Troubleshooting the CP341 as a Modbus RTU Slave to a Schneider Modicon M340 Master

The CP 341 communication processor turns an S7-300 / S7-400 station into a serial Modbus RTU device. When wired to a Schneider Modicon M340 master across an RS485 2-wire segment, the configuration can fail in subtle ways: LEDs stay dark, request telegrams produce exception responses, or the master reads garbage data. This reference consolidates field-proven diagnostics for the 6ES7 341-1CH02-0AE0 (RS422/485 variant, firmware V2.1.6) running the MODB_341 Modbus slave driver, including the meaning of ERROR_NR = 16#005C / ERROR_INFO = 16#1E0D, the correct RS485 pinout, and the integration points with Unity Pro / EcoStruxure Control Expert.

1. Problem Description

A typical field ticket reads as follows:

• CPU 31x-2 (S7-300) is loaded with a project that calls FB7 P_SEND, FB8 P_RCV, and FB80 MODB_341 with instance DB80.
• The CP 341 is configured through the Modbus Slave parameterization tool (PtP Param) for 9600 bit/s, 8E1, Modbus RTU, slave address 1..247.
• After download, the Modicon M340 (BMX P34 2020 / BMX NOM 0200 serial card) executes READ_VAR or MBP_MSTR against the S7-300.
• The CP 341 RXD/TXD LEDs stay OFF; later, RXD blinks occasionally and the slave reports ERROR_NR = 16#005C, ERROR_INFO = 16#1E0D.

2. Hardware Identification

Before any software change, confirm the exact CP 341 variant. The RS232 and RS422/485 modules are not interchangeable — they use different backplane transceivers and front connectors.

The Modicon M340 BMX NOM 0200 / BMX NOM 0200H serial module provides two RS485 2-wire ports (RJ45) supporting Modbus RTU master. Verify the master port's electrical standard with the BMX NOM 0200 product page and the Modicon M340 Platforms and Modules documentation.

3. Root Cause Analysis

3.1 LED Behaviour

The CP 341 RXD and TXD LEDs are character-driven, not line-state driven. Reference the Siemens SIMATIC S7-300 CP 341 manual (A5E00337632) Section 4.3 "Status and Error LEDs".

• RXD OFF, TXD OFF: Line idle. No character has been received since the last power-on or last successful frame.
• RXD flashes briefly, TXD never lights: CP 341 detects the start bit, processes the frame, but the request is malformed, addressed to a different slave ID, or contains an unsupported function code. The CP discards the telegram silently and the master times out.
• RXD flashes, TXD flashes: Round-trip response. The CP processed a valid request and returned a reply (data or exception telegram).
• SF (red) ON: Group error — diagnostic buffer of the CP holds an entry.

3.2 Error Code 0x005C / 0x1E0D

The MODB_341 / FB80 error structure populates two values:

FB7 P_SEND returning status 0 is a normal handshake idle value. It does not indicate an error — the function block simply has no active request.

If the master requests an address range that is not mapped in the MODB_341 instance DB, the CP returns an exception telegram (function code | 0x80) and the master records an "illegal data address" or "illegal function" error. Both sides must agree on the coil, holding-register, and input-register mapping.

3.3 Most Common Root Causes (ranked by frequency)

1. Damaged CP 341 transceiver (confirmed in this case) — the front-end IC has failed from a surge, mis-wired termination voltage, or hot-plug.
2. RS485 A/B polarity inversion — terminals labelled R(A) and R(B) must be twisted together; many third-party cables swap them.
3. Mismatched baud / parity / stop bits between CP 341 PtP parameter assignment and the M340 Modbus master port configuration.
4. Wrong slave ID in the MODB_341 parameter set versus the master's SLAVE input of READ_VAR.
5. Termination and fail-safe bias missing on long RS485 runs (>10 m at 19.2 kbit/s; mandatory above ~100 m).
6. RS232 ↔ RS485 incompatibility if the M340 serial card is configured for RS232 or if an RS232 ↔ RS485 converter is used with TX/RX swapped.

4. CP 341 Hardware Configuration

Set the on-board DIP switches on the rear of the CP 341-1CH02 for RS485 2-wire operation:

For intermediate stations, leave S1 and S2 OFF. Bias and termination should be present at exactly two points: each end of the daisy chain.

5. MODB_341 Slave Parameterization

The MODB_341 instruction and its associated driver blocks are documented in the TIA Portal reference for MODB_341 (Modbus slave RTU S7-300/S7-400). Open the project, right-click the CP 341 in HW Config, and select Object Properties > Parameter > Modbus Slave. Assign the driver the CP serial port number (typically 1 for the only X27 port).

Key parameters in the assignment:

The driver writes its generated FB80 wrapper into the project tree. FB80 is the higher-level Modbus protocol block; it calls FB7 P_SEND / FB8 P_RCV internally and surfaces ERROR_NR, ERROR_INFO, and STATUS outputs.

