Configuring CP343-1 to PC HMI Communication with WinCC Flexible

Field reference. A SIMATIC S7-300 PLC equipped with a CP 343-1 communications processor exchanges process data with a PC-based HMI (for example, a Gefran PC Touch operator terminal) running WinCC Flexible Runtime. The S7 protocol is carried over ISO-on-TCP (RFC 1006), giving you an Ethernet-based, deterministic, vendor-managed channel without the overhead of an external OPC server. This guide covers hardware selection, STEP 7 configuration on both ends of the link, the WinCC Flexible project, runtime licensing, commissioning checks, and a troubleshooting matrix drawn from real field interventions.

1. System Architecture

The classical arrangement is a star or line topology on Industrial Ethernet. The S7-300 mounts the CP 343-1 in slot 4 (typical configuration), assigned an IP address and a transport service access point (TSAP) pair. The PC station runs WinCC Flexible Runtime with a parallel S7 connection pointing at the CP 343-1. The S7 protocol suite handles read, write, bit-test, and PUT/GET primitives, while ISO-on-TCP (RFC 1006) provides reliable, full-duplex transport on top of TCP port 102.

2. Prerequisites and Bill of Materials

1. Hardware. S7-300 (CPU 312/314/315/317-2 DP/PN) with a free slot for the CP, a CP 343-1 variant matched to the firmware family, an Industrial Ethernet switch (managed or unmanaged, SCALANCE X-100/X-200 is recommended for noisy cabinets), and a PC or panel PC with at least 1 Gbit Ethernet.
2. Cabling. Cat 5e or higher, RJ45, max 100 m per segment. For >100 m, use a SCALANCE switch in the path.
3. Software on the engineering station. STEP 7 V5.5 or V5.6 SP1, plus WinCC Flexible 2008 SP5 (Compact, Standard, or Advanced — Advanced is required for the PC runtime scenario). Service Pack level matters: SP3 and earlier do not support all CP 343-1 firmware revisions.
4. Software on the target PC / panel. WinCC Flexible Runtime 2008 SP5 (or matching service pack). License key transferred via Automation License Manager (ALM).
5. Network parameters. Static IP addresses (DHCP is not advisable for industrial control), unified subnet, identical gateway for routed topologies, and a defined naming convention.

3. Protocol Stack: S7 over ISO-on-TCP

ISO-on-TCP is the canonical Siemens transport for S7 communication on Industrial Ethernet. It encapsulates ISO 8073 COTP (Connection-Oriented Transport Protocol) inside RFC 1006, which in turn rides on standard TCP. The wire stack, from the top down, looks like this:

1. S7 protocol. Carries the S7 user data — variable read/write, block services, security, time sync, PUT/GET, and diagnostic information. Functions of interest:
   • 0x04 — Read Var
   • 0x05 — Write Var
   • 0x1D — Download Block
   • 0x1E — Download Ended
   • 0x1F — Insert Start
   • 0x00 — CPU Stop / Start / Warm Restart requests
2. COTP (ISO 8073). Connection establishment (CR/CC), data (DT), and disconnect (DR). Provides the TSAP addressing that distinguishes multiple S7 applications on the same host.
3. TPKT (RFC 1006). 4-byte header carrying the length of the enclosed COTP PDU. TPKT version is always 3.
4. TCP / IP. Standard transport. S7 uses TCP port 102 for both the server (CP 343-1) and the client (WinCC Flexible RT).

The TSAP is the most common field-error source. A TSAP is a two-byte local/remote pair, formatted as a string of the form xx.yy in STEP 7. The first byte is the connection resource, the second is the slot of the CP. For an S7-300 CP in slot 4 with rack 0:

Local TSAP  : 01.04
Remote TSAP : 02.01   (or the WinCC Flexible partner ID you set)

4. CP 343-1 Hardware Configuration in STEP 7

1. Open the SIMATIC Manager project and double-click HW Config on the S7-300 station.
2. Insert the CP 343-1 from the hardware catalog under SIMATIC 300 > CP-300 > Industrial Ethernet into slot 4 of the rack (slot 4 is the conventional CP slot for the S7-300; the CPU occupies slot 2 or 3, IM in slot 3, free slots to the right).
3. Open Object Properties > Interface > Ethernet and assign:
   • IP address: 192.168.0.1
   • Subnet mask: 255.255.255.0
   • Use router: unchecked (for flat topology)
4. Open Object Properties > Connection and add a new ISO-on-TCP connection with unspecified partner (this is the S7 connection that WinCC Flexible will use). Fill in the local and remote TSAP as above. The CP 343-1 holds up to 16 such S7 connections; each occupies a connection resource in the CPU.
5. Compile and download the hardware configuration to the CPU. The CP performs a restart and accepts S7 connections only after the CPU is in RUN.

