Overview
SIMATIC PCS 7 V7.0 (and later) supports Ethernet-based data exchange with standalone SIMATIC S7-400 automation stations (AS) using the S7 protocol over Industrial Ethernet. The typical use case is a fault-tolerant PCS 7 H-System (two redundant S7-400H CPUs) that must read process data from a separate, single S7-400 station (e.g., a vendor package unit with its own ladder program and HMI) and forward that data to a central PCS 7 Operator Station (OS) running WinCC.
Two principal communication paths are available:
- S7 connection via NetPro with PUT/GET blocks (SFB/FB 14/15) on the PCS 7 AS or on the standalone station.
- OPC DA/UA connectivity between WinCC on the OS and the standalone station's OPC server (e.g., SIMATIC NET OPC Server).
This article details the NetPro-based S7 connection approach because it integrates cleanly into the PCS 7 multiproject model and avoids additional OPC licensing on every OS. The OPC alternative is summarized in a dedicated section.
Prerequisites
Before starting the configuration, verify the following hardware and software items:
- PCS 7 engineering station (ES): PCS 7 V7.0 or later with STEP 7 / CFC / SFC / WinCC installed. The multiproject must already contain the H-System AS and at least one OS.
- PCS 7 H-System AS: Two S7-400H CPUs (e.g., CPU 412-3H or CPU 417-4H) with at least one CP 443-1 communications processor in each rack for Industrial Ethernet.
- Standalone S7-400 station: One S7-400 CPU (e.g., CPU 414-3 PN/DP) with an Ethernet interface or a CP 443-1. The station is programmed in STEP 7 ladder/logic (LAD/FBD) using a separate STEP 7 project, not the PCS 7 multiproject.
- Industrial Ethernet network: Managed switches (e.g., SCALANCE XC/XB/XR), shared subnet between the H-System and the standalone station, full duplex, 100 Mbps minimum.
- Firmware compatibility: S7-400H CPU firmware version V4.5 or higher is recommended for PCS 7 V7.0+1. Verify against the PCS 7 release notes.
- STEP 7 project for the standalone station: Either a stand-alone STEP 7 project or a project that is integrated into the PCS 7 multiproject as a separate AS object.
System Architecture and Connection Types
The target architecture is a star or line topology on a single Industrial Ethernet subnet. The PCS 7 H-System and the standalone S7-400 share IP addresses in the same subnet so that the S7 transport layer (ISO-on-TCP / RFC 1006 / TCP port 102) can be routed by NetPro connections.
Connection types supported by STEP 7 NetPro for S7-400 to S7-400:
| Type | Description | Use Case |
|---|---|---|
| Specified S7 connection | Both connection endpoints are configured in NetPro (local ID, partner IP, partner rack/slot, partner connection resource). Connection is established by the CPU on startup. | Preferred for fixed, static peer relationships inside the multiproject. |
| Unspecified S7 connection | Only the local endpoint is configured; the partner IP and resources are passed at runtime via parameter assignment on PUT/GET. | Used when the peer is not part of the same multiproject or when the partner is dynamic. |
For a standalone S7-400 that is not integrated into the PCS 7 multiproject, an unspecified S7 connection is the most flexible path. The PCS 7 AS declares an S7 connection of type "unspecified," and the PUT/GET blocks supply the partner's IP address, rack, and slot via the block's input pins.
Integrating the Standalone S7-400 into the PCS 7 Multiproject
The standalone S7-400 can be integrated in one of two ways:
- Standalone STEP 7 project (no multiproject integration): The PCS 7 ES opens the standalone project separately. NetPro on the PCS 7 side still configures an unspecified S7 connection toward the partner IP. The standalone project is loaded and commissioned independently.
- Multiproject integration: The standalone S7-400 is added to the PCS 7 multiproject as a new AS object via File → Multiproject → Insert Master/Library or by adding an existing station from a separate STEP 7 project. A specified S7 connection can then be created in NetPro with both endpoints visible.
