Configuring S7-1200 GET/PUT Communication with Sinumerik 828D

1. Integration Overview

The Sinumerik 828D CNC integrates a SIMATIC S7-300-compatible PLC subsystem on the NCU (Numerical Control Unit). This built-in PLC exposes a standard S7 communication endpoint that any external S7-1200 controller can reach using the standard SIMATIC GET and PUT instructions defined in the S7-1200 system manual. The integration allows a separate S7-1200 station to read flags, data blocks, and inputs from the 828D-PLC, and to write back program numbers, mode changes, and user data without any additional gateway hardware beyond an industrial Ethernet switch.

The communication path uses ISO-on-TCP (RFC 1006) as transport and the S7 communication protocol on top. The S7-1200 acts as the S7 client; the 828D-PLC acts as the S7 server. Up to 16 S7 connections can be configured on a single 828D-PLC, of which connection resources 01..03 are reserved for HMI, 04..08 for PG/OP, and 09..16 for general S7 communication. An S7-1200 PUT/GET pair normally consumes one or two of these connection resources.

2. Prerequisites

Before commissioning, confirm that the following hardware, firmware, and software components are available and that they meet the minimum version requirements.

3. Network Topology

The 828D-PLC communicates on the customer network via the X130 port on the NCU. The default IP address of the X130 port is 192.168.214.1 with subnet mask 255.255.255.0. The S7-1200 must be assigned an IP address from the same subnet, and the subnet must not collide with the service network X120 (192.168.200.x) that connects the 828D to the MCP and handheld terminal.

Place a single industrial Ethernet switch between the S7-1200, the PG, and the X130 port of the 828D. Direct crossover cabling works for point-to-point commissioning but is not recommended in production.

4. Step-by-Step: Configuring the S7 Connection in TIA Portal

4.1 Add the S7-1200 CPU and 828D as "Unspecified" S7 Partner

1. In the TIA Portal project tree, open Devices & Networks and add the S7-1200 CPU (e.g., CPU 1214C DC/DC/DC, 6ES7214-1AG40-0XB0).
2. Right-click Devices & Networks > Add new device > PLC & HMI > SIMATIC S7-300 > CPU 317 placeholder, or use Add unspecified S7-PLC. The 828D-PLC appears in the network as an Unknown S7 partner; TIA Portal cannot import its GSDML because the 828D-PLC is internal to the NCU and has no PROFINET device descriptor.
3. Open the Devices & Networks editor and switch to Network view. Connect the S7-1200 PROFINET interface to the same subnet as the 828D's X130 port.

4.2 Define the S7 Connection

1. Select the S7-1200 CPU in the network view. In the inspector window, choose Properties > S7 communication > S7 connections and click Add new S7 connection.
2. Set Partner = Unknown, Interface = PROFINET interface, and enter the partner IP address: 192.168.214.1.
3. Open Address details on the S7-1200 side:
   • Local TSAP: enter any free TSAP, e.g. 10.01 (rack 0, slot 1) for the S7-1200.
   • Partner TSAP: enter 03.02 (connection resource 03, slot 2). Connection resource 03 is the first free S7 server connection on the 828D-PLC after the reserved HMI and PG/OP resources; slot 2 corresponds to the integrated PLC 317 of the 828D-PLC.
4. Confirm with OK and compile the project.

4.3 Rack/Slot Assignment Reference

5. Programming GET and PUT in the S7-1200

The S7-1200 instruction set contains GET and PUT as standard SIMATIC instructions. The full instruction description is in the S7-1200 system manual: GET and PUT (Read and write from a remote CPU).

5.1 GET Instruction (Read from 828D-PLC)

Use GET to read data from a remote S7 CPU. The remote CPU can be in either RUN or STOP mode. STEP 7 automatically creates an instance DB when the instruction is inserted.

Block signature in LAD/FBD:

  +-----------+
  |   GET     |
  |           |  REQ    := M0.0    (one-shot trigger)
  |           |  ID     := W#16#1  (connection ID from S7 connection table)
  |           |  ADDR_1 := P#M100.0 BYTE 1  (remote source area, e.g. 828D M100.0)
  |           |  RD_1   := P#DB20.DBX0.0 BYTE 1 (local destination buffer)
  |           |  NOP    :=           (not used in this example)
  +-----------+

Sample parameters:

• REQ: boolean, edge-triggered; one execution reads one data record.
• ID: W#16#1 must match the connection ID generated by TIA Portal when the S7 connection was created.
• ADDR_1..ADDR_4: up to four remote address areas per call, e.g. P#M100.0 BYTE 1 for one byte of 828D-PLC flags, or P#DB1700.DBX1000.0 BYTE 4 for the program-list data.
• RD_1..RD_4: local S7-1200 area (DB, M, I, Q) that receives the data.
• DONE, ERROR, STATUS: status outputs.

