Siemens S7-300 Wireless Communication Setup with CP343-1 Advanced and SCALANCE W

Wireless S7-300 links are a common requirement for moving machines (cranes, stacker cranes, AGVs, transfer cars, rotating tables) where dragging a Profibus or Profinet cable is impractical. The Siemens-native approach pairs a CP343-1 Advanced communications processor in each S7-300 station with a SCALANCE W radio (an access point on the stationary side and a client on the moving side), and uses the CP's CBA (Component Based Automation) feature with IMAP software to bind data blocks across the air gap. This reference covers hardware selection, CP configuration, SCALANCE topology, IMAP wiring, safety, and verification for a working S7-300 ↔ S7-300 wireless bridge.

1. When Wireless S7-300 Linking Makes Sense

Wireless bridging is justified when one or more of the following apply:

• The remote S7-300 traverses a fixed path (linear, circular, or gantry) and cable flex life is exhausted after a few thousand cycles.
• The remote station is a moving vehicle (crane, stacker crane, shuttle, transfer car) on a rail or track.
• The application is a process skid that is periodically relocated but needs to rejoin a Profinet/Industrial Ethernet network on power-up.
• The site forbids cable tray installation (e.g., across a public road, in a heritage building, or in ATEX zone boundaries with cable glands).

Wireless is not a replacement for Profinet IRT, Profisafe, isochronous motion, or any loop where deterministic sub-millisecond latency is required. Use copper or fiber for those.

2. System Architecture Options

3. Prerequisites

• Hardware
  • Two S7-300 stations (CPU 315-2 PN/DP, 317-2 PN/DP, 319F-3 PN/DP, or ET 200S with IM151-8 PN/DP CPU) each fitted with a 6GK7 343-1GX30-0XE0 (CP 343-1 Advanced) or equivalent firmware v3.x communications processor. CP 343-1 Lean variants do not expose CBA and cannot be used for IMAP.
  • One SCALANCE W788-1RR (access point, 6GK5788-1AR60-2AA0 or successor 6GK5788-2AR60-2AA0) on the stationary side.
  • One SCALANCE W747-1RR (client, 6GK5747-1AR60-2AA0 or 6GK5747-2AR60-2AA0) on the moving side.
  • 24 V DC power supplies sized for the radios (typ. 0.5–1.0 A each). Use the SCALANCE PSW791-x power supplies for DIN-rail mount.
  • External R-SMA antennas with low-loss coax (e.g., 6GK5793-8DJ00-0AA0 ANT792-6MN) sized for the path length. For 60 m line-of-sight, a 6 dBi omnidirectional works; for 1–2 km links, use 12–18 dBi directional Yagi panels (ANT793-8DN or ANT795-6DC).
• Software
  • SIMATIC Manager Step 7 V5.5 + SP2 or later, or TIA Portal V16+ with the S7-300 HSP.
  • IMAP (Industrial Messaging and Programming) – included in the CP 343-1 Advanced firmware package, or download from the Siemens SiePortal under "CP 343-1 Advanced CBA".
  • Primary Setup Tool (PST) or the Web-Based Management (WBM) of the SCALANCE W radios (default IP 192.168.1.1 on the AP, DHCP on the client).
• Network plan: Document the IP address scheme (e.g., stationary PLC = 192.168.10.10, moving PLC = 192.168.10.11, AP = 192.168.10.1, client = 192.168.10.2), the SSID, the WPA2-PSK key, and the antenna coordinates before powering anything on.

4. CP 343-1 Advanced Configuration

The CP 343-1 Advanced is the only S7-300 CP that exposes Component Based Automation (CBA) and the IMAP interface. Configuration is performed in HW Config in SIMATIC Manager or in the TIA Portal device view.

4.1 Insert the CP and assign the IP

1. Open the S7-300 station in HW Config, drag CP 343-1 Advanced (6GK7 343-1GX30-0XE0) from the catalog onto the rail (slot 4 typical, or any free slot before slot 9).
2. Open the CP's properties → General and assign:
   • IP address: 192.168.10.10 (stationary) or 192.168.10.11 (moving)
   • Subnet mask: 255.255.255.0
   • Router: 192.168.10.1 (the SCALANCE W AP)
3. Click New on the subnet line and create an Industrial Ethernet subnet "PN/IO_1".

