Troubleshooting CP343-1 Communication Loss on S7-300 Systems

Field failures of the SIMATIC CP 343-1 communications processor on S7-300 stations typically surface after a project download, a hardware configuration change, an MMC card replacement, or a power cycle on a controller that was previously online through a now-defunct project. The most common symptom cluster is a sudden loss of Ethernet reachability to both the CP and the host CPU 315-2 DP, accompanied by abnormal LED behavior on the CP (RUN flashing green, STOP steady yellow). Once this state occurs, both ICMP ping to the configured IP address and the Edit Ethernet Node MAC scan fail, and the engineering station cannot bring the controller back online through the production Ethernet path.

This article documents the complete recovery sequence for the symptom cluster observed on a CP 343-1 (Siemens MLFB 6GK7 343-1EX21-0XE0, firmware V1.2), attached to a CPU 315-2 DP in a PS307-powered S7-300 station. The same diagnostic flow applies to the CP 343-1 Lean (6GK7 343-1CX00-0XE0) and CP 343-1 Advanced (6GK7 343-1GX20-0XE0) families when they enter the same startup-configure state. Diagnostic references are taken from the Siemens Industry Online Support portal and the SIMATIC S7-300 product family documentation.

1. Problem Overview and Failure Mode

The reported failure pattern is repeatable across multiple sites and is one of the most common CP 343-1 service tickets worldwide. The sequence that produces the failure is consistent:

1. A working S7-300 station communicates normally through a CP 343-1 over Industrial Ethernet.
2. An engineer opens HW Config in SIMATIC Manager (STEP 7 V5.5 or TIA Portal), makes a configuration change, and downloads the project to the CPU.
3. After the download, the engineering station can no longer ping the CP IP, can no longer browse the CP MAC address, and can no longer reach the CPU through the CP.
4. The CP 343-1 enters a self-repeating startup state, indicated by a continuously flashing green RUN LED and a steady yellow STOP LED.

The CP is in what Siemens calls the STARTUP state. It is trying to apply the configuration table that it has loaded from the CPU over the backplane bus, but the table does not match the CP that is physically present, the table references a CP type that is not installed, the configuration is internally inconsistent, or the underlying MMC of the CPU has been corrupted. While in this state, the CP does not bind the previously configured IP address, so all IP-based discovery fails.

2. Affected Hardware and Identification

Verify the part numbers and firmware versions of the modules involved before applying any recovery procedure. The wrong CP type or firmware version in HW Config is the single most common cause of the startup-configure loop on this family of devices.

Source: Siemens Industry Online Support product pages for SIMATIC S7-300 CP 343-1, including the device manuals and firmware release notes.

The host CPU in the failure case is a CPU 315-2 DP (6ES7 315-2AG10-0AB0 or similar). The two-port DP suffix means that the CPU has a built-in PROFIBUS DP master/slave interface in addition to the MPI/DP interface. The CP 343-1 is installed in slot 4 of the S7-300 rack and is connected to the engineering laptop through a managed Industrial Ethernet switch.

3. Symptom Matrix and LED Interpretation

LED states are the fastest indicator of which recovery branch applies. Always observe the CP and CPU LED stack for at least 30 seconds, because a CP in startup mode will cycle the RUN LED at approximately 0.5 Hz and may transition between several substates as the configuration is validated.

4. Root Cause Analysis

The CP 343-1 startup-configure loop is almost always one of the following root causes, listed in order of field frequency:

1. MMC absent or corrupted. The CPU 315-2 DP requires an MMC (SMC 64K minimum, MMC 2 MB / 4 MB / 8 MB typical). If the MMC is removed, the CPU will not run user code and the CP cannot read a valid configuration table. Removing the MMC temporarily proves whether the MMC is the problem.
2. CP type mismatch in HW Config. HW Config references a CP 343-1 part number that is not physically installed, or refers to a CP with a higher firmware revision than the one in the rack. The CP cannot match the configuration table and stays in startup.
3. Downgrade of CP firmware. Loading a project that includes configuration data for a newer CP (for example, EX30) onto a slot that holds an older CP (EX21 V1.2 as in this case) puts the CP into startup-configure with no path forward.
4. PROFIBUS DP master/slave configuration error. A bad PROFIBUS download (bus parameters, slave address, or DP master system identifier) can leave the CPU 315-2 DP in STOP with the CP unable to come up. This is the trigger that produced the failure described in the source case.
5. IP address conflict or subnet mismatch. Less common but possible: another device on the plant LAN has taken the CP IP, or the engineering laptop has been moved to a different subnet than the CP's configured subnet. The CP can still be in RUN; only the IP-based path is broken.
6. Security software on the engineering station. Trend Micro, Windows Defender Firewall, or third-party endpoint protection can block ISO-on-TCP port 102, PROFINET DCP multicast, or the SIMATIC discovery frames used by the Edit Ethernet Node tool. This appears as if the CP is unreachable when the network is actually fine.

