Resolving the CP343-1 Lean Upload Error: Rack/Slot 0/2 Configuration in STEP 7 V5.4
This technical reference documents the resolution of the STEP 7 error message "Downloading the configuration is only possible via CPU" when attempting to upload a station to the programming device (PG) through a Siemens CP343-1 Lean Ethernet communication processor. The symptom appears most often when the original STEP 7 project is unavailable and the engineer must reverse-engineer or service a SIMATIC S7-300 station that is already in productive service.
1. Problem Statement
When the LAN cable is connected to the CP343-1 Lean and the engineer selects PLC → Upload Station to PG (German: Station in PG laden), STEP 7 returns the dialog prompt "Downloading the configuration is only possible via CPU" and refuses to continue. The CPU is correctly visible in the Accessible Nodes browser when the PG/PC interface is set to TCP/IP (auto), which proves the physical link, the IP addressing, and the ISO-on-TCP / S7 transport are all healthy. The failure is purely a parameter-routing issue inside the STEP 7 project frame.
The same symptom can appear with the following related CP types in the S7-300 family:
| CP Type | Order Number (MLFB) | Firmware | Connection Used |
|---|---|---|---|
| CP343-1 Lean | 6GK7 343-1CX10-0XE0 | V2.0 (and V2.x variants) | TCP/IP via integrated 2-port switch |
| CP343-1 | 6GK7 343-1EX30-0XE0 | V2.x / V3.x | TCP/IP, ISO, ISO-on-TCP |
| CP343-1 Advanced | 6GK7 343-1GX30-0XE0 | V2.x / V3.x | TCP/IP, ISO, PROFINET |
| CP343-1 IT | 6GK7 343-1GX20-0XE0 | V2.x | TCP/IP, ISO, FTP, HTTP |
2. Affected Hardware and Software Versions
The fault has been reproduced and confirmed on the following stack:
| Component | Type / Order Number | Firmware / Version | Notes |
|---|---|---|---|
| CPU | CPU314C-2DP, 6ES7 314-6CF02-0AB0 | Firmware V3.3 (or later) | Work memory 192 KB code / 192 KB data |
| Communication Processor | CP343-1 Lean, 6GK7 343-1CX10-0XE0 | Firmware V2.0.x | Two RJ45 ports, integrated 2-port switch |
| STEP 7 (SIMATIC Manager) | STEP 7 V5.4 + SP2 (HSP included) | 5.4.2.0 + Hotfix 7 | PG/PC interface set to TCP/IP(auto) → Intel NIC |
| Operating System | Windows XP SP3 / Windows 7 x86 | — | Setpoint for STEP 7 V5.4 |
The same logic — and therefore the same fix — applies to STEP 7 V5.5, V5.5 + SP1/SP2, V5.5 + SP3, and even to TIA Portal V13/V14/V15 when used in compatibility mode with S7-300 stations, because the underlying PG routing decision is identical.
3. Root Cause Analysis
When Upload Station to PG is invoked, STEP 7 builds an S7 upload frame (function Upload / Pi_Start) and inserts the target Rack / Slot from the active project. If no project exists, STEP 7 defaults to Rack 0, Slot 0, which is not a valid logical address in the S7-300 addressing model:
- Slot 0 of any S7-300 rack is reserved as the backplane identifier; it does not correspond to a physical module.
- Slot 1 is the power supply (PS307 / PS305).
- Slot 2 is the CPU.
- Slot 3 is the Interface Module (IM) if a distributed rack is used.
- Slots 4 to 11 hold signal modules (SM), function modules (FM), and communication processors (CP).
The CP343-1 Lean sees a target slot of 0, treats the request as an invalid configuration query, and refuses to forward it to the CPU. The error message is generated at the CP layer but is logically a wrong address problem at the PG.
By changing the upload target to Rack 0, Slot 2, the PG is told that the destination is the CPU module itself. The CP then routes the frame over the backplane to the CPU, which responds with its full SDBs (System Data Blocks) and blocks. The upload completes.
4. Resolution Procedure
4.1 Prerequisites
- PG/PC interface set to TCP/IP (auto) with the correct wired NIC selected.
- CP343-1 Lean and PG on the same IP subnet (e.g. CP at 192.168.0.10 / 24, PG at 192.168.0.50 / 24).
- Subnet mask matching; no router hops required.
- STEP 7 V5.4 + SP2 with the matching HSP for the CP firmware.
- Read/write password not required for upload, but a CPU password (if any) will block online functions.
4.2 Step-by-Step Fix
- Open SIMATIC Manager and start a new empty project (do not open any existing project).
