1. Problem Overview
A Siemens SIMATIC S7-300/S7-400 CP 341 point-to-point communication module is configured for Modbus RTU master operation. Function code 16 (Write Multiple Registers) succeeds against two Modbus slaves, but function code 03 (Read Holding Registers) returns no response. Symptoms observed on a STEP 7 (Classic) project:
- P_RCV_RK (FB 7) call returns with NDR = FALSE, ERROR = FALSE, and STATUS = 0.
- No flashing occurs on the CP 341 front-panel LED indicators TF (transmit flash) and RX (receive).
- The request data block contains a syntactically correct Modbus RTU read frame:
01 03 00 58 00 01(slave 1, function 3, register 0x0058, quantity 1). - No diagnostic buffer entry is generated on the CP.
2. CP 341 Modbus RTU Architecture
The CP 341 is loaded with one of three loadable drivers: ASCII, 3964(R), or Modbus RTU master/slave. The Modbus RTU driver is firmware-driven and converts the request buffer supplied by the CPU into a complete Modbus RTU frame, appending the CRC-16 automatically. The communication blocks used in the STEP 7 user program are:
| Block | Type | Direction | Function |
|---|---|---|---|
| FB 7 / FB 8 | P_RCV_RK / P_SND_RK | CPU → CP | Pass request to CP 341, receive response, manage RS-232/RS-485 handshaking |
| FB 21 / FB 22 | P_SEND / P_RCV | CPU → CP | Generic ASCII send/receive (not used for Modbus) |
| FC 21 / FC 22 / FC 23 | Configuration | One-time | Hardware configuration and loadable driver load |
| MODB_341 | Modbus slave FB | CPU → CP | Initializes the CP 341 as a Modbus slave (alternative master use cases) |
For master mode the loadable driver parameter "Protocol" must be set to "Modbus Master". The CP 341 then accepts a user-formatted request buffer (without CRC) and a configured response timeout.
3. Correct Read Request Frame (Function Code 03)
The CP 341 Modbus RTU master expects the request buffer to contain only the Modbus PDU without CRC. For a read holding register request to slave 1 at starting address 88 decimal (0x0058), length 1 register, the buffer must be:
| DBB Offset | Hex Value | Meaning |
|---|---|---|
| DBB 0 | 0x01 | Slave address (1 – 247) |
| DBB 1 | 0x03 | Function code (Read Holding Registers) |
| DBB 2 | 0x00 | Starting address high byte |
| DBB 3 | 0x58 | Starting address low byte (0x0058 = 88) |
| DBB 4 | 0x00 | Quantity high byte |
| DBB 5 | 0x01 | Quantity low byte (1 register) |
This is exactly the frame the operator placed in DB 1026. The CP 341 will append CRC-16 (low byte first) automatically before transmitting. CRC-16 must not be placed in the request buffer — doing so produces an 8-byte frame with corrupted content and most slaves will reject it.
4. Why P_RCV_RK Never Sets NDR
The user program polls P_RCV_RK with the LADDR, DB_NO and DBB_NO parameters of the receive DB. The block returns:
- NDR = TRUE only when a complete, error-free Modbus response has been received and copied into the configured receive DB.
- ERROR = TRUE only when the CP 341 itself detects a transport-layer or framing error on the received bytes (parity, overrun, CRC mismatch).
- STATUS is the supplementary event or error code.
With Modbus RTU, however, P_SND_RK is the block that finalizes the request. The sequence is:
- CPU triggers P_SND_RK with REQ = TRUE, LADDR, DB_NO, DBB_NO, LEN = 6.
- The CP 341 transmits the frame, switches the transceiver to receive, and waits up to the configured response timeout.
- If a valid Modbus response arrives, P_SND_RK completes with DONE = TRUE and the response is buffered internally on the CP.
- P_RCV_RK is then called to copy the buffered response payload into the user DB. Only at this point does NDR come on.
- If no valid response is received before the response timeout, P_SND_RK completes with ERROR = TRUE and a Modbus status code in STATUS. P_RCV_RK is never satisfied, and NDR remains FALSE.
