CP 343-1 Modbus TCP Configuration: Manual Setup Guide

The Siemens Modbus/TCP Wizard shipped with the S7-300 / S7-400 Modbus library only generates connection data for CPUs that have an integrated PROFINET / Ethernet interface (e.g. CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP, ET 200S CPU). When the Ethernet port is physically present on a separate communications processor such as the CP 343-1 (order number 6GK7 343-1EX30-0XE0), the wizard cannot resolve the hardware path, the CPU dropdown does not list the firmware used in the project, and any generated DB is rejected by the CPU. The correct path is to parameterize the Modbus/TCP connection manually in NETPRO and to call the MODBUSCP function block from the Siemens "ModbusTCP CP" library V4.3.

This article documents the full manual configuration path: NETPRO connection setup, MODBUSCP block parameters, supported function codes, diagnostic error codes, and verification steps.

1. Problem Definition

Typical symptoms reported when the Modbus/TCP Wizard is used with a CP 343-1 based station:

• The wizard's CPU dropdown only lists CPUs with an integrated PN/IE interface. Older CPU 31x-2 DP devices with no onboard Ethernet port do not appear.
• After forcing the wizard to a "nearest match" CPU, the generated connection DB references an integrated IE interface that does not exist on the S7-300 station. SDB download fails with 0xE1FD (connection resource unavailable) or 0x80B1 (interface not found).
• An external Modbus/TCP client (e.g. Modscan, an HMI, or a third-party PLC) cannot open a TCP connection to port 502 of the CP. netstat -an on the CP shows no listener, or the CP rejects the SYN with RST.

Root cause: the wizard writes its connection configuration into the CPU's integrated Ethernet interface parameters. The CP 343-1 is a separate ISO-on-TCP / TCP / UDP / Modbus-TCP endpoint and must be configured through the CP's own connection resources in NETPRO.

2. Supported Hardware and Firmware

The "ModbusTCP CP" library V4.3 (block package MODBUSCP, FB100/FB101/FB102/FB103) supports the following communications processors and minimum firmware versions:

The combination described in the source — CPU 315-2 DP (6ES7315-2AF03-0AB0) plus CP 343-1 (6GK7 343-1EX30-0XE0, FW V2.0) — is a fully supported target for library V4.3.

3. Prerequisites

1. STEP 7 V5.5 + SP2/HF (or STEP 7 V5.6). TIA Portal cannot configure the S7-300 CP 343-1 as Modbus/TCP server; TIA only supports the CP 343-1 Lean and the ET 200S Modbus configuration on a per-port basis. For a classic CP 343-1 + MODBUSCP block, use STEP 7 V5.x.
2. ModbusTCP CP library V4.3, downloaded from Siemens support entry 22660304 — Modbus/TCP CP V4.3 and installed into the STEP 7 library directory.
3. NETPRO (integrated in STEP 7 V5.x) for connection configuration.
4. CP 343-1 firmware ≥ V1.0; V2.0 is recommended for stable Modbus/TCP operation and is the version used in the source configuration.
5. CPU 315-2 DP in firmware V1.1 or higher.
6. Free connection resources on the CP 343-1. The CP supports up to 16 ISO-on-TCP/TCP connections, of which one is consumed by the STEP 7 PG/OP channel by default — leave 15 free for Modbus/TCP use.
7. A Modbus/TCP client (HMI, SCADA, or test tool such as modpoll, Modbus Poll, or a third-party PLC acting as master) reachable on the same Ethernet subnet.

4. Install the ModbusTCP CP Library

1. Download the self-extracting archive ModbusTCP_CP_V4_3.exe from the Siemens support page for the S7 Modbus/TCP CP library. The entry is reachable through the Siemens Industry Online Support portal at support.industry.siemens.com by searching for ModbusTCP CP.
2. Run the installer. It places the library MODBUSCP into the STEP 7 library list and unpacks:
   • FBs MODBUSCP (FB100), MODBUSCP_MASTER (FB101), MODBUSCP_CLIENT (FB102), MODBUSCP_DIAG (FB103)
   • UDTs MODBUS_PARAM, MODBUS_DIAG
   • Example project MODBTCP_EX for CP 343-1 / CP 443-1
   • Manual simatic_modbus_tcp_cp_en-US_en-US.pdf
3. Open the example project and copy the FBs and UDTs into your S7 program. Confirm that FB100, FB101, FB102, FB103 and the UDTs are present in the program blocks of the S7-300 station.

5. Configure the Modbus/TCP Connection in NETPRO

The Modbus/TCP connection is a TCP connection with the CP 343-1 acting as a server on port 502. Configure it from the S7-300 station's perspective:

1. Open SIMATIC Manager → Options → Configure Network (or press the NETPRO button in the toolbar). The S7-300 station must be inserted with its CP 343-1 sub-module and a CPU 300 sub-module.
2. Right-click the CP 343-1 and choose Insert New Connection.
3. Set the partner to Unspecified. The Modbus/TCP client is not represented as a SIMATIC station — any partner that opens a TCP connection to port 502 is accepted. Choose connection type TCP connection.
4. Confirm with Apply → OK. NETPRO creates a new connection with a local ID, for example 1. The SDB is generated at the next Save and Compile.
5. Open the connection properties:
   • General: confirm the local end is the CP 343-1, port 2000–2050 selectable (default 2000 is used for STEP 7 routing; the Modbus/TCP server on the CP listens on port 502 independently of the local port field).
   • Addresses: leave the partner IP address blank — Modbus/TCP clients are accepted from any address by default.
   • Options: leave "Active connection establishment" off (the CP only accepts incoming connections from the Modbus client).
6. Download the new SDB to the CPU using PLC → Download → Connection. The CP 343-1 will restart the connection database — this is normal and the green RUN LED on the CP remains on.

