Resolving CP343-1 Lean Ethernet Communication to Schneider

Overview: Bridging SIMATIC S7-300 and Modicon Over Industrial Ethernet

Connecting a SIMATIC S7-300 station equipped with a CP 343-1 Lean communications processor to a Schneider Electric Modicon PLC (M221, M241, M251, M340, M580, M580 Safety, Premium, or Quantum) is a common requirement in mixed-vendor brownfield installations. The CP 343-1 Lean (Siemens order number 6GK7343-1CX10-0XE0) is a cost-optimized communications module that supports several Ethernet protocols, but it does not support every protocol available on the larger CP 343-1 or CP 343-1 Advanced modules. When the peer controller is a Modicon PLC, only a subset of those protocols can be used, and the rest must be ruled out before commissioning.

This reference describes three workable paths—Open IE Communication over raw TCP/UDP, Modbus TCP, and PROFINET IO—and shows how to engineer each one in STEP 7 V5.5 / TIA Portal on the Siemens side and in EcoStruxure Control Expert (formerly Unity Pro), SoMachine, or SoMachine Basic on the Schneider side. It covers the supported function blocks, FB/DB parameter sets, port numbers, MB_HOLD_REG addressing, endianness conversion, and the diagnostics that confirm a clean handshake on both sides of the wire.

CP 343-1 Lean Communication Capabilities

The CP 343-1 Lean is documented in the SIMATIC NET CP 343-1 Lean Manual. The module provides one RJ45 port (10/100 Mbit/s, Auto-MDI/MDIX) and ships with the following protocol stack:

The CP 343-1 Lean firmware revisions 2.x and 3.x are the production releases used today; revision 3.x is the only variant currently orderable as new. Firmware can be updated using the SIMATIC Automation Tool or the Web-based administration interface at https://<CP-IP>/index.html.

Why Siemens-Proprietary Protocols Cannot Reach Modicon

S7 Communication (the "PUT/GET" services running on ISO-on-TCP port 102) and the S5-compatible FETCH/WRITE services are Siemens-developed protocols and are not implemented on any Modicon controller. Even though Modicon M340 / M580 CPUs include an Ethernet port and advertise TCP/IP support, the application layer is not S7. The Schneider Modicon application layer is either Modbus (TCP port 502 or 502+offset for Unity), EtherNet/IP (UDP port 2222 / TCP port 44818 / 2221), or an open user-developed socket on top of TCP/UDP.

Therefore, when integrating a CP 343-1 Lean with a Modicon peer, the only viable Siemens-side protocols are:

1. Open IE Communication (raw TCP or UDP sockets) used with a custom protocol on the Modicon side.
2. Modbus TCP using the Siemens "Modbus_TCP_CP" FB library.
3. PROFINET IO when the Modicon peer is a PROFINET-capable controller such as M580 with BMENOC0301/BMENOC0311 Ethernet modules.

Protocol Selection Strategy

Selection is driven by what the Modicon peer already supports and what the application requires. Use the table below to choose.

If the goal is purely cyclic process data exchange with deterministic behavior and a 1 ms update rate, PROFINET IO is the strongest option but only when the Modicon station has a BMENOC0301 or BMENOC0311 module configured as a PROFINET IO Device. If the goal is supervisory polling of measurement data, holding registers, or coils, Modbus TCP is by far the simplest. If neither is available, Open IE TCP/UDP with a custom framing protocol is the universal fallback.

Approach 1: Open IE Communication (TCP/UDP)

Open IE Communication gives the S7-300 user program a raw TCP or UDP socket. The CP 343-1 Lean provides the transport, and the application defines the payload. This is the only option that works with virtually any TCP/UDP-capable peer, including Modicon controllers running a user-developed server in Structured Text.

