Configuring S7-1200 TCP/IP Communication with PC in TIA Portal

Overview

Open User Communication (OUC) over TCP/IP is the standard mechanism the Siemens S7-1200 family uses to exchange data with a personal computer, an HMI, a third-party controller, or another S7 CPU. The S7-1200 implements TCP as a native service of the CPU's PROFINET interface; no additional CP module is required. Two blocks drive the entire data path:

• TSEND_C — establishes the connection, sends a buffer, and tears the connection down on demand.
• TRCV_C — accepts an incoming connection, receives bytes, and closes on demand.

This article is a field-proven walkthrough written for engineers who have the CPU, TIA Portal V14, and a working Ethernet cable but cannot get a single byte across. It consolidates the S7-1200 System Manual (entry ID 109755202), the S7-1200 Easy Book (entry ID 109769928), and the programming guidelines shipped with the TIA Portal V14 installation.

Prerequisites

Connection Architecture: Client vs. Server

The S7-1200 OUC blocks do not use the classic "active vs. passive" terminology. The block configuration has a single parameter, CONNECT, which references a connection description in the project tree. The connection description itself is the deciding element: the partner that holds the destination IP address and the partner that is configured to wait for an incoming SYN is the server; the partner that issues the active open is the client.

For a PC <-> S7-1200 link, the two practical topologies are:

Either topology is supported on every S7-1200. The choice is driven by the application, not by the hardware. The block pair must be selected accordingly: if the PLC only receives, you need TRCV_C on the PLC and a TCP client on the PC. If the PLC only sends, you need TSEND_C on the PLC and a TCP server on the PC. If both directions are required, instantiate both blocks and give them distinct connection IDs (1 and 2 are the conventional choices).

Step-by-Step TIA Portal V14 Configuration

1. Create the project and insert the CPU. Open TIA Portal V14, choose Create new project, then Devices & networks → Add new device. Select the exact order number of your CPU, for example 6ES7214-1AG40-0XB0 (CPU 1214C DC/DC/DC, FW 4.0). TIA Portal will create the device with the matching firmware revision.
2. Configure the PROFINET interface. In the device view, click the green PROFINET port of the CPU. In the properties panel → Ethernet addresses, set the IP address. The default 192.168.0.1 with subnet mask 255.255.255.0 is fine for the lab. Do not check the Router box unless the PC is on a different subnet.
3. Set the connection mode. Properties → Ethernet addresses → Connection mechanisms. For a TCP/IP test against a third-party PC you must uncheck "Permit access with PUT/GET communication" if you want to be strict, but OUC itself does not require this. The "Permit access with ISO/TCP" check affects S7 communication only.
4. Add the OUC block. Project tree → PLC_1 → Program blocks → Add new block. Pick TSEND_C or TRCV_C from the Communication folder. Use a single instance DB; TIA Portal will generate it automatically.
5. Wire the connection parameter. Click the block, then in the properties inspector click the Configuration tab. The wizard creates a new connection record under Devices & networks → Connections. Set:
   • Type: TCP (for raw TCP) or ISO-on-TCP (RFC 1006, used only when both sides speak ISO-on-TCP, e.g. another S7 CPU)
   • Local end point: the CPU's PROFINET interface, port 2000 (default for TSEND_C / TRCV_C)
   • Partner end point: either "Unspecified" (PC side is the active open) or the PC's IP and port (PC side is the passive open)
6. Set the LEN and DATA parameters. Open the block's interface. LEN defines the number of bytes to send/receive. DATA is a pointer to a tag, e.g. P#DB1.DBX0.0 BYTE 100 for a 100-byte payload. When LEN = 0 the block uses the full length of the DATA area.
7. Compile and download. Project tree → PLC_1 → right-click → Compile → Download to device. The download will set the connection description; the CPU reboots only if you changed the IP address or the protection level.
8. Go online and monitor. Online → Go online. Open the block and watch the status word (STATUS, DONE, BUSY, ERROR) in the monitoring view.

