C133 Industrial Communication & Networks
6C
6 Cielo Ciencia y Tecnología
·Publicada en C133 Industrial Communication & Networks

How to Configure the Siemens CP 341 as a Modbus RTU Slave

To configure a Siemens SIMATIC CP 341 communications processor as a Modbus RTU Slave in STEP 7 (SIMATIC Manager), install the PtP Parameterization software and the Loadable Driver for Modbus Slave. Assign a standard SIMATIC Data Block (DB) to the internal Modbus memory areas inside HW Config, hardware-key the CP 341 with a physical driver dongle, and execute Function Block FB80 (S_MODB) continuously within a cyclic execution task (such as OB1).

Table of Contents

Technical Cause: Why Custom Communication Logic Fails

Attempting to implement a custom Modbus RTU slave protocol handler on an S7-300 system using standard ASCII or point-to-point drivers (FB7 / FB8 P_RCV / P_SND directly) frequently fails due to protocol framing errors, unhandled cyclic redundancy checks (CRC), and asynchronous memory access conflicts.

The CP 341 Modbus RTU Slave architecture uses hardware-offloaded processing to resolve these issues. The loadable driver executes directly on the CP 341 coprocessor, offloading protocol parsing, baud rate clocking, CRC validation, and Modbus function code decoding from the main S7-300 CPU. The main CPU executes FB80 (S_MODB), which coordinates data exchanges between the hardware module interface and the assigned SIMATIC Data Blocks.

Plaintext

+-------------------------------------------------------------------------------+
|                            SIMATIC S7-300 CPU                                 |
|                                                                               |
|  +---------------------------+               +-----------------------------+  |
|  |     User Program OB1      |               |      SIMATIC Data Block     |  |
|  |                           |               |           (DB4)             |  |
|  | Call FB80 ("S_MODB")      |               |                             |  |
|  |  - LADDR := 256           |               | DBW0..35  : Holding Regs   |  |
|  |  - Modbus Slave Logic     |               |             (Read by DCS)   |  |
|  +-------------+-------------+               | DBW36..60 : Holding Regs   |  |
|                |                             |             (Written by DCS)|  |
|                | Cyclic Status &             +--------------+--------------+  |
|                | Data Transfer                              |                 |
|                v                                            |                 |
|  +----------------------------------------------------------+--------------+  |
|  |                     CP 341 Communications Processor                     |  |
|  |                                                                         |  |
|  |  +--------------------+   +-------------------+   +------------------+  |  |
|  |  | Physical Interface |   |  Hardware Dongle  |   | Loadable Driver  |  |  |
|  |  |  (RS485 / RS422)   |<->| (Modbus RTU Key)  |<->|  (Modbus Slave)  |  |  |
|  +--+--------------------+---+-------------------+---+------------------+--+  |
+--------------------------------------|----------------------------------------+
                                       | RS485 / RS232 Serial Link
                                       v
                        +------------------------------+
                        |     Modbus RTU Master        |
                        | (Yokogawa DCS / Third Party) |
                        +------------------------------+

Prerequisites

Before configuring the CP 341 as a Modbus RTU Slave, ensure the following hardware, software, and licensing requirements are met:

  • Engineering Environment: STEP 7 V5.5 or TIA Portal (for SIMATIC Manager, STEP 7 V5.5 SP4 or higher with 64-bit OS compatibility is recommended).
  • PtP Parameterization Software: Installed SIMATIC CP PtP Param setup package.
  • Loadable Slave Driver: Siemens "Loadable Driver Modbus Slave (RTU)" installed on the engineering computer and loaded into the CP 341 hardware.
  • Hardware Dongle: Physical Modbus Slave license dongle plugged into the rear slot of the CP 341 module (6ES7341-1CH02-0AE0 for RS422/485 or 6ES7341-1AH02-0AE0 for RS232).
  • Communication Partner: Modbus RTU Master system (e.g., Yokogawa DCS, SCADA system, or ModScan diagnostic utility).

