CP 341 RS232 to iFIX: Configuring RK512 Communication on S7-300

CP 341 RS232 to iFIX: Configuring RK512 Communication on S7-300

The Siemens CP 341 communications processor provides point-to-point (PtP) serial connectivity for the S7-300 family. When integrating a CP 341 RS232 channel to a GE/Emerson Intellution iFIX SCADA node, the protocol running on the PLC side must match a protocol that the iFIX host can answer. This reference covers the hardware selection, RK512 parameter assignment, FB8/FB9 program structure, wiring, and the iFIX integration paths that resolve the most common "RX/TX LEDs blink but no data appears in iFIX" symptom seen after an S5-to-S7 conversion.

Problem Definition

The classic failure mode after porting an S5 program that used RK512 to an S7-300 station is that the CP 341 RX and TX LEDs flash in a regular pattern but no process values ever appear in the iFIX database. The PLC is sending; the SCADA side shows nothing. In most field cases this is a protocol mismatch problem, not a wiring problem, and the iFIX host has no driver that understands RK512 frames.

CP 341 Hardware Selection

The CP 341 ships in three variants. Confirm the order number (MLFB) on the module front before any parameterization — RK512 over RS232 is only valid on the RS232C variant. Reference the CP 341 Point-to-Point Communication Installation and Parameter Assignment Manual for the full variant matrix.

The serial driver must be loaded onto the CP 341 flash before any user program can use the chosen protocol. The driver selection is performed once in the CP 341 parameter assignment and is independent of the user program. For RK512, install the RK512-512 loadable driver on the CP 341 using the "Load driver" function in the CP 341 PtP parameterization tool. Firmware updates and the current CP 341 driver bundles are available from Siemens Industry Online Support; the CP 341 firmware family (V1.x) is compatible with the standard RK512 driver bundle shipped with STEP 7 V5.5 / TIA Portal.

iFIX Integration Path Selection

Intellution iFIX (now Emerson PAC) does not provide a native RK512 driver in current releases. The recommended integration paths in order of engineering effort are:

1. OPC bridge over Industrial Ethernet or MPI/Profibus — Use the Siemens SIMATIC NET OPC server (or a third-party OPC server such as KEPware) on a PC connected to the S7-300 via TCP/IP. iFIX consumes OPC tags via its OPC PowerTool client. This is the lowest-effort path on the iFIX side and avoids the serial cable entirely. The CP 341 is removed from the configuration in favor of a CP 343-1 Lean (6GK7343-1CX10-0XE0) or the integrated PN port of the CPU 315-2 PN/DP.
2. Modbus RTU over the existing CP 341 RS232 — Reconfigure the CP 341 to Modbus master and have iFIX connect through a Modbus RTU OPC server or the iFIX native Modbus RTU driver. This requires changing the protocol on the CP 341 from RK512 to Modbus master and modifying the S7 program to use FB7 P_SND_RM / FB10 P_RCV_RM instead of FB8/FB9. This is the most reliable serial path if iFIX is the only consumer.
3. ASCII polled protocol — Use the CP 341 ASCII driver and implement a simple request/response protocol on the iFIX side using the iFIX EDA or a custom COM script. This is the most fragile option and is only suitable when the iFIX side must poll a custom device with a non-standard protocol.
4. RK512 retained (legacy) — If the legacy iFIX driver (e.g., the GE Fanuc RKE-512 OPC server or the Kepware Siemens RKE-512 driver) is still installed and has been validated against the iFIX node, RK512 can remain. Modern iFIX deployments typically do not include this driver.

RK512 Protocol Configuration on the CP 341

RK512 is a Siemens-specific protocol layered on the ISO-1745-based 3964R transport. It supports request/response and broadcast frames with a 1..256 byte payload, CPU/DB addressing on the partner device, and an XON/XOFF-free half-duplex discipline. The CP 341 implements RK512 as an off-the-shelf driver that handles framing, the 3964R acknowledgment, and the partner-side DB numbering.

