Configuring Siemens S7-1200 TCP Communication with Sony MG41

System Overview and Architecture

The target system is a precision thickness-measurement workstation built around a Siemens SIMATIC S7-1214C DC/DC/DC (CPU 1214C, order number 6ES7214-1AG40-0XB0 or later -X30 variant), a Sony MG41 multi-axis magnetic probe, a SIMATIC TP1200 Comfort panel, and a Siemens SCALANCE CSM 1277 unmanaged 4-port switch that provides physical-layer isolation and replication of Ethernet traffic. The probe is the only third-party TCP endpoint on the segment and must be treated as a generic "unspecified" partner in TIA Portal because no Sony GSD/GSDML file exists for the device.

The logical topology is a single subnet, typically 192.168.0.0/24, with static addresses assigned to every device because the probe's boot sequence does not include DHCP fallback in the protocol capture documented below.

Sony MG41 Probe Protocol Specification (Observed)

The Sony MG41 is a multi-axis (up to four probes per controller) magnetic non-contact displacement probe used in coordinate-measuring and in-process gauging. Communication is line-oriented ASCII over TCP/IP; no binary payload, no Modbus mapping, and no PROFINET device description. Every command the controller exposes was captured from a PuTTY/Tera Term session against the production unit. The capture below is the only authoritative reference until the manufacturer-specific protocol manual is requested from the OEM (often bundled as a printed "MG Series Communication Reference" shipped with the probe).

login: MG41           <- username prompt
Password:             <- password prompt (echo suppressed)
MOD=1                 <- mode select: 1 = measurement
ER212                 <- error: command not allowed in this mode
NIP?                  <- query network IP
NIP=192.168.0.7       <- response
HDR=01                <- header mode: 0 = off, 1 = on (axis tag included)
CMM?                  <- query measurement mode
ER210                 <- error: read-only parameter
CMV?                  <- query measurement variant
ER210
CMS?                  <- query measurement start
ER210
CTR=0                 <- set trigger: 0 = continuous (auto-stream)
CTR=1                 <- set trigger: 1 = on-demand (one reading per 'R')
OK000                 <- success acknowledgment
R                     <- read current measured value
[00A]= 0.0000         <- response: axis tag in brackets, value in native unit
R
[00A]= 0.8680
R
[00A]= -0.0015

Key protocol characteristics derived from the capture:

• Transport: TCP, server role on the probe. The PLC acts as a client and initiates the connection.
• Default port: The probe is shipped with TCP port 9000 for measurement channels (Sony Magnescale convention). Port 23 may be active as a service console but is often disabled in production firmware - confirm with the probe's PORT? query once logged in.
• Line termination: CR+LF (0x0D 0x0A) on transmit and receive. Always send a trailing CRLF - sending only LF causes a 2-3 second echo delay followed by an ER210.
• Authentication: Plain-text username/password. The username is fixed to the model string (MG41); the password is identical by default and must be changed on first commissioning. Telnet-style echo of the password is suppressed.
• Response framing: Single-line reply terminated by CRLF. Successful query: <TAG>=<value>. Successful set: OK<nnn>. Error: ER<nnn>.
• Measurement response format: [<HHH>]= <value> where <HHH> is a three-character uppercase hexadecimal axis identifier (000 through 003 for the four-probe variant; 00A is the engineering-unit ASCII for the first active axis in the capture). The space after the equals sign is mandatory.
• Native unit: millimeters with four decimal places. Multiply by 1000 for microns. The capture values 0.8680 mm and 18.8765 mm are within the published MG41 stroke range of +/- 5 mm per probe.

Network Hardware: SCALANCE CSM 1277

The SCALANCE CSM 1277 (6GK7277-1AA10-0AA0) is a four-port unmanaged Industrial Ethernet switch designed to mount on the same DIN rail as the S7-1200. Relevant specifications for this application:

Wiring rules: use Cat 5e or higher SF/UTP cable, max segment length 100 m. Do not loop a port back into itself - the CSM 1277 does not support Spanning Tree and any loop creates a broadcast storm within seconds. Power the switch from a fused 24 V branch separate from the CPU to keep PLC fault currents away from probe comms.

