CPU 315PN/DP to S7-400 CP443-1: S7 Communication over Ethernet

David Krause17 min read
Industrial NetworkingSiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

CPU 315PN/DP to S7-400 CP443-1: S7 Communication over Industrial Ethernet

This reference covers the complete configuration of an S7 communication link between a SIMATIC S7-300 CPU 315-2 PN/DP and a SIMATIC S7-400 station equipped with a CP 443-1 Industrial Ethernet communication processor. The procedure uses the standardized S7 connection (configured via NetPro) and the integrated system function blocks SFB14 (GET) and SFB15 (PUT) on the S7-300 side, paired with FB14 (GET) and FB15 (PUT) on the S7-400 side. Alternative paths (open TCP/UDP communication, PROFINET IO, and ISO-on-TCP) are documented for firmware-specific cases.

Scope note: The procedure below applies to STEP 7 V5.5 with the S7-300 / S7-400 option packages and the SIMATIC S7 function library. TIA Portal projects use a similar logic but reference PUT / GET instructions in the "Communication" palette instead of SFB14/SFB15. The configuration sequence (connection in NetPro-equivalent) and the underlying transport (ISO-on-TCP RFC1006 / S7 protocol) remain identical.

1. Communication Architecture Overview

The CPU 315-2 PN/DP integrates a PROFINET interface (X1, 2-port switch, 100 Mbit/s) and a PROFIBUS-DP master/slave interface (X2). The PROFINET port can carry both PROFINET IO and standard S7 communication simultaneously on the same physical port. The CP 443-1 module installed in the S7-400 rack terminates the Industrial Ethernet network and exposes the S7-400 CPU to the same PROFINET subnet.

Station Controller Interface module IP address (example) Subnet mask Rack / Slot
Station A CPU 315-2 PN/DP (6ES7315-2EH14-0AB0) Integrated PN port (X1) 192.168.0.10 255.255.255.0 Rack 0, Slot 2
Station B CPU 414-3 PN/DP (example) CP 443-1 (6GK7443-1EX30-0XE0) 192.168.0.20 255.255.255.0 Rack 0, Slot 4 (CP)

The S7 communication service used by GET/PUT is carried over ISO-on-TCP (RFC 1006) on TCP port 102. The S7-300 PN port and the CP 443-1 must share an Ethernet subnet, and the configured connection must be downloaded to both stations for the partners to authenticate the handshake.

2. Prerequisites

  1. STEP 7 V5.5 SP4 or later with the S7-300 / S7-400 option packages installed. PLCSIM V5.4 SP8 or later is sufficient for offline validation.
  2. CPU 315-2 PN/DP firmware V3.3 or higher. CPU order numbers in scope:
    • 6ES7315-2EH14-0AB0 (current, FW V3.3)
    • 6ES7315-2EH13-0AB0 (FW V3.2)
    • 6ES7315-2AH14-0AB0 (variant with different work memory layout)
  3. CP 443-1 firmware V3.x or higher. Order numbers in scope:
    • 6GK7443-1EX30-0XE0 (FW V3.2)
    • 6GK7443-1EX40-0XE0 (FW V3.3)
    • 6GK7443-1EX20-0XE0 (legacy, FW V2.x)
  4. Ethernet cabling: Cat 5e or higher, RJ45, switched network (Industrial Ethernet SCALANCE, managed switch recommended).
  5. STEP 7 project containing both stations with consistent hardware configuration. Not a multi-project; both stations must reside in the same STEP 7 project so that NetPro can resolve the partner.
  6. S7 connection license: each configured S7 connection consumes one connection resource. The CPU 315-2 PN/DP supports a maximum of 16 S7 communication connections (8 configured + 8 unspecified depending on firmware). The CP 443-1 supports up to 128 S7 connections.
Firmware caveat: On the CPU 315-2 PN/DP, "unspecified" S7 connections (configured with a wildcard partner) are supported from FW V2.x onwards and can be used when the partner IP is dynamic. Specified S7 connections (the standard GET/PUT path) are the preferred path and are documented in this reference.