4.2 Activate CBA on the CP

1. CP 343-1 Advanced properties → CBA tab.
2. Check Activate CBA. This loads the CBA runtime in the CP firmware (it does not consume CPU 315/317 work memory).
3. Assign the CP a unique component name – e.g., STA_Crane for the stationary side and MOV_Crane for the moving side. The name is case-sensitive and must match exactly in IMAP.
4. Note the CP's Instance ID (a 16-byte hex GUID generated automatically). IMAP will discover the CP by broadcasting the instance ID over Ethernet.

4.3 Define the data block interface

Decide which DBs the two CPUs will exchange. A common pattern is:

• DB100 "Crane_Cmd" on the stationary CPU → mapped to DB200 "Crane_Cmd_Mirror" on the moving CPU.
• DB110 "Crane_Status" on the moving CPU → mapped to DB210 "Crane_Status_Mirror" on the stationary CPU.

Each DB must have the same byte length on both sides; mismatched lengths cause IMAP "size mismatch" faults at runtime. Use a UDT (user-defined data type) to keep the structures identical.

5. SCALANCE W Access Point and Client Setup

5.1 Initial IP addressing

The SCALANCE W788-1RR ships with DHCP client enabled. To set a static IP:

1. Connect a PC to port 1 of the SCALANCE W, set the PC NIC to 192.168.1.100 / 24.
2. Browse to https://192.168.1.1 (default WBM, admin / admin).
3. Layer 3 → Subnets: set IP to 192.168.10.1 / 24. Save and reboot.
4. For the SCALANCE W747-1RR client, repeat and set the IP to 192.168.10.2 / 24. Disable DHCP client on the client radio.

5.2 Configure the radio link

5.3 Antenna alignment and link budget

For a 60 m stacker-crane X-axis link the free-space path loss at 5.18 GHz is:

FSPL(dB) = 32.45 + 20·log10(f_MHz) + 20·log10(d_km)

At 5,180 MHz and 0.06 km: FSPL = 32.45 + 74.28 + (−24.44) = 82.29 dB.

Add 6 dBi TX antenna gain + 6 dBi RX antenna gain + cable losses (~1 dB each side). Link budget: 15 + 6 + 6 − 1 − 82.29 − 1 = −57.29 dBm received signal. SCALANCE W receivers reach −90 dBm sensitivity for 54 Mbit/s MCS7, giving ~33 dB margin. For 1–2 km links reported in field installations, switch to 12–18 dBi directional Yagis and add a SCALANCE W1748-1 M12 (client) with higher EIRP allowances.

6. IMAP Wiring (Industrial Messaging and Programming)

IMAP is the Siemens tool that maps DBs between two CP 343-1 Advanced stations over Ethernet. The latest release supports Windows 10 LTSC and integrates into SIMATIC Manager as a child process. Configuration steps:

1. Install IMAP, then start IMAP → Configuration. Both CPs must be reachable on the Ethernet subnet – ping 192.168.10.10 and 192.168.10.11 from the engineering station first.
2. Click Search for components. IMAP broadcasts the CBA instance ID and lists STA_Crane and MOV_Crane in the component tree.
3. Drag STA_Crane/DB100 Crane_Cmd from the left pane to the right pane, then map it to MOV_Crane/DB200 Crane_Cmd_Mirror. Repeat in the opposite direction for status.
4. Set the update rate (default 100 ms – this is the cycle in which IMAP issues a Read/Write on the CP). Lower values (e.g., 50 ms) increase CPU load on both stations; do not go below 20 ms for crane duty cycles.
5. Save the IMAP project as crane_bridge.imap, then Project → Download to both stations. The CP 343-1 Advanced stores the IMAP configuration in non-volatile memory and re-arms the link on power-up.
6. Open IMAP → Online → Diagnostics. The link state must show Connected, Quality = 100%. The "Lost telegrams" counter must stay at zero after a 10-minute soak test.

7. Programmatic Verification in Step 7 STL

Add a heartbeat and a watchdog in each CPU to detect a frozen radio link:

// Stationary CPU (Crane Master), OB1 cycle
      L     "Crane_Cmd".Heartbeat         // MB100 incremented by IMAP partner
      L     MW 102                         // Local heartbeat, OB35 100 ms tick
      -I
      ABS
      T     "Link_OK"                      // TRUE if delta < 3, FALSE otherwise
      JC    ok
      S     "Link_Fault"                   // Latch fault, reset by HMI ack
ok:   NOP   0

// OB35 - 100 ms interrupt
      L     "Crane_Cmd".Heartbeat
      +     1
      T     "Crane_Cmd".Heartbeat

      L     "Crane_Status".Link_Timer       // counts up since last IMAP update
      +     1
      T     "Crane_Status".Link_Timer
      L     50                              // 5 s @ 100 ms
      <I
      JC    no_fault
      =     "Link_Watchdog"                 // raise to SCALANCE/HMI after 5 s silence
no_fault: NOP 0

Mirrored logic on the moving CPU resets the Link_Timer on every received IMAP update. If the timer exceeds 5 s, the HMI shows "Radio Fault" and the application code can park the moving machine in a safe state, but the safety E-stop remains hardwired and independent.

