Configuring S7-1200 to S7-400H TCP and ISO-on-TCP in TIA Portal

Configuring S7-1200 CPU 1214C to S7-400H CPU 412-5H Open IE Communication

The SIMATIC S7-400H (S7-400H) redundancy PLC family was never integrated into the TIA Portal hardware catalog. As of TIA Portal V12 (and the later V13, V14, V15, V15.1, V16, V17, V18, and V19 releases), the CPU 412-5H PN/DP and CPU 414-5H PN/DP and CPU 417-5H PN/DP continue to be programmed exclusively with STEP 7 V5.5 / V5.6 and the optional S7-H Add-on package. When an S7-1200 (for example, CPU 1214C DC/DC/DC order number 6ES7214-1AG40-0XB0) must exchange process data with a CPU 412-5H, the standard S7 connection (PUT/GET via NetPro/connection configuration) cannot be built in a single engineering tool, and the DP/DP coupler + Y-Link path is unattractive when the two stations already share an Industrial Ethernet / PROFINET backbone.

The supported alternative is Open IE communication using the standard TCON / TSEND / TRCV / TDISCON instruction set on the S7-400H side (STEP 7 V5.5) and the TSEND_C / TRCV_C / TCON / TDISCON family on the S7-1200 side (TIA Portal V12). Both transports are configured independently on each controller — no NetPro cross-project, no PUT/GET access rights, no S7 connection partner definition. This article documents a field-proven configuration for a CPU 1214C ↔ CPU 412-5H link that is bridged by two SCALANCE W786-1PRO access points operating as a wireless bridge into a SCALANCE X108 managed switch on the stacker.

1. Scope and Applicability

2. Network Architecture

The physical layer is two SCALANCE W786-1PRO devices configured as a point-to-point wireless bridge. The central control room end terminates on a SCALANCE X108 / XC108 switch together with the CPU 1214C; the movable stacker end terminates on a second SCALANCE X108 inside the stacker E-house, where the CPU 412-5H PN/DP's PROFINET port is wired. Both APs use the same SSID, channel, and WPA2/AES key in bridge mode (or iPCF mode if line-of-sight is intermittent).

IP planning is critical because both S7-1200 and S7-400H are on the same Layer-2 broadcast domain. Use a private /24 such as 192.168.0.0/24 and reserve static addresses; SCALANCE W786-1PRO supports the “Bridge mode” (point-to-point) where both APs share a single IP subnet.

3. Protocol Selection: TCP vs ISO-on-TCP

For a stacker with intermittent RF contact, ISO-on-TCP is the more deterministic choice: the TSAP (Transport Service Access Point) lets the S7-400H identify the partner without inspecting payload, and the S7-400H redundancy firmware treats the connection as a normal Open IE link that can be opened/closed by FB63/FB66. TCP is the only option if the partner is a non-Siemens device or a third-party SCADA node.

4. S7-400H Side Configuration (STEP 7 V5.5)

The S7-400H project must be created in STEP 7 V5.5 with the S7-H Add-on. Configure the CPU 412-5H PN/DP PROFINET interface with IP 192.168.0.30, subnet mask 255.255.255.0, no router. Open IE communication does not require a configured connection in NetPro — only an instance DB for the FBs.

4.1 Connection description UDT 65 (ISO-on-TCP)

Declare the connection description as a multi-instance or a stand-alone DB. UDT 65 is the standard structure used by FB63 TCON. The minimum fields for ISO-on-TCP are:

4.2 STL call sequence (S7-400H OB1)

//  FB63 TCON  - establish ISO-on-TCP connection
CALL  FB63,  DB100
       REQ   := M10.0                  // 1 = establish
       ID    := W#16#000A              // Connection ID 10
       DONE  := M10.1
       BUSY  := M10.2
       ERROR := M10.3
       STATUS:= MW12
       CONNECT := P#DB100.DBX0.0 BYTE 64   // UDT 65 in DB100

//  FB64 TSEND - send 100 bytes from DB200.DBX0.0
CALL  FB64,  DB101
       REQ   := M11.0                  // rising edge triggers send
       ID    := W#16#000A
       LEN   := 100                    // explicit length on ISO-on-TCP
       DONE  := M11.1
       BUSY  := M11.2
       ERROR := M11.3
       STATUS:= MW14
       DATA  := P#DB200.DBX0.0 BYTE 100

