Configuring CP-340/CP-341 RS-232 ASCII for DTE Communication

Overview

The SIMATIC CP 340 and CP 341 are point-to-point communication processors for the S7-300 / ET 200M backplane. They expose a single serial port (RS-232C, RS-422, or RS-485 depending on the order number) and offload serial framing, handshaking, and protocol handling from the CPU. When the downstream equipment is a generic Data Terminal Equipment (DTE) such as a barcode reader, scale, hand-held HMI, or weigh indicator, the loadable ASCII driver is the correct protocol choice. The CP 340/341 do not natively speak DF1, Allen-Bradley DH+, or any proprietary PLC protocol — those require a gateway (e.g. Prosoft, Anybus, Helmholz) or a discontinued loadable driver.

Supported loadable drivers on the CP 340/341:

• ASCII (standard, ships with the module)
• 3964(R) (standard)
• RK 512 (standard on CP 341; option on CP 340)
• Modbus master / slave, RTU + ASCII (loadable, order separately)
• DF1 (loadable, discontinued — see notes below)

Prerequisites

• S7-300 station with CP 340 or CP 341 installed in the rack (slot 4-11), configured in HW Config with no address conflicts.
• STEP 7 V5.5 + SP2 / SP3 (or TIA Portal with a SIMATIC S7-300 CP type that maps to the same module). The CP must be assigned a hardware type matching the physical module (e.g. 6ES7 340-1AH02-0AE0 for RS-232 CP 340).
• Loadable ASCII driver installed: SIMATIC S7, CP 340/341 ASCII driver Vx.x, license on diskette/USB or activated through the Automation License Manager.
• DTE device datasheet stating: baud rate, parity, data bits, stop bits, flow control (XON/XOFF, RTS/CTS, or none), terminator characters (CR, LF, CR+LF, none), and the byte order of any multi-byte values.
• RS-232 cable, DB-9 male-to-female (or DB-25) wired as a DTE-to-DCE crossover. Siemens RS-232 CP modules implement a DCE physical interface, so a straight-through cable is normally used when the DTE is the “computer side”.

CP 340 vs CP 341 — Selecting the Module

For pure ASCII I/O to a DTE both modules behave almost identically. The difference that matters is frame length: if the DTE may burst more than 1024 bytes per transaction, use the CP 341.

RS-232 Pinout and Cable

The CP 340/341 RS-232 variants ship with a female DB-9 (D-subminiature) connector. The signal assignment is:

If the DTE does not use hardware handshaking, leave the CTS/RTS loop connected (CTS grounded on the DTE side) and set the protocol parameter in the CP to “none” for both handshake directions. The cable length for RS-232 must not exceed 15 m (50 ft) at 19.2 kbit/s, less at higher baud rates; for DTE equipment installed in switchgear cabinets prefer a screened, twisted-pair cable (e.g. LiYCY 3×2×0.25 mm²).

STEP 7 Hardware Configuration

1. Open SIMATIC Manager → your S7 project → HW Config.
2. Insert the CP 340 or CP 341 from the hardware catalog (path: SIMATIC 300 → CP-300 → Point-to-Point → CP 340 / CP 341). Use the order number that matches the silk-screen on the module.
3. Double-click the CP to open the Properties dialog. The diagnostic addresses are set here (default input 384, output 384). Do not overlap these with the CPU process-image or any other module.
4. Switch to the Interface tab. Select RS-232C as the physical layer.
5. Switch to the Protocol tab. Select ASCII driver. If the entry is greyed out, the driver was not installed — re-run the SIMATIC NET CD / install via Start → SIMATIC → SIMATIC NET → Communication Settings.
6. Configure the protocol parameters (see next section).
7. Save and compile (Station → Save and Compile). Download the hardware configuration to the CPU.

ASCII Protocol Parameters

The following parameters must match the DTE exactly. One mismatch is enough to corrupt every frame.

PLC Programming — Function Blocks

Two FBs from the standard library are used. For the CP 340 the call is:

• FB 2 — P_SEND — sends one frame
• FB 3 — P_RECV — receives one frame

For the CP 341 the parameterized FBs are:

• FB 8 — P_SEND
• FB 9 — P_RECV

The FBs are multi-instance capable. Each instance DB belongs to the calling FB and holds the CP address, the send/receive DB, and the start/length parameters. A minimal “send integer to terminal” call in STL:

// One-shot send of a 12-byte ASCII message
CALL "P_SEND", DB30
  REQ    := M10.0           // rising edge triggers one send
  R      := M10.1           // abort / reset
  LADDR  := 384             // diagnostic address of the CP
  DB_NO  := 20              // data block containing the message
  DBB_NO := 0               // start byte in DB 20
  LEN    := 12              // bytes to send
  DONE   := M20.0           // set for one cycle on success
  ERROR  := M20.1           // set for one cycle on error
  STATUS := MW22            // error/status word

The receive side is identical, except EN_R must be set continuously and LEN is the maximum buffer size (the actual received length is reported in LEN on the rising edge of NDR).

