Communicating S7-1500 to LabVIEW via UDP in TIA Portal V14

The SIMATIC S7-1500 controller family supports connectionless UDP communication natively on its integrated PROFINET interface. Unlike legacy S7-300 CPUs whose integrated PN port did not implement the full open user communication stack and frequently required a separate CP (e.g. CP 343-1) for UDP, the S7-1500 integrated port implements UDP, TCP, ISO-on-TCP, and Modbus/TCP without additional hardware. This tutorial walks through the full configuration path: hardware selection, TIA Portal V14 project setup, the UDP connection definition in Devices & Networks, the TUSEND / TURCV program blocks on the PLC side, and the matching LabVIEW UDP VIs on the IPC side. Target engineers: anyone running a supervisory/test application on a National Instruments IPC that must exchange process data with an S7-1500 CPU over Ethernet.

1. Communication Architecture Overview

UDP is a connectionless, datagram-oriented transport protocol. There is no three-way handshake, no acknowledgement, and no built-in retransmission — every datagram is sent best-effort. The trade-off is low latency and low overhead, which is well suited to cyclic data streaming from a controller to a measurement/visualization front-end, or to small, frequent command/response messages where loss of an individual packet is non-critical.

In the S7-1500 world UDP is realized by the T-block family (TSEND, TRCV, TUSEND, TURCV, TCON, TDISCON) sitting on top of the operating system's ISO/OSI transport layer. The TIA Portal V14 release shipped TUSEND V1.0 and TURCV V1.0 for S7-1200/S7-1500, both of which are still the standard blocks for UDP traffic in current TIA Portal versions. The connection itself is configured declaratively in the Devices & Networks editor — the program blocks only reference the connection by ID.

The endpoints of a UDP "connection" in TIA Portal are described by a Local End Point (PLC IP + local port) and a Remote End Point (partner IP + partner port). Note that despite the name, no persistent connection state is established — the description simply tells the CPU where to send and where to accept datagrams from. See the official TIA Portal reference UDP address details (S7-300, S7-400, S7-1500) for the parameter model used in TIA Portal.

2. Prerequisites

3. Configuring the S7-1500 Hardware in TIA Portal V14

1. Open TIA Portal V14 and create a new project. Add a new device Add new device » SIMATIC S7-1500 » CPU ... » 6ES7 XXX-... matching the catalog number of the physical CPU. Confirm the firmware version matches the target (e.g. CPU 1515-2 PN, 6ES7515-2AM02-0AB0, FW 2.6).
2. Open Device view and select the PROFINET interface X1. Under Ethernet addresses, set the IP address (e.g. 192.168.0.10) and subnet mask (255.255.255.0). Leave the router empty unless traffic must leave the subnet.
3. Under Properties » General » PROFINET interface » Advanced options » Port statistics, enable the access to the port statistics if you want to monitor received/sent packets.
4. Download the hardware configuration to the CPU. The CPU's X1 LEDs should show a steady green LINK on the port connected to the IPC or switch.

4. Creating the UDP Connection

1. In the project tree, switch to Devices & Networks and select the S7-1500 CPU.
2. Click Connections in the toolbar, then choose the connection type UDP connection from the drop-down. A new connection line appears, anchored at the CPU's PROFINET port.
3. Drag the right end of the line to the not connected endpoint. In the inspector Properties » General » General, choose Unspecified as partner for the initial setup, or pick a partner CPU/PC station if you have added one.
4. In Properties » General » Address details, configure the endpoints:

Confirm the connection. The connection ID is generated automatically; you will read it from the Connection resources tab of the inspector (e.g. ID = 1). The local ID is the handle the TUSEND/TURCV blocks will reference.

5. PLC Program: TUSEND and TURCV Blocks

The S7-1500 UDP blocks are:

Both blocks ship in the Instructions » Communication » Open user communication task card of TIA Portal. Drop one TUSEND DB and one TURCV DB into the project; the DBs become the instance data blocks for the blocks.

5.1 Send (TUSEND) — SCL example

// FB "PLC_LabVIEW_Sender" — call in OB1 cyclic
// Sends 10 bytes from DB100 starting at byte 0 every 100 ms

#TUSEND_Instance(REQ     := TRUE,                   // rising edge triggers send
                 ID      := 1,                       // connection ID from Devices & Networks
                 LEN     := 10,                      // payload length in bytes
                 DATA    := P#DB100.DBX0.0 BYTE 10,  // ANY pointer to send area
                 DONE    => #sendDone,
                 BUSY    => #sendBusy,
                 ERROR   => #sendError,
                 STATUS  => #sendStatus);

5.2 Receive (TURCV) — SCL example

// FB "PLC_LabVIEW_Receiver" — call in OB1 cyclic
// Receives up to 100 bytes into DB101 starting at byte 0

#TURCV_Instance(EN_R     := TRUE,                    // enable receive
                 ID       := 1,                       // connection ID
                 LEN      := 100,                     // max length to accept
                 DATA     := P#DB101.DBX0.0 BYTE 100, // ANY pointer to receive area
                 NDR      => #rcvNewData,             // new data flag
                 BUSY     => #rcvBusy,
                 ERROR    => #rcvError,
                 STATUS   => #rcvStatus,
                 RCVD_LEN => #rcvLen);                // actual bytes received

