Resolving CP341 Modbus RTU Master Failure with ASCII Driver

Problem Overview

A CPU 417-5H running PCS 7 v8.1 reports a CP 341 communication failure when the user attempts to poll a third-party Modbus RTU slave over RS-485. The CP 341 was configured in HW Config with the ASCII driver, interface set to Half-Duplex (RS-485) two-wire mode, and the P_RCV_RK block from the CP PtP library was called with EN_R = TRUE every 1 s, LADDR = W#16#300 (decimal 768), DB_NO = 43, and DBB_NO = 0. Despite the pulsing enable, NDR remains permanently 0 and the receive buffer is never updated.

The root cause is a protocol-driver mismatch: the ASCII driver on the CP 341 implements the Siemens ASCII frame format (7 data bits, even parity, 1 stop bit, framed by STX/ETX/BCC, no Modbus CRC), whereas the connected slave speaks Modbus RTU (8 data bits, no parity or even parity selectable, 1 stop bit, binary payload, 16-bit CRC-16). The two protocols cannot interoperate on the same physical link without one side translating; in this case the CP 341 must be loaded with the Modbus RTU master driver, or the user program must manually frame Modbus RTU telegrams and compute the CRC inside ASCII frames.

CP 341 Hardware Identification

Before changing firmware or driver, verify the physical CP 341 variant installed in the ET 200M station. The article number determines the supported interface and the maximum baud rate.

For Modbus RTU over RS-485 two-wire half-duplex, the 6ES7341-1CH02-xAE0 variant is mandatory. The CP 341 must be inserted in an ET 200M IM 153 slot with a matching profile. In PCS 7 v8.1, the CP 341 appears in HW Config under SIMATIC 300 > CP-300 > Point-to-Point > CP341. Double-click the slot to open the CP 341 properties dialog; the Parameter assignment must match the slave exactly (baud, parity, data bits, stop bits, character delay).

CP 341 Protocol Architecture

The CP 341 carries one loadable driver per project. A driver is downloaded to the module's flash via the CP 341: Parameter assignment dialog using STEP 7 / SIMATIC Manager. Once loaded, the CP 341 automatically detects the start/end of a frame based on the active driver. The available loadable drivers are:

Switching drivers requires a download to the CP 341 module and an SF LED clear. The ASCII driver cannot process the 8-bit binary payload of Modbus RTU: any incoming byte with the high bit set (0x80-0xFF) is treated as a control character under ASCII framing rules, breaking the receive state machine.

Root Cause Analysis

Three independent faults are present in the original configuration:

1. Protocol mismatch. ASCII driver does not implement Modbus RTU framing, slave addressing, function codes, or CRC-16 verification. The CP 341 will discard any incoming byte pattern that does not begin with STX (0x02) or that violates the BCC checksum.
2. Wrong function block pair. P_SND_RK (FB 8) and P_RCV_RK (FB 9) are bound to the ASCII/3964/RK512 drivers only. They will not even compile/link cleanly against the Modbus RTU loadable driver; the instance DB must be generated from the Modbus driver FBs.
3. No transmit request issued. Modbus master requires an explicit polling request before any reply can be received. The original code only enabled EN_R; nothing was transmitted to slave ID 1, so the slave has no reason to reply. Receiving without first transmitting is the wrong direction in master mode.

Solution Path A: Siemens Loadable Driver Modbus Master RTU

This is the supported path. It requires the loadable driver (a paid license) and a USB or parallel-port authorization dongle.

Software and Authorization Required

• Loadable driver: "SIMATIC S7-300/S7-400 Loadable Driver for Point-to-Point CPs: MODBUS protocol, RTU format, S7 is master", order number 6ES7870-1AA01-0YA0 (or current successor — verify with Siemens Industry Online Support). Delivered as a CD with the dongle.
• Library to import into STEP 7 / PCS 7: "Modbus_Master_CP" (FBs 80–83 plus UDTs).
• Authorization: dongle plugged into the programming device (PG) USB or parallel port during the parameter download to the CP 341.
• Firmware on CP 341: V1.0.0 or higher. Verify in HW Config under CP 341 Properties > Diagnostic.