To configure RK512 on the CP 341:

1. In STEP 7 HW Config, place the CP 341 in the S7-300 rack at any free slot. The CP 341 occupies 1 slot but is mapped in the CPU I/O area as a communication processor.
2. Double-click the CP 341 to open Properties. On the Protocol tab, set Protocol = RK512 (the selection is internally implemented as 3964R + RK512 framing).
3. Set the serial parameters: Baud rate = 9600 bit/s, Parity = Even, Data bits = 8, Stop bits = 1. RK512 requires 8E1 framing as the default; do not change parity to None — RK512 mandates even parity for the BCC.
4. Set the partner address. For a point-to-point link to iFIX, leave the partner address at 0 (point-to-point, no addressing). If the link is multi-drop and a Siemens S5 device is at the other end, set the partner address to the slave number configured on the partner.
5. Click "Load driver" in the parameterization tool. This writes the RK512 driver extension into the CP 341 flash. The CP 341 will retain this driver across power cycles until it is overwritten.
6. Compile and download the hardware configuration to the CPU. The CP 341 will go through a restart (LED sequence) and report ready when the SF LED is off.

FB8 P_SND_RK and FB9 P_RCV_RK Programming

The CP 341 RK512 driver is consumed by two function blocks: FB8 P_SND_RK (send) and FB9 P_RCV_RK (receive). Both blocks are shipped in the standard STEP 7 library "CP PtP" under the "CP 341" sublibrary and must be copied into the S7 program before they can be called.

An example call that sends 32 bytes from local DB100 starting at byte 0 to the partner's DB255 starting at byte 0:

// OB1 cyclic, M10.0 toggled by application logic
CALL  "P_SND_RK" , DB30
     REQ   := M10.0          // pulse trigger from application
     R     := FALSE
     LADDR := 256            // CP 341 base address (from HW Config)
     DB_NO := 255            // partner DB number (RK512 addressing)
     DBB_NO:= 0              // partner DB byte offset
     LEN   := 32             // 1..256 bytes
     DONE  := M11.0          // job OK pulse
     ERROR := M11.1          // error pulse
     STATUS:= MW12           // status word
     SRC_DB := DB100         // local source DB
     SRC_DBB:= 0             // local source byte offset

DB255 and Partner Addressing

RK512 uses a partner-side address space. The DB_NO and DBB_NO inputs on FB8/FB9 identify the partner's destination memory, not the local DB. The local data source is set by SRC_DB and SRC_DBB on the same call.

This is the point most often confused during an S5-to-S7 conversion. In the S5 program, the partner's DB255 was referenced because the legacy iFIX peer exposed a 255-byte data block as a "DB255" to the PLC. When the S7 program calls P_SND_RK with DB_NO=255, the CP 341 sends an RK512 command frame requesting to write to DB255 on the partner; the iFIX peer must answer with an acknowledgment. If the iFIX side is configured for a different DB number or if the partner's DB255 does not exist, the request is refused at the RK512 layer and the CP 341 returns ERROR=1, STATUS=0x0B (NACK received). Verify the partner's DB layout before assuming DB_NO=255 is correct.

Wiring the CP 341 RS232C to the iFIX PC

The CP 341 RS232C variant uses a 15-pin Sub-D male connector (X27). For a null-modem DTE-to-DTE connection to the iFIX host PC serial port (also DTE), use the following pin-out:

iFIX Tag Configuration for Modbus RTU

When the CP 341 is reconfigured to Modbus master (FB7 / FB10), iFIX tags are mapped as follows:

For OPC integration, iFIX imports OPC tags from the Siemens SIMATIC NET OPC server. The OPC item path follows the form S7:[S7 connection_1]DB100,BYTE0 for byte access or S7:[S7 connection_1]DB100,INT0 for integer access. iFIX polls the OPC group on a fixed cycle (default 1000 ms; lower to 250 ms for time-critical loops).