Method 1 (standalone project, unspecified connection) is the most common because the standalone station is typically a third-party or vendor package unit whose program must not be merged into the PCS 7 master project.
NetPro S7 Connection Configuration
On the PCS 7 ES, perform the following sequence in SIMATIC Manager (or PCS 7 Engineering Tool) for the H-System AS project:
- Open the H-Station project in SIMATIC Manager and launch NetPro via Options → NetPro.
- Select the CP 443-1 in rack 0 (and repeat the same for the CP in rack 1 of the H-System; connections are mirrored automatically for redundancy).
- Right-click the CP and choose Insert New Connection.
- In the connection dialog, set the partner to "Unspecified" and connection type to S7 Connection.
- Click OK. The connection appears in the NetPro connection table with a local ID, e.g., ID 1.
- Double-click the connection row and enter the partner IP address, partner rack, partner slot, and partner connection resource. The local connection resource is assigned automatically.
- Compile and download NetPro to the H-Station (both CPUs receive the connection configuration).
On the standalone S7-400 station, open its STEP 7 project in NetPro and create a matching S7 connection whose partner is "unspecified" if you intend to drive the connection from the PCS 7 side. The local connection resource on the standalone CPU will be auto-assigned; the partner side is configured on the PCS 7 AS to point to that resource.
Configuring Communication Blocks (PUT/GET)
Once the S7 connection is established in NetPro, the application-level data exchange uses standard S7 communication system function blocks (SFBs in the CPU firmware, or FBs in the standard library):
| Block | Type | Direction | Max Data per Call | Notes |
|---|---|---|---|---|
| PUT (SFB/FB 15) | Coordinated write | Local → Partner | 160 bytes (S7-400) / 212 bytes (S7-300) | Use to push setpoints or commands to the standalone station. |
| GET (SFB/FB 14) | Coordinated read | Local → Partner | 160 bytes (S7-400) / 212 bytes (S7-300) | Use to read process data from the standalone station into the PCS 7 AS. |
| USEND/URCV (SFB/FB 8/9) | Uncoordinated | Bidirectional | 480 bytes | Fast, no handshake, must handle data consistency in user program. |
| BSEND/BRCV (SFB/FB 12/13) | Block-oriented | Bidirectional | 32 KB | Used for large data volumes with handshake and segmentation. |
Read-only use case (display data only): deploy a single GET block in the PCS 7 H-Station. The standalone station does not need any communication block; it only exposes data in its process image or a defined DB that the GET block references.
GET Block Parameters
-
REQ— Trigger pulse (e.g., 1-second cyclic from OB35). -
ID— NetPro connection ID (e.g., 1). -
NDR / DONE / ERROR / STATUS— Status outputs for diagnostics. -
ADDR_1— Pointer to partner data area, e.g.,P#DB100.DBX0.0 BYTE 40. -
RD_1— Pointer to local receive area, e.g.,P#DB200.DBX0.0 BYTE 40.
CFC Implementation on the PCS 7 Side
In CFC (Continuous Function Chart) programming, drag the FB 14 GET (or the PCS 7 APL block PCS7_GET if available in the Advanced Process Library) onto a CFC chart in the H-Station program. Wire:
-
REQto a cyclic pulse (e.g., a 1-Hz flip-flop from OB35). -
IDto the connection ID from NetPro. -
ADDR_1to a textual tag containing the partner pointer; the pointer syntax is set in the block's input configuration dialog. -
RD_1to a DB on the PCS 7 AS where the data is stored.
Compile the CFC and download to the H-Station. After a few seconds, the NDR (new data ready) output toggles and the ERROR/STATUS outputs report 0/0 on a healthy connection.
Ladder Implementation on the Standalone Station
The standalone station does not require a PUT/GET block if PCS 7 is the active partner. The data to be read must be placed in a defined DB (e.g., DB 100) and remain unmodified by the user program (or be updated periodically by the user logic). The PCS 7 GET block pulls the data into the PCS 7 AS at the configured interval.