3. Hardware Configuration in STEP 7 / SIMATIC Manager

  1. Open the SIMATIC Manager and load the project containing both stations.
    1. Station A: S7-300 station containing the CPU 315-2 PN/DP.
    2. Station B: S7-400 station containing the S7-400 CPU and the CP 443-1 inserted in the rack (typically slot 4 to leave slot 3 reserved for an IM, slot 5/6 for additional CPs).
  2. Open the Hardware Configuration editor for Station A. Double-click the CPU 315-2 PN/DP, open the Properties > Ethernet Interface dialog, and assign:
    • IP address: 192.168.0.10
    • Subnet mask: 255.255.255.0
    • Use the project-wide "Ethernet (1)" subnet or create a new one.
  3. Open the Hardware Configuration editor for Station B. Double-click the CP 443-1, open the Properties > Ethernet Interface dialog, and assign:
    • IP address: 192.168.0.20
    • Subnet mask: 255.255.255.0
    • Use the same Ethernet subnet that the CPU 315 PN/DP was assigned to. NetPro will display the subnet as a horizontal bus.
  4. Save and compile both hardware configurations (Station > Save and Compile).

4. Configuring the S7 Connection in NetPro

NetPro is the network view editor that links the two stations with a logical S7 connection. Only one configured S7 connection is required to carry both GET and PUT traffic; GET and PUT share the same connection ID.

  1. Open NetPro from the project root (right-click the project > Open in NetPro or via Options > NetPro).
  2. Locate the CPU 315-2 PN/DP and the CP 443-1 on the shared Ethernet subnet.
  3. Select the CPU 315-2 PN/DP. The right side of the connection table now shows all available partners in the project that share a subnet. Select the CP 443-1 partner.
  4. In the connection table, right-click the first row and choose Insert New Connection. The Insert New Connection dialog opens.
  5. Configure the connection:
    • Connection partner: CP 443-1 (or the S7-400 CPU if the CP is transparent for S7 routing)
    • Connection type: S7 connection
    • Local endpoint: CPU 315-2 PN/DP
    • Display > Connection path: leave the default (project-wide Ethernet subnet).
  6. Click OK. A new row appears with Connection ID, Local ID, and a status of "Not downloaded".
  7. Note the Local ID value (typically a decimal integer such as 1 or hex 0001). This is the value passed to SFB14 / SFB15 in the ID parameter.
  8. Compile NetPro (Network > Compile and Check Consistency). Resolve any warnings; a typical warning is "partner not on the same subnet" if the IP/subnet configuration was not applied in step 3.
  9. Download the connection to both stations (PLC > Download to Target > Stations on Subnet). Selecting "Both stations" is the safest method.
Connection resources: Each S7 connection uses one of the maximum 16 S7 communication resources on the CPU 315-2 PN/DP. If PG/OP/HMI connections are also configured against the same CPU, plan the budget carefully. Open Properties > Communication on the CPU in HW Config to inspect the resource allocation.

5. SFB14 (GET) / SFB15 (PUT) on the S7-300 CPU 315 PN/DP

SFB14 and SFB15 are part of the standard library "System Function Blocks" and are pre-installed in the CPU firmware. In SIMATIC Manager they are found in Libraries > Standard Library > System Function Blocks as SFB14 and SFB15.

