Keyence SR-1000 Communication with Siemens S7-300 CP340 Module

Problem Statement: CP340 Receives 16#20 (Space) Instead of QR/Barcode Data

An S7-300 station using a 6ES7340-1AH02-0AE0 CP340 RS-232 module is wired to a Keyence SR-1000 series 2D code reader. After triggering a scan from STEP 7 V5.x, the receive buffer returns 16#00000020 on every byte and the destination DB65 fills with the decimal value 32 in every position. This is not a corrupted code value—it is the ASCII space character being placed in every byte by either the configured idle-line fill or because the CP340 timed out on a receive that never produced any real data.

The root cause is architectural: the CP340 is an RS-232 / RS-422/485 point-to-point module. The Keyence SR-1000 is a PROFINET-native 2D reader that exposes decoded read results over TCP/IP or PROFINET IO, not over an asynchronous serial protocol that the CP340 can decode. Even when the SR-1000 is ordered with the RS-232 option block, the link protocol is not the Siemens 3964(R) or ASCII-driver profile the CP340 expects; it is a Keyence-defined command/response string set that requires polling, terminators, and ACK/NAK semantics the CP340 cannot natively generate.

SR-1000 Communication Interfaces — What the Reader Actually Supports

The Keyence SR-1000 series is a high-speed autofocus 1D/2D code reader. The product specification lists three industrial interfaces that are usable from a Siemens environment:

The full mechanical, optical, and electrical specifications of the SR-1000 (focal distance, frame rate, supported code symbologies, ambient immunity, and connector pin-out) are listed in the Keyence SR-1000 specifications page. The connectivity matrix between SR-1000 and Siemens / third-party PLCs—including downloadable STEP 7 sample projects—is published at the Keyence Sample Programs & Setup Guides page.

Why the CP340 Is the Wrong Module for the SR-1000

The 6ES7340-1AH02-0AE0 (and the later -1BH02 RS-422/485 variant) is a parameterizable point-to-point module supporting two protocols: 3964(R) and ASCII driver. Both protocols assume that the peer device either transmits spontaneously without any request (3964(R) receiving, ASCII with unsolicited output) or responds to a defined request frame that the CP340 itself constructs.

The SR-1000, on the other hand, implements a Keyence-defined command/response protocol on RS-232:

• The PLC must issue a request such as READ or LON (laser on) terminated by <CR><LF>.
• The scanner replies with the decoded data string, also terminated by <CR><LF>.
• There is no 3964(R) control character handshake; the CP340 will time out waiting for STX/DLE framing.

If the CP340 is configured in ASCII driver mode with a one-character terminator, it will collect characters until it sees the terminator and then place them in the receive DB. In the failing project, the first byte of every received telegram is being filled with the idle fill character (default 20h = space). This is the smoking gun: the scanner never transmitted a frame, so the CP340 timed out, reported the receive length, and left the buffer unchanged. STEP 7 then displays 16#20 as the byte value.

Recommended Fix #1: Connect via PROFINET Using a -2PN/DP CPU

If the CPU designation ends in -2PN/DP (e.g., 6ES7315-2EH14-0AB0, 6ES7317-2EK14-0AB0, or any 6ES7318-2), it carries an integrated PROFINET interface. This is the cleanest fix and avoids any extra module:

1. Wire the SR-1000 PROFINET port directly to the CPU's PROFINET port, either with a 1:1 patch cable (for a single reader) or through a managed PROFINET switch such as a 6GK5005-0BA00-1AB2 (SCALANCE XB005).
2. In HW Config, install the GSD file for the SR-1000 into STEP 7. The GSD is available from the Keyence support download portal referenced above.
3. Assign the SR-1000 a PROFINET device name and IP address from the PLC's PROFINET IO Controller view.
4. Map the relevant input slots (typically the result string and the read-status word) into input bytes of the S7-300.
5. Copy the decoded string from the PROFINET input area into a DB in the user program.

This path gives deterministic cycle-time behaviour, diagnostic interrupts on cable break, and zero protocol overhead in the user program. The PROFINET sample bundle from Keyence contains a working STEP 7 project that can be loaded as a reference.

Recommended Fix #2: Connect via CP343-1 as PROFINET IO Controller

If the CPU does not carry an integrated PROFINET interface (e.g., a classic 6ES7315-2AG10-0AB0), install a CP343-1 (e.g., 6GK7343-1EX30-0XE0) and configure it as a PROFINET IO Controller on a new subnet. The CP343-1 acts as a router between the S7-300 backplane and the PROFINET line to the SR-1000; the IO data is mirrored into the S7-300 process image, and the user program reads the result from a configured input word area.

