Resolving Siemens CP 341 Modbus Master Error 0E62H Illegal Data

Problem Overview

A Siemens CP 341-1CH01-0AE0 configured as a Modbus RTU master is communicating physically with a PC-based Modbus simulator acting as a slave over an RS-485 link, but every read request returns the CP 341 status code 0E62H. The CP 341 LEDs TxD and RxD blink continuously, the simulator reports incoming requests, and the RS indicator on the slave window flashes on every transaction. The hardware and link layer are therefore alive, but the application layer is failing.

The relevant field configuration is:

• Module: 6ES7 341-1CH01-0AE0 (CP 341 RS-485 half-duplex)
• Driver: Loadable Modbus Master RTU parameter set
• Baud: 19 200 bit/s
• Frame: 8 data bits, 1 stop bit, no parity (8N1)
• Slave address: 1
• Function code: 03 (Read Holding Registers)
• Data start address: 520
• Register count: 4
• Converter: RS-485 ↔ RS-232 at the PC COM1

The send-done bit of the master block never sets, and the ERROR bit latches the value 0E62H. According to the CP 341 Modbus Master manual, this status is the wrapper around Modbus exception code 02 (Illegal Data Address) returned by the slave.

Decoding 0E62H

The CP 341 Modbus master block (typically FB 8 P_SND_RK from the SIMATIC Modbus Master library) packages the slave's exception response into a 16-bit status word. The low byte reflects the Modbus protocol layer; the high byte reflects the Modbus exception code returned by the slave.

Reference: Siemens documentation of the Modbus master error codes is also published for the SIMATIC AX (S7-1500) Modbus-RTU blocks at Error codes of the ModbusMaster - SIMATIC AX. The exception-classification convention is the same.

Modbus Holding-Register Addressing Rules

The most common source of 0E62H is the legacy Modicon addressing convention embedded in modern Modbus tools. Holding registers are referenced as 4xxxx, where the offset is 1-based:

Modicon register 4xxxx = xxxx − 40001 = zero-based address

The master block on the CP 341 always works in zero-based register addressing. A request with start address 520, quantity 4 therefore maps to:

• Modicon 40521 through 40524
• Zero-based holding registers 520 through 523
• PDU start address byte = high byte 0x02, low byte 0x08 (decimal 520)

If the PC-based simulator is configured for Modicon (4xxxx) view, the user must declare that registers 40521..40524 exist; otherwise the simulator responds with exception 02. Conversely, if the simulator is purely zero-based, the user must declare registers 520..523. Either way, the slave simulator must have the address range pre-allocated in its data table before it will answer.

Diagnostic Workflow

Use the following sequence to isolate the failure layer before touching application code:

1. Confirm the green status LED on the CP 341 shows RUN with no SF/BAF fault.
2. Open the Modbus driver's online diagnostics in STEP 7 → CP 341 → Diagnostics; verify the driver's protocol state is Operating.
3. Capture a frame on the RS-485 bus with a serial analyser (or use the simulator's frame window) to confirm the request on the wire is exactly 01 03 0208 0004 xx xx (no extra bytes, correct CRC).
4. Capture the slave's reply. The reply must be either a normal PDU or an exception PDU beginning with 01 83 02 xx xx (function-code high bit set, exception code 02, exception CRC).
5. If the reply is an exception PDU, the link is fine and the problem is data-model. If no reply is captured, the link is broken and no amount of addressing change will help.

Loopback Test with Function Code 08

Before changing any data address, run the Modbus diagnostic loopback (function code 08, sub-function 0000). This is the canonical "is the wire alive?" test and does not touch the slave's data table at all.

Send the following request from the master:

A healthy slave will echo 01 08 00 00 A5 C3 <CRC> unchanged. The CP 341 status will be 0000H on success. If FC08 fails, the problem is in the physical layer, the RS-485/RS-232 converter, or the simulator's port settings — not the data model. Reference: this loopback is the same procedure recommended in the CP 341 Modbus master manual and matches the diagnostic pattern documented in the AutomationDirect Modbus error code reference.

Step-by-Step Resolution

1. Verify serial parameters match on both ends. Open the simulator's COM port setup and confirm 19 200 / 8N1 / no flow control. RS-485 is half-duplex — disable hardware handshaking entirely on the COM port.
2. Run the FC08 loopback test. If the loopback fails, fix the wiring, the converter (A/B polarity, ground), and the COM port first. Do not proceed until FC08 returns 0000H.
3. Open the simulator's holding-register table. Most PC simulators (e.g. Modbus Poll, Modbus Slave by WinTech, CAS Modbus Scanner) keep a separate Map or Setup dialog where the user must pre-allocate the 4xxxx range they want to expose. Add registers 40521..40524 (or 0..523 in zero-based view) and assign them test values.
4. Send a one-register read from the CP 341 at address 0, quantity 1. If this returns 0E62H, the simulator's holding-register area is still empty — go back to step 3.
5. Once address 0 returns OK, sweep upward. Request address 520, quantity 1 (not 4). If that fails but address 519 succeeds, the simulator's table ends just before 520 — extend the table by at least 5 registers.
6. Restore the original request (address 520, quantity 4) and confirm the send-done bit sets with no error.
7. Force values in the simulator at the target addresses and verify them via Monitor/Modify on the CP 341 input area (DB or PIW, depending on the FB's DATA_PTR configuration).

