CPU 315PN/DP to S7-400 CP443-1: S7 Communication over Industrial Ethernet
This reference covers the complete configuration of an S7 communication link between a SIMATIC S7-300 CPU 315-2 PN/DP and a SIMATIC S7-400 station equipped with a CP 443-1 Industrial Ethernet communication processor. The procedure uses the standardized S7 connection (configured via NetPro) and the integrated system function blocks SFB14 (GET) and SFB15 (PUT) on the S7-300 side, paired with FB14 (GET) and FB15 (PUT) on the S7-400 side. Alternative paths (open TCP/UDP communication, PROFINET IO, and ISO-on-TCP) are documented for firmware-specific cases.
1. Communication Architecture Overview
The CPU 315-2 PN/DP integrates a PROFINET interface (X1, 2-port switch, 100 Mbit/s) and a PROFIBUS-DP master/slave interface (X2). The PROFINET port can carry both PROFINET IO and standard S7 communication simultaneously on the same physical port. The CP 443-1 module installed in the S7-400 rack terminates the Industrial Ethernet network and exposes the S7-400 CPU to the same PROFINET subnet.
| Station | Controller | Interface module | IP address (example) | Subnet mask | Rack / Slot |
|---|---|---|---|---|---|
| Station A | CPU 315-2 PN/DP (6ES7315-2EH14-0AB0) | Integrated PN port (X1) | 192.168.0.10 | 255.255.255.0 | Rack 0, Slot 2 |
| Station B | CPU 414-3 PN/DP (example) | CP 443-1 (6GK7443-1EX30-0XE0) | 192.168.0.20 | 255.255.255.0 | Rack 0, Slot 4 (CP) |
The S7 communication service used by GET/PUT is carried over ISO-on-TCP (RFC 1006) on TCP port 102. The S7-300 PN port and the CP 443-1 must share an Ethernet subnet, and the configured connection must be downloaded to both stations for the partners to authenticate the handshake.
2. Prerequisites
- STEP 7 V5.5 SP4 or later with the S7-300 / S7-400 option packages installed. PLCSIM V5.4 SP8 or later is sufficient for offline validation.
-
CPU 315-2 PN/DP firmware V3.3 or higher. CPU order numbers in scope:
- 6ES7315-2EH14-0AB0 (current, FW V3.3)
- 6ES7315-2EH13-0AB0 (FW V3.2)
- 6ES7315-2AH14-0AB0 (variant with different work memory layout)
-
CP 443-1 firmware V3.x or higher. Order numbers in scope:
- 6GK7443-1EX30-0XE0 (FW V3.2)
- 6GK7443-1EX40-0XE0 (FW V3.3)
- 6GK7443-1EX20-0XE0 (legacy, FW V2.x)
- Ethernet cabling: Cat 5e or higher, RJ45, switched network (Industrial Ethernet SCALANCE, managed switch recommended).
- STEP 7 project containing both stations with consistent hardware configuration. Not a multi-project; both stations must reside in the same STEP 7 project so that NetPro can resolve the partner.
- S7 connection license: each configured S7 connection consumes one connection resource. The CPU 315-2 PN/DP supports a maximum of 16 S7 communication connections (8 configured + 8 unspecified depending on firmware). The CP 443-1 supports up to 128 S7 connections.
3. Hardware Configuration in STEP 7 / SIMATIC Manager
- Open the SIMATIC Manager and load the project containing both stations.
- Station A: S7-300 station containing the CPU 315-2 PN/DP.
- Station B: S7-400 station containing the S7-400 CPU and the CP 443-1 inserted in the rack (typically slot 4 to leave slot 3 reserved for an IM, slot 5/6 for additional CPs).
- Open the Hardware Configuration editor for Station A. Double-click the CPU 315-2 PN/DP, open the Properties > Ethernet Interface dialog, and assign:
- IP address:
192.168.0.10 - Subnet mask:
255.255.255.0 - Use the project-wide "Ethernet (1)" subnet or create a new one.
- IP address:
- Open the Hardware Configuration editor for Station B. Double-click the CP 443-1, open the Properties > Ethernet Interface dialog, and assign:
- IP address:
192.168.0.20 - Subnet mask:
255.255.255.0 - Use the same Ethernet subnet that the CPU 315 PN/DP was assigned to. NetPro will display the subnet as a horizontal bus.
- IP address:
- Save and compile both hardware configurations (Station > Save and Compile).
