Resolving CP341 Modbus Slave Write Error 02: Illegal Address

Problem Overview

The Siemens CP 341 communication processor is widely deployed as a point-to-point Modbus RTU master or slave on S7-300 and S7-400 PLC backplanes. A recurring field issue is that the CP 341 configured as a Modbus slave accepts FC 03 (Read Holding Registers) requests without fault, but rejects every FC 06 (Write Single Register) or FC 16 (Write Multiple Registers) request with Modbus exception code 0x02 — Illegal Data Address. The same station, when reconfigured as a master with the same slave device, performs flawless reads and writes. The fault is therefore localized to the slave-side parameterization, the CP firmware, and the data-block address layout.

This reference explains the root causes of the error, the correct configuration procedure for the Modbus slave parameter blocks, the firmware update path, and the verification steps required to clear exception code 02. It targets engineers commissioning or troubleshooting a CP 341 with order numbers 6ES7341-1AH02-0AE0 (RS-232C) or 6ES7341-1BH02-0AE0 (RS-485/RS-422) running Modbus slave protocols.

Problem Details — Modbus Exception Code 02

Modbus exception code 0x02 is defined by the Modbus Application Protocol Specification (Modicon) as "Illegal Data Address." The CP 341 slave answers a write request by transmitting the offending function code with the MSB set plus the exception code:

The SEND job on the master reports the Modbus slave instance-DB and the offending register number through the STATUS output word of the MODB_341 / P_SND_RK call. Combined with the Modbus trace of the slave (Step 7 → CP 341 → Diagnostics → Modbus trace), the engineer can pinpoint the register address the master is requesting and compare it against the configured range.

Root Cause Analysis

Five layered causes are observed in the field. They interact, and a station may exhibit multiple problems simultaneously:

1. Out-of-range parameter block — the register range defined on the FC 03/06/16 tab does not cover the register the master is targeting. CP 341 returns 0x02 because the start address falls outside MIN DB to MAX DB.
2. Firmware defect on early CP 341 versions — firmware prior to V 2.0.x for the 1BH02 module mishandles FC 16 boundaries. The firmware defect was corrected in HSP releases; field experience shows the symptom disappears only after the firmware is upgraded to V 3.0.0 or later (CP 341-1BH02-0AE0, MLFB 6ES7341-1BH02-0AE0).
3. DB word index above 510 — the parameter block addresses DBWx (x = 0..510). Data words at DW 511 onward are unreachable by the slave firmware.
4. Crossing a 1024-byte (kilobyte) boundary — when the configured range straddles two consecutive DBs or crosses the 1024-byte page inside a single DB, the CP returns 0x02 even though the underlying data is contiguous.
5. Reverse direction in Modbus address space — Modbus register 0x0000 maps to DBW0 of the configured DB; many engineers interpret the Limits tab as inclusive MIN and MAX register numbers while the firmware treats them as starting and ending DB word indices.

CP 341 Hardware and Firmware Reference

Select the correct module variant before commissioning. The Modbus slave dongle is hardware-keyed:

The official configuration manual CP 341 Point-to-Point Communication, Installation and Parameter Assignment documents the parameter dialog and lists the function-code capabilities of each firmware revision.

MODB_341 Slave Block Parameters

The slave uses the standard library block MODB_341 (FB 80 in the example project) loaded into the S7-300 CPU. The block interfaces are:

The slave DB is auto-generated from the HW Config wizard. The SLAVE_DB image table is the binding between Modbus register numbers and S7 data-block words. The MODB_341 documentation on the Siemens documentation portal explains the SEND job and instance DB diagnostics in detail.

Step-by-Step Configuration for FC 03 / FC 06 / FC 16

The wizard on the CP 341 dialog Properties → Parameter → Modbus-Slave exposes eight tabs. The fields relevant to a write-capable slave are FC 01/05/15, FC 03/06/16, and Limits.

