Connecting S7-300 DP (Profibus) to Ethernet for WinCC SCADA: Four Engineering-Proven Methods

Mixing legacy S7-300 315-2DP CPUs with modern WinCC Runtime over Ethernet is a recurring brownfield problem. The PLC was specced before PROFINET was a default interface, the rack has no spare slot, the SCADA HMI is hundreds of metres away, and the budget will not stretch to a full CPU replacement. This reference walks through every credible integration path—CP 343-1 modules, the 315-2 PN/DP migration, a Profibus card with an OLM, and third-party gateways such as the IBH Link S7++ HS and the Siemens IE/PB Link—together with the backplane current budget, STEP 7 connection configuration, WinCC channel setup, and verification steps you need to make the link reliable on a plant floor.

1. Problem Definition and Architectural Constraints

The CPU 315-2DP (typical order code 6ES7315-2AH14-0AB0) ships with one MPI/DP combined interface and one DP interface. It has no PROFINET port. To exchange cyclic or acyclic data with a WinCC Runtime using the SIMATIC S7 PROTOCOL SUITE channel, the engineering team normally needs one of the following on the PLC side:

• ISO-on-TCP (RFC 1006) / TCP / PROFINET IO on the PLC, and
• An Ethernet path from the SCADA PC to the PLC.

If the PC has no Profibus card and the cables must traverse an existing Ethernet LAN, something must be added on the PLC side, or the CPU must be replaced. The three classic options discussed in field practice are:

1. Add a CP 343-1 communications processor to the S7-300 rack.
2. Replace the CPU with a 315-2 PN/DP variant.
3. Add a Profibus card to the SCADA PC, possibly with an OLM for long runs.

Each has a different cost, footprint, and backplane current impact. A fourth option—a third-party MPI/Profibus-to-Ethernet gateway—requires no slot in the rack and presents an S7-compatible Ethernet endpoint to WinCC. This is often the lowest-impact solution for cabinets that are already fully populated.

2. Option 1 — CP 343-1 Communication Processor Family

Siemens offers several CPs that mount in any standard S7-300 slot and present an industrial Ethernet/PROFINET interface to the CPU via the backplane. The choice is driven by feature set, not just cost.

Always confirm the exact MLFB and current draw from the Siemens Industry Online Support manuals because supply ratings change between hardware revisions and firmware versions.

The CP 343-1 Lean is the lowest-cost pure PROFINET entry point and is sufficient if the only job is to expose S7 connection data to a WinCC station. The CP 343-1 Advanced adds an integrated 2-port switch so the PLC can be daisy-chained into a line topology without an external switch—useful when running a single Ethernet drop to a control cabinet.

2.1 CP 343-1 in HW Config / TIA Portal

Configuration is performed in STEP 7 (HW Config) or TIA Portal. Under the CP's Properties > Ethernet Interface set:

• IP address: e.g. 192.168.0.20
• Subnet mask: 255.255.255.0
• Router use: only if the SCADA PC sits on a different subnet.

After the hardware configuration is downloaded, the S7 connection is built on the CP using NetPro (STEP 7 V5.x) or Devices & Networks > Connections in TIA Portal. The connection type is S7 connection; the local end is the CP, the partner end is the WinCC station's IP.

2.2 Backplane Current Budgeting

The CPU supplies 5 V backplane current to the I/O modules. Adding a CP 343-1 must not push the total over the limit. Use the formula:

I_5V_total = Σ I_5V_modules + I_5V_CP ≤ I_5V_CPU_supply

Typical CPU 315-2AH14 supplies 1.2 A at 5 V to the backplane. The CP 343-1 Lean draws 0.15 A, the Advanced 0.20 A. With a populated rack of 8 SMs, the typical remaining headroom is 0.3–0.5 A, which fits one CP 343-1 but rarely two.

3. Option 2 — Replace the CPU with 315-2 PN/DP

The CPU 315-2 PN/DP (typical 6ES7315-2EH14-0AB0) is the drop-in successor to the 315-2DP. It has the same MPI/DP interface plus a PROFINET interface (two-port switch on most firmware revisions ≥ V3.0). The mechanical footprint and the STEP 7 user program are largely compatible, so the swap is a hardware replacement followed by a hardware-config re-download.

3.1 Migration Checklist

1. Document the existing program, hardware configuration, and any CP 343-1 already in the rack.
2. Order the 315-2 PN/DP with the same firmware family as the original, or with the highest supported by your STEP 7 / TIA version.
3. Re-do HW Config: replace the CPU, set the PN interface IP, and remove any now-redundant CP 343-1.
4. Recompile the user program. STL/FBD/LAD is binary-compatible; SCL sources may need a re-compile.
5. Update the WinCC connection: change the partner IP to the new PN port, leave rack/slot at 0/2.

For a brownfield site with many 315-2DPs, a phased roll-out—migrating only the PLCs that must talk to WinCC—keeps the budget manageable.

