Resolving S7 Connection Errors: CP343-1 Lean to CP243-1 IT

Problem Statement and Symptom Matrix

When configuring an S7 connection from a SIMATIC S7-300 station (CPU 315-2DP, 6ES7315-2AF02-0AB0 or equivalent) equipped with a CP 343-1 Lean to a SIMATIC S7-200 station (CPU 226, 6ES7216-2BD23-0XB0) equipped with a CP 243-1 IT over Industrial Ethernet, the engineering tool (STEP 7 V5.x NetPro or TIA Portal "Devices & Networks" view) refuses to commit the configuration. The dialog for selecting an "unspecified" S7 partner or for typing a remote TSAP/IP is grayed out, and the consistency check returns an error similar to the following:

Error: S7 connection cannot be created
The selected CP (CP 343-1 Lean) does not support S7 client functions
Affected object: S7 connection_1
Check the CP type and connection role assignment

Engineers frequently interpret this as a configuration error and attempt to re-enter the partner IP, re-define the TSAP, or uninstall/reinstall the CP in HW Config. None of these actions resolve the issue because the root cause is a hardware/firmware capability gap of the CP 343-1 Lean: in its stock firmware it cannot terminate a S7 connection as a client (initiator); it can only act as an S7 server (responder). Since the S7-200 side with CP 243-1 IT is also a server-only device in most field deployments, no client exists and the S7 PUT/GET exchange cannot be initiated.

The following symptom matrix summarizes the failure modes that point to this root cause:

Root Cause: CP 343-1 Lean Communication Firmware Capabilities

The CP 343-1 Lean is a stripped-down Industrial Ethernet CP that intentionally omits the S7 client and PROFINET IO controller features of the full CP 343-1 to reduce cost. The product documentation states the following communication relationships supported by the CP 343-1 Lean in its baseline firmware (V1.x and V2.x):

• S7 server connections (PUT/GET, FETCH/WRITE) — up to 4/8/16 depending on the firmware version
• PG/OP communication (routing, online functions)
• UDP frame transmission (AG_SEND/AG_RECV via TCON, TSEND/TRCV in newer firmware)
• FETCH/WRITE as server (legacy, optional)
• No S7 client function, no PROFINET IO controller, no open IE communication on early firmware

To act as a S7 client (i.e. to initiate PUT/GET to the S7-200), the CP 343-1 Lean must either be replaced with a full CP 343-1 (order numbers 6GK7343-1GX30-0XE0 or 6GK7343-1EX30-0XE0) or have its firmware updated to a version that re-enables S7 client support. The same applies if PROFINET IO controller is required. The CPU 315-2DP integrated MPI/DP interface cannot be used for Ethernet S7 connections and therefore cannot be used as a fallback.

Affected Hardware and Ordering Data

The following Siemens order numbers are relevant to this troubleshooting case. Verify the exact MLFB (machine-readable product designation) printed on the front of the device, the module label inside the front door, and the order number reported by STEP 7/TIA Portal under Module Information > Order Number:

The diagnostic procedure to confirm the local CP type is:

1. In SIMATIC Manager, open the S7-300 station in HW Config.
2. Double-click the CP 343-1 in the rack.
3. Note the order number in the dialog title bar and on the Identification tab.
4. Open the Diagnostics tab and read the firmware version (e.g. V2.6.7).
5. Cross-check against the capability table in the next section.

CP 343-1 Lean Firmware History and Capability Matrix

Siemens has updated the CP 343-1 Lean firmware several times since 2003. The relevant S7 client capability changes are summarized below. The values reference the official Siemens product manual CP 343-1 Lean / CP 343-1 in the Siemens Industry Online Support portal (entry ID 24485275) and the firmware release notes shipped with each firmware update.

Solution Path A: Upgrade the Local CP to CP 343-1 (GX30 or EX30)

The cleanest fix is to replace the CP 343-1 Lean with a full CP 343-1. The full CP 343-1 is available in two variants:

• 6GK7343-1GX30-0XE0 — Ethernet only, full S7 client/server, no PROFINET IO controller. Sufficient for S7-200 to S7-300 S7 connection.
• 6GK7343-1EX30-0XE0 — Ethernet + PROFINET IO controller. Use this if the same CP is also required to operate a PROFINET IO line.