Verify the configuration by opening Online > Accessible Nodes from STEP 7. The CP 343-1 must appear with its MAC and IP. If the entry is missing, you have a layer-1/2 problem — check the LINK LED on the CP and the switch port.

5. PC Station and WinCC Flexible RT Configuration

The PC station is a logical container that links the engineering view of the HMI to the runtime on the operator panel. There are two configuration surfaces: the PC station in STEP 7 (which registers the HMI as an S7 client) and the connection in the WinCC Flexible project itself.

1. In SIMATIC Manager, insert a PC Station next to the S7-300 station.
2. Open the PC station's hardware configuration and insert an WinCC Flexible RT application in slot 1 and an IE General (CP-IE) or a soft-net Ethernet card in slot 2. Assign the IP address 192.168.0.10 to the IE card.
3. Compile the PC station and download it. The PC-side HMI service is now visible to the CP 343-1 as an S7 client.
4. Open the WinCC Flexible project, switch to Connections, and add a new connection:
   • Name: keep default or use a numeric name
   • Driver: S7-300/400 over TCP/IP (this is the WinCC Flexible RT internal driver; it does not require SIMATIC NET)
   • PLC address: 192.168.0.1
   • Rack / Slot of PLC CPU: 0 / 2 (or whatever the CPU slot is in your HW Config)
5. Build the project, transfer it to the panel, and start Runtime.

6. Tag Mapping: Bits, Bytes, Words, and Data Blocks

The S7 protocol can address every memory area of the CPU: inputs (I), outputs (Q), merkers (M), peripheral I/O (PI/PQ), and data blocks (DB). WinCC Flexible mirrors these areas 1:1; each HMI tag points to a concrete address in the PLC.

Word-swap caveat: the S7 protocol stores words in big-endian, while x86 PCs and most HMI SCADA engines expect little-endian. The CP 343-1 handles the conversion transparently, but if you cross-compile data from a Modbus gateway or a panel that uses SWAP, the displayed value will be byte-reversed. Keep one endianness convention per project to avoid hunting phantom bugs.

Recommended approach: reserve a dedicated DB (commonly DB 100) for HMI data exchange. Lay it out as a fixed structure with named variables. WinCC Flexible can be linked to the STEP 7 symbol table so the engineering effort happens once.

7. PLC Program Patterns for HMI Data Exchange

The simplest HMI exchange is direct tag polling: WinCC Flexible issues cyclic READ_VAR on configured tags, and the CPU responds without any PLC code. This is sufficient for status display, setpoint write-back, and acknowledgment bits.

For bulk transfers, the PLC uses the S7 communication functions. On S7-300, the standard blocks are FC 5 (AG_SEND) and FC 6 (AG_RECV), callable from any OB. On S7-400 and on newer S7-300 CPUs, the integrated SFB 12 (BSEND) / SFB 13 (BRCV) provide a more efficient stream-oriented alternative. For HMI-to-HMI or HMI-to-PG copy jobs, the PG/PC side issues a PUT or GET primitive that the CP 343-1 maps onto the configured S7 connection without PLC code on the partner side, provided the target area is not write-protected.

Sample FC call in STL for an AG_SEND of 200 bytes from DB 100 to a remote partner via connection ID 1:

CALL  "AG_SEND"
     ACT    := TRUE
     ID     := 1                       // S7 connection ID
     LADDR  := W#16#0100               // Logical base address of CP 343-1
     SEND   := P#DB100.DBX0.0 BYTE 200 // Source pointer
     LEN    := 200
     DONE   := M10.0
     ERROR  := M10.1
     STATUS := MW12
     NOP 0;

Sample SCL (structured control language) version in an FC cycle for the matching AG_RECV on a separate OB1 call slot:

IF "recv_trigger" THEN
   "AG_RECV_Block"(ID := 1,
                  LADDR := 16#0100,
                  RECV := P#DB110.DBX0.0 BYTE 240,
                  NDR => "recv_ndr",
                  ERROR => "recv_err",
                  STATUS => "recv_status",
                  LEN => "recv_len");
END_IF;

Make sure the CP 343-1 hardware address (LADDR) matches the I/O address of the CP in HW Config. The default is 0100 hex for a CP in slot 4 with the standard address assignment; verify in HW Config > CP343 > Object Properties > Addresses.

