Siemens S7-300 to Mitsubishi FX3U Modbus RTU Communication Setup

Integrating a Mitsubishi FX3U as a remote I/O island or process data gateway under a Siemens S7-300 master is one of the most common mixed-vendor tasks in brownfield automation. The CPU 315-2 DP that the source request identifies is well suited to the master role because it exposes a Profibus DP master port and an MPI/DP selectable port, but neither of those ports is natively Modbus RTU. To exchange cyclic register data with an FX3U you must add the correct serial or Ethernet module on the S7-300 side and the matching RS-485 or Ethernet adapter on the FX3U. This reference walks through three viable topologies, then drills into the most robust one: Modbus RTU on RS-485 using a Siemens CP341 or CP340 module against an FX3U-485-BD.

1. Three Topologies That Actually Work

The discussion in the source thread points to Profibus DP and Modbus RTU modules for the FX3U. Field experience shows the following three options are the only ones you should consider for a 315-2 DP based system:

Option A is the one to implement first because it removes every gateway from the data path. Option B is mandatory only when the cable spec has to stay Profibus. Option C is the right answer for greenfield Ethernet. The rest of this article documents Option A in full; sections near the end cover B and C so you can pivot if a constraint forces your hand.

2. Hardware Prerequisites and Bill of Materials

Verify the following against your panel layout before you start the HW Config:

• Siemens S7-300, 6ES7315-2xxx-xx (CPU 315-2 DP variant). The integrated X2 port is Profibus DP master. It will not run Modbus RTU directly.
• Siemens CP341 communication processor. Order number 6ES7341-1CH02-0AE0 (RS-485/RS-232, one serial port, loadable Modbus master driver). Alternative: 6ES7341-1AH01-0AE0 (RS-232 only). Verify the firmware on the front of the module; revision 2 or higher is required for the Modbus loadable driver.
• Mitsubishi FX3U base unit. Any FX3U-XXMR/MT with a recent enough firmware (V2.30 or later) supports Modbus RTU slave mode on the RS-485 channel.
• Mitsubishi FX3U-485-BD (onboard board adapter, uses the top left option slot, occupies option slot 1). This module is the cheapest and most common FX3U RS-485 front end.
• FX3U-CNV-BD (required if you want to stack a FX3U-485ADP instead of a BD board).
• Shielded twisted-pair cable, e.g. Belden 3106A or Lapp ETHERLINE 2x2x0.34, terminated with characteristic impedance near 120 Ω.
• 120 Ω bus terminator resistors at both physical ends of the RS-485 segment. Many FX3U-485-BD modules have a DIP switch to enable an internal 110 Ω terminator; do not double-terminate.
• STEP 7 V5.5 or V5.6 with HSP (Hardware Support Package) for CP341-1CH02 installed.
• Mitsubishi GX Works 2 (V1.590 or later) or GX Developer V8.91Z. GX Works 3 is for FX5U; do not use it for FX3U.

3. CPU 315-2 DP Interface Identification

The CPU 315-2 DP in the source request exposes:

• X1 (MPI/DP, selectable): Used for programming and HMI. Leave it at MPI default unless the DP cable is mandatory.
• X2 (Profibus DP master): 9-pin Sub-D female, electrically isolated, 9.6 kbit/s to 12 Mbit/s. Default slave address 2. Profibus master diagnostics are read through SFC 13 (DPNRM_DG).

Although X2 is the most convenient physical port, it cannot speak Modbus RTU. Profibus DP requires a DP slave at the far end, and the FX3U does not ship with a native DP slave module. The hardware-relevant CP341 is therefore the simplest, most direct path. Plug the CP341 into any free slot of the central rack (UR or ER), preferably slot 4 to keep the S7-300 addressing window contiguous.

4. CP341 Wiring for Half-Duplex RS-485

The 6ES7341-1CH02 uses a 15-pin Sub-D female connector. The RS-485 signals are on the following pins (TIA-485-A polarity):

The CP341 in RS-485 two-wire mode is not isolated port-to-port. Place a 120 Ω resistor across A-B at the CP341 end and a second 120 Ω at the FX3U end, then disable the FX3U-485-BD internal terminator DIP (SW1 pins 1-2 OFF) so you do not exceed 60 Ω total. Maintain a 24 VDC isolated supply on the CP341 to keep bias within common-mode range.

