Configuring an S7 Ethernet Connection Between a SIMATIC S7-400 and a SIMATIC NET PC Station

Overview

An S7 connection is the Siemens proprietary logical link used for coordinated data exchange between SIMATIC controllers, PC stations, and HMI devices. When a SIMATIC S7-400 (CPU 41x family - e.g. CPU 416-3 PN/DP) must hand off cyclic or acyclic data to a Windows application - SCADA, a custom HMI, a data logger, or a diagnostic capture tool - a PC station running SIMATIC NET is the canonical reference platform. This article walks through the PC station hardware configuration in STEP 7, the SIMATIC NET software install and licensing, the S7 connection configuration in NetPro, the PLC-side S7 function blocks (PUT/GET, USEND/URCV, BSEND/BRCV), the PC-side data access path through OPC DA/UA, and packet-level verification with Wireshark (the original Ethereal, now maintained as Wireshark 3.0+).

Per Siemens, an S7 connection between a PC station and an S7-300/400/1500 CPU can be routed over Industrial Ethernet or PROFIBUS, depending on the communication processor (CP) installed in the PC station. See the official configuration guide: Communication connections to PC stations (S7-300, S7-400, S7-1500).

Prerequisites

1. SIMATIC S7-400 station with a CPU 41x (e.g. CPU 416-3 PN/DP) reachable over Industrial Ethernet. The Ethernet interface can be the CPU's onboard PROFINET port or a CP 443-1.
2. PC running Windows 10 / Windows Server 2016 or later, x64, with at least one free Ethernet NIC.
3. STEP 7 V5.5 + SPx (or STEP 7 Professional in TIA Portal V16+) with the S7-400 HSP installed.
4. SIMATIC NET PC Software V16 or later (DVD "SIMATIC NET PC Software").
5. SIMATIC NET license: Softnet S7 IE, Softnet S7 IE Lean, or Hardnet S7 IE - assigned in the Automation License Manager.
6. Industrial Ethernet interface module for the PC station:
   • Softnet: "IE General" - the SIMATIC NET soft CP that binds to the PC's on-board NIC.
   • Hardnet: CP 1623, CP 1628 (PCIe) or the legacy CP 1612 A2 / CP 1613 A2 (PCI).
7. Wireshark 3.0 or later (with the S7comm dissector enabled) for packet-level verification.

Architecture and Protocol Stack

An S7 connection over Industrial Ethernet rides on ISO Transport over RFC 1006 (TPKT) on TCP/102. The stack from the application layer down is:

During connection setup the PC station sends a COTP CR (Connection Request, TPDU 0xE0) carrying a TSAP pair. The TSAP encodes the resource type and the slot/rack of the target CPU. The S7-400 replies with a COTP CC (Connection Confirm, 0xD0) and the S7comm layer negotiates the maximum PDU size and the S7 primitives that will be used. Teardown is a COTP DR (Disconnect Request, 0x80) / DC (Disconnect Confirm, 0xC0) exchange.

Topology

PC Station Hardware Configuration in STEP 7

Open SIMATIC Manager and the project containing the S7-400 station. Add a PC station (Insert › Station › SIMATIC PC Station) and open its hardware configuration (HW Config). The slot assignment is fixed by the SIMATIC NET framework and must follow the order below:

OPC Scout V10 is the verification client and is not a slot module - it talks to the OPC server in slot 1. You can run the PC station with only slots 1 and 2 populated if you only need to test the S7 connection with OPC Scout.

SIMATIC NET Software Installation

1. Insert the SIMATIC NET DVD and run setup.exe. Choose Install › PC Station and confirm: SIMATIC NET PC Software, OPC Scout V10, Station Configuration Editor, S7DOS Helper, Communication Settings.
2. Select the licensing mode (license key on a USB dongle, or a software license key) and install the Softnet S7 IE / Hardnet S7 IE / Lean license in the Automation License Manager.
3. Reboot. Verify the SIMATIC NET Configuration service and the S7DOS Help Service are set to Automatic and are running (services.msc).
4. Open Station Configuration Editor (Start › Siemens Automation › SIMATIC NET › Configuration). Click Add Station and use the same PC station name as in NetPro. The editor will pick up the OPC server and IE General modules that match the HW Config.
5. For OPC UA, also open Communication Settings (Start › Siemens Automation › Communication Settings) to define the UA endpoint URL, server certificate, and the S7 block mapping. See the official SIMATIC NET OPC UA S7 block service document: SIMATIC NET OPC UA S7blockService (PDF).

