S7-300 to PC Data Transfer via Ethernet CP and MP277 File Methods

Problem Statement: Bridging Discrete I/O Between a Vision PC and a Siemens S7-300

A common retrofit problem on legacy Siemens S7-300 lines involves a vision inspection PC that already controls machine cameras and runs proprietary vision software, but only exchanges data with the PLC through a handful of digital inputs and outputs. The PLC in these installations is typically an S7-300 CPU 313C-2DP with no integrated Ethernet port, paired with an MP 277 Touch Panel on MPI, and a PROFIBUS DP subnet for remote I/O throughout the rest of the cell.

The line builder needs to push a part number string from the vision PC into the HMI application so the PLC can react to model changeovers. Because the vision software is custom, the integrator can shape its output freely, but the constraint is the channel: the only physical path that exists today is a few wires in a discrete I/O cable. There is no Ethernet drop on the S7-300, no PROFIBUS PC card installed, and budget rules out major new hardware.

This article evaluates four methods to land that data on the MP 277 without replacing the CPU, ranked by cost, effort, and risk. It ends with a step-by-step commissioning walkthrough for the lowest-cost option (file-based transfer through the MP 277), a verification checklist, a troubleshooting matrix, and field notes captured from real retrofits.

System Architecture Analysis

Before choosing a method, lock down the as-built hardware and software versions. The following inventory is the minimum you need to design the bridge.

Two physical facts drive the entire design: (1) the S7-300 CPU 313C-2DP has no onboard Ethernet, so PROFINET is off the table unless a Communication Processor (CP) is added; (2) the MP 277 already has an RJ45 port that is normally used only for project download. That second port is the most under-used asset on the machine and is the foundation of the lowest-cost method.

Method 1: Add an Ethernet CP to the S7-300 Rack

The cleanest engineering answer is to install an Ethernet Communication Processor on the S7-300 backplane and use S7 communication between the PC and the PLC. The vision PC then becomes a full S7 client or partner and can write tags directly.

CP Selection

The CP 343-1 Lean is usually enough for a vision PC sending one part-number string and a handful of bools. Mount it in slot 4 of the S7-300 rack, configure it in HW Config with a free IP address on the plant LAN, and enable S7 communication in the CP properties.

PC-Side S7 Communication

On the PC, two common paths exist:

• LibNoDave / Snap7 open-source stack: free, well-documented, supports S7 PUT/GET on a CP 343-1 Lean. The vision software developer can call a C/C#/Python API to read and write DB blocks.
• Siemens SOFTNET S7 / OPC server: license cost but provides a tested OPC DA/UA surface that any SCADA package can subscribe to.

Typical data layout: define DB100 with a string field for the part number (e.g., STRING[20]) and 8 bools for handshake. The PC triggers a "new part number" bit and writes the string in one PUT; the PLC clears the bit on receipt.

Hardware Costs and Effort

Expect $400-$1,400 USD for the CP module plus 4-8 hours of engineering for HW Config, IP scheme, firewall rules, and PC-side library integration. This is the most robust answer but the highest entry cost.

Method 2: Use the MP 277 as a File Gateway (Lowest Cost)

If the line is cost-sensitive and a few seconds of latency is acceptable, the MP 277's already-installed Ethernet port can act as a bridge. The vision PC writes a small text file to a Windows share, an SMB server on the vision PC, or pushes the file via FTP; the MP 277 polls that file using WinCC flexible scripting and writes the parsed string into an HMI tag, which the PLC reads over MPI.

Why This Works on the MP 277

WinCC flexible 2007 SP2 and later support VBScript inside the Runtime with FileSystemObject. The MP 277 can reach a UNC path \\VISION-PC\partdata\part.txt provided:

• The MP 277 is on the same subnet as the vision PC and can route to it.
• The vision PC exposes an SMB share with a known user/password (the MP 277 must authenticate, or the share is open to the runtime account).
• WinCC flexible 2008 or later is installed so the full VBScript runtime is present.

An alternative if SMB is not desired is to use the vision PC's FTP server (or build a one-line Python FTP listener) and have the MP 277 pull the file using VBScript with an HTTP or FTP ActiveX control. The Siemens Knowledge Base article FAQ 26107211 - Reading and writing files in WinCC flexible documents the supported approaches and the FileSystemObject usage in detail.

Data Flow

1. Vision software detects a new part. It writes the part number to C:\partdata\current.txt and increments a sequence number in C:\partdata\seq.txt.
2. MP 277 cyclic task (e.g., every 500 ms) runs a VBScript that compares the sequence number to its last read. If changed, it reads current.txt, parses the string, and writes it to internal tag PartNumber.
3. MP 277 exposes PartNumber as an HMI tag. The PLC reads it via MPI/DP area pointer "Coordination" or by polling the tag using a GET/PUT step on the CPU.
4. The PLC clears a handshake bit when it has latched the new part number into its DB.