Hardware Configuration in STEP 7 V5.5

1. Insert the CP 343-1 Lean (6GK7343-1CX10-0XE0) into the S7-300 rail and assign it slot 4 (or any free slot in the S7-300 mounting rack).
2. Open HW Config, right-click the CP, and select Object Properties → Ethernet Interface.
3. Set the CP IP address (example: 192.168.0.10) and subnet mask (255.255.255.0).
4. In the CP properties, tab Options, enable Active Connection only if the S7 should be the TCP client; otherwise select Passive Connection.
5. Add the Modicon partner as an Unspecified Connection Partner with IP 192.168.0.20 and the listening port (example: 2000 for TCP, or 2001 for UDP).
6. Assign the connection a local ID. The CP uses this ID in the AG_SEND / AG_RECV blocks.
7. Download the hardware configuration to the S7-300 station.

Programming the Open TCP Client

The standard S7-300 FBs for Open IE are:

Example call in STL / LAD for sending 100 bytes from DB100 starting at byte 0:

// STL style — TCP SEND
CALL  FB100, DB100
      ID       := 1                // Local connection ID from HW Config
      LEN      := 100              // Bytes to send
      DONE     := M100.0           // Pulse on success
      ERROR    := MW102            // Error word
      STATUS   := MW104            // Status word
      SEND     := P#DB100.DBX0.0 BYTE 100

Receive companion (place FB101 in OB1):

CALL  FB101, DB101
      ID       := 1
      LEN      := MW110             // Bytes received (out)
      NDR      := M112.0            // New data received
      ERROR    := MW114
      STATUS   := MW116
      RECV     := P#DB101.DBX0.0 BYTE 1000

Modicon Peer as TCP Server

On the Modicon M340 / M580 side, configure an Ethernet socket listener using EcoStruxure Control Expert (formerly Unity Pro) and the ADDM function block from the Communication Library for Modicon M340, or use the Socket Communication library for M580. A minimal Structured Text server that accepts one client and echoes back a 100-byte payload:

// EcoStruxure Control Expert — ST
// Socket server skeleton (M340 BMXNOE0100/BMXNOE0110)
IF NOT bServerOpen THEN
    iStatus := SysSockCreate('S', iListenHandle); // Stream socket
    iStatus := SysSockBind(iListenHandle, ADR(sAddr), 16);
    iStatus := SysSockListen(iListenHandle, 1);
    bServerOpen := TRUE;
END_IF;

iStatus := SysSockAccept(iListenHandle, iClientHandle, ADR(cAddr));
IF iStatus = 0 AND iClientHandle <> 0 THEN
    SysSockRecv(iClientHandle, ADR(rxBuf), 100, iRxLen);
    IF iRxLen = 100 THEN
        SysSockSend(iClientHandle, ADR(txBuf), 100, iTxLen);
    END_IF;
END_IF;

For M580 with the BMENOC0301 / BMENOC0311, the same function blocks apply, but the BMENOC must be configured in Control Expert with the IP address on the same subnet as the CP 343-1 Lean and routing enabled.

Approach 2: Modbus TCP via CP 343-1 Lean

Modbus TCP is the lowest-friction path when the Modicon peer runs a Modbus server. The Schneider Modicon M221, M241, M251, M340, M580, Premium (TSX), and Quantum (140) all expose a Modbus TCP server on port 502 by default. The CP 343-1 Lean becomes a Modbus client via the Siemens "Modbus_TCP_CP" library, documented in the Siemens FAQ 104584337 — "How do you establish OPEN MODBUS/TCP communication via the CP343-1 or CP443-1 and where can you find further information?"

Required Software and Library Blocks

From the Siemens support site, download the library "Modbus_TCP_CP_V15.zip" (STEP 7 V5.5) or "MODBUS_TCP_CP_for_S7-300_and_S7-400" for TIA Portal. It contains the following blocks:

STEP 7 Configuration

1. Open HW Config, configure the CP 343-1 Lean with IP 192.168.0.10.
2. In the CP properties, set up an ISO-on-TCP or TCP connection to partner 192.168.0.20:502. The connection local ID is referenced by FB103.
3. Import the Modbus_TCP_CP blocks into the S7 project.
4. Create DB200 with at least 200 bytes of register data.
5. Call FB103 in OB1 with the parameters shown below.