PLC Sample Programs

The following Structured Text (SCL) snippets compile cleanly under TIA Portal V14 with S7-1200 firmware 4.0 or later. They assume a data block "Data" containing the tags SendBuf : ARRAY[0..99] OF BYTE, RcvBuf : ARRAY[0..99] OF BYTE, and the connection IDs are 1 for the send path and 2 for the receive path.

Receive (PLC as TCP server, PC as client)

// OB1 - Main
IF "FirstScan" THEN
    // The block handles connect/recv/disconnect on its own
    "Inst_TRCV_C".EN_R   := TRUE;     // 1 = always ready to receive
    "Inst_TRCV_C".CONT   := TRUE;     // keep the connection open after each transfer
    "Inst_TRCV_C".LEN    := 0;        // 0 = use full LEN of DATA pointer (100 bytes)
    "Inst_TRCV_C".DATA   := P#"Data".RcvBuf;   // pointer to receive buffer
    "Inst_TRCV_C".CALL   := TRUE;     // rising edge initiates the receive
END_IF;

"Inst_TRCV_C"(REQ := "Data".TriggerRecv);

Send (PLC as TCP client to a listening PC)

// OB1 - Main
"Inst_TSEND_C".CONT   := TRUE;     // keep the connection open
"Inst_TSEND_C".LEN    := 0;        // 0 = use the full DATA length
"Inst_TSEND_C".DATA   := P#"Data".SendBuf;   // pointer to send buffer
"Inst_TSEND_C".CALL   := TRUE;     // rising edge initiates the send

IF "Data".SendTrigger THEN
    "Inst_TSEND_C".REQ := TRUE;     // one-shot send
ELSE
    "Inst_TSEND_C".REQ := FALSE;
END_IF;

Sample Ladder Logic Equivalent (FBD-style block call)

      "M0.0" (REQ)      +-------+
    +--|  |----+------- |TSEND_C|-- DONE "M0.1"
    |          |   ID   +-------+
    |          +--------- EN     |  -- ERROR "M0.2"
    |                    |       +-------+
    |                    +------- DATA  ---+    P#DB1.DBX0.0 BYTE 100
    |                            LEN  = 0
    +---------------------------- BUSY "M0.3"
                                  STATUS "MW4"

PC-Side Configuration with Hercules

Hercules SETUP utility (HW Group / HW VSP3) is the de-facto field tool for verifying a TCP link to a Siemens PLC. The dialog TCP Client is used when the PLC is the server (TRCV_C waiting on port 2000); the dialog TCP Server is used when the PLC is the client (TSEND_C dialing out).

1. Open Hercules → TCP Client tab.
2. Module IP: enter the CPU's IP address, default 192.168.0.1.
3. Port: enter the port the TRCV_C is bound to, default 2000.
4. Click Connect. The status indicator turns green and Hercules reports Connected to 192.168.0.1 (2000). The CPU shows STATUS = 7000h (idle, connection established) and BUSY = 0.
5. Type a string in the Send field and press Send. The bytes appear in the CPU's Data.RcvBuf and DONE pulses for one cycle.
6. To receive from the PLC you must also instantiate TSEND_C on the PLC and start Hercules in TCP Server mode listening on the matching port (2001 by default).

Hex view in Hercules (e.g. 31 32 33 0D 0A for "123\r\n") matches exactly what the CPU receives because TCP carries bytes, not strings. If you expect a string with a length prefix (S7-1200 WSTRING/WSTRING[10] layout), remember to read the maximum length header before the actual characters; TRCV_C delivers raw bytes only.

String Handling on the S7-1200

The S7-1200 string layout is a 2-byte header (max length, current length) followed by up to 254 bytes of ASCII. The 2-byte header confuses every third-party TCP stack; the typical fix is to send the payload as a byte array and let the application layer add its own framing. The two clean options are:

For the first PC ↔ PLC link, ship a 100-byte buffer. As soon as the link works, replace it with a string and add a wrapper function that strips the 2-byte header before exposing the data to the application.

Connection Limits and Resource Planning

The S7-1200 has a fixed pool of Open User Communication (OUC) connections. The exact ceiling depends on the CPU model:

Each TSEND_C, TRCV_C, TCON, MODBUS client, MODBUS server, and OPC UA server connection consumes one slot. If you are running out of resources, the diagnostic buffer reports STATUS = 80A1h ("Connection or port is already occupied") or STATUS = 80A2h ("Local resource insufficient").

