S7-300 RS-232 Communication: Configuring CP 340/CP 341 Point-to-Point

Overview

The SIMATIC S7-300 family does not expose a true RS-232 (EIA-232) port on standard CPU variants. The integrated interface on most S7-300 CPUs is MPI (Multi-Point Interface), a Siemens-proprietary RS-485-based bus. On 31x-2 DP/PN variants, the second interface is PROFIBUS DP or PROFINET. To add RS-232C point-to-point (PtP) communication you must install a dedicated communication processor (CP) into the S7-300 rack, or use one of the limited CPU variants that include a second PtP interface.

The recommended hardware paths for RS-232C are:

• CP 340 (6ES7340-1Axx) - low-cost ASCII / 3964(R) module, fixed protocol firmware.
• CP 341 (6ES7341-1Axx) - full PtP module supporting ASCII, 3964(R), RK512, and loadable firmware for Modbus RTU master/slave, Modbus ASCII, and Data Highway.
• CPU 31xC-2 PtP variants (e.g. CPU 314C-2 PtP, 6ES7314-6Bxx) - integrated second interface that is RS-422/485 only, not RS-232.

CP 340 and CP 341 are single-width modules that plug into any free slot of the S7-300 backplane. They appear in the hardware catalog of STEP 7 V5.5 and TIA Portal (V13+ with the S7-300 HSP) and are treated as standard SIMATIC S7 communication processors.

Prerequisites

Hardware

• S7-300 base unit (e.g. 6ES7300-1xxx) with at least one free slot in the rack.
• One of the following:
  • CP 340 RS-232C (6ES7340-1AH02-0AE0) - ASCII / 3964(R) only.
  • CP 341 RS-232C (6ES7341-1AH02-0AE0) - ASCII / 3964(R) / RK512 / loadable protocols.
• Power supply (PS 307, 6ES7307-1xAxx) sized to handle the CP backplane load (typical 250 mA from the 5 V backplane).
• RS-232C cable: null-modem (cross) or straight-through depending on the partner device. Standard 9-pin D-sub pinout follows EIA-574.

Software

• STEP 7 V5.5 SPx (preferred for S7-300 classic projects) or TIA Portal V13+ with the appropriate S7-300 hardware support package.
• The PtP parameter assignment tool (installer: Setup_PtP_V518.exe), distributed through Siemens Industry Online Support entry ID 10805179. This installs the FB/FC parameter assignment interface for CP 340/341 and is also required to load Modbus RTU firmware onto CP 341.
• For Modbus RTU on CP 341, the loadable parameter set "Modbus Master V3.x" or "Modbus Slave V3.x".

Functional

• Documented partner device (scale, barcode reader, printer, third-party controller, GPS, power meter, etc.).
• Documented protocol frame (ASCII layout, 3964R control characters, or Modbus RTU register map).
• Documented baud rate, parity, stop bits, and flow control (RTS/CTS, XON/XOFF, or none).

CP 340 vs CP 341: Selecting the Right Module

Rule of thumb: Use CP 340 for simple ASCII print streams or barcode readers. Use CP 341 for anything Modbus RTU, RK512, or 3964R with extensive error handling, retries, and a diagnostic buffer you need to interpret in the field.

CPU Variants with Integrated PtP (RS-422/485 Only)

A small subset of S7-300 CPUs expose a second PtP interface marked "PtP" on the front panel. These are not RS-232 - they are RS-422/485 (5-pin Phoenix or 9-pin D-sub depending on the variant) and cannot directly drive a partner device expecting true EIA-232 voltage levels. Converters (e.g. Siemens 6AV6 671-1XE00-0AX0 or third-party Phoenix Contact PSM-ME-RS232/TTY-P) are required, and these are not always reliable in industrial environments.

If your application requires RS-232 voltage levels, the CP 340/341 RS-232C variant is mandatory - not an integrated CPU interface.

Step-by-Step: CP 341 RS-232C with Modbus RTU Master

This walk-through implements a CP 341 as a Modbus RTU master polling a single slave (e.g. a power meter or temperature controller). The procedure is identical in STEP 7 V5.5 and TIA Portal; menu paths below use STEP 7 V5.5 wording.

