Configuring BSEND/BRCV Between S7-400 and S7-1500 Gateway

Overview

This reference covers a recurring industrial integration scenario: a fleet of legacy SIMATIC S7-400 stations must publish process data to a new SIMATIC S7-1500 gateway, which then exposes the consolidated dataset to a Level 2 (MES/scada) host over OPC UA. The reference example is sized for 18 S7-400 PLCs aggregating roughly 8,000 tags through one S7-1500 CPU, but the same constraints and configuration procedure apply to any multi-PLC S7 Communication topology that uses BSEND / BRCV.

The key engineering questions answered in this document are:

1. Are BSEND/BRCV feasible across 18 simultaneous S7 connections on a single S7-1500 CPU?
2. How many S7 connection resources are required per partner, and what are the firm CPU limits?
3. How must the data be packaged in the S7-400 side so that the gateway can receive it with BRCV?
4. When is PUT/GET the better choice over BSEND/BRCV?
5. How are the S7 connections configured in TIA Portal on the S7-1500 side and in STEP 7 V5.x on the S7-400 side?

Reference Architecture

The reference plant topology is shown below. Each S7-400 acts as a data source; the S7-1500 acts as a gateway, and the Level 2 host consumes the published data via the OPC UA server embedded in the S7-1500 CPU (firmware V2.0 and higher).

• 18 × S7-400 CPUs (one per skid/machine cell) — each with its own program and one or more process data DBs.
• 1 × S7-1500 gateway CPU with two PROFINET interfaces (X1, X2) integrated in the CPU and two additional CP 1543-1 modules (or similar CPs) for plant-bus segmentation.
• 1 × Level 2 server consuming data through the OPC UA server of the S7-1500.

Approximate volumes used as the design baseline for the calculations in the next sections:

S7 Connection Resource Limits

Before committing to BSEND/BRCV, the connection budget of every CPU involved must be checked against the planned 18 S7 connections (one per S7-400 partner). Each BSEND/BRCV pair consumes exactly one S7 connection resource on each participating CPU.

For a 1:18 gateway architecture the S7-1500 gateway CPU must be sized to support at least 18 + N connections, where N is the number of OPC UA sessions, HMI sessions, and PG/OP connections. A CPU 1516-3 PN/DP (256 connections) is the safe minimum; a CPU 1518-4 PN/DP (384 connections) leaves headroom for future partners. The S7-400 side needs only one connection per station (to the gateway) plus any existing HMI/PUT/GET connections, so a CPU 414-3 PN/DP (64 connections) is adequate in most cases.

BSEND/BRCV Versus PUT/GET

BSEND/BRCV and PUT/GET both ride on S7 Communication. The differences that matter for this architecture are listed below.

For this project BSEND/BRCV is the recommended choice because the payload per partner is small enough to fit a single BSEND call and the receiver DB is naturally the gateway's data consolidation DB. PUT/GET becomes attractive only when the S7-400 program cannot be modified to expose a contiguous data block.

Data Packaging Requirements

BSEND ships a contiguous byte block; BRCV receives the same block into a pre-allocated DB. The S7-400 must therefore assemble the 6 KB worth of data destined for the gateway inside a single DB (commonly named DB_GATEWAY_UPLINK or similar). The following rules apply:

• The receive DB on the S7-1500 side and the source DB on the S7-400 side must be the same length; BRCV raises STATUS = W#16#8088 if the received length differs from the DB length.
• BYTE alignment is sufficient; no need to align on word boundaries at the S7-400 side as long as the same byte layout is mirrored in the S7-1500 DB.
• If the 8,000 tags are scattered across many FBs/DBs in the S7-400, add a packaging step (a cyclic OB1 or OB35 routine) that copies the relevant values into the uplink DB before BSEND triggers.

Connection Configuration in TIA Portal (S7-1500 Side)

Use TIA Portal V16 or later (V18/V19 recommended). The procedure is identical for every one of the 18 partners; the only values that change are the partner IP address and the connection name.

1. Open the S7-1500 project in TIA Portal. In the project tree, expand Devices & Networks → Networks & Gateways.
2. Add the S7-400 partner to the network view. Right-click the S7-1500 CPU and choose Add new connection → S7 connection.
3. In the Connection dialog set the partner to "Unspecified" or to the actual S7-400 station if it exists in the project. Set the interface to the PROFINET interface X1 of the S7-1500 (or to the CP 1543-1 if the gateway partners are segmented onto a different subnet).
4. Set the connection name to a unique identifier, for example S7_400_Skid_01 through S7_400_Skid_18.
5. Set the partner IP address (e.g. 192.168.10.11 for the first partner). Leave the rack/slot at the S7-400 default (rack 0, slot 2 for a CPU 414-3 PN/DP, slot 3 if a CP is used for the S7 connection).
6. Confirm that the connection is shown in the Connection table of the S7-1500 with Active connection establishment = Yes. The S7-1500 acts as the active partner; the S7-400 is passive.
7. Repeat steps 2 to 6 for the remaining 17 partners.

After the connection table contains 18 S7 connections, compile and download the hardware configuration. The S7-1500 is now ready to instantiate the BSEND calls.