Latency and Reliability

End-to-end latency is the sum of: vision write time + SMB poll interval + VBScript execution + MPI tag transfer. In practice, expect 1-3 seconds on a healthy network. For changeover this is fine; for high-speed interlock signaling it is not.

Method 3: Use a PC Serial Port with a CP 340/341

If the vision PC has a free COM port (RS-232 or RS-422), you can add a Siemens CP 340 (RS-232: 6ES7340-1AH00-0AE0; RS-422/485: 6ES7340-1BH00-0AE0) or CP 341 (6ES7341-1AH00-0AE0) to the S7-300 and use ASCII protocol with point-to-point communication. The vision PC writes the part number as a CRLF-terminated ASCII string; the CP buffers it and the CPU picks it up via FB2/FB3 (Receive) with handshake bits in the discrete I/O cable.

This method is robust, deterministic, and survives long outages, but it requires the vision PC to write a serial protocol and consumes a slot in the S7-300 rack. Typical cost: $500-$900 USD for the CP plus a shielded cable.

Method 4: PROFIBUS PC Card with SOFTNET DP Slave

A PROFIBUS DP card on the vision PC (e.g., CP 5611 / CP 5621 with SOFTNET DP Slave license) lets the PC appear as a DP slave on the existing DP subnet. The vision PC can then expose cyclic I/O that includes the part number bits/bytes. This is the most native PROFIBUS answer but adds a license cost, requires DP master configuration changes in HW Config, and may interfere with the existing PROFIBUS segment if not carefully planned.

Comparison Matrix

Recommendation: For a single-machine retrofit where budget dominates and changeover events are seconds-scale, use Method 2 (MP 277 file gateway). For a multi-line standard, use Method 1 (CP 343-1 Lean) and treat the vision PC as a permanent S7 partner.

Implementation Walkthrough: Method 2 (MP 277 File Gateway)

The following steps assume WinCC flexible 2008 SP3 on the engineering station, MP 277 with firmware matching that project, a vision PC with a shared folder named partdata, and a single part number up to 20 ASCII characters.

Step 1 - Configure the Vision PC Share

1. Create C:\partdata on the vision PC.
2. Right-click the folder, Properties → Sharing → Share this folder. Set share name to partdata.
3. Under Permissions, allow the MP 277 runtime user read access. If the runtime account is anonymous, enable Everyone → Read on an isolated machine LAN.
4. Add a firewall rule on the vision PC to allow inbound TCP 445 from the MP 277 IP only.
5. Write an initial file current.txt with the placeholder content UNKNOWN-0000 and a seq.txt with the single digit 0.

Step 2 - Configure the MP 277 Network

1. In Control Panel on the MP 277 (opened via Start → Settings), set an IP address in the same subnet as the vision PC, with subnet mask and gateway.
2. From the engineering PC, ping the MP 277 IP and verify reply.
3. In WinCC flexible, open Device Settings → Device → Network → LAN and confirm the configured IP matches the panel.

Step 3 - Declare HMI Tags

1. Create an internal tag PartNumber of type STRING with length 20.
2. Create an internal tag PartSeq of type INT, initial value -1.
3. Create an internal tag LastSeq of type INT, initial value -1.

Step 4 - Build the Polling Script

Open Schedules → Tasks and add a new cyclic task PollPart with a 500 ms trigger. Insert the following VBScript:

' --- PollPart.vbs ---
Const SEQ_PATH = "\\\\VISION-PC\partdata\seq.txt"
Const PART_PATH = "\\\\VISION-PC\partdata\current.txt"
Const MAX_PART_LEN = 20

Dim fso, ts, txt, newSeq, part
Set fso = CreateObject("Scripting.FileSystemObject")

On Error Resume Next
Set ts = fso.OpenTextFile(SEQ_PATH, 1, False, 0)
If Err.Number <> 0 Then
    SmartTags("PartSeq") = -1
    Exit Sub
End If
txt = Trim(ts.ReadAll)
ts.Close
newSeq = CInt(txt)

If newSeq <> SmartTags("LastSeq") Then
    Set ts = fso.OpenTextFile(PART_PATH, 1, False, 0)
    If Err.Number = 0 Then
        part = Trim(ts.ReadAll)
        ts.Close
        If Len(part) > MAX_PART_LEN Then part = Left(part, MAX_PART_LEN)
        SmartTags("PartNumber") = part
        SmartTags("LastSeq") = newSeq
    End If
End If

Step 5 - Hand the Tag to the PLC

There are two common ways to move the HMI string into the PLC:

• Area Pointer "Coordination" + scheduled tag transfer: configure an area pointer that mirrors PartNumber into a DB in the PLC on change. Simpler but string handling is byte-by-byte.
• PLC polls the HMI: use a PUT/GET on the MP 277's MPI address from the CPU 313C-2DP. With S7-300 + MP 277 this is supported as the MP 277 acts as an S7 server on MPI.