Step 1 - Insert the CP in HW Config

1. Open the S7 project in STEP 7 V5.5.
2. Open HW Config and select the S7-300 station.
3. From SIMATIC 300 > CP-300 > Point-to-Point > CP 341, drag the CP 341 RS-232C (6ES7341-1AH02-0AE0) into a free slot of the rack (slot 4-11 typically).
4. Note the I/O address assigned by STEP 7 to the CP. The default base address is typically 256 (PI/PQ 256..271). This value is the LADDR parameter used by the Modbus FBs.
5. Save and compile (Station > Save and Compile) and download the hardware configuration to the CPU.

Step 2 - Configure the CP Properties

Double-click the CP 341 slot to open the properties dialog:

• Interface: RS-232C.
• Protocol: Modbus Master (RTU format). If greyed out, install the loadable parameter set "Modbus Master V3.x" via the PtP tool first (Step 3).
• Baud rate: 9600 bit/s (typical default for legacy Modbus meters).
• Data bits: 8.
• Stop bits: 1.
• Parity: Even (Modbus RTU standard).
• Flow control: None for Modbus RTU.
• Character delay time: 4 character times (RTU inter-frame delimiter).
• Response timeout: 2000 ms (raise to 4000 ms on slow radio modems).

Step 3 - Install the Modbus Master Loadable Firmware

1. Launch the PtP tool (Start > Siemens Automation > SIMATIC > PtP).
2. Connect online to the CP 341 via the MPI/DP port of the CPU (Online > Accessible Nodes or via the project navigator).
3. Select Modbus Master > Download to CP. The CP 341 will reboot internally and the new protocol is active after approximately 10 seconds.
4. Verify in the CP's diagnostic buffer that download was successful (event ID "Parameter assignment loaded" or similar).

Step 4 - Program the Modbus Master in OB1

The CP 341 uses the standard FB blocks from the PtP library, which are installed with the PtP tool:

• FB 80 "MB_MASTER" - Modbus master send/receive (V3.0+).
• FB 81 "MB_SLAVE" - Modbus slave.
• FB 6 "P_SEND" - send data (ASCII / 3964R).
• FB 7 "P_RECEIVE" - receive data (ASCII / 3964R).
• FB 6 "P_SND_RK" - send data (RK512).
• FB 7 "P_RCV_RK" - receive data (RK512).

Sample call in OB1 (STEP 7 STL) using FB 80:

// MB_MASTER call - Modbus RTU master, read 8 holding registers
CALL  "MB_MASTER" , DB80
   REQ       :=M0.0              // trigger on rising edge
   ID        :=W#16#100          // LADDR from HW Config (256 dec = 0x100)
   MODE      :=B#16#0            // 0=RTU, 1=ASCII
   DATA_ADDR :=W#16#0001         // Modbus holding register 40001
   DATA_LEN  :=B#16#8            // 8 words (16 bytes)
   DATA_PTR  :=P#DB20.DBX0.0 BYTE 16
   DONE      :=M10.0
   BUSY      :=M10.1
   ERROR     :=M10.2
   STATUS    :=MW12

Mapping notes:

• The LADDR in HW Config (e.g. 256 = W#16#100) equals the start of the input/output address range. Always cross-check with the slot's Addresses tab in HW Config.
• DB20 must be at least 16 bytes long; mismatched length triggers STATUS 0xExxx.
• REQ is rising-edge triggered. Drive it from a clock marker (e.g. M100.5 from a 1 s cyclic timer) for periodic polling, or from a one-shot logic block.

Step 5 - Wire the RS-232C Connector

The CP 340/341 RS-232C uses a 9-pin D-sub male with the following assignment per EIA-574:

For DTE-to-DTE (e.g. CP 341 to a PC serial port), a null-modem cable is required: cross TXD-RXD, RTS-CTS, DTR-DSR. For DTE-to-DCE (e.g. CP 341 to an industrial modem), use a straight-through cable.

Protocol Reference: ASCII vs 3964R vs Modbus RTU vs RK512

ASCII

Free-formatted frames. The user defines the start character, end character (typically CR/LF or ETX), and maximum line length. Used for:

• Printers (Zebra, Epson, citizen label printers via serial).
• GPS receivers (NMEA 0183 - $..*hh).
• Barcode readers (SICK, Leuze, Datalogic in free-port mode).
• Simple digital scales and torque wrenches.

Frame format is configured in the CP properties dialog. FBs: FB 6 "P_SEND" and FB 7 "P_RECEIVE" (single shot). For high-throughput you can also use the modular FB 8 / FB 9 with handshake DBs.

