Configuring S7-300 to S7-200 Ethernet Communication via GET/PUT

1. Overview: S7 Communication Between S7-300 and S7-200

Siemens S7 communication over Industrial Ethernet allows deterministic, connection-oriented data exchange between SIMATIC controllers using the ISO-on-TCP (RFC 1006) transport protocol. The S7-300 family supports bidirectional server and client roles through the SIMATIC NET library blocks FB14 GET and FB15 PUT, while an S7-200 station with a CP 243-1 Ethernet module acts as an S7 server reachable over a single, statically configured S7 connection.

This article details the end-to-end configuration for an asymmetric setup where an S7-300 CPU 312 (with a CP 343-1) reads from and writes to an S7-200 CPU 224 (with a CP 243-1). The same principles apply to other S7-300 CPUs (313, 314, 315, 316, 317, 319) and S7-200 CPUs (221, 222, 224, 224XP, 226) when paired with the corresponding Ethernet CP. Official documentation is available in the Siemens application note S7 communication over Industrial Ethernet.

2. Prerequisites

Confirm the CP 343-1 is installed in a slot with its own hardware catalog entry (slot 4 in a typical S7-300 rack, but slots 0–11 are supported depending on the mounting rail). The CP 243-1 in the S7-200 must be plugged into the expansion port of the CPU 224; the S7-200 does not have a backplane with discrete slots.

3. Hardware Configuration and IP Addressing

1. Set the CP 243-1 IP address. Use the Ethernet Wizard in STEP 7-Micro/WIN to assign an IP address (e.g., 192.168.0.10), subnet mask (255.255.255.0), and the CP 243-1 module position (must match the physical connection: 0 for the first CP, 1 for the second).
2. Set the CP 343-1 IP address. In HW Config, double-click the CP 343-1, open Properties > Ethernet Interface, and assign a static IP (e.g., 192.168.0.1) and subnet mask. Disable router and PROFINET IO options if not needed.
3. Verify physical link. Connect both controllers through a switch or via a crossed patch cable. The CP 243-1's LINK LED and the CP 343-1's LINK LED must be solid green. Use ping from a maintenance PC on the same subnet to confirm Layer 3 reachability.
4. Configure PG/PC interface. Set the programming device to use the S7ONLINE access point (TCP/IP, ISO, or anybus) compatible with both CP types. STEP 7 and Micro/WIN must use the same access point if both are run from the same PC.

4. Understanding TSAPs for the S7-300 and S7-200

A Transport Service Access Point (TSAP) uniquely identifies an S7 endpoint inside an ISO-on-TCP connection. Each TSAP is a two-byte value where the high byte typically encodes the connection resource and the low byte encodes the local/remote slot of the CP.

The local TSAP of the S7-300 cannot be freely edited in the S7 connection properties; STEP 7 derives it from the slot of the CP and the assigned connection resource. The remote TSAP of the S7-200 must be entered manually in the partner's address details of the S7-300 connection. Setting the wrong remote TSAP is the most common cause of STATUS = 0x0001 on GET/PUT.

5. Configuring the S7 Connection in STEP 7 (S7-300 Side)

1. In the S7-300 station, right-click the CPU 312 and choose Insert New Connection > S7 Connection.
2. In the connection partner dialog, select Unspecified if the S7-200 is not part of the STEP 7 project (the typical case when the S7-200 is programmed with Micro/WIN). If both stations are inside the same project, select the partner CPU directly.
3. Open Properties > Address Details on the new S7 connection. Configure the partner IP address (192.168.0.10 for the CP 243-1).
4. Enter the Remote TSAP as 10.00 for the default CP 243-1 configuration. Format: high byte / low byte in hexadecimal, e.g., 10 00.
5. Click OK and Download the hardware configuration plus the S7 connection to the S7-300 station. The connection DB (e.g., DB100) is generated automatically by STEP 7.
6. Note the connection ID shown in the connection table (e.g., 1). This ID is required as the ID input of FB14 and FB15.

6. Configuring the CP 243-1 with the STEP 7-Micro/WIN Ethernet Wizard

1. Launch STEP 7-Micro/WIN and open the project for the CPU 224.
2. Select Tools > Ethernet Wizard. The wizard creates a wizard sub-routine that runs once per scan to maintain the S7 connection state.
3. Specify the module position (0 for the first CP 243-1), IP address (192.168.0.10), and subnet mask (255.255.255.0).
4. Configure the byte count of the V memory reserved for the CP 243-1 (default: 100 bytes starting at VB100). The wizard will use this area to hold the connection control structures.
5. Configure the S7 connection with the following critical parameters:
   • Server Connection: Yes (this is the role of the S7-200).
   • TSAP for this S7-200: 10.00 (default).
   • Remote IP/TSAP: Although Micro/WIN requires entry of a partner IP and TSAP, the CP 243-1 will accept any S7 client connection; the entry is informational. Use 192.168.0.1 and TSAP 10.04 for documentation purposes.
6. Assign a number of peer-to-peer (P2P) or S7 connections (1 is sufficient for a single S7-300 client).
7. Complete the wizard and let it generate the configuration subroutine (typically ETH0_CTRL / ETH0_XFR). Call ETH0_CTRL once per scan from the main OB1.
8. Download the project to the CPU 224.

7. Programming FB14 (GET) and FB15 (PUT) on the S7-300

The SIMATIC NET library blocks reside in Libraries > SIMATIC_NET_CP > CP 300 > Blocks. Both FBs share identical input/output semantics and are called from OB1 cyclically.

