Configuring Keyence Barcode Scanner TCP/IP Communication with Siemens S7-1200 via Open User Communication (OUC)

The Siemens SIMATIC S7-1200 (CPU 1214C, firmware V4.x) communicates with Keyence barcode scanners that expose a generic TCP/IP socket interface but do not support PROFINET. Communication is implemented using Open User Communication (OUC), a set of native TCP/UDP instructions in the S7-1200 instruction set. This article provides a full engineering procedure from hardware wiring through TIA Portal configuration, sample code for both instruction variants (TSEND_C/TRCV_C and the modular TCON/TSEND/TRCV/TDISCON family), scanner-side settings, bench testing with a PC utility, and a troubleshooting matrix keyed to the OUC STATUS error codes returned by the blocks.

1. Overview of Open User Communication on the S7-1200

Open User Communication is the term Siemens uses for connection-oriented (TCP) and connectionless (UDP) socket programming on S7-1200 and S7-1500 CPUs. The instructions live in the Communication palette of the TIA Portal program editor:

Two implementation paths are available:

• Compact path: TSEND_C and TRCV_C blocks handle the connection lifecycle automatically. Recommended for simple poll/response or unsolicited scan-and-send scenarios.
• Modular path: TCON, TDISCON, TSEND, TRCV individually controlled. Required when you need asymmetric logic (e.g., only listen, or send only when data is received, or run multiple scanners over separate connection IDs).

2. Prerequisites

2.1 Hardware

2.2 Firmware & Software

• TIA Portal V15.1 or higher (V16, V17, V18 all supported). CPU firmware V4.2 to V4.6 (current production) all support the full TSEND_C/TRCV_C instruction set.
• For legacy CPU firmware V4.0 or V4.1, ensure the latest HSP (Hardware Support Package) is installed; some STATUS word layouts differ.

3. S7-1200 Communication Resources and Limits

Every active OUC connection consumes one entry from the CPU's connection resource table. The S7-1214C supports a fixed number of Open User Communication connections. Consult SIMATIC S7-1200 Programmable Controller - System Manual, chapter "Communication" for exact figures per CPU article number. Typical values:

Two common connection roles exist:

• Active partner - the PLC opens the socket to the scanner's listening port (typical). TSEND_C/TRCV_C can act as active partner.
• Passive partner - the scanner opens the socket to the PLC's listening port. TRCV_C with ActiveEstablished = FALSE on the connection DB makes the PLC passive.

4. Hardware Configuration in TIA Portal

1. Add the S7-1214C to the project. If your exact article number isn't visible, use the HSP.
2. Open Device View > CPU > PROFINET interface [X1]. Set the PLC IP address (e.g., 192.168.0.1) and subnet mask (255.255.255.0). Disable the PROFINET device name since OUC uses IP only.
3. Add the Keyence scanner as a Unspecified Device or as a vendor-specific IO module is not required. You only need its IP address and TCP port.
4. Open CPU Properties > Communication and verify that no IP access list rule is blocking the scanner IP. For LAN-only setups, leave the access list empty or allow the scanner's IP.
5. Compile and download hardware configuration.

5. PLC Tag Declaration

Create a global data block "DB_OUC_Keyence" with the following tags. Names are illustrative; match your site's naming convention.

6. Compact Path - TSEND_C and TRCV_C Implementation

6.1 Adding the Blocks

From Instructions > Communication > Open User Communication, drag TSEND_C and TRCV_C into OB1 (or a cyclic OB). TIA Portal will auto-create a connection description DB (e.g., TCON_1_DB) for each instance.

6.2 Connection Configuration (TSEND_C)

Click on the TSEND_C instance and open the Properties > Configuration > Connection tab. Specify:

6.3 Ladder Example - Trigger + Send

Network 1: Build poll command and request send
      i_SendReq     o_TSendDone
    --|P|--[CALL TSEND_C, DB_TSEND_C]--( )
                       REQ := i_SendReq
                       CONT := TRUE          // keep connection up between calls
                       LEN  := 6             // length of poll command (see scanner doc)
                       DATA := s_SendBuf     // pointer to send buffer
                       DONE => o_TSendDone
                       BUSY => o_TSendBusy
                       ERROR => o_TSendError
                       STATUS => w_TSendStatus
                       CONNECT => o_ConnEstablished

The poll command for many Keyence scanners is a short ASCII string, for example <CR>LON<CR> (6 bytes) or LON\r depending on firmware. Verify the exact byte sequence and terminating characters against the scanner's communication manual before testing.