Configuring the S7 Connection in NetPro

1. Right-click the PC station in SIMATIC Manager and choose Open NetPro.
2. Place the S7-400 CPU on the same Industrial Ethernet subnet as the IE General of the PC station (or connect both via a switch and a common subnet).
3. Select the OPC Server row in the PC station. From the menu choose Insert › New Connection. The wizard lets you pick S7 connection as connection type and the S7-400 CPU as the partner. The local endpoint is the OPC Server; the partner endpoint is the S7-400 CPU.
4. Set the connection properties:
   • Connection name: arbitrary, e.g. S7_HMI_to_416.
   • Connection type: S7 connection.
   • Active connection establishment: leave enabled. The PC station initiates the S7 connection; the S7-400 responds.
   • Local ID / Partner ID: STEP 7 assigns these slot-specific IDs automatically. Note the Local ID on the S7-400 side - you will pass it as the ID input to PUT/GET, USEND/URCV, or BSEND/BRCV.
5. Compile and download the PC station (Target system › PC internal, in STEP 7 V5.5 the dialog is PC › Download). On the PC the Station Configuration Editor picks up the new connection; restart the OPC server from the editor or with net stop "S7DOS" && net start "S7DOS".

PLC-Side S7 Function Blocks

For the S7-400 the standard S7 communication blocks live in Standard Library › Communication Blocks (SFBs, system resources) or as FBs with instance DBs:

PUT/GET is the lowest-effort path for SCADA-style polling. USEND/URCV is preferred for fast event-driven exchange. BSEND/BRCV is the right choice for large block transfer (recipes, parameter sets, archive blobs). All three ride on the same S7 connection defined in NetPro - they do not require separate connection setup.

PUT/GET on the S7-400 (Structured Text sample)

// Trigger a PUT to write 20 bytes from DB100 (local) to MB200 on the partner
// (PC station exposes MB200 as an OPC item, e.g. "S7:[S7_HMI_to_416]MB200")

DATA_BLOCK DB100
  STRUCT
    payload : ARRAY[0..19] OF BYTE;
  END_STRUCT
END_DATA_BLOCK

FUNCTION_BLOCK FB15_PUT
VAR
  bReq      : BOOL;
  bDone     : BOOL;
  bBusy     : BOOL;
  bError    : BOOL;
  wStatus   : WORD;
  iDBnum    : INT := 100;
  iDBoff    : INT := 0;
  iPtrLen   : INT := 20;
END_VAR
BEGIN
  // REQ must be a positive edge; the SFB latches internally
  FB15_PUT_0(
    REQ      := bReq,
    ID       := W#16#1,                       // local connection ID from NetPro
    DONE     => bDone,
    BUSY     => bBusy,
    ERROR    => bError,
    STATUS   => wStatus,
    ADDR_1   := P#M 200.0 BYTE 20,            // partner address (PC)
    SD_1     := P#DB100.DBX 0.0 BYTE 20       // source area (local)
  );
END_FUNCTION_BLOCK

For the S7-400 the partner address ADDR_1 may be a byte/bit/word/dword area in the S7 partner. When the partner is a PC station, the area is mapped by SIMATIC NET into the OPC namespace; the OPC client then reads/writes the same area through the OPC server.

BSEND / BRCV on the S7-400 (LAD-style call outline)

// Sender side: call BSEND with LEN = 1024 to push a 1 KB block to the partner
// BSEND is edge-triggered on REQ; it transmits in segments and only sets DONE
// after the partner has received the full block with BRCV.

CALL SFB12, DB12 (
  REQ      := bSendStart,
  R        := bSendReset,
  ID       := W#16#1,                        // same S7 connection ID
  R_ID     := DW#16#1234ABCD,                // 32-bit block ID, must match BRCV
  DONE     => bSendDone,
  ERROR    => bSendErr,
  STATUS   => wSendStatus,
  SD_1     := P#DB200.DBX 0.0 BYTE 1024,     // source DB on sender
  LEN      := 1024
);

BSEND/BRCV require that both sides agree on the 32-bit R_ID. The total block length LEN must be set on the sender; the receiver is given the actual length via LEN output after DONE is set.

PC-Side Data Exchange

OPC DA verification with OPC Scout V10

OPC Scout V10 ships with SIMATIC NET. Open it from Start › Siemens Automation › SIMATIC NET › OPC Scout. The local server appears as OPC.SimaticNET. Add an item with the syntax:

S7:[S7_HMI_to_416]DB100,BYTE0,20

This is a 20-byte read of DB100 in the S7-400, starting at byte 0. Drag the item into the right pane; a green dot in the Quality column means the S7 connection is up and the value is being read. Writing to the Value cell pushes the value through the S7 connection to the CPU.

OPC DA custom client (C# / .NET)

// Sample OPC DA 2.0 read using the OPC custom interface
using OpcRcw.Da;
IOPCServer server;
server = (IOPCServer)Activator.CreateInstance(
  Type.GetTypeFromProgID("OPC.SimaticNET", "localhost"));
// add a group, add the item "S7:[S7_HMI_to_416]DB100,BYTE0,20",
// then read/write via IOPCSyncIO.Read / .Write.

OPC UA

SIMATIC NET V14+ ships an OPC UA server. The UA endpoint is configured in Communication Settings and can be consumed by any OPC UA client. Per the SIMATIC NET OPC UA S7 block service document, the S7 block mapping defines which DB/M/I/Q areas are exposed to the UA namespace.