Important T-block behavior:

• TUSEND is edge-triggered on REQ. Hold REQ = TRUE and the block sends one datagram per rising edge of REQ. To send cyclically, pulse REQ with a 100 ms timer (e.g. from a TP/IEC_TIMER) or feed it from the BUSY fall-edge in a wrapper FB.
• TURCV is level-triggered. As long as EN_R is TRUE and there is no error, it pulls a datagram from the receive buffer on every call. NDR is set for one cycle whenever a new datagram has been copied into the receive area. RCVD_LEN tells you the actual length.
• STATUS returns the standard S7 communication error codes (e.g. 0000_0000 = OK, 80A4_0000 = no partner reachable, 80A7_0000 = data length error). The block help (F1) lists every value.

6. LabVIEW UDP Configuration

On the IPC side, the equivalent communication primitives live on the block diagram under Data Communication » Protocols » UDP. The minimum set of VIs is:

6.1 Minimal LabVIEW block-diagram recipe

1. Place UDP Open on the diagram, wire port 2001 into the port terminal. Run the VI once to verify Windows can bind the port; if the VI returns error 8 ("Specified address is already in use"), another process holds the port — close it or pick a different port.
2. Wrap UDP Read in a While Loop with a 50 ms wait. Set max datagram size to 100 (matching the PLC's LEN). The data out cluster gives you the raw bytes and the source IP/port. Use Unflatten From String with the matching cluster type to decode the payload.
3. For sending, build a cluster of your process data, run it through Flatten To String, and wire the result to UDP Write with remote host = "192.168.0.10" and remote port = 2000.
4. Place UDP Close in the stop condition of the While Loop so the socket is freed when the VI terminates.

6.2 Byte order on the wire

S7-1500 is little-endian. LabVIEW's Flatten To String also writes in host byte order, which is little-endian on x86/x64 Windows. By default, S7-1500 byte memory (%DB100.DBX), word (%DB100.DBW) and dword (%DB100.DBD) is stored little-endian, so a 4-byte float placed at offset 0 lines up byte-for-byte with a LabVIEW Single unflattened from offset 0. If you use the S7-1500 Optimized Block Access for DB100/DB101, you must disable that property on the data blocks used for UDP exchange, or the compiler will reorder the fields.

7. End-to-End Commissioning Procedure

1. From the IPC, ping the PLC: ping 192.168.0.10. A reply confirms layer-3 reachability.
2. Open a Command Prompt on the IPC and run netstat -an | findstr 2001 after starting the LabVIEW VI. You should see UDP 0.0.0.0:2001 *:*.
3. In TIA Portal, go Online » Go online, then Online » Diagnostics » Connection diagnostics. The UDP connection should show status Established.
4. Force a value in DB100 (e.g. set byte 0 to 16#AA) and observe it arrive in LabVIEW. Set a value in LabVIEW and observe it land in DB101 on the PLC.
5. Open TIA Portal » Online » Diagnostics » Port statistics on the PROFINET interface to confirm send/receive counters are incrementing in both directions.

8. Diagnostics and Status Codes

For deeper inspection, use the record set PROFINET IO » Port statistics » Record index 0x800A via RDREC, or read the CPU web server's Diagnostics » Information » Communication page. The web server is enabled under CPU properties » Web server » Activate; access it from a browser at http://192.168.0.10.

9. Performance and Tuning

Default OB1 cycle on a CPU 1515-2 PN with a typical program is 1 to 5 ms. Sending a UDP datagram of 100 bytes every 1 ms is feasible; every 0.1 ms starts to show load. The two tuning knobs are:

• Send rate. Bound the TUSEND trigger to an IEC timer rather than a free-running OB1 call. A 50 to 200 ms cycle is the typical range for HMI / IPC visualization.
• Payload size. UDP performance is dominated by per-packet overhead. Sending 16 single-byte datagrams is roughly 16x more expensive than sending one 16-byte datagram. Bundle your process data into one struct per cycle.

If you need a lower-level of assurance, drop UDP and use ISO-on-TCP (TRCV/TRCV with a confirmed connection). UDP cannot tell you if a datagram was lost; ISO-on-TCP adds TCP's stream and acknowledgement guarantees on top of the same T-block API.

10. Security Considerations

UDP is unencrypted and unauthenticated. For shop-floor deployments, do the following:

• Place the PLC and IPC on an isolated VLAN or behind a managed switch with port-based ACLs.
• If the S7-1500 must sit on a routed network, use a CP 1543-1 (6GK7543-1AX00-0XE0) for an additional Ethernet interface with firewall and VPN; configure the Security » Firewall rules to permit only the IPC's IP on the UDP ports in use.
• Enable CPU properties » Security » Activate access protection and assign a password to the PLC. Without it, anyone on the network can stop/restart the CPU and modify the program.

11. Troubleshooting Matrix

12. Frequently Asked Questions