Resolving Modbus TCP No-Response on Sinamics CU310-2 PN

1. Problem Overview

A Sinamics S120 CU310-2 PN control unit appears to negotiate a TCP session with the external client (LabVIEW, SCADA, or Modbus master) because the COM LED on the drive turns green and the Starter / Startdrive diagnostic page stops reporting an alarm. Despite this, every Modbus request (Function Code 03) issued by the client returns no valid response: either the transaction times out, the master logs an exception code, or the TCP socket is closed by the drive mid-frame. This is one of the most common integration issues when first commissioning a CU310-2 PN with non-Siemens clients.

The fault is recoverable, but the root cause is rarely on the wire layer. In almost every reported case the physical link, IP addressing, and PROFINET interface are healthy. The drive is simply ignoring valid Modbus PDUs because the request targets an address the firmware does not recognise, or Modbus TCP has not been activated in the drive parameter image.

2. CU310-2 PN Modbus TCP Architecture

The CU310-2 PN is the compact control unit for the Sinamics S120 drive family. It exposes two PROFINET ports (X150 P1, X150 P2) and an Ethernet service port (X127). Modbus TCP can be transported on the same PROFINET interface using TCP port 502; it is logically a parallel service to PROFINET RT/IRT and does not require a PROFINET controller to be present.

Because Modbus TCP is overlaid on the same PROFINET MAC/PHY, the drive must explicitly be told that Modbus is allowed on that interface. Out of the box, only PROFINET is enabled. Without this activation step the TCP socket still opens (which is why the COM LED goes green and the alarm clears) but the Modbus application layer is not registered, so request PDUs are silently dropped.

3. Root Cause Analysis: Why the Drive Stays Silent

There are only three practical reasons a CU310-2 PN opens a TCP connection on port 502 yet never returns a Modbus response:

1. Modbus TCP is not enabled in the drive parameter set. The TCP listener is opened by the Ethernet stack before the Modbus application is initialised. If the drive is configured for PROFINET-only operation, the listener accepts the socket to keep the network manager quiet, then discards incoming Modbus PDUs.
2. The client is sending the 4xxxx reference number instead of the protocol-relative register address. Siemens documentation lists registers using the conventional 4xxxx notation (e.g. 40100 for the status word). Modbus on the wire expects a zero-based address. 40100 must be transmitted as register 99, not 100. This is the single most common integration error and is the precise symptom reported in the source case.
3. The client is targeting a register that the drive has not implemented. Sinamics implements a fixed map of control/status words plus a parameter access window; reading an unmapped register returns no exception, just silence, unless the drive's exception handler is enabled (r2050 / fault masking).

4. Configuration Prerequisites

Before opening a Modbus session, confirm the following on the CU310-2 PN:

• The drive has a valid IP address, subnet mask, and gateway assigned to X150 P1 (or P2). The X127 service port does not carry Modbus TCP by default.
• PROFINET device name is assigned (or the interface is set to DHCP / transparent). An unnamed PROFINET device still works for Modbus, but name resolution and DCP queries should be disabled on the client side to avoid delays.
• The drive firmware is at a revision that supports Modbus TCP on the CU310-2 PN. Early firmware branches on the CU310-2 (pre-V4.x) implemented Modbus only on certain hardware variants. Confirm with the Siemens Industry Online Support firmware release notes for your specific 6SL3 order number.
• The client device can reach the drive IP on TCP/502 and the firewall is not blocking inbound replies.

5. Enabling Modbus TCP in the Drive

Modbus TCP must be explicitly selected as an allowed communication protocol. With STARTER or Startdrive online:

1. Go to Communications → PROFINET / Ethernet in the drive navigator.
2. Open the Modbus TCP subnode and tick Activate Modbus TCP.
3. Set the listening port (default 502) if a non-standard port is required.
4. Configure the connection timeout (p2040) and the number of allowed parallel connections (p2041 / p2042 depending on firmware).
5. Save and Copy RAM to ROM, then perform a power-cycle or issue p0977 = 1 for the changes to take effect.

When the activation is stored but not yet executed, the COM LED will still go green on TCP connect — that is the symptom that confuses integrators. After the next boot the Modbus application will be registered with the TCP stack and request PDUs will be dispatched to the handler.

6. Register Map and Function Code Reference

The CU310-2 PN implements the standard Sinamics Modbus map. The most useful registers for a typical read/write client are:

The parameter access window starting at 4xxxx reference 40300 is the most powerful feature. Each pair of registers encodes one Sinamics parameter:

• Register pair low: parameter number (e.g. p1120 = 1120 decimal = 0x0460).
• Register pair high: parameter index (default 0) in the high byte and the read/write flag in the low byte.
• Next register pair: parameter value (signed 32-bit, low word first).

This mechanism allows a Modbus client to read and write any drive parameter that is exposed on the standard access channel, including ramp times, current limits, encoder settings, and fault memory. The detailed encoding is described in the SINAMICS S120/S150 List Manual and the SINAMICS S120 Communication Function Manual available through the Siemens Industry Online Support portal.