5. Required Tools and Prerequisites

Assemble the following before starting the recovery procedure. Trying to recover an S7-300 station without an MPI fallback path is a common mistake that traps the engineer on a single point of failure.

• Engineering station with STEP 7 V5.5+ (SIMATIC Manager) or TIA Portal V13+ installed, with the HSP for the CP 343-1 EX21 V1.2 installed if using TIA.
• SIMATIC NET software component including the Edit Ethernet Node (PST Primary Set Tool) utility. In STEP 7 V5.5 this is reached through Start → SIMATIC → SIMATIC NET → Edit Ethernet Node.
• Industrial Ethernet cable (RJ45) and a known-good managed switch port. Test the cable with a cable certifier or swap to a known-good cable.
• MPI/DP USB PC Adapter (6ES7 972-0CB20-0XA0 or current equivalent) with the USB drivers installed. This is the mandatory fallback path.
• A known-good MMC card appropriate for the CPU. For CPU 315-2 DP, an SMC 64K (6ES7 953-8LF00-0AA0) is the minimum; an MMC 2 MB (6ES7 953-8LL00-0AA0) or larger is recommended.
• A field PG (PG 720P, PG 760P, or current Field PG) is preferred for MMC programming offline, but a Prommer such as the Field PG's built-in MMC prommer is also acceptable.
• Local administrator rights on the engineering station so that firewall rules and PG/PC interface assignment can be changed.

6. Step-by-Step Recovery Procedure

Work the steps in order. Each step verifies the previous one. Do not skip to MPI unless the Ethernet path is proven unworkable.

6.1 Verify the physical layer

1. Confirm the PS307 (for example 6ES7 307-1EA00-0AA0, 5 A) shows DC 24 V OK and the CPU 315-2 DP shows DC5V green.
2. Confirm the CP 343-1 is fully seated in its slot. Remove and reseat the module; a half-seated CP will mimic the startup-configure symptom.
3. Replace the Ethernet cable and switch port. LED activity on the CP Ethernet port (Link/Rx/Tx LEDs on the RJ45) confirms layer 1 is up.

6.2 Attempt Edit Ethernet Node discovery

1. Start SIMATIC NET → Edit Ethernet Node (or from SIMATIC Manager, Options → Set PG/PC Interface → Edit Ethernet Node).
2. Click Browse. The tool sends a PROFINET DCP-style discovery frame (which on this CP family also works as a generic Ethernet Node discovery) and lists all CP 343-1 devices on the segment by MAC address.
3. If the CP is found, assign the previously used IP address and subnet mask, then click Assign IP Configuration. This writes the IP directly to the CP, bypassing the CPU's configuration table. The CP will rebind the IP and the Ethernet path is restored.
4. If the CP is not found, the CP is either not on the broadcast domain, is in a state that blocks DCP, or is a pre-EX10 firmware that does not support this path. Proceed to §6.3.

6.3 Remove the MMC and power cycle

1. Power down the S7-300 station through PS307.
2. Open the cover on the CPU 315-2 DP and remove the MMC.
3. Power the station back up.
4. Observe the CP 343-1 LED stack. With no MMC present, the CPU will go to STOP with SF, but the CP 343-1 will exit the startup-configure loop and either bind a fallback IP (if the configuration table is not strictly required) or settle to a steady yellow STOP. The point of this step is to confirm that the CP is alive on the backplane and that the original symptom was configuration-driven, not hardware-driven.

6.4 Insert a known-good MMC

1. Power down again and insert a known-good Siemens MMC of the correct type. For CPU 315-2 DP, an SMC 64K or MMC 2 MB is appropriate.
2. Power up. Observe the CPU 315-2 DP LEDs. With a clean MMC and a previously good CPU, the CPU should reach STOP with no SF (no project on MMC, but no fault either) and the CP 343-1 should come up with RUN flashing green as it tries to receive a configuration table.

6.5 Re-attempt Ethernet access to the CP

1. Re-run Edit Ethernet Node. The CP should be discoverable by MAC. If a previously assigned IP is unknown, this is the path to recover it.
2. Ping the assigned IP from the engineering station. A successful ping confirms the IP is bound.
3. Open SIMATIC Manager, select the project, and from the menu select PLC → Download or Accessible Nodes with TCP/IP as the PG/PC interface.

6.6 Fallback to MPI if Ethernet download is refused

1. Connect the MPI/DP USB PC Adapter to the CPU 315-2 DP MPI port and to the engineering station.
2. In SIMATIC Manager, open Set PG/PC Interface and select PC Adapter (MPI). Set the MPI address to 0 (default) and the transmission rate to 187.5 kbit/s (default) unless the project specifies otherwise.
3. Click Accessible Nodes. The CPU 315-2 DP should appear with its MPI address (default 2).
4. Download the corrected project through MPI. This is the most reliable path when the CP is in startup-configure, because the MPI path does not depend on the CP being healthy.

