Architecture Overview
Integrating a third-party Ethernet camera that exposes data as a telnet server (a plain TCP socket on port 23 or a user-defined port) into a Siemens S7-300 control system via WinCC requires choosing the right boundary protocol. The camera publishes ASCII frames on a TCP socket; the S7-300 has no native telnet client. The boundary device - a PC running WinCC, SIMATIC NET, or a CP343-1 Lean/Advanced module - must terminate the TCP session, parse the ASCII payload, and expose the data as S7 variables or OPC tags that WinCC can read and visualize.
Four practical integration paths exist:
- SIMATIC NET OPC Server with the SEND/RECEIVE (S/R) interface, exporting each parsed value as an OPC DA 3.0 tag that WinCC reads through the OPC channel.
- WinCC channel driver - the WinCC "TCP/IP" or "Named Pipes / TCP/IP Auto-Hotspot" channel - connected to a passive station on the PC's own network interface, with the camera treated as a remote partner.
- Direct S7-300 TCP communication using a CP343-1 Lean (6GK7343-1CX10-0XE0) or CP343-1 Advanced (6GK7343-1GX30-0XE0) with FB100 (AG_SEND) / FB101 (AG_RECV) and TCON / TDISCON blocks running on the S7 side.
- PROFINET IO Device - replacing the telnet camera with a camera that supports PROFINET IO, so the S7-300 (with CP343-1 Advanced) reads image data or parameters as cyclic I/O.
The choice depends on whether the camera firmware supports any protocol other than raw telnet and on whether the user accepts a PC gateway or wants a controller-to-controller link.
Prerequisites and Hardware
| Component | Order Number / Version | Notes |
|---|---|---|
| S7-300 CPU | 6ES731x series, FW ≥ V2.x for TCP | CPU 314/315/317 required for full ISO-on-TCP and TCP open services |
| Ethernet CP | 6GK7343-1CX10-0XE0 (Lean) or 6GK7343-1GX30-0XE0 (Advanced) | Required for SEND/RECEIVE; integrated PROFINET port on newer CPUs is also valid |
| PC Ethernet NIC | Standard GbE adapter | Independent of the CP5611 Profibus card; Profibus is irrelevant for Ethernet IP traffic |
| CP5611 Profibus card | 6GK1561-1AA01 | Only useful for Profibus DP master or DP/DP coupler - cannot bridge to Ethernet TCP traffic from a telnet camera |
| SIMATIC NET PC Software | V14 SP1 or later (matches TIA Portal version) | Includes OPC Scout V10 and the S/R interface for PC stations |
| WinCC | V7.5 SP2 / TIA WinCC Professional V17 or later | Channel "SIMATIC S7 Protocol Suite" for direct PLC; "OPC" channel for SIMATIC NET |
| Camera | Telnet server mode, ASCII frame, default port 23 or custom | Confirm frame format, terminator (CR/LF), and maximum payload size |
Option A: SIMATIC NET OPC Server as TCP Receiver
SIMATIC NET PC software turns the engineering station into a PC station that owns an OPC DA server. The PC opens a passive or active TCP connection toward the camera, reads the ASCII stream with a configured SEND/RECEIVE application, and re-publishes each parsed field as an OPC item. WinCC consumes the OPC items through the "OPC" WinCC channel.
Step-by-step
- Install SIMATIC NET on the WinCC station. In Station Configuration Editor (Station Manager), add a PC station with one OPC server and one "IE General" (IE CP) module. Index the IE CP to the same physical NIC bound to the camera subnet.
- Open SIMATIC NET Configuration Console and assign the IE CP a fixed IP in the camera subnet (for example 192.168.10.10/24). Activate the module and confirm it is reachable from the camera (ping test).
- In STEP 7 V5.5 / TIA Portal, open the project containing the S7-300 station. Add the PC station via Insert > Station > SIMATIC PC Station. Configure an S7 connection in NetPro (or the TIA "Devices & Networks" editor) between the OPC server and the S7-300 CPU. Note the connection ID and the local/remote TSAPs.
- Write or use an existing SEND/RECEIVE FB (FB100/F101 on the S7 side, or the S/R DLL on the PC side) to push the parsed camera values into S7 data blocks. The OPC server exposes DB offsets as items: e.g.
