Troubleshooting Siemens CP341 Modbus Freezes and Lockup

The Siemens SIMATIC S7-300 CP 341 (order number 6ES7341-1CH02-0AE0) is an RS422/RS485 communication processor commonly deployed as a Modbus RTU master or slave. Field reports describe a hard freeze in which the module stops responding after roughly an hour of operation: receive, transmit, and SF LEDs extinguish simultaneously, and recovery requires a full power cycle of both the CP and the S7-300 CPU. This reference documents the diagnostic path, the most likely root causes for an LED-dark freeze, and the recovery procedure.

1. Problem Statement and Observable Symptoms

Affected hardware:

• CP 341 communications processor, MLFB 6ES7341-1CH02-0AE0 (RS422 / RS485 variant, hardware release 2).
• Dongle (parameterization memory) inserted in the front sub-D shell.
• Configured as Modbus master on a 2-wire RS485 trunk.
• Ten Schneider Electric DM6200 power meters as slaves.

Observable symptoms:

• Communication runs normally at start-up; freezes after approximately 60 minutes of operation.
• All CP 341 LEDs (RXD, TXD, SF) extinguish together; no diagnostics available from the module.
• S7-300 CPU continues running; program execution, OB1, and cyclic OBs are unaffected.
• Diagnostic buffer of the CP 341 contains no entries at the moment of failure.
• FB status output of the user-instantiated Modbus FBs remains in the "OK" state, indicating that the CPU-side request state machine does not detect an error.
• Recovery requires removal and re-application of the 24 V DC supply to the S7-300 backplane (i.e., power-down of CP and CPU).

2. CP 341 Hardware Overview Relevant to the Fault

The 6ES7341-1CH02-0AE0 is the second-generation CP 341 with an integrated RS422/RS485 interface (X27 socket, 15-pin sub-D female). The module occupies one slot in the S7-300 rack and communicates with the CPU over the backplane P bus. It loads its protocol stack and parameter set from the parameterization dongle at power-up.

The dongle contains both the firmware image and the parameter block (baud rate, parity, character delay, response timeout, and similar). If the dongle image mismatches the module or the dongle is marginal, the CP can drop communication silently. Verify that the dongle is the correct variant for the configured protocol (master vs. slave) and that the same dongle part number is used throughout the project.

3. Reading the CP 341 Diagnostic Buffer

The CP 341 writes diagnostic events to its internal buffer and to the S7-300 diagnostic buffer. Empty buffer entries at the time of a freeze are themselves a strong signal. Procedure:

1. In STEP 7, select the CP 341 in HW Config, then "Module Information" (F8 or right-click → Module Information).
2. Open the Diagnostic Buffer tab and scroll the most recent entries.
3. Look for entries coded as "Module fault," "Communication error," "Time-out," "Parameter assignment error," or "Channel fault."
4. If the buffer is empty after a known freeze, record the CPU diagnostic buffer at the same timestamp for cross-reference. A wedged CP will produce a CPU-side "DP/I/O access error" or "Module not responding" entry if the freeze prevents the backplane handshake.
5. Use "Operating Mode" and "Channel Diagnostics" tabs to confirm the current state of the interface (e.g., "Interface fault," "Break on receive line," "Send buffer overflow").

Reference for the Modbus slave instruction behavior on a failed initialization, taken from the official MODB_341 Modbus slave instruction documentation: "If initialization ends with errors, Modbus communication is not possible. All requests from the Modbus master system are answered with an exception code frame." The same principle applies in the master direction: a half-initialized CP that has lost its parameterization will stop polling without necessarily flagging a buffer entry until a higher-level timeout is reached.

4. Root Cause Matrix

The following table ranks root causes for the observed symptom profile (LED-dark freeze, empty buffer, recovered only by power cycle) by probability and field frequency.

5. Power Supply Investigation

The single most common cause of an LED-dark freeze with no diagnostic entries is undervoltage. The CP 341 draws approximately 250 mA from the 5 V backplane plus a small 24 V sensor supply. If the S7-300 power supply (PS 305 for AC, PS 307 for DC) is operating near its rated output, even a brief sag can reset the CP while leaving the CPU's own buffering intact. The result is precisely the observed signature: CPU continues, CP goes dark, no buffer entry because the CP is rebooting.

1. Measure 24 V DC directly at the CP's power terminals (or at the PS output) with a true-RMS meter or oscilloscope.
2. Trigger the oscilloscope on the 24 V line; capture for at least 30 minutes; look for sags below 21.5 V (Siemens PS tolerance is 20.4 – 28.8 V, but a CP can misbehave above the lower limit if its own internal regulation has no margin).
3. Compute the total backplane load: I_total = I_CPU + sum(I_modules) + I_24V_field. A PS 307 (5 A) loaded above 80 % is a candidate.
4. Verify AC mains quality upstream. A heavy contactor or VFD sharing the same transformer will produce spikes that the PS 307 cannot fully reject.

6. RS485 Termination, Biasing, and Cabling

A Modbus RTU bus on the 6ES7341-1CH02-0AE0 (the 1CH variant supports both 2-wire RS485 and 4-wire RS422) requires correct electrical termination. Each RS485 segment must have 120 Ω termination at both ends, and the bus must be biased into a defined idle state by pull-up to Vcc and pull-down to GND through 680 Ω resistors at one node only (typically the master). Without bias, the bus idles at an undefined voltage; the CP's first-stage receiver can oscillate, causing the internal state machine to lock up.

