Siemens CP 341 Modbus RTU Communication: Fixing Event 0E44 Error

1. Problem Overview

A Siemens S7-300 station configured as a Modbus RTU master using a CP 341 (RS422/485) on a CPU 315-2DP fails to exchange any data with a Modbus RTU slave. All physical-layer indicators on the CP remain dark: SF, TXD, and RXD LEDs are off, the CP does not generate a single character on the bus, and the FB8 P_SND_RK "send" block rejects the request the instant REQ is set. The status word returned by FB8 reports event class 0E44, which the Siemens Modbus master manual documents as: "The value of the transferred parameter 'Amount of bits' is out of range (1-2040)".

This symptom set — no transmission, immediate REQ reject, error counter increments at the same scan that REQ rises — is the classic signature of an invalid LEN / source-DB combination being handed to the Modbus master dongle firmware, not a hardware fault.

2. Affected Hardware and Software

Reference documentation: CP 341 Point-to-Point Communication, Installation and Parameter Assignment Manual and the Loadable Driver for Point-to-Point CPs, Modbus Protocol RTU Master manual (entry ID 25362836).

3. Symptoms and LED Diagnostic Matrix

Before assuming a parameter fault, map the observed LED pattern to a fault class. The CP 341 front panel has four relevant indicators for the RS422/485 variant: SF, TXD, RXD, and the green "CP active" LED on the right of the connector.

The user's reported pattern — SF off, TXD off, RXD off, 0E44, error counter increments the same scan that REQ rises — pins the fault to Section 4.

4. Root Cause: Event 0E44

Event 0E44 is documented in the Modbus master manual as a parameter validation error raised when the value passed in LEN to FB8 P_SND_RK lies outside the legal range of 1 to 2040 bits, or — more commonly — when the implied amount of bits derived from LEN and the function code's data footprint is inconsistent.

The CP 341 Modbus master does not transmit the request when the LEN does not match the function-code-specific expected request length. This is intentional: the dongle firmware validates the job against a fixed table (Chapter 6.1 of the Modbus master manual) before granting bus access. If the LEN is wrong, the request is rejected internally, the bus is never driven, and TXD never pulses.

Event 0E44 is one of a family of 0E4x parameter errors emitted by the Modbus master dongle:

Reference: Chapter 7 of the Modbus master manual (Siemens entry 25362836) — "Diagnostics and error messages".

5. Pre-Flight Diagnostic Checklist

Walk this list in order before modifying the FB8 call. Each item eliminates a class of fault and takes seconds to verify in STEP 7 / TIA Portal (legacy STEP 7 for S7-300).

1. Dongle presence. Open the sub-D backshell of the CP 341 and confirm the small EEPROM dongle (Siemens order number 6ES7870-1AA01-0YA0) is seated in its socket, label side up.
2. Dongle firmware load. In HW Config, right-click the CP 341 → Object Properties → Parameter Assignment. The Modbus master protocol must be selected in the protocol slot. The driver is downloaded to the CP on the next CPU-to-CP parameter assignment; verify with PLC → Module Information → Diagnostic Buffer — no event 1E0DH ("Request canceled due to complete restart, restart, or reset") should appear after the first download.
3. LED state on cold start. Power-cycle the CPU. SF must be OFF. If SF stays RED, the dongle or driver is rejected at startup — the Modbus master driver must be reloaded.
4. CP interface diagnostic. In STEP 7 PLC → CP 341 Diagnostics → Status, verify the CP reports Protocol = Modbus Master, the configured baud rate (e.g., 9600), parity (typically Even), and character framing (8E1 for Modbus RTU).
5. Cabling. For RS485 2-wire: T/R+ (pin 3) → A, T/R− (pin 8) → B, shield bonded at one end only, 120 Ω termination at each end of the bus segment, no star topology.
6. Slave address and framing match. Confirm the Modbus slave's address, baud rate, parity, and stop bits match the CP 341 parameter assignment exactly.
7. FB7 / FB8 instance DBs. The Modma example project ships instance DBs for FB7 and FB8; do not regenerate them by hand or the LEN-derived offsets will be lost.

6. FB8 P_SND_RK — Required LEN per Function Code

FB8 P_SND_RK receives a Modbus request frame from the user DB and hands it to the CP. The CP does not build the frame; you do. The frame is stored in the source data area starting at DB_NO.DBB_NO, and the user provides only the Modbus PDU payload — slave address is prepended by the CP for RTU transmissions in master mode (verify against the manual revision you use; some versions require the slave address as byte 0 of the source area).