TIA Portal Hardware Configuration

Open the project, navigate to Devices & Networks, and confirm the S7-1214C is online with firmware V4.2 or later. The open user communication blocks TCON, TSEND_C, TRCV_C, and TDISCON require firmware V4.0 minimum, but V4.2 is recommended for the parameterized TCON_Config structure. Open Properties > PROFINET interface [X1] > Ethernet addresses and set:

• IP address: 192.168.0.10
• Subnet mask: 255.255.255.0
• Use IP router: unchecked (no router on a flat subnet)

Under Properties > System > Time of day, enable NTP only if a time server is reachable. The probe does not need time synchronization; enabling NTP on an isolated cell forces you to set up a fake local NTP source to suppress fault LEDs.

Configuring an Unspecified TCP Partner

Because the Sony MG41 has no GSDML file, you cannot add it to the device catalog. Treat it as a partner outside the project:

1. In Devices & Networks, switch to the Network view tab.
2. From the right-hand hardware catalog, expand Other Ethernet devices > Unspecified.
3. Drag Unspecified CPU / partner onto the canvas and place it next to the S7-1214C.
4. Click the green Ethernet port of the PLC, then click the partner's port to draw a logical connection. The CSM 1277 does not appear in the topology editor (it is unmanaged) - that is correct.
5. Open the partner's properties and set IP 192.168.0.7, subnet 255.255.255.0.
6. Right-click the S7-1214C > Properties > Connection mechanisms. Note the default Put/Get and Read/Write access rights - they are irrelevant for open user communication but must be enabled if you later want HMI tags to write into the PLC's measurement DB.

Compile the project. The connection list under Connections on the PLC will now show one entry, but its configuration data is not yet filled in - that is handled by the TCON_Config data block in the next section.

Open User Communication Block Selection

Siemens provides two open-communication paths on the S7-1200:

For a thickness probe the compact path is sufficient on the first pass, but a production line should use the modular path so the connection can survive across scans and a TDISCON can be issued on a controlled stop. The sample in this article uses TCON + TSEND_C + TRCV + TDISCON so the connection stays open between R commands - opening a fresh TCP session for every reading adds 80-150 ms of latency on the CSM 1277.

TCON Connection Description (UDT 65)

Create a global DB named DB_Conn with one tag of type TCON_Configured_Connection (UDT 65, the structure shipped with every TIA Portal installation under Libraries > Communication > Open User Communication). Populate the fields as follows:

DATA_BLOCK "DB_Conn"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.0001
NON_RETAIN
VAR
  ProbeLink : TCON_Configured_Connection;  // UDT 65
END_VAR
BEGIN
  ProbeLink.InterfaceId   := 64;            // PROFINET interface HW ID, lookup in device properties
  ProbeLink.ID            := 1;             // unique connection ID, range 1..4095
  ProbeLink.ConnectionType:= 16#0B;         // 0x0B = TCP/IP, 0x0C = UDP, 0x0E = ISO-on-TCP
  ProbeLink.ActiveEstablished := TRUE;     // PLC is the TCP client
  ProbeLink.RemoteAddress[1] := 192;        // IP 192.168.0.7
  ProbeLink.RemoteAddress[2] := 168;
  ProbeLink.RemoteAddress[3] := 0;
  ProbeLink.RemoteAddress[4] := 7;
  ProbeLink.RemotePort    := 9000;          // MG41 default; verify with PORT? query
  ProbeLink.LocalPort     := 0;             // 0 = let the OS pick an ephemeral port
END_DATA_BLOCK

Login Sequence and Session Establishment

The login is a two-line handshake. The probe first sends the prompt login: when the TCP session is established, then waits for the username, replies with Password: , and finally sends the operating prompt (a single > by default). The PLC must consume the prompts in order or the probe will time out after 5 s with an ER201 (session timeout).