Data Storage Location and Conversion

Send and receive buffers must reside in a DB of type BYTE / CHAR / STRING. Mixing WORD/INT directly as the buffer source works because STEP 7 just sends raw bytes, but it makes debugging and the DTE’s parser unhappy if the value needs to be human-readable.

Typical approaches:

1. Raw binary, fixed length. An INT (-32768..32767) occupies 2 bytes. Use a DB declared as ARRAY[0..1] OF BYTE and copy the value with BLKMOV or MOVE after endian-swap (S7 is big-endian; most DTE devices are little-endian).
2. ASCII decimal. Use FC 5 / FC 30 (STRING conversion) from the standard library: DI_STRNG, I_STRNG, R_STRNG convert INT, DINT, REAL into a STRING of decimal digits, which can then be sent as a contiguous block.
3. Alphanumeric mixed string. Build a STRING DB manually: 'LOT=0012345' or similar tag/colon format the DTE expects. Concat the converted number and a header string with CONCAT (SCL) or string manipulation in STL.

Example SCL for “send the integer DB10.DBD0 preceded by 'VAL=' and terminated by CR+LF”:

// Build transmit buffer in DB20
DB20.VAL[0] := 'V'; DB20.VAL[1] := 'A'; DB20.VAL[2] := 'L'; DB20.VAL[3] := '=';
DB20.STR   := INT_TO_STRING(DB10.DBD0);
DB20.TAIL[0] := 16#0D; // CR
DB20.TAIL[1] := 16#0A; // LF

The total frame length fed to P_SEND is the header length + string length + 2 for CR/LF.

Verification

1. Open the online CP 340/341 Diagnostics tool in SIMATIC Manager (right-click the CP → Module Information). Confirm: module OK, protocol loaded, no diagnostic interrupts, send/receive counters incrementing.
2. Use the “Send/Receive Test” panel built into the diagnostic tool: type ASCII text, send it out of the CP port, loop it back with a TX-RX shorting plug, and verify the receive side returns the same bytes.
3. Trigger P_SEND from a watch table with a 1-byte forced value; observe DONE and STATUS from the FB instance DB.
4. Connect a serial line analyser (e.g. Wireshark with the appropriate serial tap, or a dedicated RS-232 protocol analyser) between CP and DTE to verify baud rate, framing, and that the CR/LF terminator is present.
5. With a hyperterminal-style program on a PC emulating the DTE, confirm that the CP can both send and receive a round-trip message.

Troubleshooting Matrix

When to Use a Gateway Instead

If the DTE truly speaks DF1 (Allen-Bradley legacy), or any other protocol outside the CP’s set, the CP 340/341 is the wrong choice. A PROFIBUS-DP ↔ serial gateway (e.g. Prosoft PTQ-PDPMV1) or a PROFINET ↔ serial converter (e.g. Helmholz PN/CAN, Anybus X-gateway) is more robust and avoids loadable-driver licensing. The CP is then merely a PROFIBUS slave on the same rack, and the gateway handles all the protocol conversion transparently. For a DTE that already supports ASCII but the customer is being asked to avoid the CP 340/341 altogether (e.g. to reduce spare-parts stock), a CP 1243-1 / CP 1542SP with free-port ASCII over Ethernet can also be considered, although that introduces a different cabling topology.

Migration to a Current Platform

The CP 340 was phased out of new sales in 2014 and the CP 341 in 2016 (Siemens product discontinuation notices). Both remain available for spare-parts service for a defined window. For new machines the recommended replacements are:

• ET 200SP CM PtP (6ES7 137-6AA00-0BA0) — free-port ASCII, 3964(R), Modbus, USS, on PROFINET, up to 250 messages/s.
• S7-1200 CM 1241 (RS-232 or RS-485) — for compact machines using a single serial DTE.
• CP 1542SP-1 — for full Modbus master / slave and security features.

The program migration is straightforward: P_SEND/P_RECV call signatures are similar, the diagnostic status codes map closely, and the same RS-232 cable (DB-9, DCE pinout) can be reused.