Step-by-Step Setup

1. Install the loadable driver on the engineering station. Run Setup.exe from the CD; it copies the driver file (typically CP341_MBM.HEX) and the library into the STEP 7 directories.
2. Open the PCS 7 project in SIMATIC Manager. Open HW Config and double-click the CP 341 slot.
3. In the Parameter dialog, click Load Driver.... A file browser opens pointing to ...\Siemens\Automatisierung\SIMATIC\S7DATA\CP341. Select CP341_MBM.HEX. The dongle must be present.
4. Set the interface parameters to match the slave exactly. Common settings for Modbus RTU:
   

   Parameter	Typical Value
   Protocol	Modbus Master (RTU)
   Baud rate	9600 / 19200 / 38400
   Data bits	8
   Parity	Even (or None — must match slave)
   Stop bits	1
   Character delay	4 ms (≥ 3.5 character times at 9600)
   Response timeout	2000 ms
   Retry count	2
   RTS delay	0 ms (RS-485 two-wire, hardware-controlled)

5. Save and compile HW Config. Download the hardware configuration to the AS 400H. The CP 341 performs a restart and the SF LED clears once the driver is active.
6. Import the Modbus_Master_CP library into the PCS 7 master data library. The library ships FBs FB 80 SEND_CP, FB 81 RCV_CP, FB 82 MOD_MAST (high-level), and FB 83 MOD_SLAVE (not used in master role), plus UDTs MOD_DATA, MOD_CMD, MOD_ERR.
7. In the CFC or OB 1 of the AS 400H, call FB 82 MOD_MAST with the request block (UDT MOD_CMD) referencing slave ID 1, function code 0x03 (Read Holding Registers), starting address 0, register count N. The block internally calls SEND_CP and RCV_CP; you do not call them directly.

Typical FB 82 MOD_MAST Call in STL

CALL "MOD_MAST" , DB_MODMAST
REQ        := M 10.0                  // pulse to trigger request
CONT       := FALSE                   // one-shot per REQ
LADDR      := W#16#300                // 768 decimal
UNIT       := 1                       // slave address
FC         := B#16#3                  // Modbus function code 03
DATA_PTR   := P#DB43.DBX0.0 BYTE 20   // 10 holding registers
DONE       := M 20.0                  // request completed
ERROR      := M 20.1                  // error bit
STATUS     := MW 22                   // status / error code

Refer to the driver manual for the full set of FBs and UDTs. The official Siemens Knowledge Base answers entry "Which hardware and software components do you need to establish communication between SIMATIC S7 stations and third-party devices using the MODBUS RTU protocol?" lists compatible driver/library combinations and dongle ordering numbers.

Solution Path B: Third-Party / Open Modbus Library with ASCII Driver

If the Siemens dongle is unavailable or commercial licensing is restricted, an alternative is to keep the ASCII driver loaded on the CP 341 and implement the Modbus RTU frame in the user program. The library constructs each Modbus telegram (function code, address, payload, CRC-16) byte-for-byte and ships it inside an ASCII STX/ETX envelope. The CP 341 is then used purely as a physical-layer converter. This is how user-contributed libraries on automation forums (e.g., the "MODBUS RTU MASTER FOR CP340/341/441" project) work; they avoid the dongle entirely.

User Program Responsibilities

• Construct a Modbus RTU ADU (Address, Function Code, Data, CRC-16) in a DB.
• Compute CRC-16/Modbus (polynomial 0xA001, init 0xFFFF) over the address + function + data bytes.
• Wrap the binary ADU into a STX-prefixed buffer so the CP 341 ASCII driver will transmit the bytes verbatim. Some libraries use P_SND_RK with the raw buffer; the CP 341 ASCII driver treats binary bytes 0x00-0xFF transparently in transmit, but the receive side may misinterpret bytes < 0x20; the libraries therefore install a small escape layer or interpret the receive by polling the line between known request-response boundaries.
• Implement inter-frame silence: ≥ 3.5 character times before the next request, so the slave's RTU parser resets.