6. MODBUSCP Block Parameters

The function block MODBUSCP (FB100) implements the Modbus/TCP server on the CP 343-1. The block must be called once per Modbus/TCP server instance — typically in OB1 or in a cyclic interrupt OB such as OB35.

MODBUS_PARAM UDT Layout

The MODBUS_PARAM UDT carries the Modbus/TCP server configuration. The relevant fields:

Supported Modbus Function Codes

The MODBUSCP block implements the standard Modbus/TCP function set:

7. Sample STL / SCL Call in OB1

The following STL snippet (STEP 7 V5.5) shows the canonical call of MODBUSCP in OB1. The data area is DB200; the parameter UDT is instantiated in DB100; the diagnostic UDT in DB110.

// OB1 – cyclic call of the Modbus/TCP server
CALL  FB100, DB100                    // MODBUSCP, instance DB = DB100
       REQ   := M10.0                 // 100 ms pulse from timer/clock byte
       ID    := W#16#0001             // connection ID from NETPRO
       PARAM := P#DB100.DBX30.0 BYTE 20   // MODBUS_PARAM inside DB100
       DATA_AREA := P#DB200.DBX0.0 BYTE 1024
       DIAG  := P#DB110.DBX0.0 BYTE 32
       DONE  := M10.1                 // one-cycle pulse on success
       ERROR := M10.2                 // set on rejection
       STATUS := MW12;                // status word for HMI

The same call in SCL (STEP 7 V5.5 / SCL V5.3):

// SCL – single call of MODBUSCP
MODBUSCP (REQ   := Clock_100ms,
          ID    := 1,
          PARAM := MODBUS_PARAM_DB,
          DATA_AREA := MODBUS_DATA_DB,
          DIAG  := MODBUS_DIAG_DB,
          DONE  => Modbus_Done,
          ERROR => Modbus_Error,
          STATUS => Modbus_Status);

The parameter DB is initialized once during startup (OB100) with the values from the table in Section 6. Use MB_SERVER = TRUE, MB_PORT = 502, MB_MAX_CONN = 1, and MB_UNIT_ID = B#16#FF for a single-client Modbus/TCP server.

8. Diagnostics and Error Codes

The STATUS word of MODBUSCP and the MODBUS_DIAG UDT report a structured set of error codes. The most common values are:

CP-level errors (returned in the diagnostic UDT) include SF (group error), BF (bus fault on the Ethernet), and the LED pattern on the front of the CP. Decoding:

• SF on, BF off: CP firmware internal error — power-cycle the station, then check the MODBUS_DIAG for the embedded status word.
• SF off, BF flashing: a TCP connection could not be established. Verify the partner's IP, that the partner is on the same subnet, and that no firewall is blocking TCP/502.
• SF off, BF on steady: duplicate IP address on the Ethernet segment.

9. Step-by-Step Setup Recap

1. Open the STEP 7 project containing the S7-300 station with CPU 315-2 DP and CP 343-1 EX30.
2. Install the ModbusTCP CP library V4.3 from Siemens support and copy FB100, FB101, FB102, FB103 plus the UDTs into the program blocks.
3. Instantiate a parameter DB of type MODBUS_PARAM (e.g. DB100 with the UDT at offset 30) and a diagnostic DB of type MODBUS_DIAG (e.g. DB110). Create a data DB (DB200) with 1024 bytes of accessible memory.
4. Open NETPRO, insert a TCP connection from the CP 343-1 with the partner "Unspecified". Note the connection ID (typically 1).
5. In OB1, call MODBUSCP with ID = 1, the parameter pointer, the data area pointer, and the diagnostic pointer.
6. Download the hardware configuration, the SDB, and the program blocks to the station.
7. Cold-restart the CPU (STOP → MRES → RUN) so the CP 343-1 re-initializes with the new connection database.

10. Verification

Use any Modbus/TCP client tool to confirm the server is reachable.

10.1 With modpoll (open source)

modpoll -m tcp -a 1 -r 1 -c 4 -t 4 -p 502 192.168.0.10
// -t 4 : INPUT REGISTER
// -r 1  : start address 1
// -c 4  : read 4 registers
// expected reply: 0001 0002 0003 0004 (or whatever is in DB200)

If modpoll reports Connection failed: Connection refused, the CP 343-1 is not listening on port 502 — re-check MB_SERVER = TRUE and that the SDB has been downloaded.

