Configuring PROFINET Communication Between S7-1200 and S7-300/400

Overview: PROFINET Between S7-1200 and S7-300/400 PLCs

Connecting a SIMATIC S7-1200 (PROFINET-capable by default on the CPU) to a SIMATIC S7-300 or S7-400 (PROFINET via CPU PN/DP or via CP 343-1 / CP 443-1) is one of the most common migration and brownfield integration tasks. The PROFINET interface is a real-time Ethernet protocol operating at 100 Mbps full-duplex and is shared with standard TCP/IP traffic, allowing S7 communication, TCP, UDP, ISO-on-TCP (RFC1006), and Open User Communication to coexist on the same physical interface.

Because the S7-1200/S7-1500 generation uses optimized data blocks (symbolic, retentive settings, no fixed addressing in the user view) while legacy S7-300/S7-400 use classic absolute addressing, the integration requires explicit attention to DB access mode, byte order, and the connection resource model. Both sides participate as PROFINET IO Devices on the same subnet, but the user-program-level communication is independent of PROFINET IO and is configured through the TIA Portal "Devices & Networks" editor under "Connections."

Prerequisites

Before configuring the link, verify the following items on both PLC stations:

The TIA Portal instruction set for cross-generation communication is documented in the official Siemens instructions reference: Instructions for communication tasks (S7-300, S7-400, S7-1500). This is the canonical reference for PUT/GET, TSEND/TRCV, TUSEND/TURCV, USEND/URCV, BSEND/BRCV, and ISO-on-TCP instruction usage on legacy controllers.

Network Architecture

The simplest topology is two CPUs on a single Ethernet subnet. PROFINET does not require a dedicated switch for two-node point-to-point links, but a managed switch is recommended when scaling beyond two devices, when adding PROFINET IO, or when using MRP redundancy rings.

If the S7-300 has no built-in PN interface, install a CP 343-1 (e.g., 6GK7343-1EX30-0XE0 for FW V3.x with up to 16 S7 connections) or CP 343-1 Advanced (6GK7343-1GX30-0XE0) in slot 4. S7-400 equivalent is CP 443-1 (6GK7443-1EX20-0XE0) or CP 443-1 Advanced.

TIA Portal Project Setup

1. Open TIA Portal and create a new project. Use "Project > New" and give it a meaningful name (e.g., "PN_S71200_to_S7300").
2. Add the S7-1200 first via "Add new device > SIMATIC S7-1200 > CPU > [exact MLFB] > [exact firmware]". Use the same procedure for the S7-300 CPU or for a CP 343-1 inside an S7-300 station.
3. Open "Devices & Networks" from the project tree. The S7-1200 and the S7-300 each appear as a device.
4. Switch to "Network view" (top tab). Click the PROFINET port of the S7-1200, hold, and drag to the PROFINET port of the S7-300. A green line indicates a successful connection. This creates a PROFINET subnet automatically.
5. Right-click the line and choose "Properties > PROFINET subnet" to verify the subnet IP range (e.g., 192.168.0.0/24).
6. For each station, open "Properties > PROFINET interface > Ethernet addresses" and assign the static IP and PROFINET device name listed in the architecture table.
7. Save the project. Compile both stations with "Compile > Hardware (rebuild all)".

Selecting the Communication Type

Open "Devices & Networks > Connections" tab. TIA Portal offers the following connection types relevant to this scenario:

For most modernization projects where you need to read a few hundred bytes from an S7-300 and write them into an S7-1200 (or vice versa), the S7 connection with PUT/GET is the lowest-effort option. For payloads >160 bytes or high-frequency streaming, ISO-on-TCP or TCP is preferred.

Configuring an S7 Connection (PUT/GET)

1. In "Devices & Networks > Connections", click the S7-1200 PROFINET port to select it as the local endpoint, then drag a connection line to the S7-300 PROFINET port. A "Select connection type" dialog appears.
2. Choose "S7 connection". A connection object is created. Open its properties.
3. In the properties dialog, verify the local and partner interface, IP, and that "Active connection establishment" is set on the station that initiates the call (typically the one calling PUT/GET).
4. Note the "Local ID" (connection ID) - it is a hex value used by the PUT/GET blocks. Typical IDs are 1, 2, 3, etc.
5. Open the S7-1200 program blocks. From "Instructions > Communication > S7 Communication", drag "PUT" and "GET" onto a network.

