S7-1200 to S7-300 Communication via CP343-1 in TIA Portal

Overview

Connecting a SIMATIC S7-1200 to a SIMATIC S7-300 over Ethernet is one of the most common migration and retrofit tasks in the Siemens S7 world. The S7-1200 has an integrated PROFINET interface, so it can be connected directly. The S7-300, however, has no onboard Ethernet port on the classic CPU family (CPU 312, CPU 315, CPU 317, CPU 319); Ethernet is provided by a SIMATIC NET CP 343-1 communication processor in slot 4 (or slot 0–6 of the rack, depending on configuration).

This guide addresses the recurring engineering question: can I use TSEND_C on the S7-1200 with AG_RECV/AG_SEND on the S7-300 CP, or do I have to use PUT/GET? The short answer is that both paths are supported in TIA Portal, but they belong to different communication protocols and have different block libraries, connection-resource limits, and LADDR semantics.

The two practical solutions are:

• Open User Communication (TCP/ISO-on-TCP) via CP: TSEND_C/TRCV_C on the S7-1200 with AG_SEND/AG_RECV (or the newer TCON/TSEND/TRECV) on the S7-300, with the LADDR parameter pointing to the CP module start address.
• S7 Communication (PUT/GET) via the S7 connection: PUT/GET on both controllers. The CP routes the S7 connection in the background; the application blocks run on the CPU and need no LADDR.

Communication Path Selection

Before writing any code, choose the protocol. The selection is driven by data size, cycle time, and existing program structure.

For typical S7-to-S7 data exchange under 400 bytes per job, PUT/GET is the recommended path because the CP routing is transparent and the configuration overhead is minimal. For larger payloads, repeated streaming, or when the S7-300 is the gateway to a non-S7 partner, use TSEND_C with AG_SEND/AG_RECV.

Prerequisites

1. Hardware
   • S7-1200 CPU with integrated PROFINET interface (any 12xx CPU: 1211C, 1212C, 1214C, 1215C, 1217C) on PROFINET X1.
   • S7-300 station with one of: 6GK7 343-1CX00-0XE0 (CP 343-1 Lean), 6GK7 343-1EX10-0XE0 (CP 343-1), or 6GK7 343-1GX20-0XE0 (CP 343-1 Advanced). The CP must be inserted in slot 4 of the S7-300 rack (slot 0–6 are valid; slot 4 is conventional).
   • Ethernet switch or direct patch cable between the S7-1200 PROFINET port and the CP 343-1 RJ45 port.
2. Software
   • TIA Portal V13 SP1 (minimum). For newer CP 343-1 firmware revisions, install the matching HSP under Options > Support Packages.
   • Project with both stations configured: S7-1200 (controller) and S7-300 (controller) with the CP 343-1 inserted in the device configuration.
3. Network
   • IP addresses in the same subnet, e.g. S7-1200 = 192.168.0.10 / 24, S7-300 CP = 192.168.0.20 / 24.
   • No firewall on engineering PG that blocks TCP ports 102 (S7) or 2000/2001 (ISO-on-TCP/TSEND_C default).

CP 343-1 Variants and Connection Resources

Connection resources are the limiting factor on the S7-300 side. The number of parallel S7 / open user communication connections depends on the CP variant.

For project planning, total S7 connections on the S7-300 station equal the sum of connections used by the CP 343-1 plus any connections that terminate on the CPU. Most S7-300 CPUs reserve a small number of S7 connection resources internally (typically 0 for classic S7-300 CPUs – connections to the CPU are routed through the CP). Check the CPU's "Communication" tab in the device properties for the precise number reserved for OP/PG/other S7 CPU connections.

S7-1200 Connection Resources

The S7-1200 has a fixed pool of connection resources. The exact split depends on CPU model and firmware. In TIA Portal, open the S7-1200 device configuration and select the CPU; the connection resources are listed in the inspector window under Properties > Communication. The Siemens TIA Portal documentation describes the display of S7-1200 connection resources.

Block Library Requirements

On the S7-1200 side, the relevant blocks live in the standard Program blocks > Communications palette of TIA Portal: PUT, GET, TSEND_C, TRCV_C, TCON, TDISCON.

On the S7-300 side the picture is split:

• S7 communication (PUT/GET): blocks FB14 "PUT" and FB15 "GET" are in the standard library under Standard Library > Communication Blocks (or in TIA Portal under Communication > S7 Communication). They run on the CPU and do not require the CP block library.
• Open user communication via CP: blocks FC5 "AG_SEND", FC6 "AG_RECV", FC10 "AG_LOCK", FC11 "AG_UNLOCK" are in the SIMATIC_NET_CP library. If the library is not visible in TIA Portal, the S7-300 station may not contain a configured CP, or the CP HSP is missing.