6.4 Receive Side (TRCV_C)

Network 2: Continuous receive
      i_RcvReq      o_ConnEstablished
    --|P|--[CALL TRCV_C, DB_TRCV_C]--( )
                       EN_R   := TRUE       // receive enable
                       CONT   := TRUE
                       LEN    := 0          // 0 = use ADHOC length mode (any length)
                       DATA   := s_RcvBuf
                       DONE   => o_TRcvDone
                       BUSY   => o_TRcvBusy
                       ERROR  => o_TRcvError
                       STATUS => w_TRcvStatus
                       RCVD_LEN => w_TRcvLen

6.5 Sample Code - SCL Variant

// Block: FC_OUC_Scan
// Purpose: Send LON poll, wait for barcode reply, copy to string

#iBusy := FALSE;
IF #iSendReq AND NOT #oTsendDone THEN
    "TSEND_C_DB"(REQ := #iSendReq,
                CONT := TRUE,
                LEN  := #iSendLen,
                DATA := #sSendBuf,
                DONE => #oTsendDone,
                BUSY => #oTsendBusy,
                ERROR => #oTsendError,
                STATUS => #wTsendStatus);
END_IF;

IF #oTsendDone OR #oConnEstablished THEN
    "TRCV_C_DB"(EN_R := TRUE,
                CONT := TRUE,
                LEN  := 0,
                DATA := #sRcvBuf,
                DONE => #oRcvDone,
                BUSY => #oRcvBusy,
                ERROR => #oRcvError,
                STATUS => #wRcvStatus,
                RCVD_LEN => #wRcvLen);
END_IF;

// On rising edge of oRcvDone, copy received bytes into barcode string
IF #oRcvDone THEN
    // s_Barcode := CHAR_ARRAY_TO_STRING(LEFT(s_RcvBuf, w_RcvLen));
    // Use Siemens BLKMOV or CHAR_CONV per your code style
END_IF;

7. Modular Path - TCON, TSEND, TRCV, TDISCON

When you need precise control (e.g., separate polling cycle, multiple scanners, dynamic reconnection after fault), use the modular instructions. Each block is a separate instance DB.

7.1 Network Diagram

7.2 Connection Description DB (parameter record)

You can either let TIA Portal create the connection description (right-click the TCON instance) or create one manually with the following structure. The connection description is the TCON_Param area of the TCON instance DB.

// Structure: TCON_Param (16 bytes header + parameter data)
// TIA Portal auto-generates this from the Configuration tab of TCON.

// Manual specification for TCON_PARAM (compact form):
{
  BlockLength    := 64;
  Id             := 1;                 // Connection ID
  ConnectionType := 16#0B;            // 0x0B = TCP (16#0C = ISO-on-TCP, 0x0D = UDP)
  ActiveEstablished := TRUE;          // PLC is active partner
  RemoteAddress   := 192.168.0.10;     // Scanner IP
  RemotePort      := 9004;             // Scanner TCP port
  LocalPort       := 0;                // 0 = let system assign
}

7.3 Call Sequence

// Network 1 - TCON on startup or after error
IF i_ConnectReq AND NOT o_ConnEstablished THEN
    "TCON_DB"(REQ   := TRUE,
              ID    := 1,
              DONE  => o_TconDone,
              BUSY  => o_TconBusy,
              ERROR => o_TconError,
              STATUS=> w_TconStatus);
END_IF;

// Network 2 - TSEND after a successful connect
IF o_ConnEstablished AND i_SendReq AND NOT o_TsendBusy THEN
    "TSEND_DB"(REQ   := i_SendReq,
               ID    := 1,
               LEN   := i_SendLen,
               DATA  := s_SendBuf,
               DONE  => o_TsendDone,
               BUSY  => o_TsendBusy,
               ERROR => o_TsendError,
               STATUS=> w_TsendStatus);
END_IF;

// Network 3 - TRCV always enabled when connected
IF o_ConnEstablished THEN
    "TRCV_DB"(EN_R  := TRUE,
              ID    := 1,
              LEN   := 0,
              DATA  := s_RcvBuf,
              DONE  => o_RcvDone,
              BUSY  => o_RcvBusy,
              ERROR => o_RcvError,
              STATUS=> w_RcvStatus,
              RCVD_LEN=> w_RcvLen);
END_IF;

// Network 4 - TDISCON on fatal error
IF o_TconError OR o_RcvError OR i_DisconnectReq THEN
    "TDISCON_DB"(REQ := TRUE,
                 ID  := 1,
                 DONE=> o_DisconDone,
                 BUSY=> o_DisconBusy,
                 ERROR=> o_DisconError,
                 STATUS=> w_DisconStatus);
END_IF;

8. Keyence Scanner-Side TCP/IP Configuration

Use the scanner's web interface or Keyence's AutoID Network Navigator tool to set the following. Defaults vary by model; verify against the scanner manual:

9. Bench Testing with Hercules SETUP Utility

Before touching the PLC, prove the scanner's protocol with a PC. Hercules SETUP utility is a free TCP/UDP test client widely used in industrial commissioning.

