FC 6 — preset a single register (write one 16-bit value).
• FC 16 (0x10) — preset multiple registers (write a block).

There is no Modbus function code that both reads and writes in a single transaction. The only way to update SP and read PV in the same scan is to issue two separate requests in sequence, accept the response of the first before triggering the second, and place the read result in a user DB (not the CP 341 receive DB).

The send DB and the receive DB have different structures. The send DB is built by the application and consumed by the CP 341 driver to assemble the Modbus request. The receive DB is filled by the driver with the response bytes returned by the slave. They cannot be the same DB, and they cannot be reorganized to look like one another. The PV read from FC 3 lives in the FC 3 receive DB; the SP value sent with FC 6 lives in the FC 6 source DB. To display both in a single user-visible DB for the HMI, copy the data with a simple block-move instruction in OB1 or a cyclic OB (e.g., OB35).

9. Common Source-DB Mistakes (BYTE vs. WORD)

The Modbus RTU frame is byte-oriented, but the CP 341 source DB specification mixes single-byte fields (slave address, function code) with 16-bit fields (register address, value, quantity). A frequent mistake is to declare the entire source DB as WORD or to swap the byte/word assignment, which causes the driver to either refuse the request with status 0x0E32 (format error) or transmit a frame that the slave rejects with 0x0E62 because the encoded address is out of range.

Another common mistake is the wrong conversion of the Modicon address. The decimal number 40001 is 0x9C41 in hex, not 0x9CF1. A typographical error here shifts the request by 176 register addresses and the slave returns 0x0E62 because the address is out of range. A similar error can occur when the application moves a WORD into a BYTE field by mistake and the high byte of the address overwrites the function code.

10. Reading PV and Writing SP Concurrently

Use two source DBs and two receive DBs, plus a single shadow user DB that aggregates the data for the HMI or control logic. The CP 341 Modbus master can only execute one transaction at a time on a given serial port, so alternate the read and write requests with a time gap of at least 3.5 character times plus the round-trip time.

1. Trigger the FC 3 read (DB100) for PV. Wait for DONE = TRUE and ERROR = FALSE on FB 7 (or the Modbus wrapper block).
2. Copy DB101.pv_word into a user DB, e.g., DB200.user_pv using BLKMOV or MOVE.
3. Trigger the FC 6 write (DB102) for SP. Wait for DONE = TRUE and ERROR = FALSE on FB 7.
4. Repeat. Typical cycle: 100–500 ms depending on baud and controller response time.

The minimum cycle is determined by the Modbus RTU framing rules. One character time at 9600 bit/s with 8E1 is:

The required silent interval between frames is 3.5 character times:

A round-trip for FC 6 (8 bytes request + 3.5 char gap + 8 bytes echo + 3.5 char gap) at 9600 is therefore about 23 character times or 26.4 ms. Allow at least 100 ms in practice to absorb controller scan latency and bus turnaround. The maximum cycle time is bounded by the controller's display update rate (typically 200–500 ms on a WEST 6100+); polling faster than this does not yield fresh data and only adds bus traffic.

11. RS-485 Half-Duplex Wiring Notes

The CP 341 RS-485 variant uses a sub-D connector with pin 3 (Data B / TxD+/RxD+) and pin 8 (Data A / TxD-/RxD-) as the differential pair. Common (GND reference) is pin 5. The WEST 6100+ exposes the same pair on its plug-in terminals labelled A+ and B-. Apply the following wiring rules:

• Use a twisted pair, shielded cable with 120 Ω characteristic impedance (e.g., Belden 9841 or Lapp ETHERLINE).
• Terminate the bus at both ends with 120 Ω. The CP 341 has an internal jumper for termination (closed only at the physical end of the segment). The WEST 6100+ has a termination resistor across A and B — enable it only if the controller is the end device.
• Do not use stubs. Daisy-chain the CP 341 to the WEST 6100+ with the shortest possible drop.
• Connect the cable shield to ground at one end only (typically the CP 341 panel ground) to prevent ground-loop currents that would inject noise into the differential pair.
• Set the CP 341 to RS-485 two-wire mode in the parameterization tool; do not select four-wire (full-duplex) because the WEST 6100+ is a two-wire slave.

12. Verification and Diagnostics

After downloading the hardware configuration and the program, follow this verification sequence. Each step is a check; if a check fails, jump to the corresponding row in the troubleshooting matrix below.

1. Set the CP 341 to RUN. The SF (red) LED must be off; the TX and RX LEDs must flash on every request.
2. Trigger the FC 3 read for PV. Check FB 7/FB 8 outputs. STATUS must be 16#0000 (not 0x0E62). The PV word in DB101 must reflect the controller's measured value.
3. Trigger the FC 6 write with SP = 50. The WEST 6100+ front panel must show the setpoint changing from its previous value to 50 within 200 ms.
4. Read PV back via FC 3 to confirm the controller is in remote setpoint mode. If SP writes succeed but the controller still uses its local SP, the controller is in Local mode and the writes are stored in a buffer rather than applied.
5. Capture a Modbus trace with a software tap (e.g., Modbus Poll in "Listen" mode, or a USB-to-RS-485 converter running a Modbus sniffer) on a laptop connected to a tap on the RS-485 bus. Verify the request bytes are 01 03 9C 41 00 01 CRC CRC for the read, and the response is 01 03 02 HH LL CRC CRC.

13. Frequently Asked Questions