Siemens publishes the related engineering guidance in the Industry Online Support FAQ entry ID 18610307, which describes S7 communication between S7-1200 and S7-300/400 and lists compatible blocks and CP variants.

Configuring TSEND_C on the S7-1200

TSEND_C is an integrated instruction that handles connection establishment, sending, and disconnection. It is part of the open user communication set and works on the S7-1200 PROFINET interface without any CP. The connection target is referenced by a connection description in the project (Devices & Networks > Connections), which is generated when you call the instruction for the first time and click the wizard link.

Typical input parameter values for an S7-1200 → S7-300 (CP 343-1) call:

When the wizard creates the TCON_IP_V4 data block, set the partner (S7-300 CP) IP address, the partner port (default 2000 for ISO-on-TCP), and the connection ID. The connection ID is local to the S7-1200 station and must be unique across all open user communication connections on this CPU.

Configuring AG_SEND / AG_RECV on the S7-300

On the S7-300 side, when the S7-1200 initiates a TSEND_C transfer over TCP/ISO-on-TCP, the CP 343-1 receives the data through its ISO-on-TCP protocol engine and makes the payload available to the user program via AG_RECV. The CP expects an active "receive job" to be permanently scheduled.

To send data back to the S7-1200, the S7-300 program calls AG_SEND with a destination that matches the established connection. The CP's connection database is created by the partner's TSEND_C/TCON call at runtime, so the S7-300 must use the same connection ID as the S7-1200 in the case of TSEND_C, or an ID assigned in NetPro / "Devices & Networks" if a static ISO-on-TCP connection was configured.

Determining the LADDR Parameter

The LADDR input is the most common source of confusion. It is not the IP address and not the slot number; it is the logical I/O base address assigned to the CP in the S7-300 station's hardware configuration.

1. Open the S7-300 station in the project tree and double-click Device configuration.
2. Click on the CP 343-1 module in the rack graphic.
3. In the inspector window, expand Properties > General > I/O addresses.
4. Read the Input start address and Output start address. The values are in bytes, decimal. Default for slot 4 is often 256 (decimal, 0x100 hex) or 272 (decimal, 0x110 hex) depending on the CP version and TIA Portal project settings.
5. Enter that decimal value in the LADDR input of AG_SEND and AG_RECV as a WORD.

// Example call – S7-300 STL
CALL  FC6   // AG_RECV
  ID     := W#16#1            // connection ID 1 (matches S7-1200 TSEND_C CONNECT.ID)
  LADDR  := W#16#100          // CP start address 256 decimal
  RECV   := P#DB20.DBX0.0 BYTE 100
  NDR    := M10.0
  ERROR  := M10.1
  STATUS := MW12
  LEN    := MW14

If LADDR is wrong, the CP returns status 0xE002 (CP not reachable / wrong address) or 0xE080 (no diagnosis entry). Always verify against the value shown in the HW config, not against the slot number.

Connection ID and TSAP Management

Each communication relationship uses two connection IDs – one local to each partner – and one or more TSAP identifiers. Confusing the two is a frequent cause of error 0x8082 ("Connection already in use") or 0x8083 ("No connection available").

• S7 communication (PUT/GET): one S7 connection is configured in Devices & Networks > Connections. The local connection ID is assigned automatically; it is visible in the connection's properties. PUT / GET reference this ID via the ID input. The S7-1200 connection ID and the S7-300 connection ID are independent – they do not have to match.
• TSEND_C / AG_SEND/AG_RECV: the connection is dynamic. The connection ID is set in the TCON_IP_V4 data block on the S7-1200 side and must be passed to AG_SEND / AG_RECV on the S7-300 side so that the CP can associate the runtime connection with the user job.

TSAP format for ISO-on-TCP follows the pattern xx.yy where xx is the rack/slot encoded in hex and yy is a sub-slot. For an S7-300 CP 343-1 in rack 0 slot 4, a valid local TSAP is 01.04 (rack 0 + slot 4). The S7-1200 partner TSAP can be left at default 00.00 unless required by the network configuration.

PUT / GET Path (S7 Communication)

If the goal is simple register or DB exchange with a payload under 400 bytes per call, use PUT/GET on both controllers. This is the path of least resistance.

1. In Devices & Networks, draw a line between the S7-1200 PROFINET interface and the CP 343-1. The connection wizard will offer S7 connection as a possible type.
2. On the S7-300 side, the local ID is auto-assigned; leave the CP as the endpoint.
3. On the S7-1200 side, in Program blocks, insert a PUT instruction. Wire REQ to a trigger, ID to the local S7 connection ID, ADDR_1 to the S7-300 DB, and SD_1 to the local DB.
4. Insert GET for the reverse direction with RD_1 pointing to the local receive DB.

