Configuring Siemens S7-300 to Honeywell DCS Ethernet CP 343-1

1. Integration Scenario Overview

Engineers integrating a legacy SIMATIC S7-300 station - specifically a CPU 315-2DP combined with a CP 343-1 (catalog number 6GK7 343-1CX10-0XE0) communications processor - with a Honeywell Experion DCS most often do so through a SIMATIC NET software stack running on the DCS server. The CP1613 PCI card installed in the Experion station is a Siemens industrial Ethernet adapter (6GK1 161-3AA00), not a Honeywell-native card. The card exposes Siemens S7 Communication, ISO-on-TCP, TCP and UDP transports to the host PC, where SIMATIC NET v6.4 or v7.1 SPx presents the data through an OPC Data Access 2.0/3.0 server that Experion reads as a foreign channel.

This reference walks through the entire integration stack: assigning the CP 343-1 IP address, selecting a transport, configuring the S7 connection in NetPro, calling FB14/FB15 or AG_SEND/AG_RECV in the S7 program, building the PC station with CP1613 in STEP 7, and binding the resulting OPC items to Experion parameters. The same configuration applies to deployment over a VSAT or VPN bridged Ethernet segment with one caveat: S7 Communication is sensitive to round-trip latency and works best below approximately 250 ms; for higher latency prefer ISO-on-TCP or raw TCP with application-level acks.

2. Hardware and Software Prerequisites

Verify each item with the latest Siemens and Honeywell release notes:

• SIMATIC S7-300 Communication - Function Manuals
• CP 343-1 Lean (6GK7343-1CX10-0XE0) Device Manual
• SIMATIC NET S7-1613 Edition 2008 / S7-OPC Manual Collection
• Honeywell Experion PKS Product Page

3. CP 343-1 Hardware Configuration in STEP 7

1. Open the S7 project in STEP 7 and double-click Hardware.
2. In HW Config, drag the CP 343-1 Lean from the catalog (SIMATIC 300 > CP-300 > Industrial Ethernet > CP 343-1 Lean) into slot 4 of the S7-300 rail. The slot assignment is fixed: slot 4 for the CP.
3. Double-click the CP module to open Properties - Ethernet Interface.
4. Click Properties next to the IP address and assign a static address in the engineering subnet (for example 192.168.10.10 / 255.255.255.0). Avoid DHCP unless the SIMATIC NET station also uses a DHCP reservation.
5. If the link must traverse a router, enter the Router Address field. Set the Use Router flag for the S7 connection in NetPro.
6. Open the Options tab of the CP. Set the maximum number of S7/ISO/TCP/UDP connections according to the Lean limit of 16 total.
7. Compile and download the hardware configuration to the CPU (PLC > Download to Target).

4. Protocol Selection Matrix

Pick the transport first - the rest of the configuration, the function blocks, and the SIMATIC NET connection object all derive from this choice.

5. STEP 7 NetPro Connection Configuration

1. Open NetPro from the STEP 7 project.
2. Right-click the CP 343-1 and choose Insert New Connection.
3. For the partner select Unspecified if the SIMATIC NET station has not yet been added, or browse to the PC station once it is configured.
4. For connection type choose S7 connection (recommended) or ISO/TCP/UDP per Section 4.
5. In the Addresses tab, enter the partner IP address (192.168.10.20 for the Experion server) and the TSAP. For S7 Communication the partner TSAP is typically 03.01 (slot 1, rack 0) or 10.01 for the S7-1613 OPC server. The local TSAP defaults to 10.02 and does not normally need to be changed.
6. Tick Establish an active connection on the PLC side for the S7-1613 server (which is always passive in the SIMATIC NET stack).
7. Click OK, compile, and download the connection table to the CPU.

6. S7 Communication: FB14 PUT and FB15 GET

With an S7 connection in NetPro, the PLC exchanges data with the partner CPU by calling FB14 (PUT) and FB15 (GET). The blocks are part of the Standard Library that ships with STEP 7 and reside in Library > SIMATIC_NET_CP > CP 300. Drop the type FB14 and FB15 into the S7 program as multi-instances or as standalone instance DBs.