5.2 PUT Instruction (Write to 828D-PLC)

  +-----------+
  |   PUT     |
  |           |  REQ    := M0.1
  |           |  ID     := W#16#1
  |           |  ADDR_1 := P#DB1700.DBX1000.0 BYTE 2 (program number to 828D)
  |           |  SD_1   := P#DB21.DBX10.0 BYTE 2  (local source: desired program number)
  +-----------+

5.3 Connection Status Word Mapping

6. 828D-Side Configuration

6.1 Machine Data MD 51041 – ENABLE_PROGRAM_LIST

To allow the S7-1200 to change the running program on the 828D, the program list must be enabled. The relevant machine data is:

Procedure to enable:

1. Place the 828D in commissioning mode (NCK switch or password if protected).
2. Open Start-up > Machine Data on the HMI.
3. Search for MD 51041 and change the value from 0 to 1.
4. Press OK and reset NCK.
5. Save the data: Save data > NCK reset (po) > Save to CF card or the equivalent in the active user interface.

6.2 Accessing DB1700

DB1700 is the predefined interface data block that mirrors the program list. The structure is fixed by the Sinumerik PLC basic program; engineers must not extend DB1700 with custom variables.

To select a program from the S7-1200, write the program number to DB1700.DBX1000.0 as a 16-bit INT and pulse the start bit DB1700.DBX1002.0 for one PLC cycle.

7. Program-Selection Example

Goal: the S7-1200 selects program /MPF/100.MPF on the 828D, which corresponds to the program list entry index 100 (decimal). The actual mapping from list index to file name is defined in the program list of the 828D; engineers configure the list in Program Manager > NC Select.

PUT call from the S7-1200 (in SCL):

// S7-1200 SCL – request program change on 828D
"dbCtrl".progNumber := 100;        // INT, destination area in DB1700
"dbCtrl".startBit   := TRUE;       // pulse
PUT_DB.REQ          := TRUE;
PUT_DB.ID           := 1;          // connection ID from TIA Portal
PUT_DB.ADDR_1       := P#DB1700.DBX1000.0 BYTE 2;
PUT_DB.SD_1         := P#"dbCtrl".progNumber BYTE 2;

// After one cycle, clear the start bit
IF PUT_DB.DONE OR PUT_DB.ERROR THEN
  "dbCtrl".startBit := FALSE;
  PUT_DB.REQ        := FALSE;
END_IF;

GET call from the S7-1200 to read the active program back for verification:

GET_DB.REQ    := cycleTrigger;
GET_DB.ID     := 1;
GET_DB.ADDR_1 := P#DB1700.DBX1004.0 BYTE 4;  // active number + status
GET_DB.RD_1   := P#"dbStatus".activeNumber BYTE 4;
IF GET_DB.NDR THEN
  // Update local status to HMI / SCADA
END_IF;

8. 828D vs 808D Compatibility Matrix

9. PN/PN Coupler Alternative (828D Only)

For projects that already use a PN/PN coupler (e.g., 6ES7158-3AD10-0XA0) to bridge two PROFINET networks, the 828D-PLC can be exposed on the coupler side and made visible to a S7-1500 (or S7-1200) on the other side. A reference example is published on Siemens Industry Online Support:

• SIOS entry ID 88561118: Data exchange between 828D and a SIMATIC S7 controller over a PN/PN coupler.

The example originally targets an S7-300, but the GSD-based integration works the same for an S7-1200. The 808D does not expose a PROFINET device role required by the PN/PN coupler, so the alternative is direct PUT/GET only.

10. Diagnostics and Common Error Codes

The STATUS output of GET and PUT returns a 16-bit word. The most relevant codes for an 828D integration are:

For 828D-side diagnostics, the PLC diagnostic buffer in the HMI (under Diagnostics > PLC) reports connection establishment, with a partner TSAP that must match the S7-1200 configuration.

11. Troubleshooting Matrix

12. Verification Procedure

1. From the PG, ping the 828D's X130 IP address (default 192.168.214.1) to confirm layer 3 reachability.
2. Download the S7-1200 project and place the CPU in RUN.
3. Trigger a single GET to read one byte from 828D M100.0. Confirm STATUS = 0x0001 and the destination DB has the expected value.
4. Trigger a PUT to write a program number into DB1700.DBX1000.0 and pulse the start bit. Watch the 828D HMI; the program list should change to the new program index within ~500 ms.
5. Read DB1700.DBX1004.0 (active program number) and confirm it matches the number just written.
6. Open Diagnostics > PLC > Connection list on the 828D HMI and verify the partner TSAP equals the S7-1200 local TSAP (e.g. 10.01).
7. Run a 24-hour soak test: poll GET every 100 ms, log any non-zero STATUS, and verify no connection drops appear in the S7-1200 diagnostic buffer.

13. Field-Proven Best Practices

• Use a single S7 connection with multiple ADDR_x/RD_x pairs per call before opening additional connections, to keep the 828D connection-resource count low.
• Trigger PUT/GET with a one-shot edge, not with a level-controlled variable; otherwise the instruction retries every scan and may block other communication.
• Always cross-check the 828D-PLC operating state before issuing program change commands; some 828D software versions require the NCK to be in a specific state (e.g., reset or ready) to accept a new program index.
• For 808D projects, verify with the 808D programming manual whether the user PLC includes DB1700 by default; older builds require a manual instantiation.
• Document the partner TSAP on a label inside the control cabinet so maintenance engineers can match the S7 connection on the HMI without re-engineering.