S7-300 CP340 RS232 Setup for IKA LR 1000 in TIA Portal V13

Overview

The IKA LR 1000 laboratory reactor exposes only a serial RS232 port for supervisory control, and ships with no analog, PROFIBUS, or PROFINET interface. Integrating it into a SIMATIC S7-300 line driven by an S7-315-2 PN/DP requires a point-to-point module in the central rack, an RS232 cable wired for hardware flow control, and the ASCII protocol driver on the CP340. The IKA LR 1000 "basic_control" operating manual documents the serial command set and the cable diagram on pages 17, 18, and 19. Pages 17-18 list the command names and argument formats; page 19 defines the five-conductor pinout (TxD, RxD, GND, RTS, CTS) that the cable must implement.

This reference covers the full integration path: hardware selection between the CP340, CP341, and CM PtP families, the RS232 DTE/DCE and null-modem wiring decisions, the ASCII protocol parameter set, the TIA Portal V13 hardware configuration, and the function-block code that drives the module from a cyclic OB. The same workflow ports to an S7-1200 or S7-1500 with a different communications module, but the IKA command set and the framing parameters remain unchanged.

Prerequisites

• Siemens S7-300 CPU with a free single-wide slot in the central rack. The reference build uses a 6ES7 315-2EH14-0AB0 (S7-315-2 PN/DP, firmware V3.3).
• CP340 RS232 module, order number 6ES7 340-1AH02-0AE0, firmware V2.x or later.
• TIA Portal V13 Update 6 or later (V13 SP1 Update 4 recommended) with the S7-300 hardware support packages (HSP) installed for the CPU and CP340 firmware revision in use.
• IKA LR 1000 "basic_control" operating manual shipped with the unit. Confirm the document edition; pages 17-19 cover the serial command set and the cable diagram.
• Null-modem RS232 cable wired with five conductors (TxD, RxD, GND, RTS, CTS) per the IKA pinout, terminated in a male DB9 connector on the CP340 side.
• 24 V DC supply for the S7-300 rack; the CP340 is powered through the backplane bus and draws approximately 100 mA at 5 V.
• One free logical address range in the CPU (the CP340 occupies 16 bytes of I/O by default, starting at the next free address after the last SM).

Hardware Selection: S7-300 Point-to-Point Modules

Three Siemens module families can carry the RS232 link to the IKA LR 1000. The correct choice depends on the number of free slots, the protocols expected over the life of the line, and the trade-off between a central module and a distributed I/O station.

The CP340 RS232 (6ES7 340-1AH02-0AE0) is the correct primary choice for the IKA LR 1000. It plugs into a single S7-300 slot, supports the ASCII protocol needed for the IKA command set, and is fully integrated into the TIA Portal V13 device library. The CP341 RS232 is the drop-in upgrade if a Modbus master or 3964(R) framing is required by other equipment in the line. The CM PtP RS232 BA and HF modules are designed for ET 200SP distributed I/O stations and are not plug-compatible with the S7-300 central rack; they appear in the Siemens TIA Portal V20 documentation set covering USS communication on S7-300/S7-400 as PROFINET-attached alternatives when the central rack is full. An Ethernet-to-RS232 gateway (for example, a Moxa NPort 5110 or a Siemens SCALANCE M-800 with serial tunnel) is a fourth route; it converts the IKA protocol to TCP, so the application code is rewritten in TSEND/TRCV rather than P_SEND/P_RCV.

Why ASCII, Not 3964(R)

3964(R) is a Siemens-proprietary framing protocol that wraps a transparent payload between control characters (STX, DLE, ETX, BCC) and adds an acknowledgment handshake on the link layer. The IKA LR 1000 does not implement 3964(R) — it speaks raw ASCII terminated by a carriage return and/or line feed. The CP340's ASCII mode allows the application to define the start delimiter, end delimiter, and the receive-line idle time, which is exactly what is required to delimit the IKA response frames. Configure the CP340 in ASCII mode and leave the 3964(R) driver unloaded.

RS232 Fundamentals, DTE/DCE, and the Null-Modem Decision

RS232 (EIA/TIA-574) is a single-ended point-to-point standard with voltage levels of ±3 V to ±15 V on the data and control lines. Two equipment roles are defined:

• DTE (Data Terminal Equipment) — typically a computer, terminal, or PLC. Generates TxD and RTS.
• DCE (Data Communications Equipment) — typically a modem. Generates TxD and CTS in response to the DTE's RTS.