Recommended sequence using SCL:

// State 10: send username
IF iState = 10 THEN
  sTxBuf := 'MG41' + CR + LF;     // 6 bytes including CRLF
  TSEND_C_DB(REQ := TRUE,
             ID  := 1,
             LEN := LEN(sTxBuf),
             DATA:= sTxBuf,
             BUSY=>,
             DONE=>,
             ERROR=>,
             STATUS=>);
  iState := 20;
END_IF;

// State 20: wait for "Password: " prompt (4 s)
IF iState = 20 AND TRCV_Done THEN
  IF FIND(sRxBuf, 'Password:') > 0 THEN
    iState := 30;
  ELSIF FIND(sRxBuf, 'ER') > 0 THEN
    iState := 90;                  // auth error
  END_IF;
END_IF;

// State 30: send password
IF iState = 30 THEN
  sTxBuf := sPassword + CR + LF;
  TSEND_C_DB(REQ := TRUE, ... );
  iState := 40;
END_IF;

// State 40: wait for ">" prompt
IF iState = 40 AND TRCV_Done THEN
  IF sRxBuf[LEN(sRxBuf)] = '>' OR FIND(sRxBuf, 'OK000') > 0 THEN
    bLoggedIn := TRUE;
    iState    := 100;              // jump to measurement loop
  END_IF;
END_IF;

Store the credential in a recipe DB and not in the program code so the password can be rotated without re-compiling. Use Siemens Recipe view on the TP1200 to expose it to operators.

Issuing the R Command and Parsing the Thickness Value

Once bLoggedIn is true, the application cycle is a request-reply transaction every N milliseconds (typically 50-200 ms for a thickness loop). The CR+LF terminator is mandatory:

// State 100: request one reading
IF iState = 100 AND NOT TSEND_C_DB.BUSY THEN
  sTxBuf := 'R' + CR + LF;          // 3 bytes
  TSEND_C_DB(REQ := TRUE,
             ID  := 1,
             LEN := 3,
             DATA:= sTxBuf,
             DONE=>,
             ERROR=>,
             STATUS=>);
  iState := 110;
END_IF;

// State 110: parse the [HHH]= value line
IF iState = 110 AND TRCV_Instance.NDR THEN
  sLine := sRxBuf;                  // typically "[00A]= 0.8680\r\n"
  iEq   := FIND(sLine, ']= ');
  IF iEq > 0 THEN
    sValue := MID(sLine, iEq + 3, 32);  // skip "]= "
    rThickness_mm := STRING_TO_REAL(sValue); // built-in SCL conversion
    rThickness_um := rThickness_mm * 1000.0;
    bNewValue     := TRUE;
    iState        := 100;               // request next reading
  ELSE
    iState        := 120;               // unexpected response
  END_IF;
END_IF;

Set the TRCV LEN input to 64 bytes per call - the longest single line of the protocol is the read response at 16 bytes including the CRLF. Using a larger LEN wastes only a few cycles; using a smaller LEN forces you to chain multiple TRCV calls for nothing.

Error Code Reference

Errors are framed as ER<nnn> followed by CRLF. Codes observed in the live capture and inferred from the protocol manual:

The PLC should treat any code starting with ER as a hard fault: set a tag bProbeFault, log the code to a data log block, and refuse to update the thickness tag in the HMI. The HMI faceplate reads the fault tag and forces a red banner.

Complete Sample Program (Modular Path)

The full SCL block below implements TCON + TSEND_C + TRCV + TDISCON in a 16-state machine, ready to drop into a cyclic OB. Calls to TSEND_C_DB and TRCV_Instance are single-instance DBs created from the corresponding FB types in Libraries > Communication > Open User Communication > CPU 1200.

FUNCTION_BLOCK "FB_SonyMG41"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
VAR
  iState        : INT := 0;          // 0=Idle, 10=Conn, 20=Login, ...
  tWait         : TIME;              // step watchdog
  sTxBuf        : STRING[64];
  sRxBuf        : STRING[128];
  sLine         : STRING[64];
  sPassword     : STRING[16] := 'MG41';
  bConnected    : BOOL;
  bLoggedIn     : BOOL;
  bNewValue     : BOOL;
  bProbeFault   : BOOL;
  rThickness_mm : REAL;
  rThickness_um : REAL;
  iFaultCode    : INT;               // 0 = OK, 201, 210, 212, 220, 230, 240
END_VAR

BEGIN
  // -- Step 0: hold-off until PLC finishes boot scan --
  IF iState = 0 AND NOT bConnected THEN
    TCON_DB(REQ := TRUE, ID := 1, CONNECT := "DB_Conn".ProbeLink,
            DONE=> bConnected := TRUE,
            ERROR=> bConnected := FALSE,
            BUSY=>);
    iState := 10;
  END_IF;