//  FB65 TRCV - receive into DB201 (must be 100+2 bytes for ISO-on-TCP header)
CALL  FB65,  DB102
       EN_R  := M12.0                  // 1 = enabled
       ID    := W#16#000A
       LEN   := 100                    // 0 = any length, or fixed
       NDR   := M12.1
       BUSY  := M12.2
       ERROR := M12.3
       STATUS:= MW16
       RCVD_LEN:= MW18
       DATA  := P#DB201.DBX0.0 BYTE 100

//  FB66 TDISCON - orderly close
CALL  FB66,  DB103
       REQ   := M13.0
       ID    := W#16#000A
       DONE  := M13.1
       BUSY  := M13.2
       ERROR := M13.3
       STATUS:= MW20

5. S7-1200 Side Configuration (TIA Portal V12)

The S7-1200 program is built in TIA Portal V12 against a CPU 1214C with firmware V4.2. Use the system library "Communication -> Open User Communication" which contains TSEND_C, TRCV_C, TCON, TDISCON, T_RESET, and T_DIAG FBs.

5.1 Configure the PROFINET interface

1. Open the device view, select the CPU 1214C, switch to Properties > Ethernet addresses.
2. Set IP address 192.168.0.10, subnet mask 255.255.255.0. Do not check "Use router" unless the SCALANCE W786-1PRO is in routed mode.
3. If you need to enable secure PG/PC and HMI communication later, follow the steps for certificate handling in the S7-1200 manual collection: S7-1200 Communications CPU 1214C.
4. Under "Connection mechanisms", enable "Permit access with PUT/GET from remote partner" only if you also need the legacy PUT/GET path; it is not required for Open IE communication.

5.2 Build a global DB of type "TCON_Param"

UDT "TCON_Param" is shipped with TIA Portal V12 in the system data types. Create a DB named iDB_H_Link of type TCON_Param for each connection. The fields required for an active ISO-on-TCP client targeting the S7-400H are:

5.3 SCL call sequence (S7-1200 OB1)

// TSEND_C: combined establish + send on rising edge of REQ
IF "M_Request_Send" THEN
   "iTSend_C_DB"(REQ   := "M_Request_Send",
                 ID    := 10,
                 CONT  := TRUE,                    // keep connection open
                 LEN   := 100,
                 DATA  := P#"DB_Send".DBX0.0 BYTE 100,
                 DONE  => "M_Send_Done",
                 BUSY  => "M_Send_Busy",
                 ERROR => "M_Send_Err",
                 STATUS=> "MW_Send_Status");
END_IF;

// TRCV_C: always enable after connection is up
"iTRcv_C_DB"(EN_R  := "M_Recv_Enable",
             ID    := 10,
             CONT  := TRUE,
             LEN   := 100,
             DATA  := P#"DB_Recv".DBX0.0 BYTE 100,
             NDR   => "M_Recv_NDR",
             BUSY  => "M_Recv_Busy",
             ERROR => "M_Recv_Err",
             STATUS=> "MW_Recv_Status",
             RCVD_LEN=> "MW_Recv_Len");

// Optional: T_DIAG for connection-state snapshot
"iTDiag_DB"(ID       := 10,
            MODE     := 0,                          // 0 = status only
            STATUS   := "DB_TDiag_Status",
            DIAG_OUT := "DB_TDiag_Result");

6. Connection Parameter Mapping Summary

7. SCALANCE W786-1PRO Wireless Bridge Settings

1. Open the Web-Based Management of both W786-1PRO devices.
2. Set Operating mode = Bridge mode (point-to-point). This is the default mode for the -PRO variant; do not select "Client" mode because the S7 stations need a transparent Layer-2 bridge.
3. Configure both radios with the same SSID, channel (e.g., 5 GHz DFS channel 100), and WPA2/AES passphrase.
4. Set the bridge partner MAC explicitly on both devices to avoid the 30-40 s scan delay during roam.
5. Disable Spanning Tree on the W786 radios but leave it enabled on the SCALANCE X108 — the X108 will keep the loop-free path when the wireless side is recovering.
6. Verify the link with the W786 "Diagnostics > WLAN > Signal" page; RSSI should be above -65 dBm for a 5H Open IE link to remain stable at 100 ms send cycle.
7. Set the IP of the W786 for management only (192.168.0.20 / 192.168.0.21) — they are not part of the Open IE connection.