CP 341 Hardware and Driver Reference

The CP 341 family has three electrically distinct variants sharing the same Modbus loadable driver:

The Modbus master driver is loaded into the CP 341 from the PtP Param tool in STEP 7 / SIMATIC Manager, and the FB instance is created in the user program. The relevant FBs from the SIMATIC Modbus master library are:

• FB 8 P_SND_RK — sends a Modbus request and waits for the reply
• FB 7 P_RCV_RK — receives an unsolicited Modbus request (slave mode)
• FB 9 P_PRT_RK — port-control / reset

The status output of P_SND_RK (typically STATUS / ERROR / STATUS word on the instance DB) carries the codes in the table above. Treat the high byte as the Modbus exception class and the low byte as the protocol-layer detail.

RS-485 Topology and Termination

RS-485 is differential and half-duplex. Termination and bias matter even on a bench test:

• Install a 120 Ω termination resistor at each end of the bus, between A and B. On a master–slave bench with only two nodes, terminate at both ends.
• Add fail-safe biasing (typically 680 Ω pull-up to +5 V on B and 680 Ω pull-down to GND on A) if the simulator's transceiver does not include it. Some RS-485/RS-232 converters (e.g. cheap USB dongles) omit the bias and the bus floats when idle, producing intermittent framing errors.
• Tie the signal-ground reference between the CP 341's terminal block and the converter's ground. RS-485 tolerates ground potential differences up to ±7 V common-mode; beyond that, frames corrupt silently.
• Keep the cable under 1 200 m at 19 200 bit/s. For bench work, a shielded twisted pair under 5 m is fine.

Related Modbus Exception Codes

The complete Modbus exception set, identical across the CP 341, the SIMATIC AX Modbus master (Siemens reference), the Eaton easyE4 Modbus TCP client (Eaton reference), and the C-more / CLICK Modbus master (AutomationDirect reference) is:

Verification Checklist

After the fix, confirm the following on every power-up:

1. CP 341 SF LED is off; TxD and RxD flicker on every transaction.
2. The master block's DONE output pulses high for one cycle on every successful read.
3. The ERROR output remains low (or pulses only on genuinely failed transactions).
4. The STATUS word is 0000H on success.
5. Forced values in the simulator appear in the configured DB words within one scan of DONE rising.
6. Cycle time of the master call is at least 50 ms (slave turnaround) plus the link-frame time (8 bytes × 10 bit-time at 19 200 = ~4.2 ms). With quantity 4, plan for ~10 ms per transaction; do not poll faster than 50 ms.

Edge Cases and Field Notes

• Modicon offset confusion on the slave side: Some simulators treat the user's input as zero-based by default. If you ask for "520" in the master and "520" in the simulator, but the simulator's holding-register area is exposed only from 0 to 100, the slave will still respond with exception 02. The fix is on the slave side, not the master side.
• Function code 3 vs function code 4: FC03 reads holding registers; FC04 reads input registers. If the slave has only input registers, FC03 will always return 0E62H. Switch to FC04 if the data is read-only by the slave.
• Quantity limit: Modbus defines a PDU size limit of 253 bytes. For FC03/04 with 2 bytes per register, that is a maximum of 123 registers per request. The CP 341 master block typically limits the quantity to 125 by default; requesting 4 is well within the limit and not the cause here.
• Address-1 confusion in STEP 7: The Modbus master block in STEP 7 expects the address as it appears in the Modbus PDU (zero-based). The PLC programmer is responsible for any +1 conversion. This is the opposite of some SCADA drivers that take a 1-based address. Verify which convention your block uses before assuming an off-by-one.
• Slave ID = 0 (broadcast): On RTU, address 0 is broadcast for write-only operations. A read request with slave ID 0 will return exception 02 on most slaves.
• Endianness of the response: A successful read will place register 40521 into the first word pointed to by DATA_PTR and 40522 into the next. If the byte order looks reversed, the issue is not 0E62H but a Big-Endian/Little-Endian swap. The CP 341 default is Big-Endian (Modbus standard); some third-party slaves reverse the bytes.

Comparison: How Other Platforms Report the Same Fault

The pattern is uniform across vendors: any master that follows Modicon-style exception framing will surface exception 02 as a data-model fault, not a link fault.

Frequently Asked Questions