S7-300 CP341 Modbus Master: Configuring FC03 and FC06 Writes

S7-300 CP341 Modbus Master: Configuring FC03 and FC06 Writes

The Siemens CP341 point-to-point communication module turns an S7-300 CPU into a Modbus RTU master or slave using the loadable Modbus Master or Modbus Slave driver (order numbers 6ES7341-1xH02-0AE0 drivers). Combining Function Code 03 (Read Holding Registers) and Function Code 06 (Write Single Register) on the same CP341 is fully supported, but several field traps cause the two function codes to interfere when both are active in the same scan. This reference walks through the diagnostic logic, the meaning of the +4.0 address field for each function code, and the DONE/ERROR sequencing pattern that prevents job collision.

1. Overview of the CP341 Modbus Master Driver

The Modbus Master driver replaces the standard ASCII/3964R driver on the CP341 and provides parameter assignment, message framing, and CRC handling automatically. The driver exposes two system function blocks:

The driver uses two cooperating data blocks:

• Configuration DB (e.g., DB42) — holds the Modbus job parameters per slot (slave address, function code, starting register, register count, destination DB number, destination DBW offset).
• Send/Receive data DB (e.g., DB43) — the user data buffer where the response is stored.

The Siemens sample project "PTP_Modbus_Master" (entry ID 109482710) seeds a working single-job application. Multi-function-code applications must extend this template.

2. Prerequisites

• Hardware: S7-300 CPU (any 31x series), CP341 module (6ES7341-1AH02-0AE0 for RS-232, or 1BH02-0AE0 for RS-485/422) with hardware revision ≥ 4 for the Modbus master driver, RS-485 bus terminator (120 Ω at both ends), and a Modbus slave (any vendor, e.g., a Modbus simulator running on a PC).
• Driver license: The Modbus Master driver is a loadable firmware that ships as a separate license. Install via SIMATIC Manager → Options → Install CP PtP Driver using the driver disk referenced in the CP341 manual (entry 1117393).
• Software: STEP 7 V5.5 SPx (entry ID 109751376) or compatible, S7-PLCSIM optional.
• Slave tool: MODSIM (Modbus Tools) or any Modbus slave simulator supporting FC03 and FC06.

3. Hardware Configuration and Driver Loading

Open the hardware configuration (HW Config) and double-click the CP341 slot. In the Parameter dialog select the protocol Modbus Master (RS-485) and configure the baud rate, parity, and stop bits to match the slave. Load the configuration to the CPU. The CP341 will now accept the Modbus Master driver blocks.

The Modbus Master driver requires the following FB/DB pattern in OB1 (or OB35 for cyclic polling):

1. CALL P_SND_RK, DB50 — with SEND_DB = DB42 (configuration), SEND_DBB_NO = 0 (job slot start), SNDLEN = 32 (job size), RTS_ON = TRUE.
2. CALL P_RCV_RK, DB51 — with RCV_DB = DB43 (data), RCV_DBB_NO = 0, RTS_OFF = TRUE.
3. Evaluate STATUS, ERROR, and DONE outputs of P_SND_RK before triggering the next request.

Reference the official CP341 manual chapter "Modbus Master Driver — Function Blocks" for the exact I/O layout of P_SND_RK and P_RCV_RK.

4. Function Code 03 (Read Holding Registers) Job Layout

For FC03 the configuration DB slot uses the following fields (assuming DB42 as the Modbus Master configuration DB):

With FC03 the field at offset +4.0 of the job slot is the quantity of registers to read. The driver reads N consecutive registers starting at the configured start register and writes N words into DB43 beginning at the destination offset.

5. Function Code 06 (Write Single Register) Job Layout

For FC06 the configuration DB slot fields have a different meaning at the same offset:

FC06 writes exactly one register; the field that FC03 interpreted as "register count" is the actual data payload for FC06. This is the root cause of the cross-function-code conflict that this article addresses.

6. The Critical Difference: +4.0 Address Field Semantics

Both function codes use the same configuration DB slot, but DBW4 (often labeled "Address +4.0" in STEP 7 LAD/FBD) is reused:

• FC03: DBW4 = LEN (register count).
• FC06: DBW4 = register value to write.

If a single configuration DB slot is rewritten alternately with FC03 and FC06, the value written into DBW4 must be reloaded between each trigger to reflect the new function code's interpretation. Failing to do so yields the symptom described in the field report: a constant value of 8 appearing at DB43.DBW0, because DBW4 retains the prior value (8) when the FC03 job has just finished and the FC06 job overwrites it with its current length-thinks-value semantics.

7. Sequential Trigger Logic with DONE/ERROR

The CP341 master is single-threaded — it can only execute one outstanding request at a time. The correct polling pattern between FC03 and FC06 is a strict state machine: Idle → FC03 Trigger → FC03 Wait (DONE|ERROR) → Idle → FC06 Trigger → FC06 Wait (DONE|ERROR) → Idle.