10.2 With Modbus Poll

1. Connection → Connect → Modbus TCP/IP. IP = CP 343-1 address, port = 502, connect timeout = 3000 ms.
2. Setup → Read/Write Definition: Function = 03 Holding Register, Address = 0, Quantity = 10, Scan Rate = 1000 ms.
3. If the value cells stay at zero but no red "Comm Error" indicator, the link is up. Set a few registers in DB200 from the S7 program (e.g. L 1234; T DB200.DBW 0) and confirm the value appears in Modbus Poll.

10.3 With S7-side diagnostics

• Monitor MODBUS_DIAG in DB110. Field MB_ACTIVE_CONN should read 1 when the client is connected, 0 when not. Field MB_RX_COUNT and MB_TX_COUNT increment on each request.
• Open CP 343-1 → Diagnostics → Connections in STEP 7 (online) — the Modbus/TCP connection should appear in the list with state ESTABLISHED.
• Set a watch on the CP via SIMATIC Manager → PLC → Diagnostics → Module Information. The CP's Communication tab reports the number of open TCP/UDP connections and the bytes transmitted since the last restart.

11. Common Field Issues and Workarounds

11.1 "Wizard does not list my CPU"

Expected. The Modbus/TCP wizard only supports CPUs with integrated Ethernet interface. The CP 343-1 path is a manual configuration as described in Sections 5–7. The original Siemens application example is in the manual simatic_modbus_tcp_cp_en-US_en-US.pdf shipped with library V4.3.

11.2 CP does not respond on port 502

• Confirm that MB_SERVER = TRUE in the parameter UDT.
• Confirm that the SDB has been downloaded after the NETPRO change — without the SDB the CP does not know it has a TCP connection resource to manage.
• Check the CP's IP access list (CP 343-1 → Properties → IP Access Protection). If access protection is enabled, the Modbus client's IP must be in the allowed list. Permitted range 0.0.0.0–0.0.0.0 means "all" (the default).

11.3 Client can connect but reads return illegal data address (Modbus exception 0x02)

Reduce the client's request quantity. The CP 343-1 EX30 supports at most 125 registers per FC03/FC04 request and 2000 coils per FC01/FC02 request. Exceeding the CP's per-request limit returns exception 0x02. Reduce Quantity in the client to a value below the limit.

11.4 32-bit REAL values are byte-swapped

Modbus is big-endian, S7 is little-endian. A value 1234.56 stored as REAL in DB200 occupies bytes 0x48 0x96 0x14 0x7B. On the wire, Modbus delivers two 16-bit registers, and the client interprets the first register as the high word. To make the value appear correctly to a Modbus client that expects big-endian, swap the words in the S7 program:

// Swap two 16-bit words inside a REAL pair before sending
L  MD 100               // 32-bit REAL, little-endian
T  DB200.DBD 0          // first 4 bytes of the data area
// Now swap words:
L  DB200.DBW 0          // low word
T  DB200.DBW 2          // move to high word position
L  DB200.DBW 2          // high word
T  DB200.DBW 0          // move to low word position

A simpler alternative: implement a cyclic swapping block that processes the entire data area, or use a SCADA that supports configurable byte order (most do).

11.5 Connection drops every 497 days

A known issue in CP 343-1 firmware prior to V2.0.4 caused the internal connection timer to overflow after exactly 497 days of continuous operation, after which the Modbus/TCP server stopped accepting new connections. The fix is firmware V2.0.4 or later; the source configuration is already on V2.0, so apply the latest hotfix from Siemens support.

11.6 Multiple Modbus/TCP clients

CP 343-1 EX30 supports up to 16 simultaneous TCP connections, but the MODBUSCP block only provides a single Modbus/TCP server instance per call. For multiple clients, increase MB_MAX_CONN in the parameter UDT and call the block multiple times with different IDs and separate DATA_AREAs — or upgrade to the CP 343-1 Advanced (6GK7 343-1GX30-0XE0), which natively supports up to 64 Modbus/TCP server connections in a single configuration.

12. Sample Parameter DB (DB100) Initialization

Initialize the parameter DB once in OB100 so that the server is always configured identically after a CPU restart:

// OB100 – restart / cold start
      SET
      S     DB100.DBX 30.0     // MB_SERVER  = TRUE (server enabled)
      L     502
      T     DB100.DBW 32       // MB_PORT    = 502
      SET
      S     DB100.DBX 34.0     // MB_TCP_MODE = TRUE (Modbus/TCP)
      L     W#16#0
      T     DB100.DBD 36       // MB_TIMEOUT = 0 (no watchdog close)
      L     1
      T     DB100.DBW 40       // MB_MAX_CONN = 1
      L     B#16#FF
      T     DB100.DBB 42       // MB_UNIT_ID = 0xFF
      L     1024
      T     DB100.DBW 44       // MB_DATA_AREA_LEN = 1024

13. Standards Reference

• Modbus Organization — Modbus Application Protocol V1.1b3 (function codes, MBAP header, exception codes)
• Modbus Messaging on TCP/IP Implementation Guide V1.0b (port 502, MBAP header layout, connection handling)
• Siemens Industry Online Support for the ModbusTCP CP V4.3 library and the application example PDF