The 3964R protocol is implemented in the S7 PLC via the use of Siemens Function Block FB11 and other required DBs, FBs, Timer 127 and FC81.  These Siemens blocks are supplied by Ci Technologies but the code is written by Siemens.  Unfortunately, the code in these blocks are "know-how" protected by Siemens.

It also appears that the code in FB11 does not support the use of multiple CP340/CP441 in a single rack.  When trying to use multiple CP340/CP441, Citect will report errors "Response Bad or garbled" and "Unit not responding".  All IO devices using the S7PTP driver will then go offline as a result.

There is no work around at the moment to enable the use of multiple CP340/CP441.  CiT will post any further developments in future KB articles.