5. STEP 7 HW Config Setup for CP341

Open SIMATIC Manager, then HW Config. Drag the CP341 from the catalog at SIMATIC 300 > CP-300 > CP341 > 6ES7341-1CH02-0AE0. Place it on a free slot. Double-click the CP341 to open the properties dialog and set the Modbus RTU protocol parameters:

Save and compile. The CP341 should appear in the rack with no diagnostic LEDs lit. If the SF LED is red, the loadable driver is not installed; insert the Modbus driver MMC or use the License Manager to import the license into the project.

6. Installing the Modbus RTU Loadable Driver on the CP341

The CP341 ships with a Modbus RTU driver on a separate floppy/MMC, or it can be downloaded from the Siemens support portal. To install:

1. Insert the CP341 MMC containing "Modbus Master RTU" into the programming device.
2. In HW Config, right-click the CP341 and choose "Loadable Driver..."
3. Select "Modbus Master RTU" and click Install.
4. If the driver is not on the MMC, copy the file modbus_m.fwc (or the equivalent for the firmware version) into C:\Program Files\Siemens\Automation\S7\cp341_driver\ and re-run the dialog.
5. Compile and download HW Config to the CPU.

Verify the protocol field in CP341 properties now shows "Modbus master RTU" and not "ASCII". If the property remains locked, you have an HSP mismatch; update the HSP for the CP341 from the Siemens support page and repeat.

7. S7-300 Modbus Master Programming with FB7 and FB8

Siemens ships the Modbus master function blocks FB7 (P_SND_RK, send) and FB8 (P_RCV_RK, receive) as part of the Modbus driver. Both blocks are found in the Standard Library under Communication Blocks. They run on the S7-300 CPU and use a shared instance DB that the wizard generates.

Insert the following in OB1 (cyclic):

// One-shot trigger for a Modbus request
      A     M      10.0          // Master enable
      AN    M     200.0          // Busy from FB8
      S     DB30.DBX   0.0       // Trigger request

// FB7 Send block
      CALL  FB    7 , DB30
      REQ   :=DB30.DBX0.0
      R     :=FALSE
      LADDR :=256                 // Logical base address of CP341
      DB_NO :=100                 // Send data DB
      DBB_NO:=0                   // Offset in send DB
      LEN   :=6                    // Length of send buffer (function code + address + count)
      R_..  :=                     // not used by Modbus driver
      DONE  :=M30.0
      ERROR :=M30.1
      STATUS:=MW32

// FB8 Receive block (always call, will block until response)
      CALL  FB    8 , DB30
      EN_R  :=TRUE
      R     :=FALSE
      LADDR :=256
      DB_NO :=101                 // Receive data DB
      DBB_NO:=0
      LEN   :=100                 // Maximum expected response length
      NDR   :=M30.2
      ERROR :=M30.3
      STATUS:=MW34
      SRT_TIMEOUT:=FALSE

To read Modbus holding registers 40001 to 40016 from slave 1, build the request in DB100 as follows (FB7 always sends the Modbus function code 03 for read holding registers):

DB100 (Send buffer, 6 bytes):
  Byte 0  = 0x01       // Slave address 1
  Byte 1  = 0x03       // Function code: read holding registers
  Byte 2  = 0x00       // Start address high
  Byte 3  = 0x00       // Start address low
  Byte 4  = 0x00       // Quantity high
  Byte 5  = 0x10       // Quantity low (16 registers)

The CP341 will transmit this as 0x01 0x03 0x00 0x00 0x00 0x10 0xC4 0x0B (last two bytes are the Modbus CRC appended automatically by the driver). The slave's reply is stored in DB101 starting at byte 0 with the slave address, function code, byte count, then the requested word data.

8. Generating the Modbus DB with the Parameter Assignment Tool

Manually hand-rolling the request DB is error prone. Use the CP341 "Parameter Assignment Tool" (PT) that ships with STEP 7. Right-click the CP341 in HW Config and select "CP341: Parameter Assignment Tool". Build a job list of Modbus commands, one row per request. The tool exports the request DB directly and creates the instance DB for FB7/FB8. The same tool sets:

• Slave address (1 to 247)
• Function code (01, 02, 03, 04, 05, 06, 15, 16)
• Modbus start address (0-based, so register 40001 is entered as 0)
• Quantity (1 to 125 for 03/04, 1 to 1968 for 01/02)
• Source or destination S7 data area (DB, M, I, Q, PI/PQ)
• Polling interval and priority

This tool removes almost all of the manual FB7/FB8 work and is the recommended approach.

