Configuring S7-1200 TCP Communication to UR Dashboard Server

Configuring Siemens S7-1200 TCP Communication to Universal Robots Dashboard Server in TIA Portal

Universal Robots e-Series controllers (UR3e, UR5e, UR10e, UR16e, UR20, UR30) expose a plaintext Dashboard Server on TCP port 29999 that accepts remote scripting commands such as power on, brake release, play, and close safety popup. When integrating a UR cobot with a Siemens SIMATIC S7-1200 (or S7-1500) controller, the PLC must act as a TCP client using the TCON, TSEND, and TRCV Open User Communication blocks. Field deployments repeatedly surface four problems: (1) connection ID collision producing error 80A3, (2) incorrect end-of-line terminators, (3) leading garbage bytes corrupting the first command, and (4) missing receive supervision. This guide consolidates the working configuration and root-cause fixes documented across multiple production cells.

1. Architecture Overview

The Dashboard Server is a one-line ASCII command interpreter. Each command must terminate with a carriage-return plus line-feed combination (\r\n, hex 0D 0A). Some legacy URScript transports accept a lone \n (hex 0A), but the e-Series Dashboard Server is strict and rejects commands that arrive without proper framing.

Reference the SIMATIC S7-1500 documentation portal for general Open User Communication guidelines, which also apply to S7-1200. The S7-1200 uses the same instruction set but is limited to eight active Open User Communication connections per CPU.

2. Prerequisites

1. Hardware: SIMATIC S7-1200 CPU 1212C, 1214C, 1215C, or 1217C, or any S7-1500 CPU. The PROFINET port of the CPU is used for TCP traffic — no CP required.
2. Firmware: S7-1200 firmware V4.2 or later (V4.4 recommended for TLS offload stability). S7-1500 firmware V2.0 or later.
3. Software: TIA Portal V15.1 or later (V16, V17, V18 confirmed working with the same block parameter set).
4. Network: PLC and UR controller on the same subnet, switch latency < 5 ms. UR set to fixed IP (Static) under Settings → System → Network.
5. UR Dashboard Server: Enabled by default on port 29999. Verify with telnet 192.168.1.10 29999 from a laptop; type help\r\n and confirm a list of commands returns.
6. Data block: An instance DB for TCON and a separate PLC_Connection_DB of type TCON_IP_V4 (S7-1200) or TCON_IP_RFC (S7-1500 firmware < V2.5).
7. Receive buffer: A global DB with Array[0..100] of Char or Array[0..255] of Byte for TRCV.

3. TCON Configuration — Establishing the TCP Connection

The TCON instruction establishes and monitors the TCP connection. The most common production bug is reusing connection ID 1, which conflicts with the implicit S7 communication connection reserved by the CPU for online / HMI / PUT-GET. Always assign IDs in the range 10..63 for Open User Communication.

3.1 Connection ID Selection

3.2 Connection Description DB (PLC_Connection_DB)

Right-click in the program block folder and create a new DB. Change the type to TCON_IP_V4 (S7-1200) or TCON_IP_RFC (S7-1500). Fill in the following values:

3.3 TCON Block Wiring

       +--------+
REQ -->|        |
ID  -->|  TCON  |--> DONE  (one-shot pulse)
CON  -->|        |--> BUSY
DB   -->|        |--> ERROR
       +--------+     STATUS

• REQ: Trigger with a positive edge from a startup tag, or use FirstScan with a one-shot to avoid re-issues.
• ID: 10 (matches the connection description DB).
• CONNECT: Pointer to the PLC_Connection_DB (use absolute DB number or symbolic name).
• DONE: Latch a tag (Conn_Established) used as the interlock on TSEND.

4. TSEND Configuration — Issuing Dashboard Commands

Once Conn_Established is true, TSEND transmits the command string. Build the command in a global DB so you can change it from HMI / recipe without rewriting the program.

4.1 Send Buffer Layout

DATA_BLOCK "UR_Cmd_DB"
  STRUCT
    CmdString : ARRAY[0..100] OF CHAR;   // populated from HMI or program
    CmdLen    : INT;                    // exact length including $L bytes
    SendBusy  : BOOL;
  END_STRUCT;
END_DATA_BLOCK

4.2 TSEND Block Wiring

       +--------+
REQ -->|        |
ID  -->|  TSEND |--> DONE
DATA-->|        |--> BUSY
LEN -->|        |--> ERROR
       +--------+     STATUS

5. The $L Terminator Problem

The Dashboard Server is strict about framing. Field testing reveals the following behavior:

5.1 Root Cause

The S7-1200 PROFINET firmware leaves the TCP send buffer dirty after the handshake. The first TSEND call after TCON DONE carries one to four leading garbage bytes. Plugging a PC with Wireshark on the line confirms the anomaly: bytes such as 0x00 0x0E or random ASCII arrive before the actual command, and the UR parser logs:

could not understand: ⌂⌂brake release

Prefixing the command with \n (hex 0x0A, often represented as $L in TIA string syntax) flushes the dirty buffer and gives the UR parser an unambiguous line terminator before the first real character.