Common STATUS Codes

Windows Firewall and Network Stack

The single largest cause of a "Hercules connects, no data flows" symptom is the Windows Firewall. S7-1200 TCP traffic uses port 2000 / 2001 by default; Windows blocks inbound connections by default starting with Windows 7. The fix:

1. Control Panel → Windows Defender Firewall → Advanced settings.
2. Inbound Rules → New Rule → Port → TCP → Specific local ports 2000, 2001 → Allow the connection → Domain, Private, Public → name "S7-1200 OUC".
3. Outbound Rules: add the same ports if the PC is the server.
4. For lab use, an easier approach is to temporarily disable the firewall from an elevated command prompt: netsh advfirewall set allprofiles state off. Re-enable after the test: netsh advfirewall set allprofiles state on.

Verification Procedure

1. Open TIA Portal → Online → Go online with the CPU. Confirm the green check on the PROFINET port.
2. Open Hercules. From TCP Client, connect to the CPU IP and the configured port. Status should turn green.
3. In TIA Portal, expand the TRCV_C instance and observe STATUS. The expected value is 7000 0000 for "connection established, no active job".
4. Type HELLO in Hercules and click Send. The CPU's RcvBuf must now contain 48 45 4C 4C 4F and DONE must pulse for one OB1 cycle.
5. Trigger a TSEND_C from the PLC (e.g. by setting Data.SendTrigger = TRUE in a watch table). The bytes must appear in the Hercules Received data pane.
6. Toggle the connection to ensure clean teardown: in Hercules click Disconnect, then reconnect. The PLC STATUS transitions 7000h → 7002h → 7000h.

Alternative High-Level Libraries

When the application outgrows Hercules — for example, a C# HMI that needs to log data at 50 Hz — the standard field toolset is the Snap7 C/C++/Pascal/.NET library from the open-source project on SourceForge. Snap7 speaks ISO-on-TCP natively, which is the S7-1200's preferred transport, and it does not require the S7-1200 to instantiate any OUC block. Configure the connection in the project tree as ISO-on-TCP on port 102 and Snap7 will negotiate the session automatically. Snap7 supports the Connect(), DBRead(), DBWrite(), and CT_Read() primitives out of the box. The .NET wrapper S7.Net is widely used in industrial C# applications; it provides S7.Net.Types.String.FromByteArray for decoding the 2-byte string header discussed earlier.

For Python prototypes, python-snap7 exposes the same calls with a synchronous API:

import snap7
from snap7.util import get_bool, get_int

client = snap7.client.Client()
client.connect("192.168.0.1", 0, 1, 102)   # IP, rack, slot, port

# Read 100 bytes from DB1, starting at byte 0
buf = client.db_read(1, 0, 100)
print("First 8 bytes:", buf[:8])

client.disconnect()

Note that Snap7 bypasses the TSEND_C / TRCV_C path entirely; it uses the S7 communication (rack/slot) channel. If you must keep your own TSEND_C / TRCV_C logic in the project, use a raw TCP library (e.g. socket in Python, System.Net.Sockets.TcpClient in .NET) and replicate the byte-level protocol described above.

Diagnostic Checklist

Migrating Beyond TIA Portal V14

The block interfaces described here are stable from TIA Portal V14 through V18. The only functional change introduced in V15.1 was the addition of the extended TSEND/TRCV variants (TSEND/TRCV with the ADHOC input) for partial-frame reception. Engineers sticking with V14 can stay on TSEND_C / TRCV_C without loss of functionality; just keep in mind that the CPU firmware must be at least 4.0 and that V14 has reached end of support, so the next project should move to V17 or V18.

For new projects, also consider migrating to the OPC UA Server interface (FW 4.4+ for the basic server, FW 4.5+ for Pub/Sub) which removes the need for a custom TCP socket on the PC side at the cost of a slightly more complex CPU configuration. OPC UA is the long-term Siemens direction; raw OUC remains fully supported but is positioned as the fallback transport.

FAQ