5. Root Cause Classification
The reported symptoms map to one of the following classes of root cause. They are listed in the typical order of occurrence on commissioning:
| # | Root cause | Indicators | Verification |
|---|---|---|---|
| 1 | Wrong Modbus driver loaded (ASCII instead of Modbus Master) | TF does not flash, no response on bus monitor, P_SND_RK returns STATUS 0xE0xx range | Open HW Config → CP 341 properties → Parameter → Protocol = "Modbus Master"; reload driver via FC 21/FC 23 |
| 2 | RS-485 termination / bias missing or A/B polarity reversed | TX LED flashes, RX does not, slaves never ACK | Measure idle bus voltage with DMM; install 120 Ω termination and fail-safe bias |
| 3 | Response timeout shorter than slave latency | First read works, later reads time out intermittently | Increase "Response Timeout" parameter to ≥ 1000 ms in CP 341 properties |
| 4 | Two masters on the bus (CP 341 + another master) — bus contention | Reads occasionally return garbage, slaves never respond to CP 341 | Disconnect all other masters; check RS-485 driver enable logic |
| 5 | Function code or register range not supported by slave | TX flashes, slave echoes nothing, no RX | Reduce to function 03 against register 0, length 1; refer to slave datasheet |
| 6 | Baud rate / parity mismatch | Slaves ignore all frames, bus monitor shows framed output | Verify CP 341 baud rate and parity match slave (typically 9600 8E1) |
| 7 | MODB_341 / CP_START not executed (only relevant for slave mode or after restart) | All functions fail after restart | Trigger CP_START on rising edge once after each CPU restart, per MODB_341 documentation |
6. Step-by-Step Diagnostic Procedure
Follow this sequence to localize the failure before replacing hardware.
Step 6.1 — Inspect P_SND_RK outputs
Wire the DONE, ERROR and STATUS outputs of FB 8 P_SND_RK to flags. The most common status codes for Modbus RTU on CP 341 are:
| STATUS (hex) | Meaning | Action |
|---|---|---|
| 0x0000 | Transmission still active / no result yet | Continue polling; check REQ was a single pulse |
| 0x0001 | DONE — valid response received | Proceed to evaluate P_RCV_RK |
| 0x0E81 | Response timeout — slave did not answer | Check bus wiring, slave address, response timeout |
| 0x0E82 | Frame error — parity / stop bit / overrun | Check baud rate, parity, cable length |
| 0x0E83 | CRC-16 error on received frame | Check grounding, termination, baud rate |
| 0x0E84 | Length of response does not match expectation | Verify LEN of request matches function code requirements |
| 0x0E85 | Exception response received from slave | Read exception code in response DB (DBB 1) |
| 0x0F31 | CP 341 not configured for Modbus Master | Reload loadable driver, verify protocol selection |
Step 6.2 — Capture the diagnostic buffer
- In STEP 7, right-click the CP 341 in the project tree and select “Module Information” → “Diagnostic Buffer”.
- Look for entries containing “Point-to-point” or “Modbus”. The buffer records every protocol error with a timestamp and a Siemens event ID.
- Event ID 0x0300 means “transmit completed, no response” — this confirms the CP transmitted the frame and the slave did not answer.
- Event ID 0x0301 means “frame error on reception” — the slave answered, but the bytes were corrupted.
- If the buffer is empty, the CP never received a valid REQ from P_SND_RK — the problem is in the user program, not on the wire.
Step 6.3 — Validate the request on the wire
Connect a Modbus RTU sniffer or a USB-to-RS-485 adapter running any Modbus master test tool to the bus. Issue the identical request (01 03 00 58 00 01) from the test tool. If the slave responds, the bus and slave are healthy and the problem is strictly between CPU and CP 341. If the slave does not respond to the test tool either, the bus wiring, slave power, or slave configuration is the root cause.
Step 6.4 — Check the loadable driver
In HW Config, double-click the CP 341 and open the “Parameter” tab. The selected “Protocol” must read “Modbus Master” (or “Modbus Slave” if the CP is acting as a slave — not applicable to this case). If the protocol is still ASCII, the bytes are transmitted verbatim and the slave will not interpret them as Modbus. Re-load the driver through FC 21 / FC 23 (or use the included Modbus driver load tool) and restart the CPU.
Step 6.5 — Verify REQ is a single rising edge
P_SND_RK triggers transmission on a 0→1 transition of REQ. If REQ remains high for the entire cycle, the block will not retrigger; if REQ flickers, multiple frames will collide. The recommended pattern is to set REQ for one cycle on completion of the previous request:
IF "send_done" OR "send_error" THEN
"send_req" := FALSE;
END_IF;
IF "start" AND NOT "busy" AND NOT "send_req" THEN
"send_req" := TRUE;
"start" := FALSE;
END_IF;
Step 6.6 — Confirm CP_START behavior for the loadable driver
When the CP 341 is configured as a Modbus slave, the MODB_341 instruction must be initialized on every cold or warm restart of the CPU by pulsing CP_START. For Modbus master operation, MODB_341 is not used; the loadable driver is self-initializing once the protocol parameter is set. See the MODB_341 Modbus slave instruction for CP 341 manual for the slave-specific sequence.
