J1939 to S7-300 Integration: Gateway Options and STEP 7 Setup

J1939 to S7-300 Integration: Gateway Options and STEP 7 Setup

SAE J1939 is the dominant heavy-duty vehicle and engine control network, but it is physically and logically incompatible with a Siemens S7-300 PLC, which has no native CAN interface and no native J1939 stack. The two practical paths are (a) a third-party CAN module such as the CAN300 with an S7-300 backplane, or (b) a J1939-to-Ethernet gateway that exposes the engine data as Modbus/TCP, Ethernet/IP, ISO-on-TCP (RFC 1006), or PROFINET to a CP343-1 on the S7-300. This reference covers the protocol mechanics, the Siemens CP options, the gateway evaluation matrix, and the STEP 7 configuration required for each path.

1. J1939 Protocol Stack Recap

J1939 is defined by the SAE J1939 family of documents and runs on a CAN 2.0B physical layer (ISO 11898) using the 29-bit identifier frame. It is not CANopen and cannot be parsed with any CANopen library.

Parameter Group Numbers (PGNs) the engine will normally broadcast on a typical diesel/electric set:

2. Integration Paths Compared

For most S7-300 sites the lowest-risk path is the J1939 → Modbus/TCP gateway because every CP343-1 supports Modbus/TCP as a server/client without additional hardware, and the S7 side reduces to a standard FB65/FB66 program block sequence.

3. Siemens Hardware Required on the S7-300 Side

Refer to the Siemens CP343-1 Lean manual (entry ID 24409951) and the CP343-1 Advanced manual (entry ID 24408373) for the firmwared, connection-count, and protocol limits relevant to your firmware version.

4. Selecting a J1939-to-Ethernet Gateway

Selection criteria for an industrial J1939 gateway that will live on the plant floor next to a S7-300 panel:

1. J1939 stack maturity. Confirm hardware support for Address Claiming (PGN 60928), Request PGN (PGN 59904), and BAM + RTS/CTS transport. Entry-level converters that only handle PGN-broadcast passthrough will silently fail on request-driven PGNs like DM1/DM2.
2. SPN scaling. The gateway should expose engineering-unit values (°C, kPa, RPM, L/h), not raw byte values. This is the single biggest field-failure cause.
3. Request interval. The gateway must poll PGNs at a configurable rate (typically 100–1000 ms). Some engines only broadcast EEC1 at 100 ms; others require a Request PGN to be sent.
4. Connection model on the Ethernet side.
   • Modbus/TCP server: each PGN → a fixed Holding Register range.
   • Ethernet/IP: each PGN → an Input Assembly, typically 16–32 bytes.
   • PROFINET: each PGN → a slot/sub-slot.
5. Diagnostic transparency. DM1 (active DTCs) and DM2 (historic DTCs) must be exposed as register/assembly data, not swallowed.
6. Power and environment. Industrial temperature (-40 to +75 °C), 24 VDC, DIN rail, IP20 minimum, UL/CE/ATEX as required.

Reference devices that meet all six points:

5. Configuration Walk-Through — J1939 → Modbus/TCP → CP343-1

5.1 Gateway-side register map

Configure the gateway to expose the requested PGNs as Modbus Holding Registers. Example map produced by a typical J1939-to-Modbus/TCP converter:

5.2 CP343-1 hardware configuration

1. Open the SIMATIC Manager project for the S7-300 station.
2. In HW Config, drag the CP343-1 Lean (6GK7 343-1CX10-0XE0) into slot 4 (or any free slot).
3. Double-click the CP → Properties → Ethernet Interface → assign an IP address on the plant subnet (e.g. 192.168.10.20, subnet mask 255.255.255.0).
4. Switch to the "Connections" tab of the CP properties; create one new TCP connection (not ISO-on-TCP, not UDP) toward the gateway IP, port 502.
5. Mark the connection active on the S7 side and assign the local port to 2000 (any free passive port works; the remote port stays 502).
6. Compile and download HW Config.