  // -- Step 10..40: login sequence (omitted, see Section above) --
  // -- Step 100..120: measurement loop --
  IF iState = 100 AND bLoggedIn AND NOT TSEND_C_DB.BUSY THEN
    sTxBuf := CONCAT('R', CONCAT(CHR(13), CHR(10)));
    TSEND_C_DB(REQ := TRUE, ID := 1, LEN := 3, DATA := sTxBuf,
               DONE=>, ERROR=> iFaultCode := -1, STATUS=>);
    iState := 110;
  END_IF;

  IF iState = 110 AND TRCV_Instance.NDR THEN
    sLine := TRCV_Instance.DATA;
    IF LEFT(sLine, 2) = 'ER' THEN
      iFaultCode  := STRING_TO_INT(MID(sLine, 3, 3));
      bProbeFault := TRUE;
      iState      := 200;          // error handler
    ELSIF LEFT(sLine, 1) = '[' THEN
      rThickness_mm := STRING_TO_REAL(MID(sLine, FIND(sLine,']= ') + 3, 16));
      rThickness_um := rThickness_mm * 1000.0;
      bNewValue     := TRUE;
      iState        := 100;        // request next reading
    END_IF;
  END_IF;

  // -- Step 200: error recovery --
  IF iState = 200 THEN
    TDISCON_DB(REQ := TRUE, ID := 1, DONE=> bConnected := FALSE, ERROR=>);
    iState        := 0;
    bLoggedIn     := FALSE;
  END_IF;
END_FUNCTION_BLOCK

Drop FB_SonyMG41 into OB1 (or a cyclic OB with shorter cycle time) and call it once per scan. The HMI reads DB_Sony.rThickness_um and DB_Sony.bProbeFault directly.

Verification and Acceptance Test

1. Connectivity test: From a laptop running TIA Portal's Online > Accessible nodes, confirm the probe appears at 192.168.0.7 with MAC address starting with 00-50-C2 (Sony Magnescale OUI). If it does not appear, ping from the PG - if ping fails, the CSM 1277 port LED should be lit green on the probe side and blinking amber on traffic. A solid amber port is a duplex mismatch; force the PLC port to 100 Mbit/s full duplex in the device properties.
2. Login test: Trigger a single login from the PG using a TCP test tool (Hercules, Wireshark with tcp.port == 9000). Confirm the three prompts login:, Password:, > appear in order and that the PLC's bLoggedIn tag goes true within 1 s.
3. Reading test: Set the workpiece on the probe, monitor rThickness_um in the watch table. With CTR=0 (continuous) the value should change twice a second; with CTR=1 the value changes only on each R command.
4. Soak test: Run 10 000 reads over 8 h. Watch the error counter - more than three TCP resets means the keep-alive on the probe side is killing the session prematurely. Fix by sending a NOP (any non-modifying command) every 30 s instead of relying on the TCP default of 60 min.
5. Fault test: Disconnect the probe Ethernet cable. bProbeFault must go true within 10 s, the HMI banner must turn red, and the line must NOT continue showing the last value as if it were current - tag a VALID bit on the HMI faceplate and tie it to bLoggedIn AND NOT bProbeFault.

Troubleshooting Matrix

Alternative Connection Strategies

If a second PLC vendor is introduced on the same cell, the Sony MG41's text protocol can be hosted by any controller with a TCP client socket. On a BR PLC, the equivalent of TSEND_C is the OpenSocket instruction paired with Send and Recv. On a Beckhoff CX, the TF6310 TCP/IP server/client library exposes the same primitives. On an Omron NJ/NX, the SocketCreate + SocketConnect + SocketSend + SocketReceive ladder instructions map 1:1 to the Siemens blocks used here. The login sequence and the ASCII framing are vendor-agnostic and can be ported without changing the probe's configuration.

If the application requires a hard real-time cycle shorter than 5 ms, consider replacing the probe with a PROFINET-native displacement sensor. A Wenglor P1KY or an IFM O1D laser distance sensor can be added to the TIA Portal device catalog directly, eliminating the entire open-communication stack and reducing the loop time to 1 ms over the same CSM 1277 infrastructure.