CALL  FB103, DB200             // MB_CPCLI instance
      REQ     := M200.0         // Trigger one read/write cycle
      ID      := 2              // Local connection ID
      MB_MODE := 1              // 1 = Read Holding Registers (FC03)
      MB_DATA_ADDR  := 40001     // Modicon holding register 40001 (Word 0)
      MB_DATA_LEN   := 100      // Read 100 registers = 200 bytes
      MB_DATA_PTR   := P#DB300.DBX0.0 WORD 100
      DONE    := M210.0
      ERROR   := MW212
      STATUS  := MW214
      CP_STATUS := MW216

To write to Modicon coils or holding registers, set MB_MODE = 5 (Write Single Coil), MB_MODE = 6 (Write Single Register), MB_MODE = 15 (Write Multiple Coils), or MB_MODE = 16 (Write Multiple Registers). The function code mapping follows the Modbus Application Protocol Specification V1.1b3.

Modicon M340 / M580 Modbus Server Configuration

On the Modicon side the Modbus server is built-in. For M340 / M580 in EcoStruxure Control Expert:

1. Open the CPU configuration, tab Ethernet.
2. Enable the Modbus TCP server. Default port: 502. Each Ethernet module (BMXNOE0100, BMXNOE0110, BMENOC0301, BMENOC0311) supports up to 32 simultaneous Modbus connections.
3. Map the desired %MW words to Modbus holding registers. The mapping is automatic: %MW100 = Modbus register 40001 (or 400101, depending on the addressing mode), %MW101 = 40002, and so on. Confirm the offset under Project Settings → Variables → Modbus Addressing.
4. On the Modicon M221, the equivalent configuration is done in SoMachine Basic under Ethernet → Modbus TCP Server; the M221 acts as server on port 502 and the holding registers are the %MW memory area. Reference: Schneider FAQ FA374362 — "Can the Modicon M221 PLC communicate via EtherNet/IP protocol?"

Approach 3: PROFINET IO

PROFINET IO is the only option that delivers real-time deterministic data exchange with cycle times down to 1 ms on the CP 343-1 Lean. The Lean module acts as PROFINET IO Controller, and the Modicon peer must be configured as a PROFINET IO Device.

On the Modicon side, the BMENOC0301 / BMENOC0311 modules (M580) support PROFINET IO Device mode. Older Modicon modules (BMXNOE0100 / BMXNOE0110 on M340) do not support PROFINET IO at all—they are Ethernet-only and cannot be used as PROFINET devices. For Modicon M340, the only path is Modbus TCP or Open IE.

Steps for PROFINET IO between CP 343-1 Lean and a M580 BMENOC0301:

1. Obtain the GSDML file for the BMENOC0301 from the Schneider Electric website under Modicon M580 → Downloads → GSD Files.
2. In STEP 7 HW Config, install the GSDML and drag the BMENOC0301 into the PROFINET IO network as a Device.
3. Configure the slots: typically slot 0 is the device itself, slot 1 is the input submodule, slot 2 is the output submodule.
4. Set the send clock to 1 ms and the watchdog time to 3 ms.
5. On the M580 side, in EcoStruxure Control Expert, enable DTM Browser → BMENOC0301 → PROFINET IO Device and map the PROFINET slots to %I / %Q words. The default device access point is 0.
6. Download both configurations and verify with the PROFINET diagnostics in STEP 7 (Online → PROFINET IO Diagnostics) and in Control Expert (BMENOC DTM → Diagnostics).

