PCS 7 AS-to-AS Communication S7 Blocks, PROFINET, and H

David Krause12 min read
Industrial NetworkingSiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview: Communication Architecture in SIMATIC PCS 7

SIMATIC PCS 7 is Siemens' distributed control system (DCS) in which the Automation Station (AS) executes control logic and the Operator Station (OS) / Engineering Station (ES) handle visualization, archiving, and engineering. A typical PCS 7 plant contains several AS-410 / AS-410H controllers that must exchange process data continuously, redundantly, and deterministically.

CPU-to-CPU (AS-to-AS) communication in PCS 7 is implemented through three physical layers:

  • Industrial Ethernet (PROFINET or TCP/IP) - the standard plant/system bus for AS-to-AS, AS-to-OS, and ES-to-AS traffic.
  • PROFIBUS DP - used in legacy PCS 7 V6/V7 projects, especially for remote I/O (ET 200M/IM 153) and field-device integration through DP/PA couplers.
  • Fiber-optic sync link - mandatory in H-systems (AS 410H, AS 400H) for master/standby redundancy. The two H-CPUs synchronize via dedicated sync modules over fiber; this is a separate, non-data communication channel.

Process data is moved between AS-410 controllers using the S7 Communication protocol suite, which provides both coordinated and uncoordinated data exchange with minimal configuration effort and no additional hardware beyond the standard CP 443-1 Ethernet CP.

Communication Methods Available in PCS 7 AS-410 / AS-410H

PCS 7 supports several CPU-to-CPU mechanisms. The choice depends on data volume, determinism requirements, and whether redundancy is required.

Method Protocol Layer Use Case Blocks Direction
S7 Communication (coordinated) PROFINET/Industrial Ethernet (ISO-on-TCP, port 102) Bidirectional, handshake-based data exchange between two AS controllers FB12 "BSEND" + FB13 "BRCV" Bidirectional
S7 Communication (uncoordinated) PROFINET/Industrial Ethernet Broadcast-like, low-overhead data distribution to one or more partners FB8 "USEND" + FB9 "URCV" Unidirectional
S7 Communication (server function) PROFINET/Industrial Ethernet Read/write remote DBs without server-side programming FB14 "GET", FB15 "PUT" Client-driven
Open TCP/IP / UDP TCP/IP (user-defined port) Non-Siemens or 3rd-party integration (modbus, OPC tunnel) FB65..FB68 (TCON, TSEND, TRCV, TDISCON) Bidirectional
PROFIBUS DP master-master PROFIBUS DP-V0/V1 Legacy systems, deterministic cyclic exchange DP-Slave/DP-Master configured in HW Config Bidirectional
H-Sync (redundancy only) Fiber-optic, point-to-point Master/Standby event/data synchronization (NOT application data) None - handled by CPU firmware Internal

For new PCS 7 V9.0 / V9.1 / V10.0 projects, Industrial Ethernet with S7 Communication is the standard. PROFIBUS remains in use for ET 200M remote I/O rings and for AS-to-AS in older V7.1 SPx installations where the existing bus topology cannot be easily migrated to PROFINET.

Hardware Prerequisites

Before configuring AS-to-AS communication, verify the following hardware:

  • AS 410 / AS 410H with firmware ≥ V8.0 (V8.1 recommended for PCS 7 V9.0; V8.2 for V9.1; V9.0 firmware for V10.0). Reference the SIMATIC PCS 7 AS 410 firmware release notes.
  • CP 443-1 (6GK7 443-1EX30-0XE0 for V8.2+) or CP 443-1 Advanced (6GK7 443-1GX30-0XE0) for the plant bus connection.
  • SCALANCE XC/XB/XR managed switches for the plant bus; ring redundancy via HRP/MRP is supported when using SCALANCE XC-200 or higher.
  • For H-systems: two H-CPUs (e.g., 6ES7 410-5HX08-0AB0 AS 410H) and two sync modules (6ES7 960-1AA06-0XA0) with two fiber-optic sync cables (6ES7 960-1AA04-5AA0, lengths 1 m / 5 m / 10 m).
  • ES (Engineering Station) with PCS 7 V9.1 + SPx and STEP 7 V5.6 or TIA Portal V17/V18 with PCS 7 V10 option package.
Connection resource budget: Each S7-400 CPU has a fixed number of S7 connection resources. An AS 410 provides 16 PG, 16 OP, and 32 S7 communication connections (of which 16 are reserved for OS server / redundancy). Plan PUT/GET and BSEND/BRCV traffic against this budget; see the CPU datasheet on the Siemens SIOS portal.