4. Option 3 — Profibus Card in the SCADA PC with OLM

If the SCADA PC can accept a Profibus card (PCI or PCIe), WinCC can communicate with the S7-300 directly over Profibus using the SIMATIC S7 PROTOCOL SUITE channel with a Profibus connection type. Common PC cards include the CP 5611, CP 5613, CP 5621, CP 5622, and CP 5623. The PC is then a Profibus master and the S7-300 315-2DP is the slave.

For long distances the copper cable is converted to fibre using OLMs (Optical Link Modules, e.g. 6GK1502-0AB10 for Profibus, 6GK1503-0AB00 for Profinet). An OLM pair at each end converts RS-485 Profibus to multimode or singlemode fibre, giving segment lengths up to several kilometres. This preserves the deterministic Profibus behaviour of the existing bus while reaching the remote SCADA PC.

However, the SCADA PC becomes a Profibus node—the bus must be terminated properly, addresses assigned, and the bus must be physically reachable. If the PC is "very far" and the network topology is pure Ethernet, this option is often impractical.

5. Option 4 — Third-Party Gateways (IBH Link S7++ HS, IE/PB Link, Helmholz)

Where the rack is full and the CPU must stay put, a stand-alone gateway that bridges MPI/Profibus to Ethernet is the lowest-impact solution. The most commonly cited products in field practice are:

• IBH Link S7++ HS (IBHsoftec) — connects MPI, PPI, and Profibus to Ethernet; presents the S7 protocol to a WinCC station via TCP/IP; can service multiple S7-300/400 PLCs from a single gateway.
• Siemens IE/PB Link PN IO (e.g. 6GK1411-5AB10) — Siemens' own Profibus-to-Profinet gateway; acts as a PROFINET proxy and can also expose Profibus slaves as PROFINET devices.
• Helmholz PROFIBUS-to-PROFINET gateways — similar role to the IE/PB Link, with diagnostics tailored to Profibus.

5.1 IBH Link S7++ HS — Practical Profile

The IBH Link S7++ HS sits on the MPI/Profibus connector of the PLC, requires no slot in the rack, and is a single Ethernet endpoint to WinCC. The PLC sees no change. The SCADA simply points its SIMATIC S7 PROTOCOL SUITE > TCP/IP connection at the IBH Link's IP and rack/slot of the target CPU.

Multiple PLCs can be reached through a single IBH Link if the bus topology is a Profibus line. The unit acts as a multi-master on the bus, polling each CPU. This answers the recurring follow-up question of whether one device can serve a whole loop of CPUs: yes, a single gateway can present a logical Ethernet path to every PLC on the same Profibus segment, subject to bus speed and cycle-time limits.

5.2 Siemens IE/PB Link PN IO

The IE/PB Link PN IO is the Siemens-branded alternative. Configured in STEP 7 / TIA as a PROFINET IO proxy, it exposes connected Profibus slaves (including the S7-300 315-2DP master acting as a DP slave in this scenario) to a PROFINET controller. The engineering case is similar to the IBH Link, with the added benefit of native Siemens configuration tooling and the same diagnostics surface as other Simatic Net components.

5.3 WinCC Configuration for a Gateway

From WinCC Explorer's Tag Management, right-click and add a new driver, choosing SIMATIC S7 PROTOCOL SUITE > TCP/IP. In the connection properties:

• IP address: the gateway's Ethernet IP (e.g. 192.168.0.50).
• Rack: 0 (rack of the target CPU as seen by the gateway).
• Slot: 2 (CPU slot on the S7-300).
• Connection type: S7 connection (ISO-on-TCP is selected automatically by the driver for TCP/IP).

Tags are then defined as DB addresses (e.g. DB100,DBW0 for a word in data block 100) the same way as for a direct PN/CP connection. Polling cycle and time-out are set on the channel and connection level; a 1 s cycle and 5 s time-out is a reasonable starting point for SCADA over a gateway.

6. Solution Selection Matrix

7. Backplane Power-Budget Worked Example

Consider a 315-2DP rack holding: CPU 6ES7315-2AH14-0AB0, PS 307 5A, eight SM 321 DI modules, two SM 322 DO modules, one SM 331 AI module, one SM 332 AO module. Approximate 5 V draws (verify against the actual module data sheets):

• SM 321 DI 16 × 24 V: 0.04 A each → 8 × 0.04 = 0.32 A
• SM 322 DO 16 × 24 V: 0.06 A each → 2 × 0.06 = 0.12 A
• SM 331 AI 8: 0.06 A
• SM 332 AO 8: 0.08 A
• CP 343-1 Lean: 0.15 A
• Total module draw: 0.73 A

The CPU 315-2AH14 supplies 1.2 A at 5 V to the backplane. The CP 343-1 Lean can be added without exceeding the budget, leaving 0.47 A of margin. The CP 343-1 Advanced (0.20 A) would still fit, leaving 0.27 A margin.