6.7 Re-establish CP 343-1 communication

1. After a successful project download, the CP 343-1 will receive its configuration table from the CPU and will exit the startup-configure loop.
2. Verify that the CP RUN LED is steady green and the STOP LED is off.
3. Verify that the configured IP address responds to ping.
4. Verify in SIMATIC Manager that the CP is visible under Accessible Nodes with TCP/IP and under Online → Online and Diagnostics on the CP object.

7. Resolving the "Unable to Connect to CPU315-2DP R0/S2" Error

After the MMC recovery step, a second symptom often remains: SIMATIC Manager can see the CP 343-1 through the Ethernet path and can ping it, but cannot complete a project download and reports:

Unable to connect to CPU315-2DP R0/S2 via the online interface

This message means that the ISO transport connection between the PG/PC interface and the CPU 315-2 DP could not be established. The R0/S2 designation refers to rack 0, slot 2, which is the CPU slot in the standard S7-300 configuration. The causes and remedies are:

For the Trend Micro case described in the source, the engineering station had Trend Micro endpoint security installed. Trend Micro's firewall and web reputation filters can block the SIMATIC ISO-on-TCP (port 102) and the PROFINET DCP discovery multicast frames (UDP 34964). Disabling Trend Micro's firewall and intrusion prevention temporarily resolved the symptom. In production environments, configure Trend Micro to allow port 102 inbound and outbound for the engineering station, and add the engineering station's IP and the CP subnet to the firewall exception list.

8. Configuration Parameter Mapping

Two parameter locations in HW Config control the CPU's online behavior and are the cause of most download-time errors.

8.1 CPU 315-2 DP communication parameters

Open HW Config, select the CPU 315-2 DP, open Properties → Communication. The communication load on the CPU is one parameter; the other is the Number of PG/PC connections and the Number of S7 connections. Increasing these from the default of 1 each to higher values allows multiple engineering tools and HMI panels to coexist with the engineering download session.

Setting the Number of PG/PC connections parameter to 4 (which is one of the changes the engineer in the source case attempted) increases the resource allocation for engineering sessions. In SIMATIC Manager, the corresponding check box is labeled PG/PC and OP Communication; in newer TIA Portal releases it is under Properties → Communication → Connection Resources.

8.2 CP 343-1 IP configuration

Open HW Config, select the CP 343-1, open Properties → Ethernet Interface → IP Protocol. The IP, subnet mask, and router address are configured here and are written to the CP via the project download. The MAC address is printed on the front of the CP and is the fallback identifier for Edit Ethernet Node.

9. Security Software and Network Stack Interference

Endpoint security on the engineering station is the most common non-Siemens cause of CP 343-1 unreachability. The following ports and protocols must be allowed for normal operation:

For Trend Micro specifically, add the following exceptions on the engineering station:

• Allow TCP port 102 inbound and outbound.
• Allow UDP port 34964 (PROFINET DCP) inbound and outbound.
• Allow the SIMATIC Manager, STEP 7, and TIA Portal executables as trusted processes.
• Allow the SIMATIC NET Edit Ethernet Node utility as a trusted process.

The same exceptions apply to Windows Defender Firewall, McAfee, Symantec, and Kaspersky. The same exception list is required for the engineering station to be able to scan a CP 343-1 Lean (CX00) and CP 343-1 Advanced (GX20) as well.

10. Verification and Acceptance Test

After the recovery procedure, run the following verification matrix to confirm that the CP 343-1 is fully operational. A green LED is necessary but not sufficient; the verification table exercises the live data path.

11. Preventive Measures

The failure pattern documented here is fully preventable. The following measures are the field-proven baseline.

1. Back up the project before every download. In SIMATIC Manager, use File → Archive with the Retrieve option enabled. This produces a reversible snapshot.
2. Use Siemens MMCs only. Third-party SD-to-MMC adapters have been observed to corrupt the project on power cycle. Order MMCs by Siemens MLFB (for example 6ES7 953-8LL00-0AA0 for 2 MB).
3. Document the CP part number and firmware in the project header. Put the MLFB and the firmware version in the project properties or in a documentation block. This makes a downgrade trivial to detect before it produces a startup-configure loop.
4. Lock the HW Config to a specific CP type. Use the Check Block Consistency and the Compile and Download Objects workflow in SIMATIC Manager to confirm the CP type matches the physical hardware before pressing Download.
5. Maintain a pre-staged MPI/DP USB PC Adapter. Every engineering team that maintains S7-300 stations should keep at least one MPI/DP USB PC Adapter (6ES7 972-0CB20-0XA0 or successor) on the shelf and tested.
6. Pre-stage endpoint security exceptions. Add the SIMATIC port exceptions to the engineering station's endpoint security policy before the failure occurs. Trend Micro, Windows Defender, and McAfee all support central policy-based exceptions for ports 102, 161, and 34964.
7. Reserve a known-good MMC in the spares cabinet. An SMC 64K or MMC 2 MB in a labeled ESD bag, used only for recovery, will save a 4-hour drive to the nearest Siemens distributor.

12. Frequently Asked Questions