Configuring the S7 Connection in NetPro / HW Config

AS-to-AS communication is configured as an S7 connection. With the CP 443-1 inserted in HW Config, open NetPro (PCS 7 V9.x) or the device & networks editor (TIA V18 + PCS 7 V10) and add an S7 connection between the two AS-410 stations.

  1. Insert a new S7 connection. In NetPro: right-click the CPU → Insert New Connection → S7 Connection. In TIA: drag from one CPU's S7 interface to the partner CPU's interface.
  2. Set the local and partner CP/IP addresses. The connection terminates at the CP 443-1, not the CPU's PROFINET port, when the CP is in a separate subnet.
  3. Activate the checkbox "Establish an active connection" on the initiating CPU side. Only one side must be active.
  4. Set the connection resource (local ID). This ID is the input ID on the BSEND/BRCV/PUT/GET FBs.
  5. Compile and download to both stations. The connection becomes active after a CPU STOP→RUN or after re-initialization.

For H-systems, NetPro automatically generates redundant S7 connections. The H-CPU firmware manages primary/backup switching, so user programs do not need to be modified to handle failover - the connection ID stays the same.

S7 Communication Blocks: Function Calls

The Standard Library / SIMATIC PCS 7 Library provides the IEC-conformant Function Blocks. Call them from OB1 (or OB35 if cyclic, time-synchronized) on the sender and from OB1 on the receiver.

FB12 "BSEND" - Block-Send (Sender, Coordinated)

Transmits up to 32 KB of data to one partner; receiver acknowledges. Use this for large or guaranteed-delivery transfers.

CALL "BSEND" , %DB12  // instance DB generated automatically
   REQ     := TRUE            // rising edge triggers send
   R       := FALSE
   ID      := W#16#1          // local connection ID from NetPro
   R_ID    := DW#16#1         // must match partner R_ID
   DONE    := M100.0
   ERROR   := M100.1
   STATUS  := MW102
   SD_1    := P#DB20.DBX0.0 BYTE 400  // source: 400 bytes from DB20
   LEN     := MW106            // actual length to send

FB13 "BRCV" - Block-Receive (Receiver, Coordinated)

CALL "BRCV" , %DB13
   EN_R    := TRUE
   R       := FALSE
   ID      := W#16#1
   R_ID    := DW#16#1          // must match sender R_ID
   NDR     := M110.0           // new data received
   ERROR   := M110.1
   STATUS  := MW112
   RD_1    := P#DB30.DBX0.0 BYTE 400
   LEN     := MW116            // actual length received

FB8 "USEND" / FB9 "URCV" - Uncoordinated Send/Receive

Lower overhead, no handshake. Up to 8 partners can subscribe with the same R_ID on the receive side (broadcast-like). Up to 32 KB per call. Suitable for status broadcasts (e.g., unit-mode, plant-wide setpoints).

CALL "USEND" , %DB8
   REQ     := TRUE
   ID      := W#16#2
   R_ID    := DW#16#A5
   SD_1    := P#DB40.DBX0.0 BYTE 32
   LEN     := 32
CALL "URCV" , %DB9
   EN_R    := TRUE
   ID      := W#16#2
   R_ID    := DW#16#A5
   RD_1    := P#DB41.DBX0.0 BYTE 32
   LEN     := MW132

FB14 "GET" / FB15 "PUT" - Read/Write Remote DBs

No program changes required on the partner CPU. The local CPU opens a server connection to the partner's S7 communication server.

CALL "GET" , %DB14
   REQ     := TRUE
   ID      := W#16#3
   ADDR_1  := P#DB50.DBX10.0 BYTE 20   // remote address
   RD_1    := P#DB60.DBX0.0 BYTE 20    // local target
Server access rights: For GET/PUT to work, the partner CPU's protection level must permit "Read" and "Write" via the S7 communication server. In HW Config → CPU properties → Protection tab, set Access right for S7 communication server to "Full" or configure the password accordingly. Without this, the GET/PUT call returns STATUS W#16#8311 (object access denied).