Both the S7-300 CP340 RS232 port and the IKA LR 1000 serial port are wired as DTE (Pin 2 = RXD, Pin 3 = TXD, Pin 7 = RTS, Pin 8 = CTS). When two DTE devices are connected without an intervening DCE modem, the cable must cross TxD/RxD and RTS/CTS in both directions. This wiring is called a null-modem cable. A straight-through cable between two DTE ports will produce a silent link with no character exchange — the most common commissioning fault on a first RS232 integration.

RS232 Cable and Pinout for the IKA LR 1000

The IKA LR 1000 "basic_control" operating manual specifies a five-wire null-modem cable: TxD, RxD, signal ground, RTS, and CTS. This is not a three-wire "TX/RX/GND only" cable — the IKA reactor asserts hardware flow control on its serial port, and a missing CTS line will cause the CP340 to flag a STATUS = 80B2 error on every send attempt.

Use shielded cable such as Belden 9940 (24 AWG, five conductors plus drain) or Lapp ETHERLINE RS232. Bond the shield to ground at the cabinet entry only — do not bond at both ends, or a 50/60 Hz ground loop will inject noise on the receive line. Maximum RS232 cable length is 15 m at 9600 baud per the EIA/TIA-574 specification; reduce to 7-8 m at 38400 baud and below 3 m at 115200 baud. The IKA LR 1000 does not support baud rates above 38400 in the "basic_control" firmware revision, so the 15 m budget is the practical limit for this integration.

Communication Parameters and ASCII Protocol

The IKA LR 1000 default serial parameters are 9600 baud, 8 data bits, no parity, 1 stop bit, with hardware flow control on the RTS/CTS pair. These values must match on the CP340 port and the IKA device. The IKA menu path for serial configuration is documented in the operating manual — refer to the device display menu of the LR 1000 "basic_control" model for the parameter location.

The CP340 ASCII protocol distinguishes between two frame-end conditions: an explicit delimiter character or an idle-line timeout. The IKA LR 1000 response frames end with CRLF, so configuring the CP340 with the end-of-frame delimiter set to 0x0D gives the cleanest boundary detection. The 40 ms idle-line time is a safety net — if a single IKA response is split across two receive buffer events, the CP340 will release the first buffer at the 40 ms idle mark and start a new buffer for the remainder.

ASCII vs 3964(R) Framing — Why the Choice Matters

The CP340 offers two protocol drivers in the device view: ASCII and 3964(R). The 3964(R) driver adds a Siemens-specific link-layer frame around the user payload:

• Sender raises RTS, waits for CTS, transmits STX, waits for DLE, transmits payload, transmits DLE+ETX, transmits BCC, waits for DLE (ack) or NAK (nack).
• Each byte is wrapped; the receiver strips the control characters and returns the payload to the application.

The IKA LR 1000 does not implement this handshake. If 3964(R) is selected by accident, the IKA will see STX (0x02) as the first byte of the command and reject the frame, returning either no response or an error. Switch the protocol back to ASCII and the link comes up. The CP340 also offers 3964R (with repeat) for noisy links, but the same IKA-side limitation applies.

TIA Portal V13 Hardware Configuration

1. Open the TIA Portal V13 project containing the S7-315-2 PN/DP station.
2. In the project tree, expand Devices & Networks and double-click Device view on the S7-300 station.
3. Identify the slot for the CP340. The S7-300 slot numbering rule places the CPU in slot 2, the optional IM in slot 3, signal modules in slots 4-11, and additional CPs in slots 4-11. CP340 occupies one slot.
4. From the hardware catalog, navigate to PLC → SIMATIC S7-300 → Communication → CP340 and drag the CP340 RS232 (6ES7 340-1AH02-0AE0) into the empty slot.
5. Double-click the CP340 to open its properties. Note the logical base address — TIA Portal will assign the next free address after the last SM (typically 256 or 272). Record this value; it becomes the LADDR input for P_SEND and P_RCV.
6. Click RS232 interface in the inspector and set: Protocol = ASCII, Baud rate = 9600, Data bits = 8, Parity = None, Stop bits = 1, Flow control = RTS/CTS.
7. Click ASCII protocol in the inspector and set: End-of-frame delimiter = 0x0D (CR), Wait for end delimiter = Enabled, Receive line idle time = 40 ms, Data flow control = RTS/CTS.
8. Compile the configuration (project tree → S7-300 station → right-click → Compile → Hardware and software (rebuild all)). Resolve any catalog warnings about missing HSPs before downloading.
9. Download the configuration to the CPU (online → Download to device). The CP340 receives its protocol parameters from the CPU at startup; the green "Send" LED illuminates when the module is parameterized.