The LEN parameter passed to FB8 must equal the number of user-data bytes listed above for the chosen function code. If LEN is set to a fixed value (a common error: hard-coding LEN := 5 for every function code), the dongle raises 0E44 on the first call that does not match.

6.1 Worked Example — Function Code 03 (Read Holding Registers)

To read registers 40001..40002 (qty = 2) from slave 1:

// DB100 — Send buffer (instance of FB8 source area)
DB100.DBB0  := B#16#00;   // Hi address of 40001 = 0
DB100.DBB1  := B#16#00;   // Lo address of 40001 = 0
DB100.DBB2  := B#16#00;   // Hi quantity = 0
DB100.DBB3  := B#16#02;   // Lo quantity = 2

// FB8 call
CALL FB8, DB108 (
    REQ    := M127.0,
    R      := FALSE,
    LADDR  := 256,           // Logical base address of CP 341
    DB_NO  := 100,           // Source data block
    DBB_NO := 0,             // Start byte in source DB
    LEN    := 4,             // 4 bytes of user PDU (NOT 6 — slave addr excluded)
    R_TYP  := 'W',           // Wait for response
    TVAL   := T#2S,          // Response timeout
    DONE   := M150.0,
    ERROR  := M150.1,
    STATUS := MW152
);

If the CP dongle revision expects the slave address as the first source byte, prepend a fifth byte and set LEN := 5. Always cross-check the example Modma project shipped with STEP 7 — its working LEN values are the canonical reference.

6.2 Worked Example — Function Code 16 (Write Multiple Registers)

To write registers 40010..40012 (qty = 3) on slave 1 with values 0x1122, 0x3344, 0x5566:

DB100.DBB0  := B#16#00;     // Hi start address = 0
DB100.DBB1  := B#16#09;     // Lo start address = 9  (0-based: register 40010)
DB100.DBB2  := B#16#00;     // Hi quantity
DB100.DBB3  := B#16#03;     // Lo quantity = 3
DB100.DBB4  := B#16#06;     // Byte count = 6 (2 bytes * 3 registers)
DB100.DBB5  := B#16#11;     // Reg 1 Hi
DB100.DBB6  := B#16#22;     // Reg 1 Lo
DB100.DBB7  := B#16#33;     // Reg 2 Hi
DB100.DBB8  := B#16#44;     // Reg 2 Lo
DB100.DBB9  := B#16#55;     // Reg 3 Hi
DB100.DBB10 := B#16#66;     // Reg 3 Lo

CALL FB8, DB108 (
    REQ    := M127.0,
    LADDR  := 256,
    DB_NO  := 100,
    DBB_NO := 0,
    LEN    := 11,            // 5 header + 6 data
    R_TYP  := 'W',
    TVAL   := T#2S,
    DONE   := M150.0,
    ERROR  := M150.1,
    STATUS := MW152
);

The most common 0E44 trigger on FC16 is LEN := 4 (the value used for FC03/06 read/write single) reused without recomputation for a write-multiple job.

7. Source DB Layout and the LEN ↔ DB_NO Coupling

The CP 341 Modbus master reads LEN bytes from DB_NO starting at byte DBB_NO. Three error classes arise from mis-sizing this region:

1. LEN too small — the CP reads a truncated PDU, finds the implied amount of bits inconsistent, raises 0E44.
2. LEN too large — the CP reads past the end of the DB, raises 0E45/0E46.
3. LEN field left at default — STEP 7 default for FB8 LEN is 0; a 0-length request is always rejected.

Always declare the source DB with at least DBB_NO + LEN bytes initialized to known values. Use ARRAY[0..63] OF BYTE as a safe container and fill bytes explicitly before each REQ pulse.

8. Dongle, Driver, and CP Firmware

The CP 341 does not contain Modbus RTU master firmware in its base EPROM. The Modbus master functionality is delivered as:

• A physical dongle (EEPROM key) inserted in the CP 341 sub-D shell. Without it, the CP boots but rejects every Modbus request. SF will be on red if the dongle is detected but empty; SF stays off if the dongle is absent and the protocol is not selected, but the request still fails with 0E1E.
• A loadable driver ("Modbus Protocol RTU Format, S7 is Master") downloaded to the CP from STEP 7. The driver version must match the dongle and the CP hardware revision. The current driver at time of writing supports CP 341-1CH02 (6ES7341-1CH02-0AE0) and CP 341-1BH02 (RS232 variant).