5.3 STEP 7 program blocks

The standard blocks for Modbus/TCP on S7-300 are FB65 "TCON" (open), FB66 "TDISCON" (close), FB63 "TSEND" (send request), FB64 "TRCV" (receive response), and the DB referenced by IDB of TCON. The Modbus read transaction is built as a 12-byte MBAP header + 5-byte function code frame:

// S7-300 SCL — Modbus/TCP Read Holding Registers (Function 03)
// 12 bytes MBAP header + 5 bytes PDU
// Triggered every 200 ms from OB35

FUNCTION_BLOCK FB_J1939_Read
VAR
    iTrigger : BOOL;   // rising edge starts a transaction
    iStartAddr : INT := 0;        // Modbus start address (0-based)
    iQty : INT := 14;             // number of 16-bit holding registers
    iTimeout : TIME := T#1S;
    xBusy : BOOL;
    xError : BOOL;
    wError : WORD;
    aSend : ARRAY[0..7] OF BYTE;  // 8 bytes MBAP+PDU header
    aRecv : ARRAY[0..31] OF BYTE;
    iData : ARRAY[0..13] OF INT;  // 14 register values
END_VAR

// MBAP header (6 bytes):
//   Transaction ID = 0001
//   Protocol ID    = 0000 (Modbus)
//   Length         = 0006 (bytes following: UID + FC + 2*Qty + 2)
// PDU (5 bytes):
//   Unit ID = 01, FC = 03, StartHi, StartLo, QtyHi, QtyLo
IF iTrigger AND NOT xBusy THEN
    aSend[0] := 16#00; aSend[1] := 16#01;   // Tx ID
    aSend[2] := 16#00; aSend[3] := 16#00;   // Protocol ID
    aSend[4] := 16#00; aSend[5] := 16#06;   // Length
    aSend[6] := 16#01;                       // Unit ID
    aSend[7] := 16#03;                       // Function Code 03
    // Start address and qty inserted at runtime below
    // Note: the actual 12-byte frame above is shown compactly;
    // expand to 12 bytes (2-byte Tx ID + 2-byte Proto + 2-byte Len +
    // 1-byte UID + 1-byte FC + 2-byte Start + 2-byte Qty).
    xBusy := TRUE;
END_IF;

The recommended Siemens approach is to drop FB65 "TCON", FB63 "TSEND", FB64 "TRCV" into OB35 (cyclic interrupt 200 ms), and write the MBAP frame in a separate FB that builds it from the CP's connection ID. Use the Siemens Modbus/TCP example project for CP343-1 (entry ID 24016777) as a working baseline; it ships with a sample S7 program, a connection DB, and an Excel-based address calculator.

5.4 Verification checklist

1. Online → CP343-1 → Diagnostics → Connection List: the TCP connection toward the gateway must show state ESTABLISHED with bytes-sent/received incrementing.
2. Force iTrigger := TRUE and watch xBusy toggle to FALSE within ~50 ms; xError must remain FALSE.
3. Compare the engine-speed value (aData[0]) to the value shown on the engine HMI panel — they must agree within ±5 rpm.
4. Stop the engine and confirm aData[2] (coolant) drops toward ambient within 30 minutes (sanity check on scaling and unit conversion).
5. Inject a DM1 fault (e.g. disconnect the coolant sensor) and confirm aData[14] (lamp status) goes non-zero within two 200 ms cycles.

6. Configuration Walk-Through — J1939 → PROFINET → CP343-1 PN

When the gateway supports PROFINET, the S7-300 side becomes even simpler because PROFINET IO is directly supported by CP343-1 EX30/GX30.

1. In HW Config, assign the CP343-1 EX30 to the PROFINET subnet and configure its PROFINET IO Controller role.
2. Install the gateway's GSDML file (e.g. GSDML-V2.3-HMS-PNJ1939-...) into STEP 7 via Options → Install GSD File.
3. Drag the gateway from the PROFINET IO directory into the subnet; assign it IP 192.168.10.50 and a PROFINET device name (e.g. J1939-CAN-GW).
4. Map PGNs to slots — each slot becomes one or two words in the I/O image. Typical mapping: slot 1 = EEC1 (4 words), slot 2 = ET1 (2 words), slot 3 = FE (2 words), slot 4 = DM1 (8 words).
5. Download HW Config. The gateway's I/O is now updated every PROFINET cycle (1–4 ms).

Use the gateway's web interface to confirm the J1939 side is healthy: bus load < 50 %, error frames < 100/min, claimed address 0x00 (Engine 1).

7. Configuration Walk-Through — J1939 → Ethernet/IP → CP343-1 PN

From CP343-1 firmware V3.0, the CP supports Ethernet/IP as a Scanner (Master) on a limited basis — typically up to 8 CIP connections. This works for small PGN sets. Siemens entry ID 92027198 documents the Ethernet/IP firmware add-on.