Procedure:

1. Order the new CP (MLFB 6GK7343-1GX30-0XE0 or 6GK7343-1EX30-0XE0) per Siemens Industry Mall catalog.
2. Power down the S7-300 station, remove the CP 343-1 Lean from the rack, and install the new CP 343-1 in the same slot. The CP 343-1 occupies a single slot in the S7-300 rack (slot 4–11); the slot number must be the same as in HW Config to avoid reconfiguration.
3. In HW Config, delete the old CP 343-1 Lean from the rack and drag the new CP 343-1 from the hardware catalog (path: SIMATIC 300 > CP 300 > Industrial Ethernet > CP 343-1 > 6GK7343-1GX30 / 6GK7343-1EX30).
4. Assign the same IP address and subnet mask as the previous Lean CP. The MAC address will change; if MAC-based port security is enforced on the switches, update the switch configuration.
5. Save and compile HW Config; download to the CPU.
6. In NetPro, re-create the S7 connection. The dialog will now allow selection of an unspecified S7 partner and PUT/GET will be permitted.

Solution Path B: Use PROFIBUS DP with the EM 277

If a PROFIBUS cable is already installed between the two stations, the EM 277 (order number 6ES7277-0AA22-0XA0) provides a robust alternative. The S7-200 station becomes a PROFIBUS DP slave, the S7-300 CPU 315-2DP acts as a PROFIBUS DP master via its integrated DP port, and data exchange is performed by the well-known DP_V0 mechanism (cyclic I/O, no PUT/GET required).

Hardware setup:

1. Insert the EM 277 in the S7-200 expansion rack. The EM 277 occupies an I/O expansion slot adjacent to the CPU 226 (slot 0 is the CPU itself; the EM 277 may be slot 1–7).
2. Set the PROFIBUS address of the EM 277 with the rotary switches on the module front. Valid range: 1–99, default 1.
3. Connect the PROFIBUS cable to the 9-pin D-sub connector of the EM 277. Ensure termination is on at both cable ends (typically the CPU 315-2DP integrated DP port and the last DP device).
4. Set the integrated DP port of the CPU 315-2DP to "DP master" mode and assign a unique master PROFIBUS address (e.g. 2).

STEP 7 HW Config steps (S7-300 side):

1. Open the S7-300 station in HW Config.
2. Double-click the integrated DP port of the CPU 315-2DP and select DP master as the operating mode.
3. From the hardware catalog, navigate to PROFIBUS DP > Stations > SIMATIC S7-200 > EM 277 PROFIBUS-DP and drag the slave onto the DP master system.
4. Set the PROFIBUS address of the EM 277 slave to match the rotary switch setting (e.g. 1).
5. Insert a slot in the EM 277 slave and choose the I/O configuration. The EM 277 supports several I/O sizes; for a typical S7-200 to S7-300 exchange, select the variant that provides the required number of input/output bytes (e.g. 32 bytes input / 32 bytes output). Available sizes: 1 word I + 1 word O, 8 words I + 8 words O, 16 words I + 16 words O, 32 words I + 32 words O.
6. Note the I and Q addresses assigned to the EM 277 slave by STEP 7. These addresses are mapped to the V memory of the S7-200 CPU 226 in the EM 277 setup switch positions (see S7-200 System Manual, Appendix A).

Micro/WIN setup (S7-200 side):

1. Open STEP 7 Micro/WIN and the S7-200 project.
2. The EM 277 uses the V memory of the CPU 226 for data exchange. The address mapping is defined by the EM 277 mode switch (position 0–7); the typical mapping for 16 words I + 16 words O is V memory range VW0–VW31 (input) and VW32–VW63 (output). Refer to the Siemens S7-200 System Manual (entry ID 1109582) for the exact mapping table.
3. Write the data to be exchanged into the corresponding V memory area in the S7-200 user program. The DP master will read/write these locations cyclically.

S7-300 program (DP master):

1. The integrated DP port of the CPU 315-2DP does not require additional FB/FC calls. Data is exchanged automatically; the I/Q addresses assigned in HW Config are read/written by the user program with normal L PIB / T PQB instructions.
2. If a CP 342-5 is used as DP master (e.g. for diagnostic routing), the program must call FC1 (DP_SEND) and FC2 (DP_RECV) from the standard library "SIMATIC_NET_CP" with the LADDR parameter set to the logical base address of the CP 342-5.

// Read 32 bytes from S7-200 EM 277 (input area starts at I 100)
L  PIB 100        // byte 0 from S7-200
T  MB 200         // store in flag byte
L  PIB 131        // byte 31 from S7-200
T  MB 231

// Write 32 bytes to S7-200 EM 277 (output area starts at Q 100)
L  MB 100         // flag byte to send
T  PQB 100        // write to output byte 0
L  MB 131         // flag byte to send
T  PQB 131        // write to output byte 31

STEP 7 and Micro/WIN Configuration Procedures

This section consolidates the configuration steps for both the Ethernet and PROFIBUS paths.