5.1 SFB14 (GET) parameter assignment

Parameter Declaration Data type Meaning Typical value
REQ INPUT BOOL Trigger to start the read job M0.0 (rising edge)
ID INPUT WORD Connection ID from NetPro W#16#0001 (Local ID = 1)
ADDR_1 INPUT ANY Remote address 1 (data to read) P#DB20.DBX0.0 BYTE 20
ADDR_2 INPUT ANY Remote address 2 (optional) P#DB20.DBX20.0 BYTE 20
ADDR_3 INPUT ANY Remote address 3 (optional) --
ADDR_4 INPUT ANY Remote address 4 (optional) --
RD_1 OUTPUT ANY Local receive buffer 1 P#DB30.DBX0.0 BYTE 20
RD_2 OUTPUT ANY Local receive buffer 2 P#DB30.DBX20.0 BYTE 20
RD_3 OUTPUT ANY Local receive buffer 3 --
RD_4 OUTPUT ANY Local receive buffer 4 --
NDR OUTPUT BOOL New data received (one-shot) M10.0
ERROR OUTPUT BOOL Error flag M10.1
STATUS OUTPUT WORD Status / error code MW12
LEN OUTPUT WORD Actual length transferred MW14

5.2 SFB15 (PUT) parameter assignment

Parameter Declaration Data type Meaning Typical value
REQ INPUT BOOL Trigger to start the write job M0.1 (rising edge)
ID INPUT WORD Connection ID from NetPro W#16#0001
ADDR_1 INPUT ANY Remote address 1 (write target) P#DB40.DBX0.0 BYTE 20
ADDR_2 to ADDR_4 INPUT ANY Additional remote areas --
SD_1 INPUT ANY Local send buffer 1 P#DB50.DBX0.0 BYTE 20
SD_2 to SD_4 INPUT ANY Additional send buffers --
DONE OUTPUT BOOL Job completed without error M20.0
ERROR OUTPUT BOOL Error flag M20.1
STATUS OUTPUT WORD Status / error code MW22

5.3 STL example block call (S7-300)

// Trigger GET with rising edge on M0.0
A M 0.0
FP M 0.2
= L 1.0
CALL "GET"  // SFB14
    REQ :=L1.0
    ID  :=W#16#0001
    ADDR_1 :=P#DB20.DBX0.0 BYTE 20
    ADDR_2 :=P#DB20.DBX20.0 BYTE 20
    NDR   :=M10.0
    ERROR :=M10.1
    STATUS:=MW12
    LEN   :=MW14

// Trigger PUT with rising edge on M0.1
A M 0.1
FP M 0.3
= L 2.0
CALL "PUT"  // SFB15
    REQ :=L2.0
    ID  :=W#16#0001
    ADDR_1 :=P#DB40.DBX0.0 BYTE 20
    SD_1   :=P#DB50.DBX0.0 BYTE 20
    DONE   :=M20.0
    ERROR  :=M20.1
    STATUS :=MW22
Job execution: A GET/PUT job executes asynchronously. The block must be called every OB1 cycle while REQ is high so that the firmware can perform polling and fragmentation. Avoid passing a sustained TRUE on REQ without monitoring NDR / DONE and ERROR; if the partner returns an error, the job latches until REQ is dropped and re-applied.

6. FB14 (GET) / FB15 (PUT) on the S7-400 Side

On the S7-400, GET and PUT are function blocks (FB14 / FB15) that must be instantiated in a DB. They are functionally identical to the S7-300 SFBs but are delivered as FBs to allow multiple instances.

  1. In SIMATIC Manager, copy FB14 (GET) and FB15 (PUT) from the standard library into the S7-400 program (Libraries > Standard Library > Communication Blocks > FB14 / FB15).
  2. Insert DB100 as instance DB for FB14 and DB101 as instance DB for FB15.
  3. Call the FBs in OB1 with the same parameter semantics as in Section 5.
  4. The ID parameter on the S7-400 side must match the local connection ID on the CP 443-1, not the partner's ID. Read the ID from the connection table inside the S7-400 station.
Why the IDs differ: NetPro assigns a local ID to each endpoint. Station A's connection entry will show its own local ID, Station B will show a different local ID (commonly 1 on both sides by coincidence, but treat them as independent). Always cross-check with the connection table of each station before downloading.