6. PLC Program Skeleton

A minimal call of the slave driver in OB1 (STEP 7 STL / SCL):

// Cyclic OB1 - Modbus slave call
CALL  FB80, DB80   // MODB_341 instance
  LADDR   := 256   // logical base address of CP 341
  STARTUP := FALSE // no cold-restart handling
  STATUS  := MW100 // optional status word
  ERROR_NR:= MW102 // optional error number
  ERROR_INFO:= MW104

// FB7 and FB8 are called internally by FB80; do NOT call them directly
// unless you are running raw ASCII mode without the Modbus driver.

For diagnostic visibility, latch ERROR_NR on its rising edge into a retentive flag (e.g., MW110) so a power cycle does not erase the last fault.

7. RS485 Wiring and Topology

CP 341-1CH02 X27 pinout (15-pin Sub-D, female cable connector):

Modicon M340 BMX NOM 0200 RJ45 pinout (port 0 / port 1):

Connect: CP 4 ↔ M340 4 (A), CP 11 ↔ M340 5 (B), CP 8 ↔ M340 8 (GND). Use a shielded twisted pair, ≤ 1200 m at ≤ 19.2 kbit/s.

8. Modicon M340 Master Configuration (Unity Pro / EcoStruxure CE)

Configure the BMX NOM 0200 serial channel in Unity Pro:

1. Project > Configuration > Serial Port > Modbus RTU Master.
2. Set baud = 9600, parity = Even, data bits = 8, stop bits = 1.
3. Set the Modbus slave number to match the CP 341's MODB_341 parameter (default 1).
4. Use READ_VAR (formerly MBP_MSTR) in a periodic task (e.g., MAST) with a 100 ms cycle.

Sample Unity Pro ST section:

// MBP_MSTR example (legacy)
MBP_MSTR(
  Mode   := 1,           // Read holding registers
  Slave  := 1,           // CP 341 slave ID
  Func   := 3,           // 03h = Read Holding Registers
  EAddr  := 0,           // 0-based register address
  Quant  := 10,          // 10 words
  SrcObj := NULL,
  DestObj:= %MW100:10,
  Error  => ERR,
  Status => STAT
);

Or with the newer ModbusIOScanner / READ_VAR in EcoStruxure Control Expert, the equivalent uses ADDM + READ_VAR blocks. Always interpret the STATUS output > 0 as a Modbus exception (exception function = STATUS & 0x00FF, exception code = (STATUS >> 8) & 0x00FF).

9. Diagnostic Workflow

1. Hardware check — open the diagnostic buffer of the CP in STEP 7 / TIA Portal (right-click CP > Online > Diagnostics). Capture any "wire break", "parity", or "framing" entries.
2. LED check — issue one READ_VAR from the M340 and observe CP 341 LEDs. RXD must pulse; TXD must follow within < 1 ms (turnaround time of the CP 341 receiver).
3. Loopback test — disconnect the field cable, place a 120 Ω resistor across R(A)–R(B) and 1 kΩ pull-up/down as fail-safe. The CP 341 should report "line break" in the diagnostic buffer, confirming the receiver path is alive.
4. ModScan32 verification — connect a PC with a USB-to-RS485 adapter to the same bus. Issue a holding-register read against slave ID 1 at 9600 8E1. Successful frames prove the CP 341 is responding, isolating the M340 side if it still fails.
5. Status word decoding — capture FB80 ERROR_NR and ERROR_INFO on every transaction. Codes ≥ 0x0100 are CP-level; codes < 0x0100 are protocol-level (mapping errors).
6. Swap test — replace the CP 341 with a known-good unit. If the bus now operates, the original CP's RS485 transceiver is faulty (this was the resolution in the original ticket).

10. Error Code Reference

11. Verification Checklist

• ☐ M340 serial port set to Modbus RTU master, not ASCII or Modbus ASCII.
• ☐ Slave ID, baud, parity, data bits, stop bits identical on both ends.
• ☐ RS485 A/B polarity verified (swap test once before condemning hardware).
• ☐ Termination at bus ends only, fail-safe bias at one end only.
• ☐ CP 341 diagnostic buffer free of "wire break" and "frame error" events.
• ☐ FB80 ERROR_NR = 0 and ERROR_INFO = 0 in cyclic operation.
• ☐ RXD and TXD LEDs flash on every master request.
• ☐ ModScan32 / Modbus Poll tool successfully polls the CP from a third device on the same bus.

12. Field-Proven Lessons

• LEDs are not online indicators. Treat them as activity lamps — use the diagnostic buffer for "is the CP alive".
• The CP 341's RS485 transceiver is the most likely point of failure on legacy modules that have seen field bus surges. Surge arrestors (e.g., Siemens SIPLUS or Phoenix Contact PT-IQ) on the bus side are cheap insurance.
• MODB_341 is the supported path. Third-party libraries (e.g., Tibi68) work but lack the safety-net diagnostic buffer integration; prefer the official driver when a dongle/license is available.
• Keep the M340 firmware current. Modicon serial modules < V2.0 have known Modbus RTU master turnaround timing issues that produce intermittent exception 0x0B errors on the CP side.
• Always tie signal ground between the two devices — even on a 4-wire RS485 link. Floating GNDs cause asymmetric common-mode voltage and silent frame corruption.

FAQ