3964(R)

Siemens-proprietary protocol layered on RS-232C with handshake characters:

The (R) variant adds a checksum (BCC, XOR of all data bytes) for integrity. Widely used in older Siemens systems (S5, S7-200, third-party drives). FBs: same as ASCII (P_SEND / P_RECEIVE).

Modbus RTU

Industry standard, binary 8-bit frame with CRC-16, 3.5 character silence between frames. Function codes 01-06, 15, 16 typical. The CP 341 firmware handles all framing, CRC-16, inter-frame timing, and retries (if configured). FBs: FB 80 (master) / FB 81 (slave). For a deeper reference, see the Modbus Application Protocol V1.1b3 specification.

RK512

Siemens RK512 protocol over 3964R; used for inter-PLC communication with S5, S7-200, and select third-party devices. FBs: FB 7 "P_RCV_RK" and FB 6 "P_SND_RK". RK512 is increasingly replaced by S7 communication over Industrial Ethernet / ISO-on-TCP.

Status / Error Code Reference (CP 341 Modbus Master)

The exact mapping of STATUS codes depends on the loadable parameter set version. Always cross-reference with the diagnostic buffer of the CP (PLC > Module Information > Diagnostic Buffer) for the precise event.

Verification

1. LED check on CP 341: Green "SF" off, green "RUN" on. Yellow "TXD" should flash on transmit, "RXD" on receive.
2. Diagnostic buffer: In STEP 7, PLC > Module Information > Diagnostic Buffer should show clean startup with no events beyond the normal "module initialised" event.
3. Online terminal test: Connect a PC running PuTTY (or any terminal) to the CP's RS-232 port at the configured baud rate. Trigger a P_SEND FB and verify the bytes arrive.
4. Loopback test: Insert a null-modem loopback (TXD pin 2-3, RTS pin 7-8) and run a self-test in the PtP tool. Bytes sent should return identically with no errors.
5. Modbus polling: With the master running, read a known register from the slave. Check that DONE toggles high on completion, STATUS stays at 0x0000, and the data arrives in the target DB.
6. Trace: In TIA Portal V15+ with S7-300, use Trace to record BUSY, DONE, ERROR, and STATUS over a 10-second window to detect intermittent faults that would be invisible on single-shot inspection.

Troubleshooting Matrix

Alternative: Ethernet via CP 343-1 Lean

If your partner device supports Modbus TCP, raw TCP, or PROFINET, an Ethernet CP is often a more future-proof choice than a serial CP. The CP 343-1 Lean (6GK7343-1CX10-0XE0) supports:

• TCP/IP connection setup via the TCON / TSEND / TRCV instruction set.
• ISO-on-TCP (RFC 1006) for S7-S7 communication.
• Modbus TCP via loadable blocks (Modbus TCP PN-CPU package).

However, for direct substitution of an existing RS-232 partner device, the CP 340/341 path is usually shorter and requires no firmware changes on the partner. Also note that the CP 343-1 Lean does not provide an RS-232 interface - it is Ethernet only.

Comparison: S7-1200 CM 1241 RS-232 (Reference)

If you are migrating from S7-300 to S7-1200 / S7-1500, the equivalent RS-232 module is the CM 1241 RS-232 (6ES7241-1AH32-0XB0), with the following electrical and functional spec per the official CM 1241 RS-232 Technical Specifications in the TIA Portal documentation:

The same electrical envelope applies to the CP 340/341 RS-232C. For S7-300 sites the CP 340/341 family remains the canonical RS-232 path; for new builds using S7-1200/1500, prefer the CM 1241 / CM PtP.

Field-Commissioning Checklist

1. Verify rack slot (slot 4-11, must follow the CPU and any I/O that the hardware catalog allows).
2. Insert CP, power on, observe LED behaviour on first power-up: SF red briefly, RUN green within 5 s.
3. Download HW Config. Confirm the CP appears in PLC > Module Information > Diagnostic Buffer with a clean start event.
4. Open the PtP tool, set the protocol, configure the loadable parameter set, and download to the CP.
5. Wire RS-232C; for first commissioning use a loopback to validate the cable.
6. Place the FBs in OB1 with the correct LADDR from HW Config. Start with a one-shot read/write to confirm polling, then move to cyclic.
7. Watch the diagnostic buffer during the first hour of production traffic. Address any new events before declaring commissioning complete.

FAQ