7. Alternate Path: AG_SEND / AG_RECV on the S7-400 (Block Mode)

For S7-400 stations that use an older CP 443-1 (e.g. 6GK7443-1EX11/1EX20) or for firmware paths that block S7 communication on the CP, an alternative is to use the CP's "block mode" via FC5 (AG_SEND) and FC6 (AG_RECV). These operate on ISO-on-TCP or TCP connections configured separately in the CP's NetPro connection entry and require no SFB on the S7-400 CPU. The S7-300 side then uses the open communication services (Section 8) and pairs with FC5/FC6 over the CP's LDB / data record interface.

When using AG_SEND/AG_RECV, configure the CP 443-1 connection as "TCP connection" or "ISO-on-TCP connection" (type 01 / 11 in the connection table), not as an S7 connection. The CP must occupy a free connection resource on the partner S7-300's PN port.

8. Alternate Path: Open Communication (TCP/UDP) on the CPU 315 PN/DP

When the S7 communication service is not desired (for example, because the S7-400 has no S7 connection resources left or the partner is a non-Siemens device), the CPU 315 PN/DP supports ISO-on-TCP, TCP, and UDP via the open-communication blocks:

  • FB65 (TCON) — establish connection
  • FB66 (TDISCON) — terminate connection
  • FB63 (TSEND) — send data
  • FB64 (TRCV) — receive data
  • FB67 (TUSEND) / FB68 (TURCV) — UDP variants

These are called open because the connection is configured parametrically (an ANY-style connection description UDT65 passed to TCON) rather than via NetPro. They are CPU 315 PN/DP native; they do not require a CP 343-1 Lean. The partner S7-400 then either runs the matching T-functions on a CP 443-1 that supports them or uses ISO-on-TCP block mode (FC5/FC6) on the CP.

9. Alternate Path: PROFINET IO Master/Slave

The CPU 315-2 PN/DP can act as a PROFINET IO controller and the CP 443-1 can act as a PROFINET IO device. This requires a CP 443-1 with PROFINET capability (firmware V3.x or higher, e.g. 6GK7443-1EX30) and is configured in HW Config by right-clicking the CP 443-1 > PN IO Mode. PROFINET IO is suitable when the data exchange is point-to-point with deterministic cycle times (1 ms, 4 ms). It is not a substitute for S7 GET/PUT when the application needs event-driven access to arbitrary DB areas.

10. Verification and Diagnostics

10.1 Online connection status

  1. Open NetPro with the project online (View > Online or click the "Online" toolbar icon).
  2. The connection row should show a green status indicator and the message "Connection established".
  3. If the status is yellow/red, double-click the connection and read the diagnostic text. Common states:
    • Established — both endpoints are reachable.
    • Connection not established — partner CPU in STOP, IP unreachable, or connection not downloaded to partner.
    • No resource — partner has run out of S7 communication resources.

10.2 SFB14 / SFB15 diagnostics in OB1

Inspect the STATUS output with a watch table or HMI tag. STATUS is structured as a 16-bit word:

  • Bit 15 set (0x8xxx) — local error in the CPU executing the SFB.
  • Bit 15 cleared (0x0xxx to 0x7xxx) — remote error reported by partner CPU.

10.3 Buffer diagnostics

  1. Open the online partner (S7-300 or S7-400) in SIMATIC Manager.
  2. PLC > Diagnostics / Setting > Diagnostics Buffer.
  3. Filter for entries with text "Communication", "Connection", "SFB14", "SFB15", "FB14", "FB15".
  4. Typical informational entries confirm S7 connection establishment with details on the partner IP, TSAP, and slot.