Programming Send and Receive Function Blocks

The CP340 in TIA Portal V13 is driven by FB8 "P_SEND" and FB9 "P_RCV" (corresponding to SFB60 and SFB61 in classic STEP 7). The blocks are found in the Standard library → Communication → PtP section of the TIA Portal instructions. The IKA LR 1000 command-response sequence maps cleanly to a P_SEND call followed by a P_RCV call inside the same OB1 cycle, gated by the CP340 status word to enforce command-response sequencing.

Instance DBs and Background OB

Create a global DB to hold the IKA send/receive buffers. The instance DBs for P_SEND and P_RCV are generated automatically when the FB is first instantiated and are assigned symbolic names (for example, iDB_P_SEND and iDB_P_RCV). Place the P_SEND call in OB1 (or a faster cyclic OB such as OB35 at 100 ms) and the P_RCV call in the same OB so that both share the same scan context.

FB8 P_SEND Interface

FB9 P_RCV Interface

ST Snippet — Build and Send the "IN_SP_1 25.0" Command

// Cyclic OB1 — build and send the safety-temperature setpoint
IF "ika_send_enable" AND NOT "ika_send_busy" THEN
   "ika_send_buf"[0]  := 16#49; // 'I'
   "ika_send_buf"[1]  := 16#4E; // 'N'
   "ika_send_buf"[2]  := 16#5F; // '_'
   "ika_send_buf"[3]  := 16#53; // 'S'
   "ika_send_buf"[4]  := 16#50; // 'P'
   "ika_send_buf"[5]  := 16#5F; // '_'
   "ika_send_buf"[6]  := 16#31; // '1'
   "ika_send_buf"[7]  := 16#20; // ' '
   "ika_send_buf"[8]  := 16#32; // '2'
   "ika_send_buf"[9]  := 16#35; // '5'
   "ika_send_buf"[10] := 16#2E; // '.'
   "ika_send_buf"[11] := 16#30; // '0'
   "ika_send_buf"[12] := 16#0D; // CR — frame terminator
   "ika_send_len" := 13;

   "iDB_P_SEND"(REQ := TRUE,
                LADDR := 256,
                DB_NO := 100,
                DBB_NO := 0,
                LEN := "ika_send_len",
                DONE  => "ika_send_done",
                ERROR => "ika_send_error",
                STATUS => "ika_send_status");
   "ika_send_busy" := TRUE;
END_IF;

IF "ika_send_done" OR "ika_send_error" THEN
   // Reset the REQ to release the FB
   "iDB_P_SEND"(REQ := FALSE, LADDR := 256, DB_NO := 100, DBB_NO := 0, LEN := 0);
   "ika_send_busy" := FALSE;
   IF "ika_send_error" THEN
      "ika_last_err" := "ika_send_status";  // capture for HMI
   END_IF;
END_IF;

ST Snippet — Continuous Receive into DB101

// Continuous receive — call every OB1 cycle
"iDB_P_RCV"(EN_R := TRUE,
            LADDR := 256,
            DB_NO := 101,
            DBB_NO := 0,
            LEN := "ika_rcv_len",
            NDR   => "ika_rcv_new",
            ERROR => "ika_rcv_error",
            STATUS => "ika_rcv_status");

IF "ika_rcv_new" THEN
   // "ika_rcv_buf" holds the IKA response. Copy and parse outside the FB call.
   "ika_parse_pending" := TRUE;
END_IF;

IF "ika_rcv_error" THEN
   "ika_last_err" := "ika_rcv_status";
END_IF;

ST Snippet — Parse "OUT_T1 24.8" Response

// Parser — extract a real value after the command name + space
IF "ika_parse_pending" THEN
   "ika_parse_pending" := FALSE;
   // Search for the space character (0x20) and the terminating CR (0x0D)
   FOR "ika_i" := 0 TO "ika_rcv_len" - 1 DO
      IF "ika_rcv_buf"["ika_i"] = 16#20 AND "ika_value_start" = 0 THEN
         "ika_value_start" := "ika_i" + 1;
      END_IF;
      IF "ika_rcv_buf"["ika_i"] = 16#0D AND "ika_value_start" > 0 THEN
         "ika_value_len" := "ika_i" - "ika_value_start";
      END_IF;
   END_FOR;
   // Convert ASCII substring to REAL using STRING_TO_REAL on a temp string
   // (omitted for brevity — standard S7 string conversion in TIA Portal V13)
   "ika_value_start" := 0;
   "ika_value_len" := 0;
END_IF;

Buffer Sizing and Timeout Strategy

The CP340 receive buffer is sized by the LEN input on the next P_RCV call. Set LEN to the maximum expected IKA response length plus a 16-byte headroom. The IKA command responses are at most ~30 bytes (command name + value + CRLF). A LEN of 128 bytes gives generous headroom without wasting DB memory. If the IKA returns a multi-line response, the P_RCV FB releases the buffer at the first CR (0x0D) and the remaining lines are loaded into the next P_RCV call — the application must call P_RCV in a tight loop until the buffer is empty or the application times out.