Schneider Modicon Ethernet Capability Matrix

Data Type and Endianness Conversion

The S7-300 stores multi-byte integers in big-endian (Motorola) byte order by default. Modicon Modbus registers are transferred in big-endian over the wire, which means a 16-bit holding register read by the S7-300 ends up in the correct word orientation. For 32-bit values (DINT, REAL), however, the Modbus specification holds the low word first, so the S7-300 must swap words to recover the value.

Example: a Modicon REAL at %MW200 / %MW201 arrives in DB300 as Word 100 (low) and Word 101 (high). To reassemble in STL / SCL:

// SCL — Reassemble a Modicon REAL from low/high words
rValue := DWORD_TO_REAL(SHL(IN := WORD_TO_DWORD(wHigh), N := 16)
                        OR WORD_TO_DWORD(wLow));

For the Open IE approach, define the byte order explicitly in the protocol specification and document it in the project. A common convention is a 6-byte header (e.g. [STX 0x02][LEN_HI][LEN_LO][CMD][DATA...][BCC 0x03]) followed by the payload.

Network Architecture and Hardware Considerations

Place the CP 343-1 Lean and the Modicon peer on the same IP subnet, separated from the office LAN. Recommended baseline hardware:

• Industrial managed switch with IGMP snooping disabled (e.g. Siemens SCALANCE XC-200, Hirschmann RS20, or Schneider MCSESM-E).
• Cat 5e STP cable, maximum run length 100 m.
• Dedicated VLAN if PROFINET IO is used, to keep broadcast traffic off the real-time channel.
• Surge protection on field-side runs (Phoenix Contact PT-IQ or equivalent).

Configure the CP 343-1 Lean port as follows: 100 Mbit/s full-duplex, Auto-Negotiation disabled, MDIX enabled. Mismatched duplex is the single most common cause of late packets on PROFINET IO links.

Verification and Diagnostics

1. CP 343-1 Lean diagnostics: open the Web-based administration at https://<CP-IP>/index.html. Confirm the partner connection state shows "Established" under Information → Connections. On Open IE TCP, the CP reports the connection status byte STAT_TCP = 0x03 when active.
2. STEP 7 online diagnostics: in HW Config, right-click the CP, choose Module Information → Diagnostics. Look at Connection Diagnostics; the CP lists the connection ID, partner IP, port, send and receive byte counters, and the last error code.
3. Modbus TCP diagnostic counters: read STATUS from FB103. Common values: 0000 done, 0001 busy, 8381 Modbus exception 0x83 illegal data address, 8382 illegal data value, 80C8 partner connection timeout.
4. Modicon side diagnostics: in EcoStruxure Control Expert, open the Ethernet module DTM and select Diagnostics → Statistics. Look at Modbus requests received, Modbus responses sent, and Connection errors. The counters must increment symmetrically with the FB103 calls on the Siemens side.
5. Wire-level confirmation: capture port 502 (Modbus TCP) with Wireshark between the two devices. Confirm the TCP three-way handshake, the Modbus ADU, and the unit identifier. For PROFINET IO, filter on pn_rt and confirm periodic Real-Time frames.

Troubleshooting Matrix

Field-Proven Caveats

• Keep the CP 343-1 Lean firmware current. Revision 3.x resolved multiple TCP keep-alive bugs present in 2.x that caused silent disconnects on idle links.
• Avoid running PROFINET IO and Modbus TCP on the same CP at very different update rates. The PROFINET real-time channel can starve the Modbus polling if the send clock is set below 1 ms without proper QoS.
• Modicon M580 BMENOC0301 firmware V2.50 and earlier has known issues with PROFINET IO Device reconnection after power cycle. Apply V2.60 or later.
• Open IE UDP is connectionless, so AG_SEND over UDP cannot confirm delivery. Use TCP if the application is safety-relevant; never use raw UDP for interlocks.
• For M580 Safety applications, never route safety data over Modbus TCP or Open IE—use CIP Safety on EtherNet/IP or PROFIsafe on PROFINET.

FAQ