Use the same GSD-based procedure described in the previous section. The CP343-1 Lean variants (6GK7343-1CX10-0XE0) do not support PROFINET IO Controller; only the EX30, EX40, and GX31 variants do. The 6GK7343-1GX31-0XE0 variant additionally supports Gigabit uplinks if the SR-1000 segment must be extended onto a higher-bandwidth plant network.

Fallback: If You Must Use RS-232 Through the CP340

Some legacy machines force the use of the existing CP340 wiring. If you cannot add a CP343-1 and the CPU is not a -2PN/DP variant, the SR-1000 can be set to RS-232 command mode using the Keyence SR-1000 Series User's Manual, downloadable from the Keyence PC Software & Manuals page. The configuration required is:

When configured this way, the user program issues a LON (laser on) or READ command via FB3 P_SEND from the CP340 library (Standard Library → Communication Blocks → CP 340), then waits for the response using FB2 P_RCV. The result string arrives terminated by 0D 0A and is written to a configured receive DB.

Wiring the SR-1000 RS-232 Port to a CP340

The SR-1000 RS-232 option block exposes a female D-sub 9 connector. The CP340 RS-232 variant (6ES7340-1AH02-0AE0) provides a male D-sub 15. Use a Keyence-supplied cable (typically part of the SR-1000 communications option) or build a crossover as follows:

Both ends must share a common ground reference. Do not connect DSR/DCD/RI pins; the SR-1000 ignores them. Verify that the EIA-232-F signal levels (±3 to ±15 V) are present on the SR-1000 side with a scope before concluding that the wiring is correct. A shorted or open signal pair can produce exactly the "all spaces" symptom observed.

STEP 7 Program Skeleton for the CP340 Path

If the CP340 path must be used, the following is the minimum user program required to drive the receive process:

// DB65: receive DB, length = 200 bytes
// DB66: send DB, length = 200 bytes

// At first scan (OB100) initialize CP340
CALL FB3  // P_SEND
   REQ   := FALSE
   R     := TRUE          // reset CP340 once on startup
   LADDR := W#16#100       // CP340 logical base address (configure to match HW Config)
   DB_NO := 66
   DBB_NO:= 0
   LEN   := 0
   DONE  := M10.0
   ERROR := M10.1
   STATUS:= MW12

// Periodic trigger of a READ command
CALL FB3  // P_SEND
   REQ   := M10.2          // toggle to send one telegram
   R     := FALSE
   LADDR := W#16#100
   DB_NO := 66
   DBB_NO:= 0
   LEN   := 6              // length of "READ\r\n"
   DONE  := M10.3
   ERROR := M10.4
   STATUS:= MW16
// DB66.DBB0..DBB5 = 'R','E','A','D',13,10

// Receive decoded string
CALL FB2  // P_RCV
   EN_R  := TRUE
   R     := FALSE
   LADDR := W#16#100
   DB_NO := 65
   DBB_NO:= 0
   LEN   := MW20           // number of bytes received
   NDR   := M10.5          // new data received
   ERROR := M10.6
   STATUS:= MW22
   // On NDR rising edge, DB65.DBB0..DBB[LEN-1] contain the decoded code string.

The complete block library (FB2 P_RCV and FB3 P_SEND) is part of STEP 7 V5.x and is documented in the Siemens CP340/CP341 Parameter Assignment manual.

Troubleshooting Matrix

Verification Procedure After the Fix

1. With the SR-1000 powered and focused on a known-good 2D code (e.g., a Data Matrix on the Keyence test card), open the online watch table on the receive DB.
2. Trigger a scan from the PLC or from the SR-1000 handheld.
3. Confirm the receive length word is non-zero and matches the code length.
4. Confirm the first and last bytes are not 0x20 (the decoded code text should be alphanumeric).
5. Cycle the test 100 times to confirm deterministic response; if any frame returns all 0x20, treat it as a receive timeout and increase the CP340 receive timeout parameter.
6. Toggle the trigger off, place a non-readable surface in the field of view, and confirm the status word reports "no read" rather than filling the buffer with fill characters.

Recommendation Summary

For any new S7-300 / SR-1000 installation, choose the PROFINET path. The hardware is on the SR-1000 by default; the sample program and GSD are free from Keyence; and you remove the CP340 as a single point of failure. Reserve the CP340 RS-232 path for retrofit installations where the existing module, cable, and rack are fixed, and budget time for protocol handshaking and command-mode configuration.