Creating HTML Pages and Java Applets with Siemens CP 343-1 IT

Overview: Web Server Capability of the CP 343-1 IT

The SIMATIC CP 343-1 IT is an Industrial Ethernet communication processor for the S7-300 family that integrates an embedded web server, FTP server, and e-mail client directly into the PLC rack. Unlike the Lean and Standard variants of the CP 343-1 family, the IT variant ships with an extended firmware image that exposes four Java applets (Ident, Status, Get, Put) for bidirectional read/write of S7 process variables from any HTML page stored on the CP's file system. This makes it possible to build custom operator dashboards, multi-state text lists, and Hand/Off/Auto selectors without WinCC, without a separate HMI panel, and without any external SCADA runtime.

The web server is served from the CP's own flash file system. Custom HTML, JavaScript, CSS, and JAR files are loaded into the CP through the S7 FTP interface (default user admin, password configurable in STEP 7 → CP Properties → Web Server) and then served to any browser that reaches the CP on TCP port 80 (HTTP) or 443 (HTTPS on firmware ≥ V3.0). The four built-in applets use the Siemens S7Controls Java library to tunnel read/write requests through a small Java-to-S7 protocol bridge that runs in the browser's JVM. This is the same mechanism used by the canned example pages shipped with the device.

CP 343-1 Family: Variants and Part Numbers

Before commissioning, confirm that you have an IT-class CP. The Lean, Standard, Advanced, and IT variants ship different firmware and expose different applet sets.

The CP 343-1 IT is the only member of the family that supports the complete S7Controls applet suite for custom HTML development. The Advanced variant exposes the same Ident, Status, Get, and Put applets but ships with a reduced Java library. For multi-state text list work, the IT variant is the recommended target hardware.

Prerequisites

1. STEP 7 V5.5 + SP4 (or STEP 7 Professional in TIA Portal V15.1 or later) with the CP 343-1 IT HSP or GSD file installed. The IT CP must appear in the hardware catalog under SIMATIC 300 → Communication → CP 343-1 IT.
2. Firmware on the CP: V2.4 minimum for the full S7Controls set; V3.0 is recommended for HTTPS and improved S7-300 backplane performance.
3. S7Controls Java library (s7controls.jar) - distributed with the CP's example HTML package. This JAR must be uploaded to the CP alongside any custom HTML page that calls the applets.
4. FTP client for file upload (Windows Explorer, WinSCP, FileZilla). The CP exposes an FTP server on TCP/21 by default.
5. Java Runtime Environment on the operator workstation (JRE 1.6 or 1.7 for legacy firmwares; JRE 8 for CP firmware V3.0+). Modern Chromium-based browsers no longer support the NPAPI plugin required by the legacy S7Controls applets - use Internet Explorer 11 or a virtualized environment for verification.
6. HTML editor - any plain-text editor is sufficient. Spidercontrol's PLC Edition (described later) is recommended for visual layout.

Enabling the Web Server in STEP 7

1. Open the S7 project in STEP 7 and double-click the CP 343-1 IT in the hardware configuration (HW Config).
2. Navigate to Properties → Web Server.
3. Tick "Enable Web server" and assign the HTML directory (default: / on the CP's file system).
4. Set the FTP access password. The default user admin is non-editable on firmware V2.x.
5. Under S7 Applets, enable the four applets: IdentApplet, StatusApplet, GetApplet, PutApplet. Each must be bound to an S7 connection on the CP for read/write operations.
6. Download the hardware configuration to the CPU. The CP will reboot and the web server will bind to the configured IP on TCP/80.

Verify the web server is live by browsing to http://<CP-IP-address>/. The default Siemens welcome page lists the four applet names, confirming the S7Controls JAR is present and the applets are registered.

S7Controls Architecture: How the Applets Work

The four S7Controls applets share a common protocol bridge that opens an ISO-on-TCP (RFC 1006) connection to the S7 CPU over the CP's backplane. The bridge multiplexes multiple browser sessions through a single S7 connection, which is why the CP must be configured with at least one S7 connection of type "S7 connection" pointing back to the local CPU (rack 0, slot 2 for an S7-300).