4. Configuring the S7 Connection in NetPro
NetPro is the network view editor that links the two stations with a logical S7 connection. Only one configured S7 connection is required to carry both GET and PUT traffic; GET and PUT share the same connection ID.
- Open NetPro from the project root (right-click the project > Open in NetPro or via Options > NetPro).
- Locate the CPU 315-2 PN/DP and the CP 443-1 on the shared Ethernet subnet.
- Select the CPU 315-2 PN/DP. The right side of the connection table now shows all available partners in the project that share a subnet. Select the CP 443-1 partner.
- In the connection table, right-click the first row and choose Insert New Connection. The Insert New Connection dialog opens.
- Configure the connection:
- Connection partner: CP 443-1 (or the S7-400 CPU if the CP is transparent for S7 routing)
- Connection type: S7 connection
- Local endpoint: CPU 315-2 PN/DP
- Display > Connection path: leave the default (project-wide Ethernet subnet).
- Click OK. A new row appears with
Connection ID,Local ID, and a status of "Not downloaded". - Note the Local ID value (typically a decimal integer such as
1or hex0001). This is the value passed to SFB14 / SFB15 in theIDparameter. - Compile NetPro (Network > Compile and Check Consistency). Resolve any warnings; a typical warning is "partner not on the same subnet" if the IP/subnet configuration was not applied in step 3.
- Download the connection to both stations (PLC > Download to Target > Stations on Subnet). Selecting "Both stations" is the safest method.
5. SFB14 (GET) / SFB15 (PUT) on the S7-300 CPU 315 PN/DP
SFB14 and SFB15 are part of the standard library "System Function Blocks" and are pre-installed in the CPU firmware. In SIMATIC Manager they are found in Libraries > Standard Library > System Function Blocks as SFB14 and SFB15.
5.1 SFB14 (GET) parameter assignment
| Parameter | Declaration | Data type | Meaning | Typical value |
|---|---|---|---|---|
| REQ | INPUT | BOOL | Trigger to start the read job |
M0.0 (rising edge) |
| ID | INPUT | WORD | Connection ID from NetPro |
W#16#0001 (Local ID = 1) |
| ADDR_1 | INPUT | ANY | Remote address 1 (data to read) | P#DB20.DBX0.0 BYTE 20 |
| ADDR_2 | INPUT | ANY | Remote address 2 (optional) | P#DB20.DBX20.0 BYTE 20 |
| ADDR_3 | INPUT | ANY | Remote address 3 (optional) | -- |
| ADDR_4 | INPUT | ANY | Remote address 4 (optional) | -- |
| RD_1 | OUTPUT | ANY | Local receive buffer 1 | P#DB30.DBX0.0 BYTE 20 |
| RD_2 | OUTPUT | ANY | Local receive buffer 2 | P#DB30.DBX20.0 BYTE 20 |
| RD_3 | OUTPUT | ANY | Local receive buffer 3 | -- |
| RD_4 | OUTPUT | ANY | Local receive buffer 4 | -- |
| NDR | OUTPUT | BOOL | New data received (one-shot) | M10.0 |
| ERROR | OUTPUT | BOOL | Error flag | M10.1 |
| STATUS | OUTPUT | WORD | Status / error code | MW12 |
| LEN | OUTPUT | WORD | Actual length transferred | MW14 |
5.2 SFB15 (PUT) parameter assignment
| Parameter | Declaration | Data type | Meaning | Typical value |
|---|---|---|---|---|
| REQ | INPUT | BOOL | Trigger to start the write job |
M0.1 (rising edge) |
| ID | INPUT | WORD | Connection ID from NetPro | W#16#0001 |
| ADDR_1 | INPUT | ANY | Remote address 1 (write target) | P#DB40.DBX0.0 BYTE 20 |
| ADDR_2 to ADDR_4 | INPUT | ANY | Additional remote areas | -- |
| SD_1 | INPUT | ANY | Local send buffer 1 | P#DB50.DBX0.0 BYTE 20 |
| SD_2 to SD_4 | INPUT | ANY | Additional send buffers | -- |
| DONE | OUTPUT | BOOL | Job completed without error | M20.0 |
| ERROR | OUTPUT | BOOL | Error flag | M20.1 |
| STATUS | OUTPUT | WORD | Status / error code | MW22 |
5.3 STL example block call (S7-300)
// Trigger GET with rising edge on M0.0
A M 0.0
FP M 0.2
= L 1.0
CALL "GET" // SFB14
REQ :=L1.0
ID :=W#16#0001
ADDR_1 :=P#DB20.DBX0.0 BYTE 20
ADDR_2 :=P#DB20.DBX20.0 BYTE 20
NDR :=M10.0
ERROR :=M10.1
STATUS:=MW12
LEN :=MW14
// Trigger PUT with rising edge on M0.1
A M 0.1
FP M 0.3
= L 2.0
CALL "PUT" // SFB15
REQ :=L2.0
ID :=W#16#0001
ADDR_1 :=P#DB40.DBX0.0 BYTE 20
SD_1 :=P#DB50.DBX0.0 BYTE 20
DONE :=M20.0
ERROR :=M20.1
STATUS :=MW22
REQ is high so that the firmware can perform polling and fragmentation. Avoid passing a sustained TRUE on REQ without monitoring NDR / DONE and ERROR; if the partner returns an error, the job latches until REQ is dropped and re-applied.6. FB14 (GET) / FB15 (PUT) on the S7-400 Side
On the S7-400, GET and PUT are function blocks (FB14 / FB15) that must be instantiated in a DB. They are functionally identical to the S7-300 SFBs but are delivered as FBs to allow multiple instances.
