Reading Data from Multiple S7-1200 PLCs on an S7-1500 in TIA Portal

When a head PLC (S7-1500) must collect data from 12 field PLCs (S7-1200) over PROFINET, two certified Siemens transports are available: S7 communication (PUT/GET) and Open User Communication (TCON/TSEND/TRCV). Both run on the integrated PROFINET interface without additional hardware, but they differ in how connection resources, TSAPs, and data marshalling are handled. This guide covers the architecture decisions, project engineering in TIA Portal (V17 to V20), SCL code for both transports, and field-verified diagnostics for the most common handshake faults.

1. Problem Definition and Data-Flow Mapping

Before selecting a transport, itemise what flows in each direction. With 12 substations this decision drives the total number of open connections on the head PLC, the cycle time, and whether partner connections must be configured passively or actively.

For a 12-node fleet with 128-byte read + 32-byte write per node, S7-1200 PUT/GET is usually the lowest-effort choice because Siemens pre-builds the connection resources. Open TCP is preferred only when the application needs a custom payload format (e.g. JSON for an MES), tight security segmentation with IP ACLs, or integration with non-Siemens partners.

2. Prerequisites

1. Firmware — All S7-1200 CPUs must be at firmware V4.0 or higher. PUT/GET as a server and the Open User Communication blocks (TCON, TSEND, TRCV, TUSEND, TURCV) require V4.0+. The S7-1500 CPU must be V2.5 or higher (V2.9 recommended for V20 TIA Portal projects).
2. Software — TIA Portal V17, V18, V19, or V20. V20 is required to edit projects that target the newest S7-1500 CPU firmware (V3.1).
3. Network — A single PROFINET subnet with the head PLC and all 12 field PLCs. Use managed switches (e.g. SCALANCE XC-200) if you need IGMP snooping or port mirroring for diagnostics.
4. IP plan — Reserve a /27 or /28 subnet. Example: head PLC 192.168.0.1, field PLCs 192.168.0.11 … 192.168.0.22, subnet mask 255.255.255.0.
5. CPU connection budget — Verify that the head PLC has enough free connection resources. See §3.

3. Connection Resource Budget

Each open transport consumes one connection resource on both the server and the client. Siemens CPUs have a fixed pool that is split between PG/OP, S7 (PUT/GET), and Open User Communication.

For 12 S7-1200 servers each needing one S7 connection to the head PLC, the head station requires 12 S7 connections. The S7-1200 servers each need exactly one S7 connection back to the head. This fits comfortably on an S7-1500, but on a CPU 1511-1 PN (16 max concurrent S7 connections) it can be tight if HMI panels and engineering stations share the same CPU. Use a CPU 1515-2 PN or 1516-3 PN/DP if you must add PG, OP, and an OPC UA server on the same controller.

4. Protocol Selection Matrix

Recommendation: for the 12 × S7-1200 + S7-1500 topology with read/write of process data and I&M records, use S7 PUT/GET on the data path and add Open TCP only if you need > 212-byte bursts or want a uniform JSON payload for an MES.

5. Project Engineering — S7 PUT/GET Path

5.1 Enable PUT/GET on each S7-1200

1. In TIA Portal, open the S7-1200 device.
2. Properties → Protection & Security → check Permit access with PUT/GET communication from remote partner.
3. Compile (Hardware) and download to the CPU.

5.2 Create one DB per S7-1200 substation on the S7-1500

Use an array of UDT_S7_1200_Telemetry structures so the same GET block can be parameterised from a loop. A minimal UDT:

TYPE "UDT_S7_1200_Telemetry"
VERSION : 0.1
   STRUCT
      Heartbeat : WORD;        // S7-1200 toggles every cycle
      Inputs    : WORD;        // first 16 bits of %IW0
      Analog1   : INT;         // %IW64
      Analog2   : INT;         // %IW66
      Counter   : DWORD;       // from S7-1200 fast counter
      Status    : BYTE;        // 0x01=running, 0x02=fault
      Reserve   : ARRAY[0..9] OF BYTE;
   END_STRUCT;
END_TYPE

Then a single receive DB on the S7-1500:

DATA_BLOCK "DB_Fleet"
VERSION : 0.1
   STRUCT
      Node : ARRAY[1..12] OF "UDT_S7_1200_Telemetry";
   END_STRUCT;
END_DATA_BLOCK

5.3 Place 12 GET blocks on the S7-1500

For every substation add an instance of GET from Instructions → Communication → S7 Communication. The block pulls data from a remote DB or I/O area into a local area of the same size. A typical call in OB1 / OB35:

// GET from S7-1200 #1 (192.168.0.11, rack 0, slot 1)
"iDB_GET_01"(REQ   := "clock_100ms",            // periodic trigger
             ID    := 1,                        // connection ID 1
             ADDR_1:= P#DB1.DBX0.0 BYTE 32,     // remote source
             RD_1  := P#DB_Fleet.Node[1] BYTE 32,// local target
             NDR   => "stat_GET_01_NDR",
             ERROR => "stat_GET_01_ERR",
             STATUS=> "stat_GET_01_ST");

Repeat the call 12 times, scaling the connection ID and the target slice. The connection ID must match the configured partner connection described in §5.4.

5.4 Configure the partner connections

On the S7-1500, in Devices & Networks → Network view, drag a Put/Get connection from each S7-1200 to the head. The local TSAP of the head defaults to 03.01; the partner TSAP defaults to 03.0B for S7-1200 slot 1. The "Address details" tab in the connection properties must show:

5.5 Trigger the calls cyclically

A 100 ms cyclic interrupt (OB35) is fast enough for telemetry. If you need a consistent scan across all 12 nodes, drive every REQ input from the same BOOL and read each NDR/ERROR/STATUS into the same UDT under a fault-tracking sub-DB.

6. Reading I&M 0..3 Records with Get_IM_Data

For each S7-1200 substation, Siemens exposes identification and maintenance data through the Get_IM_Data instruction. The block is documented in the TIA Portal help under Extended Instructions → Diagnostics → Get_IM_Data; see the TIA Portal V20 reference: Get_IM_Data. Use it when an MES needs serial number, firmware, or installation date.

6.1 Block interface

6.2 Sample call (SCL) for substation 1

// Read I&M0 from substation 1 — invoked on demand from HMI
IF "HMI_Read_IM0_N1" AND NOT "stat_IM0_01_Busy" THEN
   "iGetIM0_01"(LADDR  := 268,                    // HW ID of S7-1200 IO device
                IM_TYPE:= 0,                      // I&M0
                DB     := "DB_IM0_Sub_01",
                BUSY   :=> "stat_IM0_01_Busy",
                RET_VAL:=> "stat_IM0_01_RV");
   "HMI_Read_IM0_N1" := FALSE;
END_IF;

The LADDR is the hardware identifier that TIA Portal assigns to the partner's PROFINET interface in the device view. Right-click the S7-1200 → Properties → System constants to copy the constant. Do not hard-code the IP address — LADDR resolves through the project's device configuration and survives a topology change.

6.3 I&M record layout

7. Project Engineering — Open TCP Path (When Required)

Use Open User Communication when the data bursts exceed 212 bytes, when you need TLS, or when the S7-1200 must talk to a non-S7 partner in parallel. The S7-1500 plays the role of the active client, the 12 S7-1200s are passive servers.

7.1 Block chain per partner

For each substation, instantiate TCON, TSEND, and TRCV as a multi-instance DB. TIA Portal's TSEND_C / TRCV_C combined blocks are a faster starting point for a 1:1 relationship, but for the 1-to-12 head station use the discrete blocks so a single TCON can be shared.

// Open a passive connection to 192.168.0.11, port 2000
"iTCON_01"(REQ     := TRUE,
           ID      := 1,                          // local ID
           CONNECT := "TCON_IP_V4_01",            // DB of type TCON_IP_V4
           DONE    => "stat_TCON_01_OK",
           BUSY    => "stat_TCON_01_Busy",
           ERROR   => "stat_TCON_01_Err",
           STATUS  => "stat_TCON_01_St");

The TCON_IP_V4 structure must declare both ends:

For 12 S7-1200 servers, configure the head as a TCP server on 12 different local ports (2001..2012) and let each S7-1200 actively TSEND_C on a 1 s cycle. This keeps connection re-establishment on the field PLC and simplifies the head's program, because every partner is just another incoming connection ID.