From the HTML author's perspective, the Get and Put applets expose a small JavaScript-like API. In practice you embed the applet via <APPLET> or <OBJECT> and reference the tag by name. The applet maintains a Java-side hashtable of "variable name → S7 address" mappings declared in a properties file, then polls the CP on a configurable refresh interval (default 1000 ms).

Building a Multi-State Text List

A multi-state text list maps a numeric tag (BYTE, INT, or WORD) to a user-defined string table. This is the standard HMI/SCADA pattern for displaying pump Hand-Off-Auto or Stopped-Running-Faulted status. The CP 343-1 IT has no built-in text-list widget, but the same effect is achieved with the GetApplet feeding a small JavaScript switch.

Step 1: Define the S7 Tag

In the S7 program, expose a data block byte for the pump status. For example, in DB100:

DATA_BLOCK "Pump_Status"
  STRUCT
    HOA_Mode : BYTE;   // 0 = Off, 1 = Hand, 2 = Auto
    Run_State : BYTE;  // 0 = Stopped, 1 = Running, 2 = Faulted
  END_STRUCT
END_DATA_BLOCK

Confirm in the CP's S7 connection configuration that the connection has S7_GET rights on DB100. Also enable Read Once if you want a single-shot read instead of a continuous poll.

Step 2: Declare the Tag in the GetApplet Properties

Create a file getvars.props on the CP that maps symbolic names to absolute S7 addresses:

// getvars.props - variable declarations for GetApplet
PUMP_HOA   = DB100.DBB0   BYTE
PUMP_STATE = DB100.DBB1   BYTE

Upload getvars.props to the CP via FTP into the /applets/ directory. The CP parses this file at web server startup.

Step 3: Embed the GetApplet in HTML

<!DOCTYPE html>
<html>
<head><title>Pump Dashboard</title>
<script src="textlist.js"></script>
</head>
<body>
  <h1>Pump P-101 Status</h1>
  <table border="1">
    <tr><td>HOA Mode:</td>
        <td><span id="hoa">---</span></td></tr>
    <tr><td>Run State:</td>
        <td><span id="state">---</span></td></tr>
  </table>

  <!-- Embed the GetApplet -->
  <APPLET code="GetApplet.class"
          archive="s7controls.jar"
          width="1" height="1">
    <param name="varsfile" value="getvars.props">
    <param name="refresh"  value="1000">
  </APPLET>
</body>
</html>

The GetApplet is invisible (1×1 px) but exposes a JavaScript-callable update mechanism. Two approaches are field-proven:

1. LiveConnect bridge (legacy Netscape-era JS↔Java interop): call document.applets[0].getValue("PUMP_HOA") from a setInterval() in textlist.js.
2. Polling callback: use a small Java class that extends GetApplet and invokes JSObject.getWindow(this).updateHoa(value) on each poll cycle. This is more reliable across JRE versions.

Step 4: Build the Text Mapping in JavaScript

// textlist.js - multi-state text list for pump status
var HOA_TEXT = ["OFF", "HAND", "AUTO"];
var STATE_TEXT = ["STOPPED", "RUNNING", "FAULTED"];

function updateHoa(rawValue) {
  // rawValue arrives as Java byte; coerce to integer index
  var v = (rawValue & 0xFF);
  document.getElementById("hoa").innerHTML =
      (v < HOA_TEXT.length) ? HOA_TEXT[v] : ("INVALID (" + v + ")");
}

function updateState(rawValue) {
  var v = (rawValue & 0xFF);
  document.getElementById("state").innerHTML =
      (v < STATE_TEXT.length) ? STATE_TEXT[v] : ("INVALID (" + v + ")");
}

// Polling bridge - calls GetApplet every refresh cycle
setInterval(function() {
  try {
    var a = document.applets[0];
    if (a && a.getValue) {
      updateHoa(a.getValue("PUMP_HOA"));
      updateState(a.getValue("PUMP_STATE"));
    }
  } catch (e) { /* applet not yet ready */ }
}, 1000);

Upload textlist.js and the HTML page to the CP via FTP into the web root (/). The CP serves them at http://<CP-IP>/pump_dashboard.html. The page auto-refreshes the displayed text every 1 second based on the live S7 values.

Adding a Hand-Off-Auto Write Selector with PutApplet

To allow the operator to switch the pump between Off, Hand, and Auto from the browser, add a PutApplet-driven selector. The S7 program must include logic that uses the written value to drive the actual mode (typically the value is copied into a "command" byte that the user program interprets).