- In SIMATIC Manager, copy FB14 (GET) and FB15 (PUT) from the standard library into the S7-400 program (Libraries > Standard Library > Communication Blocks > FB14 / FB15).
- Insert DB100 as instance DB for FB14 and DB101 as instance DB for FB15.
- Call the FBs in OB1 with the same parameter semantics as in Section 5.
- The
IDparameter on the S7-400 side must match the local connection ID on the CP 443-1, not the partner's ID. Read the ID from the connection table inside the S7-400 station.
1 on both sides by coincidence, but treat them as independent). Always cross-check with the connection table of each station before downloading.7. Alternate Path: AG_SEND / AG_RECV on the S7-400 (Block Mode)
For S7-400 stations that use an older CP 443-1 (e.g. 6GK7443-1EX11/1EX20) or for firmware paths that block S7 communication on the CP, an alternative is to use the CP's "block mode" via FC5 (AG_SEND) and FC6 (AG_RECV). These operate on ISO-on-TCP or TCP connections configured separately in the CP's NetPro connection entry and require no SFB on the S7-400 CPU. The S7-300 side then uses the open communication services (Section 8) and pairs with FC5/FC6 over the CP's LDB / data record interface.
When using AG_SEND/AG_RECV, configure the CP 443-1 connection as "TCP connection" or "ISO-on-TCP connection" (type 01 / 11 in the connection table), not as an S7 connection. The CP must occupy a free connection resource on the partner S7-300's PN port.
8. Alternate Path: Open Communication (TCP/UDP) on the CPU 315 PN/DP
When the S7 communication service is not desired (for example, because the S7-400 has no S7 connection resources left or the partner is a non-Siemens device), the CPU 315 PN/DP supports ISO-on-TCP, TCP, and UDP via the open-communication blocks:
- FB65 (TCON) — establish connection
- FB66 (TDISCON) — terminate connection
- FB63 (TSEND) — send data
- FB64 (TRCV) — receive data
- FB67 (TUSEND) / FB68 (TURCV) — UDP variants
These are called open because the connection is configured parametrically (an ANY-style connection description UDT65 passed to TCON) rather than via NetPro. They are CPU 315 PN/DP native; they do not require a CP 343-1 Lean. The partner S7-400 then either runs the matching T-functions on a CP 443-1 that supports them or uses ISO-on-TCP block mode (FC5/FC6) on the CP.
9. Alternate Path: PROFINET IO Master/Slave
The CPU 315-2 PN/DP can act as a PROFINET IO controller and the CP 443-1 can act as a PROFINET IO device. This requires a CP 443-1 with PROFINET capability (firmware V3.x or higher, e.g. 6GK7443-1EX30) and is configured in HW Config by right-clicking the CP 443-1 > PN IO Mode. PROFINET IO is suitable when the data exchange is point-to-point with deterministic cycle times (1 ms, 4 ms). It is not a substitute for S7 GET/PUT when the application needs event-driven access to arbitrary DB areas.
10. Verification and Diagnostics
10.1 Online connection status
- Open NetPro with the project online (View > Online or click the "Online" toolbar icon).
- The connection row should show a green status indicator and the message "Connection established".
- If the status is yellow/red, double-click the connection and read the diagnostic text. Common states:
- Established — both endpoints are reachable.
- Connection not established — partner CPU in STOP, IP unreachable, or connection not downloaded to partner.
- No resource — partner has run out of S7 communication resources.