9. Mitsubishi FX3U Modbus Slave Configuration in GX Works 2

Switch to GX Works 2 and open the FX3U project. The serial channel for the FX3U-485-BD is "ch1". Open the parameter tree and expand PLC Parameter > PLC System (2). Set the following special relays and data registers:

D8120 in detail: bits set per the FX3U manual. H0C86 hex expands to b15..0 = 0000 1100 1000 0110, which the manual decodes as: 19200 baud, even parity, 1 stop bit, 8 data bits, no header/terminator, RS-485 (2-wire) mode. Any deviation from the CP341 parameters results in silent framing errors and SF on the CP341.

10. Modbus Register to FX3U D-Register Mapping

The FX3U in Modbus RTU slave mode maps the Modbus holding register space onto the D register block. The mapping is direct: Modbus holding register n (1-based) corresponds to FX3U D-register n (decimal). For example:

Avoid using the FX3U special D-register ranges (D8000 to D8511) for Modbus data. Although the FX3U will write to them, you risk losing watchdogs, link registers, and timing values. Reserve D5000 to D5099 as a clean Modbus landing area; this also makes it trivial to gate Modbus data with a protection condition in the ladder.

11. Sample Ladder: Reading a Holding Register from the FX3U Slave

On the S7-300 side, with the request from section 8 complete and DB101 populated, extract the data:

// The Modbus reply layout is:
//   Byte 0   = slave address
//   Byte 1   = function code (03)
//   Byte 2   = byte count N
//   Byte 3.. = N data bytes (high, low, high, low, ...)
//   Last 2   = CRC (stripped by FB8 for DB_NO destination; check FB docs)

      L     DB101.DBB  3         // First data byte = high byte of D0
      T     DB50.DBB   0         // Copy into your application DB
      L     DB101.DBB  4         // Low byte of D0
      T     DB50.DBB   1
      L     DB101.DBB  5         // High byte of D1
      T     DB50.DBB   2
      L     DB101.DBB  6         // Low byte of D1
      T     DB50.DBB   3

For more than 16 words, use SFC 14 (DPRD_DAT) to read the CP341 receive DB in a single call, then a loop with pointer arithmetic. Avoid accessing DB101 byte-by-byte in OB1 for 100+ word transactions; it bloats scan time.

12. Writing to the FX3U with Function Code 16

To push data from S7-300 into the FX3U, use Modbus function code 16 (Preset Multiple Registers). The request layout is:

Send DB layout (8 + 2N bytes for N registers):
  Byte 0  = 0x01           // Slave address 1
  Byte 1  = 0x10           // Function 16
  Byte 2-3= 0x0000         // Start address high/low
  Byte 4-5= 0x00NN         // Quantity N high/low
  Byte 6  = 2*NN           // Byte count
  Byte 7..= data            // Register values, high byte first

Configure the request in the CP341 Parameter Assignment Tool, choose FC16, start address 499, quantity 10, source S7 DB 50 starting at byte 0. The tool generates the request for you and the CP341 handles the CRC. Confirm the FX3U received the data by reading M8062 (serial error) and D8063 (error code) and the target D registers via the monitor window.

13. CP341 SF LED and Error Code Reference

When the SF (red) LED on the CP341 is lit or flashing, read the diagnostic buffer (SFC 59 RD_REC) and check STATUS at the FB7/FB8 outputs. Common STATUS values:

14. FX3U Serial Error Flags (M8061 to M8069) Decoded

The FX3U maintains dedicated error flags for the ch1 serial port. Drive the FX3U into RUN with the programming cable and monitor these relays in GX Works 2:

The D-register companion codes (D8061, D8062, D8063, D8064, D8067) carry the exact error sub-code as a decimal integer; consult the FX3U Programming Manual for the per-flag code list.

15. Option B: Profibus DP Master to FX3U via Gateway

If cable plant forces Profibus DP, the canonical approach is a Profibus DP slave to Modbus RTU master gateway. Common choices that have been used in field retrofits:

• Helmholz DP/Modbus coupler (e.g. 700-972-0BA12). Configure the GSD file in HW Config, then map the Modbus registers into the gateway's process image; the gateway itself is a Profibus DP slave to the CPU 315-2 DP and a Modbus RTU master to the FX3U.
• ProSoft PLX31-PBM-MBS for higher throughput. Configures via ProSoft Configuration Builder, exposes up to 800 bytes of process data per direction.
• Anybus X-gateway Profibus to Modbus RTU. Compact DIN-rail form factor, well supported by HMS technical support.