Recommended implementation in LAD/FBD on the trigger input of P_SND_RK:

1. Use two boolean tags (e.g., M10.0 = "FC03 pending", M10.1 = "FC06 pending") instead of a free-running clock bit.
2. In the FC03 branch, unconditionally write DB42.DBW0 = 3, DB42.DBW2 = slave, DB42.DBW4 = LEN, DB42.DBW6 = start register, DB42.DBW8 = 43, DB42.DBW10 = 0. Then set REQ = M10.0 AND NOT FC03_BUSY.
3. On rising edge of DONE or ERROR from P_SND_RK, clear M10.0.
4. In the FC06 branch, unconditionally write DB42.DBW0 = 6, DB42.DBW2 = slave, DB42.DBW4 = value, DB42.DBW6 = target register, then set REQ = M10.1 AND NOT FC06_BUSY AND NOT FC03_BUSY.
5. On rising edge of DONE or ERROR, clear M10.1.

The clock-bit pattern shown in the field report is the source of the duplication bug: a periodic clock fires regardless of DONE, so the next job can start before the prior one completes. This corrupts the configuration DB before P_SND_RK has finished reading it.

8. Source DB Isolation Strategy

Two viable strategies prevent FC03 and FC06 from corrupting each other's job slots.

8.1 Single Send DB with Overwrite Discipline

Use one configuration DB (DB42) with one job slot, but rewrite the entire slot before each trigger. This is the leanest approach and works for a small number of function codes. It is sensitive to scan-time races because the same slot is shared. Recommended only when both function codes are guaranteed to interleave at DONE boundaries (see Section 7).

8.2 Separate Send DB per Function Code

Use two configuration DBs:

• DB42 — FC03 jobs: dedicated to read-holding-register jobs.
• DB44 — FC06 jobs: dedicated to write-single-register jobs.

Each function block call references its own DB. The application code can interleave them safely because the destination DBs are physically separate. This pattern scales cleanly when adding FC05 (Force Single Coil) and FC16 (Write Multiple Registers).

9. Function Code 16 (Write Multiple Registers) as a Substitute for FC06

If the application needs to update multiple holding registers per write transaction, FC06 cannot be used — FC06 always writes exactly one register. Per the Modbus protocol reference, FC16 (Write Multiple Registers) accepts up to 123 contiguous registers in a single request and is functionally a superset of FC06 for writes greater than one register. Verify the slave device supports FC16 by reading its Modbus reference manual; many VFDs and energy meters expose only FC06, in which case the application must loop the FC06 request or upgrade the slave firmware.

FC16 can also be used to write a single register (set Quantity of Registers = 1 and provide a two-byte data payload), but the slave's exception behavior must be checked — some slaves reject FC16 with quantity=1 if FC06 is supported.

10. Common Fault Matrix

11. Verification Steps

After implementing the corrected polling sequence, validate with these checks:

1. Online watch DB42: Confirm that DBW0 alternates between 3 and 6 and that DBW4 is overwritten each time with the appropriate value (LEN for FC03, DATA for FC06).
2. Online watch DB43: Confirm that after FC03 completes, DB43.DBW0 holds the value the slave exposes at the start register. After FC06 completes, the slave's tool (MODSIM or slave HMI) shows the same value at the target register.
3. Force a known FC06 write from STEP 7 watch table: Set M10.1 = TRUE; observe that the slave register changes and that P_SND_RK DONE rises within the configured timeout (default 2000 ms).
4. Force a slave-side register change: Use MODSIM to update a holding register; confirm that the next FC03 read returns the new value at DB43.DBW0.
5. Cross-check exception handling: Program a target register one above the slave's valid range; observe exception code 02 returned and ERROR=TRUE with STATUS showing the exception.
6. Disconnect the slave: Verify that ERROR=TRUE is asserted within the timeout window and that the application does not hang.

12. Best Practices for Field Deployments

• Always drive the master trigger from DONE/ERROR feedback, never from an unconditional clock or pulse generator. The clock pattern introduces race conditions that corrupt the configuration DB.
• Use a single watchdog timer in the application to detect a stuck master state (no DONE/ERROR transition within N seconds) and force a P_SND_RK restart.
• Maintain the Modbus slave address map in a documentation table and cross-check it against the S7 program comments to avoid off-by-one errors between STEP 7 (0-based) and slave (1-based) addressing.
• For more than two function codes, build a "job queue" of FC/LEN/ADDR/VALUE entries in a DB and dispatch one per cycle. This scales to FC05, FC06, FC16, and FC23 without rewriting the master state machine.
• Configure CP341 to 19200 8E1 for industrial VFDs and 9600 8N1 for most energy meters — confirm from the slave manual before commissioning.