Cyclic Triggering and Watchdog

For deterministic, time-synchronized AS-to-AS exchange, place the BSEND/PUT call in OB35 (typically 100 ms or 1 s) and the BRCV/GET in OB1. For each block instance, monitor the STATUS word against the standard S7 communication error codes:

STATUS (hex) Meaning Recommended Action
0000 Job completed without errors None
7000 No job active (idle) Normal; block not yet triggered or already finished
8183 Wrong length / pointer error Check SD_1, RD_1, LEN consistency between sender and receiver
8184 Data type not allowed SD_1/RD_1 must be ANY pointer; LEN must be WORD
8301 Partner CPU in STOP / unreachable Check partner mode, network, connection
8311 Access denied (protection level) Lower partner CPU protection / grant S7 server access
8312 Requested DB does not exist on partner Download partner DB or correct ADDR_x pointer
8380 Connection not configured / ID invalid Re-check NetPro connection ID assignment and download
8381 Connection busy / overload Reduce call rate; check OS / PG connection count
80A1..80A3 Connection aborted (link down, partner STOP/RUN, redundancy lost) Check physical link, partner CPU state, H-failover
80B1..80B5 IP/TCP layer errors (timeout, ARP, route) Verify IP address, subnet mask, CP 443-1 diagnostic buffer

H-System Redundancy: Master/Standby Sync Link

An AS 410H station contains two identical H-CPUs (e.g., CPU 410-5H PN/DP, 6ES7 410-5HX08-0AB0). They run in parallel and exchange:

  • Redundancy state (which CPU is master, which is standby).
  • Process image of the OB1-PII / OB1-PIO for fast failover.
  • Non-retentive memory sections during every scan.

The two CPUs are linked through the sync modules (6ES7 960-1AA06-0XA0), each plugged into the backplane of one CPU, and joined by two fiber-optic cables. Both cables must be present; loss of one cable raises diagnostic event "Sync link 1 failed" (W#16#4522) but redundancy is maintained. Loss of both cables forces the standby CPU to STOP with event "H-synchronization failed" (W#16#4570).

Important: The sync link is for redundancy/control data only. Process-data exchange between two physically separate AS stations is still configured via the standard Industrial Ethernet / S7 connection. H-CPU and S7 connection are independent mechanisms.

Application programs on the AS 410H call BSEND/GET exactly as on a non-redundant CPU. During a master/standby switchover, S7 connections automatically re-establish on the new master; the connection ID is preserved so user programs do not need to be re-initialized.

PROFIBUS-Based AS-to-AS (Legacy Projects)

For PCS 7 V7.x projects using PROFIBUS as plant bus, AS-to-AS is configured with the CP 443-5 Extended (6GK7 443-5DX05-0XE0). In HW Config, designate one AS-410 as PROFIBUS DP master and the other as DP slave, and configure a DP master-master / slave-slave relationship. The PCS 7 V7 Standard Architectures manual documents topology limitations (max 32 nodes per segment, 1000 m with repeater).

Recommended: migrate PROFIBUS AS-to-AS links to PROFINET on new builds. PROFINET provides higher bandwidth, integrated diagnostics via SNMP/SNMPv3, and full support in PCS 7 V9.0+.

Diagnostics: Verifying Communication Health

Use the following methods to verify that AS-to-AS communication is healthy:

  1. Connection status online in NetPro: right-click the S7 connection → Connection Status. Look for "Established".
  2. CPU diagnostic buffer (online → CPU → Diagnostic Buffer). Filter for event IDs 0x4522 (sync link error), 0x8301 (connection abort), 0x8311 (access denied).
  3. CP 443-1 Web server (firmware V3.2+): open http://<cp-ip> in a browser; check Connection Statistics → S7 connection list, error counters, dropped packets.
  4. PCS 7 Maintenance Station: AS-410 connection status is automatically forwarded to the MS via the standard PCS 7 driver set; failed AS-to-AS links appear as a yellow/red alarm block in the WinCC faceplate.
  5. SFC / SFB call STATUS: integrate the STATUS output of BSEND/BRCV/GET/PUT into the PCS 7 standard diagnostics (APL block CH_ACT or CTRL_PID-style alarm logic).