At commissioning, the FX3U side stays configured per sections 9-12 above. On the Siemens side, the gateway is added to the Profibus network as a DP slave with the GSD file. The gateway configuration tool defines how many bytes of input and output process data map to which Modbus holding registers. Cyclic I/O exchange then rides on Profibus, the gateway converts, and the FX3U sees plain Modbus RTU.

16. Option C: Modbus TCP with FX3U-ENET-ADP

If a CP343-1 Lean is already on the S7-300 rack and the panel has a managed Ethernet switch, switch the integration to Modbus TCP. The FX3U-ENET-ADP supports Modbus TCP server on a configurable port (default 502). Use Siemens FB "MB_CLIENT" (or, for older S7-300, the Modbus TCP library from the SIMATIC Modbus/TCP PN-CPU package) to issue 03/16 transactions. The advantages over RTU: no character timing, error detection built into TCP, easy to bridge across plants. The disadvantages: extra license on the CP343-1 in older firmware revisions, and you must open port 502 in any panel firewall.

17. Topology Diagram (SVG)

18. Verification and Acceptance Test

Once hardware is wired and parameters are loaded, run a four-step acceptance test before handing the panel to operations:

1. Physical check: A-to-B polarity, shield on one end only, both terminators 120 Ω. Use a multimeter to confirm 60 Ω between A and B with both ends powered.
2. Frame visibility: Open STEP 7 Online > CP341 Diagnostics > "Monitor". Issue a single FC03 read of register 0. Verify the raw hex on the wire matches what you expect: 01 03 00 00 00 0A C5 CD for 10 registers from slave 1.
3. Loopback test: From the S7-300, write a known pattern to the FX3U (e.g. D5000 = 0x1234, D5001 = 0x5678). Read it back. Both must match exactly. If D5000 reads back as 0x3412, you have a byte-swap issue; insert SWAP logic in the S7 application layer.
4. Sustained load: Run for 30 minutes with polling at 50 ms. Check CP341 SF LED stays off, FX3U error flags M8061-M8069 stay off, and the S7-300 scan time does not grow more than 5 ms. If any error is latched, capture the diagnostic buffer before clearing.

19. Performance and Timing

A single FC03 read of 16 words at 19200 baud takes roughly: 8 bytes request (~4.2 ms) + 37 bytes reply (~19.4 ms) + 10 ms turnaround = ~34 ms per transaction. With 4 reads and 2 writes per cycle, the S7-300 spends about 200 ms per second on Modbus traffic. This is acceptable for process I/O but marginal for high-speed interlocks. If the application demands faster updates, move to 115200 baud (reduce per-transaction time to ~6 ms) or change to Profibus DP via a gateway, which runs at 1.5 Mbit/s and updates in 2 to 10 ms per cycle.

20. Field-Proven Caveats

• The CPU 315-2 DP integrated ports cannot run Modbus RTU. Do not waste time looking for a "Modbus master" checkbox in HW Config for X1 or X2. The only Modbus RTU master on an S7-300 platform is a CP341 with the loadable driver, or a CP440/CP441 with the Modbus master option.
• The FX3U Modbus RTU slave implementation does not support broadcast (slave address 0). Treat the S7-300 as the only master; daisy-chaining a second master (HMI, drive) on the same ch1 causes collisions.
• If you later migrate to an FX5U, replace the FX3U-485-BD with the FX5-485-BD. The D-register mapping is preserved, but the Modbus enable is now SM8171 (not M8171) and D8120 becomes SD8210. The CP341 side is unaffected.
• Conductor length between CP341 and FX3U should be kept under 500 m at 19200 baud. Beyond that, switch to 9600 or move to Ethernet (Option C).
• If the CP341 SF LED lights immediately after switching the FX3U from STOP to RUN, the FX3U reset D8120 to the default (D8120 = 0). The default is 9600 baud with no parity; D8120 must be reloaded on every cold start. Add a step in the FX3U ladder that always sets D8120, D8121, and M8171 on first scan.

21. Related References and Standards

For deeper detail, cross-check the following primary sources:

• Siemens CP341 manual entry page
• Siemens Modbus RTU loadable driver documentation
• Mitsubishi FX3U series product page
• Mitsubishi FX3U Series User's Manual - Hardware Edition
• Modbus Application Protocol V1.1b3 specification