Configuring CP 343-1 (1EX30) PNIO Controller I/O Start Addresses

Problem Overview

The CP 343-1 (6GK7 343-1EX30-0XE0) used as a PROFINET IO controller on an S7-300 station fails to exchange process data when the configured PROFINET device I/O start address differs from byte 0 of the CPU's process image. Inputs mapped to IB 380 and outputs mapped to QB 95 remain inactive (always 0) or never get set, even though the PNIO_RECV (FC12) and PNIO_SEND (FC11) calls return error-free status. The same configuration works correctly when the start address is set to 0.0.

This is not a fault of the FC blocks themselves. It is a mismatch between the CPU process image input/output size, the PROFINET device slot address in HW Config, and the RECV/SEND pointer in the user program. Each of these three locations must be brought into agreement.

Affected Hardware and Firmware

Root Cause Analysis

The CP 343-1 operates a local address space that is logically independent from the CPU's process image. Internally, the CP transfers PROFINET process data starting at offset 0 of its own working buffer, and FC11/FC12 are responsible for copying that buffer between the CP and the CPU memory area selected by the RECV and SEND pointer parameters.

Three parameters must agree for the transfer to succeed:

1. Configured slot address of the PN IO device in HW Config (or in the PROFINET IO topology of the TIA Portal).
2. Length of the process image input/output area on the CPU (Object > Properties > Cycle/Clock Memory).
3. RECV / SEND pointer used in FC12 / FC11 of the user program.

If the PN IO device is configured at I 380.0 with 66 bytes of input data, the CPU's process image must be at least 446 bytes (380 + 66). If it is configured at I 0.0, only 66 bytes are needed. The CP cannot write data to a memory area that is not part of the process image, and the FC blocks will still return BUSY = 0 and DONE = 1 with no error code because the copy operation succeeds in RAM — but the source data on the CP side is never refreshed until the process image is large enough to cover the configured slot.

Symptom Matrix

Prerequisites

• STEP 7 V5.5 or TIA Portal V13+ installed with the CP 343-1 (1EX30) GSD file or HSP.
• CPU 315-2 PN/DP or comparable S7-300 with PROFINET capability.
• PN IO device GSD file imported (e.g. ET 200SP, ET 200MP, ET 200AL).
• PNIO_SEND (FC11) and PNIO_RECV (FC12) function blocks from the CP 343-1 library installed in the S7 program.
• Online connection to the CPU for download and diagnostics.

Step-by-Step Resolution

Step 1 — Confirm the PN IO Device Slot Address

1. Open the SIMATIC S7 project in STEP 7.
2. Open HW Config and double-click the PN IO device assigned to the CP 343-1.
3. Note the configured Input start address and Output start address (e.g. IB 380 / QB 95).
4. Note the configured Input length and Output length (e.g. 66 input bytes, 32 output bytes).

Step 2 — Resize the CPU Process Image

1. In HW Config, double-click the CPU (e.g. CPU 315-2 PN/DP).
2. Open the Cycle / Clock Memory tab.
3. In the Process image section set:

For the example values IB 380 / 66 bytes and QB 95 / 32 bytes set the process image to at least 446 input bytes and 127 output bytes. A practical round value is 512 / 512 bytes.

Step 3 — Align the FC11 / FC12 Pointers

Open the instance DB or shared DB that contains the FC11 / FC12 calls. The two critical parameters are RECV for FC12 and SEND for FC11.

For the example above the call must read exactly:

PNIO_RECV(
  CPLADDR := W#16#18E,         // or actual diagnostic address of the CP
  MODE    := B#16#0,
  LEN     := 66,                // must equal HW Config input length
  RECV    := P#I380.0 BYTE 66   // must point to the same start address configured in HW Config
);

For the outputs:

PNIO_SEND(
  CPLADDR := W#16#18E,
  MODE    := B#16#0,
  LEN     := 32,                // must equal HW Config output length
  SEND    := P#Q95.0 BYTE 32    // must point to the same start address configured in HW Config
);

The RECV / SEND pointer must match the slot address byte for byte. Setting RECV := P#I0.0 BYTE 66 while HW Config has the slot at IB 380 means the CP copies data into the wrong memory area and the application sees stale data.