Connection Configuration in STEP 7 V5.x (S7-400 Side)

The S7-400 partner must agree on the connection. In STEP 7 V5.6 open the NetPro editor:

1. Insert a new S7 connection to "Unspecified" partner.
2. Enter the IP address of the S7-1500 interface used for the S7 connection (192.168.10.1 for example).
3. Set Active connection establishment = No — the S7-400 waits for the S7-1500 to establish.
4. Save and download the connection to the S7-400.

For a list of firmware-compatible CPU combinations see the Siemens FAQ S7 Communication between SIMATIC S7-1500 and SIMATIC S7-300, which also applies to the S7-400 line because the same S7 Communication blocks (FB12/FB13) are used.

Programming BSEND on the S7-400 Side

The S7-400 calls FB12 BSEND from the standard library Communication Blocks → S7 Communication. The call must be made cyclically, for example from OB35, and the instance DB must be unique per partner.

CALL FB12, DB100   // BSEND instance for partner #1
REQ    := TRUE     // edge-triggered, set for one cycle
R      := FALSE    // no reset
ID     := 1        // connection ID from NetPro
DONE   := M100.0   // bit: job complete without error
ERROR  := M100.1   // bit: error flag
STATUS := MW102    // word: detailed status
SD_1   := P#DB200.DBX0.0 BYTE 6144   // source: first 6 KB of DB200
LEN    := MW110    // actual length to send (up to 6144)

Keep the call re-triggered: if REQ is left TRUE, BSEND re-sends the data on every successful completion. The S7-400 CPU 414-3 PN/DP (6ES7414-3EM07-0AB0) firmware V7.0 supports the 32 KB payload that BSEND allows.

Programming BRCV on the S7-1500 Side

The S7-1500 uses the system instruction BSEND / BRCV from the Communication → S7 Communication palette. Each partner requires two FB instances (one for uplink, one for downlink).

// SCL sample for S7-1500 BRCV instance 'rcv_Skid_01'
IF "rcv_Skid_01".NDR OR "rcv_Skid_01".ERROR THEN
    IF "rcv_Skid_01".ERROR THEN
        // log STATUS, raise alarm
    ELSE
        // new data available in DB 'GatewayUplinkDb'.Skid01
    END_IF;
END_IF;
"rcv_Skid_01"(
    REQ    := FALSE,
    ID     := 1,                       // connection ID = TCON_ID of S7 connection
    EN_R   := TRUE,                    // enable reception
    R      := FALSE,
    LEN    := 6144,                    // expected length
    DONE   => ,                       // ignored on BRCV
    NDR    => ,                       // new data received
    ERROR  => ,
    STATUS => ,
    RD_1   := P#"GatewayUplinkDb".Skid01 BYTE 6144);

For a full programming example see the TIA Portal help page Program example for BSEND & BRCV (S7-1500, S7-1200 G2).

Wiring and Interface Layout

The S7-1500 CPU used in this reference has two PROFINET interfaces (X1, X2) integrated in the CPU plus two CP 1543-1 modules plugged in the left side of the rack. The recommended port assignment is:

Commissioning and Verification

After download to both CPUs, perform the following checks before going into production:

1. Connection status: in TIA Portal open Online & Diagnostics → Connection table. Every one of the 18 entries should show Established = Yes. A STATUS = W#16#0001 on BRCV means the connection is up but no data has been received yet.
2. Cyclic data: trigger a value change on the S7-400 (e.g. a counter incremented in OB1) and confirm that the change appears in the corresponding S7-1500 DB within one BSEND cycle (~50 ms typical for a 6 KB payload on a 100 Mbit/s link).
3. PDU size: read SZL ID W#16#0132 on the S7-400 and confirm 480 bytes. A 240-byte PDU increases the cycle time by roughly a factor of two for the same payload.
4. Connection count: in the S7-1500 online diagnostics, Communication → Connection resources, verify that 18 of the available connections are in use and that the OPC UA server (one session) is also accounted for.
5. OPC UA exposure: from a Level 2 OPC UA client (for example UA Expert), browse the S7-1500 server, navigate to GatewayUplinkDb.Skid01..18 and confirm that all tags are readable and that the values match the S7-400 source.

Troubleshooting Matrix

Edge Cases and Field-Proven Caveats

• S7-400 firmware < V6.0: only 240-byte PDU. The 6 KB payload per partner still works but takes ~25 PDUs per direction and cycle time goes up. Upgrade the firmware of the S7-400 CPUs to V7.0 or later if the application is cycle-time critical.
• CP 443-1 on the S7-400 side: if the S7-400 reaches the S7-1500 through a CP, the connection must be configured in NetPro with the CP's IP address and the CP's rack/slot (slot 4 for the first CP 443-1 in a S7-400 rack).
• Routing across subnets: the S7-1500 CPU cannot act as an S7 router between two S7-400 partners. Each S7-400 partner must establish its connection directly with the S7-1500 CPU on the same subnet.
• OPC UA performance: 8,000 tags polled at 100 ms produce ~80 kSamples/s on the OPC UA server. The CPU 1516-3 PN/DP can sustain this load; the CPU 1515-2 PN is at its limit and may saturate the OPC UA subscription queue.
• Security: S7 Communication between S7-400 and S7-1500 is not encrypted. Use a CP 1543-1 with an IPsec tunnel or move the S7 Communication to a separate physical plant-bus if data confidentiality is required.

Frequently Asked Questions