Implement a software watchdog: if the P_RCV NDR flag does not assert within 2 seconds of the P_SEND DONE flag, declare a communication timeout. Reset the IKA with a "RESET" command and increment a counter tag for HMI display. The IKA LR 1000 itself has an internal timeout, but the PLC-side watchdog gives faster diagnostic feedback to the operator.

IKA LR 1000 Command Structure and Value Ranges

The IKA LR 1000 "basic_control" command set follows the IKA laboratory device convention: an ASCII command name, an optional space-separated argument, and a CR (0x0D) terminator. Responses echo the same command name followed by the queried value and a CR/LF terminator. The exact command set and value ranges must be confirmed against the manual edition in use — the following table lists the published baseline for the "basic_control" model.

Refer to the IKA LR 1000 "basic_control" operating manual for the complete command list, valid value ranges, and the safety limits enforced by the device firmware. The maximum single command payload is 100 bytes; a longer frame will be rejected by the IKA parser and may cause the IKA to return an error response. Argument values are limited to the device's safety range — for the LR 1000, the safety setpoint (SP_1) is bounded to 0-400 °C and the process setpoint (SP_2) is bounded to 0-300 °C, but these values must be verified against the manual in use.

Command-Response Sequencing — State Machine

Implement the IKA interface as an explicit state machine in the application. The state machine guarantees one command in flight, one response consumed, and a recovery path on timeout.

The state machine lives in a global DB. OB1 advances the state on each cycle, calls P_SEND in SEND, calls P_RCV in RECEIVE, and clears the state to IDLE on terminal errors (STATUS = 80B0, 80B1, 80B2). HMI tags expose the current state, the last error code, and a cumulative error counter for the operator.

Diagnostics, Status Codes, and Troubleshooting

The CP340 exposes diagnostics through the FB STATUS output, the module LEDs, and the diagnostic buffer of the S7-300 CPU. The table below maps the most common STATUS values reported by P_SEND and P_RCV to actionable causes.

CP340 LED Interpretation

• SF (red, on) — Internal module fault or group diagnostics active. Open the S7-300 online diagnostics (CPU → Online & Diagnostics → Diagnostic buffer) to read the cause.
• Send (green, on) — Interface parameterized and ready for traffic.
• Send (green, flashing) — Data is being transmitted on TxD.
• Receive (green, flashing) — Data is being received on RxD.
• Receive (green, off) with no traffic — Normal idle state when EN_R is FALSE or no incoming frames are present.

Troubleshooting Matrix

Multiple CP340 Modules in One Station

If the lab line expands to more IKA reactors or to other RS232 instruments, additional CP340 modules can be inserted in the central rack. Each CP340 occupies one slot, consumes 16 bytes of logical I/O, and is addressed by its own LADDR value (typically 256, 272, 288, and so on). The application instantiates one P_SEND and one P_RCV pair per CP340 logical address, with one set of send/receive data DBs per port. Naming convention: iDB_P_SEND_256, iDB_P_SEND_272, etc. The state machine in the previous section is replicated for each IKA instance; the operator HMI displays the status of each port on a separate faceplate.

For a rack full of CPs and a tight I/O budget, switch to the CM PtP RS232 BA / HF modules in an ET 200SP station on PROFINET. The CM PtP modules each occupy one slot in the ET 200SP base unit and are addressed via the PROFINET device name and slot number, not by the CPU's local I/O map. The application uses the same P_SEND / P_RCV FBs but with a different LADDR derived from the PROFINET device configuration.

HMI Integration of the Serial Link

Expose the following tags on the HMI to give the operator a clear view of the IKA link:

• ika_state — current state of the state machine (IDLE, BUILD_CMD, SEND, WAIT_DONE, RECEIVE, PARSE_RESP, ERROR).
• ika_last_cmd — last command sent (string tag, length 20).
• ika_last_resp — last response received (string tag, length 60).
• ika_last_err — last STATUS word from P_SEND or P_RCV (word tag, displayed as hex).
• ika_err_count — cumulative error counter (DINT, reset from the HMI).
• ika_send_enable — operator-controlled enable for the send sequence.
• ika_setpoint_sp1, ika_setpoint_sp2 — current setpoints in °C (REAL).
• ika_temp_t1, ika_temp_t2 — current temperatures in °C (REAL).
• ika_speed_v — current stirrer speed in RPM (REAL).