1. Connect a PC directly to the scanner with an Ethernet cable (or via a small switch).
2. Configure the PC's NIC to a static address in the same subnet, e.g., 192.168.0.100 / 255.255.255.0.
3. Open Hercules > TCP Client tab. Set Host IP = 192.168.0.10, Port = 9004. Click Connect.
4. Click Send with the ASCII string LON (or the equivalent trigger command from the scanner manual).
5. The scanner returns the barcode (or a NAK if no code is in view). Verify character set, terminator, and length.
6. Repeat with the scanner's native configuration tool (AutoID Network Navigator or similar) to confirm framing before adapting to the PLC.

Once you have a known-good ASCII (or binary) frame, mirror it exactly in the PLC's s_SendBuf and validate s_RcvBuf against the same length.

10. Verification and Diagnostics

10.1 Online STATUS Word Decoding

Watch the following tags in the watch table:

10.2 Common OUC STATUS Codes (hex)

10.3 Reconnection Logic

A robust pattern wraps every OUC block with auto-reconnect:

// After a TSEND_C or TRCV_C ERROR, drop and re-establish connection
IF o_TsendError OR o_RcvError THEN
    "TDISCON_DB"(REQ := TRUE, ID := 1);
    i_ConnectReq := TRUE;          // retry TCON on next OB1 scan
END_IF;

// Re-arm with a small delay to avoid hot-looping if the partner is offline
IF i_ConnectReq AND NOT o_ConnEstablished THEN
    IF t_RetryTimer.Q = FALSE THEN
        t_RetryTimer(IN := TRUE, PT := T#2S);
    END_IF;
    IF t_RetryTimer.Q THEN
        "TCON_DB"(REQ := TRUE, ID := 1);
    END_IF;
END_IF;

11. Troubleshooting Matrix

12. Field-Proven Caveats and Performance Notes

• Trigger latency: A round-trip poll/response between PLC and scanner typically completes in 30-80 ms on a clean 100 Mbps link. The PLC's OB1 cycle must be faster than the scanner's response time or the DONE flag can be missed. OB1 at 10 ms is safe.
• OB1 vs OB35/OB36: Place OUC blocks in OB1 only. Cyclic interrupt OBs (OB30-OB38) can call OUC, but be aware that BUSY persists across OB invocations and the call must remain in the same priority class.
• Firmware mismatch: S7-1200 firmware V4.0 introduced new STATUS codes (e.g., 16#80C3 for resource exhaustion). V4.2 added TUSEND/TURCV. Older STATUS reference tables (pre-V4.0) will be missing codes that you will encounter in newer CPUs.
• Switch selection: Avoid unmanaged industrial switches with embedded IGMP/PTP filtering - they sometimes drop TCP keepalives. Use a managed switch (e.g., Siemens SCALANCE XC-100) when in doubt.
• Watchdog / cycle time: Receiving many telegrams can briefly extend OB1 cycle time when the receive buffer is large. Monitor OB1_PI_SERVICE and OB1_PI_START in diagnostics.
• HMI touch points: HMI tags polled at 250 ms for the barcode are typical. Add a "new scan" pulse tag so the HMI can blink a banner when DONE transitions.

13. Complete Commissioning Checklist

1. Verify scanner IP and subnet with a laptop ping.
2. Verify scanner port with Hercules (open a TCP socket and read reply).
3. Compile hardware config in TIA Portal; download to PLC.
4. Insert TSEND_C/TRCV_C with connection ID = 1, partner IP, partner port.
5. Set CONT := TRUE on both blocks.
6. Trigger a send from a watch table forcing i_SendReq; observe w_TSendStatus = 16#0000 after DONE.
7. Trigger a scan physically; observe w_RcvLen = expected length and s_RcvBuf contents in the watch table.
8. Convert s_RcvBuf to a STRING tag and display on HMI.
9. Add reconnection logic if production cannot tolerate manual intervention.
10. Run the line for 30 minutes; verify no STATUS codes other than 16#0000/16#7000/16#7001 appear in the diagnostic buffer.

14. References and Further Reading

• SIMATIC S7-1200 Programmable Controller - System Manual (chapter "Communication / Open User Communication")
• SIMATIC S7-1200 / S7-1500 - Open User Communication - Function Manual
• Communication with S7-1200 / S7-1500 - Programming and Operating Manual
• Keyence SR-1000 / SR-2000 Series Barcode Reader Communication Manual (catalog no. SR-1000 / SR-2000) - search the vendor site for the specific model's "Communication (Ethernet) Manual"
• Keyence BL-1300 Series Barcode Reader - Communication Manual

FAQ