S7-1200 PUT block (writing to S7-300):

// PUT - write 10 bytes from local DB1 to remote DB10
// Connection ID: 1 (must match the configured S7 connection)
// S7-1200 acts as the active partner
   "PUT_DB".REQ        := TRUE;            // Edge-triggered start
   "PUT_DB".ID         := 1;               // Local connection ID
   "PUT_DB".DONE       := "status".done;   // BOOL, TRUE for one cycle when complete
   "PUT_DB".ERROR      := "status".error;  // BOOL, error flag
   "PUT_DB".STATUS     := "status".status; // WORD, error code if ERROR=TRUE
   "PUT_DB".ADDR_1      := P#DB10.DBX 0.0 BYTE 10; // Remote area (in S7-300)
   "PUT_DB".SD_1       := P#DB1.DBX 0.0 BYTE 10;  // Local source area
   "PUT_DB".LEN        := 10;              // Length in bytes (max 160 for PUT)

S7-1200 GET block (reading from S7-300):

// GET - read 10 bytes from remote DB10 into local DB2
   "GET_DB".REQ        := TRUE;
   "GET_DB".ID         := 1;
   "GET_DB".DONE       := "status".done;
   "GET_DB".ERROR      := "status".error;
   "GET_DB".STATUS     := "status".status;
   "GET_DB".RD_1       := P#DB2.DBX 0.0 BYTE 10;
   "GET_DB".ADDR_1     := P#DB10.DBX 0.0 BYTE 10;
   "GET_DB".LEN        := 10;              // Max 160 bytes per area, max 16 areas

On the S7-300/400 side, the partner station automatically accepts incoming S7 connections from PUT/GET clients when the connection object is configured and downloaded. The "Permit PUT/GET access from remote partner" option must be enabled on the S7-1200 (CPU Properties > Communication > PUT/GET Communication = "Permit"). This is the default on FW V4.0+ but verify it explicitly.

Configuring Open User Communication (TCP)

For TCP or ISO-on-TCP, TIA Portal does not create connection objects in the same way as S7 connections. You build the connection descriptor (TCON block IDB) yourself or rely on the TCON wizard.

1. In the S7-1200 program, place "TCON" from "Instructions > Communication > Open User Communication".
2. Right-click TCON > "Properties > Configuration" or use the inspector to fill in: connection type (TCP = 16#0B, ISOonTCP = 16#0C), partner IP, partner port (102 for S7, 2000..65535 for free), local port (0 = automatic).
3. Use TSEND to transmit data and TRCV to receive. Both can be triggered cyclically or on event.

TCP transmit example on S7-1200 (ST):

// One-shot connection establishment
IF "first_scan" THEN
   "tccon_db".REQ := TRUE;
END_IF;

"tccon_db".CONNECT := "conn_desc"; // Filled via inspector

// Transmit when ready flag rises
IF "send_trig" AND NOT "tccon_db".BUSY THEN
   "tsend_db".REQ := TRUE;
   "tsend_db".DATA := P#DB20.DBX 0.0 BYTE 50; // up to 8192 bytes
   "tsend_db".LEN  := 50;
END_IF;

IF "tsend_db".DONE OR "tsend_db".ERROR THEN
   "tsend_db".REQ := FALSE;
   "send_trig"   := FALSE;
END_IF;

On the S7-300 side, the matching FB63 (TCON), FB64 (TSEND), FB65 (TRCV) are found in "Standard Library > Communication Blocks". Use the same connection type code: B#16#0B for TCP, B#16#0C for ISO-on-TCP. The S7-300 IDB has a different layout than the S7-1200 IDB - refer to the Siemens help on each FB block for the UDT or DATA structure layout.

For data block access compatibility, the official Siemens documentation notes that drivers handling both optimized (S7-1200/1500) and classic (S7-300/400) structures are required - the structure of the data payload must be agreed upon byte-for-byte between partners. See What is PROFIBUS/PROFINET? | Siemens I/O Protocols Explained for an overview of how protocol stacks differ across generations.