5.2 Worked String Examples

6. TRCV Configuration — Receive Supervision

Although not strictly required to drive the robot, installing a TRCV block is strongly recommended. The Dashboard Server replies to every command with a status line such as brake release (echo) or Robotmode: POWER_OFF. Capturing these responses lets you verify the robot actually accepted the command, distinguish a hardware emergency stop from a TCP timeout, and log operator actions.

6.1 Receive Buffer

DATA_BLOCK "UR_Rcv_DB"
  STRUCT
    RcvBuffer : ARRAY[0..100] OF CHAR;
    RcvLen    : INT;
    RcvReady  : BOOL;
  END_STRUCT;
END_DATA_BLOCK

6.2 TRCV Block Wiring

• EN_R: TRUE (always enabled while connection is up)
• ID: 10 (same as TCON/TSEND)
• LEN: 100 (receive up to 100 bytes per call; TRCV will return as soon as data arrives)
• DATA: UR_Rcv_DB.RcvBuffer[0]
• ADHOC: FALSE on S7-1200; TRUE if you want immediate processing on S7-1500

On NDR (new data received) rising edge, copy RcvBuffer to a log ring buffer and clear RcvReady. Most Dashboard responses are under 64 bytes; if you expect long responses (e.g. program save), increase the buffer to 256 and LEN to 256.

7. Interlock and Sequencing

A typical production sequence avoids sending a new command before the previous one has been acknowledged. The ladder below shows the canonical pattern:

// Power-on sequence
      Conn_Established        CmdAck
          |                    |
A1: ---| |---------|/|---( S )-- Q_PowerOnCmd        // latch request
      Q_PowerOnCmd  Conn_Established
          |           |
B1: ---| |----------| |---( TSEND )  REQ             // fire TSEND
      TSEND.DONE
          |
C1: ---| |----------( R )-- Q_PowerOnCmd             // clear request on DONE

Repeat for brake release, play, close safety popup. Add a 200 ms minimum interval timer between consecutive TSEND calls to prevent back-to-back bursts that overrun the Dashboard parser.

8. Error Code Reference

9. Troubleshooting Matrix

10. Verification Procedure

1. Power on UR controller. Wait until the teach pendant shows the home screen.
2. Open TIA Portal online. Add the PLC to the online view.
3. Place the project online with watch tables for TCON.DONE, TSEND.BUSY, TSEND.DONE, and UR_Rcv_DB.RcvBuffer.
4. Trigger the TCON block. Verify DONE latches to TRUE within 1 second.
5. Set UR_Cmd_DB.CmdString = '$Lpower on$L' and CmdLen = 12.
6. Trigger TSEND. Verify robot enters POWER_ON state on the teach pendant.
7. Trigger '$Lbrake release$L' with LEN = 17. Joints should be free to move.
8. Trigger '$Lplay$L' with LEN = 7. Loaded program starts.
9. Check UR_Rcv_DB.RcvBuffer in the watch table — you should see UR echoes of the commands.
10. Run a 60-minute soak test, sending one command every 5 minutes, monitoring STATUS for any 80Ax codes.

11. S7-1500 Notes

For SIMATIC S7-1500 CPUs the same three blocks apply. Differences:

• Connection description type is TCON_IP_RFC (firmware < V2.5) or TCON_IP_V4 (V2.5+). The same octet-style address fields are used.
• The S7-1500 allows up to 64 Open User Communication connections, so ID collision with the system range (1..9) is rarer but still possible. Keep ID ≥ 10.
• Set TRCV.ADHOC = TRUE to receive partial frames immediately, useful when UR sends short status strings.
• On S7-1500 the $L prefix is still recommended for the first command after TCON. The dirty-buffer bug has been observed on S7-1500 firmware V2.0..V2.6 but disappears in V2.8 onward with PROFINET interface firmware V5.2.

12. Safety Considerations

Per ISO 10218-1 and ISO/TS 15066, collaborative robot applications must remain in the validated configuration when commanded remotely. Re-validate the risk assessment if you start programs automatically after teach pendant programming.

13. FAQ