Verify both are present and matched by opening SIMATIC Manager → Options → Set PG/PC Interface → CP341 (PROFIBUS) and using the CP Parameter Assignment tool to read the active protocol. If the tool shows "No protocol loaded", the driver download did not complete — repeat after a full power cycle.

9. RS485 Cabling and Termination

Once the parameter fault is resolved and TXD begins to pulse, RS485 physical-layer faults become the next likely failure source. Apply the following to a 2-wire RS485 bus:

• Use twisted-pair cable with characteristic impedance near 120 Ω (e.g., Belden 3106A).
• Install 120 Ω termination resistors at both ends of the bus segment, between A and B only. Remove terminations on stub devices.
• Maximum stub length: 0.3 m at 19.2 kbps, shorter at higher baud rates. For 115.2 kbps keep stubs below 0.1 m.
• For long cables or noisy environments, add a 680 Ω pull-up to +5 V on A and a 680 Ω pull-down to ground on B at the master end (fail-safe bias).

10. Step-by-Step Resolution

1. Power down the S7-300 station. Open the CP 341 sub-D shell and confirm the Modbus master dongle is inserted.
2. Power up. Observe SF — must be OFF. If SF is ON, re-download the Modbus master driver to the CP and repeat.
3. Open the Modma example project in STEP 7. Compile the entire S7 program (CPU 315-2DP, FB7, FB8, instance DBs, OB1, OB100).
4. Download hardware configuration (HW Config) including the CP 341 with the Modbus master protocol slot configured (baud rate, parity, character frame, response timeout).
5. Download the S7 program. Go online. Force a cold restart (OB100 → FB100 INIT_DONE pattern runs, FB7/FB8 instance DBs are re-initialized).
6. Open the FB8 instance DB (e.g., DB108) in online view. Confirm DB_NO, DBB_NO, LEN, LADDR, TVAL are populated correctly for the chosen function code.
7. Open the source DB (e.g., DB100) in online view. Pre-fill the PDU bytes for function code 03, slave 1, reading register 0, quantity 1: 00 00 00 01. Set LEN := 4.
8. Set M127.0 (= REQ) TRUE for one scan. Observe FB8 outputs: DONE should pulse, ERROR stays FALSE, STATUS = 0000h on success.
9. Check the CP 341 front panel: TXD should pulse, then RXD should pulse on the slave's reply. If TXD still does not pulse, the LEN is still wrong — return to step 7.
10. If TXD pulses and the slave does not respond, verify slave address, parity, and termination per Section 9.

11. Verification Procedure

After the link is operational, validate sustained operation:

1. In OB1, watch FB8.DONE rising-edge — this indicates a successful send. FB7.NDR rising-edge indicates a successful receive. Both must toggle at the configured poll rate.
2. In PLC → CP 341 Diagnostics → Statistics, confirm the Frames sent counter is incrementing at the expected rate, Frame errors received is zero, and CRC errors is zero.
3. For a 16-bit register read (FC03), inspect the receive buffer DB (assigned to FB7 by DB_NO/DBB_NO): slave address byte, function code echo, byte count, and the requested register data must be present and consistent with the slave's response.
4. Force a deliberate slave-side fault (e.g., request a non-existent register). FB8 ERROR should rise, and STATUS should report the appropriate exception code per Modbus spec (e.g., 0x02 for "Illegal Data Address").
5. Power-cycle the CPU and confirm the link comes back up without manual intervention — the OB100 initialization must hand a valid parameter set to the CP on every restart.

12. CP 341 Diagnostic Event Reference (CP 341 manual, Chapter 7)

Source: CP 341 manual, Appendix A — Diagnostic Events.

13. Modbus Function Code Quick Reference

14. Alternate Controllers and Migration Notes

For new installations on S7-1200 or S7-1500, the CP 341 is no longer used; instead:

• S7-1200: Use the CM 1241 (RS232 or RS485) communication module with the MODBUS_PNP_MASTER instruction from the S7-1200 library. LEN semantics are replaced by direct input parameters DATA_ADDR, DATA_LEN, and DATA_PTR.
• S7-1500: Use PtP communication modules (CM PtP) with the MODBUS_PNP_MASTER instruction from the S7-1500 library.
• S7-300 with ET 200S / PTP: The Modbus/PN gateway or a CP 341-1CH02-0AE0 remains the standard hardware path. The driver and FB interface described in this article apply unchanged.