Troubleshooting Matrix

Symptom Likely Root Cause Fix
BSEND STATUS = 80A1, partner CPU reachable Local or partner CPU STOP/RUN transition during transfer Trigger REQ once, ignore transient 80A1; CPU will re-establish automatically
BSEND STATUS = 80A3 Connection actively aborted Check CP 443-1 firmware, replace if corrupted; re-download connection configuration
GET STATUS = 8311 Partner CPU protection blocks read access Set "Read" access right for S7 server on partner CPU
GET STATUS = 8312 Target DB missing on partner or wrong number Download partner DB; verify ADDR_1 pointer DB number
Connection not establishing IP/subnet mismatch, wrong CP selected, no S7-connection resource Verify with ping from ES to CP IP; check NetPro partner endpoint points to the correct CP, not the CPU PN port
H-system: standby CPU goes STOP with 4570 Both sync cables unplugged or damaged Re-seat sync modules, replace fiber, verify not crossed in the same panel (max length 10 m for 6ES7 960-1AA04-5AA0)
URCV receives zero-length data Sender's LEN > actual SD_1 area Set LEN to actual length in bytes; LEN = 0 in USEND/URCV means "use SD_1 area"
Latency on PROFINET > 1 s Plant bus overloaded by OS / Engineering traffic Separate VLAN for OS/ES traffic; reserve PROFINET for AS-410; use SCALANCE QoS

Best-Practice Checklist for PCS 7 AS-to-AS Projects

  • Use BSEND/BRCV for critical, large, or coordinated transfers; USEND/URCV for non-critical broadcasts.
  • Place BSEND/PUT in OB35 (100 ms-1 s) and BRCV/GET in OB1 - never call long-running blocks in OB1 of the sender.
  • Always set a unique R_ID per logical data channel - never reuse R_ID between unrelated senders and receivers.
  • Document the connection ID assignment in the project documentation. Maintain a connection-resource table per CPU.
  • On H-systems, validate that NetPro generated the redundant connection automatically (look for the second connection record in the project tree).
  • Always grant the S7 server access rights on every CPU that participates in GET/PUT; otherwise partner CPUs must explicitly open a connection and the local CPU must be the server side, which is rarely the case.
  • Use SIMATIC PCS 7 Maintenance Station to monitor AS-410 link health instead of polling each CPU individually.

Reference Documentation (Siemens Industry Online Support)

For deeper detail, the following official documents cover the topics in this guide:

Which Siemens blocks are required for CPU-to-CPU communication in PCS 7?

Use the Standard Library FBs: FB12 BSEND + FB13 BRCV for coordinated bidirectional transfer, FB8 USEND + FB9 URCV for uncoordinated broadcast, and FB14 GET + FB15 PUT for read/write without partner programming. No special PCS 7 blocks are required - these come from the SIMATIC S7 base library.

Can AS-410 controllers communicate over Industrial Ethernet in PCS 7?

Yes. Industrial Ethernet (PROFINET) is the standard plant bus in PCS 7 V8.x and V9.x. AS-to-AS is configured as an S7 connection in NetPro; traffic uses ISO-on-TCP (port 102) through the CP 443-1. The H-sync fiber-optic link is for redundancy only, not for application data.

What is the purpose of the fiber-optic link between two H-CPUs?

The fiber-optic link connects the two H-CPUs (e.g., AS 410H) through sync modules 6ES7 960-1AA06-0XA0. It synchronizes the master and standby CPUs, transferring process image, memory, and redundancy state so that on master failure the standby can take over within the configured failover time. It does not carry application data between physically separate AS stations.

How many S7 communication connections does an AS 410 support?

An AS 410 CPU provides 32 S7 communication connection resources in addition to PG/OP channels. Of these, several are reserved for OS servers (one per OS server, typically 2-4) and one for the redundancy partner, leaving ~24-28 free for AS-to-AS, ES, and 3rd-party traffic. See the CPU datasheet for the exact number, as it varies by firmware version.

Why does GET/PUT return STATUS 8311?

STATUS W#16#8311 means "object access denied." It is almost always caused by the partner CPU's protection level blocking S7-server read/write access. Open the partner CPU's properties in HW Config, go to the Protection tab, and set the S7 communication server access right to "Read" and/or "Write." The call will then succeed without a STOP/RUN transition.

Back to blog