// S7-1200 PUT call – SCL
"PUT_DB"(REQ := bStart,
         ID  := 16#0001,                   // local S7 connection ID
         DONE=>bDone, ERROR=>bErr, STATUS=>wStatus);
ADDR_1 := P#DB200.DBX0.0 BYTE 20;        // S7-300 remote DB200, 20 bytes
SD_1   := P#DB100.DBX0.0 BYTE 20;        // S7-1200 local DB100, 20 bytes

For the S7-300 side, drag FB14 "PUT" and FB15 "GET" from Communication Blocks into a DB, create an instance DB, and call them with the S7 connection ID shown in Devices & Networks > Connections. The S7-300 instance DB must be present in the CPU at runtime; PUT/GET on S7-300 cannot access an undefined DB.

Step-by-Step: TSEND_C + AG_SEND / AG_RECV Configuration

1. Wire the network. Connect the S7-1200 PROFINET X1 and the CP 343-1 RJ45 to the same switch or with a patch cable.
2. Assign IP addresses. S7-1200 = 192.168.0.10 / 24; CP 343-1 = 192.168.0.20 / 24. Disable any router setting on the S7-1200 PROFINET interface (use subnet directly).
3. Configure the CP 343-1 in HW config. Open the S7-300 station, double-click the CP 343-1, and set the IP, subnet mask, and (optionally) the connection type. Note the I/O start address from I/O addresses.
4. Insert the TSEND_C block on the S7-1200. Add a new FB or use OB1. Insert TSEND_C; click on the Connection description link to open the wizard. Pick the S7-300 CP 343-1 as the partner. Choose ISO-on-TCP, set the partner port 2000, and finish the wizard. TIA Portal generates the TCON_IP_V4 data block.
5. Insert AG_RECV on the S7-300. In the S7-300 program, drag FC6 "AG_RECV" from the SIMATIC_NET_CP library. Set ID to the connection ID used in step 4, LADDR to the CP start address, and RECV to a receive DB of sufficient size. Leave AG_RECV permanently scheduled (call it cyclically in OB1).
6. Insert AG_SEND on the S7-300 for the reverse direction. Call FC5 "AG_SEND" with the same ID and LADDR; point SEND to a DB of payload data and trigger with a rising edge on ACT.
7. Configure PUT/GET permission on the S7-300. If the S7-300 also needs to use PUT/GET, open the CPU properties > Communication and tick Permit access via PUT/GET communication partner. Without this, the CPU will reject partner requests from the S7-1200.
8. Compile and download. Compile the S7-300 station first, then the S7-1200. Download both. Bring the S7-300 to RUN with the CP initialized, then run the S7-1200.
9. Monitor. Use the S7-1200's Watch table to monitor the send/receive DBs and the TSEND_C outputs. Use the S7-300's Monitor/Modify to inspect the AG_SEND/AG_RECV status words.

Verification and Diagnostics

Use these checks to confirm a working link.

1. LEDs on the CP 343-1: the "LINK" LED should be solid green; the "RX/TX" LED should flicker when data is exchanged. No LED activity points to a physical layer issue or wrong port.
2. Online & Diagnostics on the CP 343-1: in TIA Portal select the S7-300 station, right-click the CP 343-1, choose Online & Diagnostics > Diagnostics. Look for the partner IP and the established connection. The "Status of connections" tab shows the number of active connections and their state.
3. Connection status on the S7-1200: open Online & Diagnostics > Connections on the S7-1200. The connection should show state Established; status word = 0.
4. Watch tables: write a test pattern into the S7-1200 send DB and check whether it appears in the S7-300 receive DB within the configured send/receive cycle. Repeat for the reverse direction.
5. Trace with status codes: capture the STATUS output of TSEND_C and AG_SEND / AG_RECV in the watch table and compare against the diagnostic table below.

Troubleshooting Matrix

Field-Proven Caveats

• CP 343-1 Lean as S7-300 active partner is impossible for S7 communication. Use a Standard or Advanced CP if the S7-300 must initiate an S7 connection, or reverse the direction (S7-1200 active, S7-300 passive).
• AG_SEND/AG_RECV must be called cyclically with a positive edge only on ACT. Forgetting to call AG_RECV results in the CP discarding incoming data.
• Connection resource numbers are total, not per block. Each configured S7 connection in Devices & Networks consumes one resource from the S7-1200 pool, even if the program never calls PUT/GET.
• The S7-1200 PROFINET interface is shared with PROFINET IO. If the CPU is also a PROFINET IO controller with many devices, the load on the interface may delay open user communication. Move to a CP 1242-7 or external switch if communication jitter becomes an issue.
• TSAP on ISO-on-TCP must be unique per CP. Two ISO-on-TCP connections from two S7-1200 stations to the same CP 343-1 with identical TSAPs will conflict.