8. Safety and Functional Considerations

• Keep E-stop, SLS, and STO hardwired. Per EN ISO 13849-1, a wireless path is not a "proven component" for safety. Run the e-stop loop in dedicated safety contactors or a Sirius 3SK safety relay with its own wired pilot circuit.
• Use wireless only for non-safety control and HMI data. Tag the IMAP link in the HMI as "non-safety" so operators do not trust it for emergency actions.
• Encrypt the radio. Use WPA2-PSK with a 63-character random key. Industrial Wi-Fi networks must not run open or WEP. Disable WPS on the SCALANCE W.
• Check local RF regulations. 5 GHz DFS channels 52–140 are restricted in some countries; verify with the local radio regulator and the SCALANCE W country profile (default "World", change to "USA", "EU", "China", etc. as required).
• Segregate the WLAN from the office network. Put the SCALANCE W on a dedicated VLAN/subnet; do not bridge it to the corporate LAN.

9. Verification and Commissioning Steps

1. Power both S7-300 stations and both SCALANCE W radios. Verify 24 V DC at the radio screw terminals and the green "Power" LED.
2. From a laptop on the same subnet, ping both CP 343-1 Advanced IPs. A reply confirms the wired Ethernet side is healthy.
3. From the SCALANCE W WBM on the AP (https://192.168.10.1), open WLAN → Client List. The W747-1RR MAC address must appear with a "Signal -55 dBm" or better value.
4. In IMAP Online, force a single update: right-click the link → Update now. Check the byte count and CRC of the received DB; both must be non-zero and match the configured length.
5. Run a 30-minute soak test with the moving PLC traversing the full axis. Watch the Lost telegrams counter in IMAP; it must stay at zero. Capture SCALANCE W log via Syslog to a local server to spot transient DFS radar-detect events.
6. Run a forced-disconnect test: pull the 24 V DC on the client radio. The moving CPU's Link_Watchdog must rise within 5 s and the HMI must display "Radio Fault". Re-apply power; IMAP must reconnect within 15 s without operator action.
7. Document the link budget, channel, country code, antenna gain, EIRP, MAC addresses, and WPA2 key in the plant's wireless register per IEC 62734 where applicable.

10. Troubleshooting Matrix

11. Third-Party Wireless Alternatives

If the SCALANCE W/CP 343-1 Advanced path is not available, the following devices appear in field installations and integrate as transparent Ethernet or Profibus bridges:

• Phoenix Contact RAD-ISM-2400-SET-BD-BUS-ANT – bidirectional 2.4 GHz Profibus set; 100 mW EIRP, IP65 housing, plug-and-play Profibus cable emulation. Best for slow Profibus DP (1.5 Mbit/s) and very short distance (≤150 m). Use only on non-safety Profibus segments.
• Leuze DDLS 500 / DDLS 200 – optical free-space Ethernet/Profibus data links. Treated as a piece of cable. 0–120 m or 0–200 m ranges, IP65, unaffected by RF noise. Requires precise alignment; outdoor mounting brackets strongly recommended.
• SICK ISD 300-1211 – Profibus over infrared, 60 m, used on stacker cranes. Integrates as a Profibus segment with standard GSD file.
• HMS Anybus Wireless Bolt – 2.4 GHz WLAN or Bluetooth, transparent Ethernet/serial; advertised for moving-machine serial or MQTT bridging. Use only for non-safety, non-deterministic traffic.
• ProSoft Technology PLX31-EIP-SIE – gateway that terminates EtherNet/IP on one side and Siemens Industrial Ethernet (S7 PUT/GET) on the other. Useful when the moving vehicle is a Rockwell-controlled AGV that must publish its status to a Siemens S7-300 master. See the ProSoft EtherNet/IP to Siemens Industrial Ethernet gateway page.

12. Reference Documents and Official Links

• TIA Portal – Instructions for communication tasks (S7-300, S7-400, S7-1500)
• SiePortal – WiFi Communication between S7-300
• SiePortal – S7-300 & S7-400 Communication using wireless
• ProSoft Technology – EtherNet/IP to Siemens Industrial Ethernet gateway