7.2 Polling pattern on the S7-1200 server

On each S7-1200, instantiate a single TSEND_C with CONTROL.REQ driven by a 1 s clock. The block sends the latest copy of DB_Telemetry (cloned into the SD area) and re-uses the same connection for the return path. The S7-1500 receives via TRCV with a fixed receive length equal to the payload size; leftover bytes are reported in RCVD_LEN.

8. PUT/GET Status Word Decoding

Every GET/PUT instance returns a STATUS word. The most common values when the head polls 12 S7-1200 servers:

9. PUT Path — Writing to the S7-1200s

The PUT block is the mirror of GET. It writes from the head into a remote DB on the S7-1200. The block is enabled the moment a write is needed; cycling it every 100 ms with the same data is harmless but wastes connection bandwidth.

// Write 16-byte recipe to S7-1200 #3
IF "recipe_loaded" THEN
   "iPUT_03"(REQ   := TRUE,
             ID    := 13,                          // connection ID for node 3
             ADDR_1:= P#DB50.DBX0.0 BYTE 16,
             SD_1  := P#DB_Recipes.Node[3] BYTE 16,
             DONE  => "stat_PUT_03_Done",
             ERROR => "stat_PUT_03_Err",
             STATUS=> "stat_PUT_03_St");
   "recipe_loaded" := FALSE;
END_IF;

The partner S7-1200 must have its DB created with the same absolute addresses. A common pitfall is that the remote CPU's DB must be set to non-optimised when the S7-1500 PUT block addresses the DB by absolute byte offset.

10. Connection Diagnostics on the S7-1500

1. Online → Diagnostics → Connection diagnostics shows all 12 partners and their state (established / aborted / not configured).
2. Right-click a connection → Connection status reveals the last error, the bytes sent, and bytes received.
3. On the partner S7-1200, Online → Diagnostics → Diagnostic buffer will log any incoming S7 connection from the head, including the TSAP.

For continuous monitoring, the RDREC/WRREC pair can be used against the head CPU's own PROFINET interface to read internal connection statistics — useful in large fleets when the HMI cannot poll the diagnostic pages fast enough.

11. Verification Steps

1. Compile and download the head S7-1500 project. Force the value of "clock_100ms" in the watch table to TRUE to trigger a single GET cycle. Verify NDR rises and STATUS is 0 for all 12 instances.
2. Open each S7-1200 in online mode and inspect DB_Telemetry. The values should match the S7-1500's DB_Fleet.Node[i] within one OB35 cycle.
3. Pull the PROFINET cable on substation 6. Within 5 s, the head should report ERROR = TRUE and STATUS = 8101 on iDB_GET_06. Reconnect and confirm the connection auto-rebuilds (the head retries every 10 s by default).
4. Run Get_IM_Data on one S7-1200 and inspect DB_IM0_Sub_xx. Field 0..21 should contain the manufacturer ID "6ES7 ..." and the serial number in ASCII.
5. Force STATUS of iDB_GET_05 to 16#8107 by deleting DB1 on the partner. Confirm the head logs the error and does not stop the OB.

12. Performance and Cycle Planning

For a 100 ms OB35 cycle, the head has 12 × PUT/GET rounds per cycle. The measured round-trip on a PROFINET subnet with one switch is ≈ 4–8 ms per call when the payload is 32 bytes, so a fleet of 12 fits inside the 100 ms budget. If the payload is closer to 212 bytes, the budget shrinks to 60–70 ms and the cycle should be lifted to 150 ms or 200 ms.

For topologies that exceed 20 substations, group the nodes on the same PROFINET interface and run the GET calls on multiple OB35 priorities using a round-robin scheduler. This avoids a single OB running past its scheduled time and triggering a time-error OB (OB80).

13. Security and Firewall Considerations

From S7-1500 firmware V2.9 and S7-1200 firmware V4.4, Siemens offers Protection & Security with access-level passwords and an OPC UA server. The "Permit access with PUT/GET" flag still controls whether the head may read/write over S7 communication. For plants subject to IEC 62443, restrict the head PLC's PROFINET interface to a dedicated VLAN and use the SCALANCE firewall rules to drop unknown TSAPs.

14. Common Faults and Quick Map

15. FAQ