System Architecture and Data Mapping

Modbus RTU relies on standardized numerical register addresses, whereas the SIMATIC environment addresses data using structured byte/word offsets within Data Blocks. The CP 341 loadable driver bridges these formats by mapping Modbus Function Codes directly to specific DB numbers and word offsets in HW Config.

Default Function Code Mapping

Modbus Function CodeTarget Modbus Data AreaS7-300 Mapping MethodTypical Application CaseFC 01 / FC 05 / FC 15Read/Write Coils (0xxxx)DB or Bit Memory (M) areaBinary commands and status outputFC 02Read Discrete Inputs (1xxxx)DB, Bit Memory (M), or Inputs (I)Field contact status inputsFC 03 / FC 06 / FC 16Read/Write Holding Registers (4xxxx)Assigned SIMATIC Data BlockProcess variables, setpoints, analog dataFC 04Read Input Registers (3xxxx)DB, Bit Memory (M), or Inputs (I)Analog field measurements

Step-by-Step Implementation Workflow

Setting up the CP 341 requires a four-step process across hardware parameterization, driver downloading, PLC memory declaration, and cyclic block execution.

Step 1: Physical Interface and Dongle Installation

  1. Power off the S7-300 rack.
  2. Insert the physical Modbus Slave hardware dongle into the slot located on the rear side of the CP 341 module.
  3. Wire the serial interface (RS485 half-duplex: Terminals 4 [T(B)/R(B)] and 11 [T(A)/R(A)]; RS232: standard TxD, RxD, and GND pins).
  4. Power up the S7-300 station.

Step 2: HW Config and Parameterization

  1. Open TIA Portal or STEP 7 HW Config and double-click the CP 341 module.
  2. Click Parameters to open the CP PtP Param interface.
  3. Set Protocol to Modbus Slave.

  4. Double-click the protocol icon to configure physical layer parameters:

    • Baud Rate / Parity / Stop Bits: Match the master configuration (e.g., 9600 bps, 8 Data Bits, Even Parity, 1 Stop Bit).

    • Slave Address: Set a unique node address (e.g., 1 to 247).
      5. Configure the Modbus Register Mapping:

    • Assign the DB number (e.g., DB4) to handle Holding Register operations (FC 03, 06, 16).

    • Specify limits to prevent memory overflow (e.g., map Modbus address 40001 to DB4.DBW0).

Plaintext

Modbus Holding Register Offset <---> SIMATIC Data Block Offset

  Modbus Register 40001  <=======>  DB4.DBW0  (Word 0: Read by DCS)
  Modbus Register 40002  <=======>  DB4.DBW2  (Word 1: Read by DCS)
  ...                               ...
  Modbus Register 40036  <=======>  DB4.DBW70 (Word 35: Read by DCS)
  Modbus Register 40040  <=======>  DB4.DBW78 (Word 39: Written by DCS)

Step 3: Download Loadable Driver to Module

  1. Within the CP PtP Param window, select Options > Load Driver.
  2. Select the installed Modbus Slave driver package.
  3. Download the driver directly to the CP 341 module hardware over the MPI/PROFIBUS/PROFINET connection.
  4. Save and compile HW Config, then download the System Data Blocks (SDBs) to the S7-300 CPU.

Step 4: Program Call in OB1

Instantiate FB80 (S_MODB) in OB1 or a periodic cyclic interrupt task (OB35). FB80 manages continuous background handshaking between the S7-300 CPU memory and the CP 341 co-processor.