11. SFB14 / SFB15 Status Code Reference

STATUS (hex) Class Meaning Corrective action
0000 Success Job completed successfully None
0070 Success GET only: data received (informational) None
007F Success PUT only: data written (informational) None
8090 Local error Connection ID invalid or unknown Verify the ID matches the local connection in NetPro; ensure the connection was downloaded.
8092 Local error Connection aborted by partner (PUT/GET) Check partner CPU state (RUN/STOP) and SFB/FB calls.
8094 Local error ADDR parameter invalid (e.g. wrong DB, area, length) Verify the remote address; for GET ensure the remote data block exists on the partner and is not optimized.
80A0 Local error Negative acknowledgment from partner Inspect partner diagnostic buffer; verify partner CPU is in RUN.
80A1 Local error Partner rejected the call (S7-300/400 function not permitted) Ensure partner firmware supports PUT/GET; on the S7-400 partner CPU, "Permit PUT/GET access from remote" must be enabled in HW Config > CPU > Protection.
80B0 Local error Data length mismatch between ADDR and LEN Check that RD_/SD_ lengths match the ADDR lengths.
80B1 Local error Send buffer too short (PUT) Increase local SD_ area.
80B2 Local error Receive buffer too short (GET) Increase local RD_ area.
80C0 Local error Data cannot be read (GET) / written (PUT) on partner Verify the addressed DB exists on the partner and the partner CPU is not in STOP.
80C1 Local error Data length of partner area too short Reduce job length or extend partner DB.
80C2 Local error Access to partner area denied (protection) Partner CPU has password / know-how protection; re-enable access or remove the password.
80C3 Local error Partner CPU in STOP or not reachable Set partner to RUN; verify IP/subnet.
80C4 Local error Communication problem — fault on partner side Inspect partner diagnostic buffer for additional events.
80D0 Local error Connection not established yet Wait for connection establishment; verify NetPro download.
80D2 Local error Connection ID already in use by another job Ensure only one GET and one PUT job share the same connection at a time; use separate connections for parallel jobs.
80E0 Local error Internal error — SFB call lost Re-trigger; if persistent, replace CPU.
80F0 Local error Internal error — firmware bug Update firmware; report to manufacturer support.

12. Troubleshooting Matrix

Symptom Likely root cause First check Fix
STATUS = 80A1 PUT/GET not permitted on partner CPU HW Config > CPU Properties > Protection > "Permit PUT/GET access from remote" Tick the box, save and download to the S7-400 CPU.
STATUS = 80C2 Partner CPU protected by password Try to read a known DB from the partner with the PG Remove protection or use a connection with the appropriate rights.
STATUS = 80C3 Partner CPU in STOP Online > Operating Mode Switch partner to RUN; verify error OB / diagnostic buffer for STOP cause.
STATUS = 80D0 Connection not established NetPro > Online status of the connection Confirm connection was downloaded to both stations; confirm IP routing.
STATUS = 80B0/B1/B2 Length mismatch Inspect ADDR_ and RD_/SD_ in the call Ensure byte counts match between source and destination.
NDR/DONE never set, no error SFB not called cyclically Cross-reference SFB call in OB1 Place the CALL SFB14/SFB15 inside OB1 unconditionally so the firmware can poll the connection.
NetPro connection status "No partner on subnet" Partner IP not in same subnet Compare IP and subnet mask Reassign one or both endpoints so they share an Ethernet subnet.
CP 443-1 SF (red) LED CP configuration mismatch or partner missing CP diagnostic buffer via PG online Verify the connected CP firmware supports the configured service; re-download HW Config.
Intermittent connection drops every few minutes Watchdog timeout; PN port in port-down mode SCALANCE / switch diagnostics for link flap Replace the cable / port; verify both devices negotiate 100 Mbit/s full duplex.
PG can read the partner DB but GET returns 80A1 S7 protection vs. PG protection differ Compare HW Config protection settings Permit PUT/GET separately from PG access (they are independent on the S7-400 CPU).
CPU 315 reports "Connection resources exhausted" All 16 resources consumed CPU Properties > Communication > Connection resources Reduce configured connections; switch OP / HMI to unspecific connections if possible.