CRC-16/Modbus Calculation in SCL

// SCL function block: Modbus CRC-16
FUNCTION_BLOCK FB_CRC16_MODBUS
VAR_INPUT
  pData : POINTER TO BYTE;
  iLen  : INT;
END_VAR
VAR_OUTPUT
  crcLo : BYTE;   // low byte appended to telegram
  crcHi : BYTE;   // high byte appended to telegram
END_VAR
VAR_TEMP
  i     : INT;
  j     : INT;
  crc   : WORD;
  b     : BYTE;
END_VAR
BEGIN
  crc := 16#FFFF;
  FOR i := 0 TO iLen - 1 DO
    b := pData^[i];
    crc := crc XOR WORD_OF_BYTE(b);
    FOR j := 0 TO 7 DO
      IF (crc AND 16#0001) <> 0 THEN
        crc := (crc SHR 1) XOR 16#A001;
      ELSE
        crc := crc SHR 1;
      END_IF;
    END_FOR;
  END_FOR;
  crcLo := BYTE_OF_WORD(crc AND 16#00FF);
  crcHi := BYTE_OF_WORD((crc AND 16#FF00) SHR 8);
END_FUNCTION_BLOCK

Example Send Sequence (STL, ASCII driver + manual Modbus RTU)

// Trigger send of pre-built Modbus ADU in DB43 (bytes 0..7)
CALL "P_SND_RK" , DB_SND
REQ        := M 10.0
LADDR      := W#16#300
DB_NO      := 43
DBB_NO     := 0             // start of ADU inside DB43
LEN        := 8             // 1 addr + 1 FC + 2 start + 2 qty + 2 CRC
R          := M 10.1
DONE       := M 11.0
ERROR      := M 11.1
STATUS     := MW 12

Hardware Wiring for RS-485 Two-Wire Half-Duplex

The CP 341 X27 front connector pins for RS-485 two-wire are:

For two-wire mode, only pins 2 and 4 carry data; tie pin 9 and 11 to "OFF" (not connected) and set Interface Type = Half Duplex (RS-485) Two-Wire Mode in HW Config. Enable the integrated 390 Ω bus termination resistors on both ends of the segment via DIP switches on the CP 341 (default: enabled when shipped). The shield must be bonded to functional earth at one point only to avoid ground loops.

Diagnostic and Verification Procedure

1. Open Online > CP 341 Diagnostics in STEP 7. Verify the active driver name matches what was loaded (e.g., "MODBUS_MASTER_RTU"). If "ASCII" appears, the download did not complete or the dongle was missing.
2. Use the CP 341: Modbus Master Test tool from the driver CD to issue a single request from the engineering station. If this works but the PLC program does not, the issue is in the user program.
3. Connect an oscilloscope or Modbus-line analyzer (e.g., a PC running "Modbus Poll" + USB-to-RS485 converter) to the X27 pins. Confirm the CP 341 transmits 11-bit frames at the configured baud and that the slave responds within the response timeout. If no transmission occurs, SEND_CP was never called.
4. Check the STATUS word returned by SEND_CP or MOD_MAST against the error table in the driver manual. Common codes:
   

   STATUS (hex)	Meaning
   0x0000	OK
   0x0E01	Driver not loaded / CP 341 in STOP
   0x0E02	Parameter assignment inconsistent
   0x0E04	Frame error on receive (parity, framing, overrun)
   0x0E05	CRC error on receive (Modbus RTU only)
   0x0E06	Response timeout (slave did not reply)
   0x0E07	Function code not supported by slave
   0x0E08	Modbus exception code received (illegal data address etc.)
   0x0E0A	Initialization error — driver cannot start; check dongle and firmware

5. Observe the CP 341 LEDs: SF (red) = group fault, TXD (green) = transmitting, RXD (green) = receiving. In the original fault, RXD remained dark because no slave response was requested and the ASCII driver suppressed all binary bytes from the line.
6. Toggle a single test request via a watch table: set the REQ input of FB 82 to TRUE, monitor DONE, ERROR, and STATUS. A healthy cycle reads 3 holding registers from slave ID 1, function code 0x03.