7. Register Address Conversion: The 40001 Offset

Modbus on the wire uses a zero-based register address in the PDU. The 4xxxx notation used in documentation is a legacy display convention: the leading '4' indicates a holding register, and the trailing digits are 1-based. To convert:

Worked example for the status word:

• Documentation: 40100 (Status Word 1)
• Protocol value: 40100 − 40001 = 99
• Read request: Function Code 03, starting register 0x0063 (= 99), quantity 1

A common mistake is to send register 100 (decimal) or 0x0064. The drive replies to neither. It does not raise an exception code 02 (Illegal Data Address) for every request — most firmware revisions only return an exception if the address window is completely invalid. A valid address that points to an unimplemented word simply returns zeros, which many clients interpret as a timeout or "no response."

8. Step-by-Step Commissioning

1. Wire and address. Connect to X150 P1, assign a static IP, ping the drive from the Modbus client machine.
2. Enable Modbus TCP in the project as described in Section 5 and save to ROM.
3. Cycle power to the control unit. The Modbus application registers with the TCP stack only after a fresh boot.
4. Open a raw TCP socket to port 502 using a Modbus master test utility (Modbus Poll, mbpoll, pymodbus console, NI Modbus Library in LabVIEW). Do not skip this step — a working socket does not imply a working Modbus PDU.
5. Read register 0 (4xxxx 40001) with FC 03. Expect 1 register back. If empty, the activation step failed.
6. Read register 99 (4xxxx 40100) with FC 03. Expect the current Status Word 1 of the drive.
7. Write register 199 (4xxxx 40200) with FC 06 to a value such as 0x047E (control word: ON, no coast stop, no quick stop, enable ramp, enable setpoint, ramp enable, enable speed). Read 40100 back and verify the relevant bits transition.
8. Read parameter p1120 via the parameter access window at 4xxxx 40300 / 40301. Confirm the ramp-up time is readable.

Only after step 6 succeeds should the LabVIEW or SCADA application be reconfigured to use the corrected addresses. This isolates client-side framing bugs from drive-side configuration bugs.

9. LabVIEW and SCADA Client Configuration

National Instruments' LabVIEW ships a Modbus Library that hides the protocol details behind VIs such as MB Modbus Master Query.vi. The IP address, port, and function code are configured, but the starting address is still the zero-based register number. The typical LabVIEW mistake is to enter the documentation reference (40100) directly; LabVIEW will then attempt to read holding register 40100, which the drive silently discards.

Configuration checklist for LabVIEW:

• Set Unit ID / Slave Address to 0 or 255 (Sinamics ignores Unit ID; do not rely on a specific value).
• Set Function Code to 03 for reads, 06 for single-register writes, 16 for multi-register writes.
• Set Starting Address to the 0-based value (e.g. 99 for ZSW1, 199 for STW1).
• Set Quantity of Registers in the range the drive supports (typically 1–125 per request).
• Set the connection timeout to at least 1000 ms for the first transaction; drop to 250–500 ms once stable.

For SCADA packages (WinCC, Ignition, FactoryTalk, iFIX), the equivalent configuration is the Modbus device driver — map the 4xxxx reference minus 40001 to the tag address. Most drivers allow either notation; choose the 0-based option for Sinamics.

10. Diagnostics and Error Codes

When the drive does respond but the data is wrong, use these diagnostics:

Use the drive's Web server (default at http://<drive-ip>/) to confirm online diagnostics: the Communication page shows the active protocol, the number of open Modbus connections, and the last exception code received. This is the fastest way to confirm whether the drive is even seeing the request PDU.

11. Troubleshooting Matrix

If the pass criterion at any layer fails, fix that layer before moving to the next. The most common failure point in the field is the application layer (the 40001 offset), but only after the activation step is verified should the integrator trust the client-side address configuration.

12. Field-Proven Notes and Caveats

• The Unit ID byte in the Modbus TCP MBAP header is not evaluated by Sinamics. Always set it to 0xFF on the client side to avoid any vendor-specific handling on later firmware revisions.
• If a PROFINET controller is also connected to the CU310-2 PN, do not assume Modbus TCP and PROFINET share the same setpoint. The PROFINET controller and the Modbus master can fight for the same control word bits; if you see the drive toggling, write 0x0000 to STW1 from one of the two sources before commissioning.
• Modbus TCP is unencrypted. Do not expose the drive's PROFINET interface to a corporate network without a firewall. Use a dedicated commissioning VLAN.
• For multi-axis S120 lines, each CU310-2 PN needs its own IP. The Modbus port is the same (502) on all, so distinguish by IP, not port.
• For deeper PC-side Modbus configuration reference, see the TIA Portal — Setting up communication with Modbus TCP guide, which covers the same protocol fundamentals from a CPU-side perspective.