For a string tag, the cleanest is to expose PartNumber byte-by-byte as 20 internal bool-byte tags and have the PLC assemble them into a STRING in DB100. Use the area pointer "Tag" with 20 bytes configured to point at the part-number memory area.

Step 6 - Latch and Acknowledge in the PLC

Sample STL ladder snippet (CPU 313C-2DP, S7-300, Step 7 V5.5):

// FB100 "PartChangeHandler"
// Inputs:  iPartChanged BOOL  (HMI tag mirror "PartNumberChanged")
// Outputs: qAck        BOOL  (sent to MP 277 tag "PartAck")

A "PartNumberChanged";          // rising edge of HMI-issued change
FP "PartNumberChangedEdge";
= "LatchPartNumber";

A "LatchPartNumber";
JCN _END;

CALL "BLKMOV"                   // copy 20 bytes from HMI input area
   SRCBLK := P#E 200.0 BYTE 20  // area pointer base configured above
   RET_VAL:= MW 100
   DSTBLK := DB100.DBX0.0 BYTE 20

S "PartAck";
R "LatchPartNumber";
_END: NOP 0;

Step 7 - Vision Software Trigger

On every part number change, the vision software must:

1. Read the current sequence integer from seq.txt, increment it by 1.
2. Write the new part number to current.txt.
3. Write the new sequence integer back to seq.txt.
4. Set the discrete output bit "PartNumberChanged" on the PLC I/O cable.

Use atomic rename on POSIX-style systems or a write-temp-then-rename pattern on Windows to avoid the MP 277 reading a half-written file.

Verification Procedures

Run these checks before declaring the bridge live.

1. Network reach: from the MP 277 command shell (if available on your firmware) or via a WinCC flexible diagnostic screen, ping the vision PC. If ping fails, fix IP and firewall first.
2. Share access: from the engineering PC, browse to \\VISION-PC\partdata using the same credentials the MP 277 will use. Confirm both files are visible.
3. Script dry-run: on the engineering PC in WinCC flexible Runtime (with simulator), force seq.txt to increment and watch PartNumber update in the tag simulator.
4. HMI to PLC transfer: trigger a change on the vision PC, watch DB100 in the PLC reflect the new string within 3 seconds. Monitor MW100 for non-zero BLKMOV return codes (0 = OK).
5. Negative tests: stop the vision PC share, force the script to fail, confirm PartSeq goes to -1 and the PLC retains its last good value (alarm raised, not a runaway).
6. Power-cycle: reboot the vision PC while the line runs. The bridge should recover automatically within one polling cycle after the share returns.

Troubleshooting Matrix

Field-Proven Cautions

• Windows 10/11 SMB deprecation: Newer Windows builds disable SMB 1.0 by default. The MP 277's VBScript SMB stack typically negotiates SMB 1. If the vision PC runs Windows 10 1709 or later, you must enable SMB 1 in Windows Features or pivot to FTP.
• MP 277 memory ceiling: avoid writing large logs or loop-unrolled file reads. Keep the polling script under 4 KB of source and read one file per cycle.
• Power retention: strings in HMI internal tags are not retained across power cycles. Always re-read on boot. The PLC must treat "no part number" as a controlled state, not a runaway.
• Discrete I/O sanity: keep the discrete handshake bits as the single source of truth for changeover. The file-based path is best-effort; the discrete handshake is the committal event.
• Cybersecurity: if the machine LAN is connected to the plant network, isolate the MP 277 / vision PC segment behind a managed switch or firewall. Anonymous read shares are unacceptable on a flat enterprise network.
• Firmware match: before commissioning, export the MP 277 image using ProSave and store it. If a script corrupts the runtime, you can re-flash without reloading WinCC flexible.

Reference Documentation

The following official Siemens documentation supports the methods discussed. Keep them on hand during commissioning.

• Siemens FAQ 26107211 - Reading and writing files in WinCC flexible
• SIMATIC S7-300 CPU 313C-2DP manual
• SIMATIC MP 277 operator panel manual
• SIMATIC CP 343-1 Lean manual
• SIMATIC CP 340 - Point-to-Point Communication manual