H-System Connection Behavior and Dummy CPU
When the partner is a redundant H-Station, the NetPro S7 connection is created twice (once for each H CPU). The active H CPU uses its own connection; the standby holds the configuration but does not actively exchange data. Failover is handled by the H-System firmware within 100 ms to a few seconds, depending on the configured monitoring time.
For a single (non-redundant) S7-400 station, the partner is a single connection endpoint. The PCS 7 AS connection table contains exactly one row per logical relationship, with the partner IP pointing to the single CPU's CP 443-1 or integrated PROFINET interface.
WinCC Tag Integration for Display
After the GET block populates DB 200 on the PCS 7 H-Station, expose each DB word as a WinCC tag:
- Open the WinCC Explorer on the OS project (in the multiproject) and select Tag Management → SIMATIC S7 PROTOCOL SUITE → TCP/IP.
- Right-click the TCP/IP driver and choose System Parameter → Logical Device Names. Ensure the CP 1613 / CP 1623 / softnet S7 LAN is assigned to the OS application.
- Create a new connection in the TCP/IP channel pointing to the H-Station CPU rack/slot.
- Add tags of type
Binary Tag,Unsigned 16-bit,Signed 16-bit, orFloating-point 32-bit IEEE 754as required. The address syntax isDB200,DW0for double-word at byte offset 0,DB200,DBW10for word, andDB200,DBX5.0for bit. - Compile the OS, run the WinCC Graphics Runtime, and verify the values update cyclically.
For WinCC faceplates, use the standard PCS 7 driver block chain so that alarms, trending, and operator messages are automatically generated.
Alternative: OPC Connectivity
If the standalone station must communicate with multiple HMI clients, or if the PCS 7 ES is not available on every site, OPC connectivity provides a server-based alternative:
- Install SIMATIC NET OPC Server on a dedicated PC station or on the OS server.
- Configure an S7 connection from the OPC server to the standalone S7-400.
- Add an S7 connection from the OPC server to the PCS 7 OS (or HMI on the standalone station).
- Browse the OPC tag space in WinCC via the OPC channel; map tags directly.
The OPC approach decouples WinCC from any changes on the PCS 7 AS program, at the cost of additional licensing (SIMATIC NET SOFTNET-S7 or HARDNET-S7) and an extra PC.
SIMATIC PC Station Reference
Where a SIMATIC PC station is used as an OS or as an OPC gateway, the configuration pattern follows the SIMATIC PC Station model. The PC station is inserted in NetPro with a virtual IE interface (e.g., IE General) and a software PLC or WinCC Runtime application. Detailed configuration steps for S7-300, S7-400, S7-1500, and PC stations in TIA Portal V20 are documented at Siemens TIA Portal V20 - SIMATIC PC Station configuration.
The same engineering rules apply when migrating a PCS 7 V7.0 design to PCS 7 V9.x or V10: NetPro connection IDs are preserved, and the PC station must be inserted into the multiproject as a separate object.
Diagnostics and Verification
After download and CPU restart, validate the connection in the following order:
- On the PCS 7 ES, open Online → Accessible Nodes. The H-Station's CP 443-1 and the standalone station's CP must both respond to a node ping.
- In the H-Station online view, open the connection table (right-click CP → Connection Status). The state should be ESTABLISHED for both H CPUs.
- Force a value in the standalone station's DB 100 and watch it appear in the PCS 7 DB 200 within one cycle (typically 1 to 2 seconds for a 1-Hz REQ pulse).
- In the PCS 7 OS, open the WinCC tag diagnosis (Ctrl+F11 in Graphics Designer) and confirm that the DB 200 tags show the expected values.
- Trigger a H-System failover (pull the active CPU's power or disable the synchronization link). The connection should re-establish on the standby CPU within the configured monitoring time, and WinCC tags should continue updating without operator intervention.