User Application slot (custom C++ / .NET service)

If the PC station has a User Application module in slot 3 or higher, that process is registered as an OPC client of the OPC server in slot 1. The custom process does not need its own CP; the OPC server multiplexes the S7 traffic to all configured S7 connections.

Packet Capture with Wireshark

To inspect S7 connection establishment, data transfer, and teardown at the wire level, capture the PC's NIC with Wireshark. The display filters s7comm and tcp.port == 102 cover the connection. Procedure:

1. Temporarily disable the Windows firewall or allow the Npcap loopback driver used by Wireshark.
2. Start the capture on the NIC bound to the IE General (or CP 1623 / CP 1628). For Softnet S7 IE, the IE General binds to the Windows NIC IP, so capture that same NIC.
3. Trigger the PC station to bring the S7 connection up: restart S7DOS, or write to an OPC item in OPC Scout.
4. Filter on the S7comm dissector. Useful S7comm function codes:
   • 0x00 - CPU function group (setup, read/write SZL).
   • 0x04 - read variable.
   • 0x05 - write variable.
   • 0x1A / 0x1B - PI service (PI_START / PI_STOP) for SFB/FB calls.
5. Decode the lifecycle:
   • CR / CC (COTP 0xE0 / 0xD0) - connection establishment.
   • S7comm setup communication (function group 0x00) - parameter negotiation (PDU size, max parallel jobs).
   • Data PDUs (function 0x04 / 0x05) - data transfer.
   • DR / DC (COTP 0x80 / 0xC0) - disconnect.

The TSAP in the COTP CR PDU must match the partner's configured TSAP. For an S7-400 CPU reached directly (rack 0, slot of the PROFINET interface), the destination TSAP is the rack/slot pair shown in NetPro's partner endpoint. For an S7-400 reached via CP 443-1, the destination TSAP encodes the CP's slot, not the CPU's slot - using the CPU's slot TSAP against a CP-anchored connection is a very common commissioning error and shows up at the wire level as a COTP DR with reject cause invalid TSAP.

Commissioning and Verification

1. On the S7-400, in CPU properties (Protection tab), confirm that the operating mode allows HMI/OPC read/write access. Enable Permit PUT/GET communication access. Download the hardware configuration.
2. Download the STEP 7 project (S7 program + NetPro connections) to the CPU. The download also brings the S7 connection to the CPU side; the connection shows up in CPU › Connections in NetPro with status established once the PC station is online.
3. On the PC, open the Station Configuration Editor. The OPC server module and IE General must show a green check mark. If they show a red X, click Station › Import Station and point at the STEP 7 PC station that was downloaded earlier.
4. Start the OPC server: right-click the OPC server module › Start. The status field shows Running.
5. Open OPC Scout, navigate to OPC.SimaticNET, add the S7 connection branch (S7:[S7_HMI_to_416]), and add the items to test. A green dot in the Quality column means the S7 connection is up and the items are being read.
6. Trigger a write from OPC Scout. In the S7-400, monitor the target DB or M area online to confirm the value arrived. The CPU diagnostic buffer should not show any new communication errors. S7DOS on the PC should show a successful connection state in the event log.
7. (Optional) Cross-check with Wireshark: a healthy PUT/GET polling exchange shows a CR/CC at startup, periodic variable-read PDUs, and a DR/DC only when the OPC server is stopped.

Troubleshooting Matrix

Field-Proven Caveats

• For an S7-400 with a CP 443-1, the S7 connection is anchored to the CP, not to the CPU's PROFINET interface. The partner TSAP must reference the CP's slot. Using the CPU's slot TSAP against a CP-connected CPU is the most common first-day commissioning error.
• STEP 7 V5.5 will let you configure a PC station with no IE General if you only need a WinCC Flexible RT direct connection. The OPC server on the S7 path always needs an Ethernet interface in the PC station - do not skip IE General for an OPC-based SCADA node.
• Softnet S7 IE Lean (max 16 S7 connections) is the right answer for the typical SCADA node. Reserve the full Softnet S7 IE or Hardnet S7 IE for nodes that aggregate many PLCs into a single OPC server.
• If the OPC server runs as a Windows service under LocalSystem, it cannot use the interactive desktop session to import the station. Run the Import Station step from a session of the same user that owns the Station Configuration Editor; once imported, the S7DOS service can run independently.
• Watch out for duplicate S7 connection IDs: if you duplicate a S7-400 station in NetPro and forget to re-assign the connection ID, the second station will use the same ID as the first and PUT/GET calls will conflict.
• PUT/GET and USEND/URCV are not interchangeable on the wire - PUT/GET uses S7comm function codes 0x04/0x05 (read/write variable), USEND/URCV uses S7comm function group 0x1A/0x1B (PI service) with the SFB indices. The OPC server's namespace is designed for the variable services (PUT/GET) only.

FAQ