Configuring PUT/GET Communication on S7-300 vs S7-1500 PLCs

Overview

PUT/GET is the Siemens designation for the S7 communication services used to read (GET) and write (PUT) data areas on a remote SIMATIC CPU over Industrial Ethernet. Both the S7-300 and S7-1500 CPU families implement these services, but their default state, activation procedure, and system block interface differ significantly. The S7-300 CPU — for example, the widely deployed 6ES7317-2EK14-0AB0 (CPU 317-2 PN/DP) — accepts PUT/GET traffic without any project-level enablement. The S7-1500 CPU, by contrast, blocks PUT/GET by default starting with firmware V3.1 and requires explicit opt-in via TIA Portal. This reference walks through both platforms, the FB14/FB15 programming interface on S7-300, the TIA Portal enablement procedure on S7-1500, NetPro S7 connection configuration, payload limits, security posture, and the migration path between the two families.

PUT/GET Communication Model: S7-300 vs S7-1500

S7-300 PUT/GET: Always-On Architectural Model

The S7-300 architecture predates the granular access-control model introduced with the S7-1500 generation. Every S7-300 CPU that exposes an industrial Ethernet interface — whether through an onboard PROFINET port (CPU 315-2 PN/DP, 317-2 PN/DP, 319-3 PN/DP) or via the CP 343-1 family — accepts incoming S7 communication frames targeting PUT/GET services without any project-level enablement. There is no property sheet, no bit in the CPU properties, and no NetPRO checkbox to flip. From a security perspective this is an always-on, always-permitted model.

Supported S7-300 CPUs

• CPU 312C, 312, 314, 314C, 315, 315-2 PN/DP, 317-2 PN/DP, 319-3 PN/DP
• All S7-300 CPUs paired with CP 343-1 Lean / CP 343-1 / CP 343-1 Advanced / CP 343-1 ERPC
• CPU 31x PN/DP variants with at least firmware V2.x (older firmware requires CP 343-1)

Why the S7-300 Cannot Behave Like an S7-1500 Toggle

The "Permit access with PUT/GET communication from remote partner" checkbox does not exist on S7-300. The CPU's firmware simply has no facility to reject a PUT or GET request. The only way to restrict PUT/GET on a live S7-300 system is network-level filtering — for example, an industrial firewall (SCALANCE S, mGuard, or Cisco IE) configured to drop TCP/102 S7 traffic from unauthorized source IPs. Application-level restrictions via know-how protection do not apply to PUT/GET; they only protect S7 program blocks from upload.

S7-1500 PUT/GET: Explicit Access Control

Starting with S7-1500 CPU firmware V3.1 and S7-1200 CPU firmware V4.7, Siemens introduced an explicit permission flag for legacy PUT/GET communication. The default state is disabled — meaning a TIA Portal project shipped without explicitly enabling the option will reject any PUT/GET request from a remote partner, regardless of whether the request originates from an S7 client, an OPC server, or an HMI panel.

Per the official Siemens Knowledge Base entry 109925755 — How do you activate PUT/GET access on an S7-1500 CPU from FW V3.1 or S7-1200 CPU from FW V4.7?, the activation path is:

1. Open the device configuration of the S7-1500 / S7-1200 CPU in the TIA Portal project.
2. In the inspector window, navigate to Properties > Protection & Security.
3. In the section navigation on the left, select Connection mechanisms.
4. Activate the option "Permit access with PUT/GET communication from remote partner".
5. Compile the hardware configuration (Compile > Hardware (rebuild all)) and download it to the CPU.

The TIA Portal reference manual (PUT/GET: Restrictions in the CPU) documents that even with the option enabled, the partner must still be reachable at TCP/102 and the CPU must have free connection resources. Disabling the option does not block HMI communication via S7 connections explicitly configured in TIA Portal — only the legacy unconfigured PUT/GET requests.

Programming FB14 (GET) and FB15 (PUT) on S7-300

The S7-300 PUT/GET services are exposed through two communication function blocks that ship in every S7-300 CPU's system data. The reference sample program is published by Siemens as entry 18924842 — S7 Communication with blocks FB14 (GET) and FB15 (PUT) of the CPU 317-2 PN/DP.

FB14 GET — Interface Definition

FB15 PUT — Interface Definition

Structured Text Sample: GET 10 Words from Partner DB200 into Local DB100

// Trigger GET on rising edge of bTrigRead
IF bTrigRead THEN
    FB14_GET.REQ := TRUE;
    FB14_GET.ID := W#16#1;                        // connection ID 1 from NetPro
    FB14_GET.ADDR_1 := P#DB200.DBX 0.0 WORD 10;   // partner: DB200, 10 words
    FB14_GET.RD_1 := P#DB100.DBX 0.0 WORD 10;     // local : DB100, 10 words
    FB14_GET();

    IF FB14_GET.NDR THEN
        bTrigRead := FALSE;                       // single-shot complete
        bGetNdr   := TRUE;
    END_IF;