Diagnostic Buffer Entries
Common diagnostic buffer entries for S7 connections on the CP 443-1:
| Event ID | Meaning | Remediation |
|---|---|---|
| 0x0001 (Connection established) | Normal | None. |
| 0x0002 (Connection terminated) | Partner or network unreachable | Check partner IP, subnet mask, switch port status. |
| 0x001E (Connection aborted - resource error) | Partner CPU overloaded or PUT/GET job rejected | Check partner CPU scan time and number of active jobs. |
| 0x0038 (Partner not reachable - timeout) | No response within 10 s | Verify CP firmware, route, and partner CPU state (RUN/STOP). |
Troubleshooting Matrix
| Symptom | Likely Cause | Verification | Resolution |
|---|---|---|---|
| Connection status shows IDLE | Connection not downloaded to CPU | Check NetPro download status of both H CPUs | Re-download NetPro to both H CPUs |
| GET block reports STATUS = 0x0001 and ERROR = 0 | No new data since last read (normal) | Monitor NDR bit over time | No action; NDR toggles on every successful read |
| GET STATUS = 0x80C3, ERROR = 1 | Partner address not reachable / wrong connection resource | Cross-check partner rack/slot in NetPro | Correct rack/slot of partner CPU; recompile NetPro |
| GET STATUS = 0x80A1, ERROR = 1 | Partner DB does not exist or is too short | Open partner project, verify DB number and length | Recreate partner DB with sufficient length; reload partner CPU |
| WinCC tags show "connection failed" | WinCC channel not bound to a working CP or softnet driver | Check WinCC channel diagnosis | Assign correct softnet license, verify CP assignment in Set PG/PC Interface |
| Values update on H CPU 0 but not H CPU 1 after failover | PUT/GET instance DB lost on standby due to CFC compile | Compare instance DBs on both CPUs | Mark instance DB as "non-runtime-modifiable" or re-download |
| Latency > 5 seconds | OB35 cycle set too slow or REQ pulse dropped | Measure OB35 scan time | Reduce OB35 cycle to 100 ms; use a separate OB for the communication trigger |
Safety and Operational Notes
- Do not place the S7 communication blocks in OB1 if the program is part of a safety-related application; use a separate OB35 or OB82 cycle to keep the safety stack intact.
- When reading from a non-PCS 7 station, the data must be treated as non-safety by default. If the values feed safety logic, route them through a certified safety block (e.g., F-input in a F-CPU).
- Network segmentation: keep the PCS 7 OS server, ES, and AS on the same plant bus; place the standalone station on the same VLAN or subnet to allow RFC 1006 routing.
- Document the connection IDs and partner IPs in the PCS 7 plant documentation so that future modifications remain traceable.
FAQ
What is the difference between a specified and unspecified S7 connection in NetPro?
A specified S7 connection is configured with both endpoints (local and partner) in NetPro, and the CPU automatically establishes it on startup. An unspecified S7 connection only defines the local endpoint; the partner IP, rack, slot, and connection resource are supplied at runtime by the PUT/GET block parameters. Use unspecified connections when the partner station is not part of the PCS 7 multiproject.
Do I need a dummy CPU placeholder for a single S7-400 station?
No. A dummy CPU is only required when the partner station hardware is not yet available and you need to pre-document the connection. When both the PCS 7 H-Station and the standalone S7-400 are real and the IP, rack, and slot are known, configure the connection directly in NetPro without a dummy.
Can the standalone S7-400 program remain in LAD while the PCS 7 AS is programmed in CFC?
Yes. PCS 7 uses CFC and SFC for the AS program, and the standalone S7-400 can use any STEP 7 language (LAD, FBD, STL) because only the data interface (DB numbers and offsets) must match the PUT/GET address parameters. The two projects remain independent.
How much data can a GET block transfer per call between two S7-400 stations?
For S7-400 to S7-400 communication, the GET block supports up to 160 bytes per call in the standard S7-400 firmware. For larger volumes, use BSEND/BRCV (SFB/FB 12/13), which can transfer up to 32 KB per call with handshake and segmentation.