Step 3a — Resolving the Address Conflict with Existing Modules

If the CPU process image is already populated up to IB 380 by other local or PROFIBUS modules, the PN IO slot must be placed either:

• Above the highest existing byte plus its length (e.g. IB 380 requires the previous module to end at or below IB 379).
• In an unused gap between modules if the process image is large enough.

Use HW Config > PLC > Edit Ethernet Node or PROFINET IO Topology to renumber slots. STEP 7 automatically rejects overlapping addresses and warns the engineer at compile time.

Step 4 — Download and Reset

1. Save and compile the HW Config and the S7 program.
2. Download the HW Config first, then the S7 program to the CPU.
3. Perform a complete restart (STOP → MRES → RUN) so the CP re-initialises the PROFINET IO subsystem with the new process image.

Verification

Common Pitfalls

Pitfall 1 — Using the Wrong FC Number

The CP 343-1 (1EX30) uses FC11 (PNIO_SEND) and FC12 (PNIO_RECV). Older CP 342-5 documentation that uses FC1/FC2 (DP_SEND/DP_RECV) is not directly applicable to PROFINET, although the principle of process image size and pointer alignment is identical. Refer to the function block help inside STEP 7 for the correct block number.

Pitfall 2 — Leaving MODE ≠ 0

For cyclic PROFINET IO data exchange the MODE parameter must be B#16#0. A non-zero MODE triggers a one-time read/write service and will appear to "work" once but then stop updating.

Pitfall 3 — Ignoring the Update Time

Even with the process image correctly sized, the PN IO device must be configured with a sensible send clock (typically 1 ms). A send clock of 0 or an unsupported value causes the CP to keep the slot in "not exchanged" state without raising an error code.

Pitfall 4 — TIA Portal vs Classic STEP 7 Conversion

When migrating an S7 project from STEP 7 V5.5 to TIA Portal, the CP 343-1 (1EX30) GSD file is loaded through the device library. The function block instances FC11/FC12 remain identical, but the underlying data type of CPLADDR may be displayed as HW_IO. Always verify the value (typically 16#18E or 16#18F) against the diagnostic address visible in the device properties.

Extended Diagnostic Procedure

If the slots still do not update after following the steps above:

1. Open Online & Diagnostics on the CP 343-1 and read the diagnostic buffer.
2. Select PROFINET Diagnostics > Station and confirm each PN IO device shows "OK".
3. Use Trace on the FC11 / FC12 calls to record RETVAL and STATUS over several seconds. Look for transient W#16#80C3 (timeout) which indicates the update time is too short for the device.
4. Temporarily reduce the PN IO device update time to 4 ms and observe whether data flow resumes; if so the original value of 1 ms was unsupported by the device firmware.
5. As a last resort, remove the PN IO device from HW Config, recompile, download, perform a complete restart, then re-add the device. This forces the CP to rebuild the AR (Application Relationship) from scratch.

Why I0.0 Always Works

The default process image size of any S7-300 CPU is 128 bytes for inputs and 128 bytes for outputs. Setting a PN IO slot at IB 0 therefore always fits inside the default image regardless of CPU type, and the FC12 copy succeeds in RAM even when the CP has not yet refreshed the buffer. With non-zero start addresses, the slot may fall outside the default image; the CP cannot refresh the data because the CPU never scans it during OB1 cycle update.

This is why the symptom appears only when the slot address is moved away from byte 0 and not because the FC blocks impose an internal address restriction. The CP itself has no such limitation — it can address the full OB1 process image up to the CPU maximum.

Field-Commissioning Checklist