10.2 SFB14 / SFB15 diagnostics in OB1
Inspect the STATUS output with a watch table or HMI tag. STATUS is structured as a 16-bit word:
- Bit 15 set (0x8xxx) — local error in the CPU executing the SFB.
- Bit 15 cleared (0x0xxx to 0x7xxx) — remote error reported by partner CPU.
10.3 Buffer diagnostics
- Open the online partner (S7-300 or S7-400) in SIMATIC Manager.
- PLC > Diagnostics / Setting > Diagnostics Buffer.
- Filter for entries with text "Communication", "Connection", "SFB14", "SFB15", "FB14", "FB15".
- Typical informational entries confirm S7 connection establishment with details on the partner IP, TSAP, and slot.
11. SFB14 / SFB15 Status Code Reference
| STATUS (hex) | Class | Meaning | Corrective action |
|---|---|---|---|
| 0000 | Success | Job completed successfully | None |
| 0070 | Success | GET only: data received (informational) | None |
| 007F | Success | PUT only: data written (informational) | None |
| 8090 | Local error | Connection ID invalid or unknown | Verify the ID matches the local connection in NetPro; ensure the connection was downloaded. |
| 8092 | Local error | Connection aborted by partner (PUT/GET) | Check partner CPU state (RUN/STOP) and SFB/FB calls. |
| 8094 | Local error | ADDR parameter invalid (e.g. wrong DB, area, length) | Verify the remote address; for GET ensure the remote data block exists on the partner and is not optimized. |
| 80A0 | Local error | Negative acknowledgment from partner | Inspect partner diagnostic buffer; verify partner CPU is in RUN. |
| 80A1 | Local error | Partner rejected the call (S7-300/400 function not permitted) | Ensure partner firmware supports PUT/GET; on the S7-400 partner CPU, "Permit PUT/GET access from remote" must be enabled in HW Config > CPU > Protection. |
| 80B0 | Local error | Data length mismatch between ADDR and LEN | Check that RD_/SD_ lengths match the ADDR lengths. |
| 80B1 | Local error | Send buffer too short (PUT) | Increase local SD_ area. |
| 80B2 | Local error | Receive buffer too short (GET) | Increase local RD_ area. |
| 80C0 | Local error | Data cannot be read (GET) / written (PUT) on partner | Verify the addressed DB exists on the partner and the partner CPU is not in STOP. |
| 80C1 | Local error | Data length of partner area too short | Reduce job length or extend partner DB. |
| 80C2 | Local error | Access to partner area denied (protection) | Partner CPU has password / know-how protection; re-enable access or remove the password. |
| 80C3 | Local error | Partner CPU in STOP or not reachable | Set partner to RUN; verify IP/subnet. |
| 80C4 | Local error | Communication problem — fault on partner side | Inspect partner diagnostic buffer for additional events. |
| 80D0 | Local error | Connection not established yet | Wait for connection establishment; verify NetPro download. |
| 80D2 | Local error | Connection ID already in use by another job | Ensure only one GET and one PUT job share the same connection at a time; use separate connections for parallel jobs. |
| 80E0 | Local error | Internal error — SFB call lost | Re-trigger; if persistent, replace CPU. |
| 80F0 | Local error | Internal error — firmware bug | Update firmware; report to manufacturer support. |
12. Troubleshooting Matrix
| Symptom | Likely root cause | First check | Fix |
|---|---|---|---|
| STATUS = 80A1 | PUT/GET not permitted on partner CPU | HW Config > CPU Properties > Protection > "Permit PUT/GET access from remote" | Tick the box, save and download to the S7-400 CPU. |
| STATUS = 80C2 | Partner CPU protected by password | Try to read a known DB from the partner with the PG | Remove protection or use a connection with the appropriate rights. |
| STATUS = 80C3 | Partner CPU in STOP | Online > Operating Mode | Switch partner to RUN; verify error OB / diagnostic buffer for STOP cause. |
| STATUS = 80D0 | Connection not established | NetPro > Online status of the connection | Confirm connection was downloaded to both stations; confirm IP routing. |
| STATUS = 80B0/B1/B2 | Length mismatch | Inspect ADDR_ and RD_/SD_ in the call | Ensure byte counts match between source and destination. |
| NDR/DONE never set, no error | SFB not called cyclically | Cross-reference SFB call in OB1 | Place the CALL SFB14/SFB15 inside OB1 unconditionally so the firmware can poll the connection. |
| NetPro connection status "No partner on subnet" | Partner IP not in same subnet | Compare IP and subnet mask | Reassign one or both endpoints so they share an Ethernet subnet. |
| CP 443-1 SF (red) LED | CP configuration mismatch or partner missing | CP diagnostic buffer via PG online | Verify the connected CP firmware supports the configured service; re-download HW Config. |
| Intermittent connection drops every few minutes | Watchdog timeout; PN port in port-down mode | SCALANCE / switch diagnostics for link flap | Replace the cable / port; verify both devices negotiate 100 Mbit/s full duplex. |
| PG can read the partner DB but GET returns 80A1 | S7 protection vs. PG protection differ | Compare HW Config protection settings | Permit PUT/GET separately from PG access (they are independent on the S7-400 CPU). |
| CPU 315 reports "Connection resources exhausted" | All 16 resources consumed | CPU Properties > Communication > Connection resources | Reduce configured connections; switch OP / HMI to unspecific connections if possible. |
13. Performance Notes and Field Tips
- Maximum user data per PUT/GET job: 76 bytes per ADDR_ pointer on the CPU 315 PN/DP. Split larger transfers into multiple ADDR_1..ADDR_4 calls.