- In the toolbar, click Options → Set PG/PC Interface. Select TCP/IP (auto) → <your NIC>.
- From the menu, choose PLC → Upload Station to PG (or the toolbar icon). The Target node address / Target station dialog appears.
- Click View to populate the Accessible Nodes list. Verify that the CP343-1 Lean (and therefore the CPU behind it) appears as an S7-CPU entry with its IP and MAC address.
- Select the entry. The default Rack and Slot will show 0 / 0.
- Change Slot from 0 to 2 (Rack remains 0).
- Confirm with OK. STEP 7 will now perform the upload using the proper S7 routing through the CP to the CPU in slot 2.
- When prompted, select the destination project path. STEP 7 reconstructs the S7 program (OB / FB / FC / DB / SDB / SFC / SFB), the symbol table (if uploaded from CPU), and the diagnostic buffer entries.
The process typically completes in 30 seconds to a few minutes, depending on program size and CP throughput. The CP343-1 Lean is rated at 100 Mbit/s full duplex but the S7 protocol is half-duplex; effective throughput is closer to 40–60 Mbit/s for block transfers.
5. Alternative Path: Pre-Configuration with the PST Tool
If the rack/slot workaround cannot be applied (e.g. the PG cannot see the CPU at all), the PST (Primary Setup Tool) can be used to pre-configure the CP343-1 Lean so that it boots with a known IP address and routing behaviour. This is particularly useful for bricked CPs or brand-new replacements that have never been commissioned.
PST parameters relevant to the upload problem:
| Field | Recommended Value | Purpose |
|---|---|---|
| IP address | 192.168.0.10 (or per plant scheme) | Reachable address for the PG |
| Subnet mask | 255.255.255.0 | Match PG subnet |
| Router | 0.0.0.0 (no router) | Local subnet only |
| MAC address enable | Enabled | Allows link-layer discovery |
| Send Keep-alive | 30 s | Maintains active connections |
| PROFINET / PNIO | Disabled (Lean variant) | CP343-1 Lean does not support PNIO |
| S7 routing | Enabled | Required to reach the CPU on slot 2 |
After the PST write, restart the CP (power cycle) and retry the upload with the corrected Rack 0 / Slot 2 settings.
6. Online Block Editing Without a Full Project
If the only goal is to modify a few blocks (e.g. tune a PID parameter, change a setpoint, or patch a bug), a full upload is not required. The minimum procedure is:
- Resolve the rack/slot as described in Section 4 so that the CP allows PG-to-CPU communication.
- From the empty SIMATIC Manager, choose PLC → Display Accessible Nodes. The CPU appears in the right pane.
- Right-click the CPU entry and choose Upload to PG for an individual block, or Monitor/Modify to watch tags live.
- For source-level editing, right-click the online block and choose Download to PG (German: Baustein in PG laden). The block source is reconstructed and editable.
- After modification, write the block back with Download to Target System. The CPU stays in RUN if the change is to a referenced DB or to data only; OB / FB / FC changes force a re-initialisation.
s7imgrd.exe / s7imgrw.exe utility shipped with STEP 7 can dump a complete card image to a file for offline restore.7. Backup Procedure with s7imgrd / s7imgrw
The s7imgrd.exe (Siemens 7 image read) and s7imgrw.exe (Siemens 7 image write) utilities are part of the STEP 7 installation and live in:
C:\Program Files\Siemens\Automation\SIMATIC Manager\S7BIN\s7imgrd.exe
Typical command-line usage from a CMD prompt in the destination folder:
s7imgrd.exe -ip 192.168.0.10 -slot 2 -rack 0 -out backup_2024.bin
This creates a complete binary image of the CPU load memory including the SDBs, blocks, and configuration. The image can later be restored with:
s7imgrw.exe -ip 192.168.0.10 -slot 2 -rack 0 -in backup_2024.bin
Note that the slot argument is mandatory; passing slot 0 produces the same error encountered by the SIMATIC Manager. The -slot 2 switch forces the request to the CPU and bypasses the CP routing check.
8. Verification
After applying the rack/slot correction, verify the fix with the following checks:
- Upload success: a new S7 project is created with the correct station name, CPU order number, and module list.
- Online visibility: PLC → Display Accessible Nodes shows the CPU with RUN or STOP status.
- Diagnostic buffer: open PLC → Diagnostic/Setting → Diagnostic Buffer and confirm no new communication-error entries were generated by the upload.
- Block consistency: cross-check the FC/FB/DB counters between the uploaded project and what the CPU reports in PLC → Module Information → Performance Data.