If the rack were already at 1.05 A draw, adding a Lean CP would push it to 1.20 A—right at the limit, which Siemens explicitly flags as a configuration error. In that scenario, an IM 360/361 extension (powered by a second PS 307) is the engineering-correct fix.

8. Network Topology for the Ethernet Path

The crucial design point is that the CP 343-1 / gateway / 315-2 PN/DP all terminate the Ethernet at the cabinet. Beyond the switch, the existing LAN (managed switches, fibre uplinks, SCADA VLAN) handles the long-distance run to the SCADA PC.

9. STEP 7 / TIA Connection Configuration

For a CP 343-1 or a 315-2 PN/DP, the S7 connection to the WinCC PC is built in NetPro (STEP 7 V5.x) or Devices & Networks > Connections in TIA Portal. Parameters:

After download, the connection can be tested from STEP 7 with Right-click > Connection Test. The diagnostic must report "Connection established" with no error bytes (SFB status 0000).

10. WinCC Channel Configuration

In WinCC Explorer, expand Tag Management, right-click and add the SIMATIC S7 PROTOCOL SUITE channel. Then add a new connection under TCP/IP. Parameters:

• IP address: the CP / PN port / gateway IP.
• Rack: 0.
• Slot: 2 for an S7-300 CPU.
• Update: 1 s for a typical SCADA, 250 ms for fast trends.
• Time-out: 5 s for a normal link, 1 s for a tightly-watched loop.

Tags are then created in the structure tag editor. A typical tag mapping looks like:

Use the Channel Diagnosis applet in WinCC to confirm connection state in real time. A red cross on the connection means the S7 driver cannot establish the ISO-on-TCP session; the most common cause is a Windows firewall rule blocking S7DOS.exe.

11. Verification and Commissioning

1. Physical layer: link LEDs on the CP / gateway / switch are green; Ethernet cable certified for Cat 5e or higher; copper runs < 100 m to the nearest switch port.
2. Address layer: ping the CP / gateway from a maintenance laptop on the same VLAN. Expect < 1 ms on copper, < 5 ms on a routed VLAN.
3. STEP 7 connection test: in NetPro or TIA, right-click the S7 connection and select Connection Test. The diagnostic must report "Connection established" with no error bytes (SFB status 0000).
4. WinCC channel diagnostic: open the S7 PROTOCOL SUITE channel diagnosis. All configured connections should report "OK" and a recent last update timestamp.
5. Tag smoke test: in WinCC tag simulation, force a value in a test DB from STEP 7 and confirm it appears in WinCC within the configured update cycle (typically 250 ms–2 s for SCADA polling).
6. Long-run soak: leave the link active for ≥ 24 h with the live process and watch the connection's error counters in the CP's Web diagnostics (CP 343-1 Advanced) or the gateway's web UI. Zero lost telegrams and zero reconnection events are the acceptance criterion.

12. Troubleshooting Matrix

13. Field-Proven Caveats

• CP 343-1 Lean is not a PROFINET IO controller—it is a PROFINET IO device. If a higher-level PROFINET controller needs to look at it, the CP must be configured as a device, not a controller. This is the most common misunderstanding on the field.
• MPI vs Profibus on the gateway: the IBH Link S7++ HS has separate terminal settings for MPI (187.5 kbit/s default) and Profibus (up to 12 Mbit/s). A wrong baud rate is the single most common reason a fresh gateway install will not see a CPU.
• CP 343-1 Advanced Web diagnostics requires the "Enable Web server" tick in HW Config and a valid administrator password. Without it, the Web UI is invisible and the only diagnostic path is STEP 7.
• Firmware version pinning: when a CP 343-1 is replaced for a fault, the new module often ships with a newer firmware. If the STEP 7 project has a specific firmware pinned, the replacement is rejected on download. Update the HW Config first, then re-download.
• VLAN and broadcast storm risk: the integrated switch in a CP 343-1 Advanced is unmanaged. If a SCADA VLAN is already in place, do not put the CP on a trunk port expecting tag handling—it will not work. Use the CP on an access port only.
• OP 5 / HMI coexistence: if an existing OP or Touch panel already uses the MPI/DP bus, putting a gateway on the same segment will increase bus load. Confirm the existing master has spare token time before commissioning.

14. Standards and Reference Documents

Verify the backplane supply, module draw, and EMC/classification numbers in the official manuals before sign-off:

• Siemens Industry Online Support — entry point for S7-300 manuals, FAQs, and firmware downloads.
• S7-300 CPU 315-2DP / 315-2 PN/DP operating instructions — confirm 5 V supply ratings and firmware compatibility.
• CP 343-1 Lean / CP 343-1 / CP 343-1 Advanced manual — function blocks (FB 14, FB 15), connection resource limits, Web diagnostics.
• SIMATIC S7 PROTOCOL SUITE channel — WinCC V7.x / TIA WinCC — driver parameter reference and supported S7 function sets.
• IBHsoftec product pages — IBH Link S7++ HS datasheet and configuration tooling.