Ethernet Path: NetPro S7 Connection Setup

After upgrading to CP 343-1 (GX30/EX30), the S7 connection can be configured as follows. This procedure assumes STEP 7 V5.5; TIA Portal V14+ uses a similar wizard but the field names differ.

1. Open the S7-300 project in SIMATIC Manager.
2. Select the S7-300 station, then double-click NetPro in the right-hand pane (or use the menu Options > NetPro).
3. In the network view, the S7-300 station appears with the CP 343-1 (GX30/EX30). Right-click the CP and select Insert New Connection.
4. In the Insert New Connection dialog, choose connection type S7 connection.
5. In the partner selection, click Unspecified. (This option is enabled only when the local CP supports the S7 client function.)
6. Click Add and confirm the connection properties dialog.
7. In the Properties > General tab, set the partner IP address (e.g. 192.168.0.20 — the IP of the S7-200 station with CP 243-1 IT).
8. In the Properties > Address Details tab, set the local TSAP (e.g. 10.01) and partner TSAP (e.g. 10.01 for connection 0 of CP 243-1 IT; 10.02 for connection 1, etc.). The TSAP for the CP 243-1 IT follows the format 10.NN where NN is the connection number 0–7 (1–8 in the wizard display). Note: For the S7-300 CP 343-1, the local TSAP is 10.NN where NN is the local connection ID, or any TSAP starting with 01., 02., 10., or 11. (rack/slot).
9. Save and compile the project (menu Network > Save and Compile). STEP 7 will issue a warning if the partner S7-200 project is not in the same project; this is expected. To work around it, either include the S7-200 station in the same STEP 7 project as a "non-S7 station" placeholder, or accept the warning.
10. Download the connection configuration to the S7-300 CPU (right-click the CPU > Download).

Ethernet Path: CP 243-1 IT Wizard in Micro/WIN

The CP 243-1 IT is configured with the Ethernet Wizard in STEP 7 Micro/WIN. The wizard generates data blocks and subroutines that the S7-200 program must call. Procedure:

1. Open the S7-200 project in STEP 7 Micro/WIN (V4.0 SP9 or later recommended; the CP 243-1 IT wizard is included in the SP5+ service pack).
2. From the menu, select Tools > Ethernet Wizard.
3. In step 1, set the module position (the slot where the CP 243-1 IT is installed in the S7-200 expansion rack; typically position 0 or 1).
4. In step 2, set the IP address, subnet mask, and gateway for the CP 243-1 IT. Default IP 0.0.0.0 is set when no IP is configured. The default after first power-up is 0.0.0.0; the project IP is applied after the next download.
5. In step 3, configure the number of S7 connections. The CP 243-1 IT supports up to 8 S7 connections (1 server + 7 client, or 8 server, depending on the firmware). Enable at least 1 S7 connection as a server with TSAP 10.01 (connection 0).
6. In step 4, configure the S7 connection peer (for each connection, the TSAP and optionally the IP of the partner). The partner IP is optional for server connections; the S7 client must reach the server by IP.
7. In step 5, configure the byte buffer sizes (default 240 bytes per transfer for S7-200 PUT/GET; the CP 243-1 IT limits a single transfer to 212 bytes of user data due to the ISO Transport header).
8. Click Finish; the wizard creates a data block (typically ETH0_S7CB or similar) and several subroutines. The names of the subroutines depend on the wizard version: ETHx_CTRL, ETHx_XMIT, ETHx_XRCV, ETHx_XGET, ETHx_XPUT, ETH0_INT (interrupt handler, optional).
9. Insert the wizard-generated subroutines into the main program (or into an OB). At minimum, ETHx_CTRL must be called once per scan to manage the CP state machine.
10. Compile and download to the S7-200 CPU.

S7-300 PUT/GET Programming

Once the S7 connection is established in NetPro, the S7-300 program can use the system function blocks SFB14 (GET) and SFB15 (PUT) to exchange data with the S7-200 V memory. The instance DB is assigned automatically by NetPro (e.g. DB100 for connection ID 1).