13. Performance Notes and Field Tips

  • Maximum user data per PUT/GET job: 76 bytes per ADDR_ pointer on the CPU 315 PN/DP. Split larger transfers into multiple ADDR_1..ADDR_4 calls.
  • Throughput on a 100 Mbit/s PROFINET link: an S7 PUT/GET cycle (one DB write + one DB read of 76 bytes each) typically executes in 50–100 ms end-to-end. Larger transfers fragment into multiple TCP segments.
  • Polling discipline: do not retrigger REQ until the previous job has completed (NDR / DONE) or has returned an error (ERROR + STATUS). Back-to-back REQ pulses cause STATUS = 80D2 (connection busy).
  • STOP behavior: when the S7-300 CPU transitions to STOP, all active PUT/GET jobs are aborted. The partner receives a connection abort diagnostic event.
  • Migration path to TIA Portal: when migrating to TIA Portal, the S7 connection can be ported as an "HMI / S7 connection". SFB14/SFB15 are replaced by the PUT and GET instructions in the program editor's Communication > S7 Communication palette.

14. Safety and Operational Notes

Network segmentation: Place the CPU 315 PN/DP and the CP 443-1 in a dedicated VLAN or behind a SCALANCE firewall if the Industrial Ethernet network is shared with corporate traffic. S7 communication is authenticated only by IP/TSAP, so any device that knows the partner IP can attempt PUT/GET access.
Know-how protection: On the S7-400 CPU, "Permit access with PUT/GET from remote partner" is independent of the password-based know-how protection. Disabling it does not password-protect the CPU, but it does prevent any S7 client from reading or writing DBs without explicit configuration.
Diagnostic access during commissioning: During commissioning, leave the "Permit access with PUT/GET" option enabled. Disable it only after the application has been validated to reduce the attack surface for plant-floor networks.

15. Reference Documentation

  • Siemens Online Support: support.industry.siemens.com — searchable documentation, FAQ, and downloads for S7-300 / S7-400 systems.
  • STEP 7 V5.5 help system: "Working with S7 connections" — describes NetPro connection configuration.
  • CPU 315-2 PN/DP manual (entry for 6ES7315-2EH14-0AB0) — communication services, resource budgets, status codes.
  • CP 443-1 manual (entry for 6GK7443-1EX30-0XE0) — LED descriptions, firmware options, ISO-on-TCP / TCP / UDP / PROFINET IO capabilities.
  • Function manual "S7 Communication" — describes GET/PUT semantics across S7-300 / S7-400 / WinAC.

FAQ

Can I use SFB14 / SFB15 between a CPU 315-2 PN/DP and an S7-400 with CP 443-1 without configuring the connection in NetPro?

No. GET/PUT requires a configured S7 connection. Open NetPro, select the CPU 315-2 PN/DP, choose the CP 443-1 as the partner, insert a new "S7 connection" entry, and download to both stations. The connection ID from this entry is the value passed to the ID input of SFB14/SFB15.

What is the maximum number of bytes that a single PUT/GET call can transfer on the CPU 315 PN/DP?

Each ADDR_1..ADDR_4 pointer can address up to 76 bytes of user data. Four pointers can be combined in one call, giving a maximum of 304 bytes per PUT/GET job. For larger transfers, run multiple jobs sequentially or switch to PROFINET IO.

Why does GET return STATUS = 80A1 even though the connection shows "established" in NetPro?

STATUS = 80A1 means the partner CPU has rejected the PUT/GET request because access is not permitted. On the S7-400 CPU, open HW Config > CPU Properties > Protection and tick "Permit access with PUT/GET from remote partner". Save, download, and re-test.

Can I use the PROFINET port on the CPU 315-2 PN/DP for both PROFINET IO and S7 communication at the same time?

Yes. The integrated PN interface on the CPU 315-2 PN/DP supports PROFINET IO and S7 communication (GET/PUT, ISO-on-TCP, TCP, UDP) concurrently. There is no need to choose between the two; both services share the same 100 Mbit/s Ethernet port.

Do I need a CP 343-1 on the S7-300 side to communicate with the CP 443-1?

No. The CPU 315-2 PN/DP has an integrated PROFINET interface that supports S7 communication natively. A CP 343-1 is only required for older S7-300 CPUs without a PROFINET port (such as the CPU 312 – CPU 314, or older 315-2 DP variants without PN).

Back to blog