Structured Text

// S7-SCL Example: Calling FB80 for CP 341 Modbus Slave Operation
DATA_BLOCK "DB_FB80_S_MODB" "FB80"
BEGIN
END_DATA_BLOCK

ORGANIZATION_BLOCK "Main_Program"
TITLE = "Cyclic Main Program"
VAR_TEMP
    ob1_prev_cycle : INT;
END_VAR

BEGIN
    // Call FB80 to process CP 341 Modbus Slave requests
    "DB_FB80_S_MODB"(
        LADDR    := 256,       // Base I/O address assigned in HW Config (e.g., 256 = 16#100)
        START    := TRUE,      // Enable continuous communication processing
        BUSY     => #wBusy,    // Communication active indicator
        ERROR    => #wError,   // General error indicator
        STATUS   => #wStatus   // Detailed diagnostic status code
    );
END_ORGANIZATION_BLOCK

Core Function Block Interface (FB80)

The primary interaction with the Modbus Slave driver is handled via FB80 (S_MODB). Below are the required parameters:

ParameterDeclarationData TypeFunctional DescriptionLADDRINPUT``INTBase hardware I/O address configured in HW Config (e.g., 256 for address 256..271).STARTINPUT``BOOLSet TRUE to initialize and maintain slave execution loops.START_DEVICEINPUT``CHARCommunication device selector (defaults to 'C' for CP 341).BUSYOUTPUT``BOOLIndicates an active driver request or internal processing cycle.ERROROUTPUT``BOOLEvaluates to TRUE if a hardware or parameterization error occurs.STATUSOUTPUT``WORDReturns internal diagnostic status flags (e.g., 16#0000 = normal operation).CP_START_ERROROUTPUT``BOOLIndicates initialization failure between S7 CPU and CP 341 module.CP_START_STATUSOUTPUT``WORDReturns initialization diagnostic code (e.g., 16#0002 = LADDR mismatch).

Verification

The procedure is successful when:

  1. Hardware Diagnostics: The SF (System Fault) LED on the CP 341 is off.
  2. Serial Traffic: The TxD and RxD LEDs blink continuously during polling by the Modbus Master.

  3. Data Integrity Verification:

    • Values written by the master (e.g., Yokogawa DCS writing to holding register 40040) update instantaneously at the mapped Data Block location (DB4.DBW78).
    • Values written by the S7-300 logic into DB4.DBW0 can be read continuously by the Modbus Master at address 40001.
      4. Block Status: Parameter STATUS on FB80 evaluates continuously as 16#0000 without tripping ERROR = TRUE.

Limitations and Operational Cautions

  • Dongle Dependency: Operating the CP 341 without the physical Modbus Slave hardware dongle causes the driver to operate in evaluation mode or generate systematic communication errors, preventing full data exchange.
  • Array Length Limits: Ensure that the destination Data Block (DB4) contains enough declared words or bytes to cover the highest Modbus register offset requested by the Master. An out-of-range request (e.g., Master reading 100 words from a DB containing only 50 words) generates an Area Length Error (STATUS = 16#E460) and returns an exception code to the Master.
  • Mixed Read/Write Regions: Modbus RTU holding registers allow both read and write operations across any valid register offset. Storing master-written setpoints and PLC-read monitoring data in the same DB is fully supported, provided master and slave logic do not overwrite shared word offsets.
  • Simulation Restrictions: Siemens S7-PLCSIM does not support serial hardware communication processors. Testing CP 341 logic requires physical hardware execution.

Engineer FAQ

Where can I obtain FB80 (S_MODB) for my STEP 7 project?

FB80 is included within the MODBUS library installed alongside the Siemens "Loadable Driver Modbus Slave (RTU)" software package. You can open it in SIMATIC Manager via File > Open > Libraries > Modbus and copy FB80 into your project's Blocks folder.

What causes CP_START_Error = 1 and Error_NR = 0002 on FB80?

This error indicates a hardware address mismatch. Verify that the LADDR input parameter passed to FB80 matches the starting address assigned to the CP 341 under Addresses in HW Config (e.g., 256 decimal for 16#100).

Do I need to call FB7 (P_RCV) and FB8 (P_SND) manually in my S7-300 program?

No. For Modbus Slave operations, call only FB80 (S_MODB). FB80 internally manages calls to FB7 and FB8 to handle low-level packet transmission over the CP 341 backplane.

Related Articles

Related Tags

Code: C133

6 respuestas