7. Parameter Table for the CP 341 Modbus Master
Set the following parameters in HW Config → CP 341 → Properties → Parameter:
| Parameter | Recommended value | Note |
|---|---|---|
| Protocol | Modbus Master | Must match the loadable driver on the CP |
| Baud rate | 9600 (or match slave) | Common values: 1200, 2400, 4800, 9600, 19200, 38400 |
| Parity | Even | Modbus RTU default; many devices also support None + 2 stop bits |
| Data bits | 8 | Fixed for Modbus RTU |
| Stop bits | 1 (with parity) / 2 (no parity) | Match slave exactly |
| Response timeout | 1000 ms (range 5 – 65500 ms) | Must exceed slave turnaround + bus propagation |
| Pause time (3.5 char) | Auto / 4 ms @ 9600 | Set explicit if multi-vendor slaves coexist |
| Flow control | None (RS-485) / RTS-CTS (RS-232) | RS-485 half-duplex does not require RTS |
8. Common Configuration Errors
- Handshaking pins not connected: On RS-232 the CP 341 expects CTS to be looped back to RTS when no hardware flow control is used. Some cable assemblies omit this loop; the CP will refuse to transmit without CTS active.
- RS-485 transceiver direction not handled: The CP 341 includes an internal RS-485 transceiver. If an external transceiver is wired in parallel, the direction control must be from the same CP. Two drivers on the bus will corrupt frames.
- Shared shield ground creating ground loop: A ground potential > 7 V between CP 341 and slave will cause intermittent CRC errors. Use isolated repeaters or an RS-485 isolator.
- Cable length exceeding Modbus limit: RS-485 at 9600 baud supports up to 1200 m. Higher baud rates reduce the maximum length proportionally. For multi-drop, derate by 50%.
9. Verification After Fix
- Open the receive DB in STEP 7 in online mode. With function 03 and length 1, the response layout will be
01 03 02 HH LL(slave 1, function 3, byte count 2, register high, register low). NDR goes high, then the application must reset NDR after copying the data. - Observe the CP 341 LEDs: TF (transmit flash) must blink on each request, and RX (receive) must blink when a slave responds.
- Trigger a cyclic read of 10 registers and verify the data updates in the receive DB at the configured cycle rate.
- Disconnect the bus and re-connect; the master should re-establish communication within one response timeout cycle without CPU restart.
10. Field-Proven Commissioning Checklist
- Single-slave bench test before connecting to the full bus.
- Default Modbus RTU parameters: 9600 8E1, response timeout 1000 ms, slave address 1.
- Use FC 21 / FC 23 to download the Modbus Master loadable driver, not the ASCII driver.
- Confirm P_SND_RK returns STATUS = 0x0001 (DONE) on a successful read.
- Confirm P_RCV_RK NDR goes high only after P_SND_RK DONE has fired.
- Capture one full exchange with a Modbus sniffer to confirm CRC and timing.
11. Standards Reference
Modbus RTU framing, function codes, and exception codes are defined by the Modbus Organization specification:
- Function code 03 — Read Holding Registers, 1 to 125 registers per request.
- Exception codes: 0x01 Illegal Function, 0x02 Illegal Data Address, 0x03 Illegal Data Value, 0x04 Slave Device Failure.
- Inter-frame silence ≥ 3.5 character times at the configured baud rate.
Why does P_RCV_RK NDR never come ON when reading Modbus slaves on a CP 341?
P_RCV_RK is a passive receive block on the CP 341. It only sets NDR after P_SND_RK has already returned DONE = TRUE. If the slave does not reply within the response timeout (default 1000 ms), P_SND_RK ends with ERROR and STATUS 0x0E81, and P_RCV_RK never receives data. Check the STATUS output of P_SND_RK first.
What STATUS code on P_SND_RK means the slave did not answer?
STATUS = 0x0E81 indicates a response timeout. The CP transmitted the request, the line is physically OK, but no reply was received within the configured response timeout. Typical causes are wrong slave address, wrong register range, missing RS-485 termination, or response timeout too short for the slave latency.
Do I need to append the Modbus CRC-16 in the request DB buffer on CP 341?
No. The loadable Modbus Master driver on the CP 341 calculates and appends the CRC-16 automatically. The request buffer must contain only the Modbus PDU: slave address, function code, and data. For function 03 the buffer length is 6 bytes.
How do I check the Modbus protocol loaded on the CP 341?
Open HW Config, double-click the CP 341, and read the "Protocol" field in the Parameter tab. It must say "Modbus Master". If it reads "ASCII", re-load the Modbus Master driver with FC 21 and FC 23 and restart the CPU.
Is MODB_341 required for Modbus master operation on CP 341?
No. MODB_341 is the slave-side initialization FB and must be called once after a cold or warm restart when the CP is acting as a Modbus slave. For Modbus master operation, the loadable driver is self-initializing and only requires the correct protocol parameter in HW Config.