Optimized vs Classic Data Blocks

This is the most common cause of cross-generation failures. The S7-1200/S7-1500 default DB attribute is "Optimized block access" (symbolic only). The S7-300/S7-400 default is "Standard" (absolute addresses available, fixed memory layout).

To disable optimized access on a specific DB: open the DB in TIA Portal > Properties > Attributes > uncheck "Optimized block access". Recompile. The DB now exposes absolute addresses and can be referenced as P#DBx.DBX y.0 BYTE n by the legacy partner.

Downloading and Verification

1. Right-click the S7-1200 > "Download to device > Hardware and software". TIA Portal will compile and push the project to the CPU. Confirm STOP-to-RUN transition.
2. Repeat for the S7-300 station.
3. On the S7-1200, enable "Online & Diagnostics > Diagnostics > Connection diagnostics" to see active S7 connections.
4. On the S7-300, use "Online & Diagnostics > Diagnostics buffer" and look for connection establishment events ("S7 connection established / aborted").
5. Monitor the PUT/GET block instance DB online. DONE should toggle TRUE on success; STATUS = 0000 means no error. Typical STATUS values: 16#8183 = partner not reachable, 16#8184 = wrong ID/ADDR, 16#8188 = DB does not exist on partner.
6. Force a small test tag on the partner side and verify it appears on the local side within one cycle (typically 100-500 ms depending on OB1 scan time and call frequency).

Connection Resources and Limits

If connection establishment fails with STATUS 16#8183 ("No connection resource available"), either the local or partner CPU has exhausted its connection pool. Free resources by terminating unused PG/HMI sessions or by adding a CP.

Troubleshooting Matrix

Edge Cases and Field Tips

Mixing optimized and non-optimized DBs. If you cannot change a partner DB (e.g., a third-party legacy S7-300 program), use the S7-1500's "Standard access" mode for any DB that will be read by PUT/GET. For mixed deployments, mark only the boundary DBs as non-optimized; leave internal logic DBs optimized.

Firmware V2.x S7-1200. Old S7-1200 CPUs (FW V2.x) lack the PUT/GET blocks in the standard instruction library. They must be sourced from the legacy "SIMATIC S7-1200 Communication Library" example project or migrated to FW V4.x. Plan a CPU swap if firmware update is blocked by hardware revision.

CPU 315-2 PN/DP early FW. FW V2.x on 6ES7 315-2EH13-0AB0 has limited connection resources and may refuse connections if the PG port is busy. Upgrade to FW V3.3+ where applicable.

Routing through multiple subnets. If the S7-1200 is on subnet A and the S7-300 is on subnet B with a router between them, configure the default router on each CPU and add an "S7 routing" entry in TIA Portal. PG/PC must also have IP routing enabled. Use "Online > Accessible nodes" over the routing path to verify.

PROFINET IO coexistence. The same physical port can carry PROFINET IO (e.g., ET 200SP stations) and S7 connections simultaneously. The "Update time" and "Watchdog" settings for IO do not affect S7 connection timing.

OPC UA integration. If the S7-1200 also serves OPC UA clients (S7-1200 FW V4.4+ with a license), OPC UA uses its own connection resources. The S7 connection count is independent. Verify that OPC UA server is enabled (CPU Properties > OPC UA Server).

Security and Access Control

On the S7-1200 (FW V4.0+), TIA Portal introduces an access protection model with hashed passwords per CPU. The "Permit PUT/GET access from remote partner" setting is a separate toggle and is independent of the project password. Best practice for an industrial network: keep this toggle ON only on PLCs that explicitly need PUT/GET from external partners. For new development, prefer Open User Communication (TCP/ISO) with explicit TCON/TDISCON because it allows controlled lifecycle (the connection is only open when needed).

Disable unneeded services on the S7-300/400 partner: turn off Web server if not used, restrict DCP discovery with the PROFINET security settings in TIA Portal, and physically segment the plant network from the corporate network.

Performance Expectations

For deterministic sub-10 ms behavior, use PROFINET IO with an ET 200 station rather than user-data blocks. For 100 ms-class control loops with hundreds of bytes, PUT/GET is fully adequate.

FAQ