8. Verification Procedure

1. Download the S7-400H project to the H-station; check that both CPUs go to RUN with no diagnostic interrupt. The H-system status must show "System status: Redundant".
2. Download the S7-1200 project to the CPU 1214C. Open the Online > Diagnostics > Connection diagnostics view; the connection with ID 10 should appear with state ESTABLISHED.
3. On the S7-400H, force REQ = TRUE on FB64 TSEND. Verify in the partner DB that the data is non-zero and the S7-1200's RCVD_LEN reports 100.
4. Reverse the test: trigger TSEND_C on the S7-1200 and read RCVD_LEN at the H-station. Both DONE flags must pulse once per REQ.
5. Watch the W786 signal page for 60 s; packet loss must be 0 % for the 100 ms cycle.
6. Issue a STOP/RUN on the standby CPU of the H-system to confirm that the Open IE connection survives a redundancy switchover. Status must remain ESTABLISHED within 2 s (typical 200-500 ms).
7. Pull power on the wireless bridge for 5 s; verify that STATUS on the S7-1200 reads W#16#80C8 (connection terminated) and is followed by automatic re-establishment when the bridge comes back.

9. Diagnostics and Status Codes

Open IE communication on the S7-400H and S7-1200 use the same STATUS word layout (16-bit, 8-bit event class + 8-bit event number). Common codes that show up in the field:

10. Security Considerations

Open IE communication is unencrypted by default. On a wireless link such as SCALANCE W, this is a known attack surface. The hardening sequence recommended for production:

1. Enable WPA2/AES on the SCALANCE W786-1PRO radios (already documented in section 7) and use a 20+ character passphrase rotated quarterly.
2. Restrict the S7-1200 firmware ≥ V4.2: enable "Access protection" with a password of at least 8 characters including a digit and a special character.
3. For CPU 1214C firmware V4.4 and higher, switch the Open IE link to TLS using the TCON block with ConnectionType = 0x11 (17) and a CPU-side X.509 certificate. The S7-400H V6.0 firmware supports TLS for Open IE only with CP443-1 EX30 / GX30 modules, not on the CPU's onboard PN interface — keep Open IE unencrypted on the H-station CPU and rely on a CP for TLS.
4. Apply all CISA-published Siemens advisories for the S7-1200 platform — see the CISA ICS advisory ICSA-25-044-01 for the most recent updates (note that CISA stopped updating this advisory line on 10 January 2023, but historical advisories still apply).
5. Disable the Web server on the S7-1200 unless required; if it must remain on, restrict it to HTTPS with a CPU-side certificate.
6. Apply the "Permit access with PUT/GET from remote partner" option in TIA Portal V12 only if legacy S7 partners exist; this option opens the CPU to known S7 read/write attacks and is the root cause of multiple S7-1200 advisories (e.g., CVE-2019-13945, CVE-2020-15782).

11. Troubleshooting Matrix

12. Why the DP/DP-Coupler + Y-Link Path Was Rejected

The original installation uses a SCALANCE W786-1PRO wireless link. The DP/DP coupler + Y-Link path requires the S7-400H to communicate over PROFIBUS, which would have meant adding a CP 443-5 Extended in the H-rack, a Y-Link (6ES7197-1LA12) and a DP/DP coupler (6ES7158-0AD01) in the stacker, plus a PROFIBUS cable routed back through the stacker cable reel. The wireless bridge already in place made the wireless Ethernet path the lower-cost and lower-maintenance alternative. Open IE over the existing SCALANCE W infrastructure reuses the same radio link, the same SCALANCE X108 switches, and the same grounding concept.

13. Migration to TIA Portal V15+ with PUT/GET

If the S7-400H is ever migrated to a non-H CPU (for example, on a non-redundant line), TIA Portal V15.1 and later support the legacy S7 PUT/GET path against the S7-1200. The same CPU 1214C then uses PUT / GET instructions in the "Communication -> S7 Communication" library, and the S7-400 side uses FB14 GET and FB15 PUT. For the S7-400H, however, the S7-H Add-on does not add PUT/GET support beyond the firmware already includes; the Open IE path remains the only standardized option across all firmware versions.

14. Frequently Asked Questions