8. Building the WinCC Flexible Project

1. Connections. Open the Connections editor and confirm the S7-300/400 over TCP/IP entry points to the CP 343-1's IP, rack, and slot. Save and rebuild.
2. Tags. Create internal and external tags. For external tags, select the connection and enter the PLC address from Table 3. Use symbolic names if STEP 7 integration is enabled (Options > STEP 7 Symbol Table Integration).
3. Area pointers. WinCC Flexible uses area pointers to exchange non-tag data, including:
   • Coordination — startup and lifetime handshake between RT and PLC
   • Date/Time — time sync from PLC to RT
   • Project ID — runtime consistency check
   • Job mailbox — control commands for recipes, screen selection, password reset
   Reserve a DB (e.g., DB 99) for these area pointers, and assign each pointer a unique starting offset. Each area pointer requires 8 to 24 bytes; the Coordination pointer is 1 word.
4. Screens. Add I/O fields, buttons, and alarms bound to the configured tags. Use the connection's tag quality display to expose communication faults in operator-friendly form.
5. Alarms. Discrete alarms can be triggered by tag edges (HMI-side) or by bit messages from the PLC. Use bit messages for guaranteed delivery in a coordinated system.
6. Recipes. Recipe data is stored in the RT machine database and transferred to the PLC on demand. Define a recipe DB (e.g., DB 50) of 200 to 800 bytes typical. WinCC Flexible generates a UDT in STEP 7 if you choose to compile recipes into the PLC.

9. Runtime Licensing and Power-Tag Budget

WinCC Flexible Runtime is licensed by the number of power tags. A power tag is a tag that participates in logging, alarming, or trending, or that is read from or written to the PLC cyclically with a settable acquisition cycle. Pure display tags used only in screen objects with no logging, no alarming, and the default 1 s update do not count as power tags in the conservative interpretation; check the exact rule in the WinCC Flexible manual for the specific version.

Transfer the license via the Automation License Manager (ALM). The license is bound to the panel's hard disk serial number (volume serial). If you swap the panel's storage, plan for a license reclamation through the Siemens license portal.

10. Commissioning and Verification

1. Layer 1 — physical. LINK LED on the CP 343-1 solid green, LINK LED on the PC Ethernet port solid green. Cable tester shows all four pairs wired (for 100BASE-TX) and within length spec.
2. Layer 2/3 — network. From the PC, ping the CP IP. ping 192.168.0.1 -t with -t on Windows; the first ping can take up to 2 s while the CP populates its ARP cache. Subsequent pings should be < 1 ms on a switched network.
3. Layer 7 — application. Start WinCC Flexible RT. Open the Diagnostics view (Project > RT > Diagnostics). The connection line should be solid green, with a tag count and a cycle time displayed.
4. Tag-level verification. Use the tag simulator in WinCC Flexible (Tools > Tag Simulation) or, in the running RT, use a tag test with a forced value. Confirm the value reflects in the PLC by monitoring in STEP 7 online (for tags in M or DB areas).
5. CP diagnostics buffer. In STEP 7, PLC > Diagnostic/Setting > Diagnostic Buffer. There should be no entries of class Connection with status codes 0x0206 (partner not reachable) or 0x0401 (TSAP mismatch).

11. Troubleshooting Matrix: LEDs, Diagnostic Buffer, and Tags

12. Best Practices and Migration Path

• Keep WinCC Flexible 2008 SP5 or move to TIA Portal. WinCC Flexible is end-of-life for new development. New projects should use TIA Portal V17/V18 with WinCC Comfort, Advanced, or Professional. The migration tool converts a WinCC Flexible project to a TIA Portal project and re-maps the S7-300/400 connection to an HMI connection on the TIA-side S7-1500 or S7-300 target.
• Reserve a coordination DB. A small DB (e.g., DB 99) holding the coordination pointer, date/time, and project ID is essential. It is the runtime handshake that WinCC Flexible needs to start cleanly.
• Use a managed switch. For shop-floor panels, a SCALANCE XC-100 or XB-200 series managed switch gives you SNMP, port diagnostics, and redundancy features that pay back quickly during commissioning and aftercare.
• Tag naming convention. Adopt a single tag prefix per area (e.g., HMI_StartPermit, MOT_RunCmd) so that the WinCC Flexible project remains maintainable. Import the STEP 7 symbol table directly.
• Substitute a CP 343-1 Advanced for >16 connections. The standard CP 343-1 supports 16 S7 connections total. If your PC runtime, a PG, an OPC server, and a couple of PUT/GET partners are already in the budget, the limit is reached quickly. The Advanced variant doubles the budget and adds IT functions.
• Plan for PLC runtime. A 1 s update cycle on 100 tags generates 100 S7 read requests per second. On a CPU 315-2 DP, this is negligible. On a CPU 312, allocate connection resources carefully and consider increasing the cycle to 2 s for non-critical tags.