- Process stability: because the upload is a read operation, the CPU does not transition. Confirm the machine has continued normal operation throughout.
9. Edge Cases and Related Symptoms
| Symptom | Likely Cause | Resolution |
|---|---|---|
| CPU visible in Accessible Nodes but upload blocked with rack/slot 0/0 | Default slot from empty project | Set slot to 2 (this article) |
| CPU not visible in Accessible Nodes | Wrong subnet, firewall, or CP not routing S7 | Verify IP, disable Windows Firewall, enable S7 routing in CP config |
| Visible but upload returns "Connection to partner broken" | CPU in STOP with startup block, or password protected | Reset CPU, or supply password via PLC → Access Rights |
| Upload completes but program is empty | CPU in passive role with no S7 connection partner | Trigger a one-time S7 job from a configured partner |
| Upload stalls at 0% on large projects | CP343-1 Lean has limited PDU size (480 bytes) compared with CP343-1 (960 bytes) | Use smaller block-by-block upload via Online → Blocks view |
| Slot 2 wrong: another module sits in slot 2 (e.g. CPU in slot 3) | Non-standard S7-300 configuration (rare) | Check physical slot of CPU, update Rack/Slot accordingly |
Particular attention must be paid to the PDU size limitation of the CP343-1 Lean. The Lean module negotiates a maximum S7 PDU of 480 bytes, while the standard CP343-1 negotiates 960 bytes. For projects larger than 1 MB this is rarely a problem at upload time but can become a bottleneck for repeated online block streaming.
10. Safety Considerations for 24/7 Production
Uploading a program is a non-destructive read operation. It does not alter the CPU's load memory, work memory, or system memory. The CPU stays in RUN (or STOP) exactly as it was. Nevertheless, observe the following field best practices on a continuously running machine:
- Schedule the upload during a planned micro-pause in machine cycles if a download (write) is to follow.
- Confirm the PG has an updated virus scanner — the S7 protocol on TCP/102 is a known lateral-movement vector in OT networks.
- Disable any HMI write access to the blocks you intend to inspect, to avoid mid-upload inconsistencies.
- Save the binary backup with a timestamp and store it in the plant's historian folder for traceability.
- For safety-related S7-300F stations (CPU315F / CPU317F), the standard CP343-1 is not F-capable; the F-CP must be used. The Lean variant is never F-capable and must not be used in a SIL path.
11. Frequently Asked Questions
Why does STEP 7 default to Rack 0 / Slot 0 when no project is open?
STEP 7 populates the upload dialog from the active project; with no project loaded, the values are placeholders (0/0) that are not valid S7-300 logical addresses. The CPU sits in slot 2, so the PG must be told to address slot 2 explicitly. The CP at slot 4 (or wherever it is mounted) is the router, not the target.
Is an MPI cable required if the CP is unreachable?
Only if you cannot establish any TCP path to the CP. In that case a USB-MPI adapter (PC-Adapter USB, 6ES7 972-0CB20-0XA0) lets you address the CPU directly without going through the CP. The CP's IP must still be corrected (via PST) so that future LAN access works, but the immediate block download can be done over MPI.
Will the upload also retrieve the hardware configuration (HW Config)?
No. STEP 7 Upload Station to PG retrieves the S7 program and the SDBs (system data), but the HW Config diagram is regenerated only as a basic representation. The detailed module parameterisation (e.g. analogue input scaling, digital filter times) may be missing and must be reconstructed manually or pulled from a TIA Portal backup if one exists.
Does the fix apply to TIA Portal as well?
Yes. In TIA Portal V13 and later, the equivalent dialog is Online → Upload from device (software). The same rack/slot concept applies; TIA Portal will usually discover the CPU slot automatically through the S7 connection, but if the upload hangs, switch the destination slot to the CPU's physical slot manually in the upload wizard.
Can the rack/slot parameter be saved permanently so I never have to change it again?
Yes. After the first successful upload, save the recovered project. On every subsequent session open the project first, then Upload Station to PG — STEP 7 will read the correct rack/slot from the project headers and the issue will not reappear. Keep a version-controlled copy in the plant archive to make this fully reproducible.
What if the CPU is in slot 3 or higher because of a custom rack layout?
Inspect the physical rack: the CPU is the module with the mode selector and MMC slot. In a standard S7-300 it is always slot 2 of rack 0. In an ET200M with IM153 it is logical slot 2 inside the station, which STEP 7 maps to 0/2 in the upload dialog. Non-standard layouts (e.g. CPU mounted in slot 4 of a wider rack) are rare and must be entered manually.