// putvars.props
PUMP_HOA_CMD = DB100.DBB2  BYTE   // operator command

<!-- HTML selector -->
<form name="hoaForm">
  <input type="radio" name="hoa" value="0" onClick="setHoa(0)"> OFF
  <input type="radio" name="hoa" value="1" onClick="setHoa(1)"> HAND
  <input type="radio" name="hoa" value="2" onClick="setHoa(2)"> AUTO
</form>

<APPLET code="PutApplet.class"
        archive="s7controls.jar"
        width="1" height="1">
  <param name="varsfile" value="putvars.props">
</APPLET>

<script>
function setHoa(val) {
  try {
    document.applets[1].putValue("PUMP_HOA_CMD", val);
  } catch (e) {
    alert("PutApplet not ready: " + e);
  }
}
</script>

Spidercontrol: Visual Authoring for Non-Programmers

Spidercontrol's PLC Edition (formerly SpiderControl PLC Edition Simatic) is a Windows tool that generates the HTML/JS/Java files for the CP 343-1 IT from a visual canvas. It supports:

• Drag-and-drop gauges, bar graphs, level indicators, and text lists
• Direct binding to S7 tags declared in the project's symbol table
• Auto-generation of getvars.props and putvars.props
• One-click FTP upload to the CP

The downloadable demo version (SpiderControl PLC Edition Simatic Demo) is fully functional but limits the project to a small number of tags (typically 8-16 depending on the version), making it suitable for small operator dashboards. A commercial license lifts the tag limit. Spidercontrol is the lowest-effort path for engineers who do not want to hand-author the applet-embedding HTML above.

Variable Addressing Reference

The getvars.props / putvars.props syntax uses absolute S7 addresses. Always prefer DB addressing for portability across firmware updates - absolute I/Q/M addresses can collide with the S7-300 system bit area.

For BOOL, the applet returns a Java boolean (true/false). For BYTE/WORD/DWORD the applet returns an unsigned integer. For INT/DINT the applet returns a signed Java int or long. For REAL the applet returns a Java float - be aware of IEEE 754 rounding when displaying process values with one or two decimal places.

Security Considerations and CISA Advisory

The CP 343-1 family was the subject of CISA advisory ICSA-24-046-04 (associated with Siemens security advisory SSA-516818), which addresses vulnerabilities in the CP 343-1, CP 343-1 Advanced, and CP 443-1 product lines. Operators of CP 343-1 IT devices on plant networks should review the advisory and apply firmware updates where available.

Verification Procedure

1. Web server reachability: From an engineering workstation, browse to http://<CP-IP>/. The default Siemens landing page should render with the four applet links.
2. Custom page render: Browse to http://<CP-IP>/pump_dashboard.html. The page should display the HOA and Run State text spans, initially showing ---.
3. Live read: Force the S7 variable DB100.DBB1 (PUMP_STATE) to value 2 in the S7 VAT table. Within 1 second, the Run State cell should update to FAULTED.
4. Live write: Click the HAND radio button on the dashboard. Force-watch DB100.DBB2 (PUMP_HOA_CMD) in the VAT - the value should change to 1 within 200 ms.
5. Invalid value handling: Force PUMP_STATE to a value outside the defined text array (e.g., 99). The text list should display INVALID (99), confirming the fallback path.

Troubleshooting Matrix

Migration Path: From CP 343-1 IT to CP 343-1 Advanced + OPC UA

For new installations where browser-NPAPI support is not acceptable, the recommended replacement is the CP 343-1 Advanced (6GK7343-1GX30-0XE0) with firmware V3.0. The Advanced variant ships an OPC UA server and a modern HTML5 web server that does not require Java applets. The tag-binding pattern is similar - tags are declared in a JSON manifest and bound to OPC UA nodes - but the JavaScript polling bridge is replaced with native WebSocket subscriptions.

If you have an existing investment in CP 343-1 IT hardware and HTML pages, the Java-applet approach continues to work on Internet Explorer 11 and is supported on Windows 10/11 in IE Mode (configured via Group Policy). Plan a phased migration to the Advanced variant as IE Mode reaches end-of-support in your organization.

FAQ