FB14 PUT input/output (excerpt):

• REQ BOOL - rising edge triggers a write
• ID WORD - connection ID from NetPro (e.g., W#16#0001)
• DONE BOOL - set when the transfer completes
• ERROR BOOL - set on error
• STATUS WORD - return code
• ADDR_1..ADDR_4 ANY - destination pointers in partner (e.g., P#DB100.DBX0.0 BYTE 20)
• SD_1..SD_4 ANY - source pointers in local PLC (e.g., P#DB200.DBX0.0 BYTE 20)

FB15 GET input/output (excerpt):

• REQ BOOL - rising edge triggers a read
• ID WORD - same connection ID
• NDR BOOL - new data received
• ADDR_1..ADDR_4 ANY - source pointers in partner
• RD_1..RD_4 ANY - destination pointers in local PLC

Sample SCL call (S7-300/400 compatible) that periodically pushes DB200 into the partner DB100:

// Trigger PUT every 1 s
IF "Clock_1Hz" THEN
    "iDB_PUT".REQ := TRUE;
    "iDB_PUT".ID := W#16#0001;
    "iDB_PUT".ADDR_1 := P#DB100.DBX0.0 BYTE 20;
    "iDB_PUT".SD_1 := P#DB200.DBX0.0 BYTE 20;
END_IF;

"PUT_FB14"(REQ := "iDB_PUT".REQ,
           ID  := "iDB_PUT".ID,
           DONE => "iDB_PUT".DONE,
           ERROR => "iDB_PUT".ERROR,
           STATUS => "iDB_PUT".STATUS,
           ADDR_1 := "iDB_PUT".ADDR_1,
           SD_1 := "iDB_PUT".SD_1);
IF "iDB_PUT".DONE OR "iDB_PUT".ERROR THEN
    "iDB_PUT".REQ := FALSE;
END_IF;
IF "iDB_PUT".ERROR THEN
    "Last_Status" := "iDB_PUT".STATUS;
END_IF;

7. Open User Communication: AG_SEND and AG_RECV

For ISO-on-TCP, TCP, or UDP, drop FC5 (AG_SEND) and FC6 (AG_RECV) from Library > SIMATIC_NET_CP > CP 300. Both blocks take a connection ID and an ANY pointer; the difference is in the call pattern - AG_SEND is triggered with REQ while AG_RECV is called cyclically and completes when NDR rises.

STL example for ISO-on-TCP on connection ID W#16#0002:

CALL "AG_SEND"  // FC5
REQ    := M 10.0          // trigger bit
ID     := W#16#0002       // NetPro connection ID
LADDER := P#M 100.0 BYTE 50
DONE   := M 14.0
ERROR  := M 14.1
STATUS := MW 16

CALL "AG_RECV"  // FC6
ID     := W#16#0002
LADDER := P#M 200.0 BYTE 50
NDR    := M 18.0          // new data received
ERROR  := M 18.1
STATUS := MW 20
LEN    := MW 22           // actual bytes received

The CP 343-1 buffers up to 8 send and 8 receive jobs per connection. The NDR/ERROR bits on AG_RECV must be evaluated and reset in the user program to avoid job overruns. For UDP the call pattern is identical but you can broadcast by setting the partner address to 255.255.255.255 in NetPro.

8. SIMATIC NET PC Station with CP1613

1. On the Experion server, install the SIMATIC NET PC software (V6.4 or V7.1). Reboot when prompted.
2. Physically seat the CP1613 into a free PCI slot and start the Configuration Console (Start > SIMATIC > SIMATIC NET > Configuration Console).
3. In the Configuration Console, the CP1613 should appear as a IE General module. Click Properties and assign a static IP address (for example 192.168.10.20 / 255.255.255.0). The CP1613 MAC address is printed on the bracket and on the module label.
4. Open STEP 7 on the engineering station and add a SIMATIC PC Station to the project. Drag a CP1613 into the PC station's slot and an OPC Server (S7-1613 IE) into slot 1 of the software interface.
5. In NetPro, drag a connection from the OPC Server to the S7-300 CPU and select S7 connection. The TSAP on the OPC server side is fixed at 10.01. The PLC side TSAP is set to 10.02 automatically.
6. Compile the PC station (Station > Compile and Check Consistency) and download it via the PC Internal or TCP/IP download path to the Experion server's hard disk (target file %programfiles%\Siemens\Automation\S7dat\xdb\<station>.xdb).
7. Restart the SIMATIC NET service: net stop s7oiehsx then net start s7oiehsx, or use the Commissioning Wizard.

9. S7-1613 OPC Server and Tag Browsing

1. On the Experion server, open the OPC Scout (Start > SIMATIC > SIMATIC NET > OPC Scout).
2. Create a new group (e.g., S7_to_Experion) and add a server definition pointing to OPC.SimaticNET.
3. Browse the server namespace. The path is S7 > [connection name] > [CPU] > S7 > DB100 > DB[100].Byte 0 for a data block. Drag the desired items into the group.
4. Click Read and verify that values appear. Trigger a write to confirm the round-trip latency is acceptable.