Modbus Exception Code Handling

If the CP 341 receives a valid RTU frame but the slave cannot fulfill the request (illegal address, illegal function, illegal data value, etc.), the slave returns an exception response: function code with bit 7 set (e.g., 0x83 instead of 0x03) followed by exception code byte. The CP 341 surfaces this through STATUS = 0x0E08 plus an extended code in EXT_STATUS:

PCS 7 v8.1 Specifics

PCS 7 v8.1 ships STEP 7 V5.5 + SP4 and CFC/V9. The CP 341 with Modbus RTU master is supported as of PCS 7 V8.0. For AS 410 / AS 400H systems, the CP 341 may be placed in the central rack or in an ET 200M station; in redundant AS 400H systems only one CP 341 may carry the Modbus master role per logical link, and the application program must gate requests through the partner CP if active (or hold requests during a fail-over ramp-up). CP 341 itself is not redundant; only the CPU pair is. For redundant Modbus masters consider the CP 341-1 or CM PtP (ET 200SP) with H-system coupling via application logic.

When using CFC, place the FB 82 MOD_MAST call in a cyclic task (OB 35 at 1 s, or OB 32/33 at 500/250 ms for faster poll). Wire the REQ input to a periodic pulse generator block so the same register request repeats every cycle; the FB handles the state machine and only fires one transaction per rising edge of REQ.

Common Pitfalls

• Driver still shows "ASCII". The dongle was missing during the parameter download; reload the parameters with the dongle attached.
• LADDR mismatch. Entering decimal 768 works but is fragile. Use W#16#300 everywhere; HW Config displays the address in decimal for human reading.
• Wrong block pair. Calling P_RCV_RK with the Modbus driver active produces STATUS = 0x0E01 immediately. Always use the FBs documented for the loaded driver.
• No slave request. Enabling EN_R alone in master mode is meaningless — the master must initiate every exchange.
• Baud mismatch. Many third-party slaves default to 19200 8E1; verify with the slave datasheet. Use the diagnostic tool "Modbus Poll" with a USB-RS485 converter to read the slave first before connecting the CP 341.
• Termination missing. RS-485 two-wire without 120 Ω termination at both ends causes reflections and CRC errors at ≥ 38400 baud. The CP 341 has internal 390 Ω resistors that, combined with the external 120 Ω, approximate the recommended 60 Ω; some installations prefer to disable internal and use only external 120 Ω at the two ends.
• Inter-frame delay too short. Modbus RTU requires 3.5 character times of silence. At 9600/11 = 1.146 ms per char, the gap is 4 ms. Setting the character-delay parameter to 4 ms guarantees compliance.

Related CP 341 in Slave Role

If the same project ever needs the CP 341 to act as a Modbus slave (i.e., a third-party master polls it), the loadable driver is "Modbus Slave RTU" and the block is MODB_341. The TIA Portal cloud documentation for this block, MODB_341: Modbus slave instruction for CP 341 (S7-300, S7-400), notes: "If initialization ends with errors, Modbus communication is not possible. All requests from the Modbus master system are answered with an exception code frame." The same initialization discipline applies in master mode: if the driver fails to start (bad firmware, missing dongle, wrong HW Config), every master request will receive an exception frame from the partner side or timeout entirely.

Verification Checklist Before Going Online

1. CP 341 order number ends in 1CH02 (RS-485 variant).
2. Active driver in HW Config is "Modbus Master (RTU)" or ASCII (only if using a third-party CRC library).
3. Slave ID, baud rate, parity, data bits, and stop bits match the third-party device datasheet exactly.
4. Character delay ≥ 3.5 character times at the selected baud.
5. Response timeout > measured slave round-trip time (typical: 50–500 ms for slow RTU slaves).
6. Bus termination installed at both ends of the RS-485 segment; shield bonded at one point only.
7. LADDR matches HW Config base address in hex (W#16#300 for 768 decimal).
8. FBs are imported from the correct library: Modbus_Master_CP FBs (80/81/82) or the third-party library — never both.
9. First end-to-end test: read holding register 0x0000, quantity 1, slave ID 1. Observe DONE = TRUE, ERROR = FALSE, and a non-zero value in the receive DB if the slave register holds one.
10. Long-run soak test: poll every 1 s for ≥ 30 minutes, log STATUS; acceptable if no 0x0E0x errors appear.