1. Upgrade the CP343-1 PN firmware to V3.0.x (e.g. 6GK7 343-1HX00-0XE0 FW V3.0.10).
2. Enable the Ethernet/IP functionality in HW Config under the CP properties (license required in some FW versions).
3. Configure the CP as EtherNet/IP Scanner; enter the gateway IP 192.168.10.50.
4. Define Input Assembly 0x64 (100) and 0x65 (101) — 16 and 32 bytes respectively, matching the gateway's mapping.
5. Use the standard S7-side logic L PEW / T DBW to pull engine data from the process image.

8. The "WinAC + PC" Path (When No Industrial Gateway Is Acceptable)

A WinAC RTX slot PLC runs the S7 program on a Windows IPC and exchanges process data with any PC-attached CAN hardware via the SIMATIC NET OPC server. This is the only path that gives you direct access to the raw J1939 frames without a converter box.

1. Install an IPC with a PEAK PCAN-PCI, IXXAT USB-to-CAN, or Kvaser Leaf interface.
2. Install a J1939 stack (e.g. IXXAT J1939 stack, or the Kvaser J1939 library) on Windows.
3. Open a J1939 channel, claim an address (Address Claiming 0xFE = Industry Group 2, Arbitrary), and subscribe to PGNs 0xF004, 0xFEEE, 0xFEF2, etc.
4. Build a Windows service that scales the SPNs to engineering units and pushes values into the WinAC RTX process image via SIMATIC NET OPC or a memory-mapped file.
5. The S7 program reads the values as if they came from local I/O.

This path trades hardware cost and engineering complexity for the highest possible flexibility (you can subscribe to any PGN, run proprietary diagnostics, log DM1 history, etc.). It is the right answer for OEM equipment builders who need J1939 mastery; it is the wrong answer for a one-off retrofit where a $600 gateway would do.

9. SPN Scaling Reference (For DIY Gateway Programming)

If you are writing your own J1939-to-Modbus mapping, use this formula:

// SPN engineering value from raw byte(s)
// byte_offset = position of LSB inside the 8-byte CAN payload
// length      = 1, 2, or 4 bytes (J1939 transmission is little-endian)
// resolution  = LSB weight
// offset      = zero-point offset

EngineeringValue := 0.0;
FOR i := 0 TO length-1 DO
    EngineeringValue := EngineeringValue + raw_bytes[byte_offset + i] * (256 ** i);
END_FOR;
EngineeringValue := (EngineeringValue * resolution) + offset;

Examples (from SAE J1939-71):

10. Troubleshooting Matrix

11. Standards and Compliance

• SAE J1939-21 — Data Link Layer (29-bit CAN ID, BAM, RTS/CTS).
• SAE J1939-71 — Vehicle Application Layer (PGN/SPN definitions, scaling).
• SAE J1939-73 — Diagnostics (DM1, DM2, DM14).
• SAE J1939-81 — Network Management / Address Claiming.
• ISO 11898-1/2 — CAN physical layer (250 kbps for J1939).
• IEC 61158 — Fieldbus (PROFINET part referenced by CP343-1 PN).
• RFC 1006 — ISO-on-TCP transport (only for raw byte pipe, not for J1939 parsing).
• Modbus Organization Modbus/TCP — MBAP + Function Code 03/06/16 reference.

12. Recommendation Summary

• Single engine, small retrofit, low budget: J1939 → Modbus/TCP gateway (HMS Anybus, Red Lion ICX35, Turck TBEN) + CP343-1 Lean + FB65/FB63/FB64 in OB35.
• Multi-engine plant or existing PROFINET infrastructure: J1939 → PROFINET gateway (Helmholz PN/CAN, HMS Anybus PROFINET variant) + CP343-1 EX30/GX30 with GSDML.
• Existing EtherNet/IP site (e.g. CompactLogix or S7-1500 mixed fleet): J1939 → Ethernet/IP gateway (ProSoft PLX31, HMS Anybus Ethernet/IP) + CP343-1 PN with Ethernet/IP firmware add-on.
• OEM with deep J1939 customization needs: WinAC RTX + IPC with IXXAT/PEAK/Kvaser CAN + native J1939 stack + SIMATIC NET OPC.
• Avoid: ISO-on-TCP as the J1939 carrier. It is a byte-pipe; you still need a stack at each end. Modbus/TCP gives you a deterministic, polled, register-based view that maps cleanly onto STEP 7's data-block model.