The OPC Scout also exposes the connection status under S7 > [connection] > Status. A red X means the S7 connection is down; the most common reason is a TSAP or IP mismatch. The OPC item address syntax is S7:[connection name]DB<number>,BYTE <offset>,<type> (e.g., S7:[S7_to_PLC]DB100,BYTE 0,REAL).

10. Honeywell Experion OPC DA Channel

1. Open Quick Builder on the Experion Engineering station and create a new Channel of type OPCDA.
2. Point the channel at the local OPC server: OPC.SimaticNET on host localhost.
3. Define a Device for the S7-300 with a scan class of 1 second (default) or 250 ms for high-speed data.
4. Map Experion parameters to OPC items using the syntax S7:[S7_to_PLC]DB100,BYTE 0,REAL. The mapping editor supports import/export to CSV.
5. Download the channel to the Experion server and verify that parameters show good quality (Good in the station detail display).

For redundancy, configure two OPC channels and use the ChannelType = OPCDA_RED to load-balance reads; SIMATIC NET's OPC server runs as a Windows service and supports hot failover when the S7 connection is mirrored in NetPro.

11. Data Format, Byte Order, and DB Layout

The CP 343-1 transmits data in big-endian on the wire regardless of the byte order of the source DB. S7-300 CPUs store INT, DINT, and REAL in little-endian; the S7 Communication and AG_SEND drivers handle the byte swap automatically. ISO-on-TCP and raw TCP do not perform this swap - the user program must.

Standard layout for a 20-byte interface DB on the S7-300 side:

For a multi-block PUT, place related variables contiguously to avoid split areas - the CP 343-1 will reject a PUT whose ADDR_1 and ADDR_2 areas overlap or are non-contiguous in the same DB.

12. WAN / VSAT Deployment Considerations

VSAT links add 500-1500 ms of one-way latency and 1-5% packet loss. S7 Communication is a request/response protocol with a default 3 s timeout and will time out repeatedly above 1 s RTT. Use the following mitigations:

• Switch the transport to ISO-on-TCP and increase the S7-300 Connection Timeout in NetPro from 3 s to 10 s.
• Apply a VPN tunnel (IPsec) on top of the VSAT link to keep the CP 343-1 stack off the public network. Disable PAT and forward only UDP 500 / ESP 50/51 or TCP 1723 depending on the tunnel type.
• Set the SCALANCE switch's QoS Priority to DSCP 46 (EF) for the S7 frames; VSAT modems often drop VoIP-marked traffic first.
• Reduce the polling rate on the Experion side to 2-5 s and use a small number of large PUT/GET calls rather than many small ones - the S7 protocol overhead is roughly 50 bytes per call.
• Enable IGMP snooping only if the OPC server is also multicasting; otherwise disable it to prevent the CP1613 from missing ACKs.

13. Diagnostic LEDs and Online Verification

The CP 343-1 has four front-panel LEDs:

For a complete verification pass:

1. In NetPro, right-click the S7 connection and choose Connection Status. The status should be Established for all enabled connections.
2. In STEP 7, open PLC > Ethernet > Diagnostics and read the CP 343-1 diagnostic buffer. Look for event IDs 0x8A01 (connection established), 0x8A02 (connection terminated), and 0x8A04 (connection rejected - usually a TSAP conflict).
3. In OPC Scout, add a status tag for the S7 connection. The Status item returns 0 = OK, non-zero = error code matching the Siemens manual.
4. From the Experion station detail display, force a small value and observe the change in the PLC using a watch table in STEP 7.

14. Troubleshooting Matrix

15. Migration Path to ControlEdge PLC

For new installations or end-of-life replacements, the Honeywell ControlEdge PLC (C300, ControlEdge HC900, or ControlEdge 900 platform) provides built-in EtherNet/IP and Modbus TCP without requiring a CP1613 card or SIMATIC NET. This eliminates the PC-based OPC layer and reduces the integration surface. The ControlEdge PLC EtherNet/IP Product Information Note documents the topology support (DLR, Star, Line, Mixed) and the scan class timings. Existing S7-300 tag DBs can be re-mapped to ControlEdge tag databases and exposed to Experion via the native channel - no third-party OPC server required.

16. Frequently Asked Questions