1. Open HW Config, select the CP 341, open Properties and click Parameter…. When the dongle is detected, the Modbus-Slave entry is enabled (blue envelope icon).
2. FC 01/05/15 tab — clear FC 15 if coil writes are not required. For 16-bit register writes only, leave this tab on its default values.
3. FC 03/06/16 tab — enable FC 03, FC 06, and FC 16. Enter the starting DB word (DBWn) of the register window, e.g., DB10.DBW0. The wizard treats this entry as the first register address accessible to the master; register 0x0000 will map here.
4. Limits tab — set MIN DBW to the same starting offset as in step 3, and MAX DBW to the offset of the last register that the master may access. For two consecutive DBs the limits must remain inside the smaller DB number; do not span DBs.
5. DB layout in the CPU — ensure the data blocks exist physically (DB10 and DB11) and contain the required number of WORD values. CP 341 will not create the DBs.
6. Compile HW Config and download to the CPU and the CP. The parameters are pushed to the CP only after a full download.
7. Rebuild the slave DB from the example project on the dongle diskette to obtain a clean instance DB; mismatched instance DBs cause the slave to silently reject FC 16 even with correct parameter blocks.

The Limits tab is the single most common source of exception 0x02. The CP 341 checks every FC 06/FC 16 request against MIN DBW ≤ target ≤ MAX DBW; if either bound is violated, the CP returns 0x02 without consulting the application program.

DB Address Constraints and Kilobyte Boundary Rules

The Modbus slave firmware inside CP 341 supports a maximum of 511 data words (0..510) per data block. Additional hard rules:

Keep the target register count small and the offset low. A configuration of DB10.DBW0..DB10.DBW99 (100 words) is straightforward; DB10.DBW500..DB10.DBW520 requires the firmware to support a split range and frequently fails on older CP 341 versions. Where a wider register space is required, deploy multiple CP 341 stations or split the address map across two lower-numbered DBs (for example, registers 0..255 in DB10 and registers 256..511 in DB11) and configure two separate parameter blocks in the wizard.

Firmware Update Procedure

1. Identify the current firmware under HW Config → CP 341 → Module Information. Note the hardware version and MLFB.
2. Download the latest firmware/HSP from the Siemens Industry Online Support portal. Search for the MLFB of the CP 341 to obtain the matching firmware file (e.g., CP341_V3.0.0.upd).
3. Open SIMATIC Manager → PLC → Update Firmware, select the CP 341 slot, and load the upgrade file. The CP reboots; do not power down during update (typical 90-180 s).
4. Re-download the HW Config and re-transfer the example project. Verify the CP boots without SF/BF errors and that the Modbus slave dongle LED indicates a healthy state.
5. Re-test FC 06/FC 16 from the master. The firmware defect behind exception 02 is reproducible on V 1.x and is corrected in V 2.0.x and later for the 1BH02 module.

Verification Procedure

1. From the Modbus master, issue a read against register 0. Expect FC 03 success. If this fails with 0x02 the slave image DB has not been loaded.
2. Issue a single-register write to register 0 using FC 06. Expect success and a read-back value equal to the written value.
3. Issue a multi-register write using FC 16 covering at least two consecutive registers. Expect success and consistent echo on read-back.
4. Issue a write that intentionally targets a register outside the configured limits. Expect exception 0x02, confirming that the limit checking is now working correctly.
5. Capture the slave's Modbus trace from HW Config → CP 341 → Diagnostics → Modbus Trace and verify the request/response match the application intent.

Troubleshooting Matrix

Related Configuration Points

The Modbus slave wizard also exposes tabs for FC 02 (Read Discrete Inputs) and FC 04 (Read Input Registers). These are read-only by design; a master attempting FC 05/06/15/16 against the input range receives exception 0x02 by specification. If the master must write, ensure the registers live in the holding-register map configured on the FC 03/06/16 tab, not on the FC 04 input map.

The Data Transmission tab controls the frame format (start bits, data bits, parity, stop bits, baud rate). A mismatch with the master baud rate does not produce 0x02 but produces timeout/no response. The baud rate must match exactly between CP 341 and the master device.

For RS-485 multidrop applications, the CP 341 acts as a slave on the bus. Bias resistors and termination (typically 120 Ω) must be present at both ends of the bus and the CP must be configured for RS-485 half-duplex operation in HW Config. Reversed A/B polarity looks identical to a frame error and is sometimes misdiagnosed as an address problem.

Safety and Operational Notes

Frequently Asked Questions