On the CP 341, the dongle itself can include internal termination and bias that is enabled in the parameterization tool ("PTP Parameter Assignment"). Confirm that:

• If the CP is at a bus end, internal 120 Ω termination is enabled.
• If the CP is mid-bus, termination must be external and internal termination disabled.
• Fail-safe bias is enabled on the master only; disable on every other node if their dongle supports it.

7. Modbus Master Polling and Timing Parameters

The CP 341 master executes the polling cycle defined by the user program. The default timeouts are tuned for short-bus, low-slave-count configurations. With ten DM6200 power meters, the round-trip per request at 19200 bit/s is approximately 60 – 120 ms, depending on register count. The accumulated response time can exceed the configured slave response timeout under marginal signal conditions, which the CP handles by retrying; repeated retries on a noisy bus can saturate the internal send buffer and stall the master.

The Modbus RTU spec mandates a 3.5 character silent interval between frames. The "character delay" parameter in the CP 341 parameterization must be set to at least this value, or the CP will mis-frame concatenated responses from multiple slaves.

8. FB80 / FB82 / MODB_341 / MODB_MASTER Usage

The CP 341 Modbus master / slave FBs are loaded from the dongle into the S7 CPU library and called from the user program. The master FB is the dedicated MODBUS master block (often named MODB_MASTER or MODB_MAST depending on the dongle version). A typical call pattern in OB1 looks like:

// One-shot initialization in OB100 (restart / warm restart)
CALL  FB 101  // "INIT_CP341" or the dongle-supplied init FB
   INIT  := TRUE
   LADDR  := W#16#100      // logical base address of the CP 341
   DB_PARAM := DB 100      // parameter DB (loaded from dongle)
   DONE   := M 10.0
   ERROR  := M 10.1
   STATUS := MW 12

// Cyclic call in OB1
CALL  FB 102  // "SEND_RECV" or master FB
   REQ    := M 20.0       // trigger one poll per scan if not busy
   LADDR  := W#16#100
   DB_PARAM := DB 100
   SLAVE  := 1            // 1..10 for the ten DM6200 meters
   FUNCTION := 3          // 3 = read holding registers
   DATA_PTR := P#DB201.DBX0.0 BYTE 100
   DONE   := M 21.0
   ERROR  := M 21.1
   STATUS := MW 24
   COM_TIMER := T 5       // watchdog timer 1 s

For the slave-side equivalent, refer to MODB_341 Modbus slave instruction for CP 341 (S7-300, S7-400). The same initialization principle applies in both directions: if the init FB returns ERROR = TRUE, no Modbus traffic is possible until initialization succeeds. Implement a retry-on-error block in OB100 and on diagnostic interrupt (OB82).

9. Watchdog and Recovery Implementation

To survive a transient CP freeze, add a hardware-level watchdog and a software-level reinit loop. The hardware watchdog is a 24 V relay coil driven by a CPU output; if the CPU stops toggling the output, the relay drops and power-cycles the CP via a latching contactor. The software watchdog reissues init when DONE is missed.

1. In OB1, start a timer (e.g., TON, PT = 1.5 × slave response timeout) on each rising edge of REQ.
2. Reset the timer on each DONE rising edge.
3. If the timer expires, set a reinit request flag and call the init FB in OB100 / OB101 logic.
4. On OB82 (diagnostic interrupt) for the CP, set the reinit flag and log the event.
5. Limit reinit attempts to, for example, 5 within 10 minutes; after that, raise a CPU stop or a permanent fault to alert operations.

10. Step-by-Step Diagnostic Procedure

Execute the following sequence in order; do not skip steps. Each step produces a "go / no-go" decision before the next.

1. Capture the moment of failure. Use a digital storage oscilloscope on the 24 V supply rail and on the RS485 A/B lines. Trigger on RS485 idle-to-active edges; record pre- and post-failure traces.
2. Read the S7-300 diagnostic buffer. Note the timestamps of any "module failure" or "module removed/inserted" entries for the CP 341.
3. Measure 24 V at the CP. Use a true-RMS DMM and capture a 30-minute log. The Siemens PS 307 should hold 24.0 V ± 2 % under full load.
4. Check termination and bias. Power down, disconnect the bus at the CP, measure resistance from A to B with terminators in place. Should read 60 Ω (two 120 Ω in parallel) if both ends are terminated; 120 Ω if only the far end is terminated.
5. Verify dongle type and seating. Remove and reinsert the dongle; confirm the part number matches the configured protocol (master vs. slave, RTU vs. ASCII).
6. Reduce the poll cycle. Comment out nine of the ten slaves; poll only one. If the freeze disappears, the issue is timing, buffer saturation, or bus contention.
7. Lower the baud rate. Move from 19200 to 9600 bit/s. If the freeze disappears, the bus is marginal; focus on cabling and termination.
8. Replace the dongle. A marginal dongle can pass a short test but fail after warm-up. Use a known-good spare.
9. Replace the CP 341. Internal firmware / hardware fault. Submit a service request to Siemens with the diagnostic buffer dump and the FB STATUS trace.

11. Verification Checklist

After applying any fix, run a 24-hour soak test with all ten DM6200 slaves polled at the configured cycle. Verification criteria:

12. Frequently Asked Questions