FB14 GET — Sample Call

CALL  "GET" , DB_GET
REQ     := M10.0              // Trigger, must be a 1-shot pulse
ID      := 1                  // S7 connection ID from HW Config
NDR     := M10.1              // New data ready (TRUE for one scan on success)
ERROR   := M10.2              // Error flag
STATUS  := MW12               // Detailed status word (16-bit)
ADDR_1  := P#DB1.DBX0.0 BYTE 20   // Read 20 bytes from S7-200 DB1 (V memory)
RD_1    := P#M100.0 BYTE 20       // Local target buffer in M area

FB15 PUT — Sample Call

CALL  "PUT" , DB_PUT
REQ     := M11.0              // Trigger, must be a 1-shot pulse
ID      := 1                  // Same S7 connection ID
DONE    := M11.1              // Job completed (TRUE for one scan on success)
ERROR   := M11.2              // Error flag
STATUS  := MW14               // Detailed status word (16-bit)
ADDR_1  := P#DB1.DBX100.0 BYTE 10  // Write 10 bytes into S7-200 DB1 offset 100
SD_1    := P#M200.0 BYTE 10        // Local source buffer in M area

Each block is instance-called with its own instance DB (e.g., DB_GET, DB_PUT). The ID parameter must match the connection ID in the S7 connection table. The maximum data length per call is 160 bytes for GET/PUT (some firmwares support 222 bytes; check the CP 343-1 GSD/firmware release notes).

8. Accessing S7-200 V Memory as DB1

The CP 243-1 exposes the CPU 224's V memory (variable memory) as data block DB1 on the S7 communication partner. This is a fixed mapping: VB0 on the S7-200 corresponds to DB1.DBX0.0 on the S7-300, and VB100 corresponds to DB1.DBX100.0.

The S7-300 cannot reference V memory directly; it must use the explicit ANY pointer format P#DB1.DBX<offset>.0 BYTE <count>. Avoid overlapping the V memory range used by the Ethernet Wizard (default VB100–VB199 on a 100-byte allocation). Always reserve a clean area outside the wizard footprint for application data.

9. The REQ Bit Cycling Requirement

A frequently missed operational detail is the edge-triggered behavior of the REQ input. The FB14/FB15 do not poll or re-arm automatically; they fire once on a 0→1 transition of REQ and then return to idle. If REQ remains continuously TRUE:

• The block issues a single job, completes it, and then does not issue a follow-up job until REQ returns to 0 and rises again.
• The ERROR and STATUS outputs may show 0 and 0x0000 even when no data is being exchanged, because the last successful call cleared the status.
• The S7-200 V memory values will appear frozen or stale.

Implement a pulse generator to cycle REQ:

// Pulse pattern: 1-second true, 1-second false
A      M10.0
L      S5T#1S
SD     T1                // T1 turns on for 1s on rising edge of M10.0
A      T1
=      M10.0             // T1 self-holds M10.0 high for 1 s
AN     T1
L      S5T#1S
SE     T2                // 1 s off-delay
A      T2
AN     T1
=      DB_GET.REQ        // 1-shot pulse each 2 s

For continuous read of a slowly changing value (e.g., a process variable updated every 100 ms by the S7-200), 1-second polling is sufficient. For data acquisition with < 100 ms jitter, use a faster pulse (e.g., S5T#200MS).

10. Verification and Diagnostics

1. Online view of STATUS. Open the instance DB in STEP 7 online and monitor the STATUS word of FB14/FB15. Common return codes:
   • 0x0000 — Job completed without errors.
   • 0x0001 — Connection error (TSAP mismatch, partner unreachable).
   • 0x0007 — Resource error (no free connection on the CP 343-1).
   • 0x000A — Object access error (e.g., partner DB does not exist on the S7-200). Note that DB1 always exists virtually on the S7-200.
   • 0x000E — Negative acknowledgement from partner; check CP 243-1 diagnostics via Micro/WIN.
2. CP diagnostics buffer. Open the CP 343-1 in HW Config and use Diagnostics > Buffer to read any S7 connection events. The buffer reports Connection Established, Connection Aborted (Reason: TSAP not found), or Connection Aborted (Reason: Partner not reachable).
3. CP 243-1 status LED. A steady LINK LED and a slow-blinking STATUS LED indicate the CP is operational. Rapid blinking of STATUS indicates no S7 connection is currently active; persistent off indicates a hardware fault.
4. Data verification. Toggle a known bit (e.g., M200.0) in the S7-200 by writing through a Micro/WIN status chart; observe the corresponding bit in the S7-300 instance DB or VAT to confirm end-to-end transfer.

11. Troubleshooting Matrix

12. Field-Proven Configuration Checklist

• One-sided S7 connection: The S7-300 is the only side that needs an S7 connection configured. The S7-200 is a passive server.
• TSAP 10.00 is the canonical S7-200 server TSAP for the first CP 243-1. Use 10.01, 10.02, ... for additional CP 243-1 modules.
• Slot 4 of the S7-300 is the default slot for the CP 343-1, giving a local TSAP of 10.04 (with resource 10). Always confirm the actual slot and update the partner TSAP reference accordingly.
• V memory reserved for the Ethernet Wizard must not be used for application data. Default 100 bytes starting at VB100 is the most common allocation.
• REQ edge-triggering is mandatory; constant-high REQ is a hidden failure mode that latches STATUS=0 while no data is exchanged.
• Maximum payload per call is 160 bytes for GET/PUT; for larger transfers, use BSEND/BRECV (FB12/FB13) which can transfer up to 32 KB per call.
• Symmetric routings (S7-200 → S7-300) require the same S7 connection on the S7-300 side; the S7-200 does not initiate, it only responds.