Troubleshooting Matrix

Verification Procedure

1. Open STEP 7, go online with the CPU, and force M10.0 in OB1 to trigger a single P_SND_RK call. Verify M11.0 DONE = 1 and M11.1 ERROR = 0 in the VAT.
2. On the CP 341, observe the RX and TX LEDs flash synchronously with each FB8 invocation. If only TX flashes, the partner is not answering.
3. Connect a serial line analyzer (Wireshark with the appropriate serial capture plugin, a hardware protocol analyzer, or a free tool such as hercules SETUP utility in "TCP Client" against a serial-over-IP gateway) to the line and capture one RK512 frame. The frame should begin with STX (0x02), followed by the partner DB and DBB numbers, length, payload, ETX (0x03), and BCC.
4. On the iFIX side, open the Database Manager (DBM) and inspect the tag status. For OPC, the OPC PowerTool client should show "Good" quality on the polled items. For native Modbus, the tag status should report "Good" with a refresh timestamp.
5. If using Modbus master, run ModSim on a PC with a known register pattern and have the CP 341 configured as a Modbus master read that register. Confirm the value lands in the local DB and then verify in iFIX.
6. If using the OPC path, validate end-to-end by toggling a known bit in the S7 DB and confirming the OPC item updates within the configured poll cycle.

Migration Notes from S5

When converting an S5 project that communicated via RK512 to an S7-300 + CP 341 architecture, the following structural changes are required:

• S5 "Send All" (FB 244) and "Receive All" (FB 245) calls are replaced by FB8 P_SND_RK and FB9 P_RCV_RK. The partner addressing parameters are preserved but the local data DB layout must match the new project.
• S5 CP 521 / CP 523 modules are physically replaced by CP 341. The wiring adapter is different — the S5 25-pin ports are not pin-compatible with the CP 341 15-pin X27 connector, so the existing field cable must be re-terminated or replaced.
• The CP 341 RK512 driver does not implement the S5 broadcast or "fetch all" semantics; if the legacy iFIX driver used fetch/poll, the S7 side must use P_RCV_RK to handle inbound partner requests.
• The CP 341 base address in the STEP 7 program (LADDR input on FB8/FB9) must match the I/O base address assigned by HW Config. An off-by-one in this field is a common commissioning error.
• Existing S5 CPU-to-CPU RK512 connections that used the "CPU address" mode (rather than DB addressing) must be migrated to DB addressing — the CP 341 RK512 driver does not implement the S5 CPU-number addressing.

Recommended Architecture for New Projects

For new S7-300 + iFIX integrations, avoid RK512 entirely. The recommended baseline is:

1. CPU 315-2 PN/DP or CP 343-1 Lean for Industrial Ethernet connectivity.
2. Siemens SIMATIC NET OPC server on the iFIX host PC, configured with an S7 connection to the PLC.
3. iFIX OPC PowerTool client importing tags from the Siemens OPC server.
4. TCP/IP transport between PLC and SCADA, eliminating the serial cable and its associated ground/EMI risks.

Reserve the CP 341 RK512 path only for brownfield migrations where the iFIX node has a known-good RK512 driver and the network topology cannot be changed. Reference the TIA Portal CP 341 configuration documentation when re-engineering the serial link to Modbus RTU.

Safety and EMC Considerations

A few field-proven constraints when commissioning the CP 341 in an industrial cabinet:

• Maximum RS232 cable length at 9600 bit/s is 15 m (per EIA/TIA-232). For runs over 15 m, switch to RS485 (CP 341 BH variant) or convert to Industrial Ethernet.
• Use shielded cable with the shield bonded to chassis ground at one end only to avoid ground loops. If ground loops are unavoidable, insert an RS232 isolator (e.g., Phoenix Contact PSM-ME-RS232/RS232-P) in the line.
• Verify the iFIX PC and the S7-300 cabinet share the same protective earth reference. A floating ground on the PC side is a common cause of intermittent communication dropouts that present as STATUS=0x1A (BCC error).
• Disable any power-management on the PC COM port that may put the UART to sleep. Windows Device Manager → Ports → COM port → Power Management → uncheck "Allow the computer to turn off this device to save power".