- Throughput on a 100 Mbit/s PROFINET link: an S7 PUT/GET cycle (one DB write + one DB read of 76 bytes each) typically executes in 50–100 ms end-to-end. Larger transfers fragment into multiple TCP segments.
- Polling discipline: do not retrigger REQ until the previous job has completed (NDR / DONE) or has returned an error (ERROR + STATUS). Back-to-back REQ pulses cause STATUS = 80D2 (connection busy).
- STOP behavior: when the S7-300 CPU transitions to STOP, all active PUT/GET jobs are aborted. The partner receives a connection abort diagnostic event.
- Migration path to TIA Portal: when migrating to TIA Portal, the S7 connection can be ported as an "HMI / S7 connection". SFB14/SFB15 are replaced by the PUT and GET instructions in the program editor's Communication > S7 Communication palette.
14. Safety and Operational Notes
15. Reference Documentation
- Siemens Online Support: support.industry.siemens.com — searchable documentation, FAQ, and downloads for S7-300 / S7-400 systems.
- STEP 7 V5.5 help system: "Working with S7 connections" — describes NetPro connection configuration.
- CPU 315-2 PN/DP manual (entry for 6ES7315-2EH14-0AB0) — communication services, resource budgets, status codes.
- CP 443-1 manual (entry for 6GK7443-1EX30-0XE0) — LED descriptions, firmware options, ISO-on-TCP / TCP / UDP / PROFINET IO capabilities.
- Function manual "S7 Communication" — describes GET/PUT semantics across S7-300 / S7-400 / WinAC.
FAQ
Can I use SFB14 / SFB15 between a CPU 315-2 PN/DP and an S7-400 with CP 443-1 without configuring the connection in NetPro?
No. GET/PUT requires a configured S7 connection. Open NetPro, select the CPU 315-2 PN/DP, choose the CP 443-1 as the partner, insert a new "S7 connection" entry, and download to both stations. The connection ID from this entry is the value passed to the ID input of SFB14/SFB15.
What is the maximum number of bytes that a single PUT/GET call can transfer on the CPU 315 PN/DP?
Each ADDR_1..ADDR_4 pointer can address up to 76 bytes of user data. Four pointers can be combined in one call, giving a maximum of 304 bytes per PUT/GET job. For larger transfers, run multiple jobs sequentially or switch to PROFINET IO.
Why does GET return STATUS = 80A1 even though the connection shows "established" in NetPro?
STATUS = 80A1 means the partner CPU has rejected the PUT/GET request because access is not permitted. On the S7-400 CPU, open HW Config > CPU Properties > Protection and tick "Permit access with PUT/GET from remote partner". Save, download, and re-test.
Can I use the PROFINET port on the CPU 315-2 PN/DP for both PROFINET IO and S7 communication at the same time?
Yes. The integrated PN interface on the CPU 315-2 PN/DP supports PROFINET IO and S7 communication (GET/PUT, ISO-on-TCP, TCP, UDP) concurrently. There is no need to choose between the two; both services share the same 100 Mbit/s Ethernet port.
Do I need a CP 343-1 on the S7-300 side to communicate with the CP 443-1?
No. The CPU 315-2 PN/DP has an integrated PROFINET interface that supports S7 communication natively. A CP 343-1 is only required for older S7-300 CPUs without a PROFINET port (such as the CPU 312 – CPU 314, or older 315-2 DP variants without PN).