    IF FB14_GET.ERROR THEN
        wGetStatus := FB14_GET.STATUS;            // capture for HMI diagnostics
        bGetErr    := TRUE;
    END_IF;
END_IF;

Ladder Logic Equivalent (FB14 GET)

|    bTrigRead     FB14          |
|---[P]----------|REQ   NDR|----( )--|
|                |             |        |
|  W#16#1--------|ID   ERROR|----( )--|
|                |             |        |
|  P#DB200       |ADDR_1      |        |
|  DBX0.0 WORD10 |             |        |
|                |             |        |
|  P#DB100       |RD_1  STATUS|--[MW10]|
|  DBX0.0 WORD10 |             |        |

NetPro S7 Connection Configuration

For S7-300 PUT/GET traffic, the S7 connection must be configured in NetPro. Per the Siemens PDF 82212115 — S7 Communication with PUT/GET (S7-300 Sequencer), the procedure is:

1. In SIMATIC Manager, open the project containing the S7-300 station.
2. Launch NetPro via Options > Configure Network.
3. In the S7-300 station's connection table, insert a new S7 connection.
4. Set the partner to Unspecified (for partner not in same project) or select a known partner station.
5. Confirm the connection type is S7 connection.
6. Note the local ID (Block ID) parameter — this is the value passed to FB14/FB15 ID input.
7. Compile and download the connection configuration to the CPU.

PC and HMI Client Integration

PUT/GET on the S7-300 has been the de facto integration protocol for third-party HMI/SCADA software that speaks the S7 protocol natively. Common clients include:

• LabVIEW DSC / LabVIEW Datalogging via the OPC servers from Siemens or third-party drivers. LabVIEW itself does not speak S7 natively; it relies on an OPC or TCP server that exposes PUT/GET as the lowest-common-denominator transport.
• WinCC flexible / TIA Portal WinCC HMI panels communicating with S7-300 (HMI tags use PUT/GET under the hood).
• Kepware, LibNoDave, Snap7, NodeS7 — third-party drivers that wrap PUT/GET as the transport for read/write requests.

For the LabVIEW integration scenario described in the original project context (traceability PC reading/writing to a PLC), three options are available:

The third option (TCP socket with JSON payloads) bypasses PUT/GET entirely and is recommended for new S7-1500 projects where PUT/GET must remain disabled for security reasons. S7-300 supports this via the CP 343-1 Lean or higher, using TCON, TSEND, and TRCV (FB186/FB187/FB188) with ISO-on-TCP or TCP protocol.

Security Posture and Hardening

Data Payload Limits and Performance

The classic S7-300 PUT/GET payload is capped at 160 bytes per call when using the standard FB14/FB15. To transfer larger datasets, the calling code must either segment into multiple calls or chain the ADDR_1..ADDR_4 / RD_1..RD_4 pointers. Per the Siemens Knowledge Base entry 49450152 — How do you program FB14 (GET) and FB15 (PUT) in S7-300 to transfer more than 160 bytes?, the chained variant allows up to 4 × 160 = 640 bytes per call.

Payload Comparison

Typical PUT/GET Call Cycle Time on S7-300

Values are typical measurements on an isolated PN segment. Real-world figures depend on network load, partner CPU scan time, and any intermediate switches.

Migration Considerations: S7-300 to S7-1500

When migrating a CPU 317-2 PN/DP project to an S7-1500 platform (e.g., CPU 1515-2 PN or CPU 1518-4 PN/DP), the following PUT/GET-related items must be addressed:

1. Enable PUT/GET on S7-1500 in the new TIA Portal project. Without this, every LabVIEW / OPC client that previously "just worked" will start receiving STATUS = W#16#0002 errors.
2. Replace FB14/FB15 calls with the TIA Portal "GET" and "PUT" extended instructions from the Communication > S7 Communication palette. The instance DB model is different (multi-instance capable on S7-1500).
3. Convert ANY pointers from absolute (DB200.DBX0.0) to either absolute or symbolic form. The S7-1500 uses optimized block access by default; any code that referenced %DB200.DBX0.0 must either be switched to symbolic addressing or the block must be configured with the Accessible from S7 communication / PUT-GET access without optimized block access attribute.
4. Address the S7-Graph limitation: S7-Graph optimized access is available only on S7-1500. S7-300 supports both optimized and non-optimized, but S7-1500 S7-Graph blocks are optimized by default. If the application uses S7-Graph sequences that interlock with PUT/GET, ensure the referenced data blocks are marked as accessible from S7 communication.
5. Verify connection resources. S7-1500 CPUs have a different (typically higher) number of S7 connection resources than the S7-300 they replace. Refer to the CPU-specific datasheet for the exact count.

Troubleshooting Matrix

Note: STATUS codes follow the convention documented in the S7-300 Communication Function Blocks manual. For S7-1500 PUT/GET extended instructions, the STATUS values are mapped through the standard done, busy, error, and status outputs — refer to the TIA Portal online help for the exact mapping.

Frequently Asked Questions