An HMI alarm class of "Communication" should be wired to ika_err_count when it increments, and to ika_state = ERROR when the state machine enters the ERROR state. The alarm text should include the hex value of ika_last_err so that the operator can cross-reference the table above.

Cybersecurity and Safety Notes

RS232 is a point-to-point copper link with no authentication, no encryption, and no integrity checking. It is suitable for laboratory and process-instrumentation use inside a controlled cabinet, but not for any link that crosses a building or touches a public network. The cabinet containing the S7-300 and the IKA LR 1000 should be locked, and the RS232 cable should remain inside the cabinet raceway. If a PROFINET gateway is added later, place the gateway behind a SCALANCE firewall module and disable any unused Ethernet services on the gateway.

Functional safety on the IKA LR 1000 is implemented inside the device — the LR 1000 has an independent safety temperature circuit (SP_1) that trips the heater regardless of the serial command. The PLC should treat the serial interface as a supervisory channel, not a safety channel, and should not rely on a STOP command to remove process risk. A separate hardwired safety relay (for example, a Pilz PNOZ s5) wired to the IKA's safety contact is the correct layer for functional-safety integration.

Migration Notes: S7-1200 and S7-1500 Alternatives

If the lab line is being re-platformed onto S7-1200 or S7-1500, the same IKA command set and the same ASCII framing parameters apply unchanged. The communications module and the function-block call site change:

• S7-1200 — add a CM 1241 RS232 communications module to the left of the CPU. In the TIA Portal instructions tree, use the Point-to-Point family of instructions: Send_P2P and Receive_P2P (legacy numbering FB 3 and FB 4) or the newer Point-to-Point instruction blocks. The CM 1241 RS232 supports the same ASCII driver with the same end-of-frame delimiter and idle-line time configuration.
• S7-1500 — add a CM PtP RS232 BA or HF to the ET 200SP station on PROFINET. The TIA Portal Point-to-Point instructions target the module by its PROFINET slot number; the same ASCII framing applies. The HF variant adds USS and Modbus support if the line is later expanded with drives.

Specific S7-1200/1500 part numbers and firmware minimums should be confirmed against the current TIA Portal hardware catalog at the time of project commissioning — the application code (ASCII framing parameters, IKA command set, parser logic, state machine) ports across unchanged. A code re-use strategy is to place the IKA state machine and parser in a dedicated FB that takes a hardware-handle input (LADDR / HW_ID), so the same FB works against a CP340 on S7-300 and a CM 1241 on S7-1200 with only the LADDR value changing.

Verification Procedure

1. With the S7-300 in STOP, go online and open the CP340 in the device view. Confirm the SF LED is off and the green "Send" LED is on (interface parameterized).
2. Switch the CPU to RUN. From a watch table, force ika_send_enable := TRUE. Verify the green "Send" LED on the CP340 flashes for ~14 ms (one frame at 9600 baud), and the green "Receive" LED flashes ~10 ms later as the IKA returns its answer.
3. Inspect the receive buffer DB (DB101). Confirm the IKA echo matches the command byte-for-byte, and that a CR/LF terminates the response.
4. Trigger an OUT_T1 command. Verify the parsed temperature value is inside the IKA's physical range and updates within 1 s of the send.
5. Disconnect the IKA DB9 connector. Repeat the OUT_T1 send. The P_RCV call should report STATUS = 80B2 (CTS low) within the configured retry window. Reconnect the IKA and confirm the error clears on the next receive cycle.
6. With the IKA connected, send an out-of-range setpoint (for example, IN_SP_1 999.9). Confirm the IKA returns an error response and the application state machine increments ika_err_count.
7. Cycle power on the IKA. Confirm that the application watchdog times out within 2 s, sends a RESET, and the IKA re-initializes without manual intervention.
8. Run the line for 24 hours with the IKA in continuous mode. Confirm that ika_err_count remains at zero and that the response buffer does not drift or contain partial frames.

Once these checks pass, the link is field-ready. Subsequent step additions (analog stations, additional IKA reactors) can reuse the same FB instances by parameterizing LADDR with the new CP340 logical address.

FAQ