Sample program — S7-300 side, STEP 7 V5.x STL:

// OB1, cyclic
// Call SFB14 (GET) to read 16 bytes from S7-200 (connection ID 1, instance DB 100)
CALL   SFB  14
       REQ   :=M10.0
       ID    :=W#16#1              // connection ID from NetPro
       NDR   :=M10.1
       ERROR :=M10.2
       STATUS:=MW12
       ADDR_1:=P#V 0.0 BYTE 16     // S7-200 partner: V memory, 16 bytes from V0
       RD_1  :=P#DB200.DBX0.0 BYTE 16  // S7-300: store in DB200

// Call SFB15 (PUT) to write 16 bytes to S7-200
CALL   SFB  15
       REQ   :=M10.3
       ID    :=W#16#1
       DONE  :=M10.4
       ERROR :=M10.5
       STATUS:=MW16
       ADDR_1:=P#V 0.0 BYTE 16     // S7-200 partner: V memory, 16 bytes from V0
       SD_1  :=P#DB201.DBX0.0 BYTE 16  // S7-300: source data in DB201

If TIA Portal is used, the equivalent function blocks are:

• PUT: instruction in the "Communication" palette > "S7 Communication" > "PUT"
• GET: instruction in the "Communication" palette > "S7 Communication" > "GET"
• Connection ID: must match the connection configured in "Devices & Networks" > "S7 connection_1"

Verification and Diagnostics

After the S7 connection is configured and downloaded, verify the link using the following tools:

1. Online > Accessible Nodes in STEP 7 V5.x. Confirm that the S7-200 station with CP 243-1 IT is visible at the configured IP address. The S7-200 should report its order number (e.g. "CPU 226") and CP order number (e.g. "CP 243-1 IT").
2. Right-click CP 343-1 > Connection Overview > Status in NetPro. The connection should be reported as Established. If the status is Not established, double-click the connection row for diagnostic details.
3. CP 343-1 online diagnostics: PLC > Module Information > Diagnostic Buffer on the CP. Look for entries of type Connection established or Connection terminated by partner with a detailed reason. Typical error codes:
   • 0x0001 — partner not reachable (IP / subnet mismatch)
   • 0x000A — partner TSAP not configured (wizard not run on S7-200)
   • 0x001E — object does not exist (S7-200 V memory range out of bounds)
   • 0x8082 — local resource error (CP firmware outdated, or S7 connection count exhausted)
4. S7-300 STATUS word on SFB14/SFB15: if STATUS = 0 after a successful transfer, the exchange is working. STATUS = 0x001E points to a S7-200 addressing error.
5. Wireshark / S7 comm trace: capture the TCP port 102 (ISO-TSAP) traffic on the Ethernet segment. The S7 communication should show TPKT/COTP frames between the two IP addresses. If only SYN attempts are seen, the S7-200 CP is not responding (TSAP mismatch, CP not in RUN, IP conflict).

For the PROFIBUS path, verify with:

1. PLC > Module Information > Diagnostic Buffer on the CPU 315-2DP. Look for DP bus errors or slave diagnostics.
2. Right-click DP master system > Monitor/Modify in HW Config. Inspect the I and Q addresses of the EM 277 slave; the values should change when the S7-200 program writes to V memory.
3. On the S7-200 side, the EM 277 LED behavior: SF (red) off = no fault, BF (red) flashing = bus fault (no PROFIBUS communication), BF (red) solid = slave address conflict or wiring error.

Troubleshooting Matrix and Field Caveats

Additional field-proven caveats:

• CP 243-1 IT firmware bug (V1.0 – V1.5): Early CP 243-1 IT firmware occasionally drops established S7 connections after a power cycle. Update to V2.0+ if you observe this.
• S7-200 V memory atomicity: SFB14/SFB15 transfers are not atomic across the entire byte range; if the S7-200 user program writes to V memory during a transfer, the S7-300 may read a mix of old and new bytes. Use a double-buffering scheme (write to a staging V area, then swap pointers in a single scan) if this is a concern.
• CP 343-1 Lean vs. CP 343-1 Lean "PN": Do not confuse the "CP 343-1 Lean" with the "CP 343-1 Lean PN" (no PN variant exists in the catalog, but the catalog label may be truncated). The PN-capable variant is the CP 343-1 EX30.
• S7-200 and TIA Portal: TIA Portal does not support programming the S7-200 CPU 226. Use STEP 7 Micro/WIN (V4.0 SP9 is the last officially supported version). For TIA Portal, the S7-200 is treated as an "unspecified partner" with a manual IP and TSAP entry.
• PG/OP routing through CP 343-1: If the S7-200 is to be programmed via the S7-300 station (i.e. the S7-300 is a router for the PG), the S7-300 must have a routing-enabled S7 connection. Enable "Enable router" in the S7 connection properties.
• PROFIBUS cycle time at 1.5 Mbps with 32-byte I/O: Approx. 1.5 ms per slave at 1.5 Mbps with 32 bytes I/O; at 12 Mbps this drops to ~0.2 ms. S7-200 scan time is not affected by PROFIBUS as the EM 277 handles the protocol autonomously.

Frequently Asked Questions