S7:[S7 connection_1]DB100,BYTE0. - In WinCC Explorer, add a new channel of type "OPC". Add a connection pointing to the local SIMATIC NET OPC server (ProgID:
OPC.SimaticNET). Add tags linked to the OPC item paths defined in step 4. - Bind the tags to screen I/O fields and to the runtime archive. Enable the OPC channel and download the WinCC project to runtime.
Option B: WinCC TCP/IP Channel Directly to the Camera
WinCC ships a "TCP/IP" channel (under "Windows Protocols") and an "IE TCP/IP" channel in the SIMATIC S7 Protocol Suite. The TCP/IP channel is a raw socket driver: WinCC becomes a TCP client that opens a passive or active connection to a partner on a defined port. The partner can be the camera itself, with the parsed ASCII stream mapped to process tags via a "raw data tag" of type "Text tag 8-bit character set".
- In WinCC Explorer add channel "TCP/IP" from the "Windows Protocols" group.
- Create a new connection: enter the camera IP (e.g.
192.168.10.50) and the camera port (default23). Set the connection role to "Client". - Add a "Raw Data Tag" of datatype "Text tag 8-bit character set". Length should match the camera frame plus a few bytes for the telnet IAC escape overhead; 256 bytes is a safe default.
- Schedule a Global Script C or VBS action to run on a 100 ms tick. The action reads the raw tag, splits the buffer on the configured terminator (CR/LF), and writes each numeric field to an internal WinCC tag.
- Internal WinCC tags are then forwarded to the S7-300 via the S7 Protocol Suite connection (MPI/Profibus/ISO-on-TCP). Configure a secondary connection to the S7 CPU with rack/slot or ISO-on-TCP TSAPs.
Option C: Direct S7-300 TCP Communication via CP343-1
If the application is latency-sensitive or the WinCC PC must be bypassed, the S7-300 itself can open a TCP connection to the camera using the open communication services of the CP343-1.
Required blocks
| Block | Function | Notes |
|---|---|---|
| FB100 AG_SEND | Send data to communication partner | From SIMATIC NET CP library; available in STEP 7 "Standard Library > Communication Blocks" |
| FB101 AG_RECV | Receive data from communication partner | Pair with FB100; runs in OB1 or OB35 cyclic interrupt |
| FC5 AG_INIT / FC6 AG_LSEND / FC7 AG_LRECV | Connectionless UDP service | Useful for broadcast-style camera telemetry |
| UDT 65 / UDT 66 / UDT 63 | Connection description data types | Required for FB100/FB101 instance DBs |
Configure the CP343-1 in HW Config (or TIA "Devices & Networks") with one or more "TCP connections" of type "TCP" (not ISO-on-TCP). The connection partner is the camera; specify the camera IP, the camera's TCP port, and the local port (any free port above 2000). In the S7 program, instantiate FB101 with the connection ID from the CP configuration; the FB returns the received frame in its RD output. A simple state machine - WAIT_FOR_DATA, PARSE, STORE_TO_DB - should run on OB35 (default 100 ms) and use a global clock bit to debounce.
Telnet framing requires stripping the leading telnet negotiation banner. The CP343-1 cannot negotiate telnet options. A recommended workaround is to put a small PC bridge (or a managed industrial gateway like the SCALANCE SC646-2C, 6GK5646-2GS00-2AC2) between the camera and the PLC: the gateway runs a telnet client to the camera, disables local echo and character mode, and forwards only the data stream to a TCP listener that the S7-300 connects to.
Option D: Replace Telnet with PROFINET IO
Many industrial vision cameras (Cognex, Basler ace 2, Keyence CV-X, Sick InspectorP) expose a PROFINET IO device interface. A PROFINET IO camera is preferable to a telnet camera because:
- The CP343-1 Advanced (6GK7343-1GX30-0XE0) and CPU 31x PN/DP variants can act as a PROFINET IO controller, with cyclic I/O exchanged at 1 ms or 4 ms.
- No byte-stream parsing is required; the camera populates input modules and the S7 program reads them as if they were local I/O.
- Diagnostic and alarm channels are defined by PROFINET, removing the ambiguity of a freeform telnet frame.
To reconfigure, load the camera's GSDML file (e.g. GSDML-V2.3-Cognex-IS7000-20150112.xml) into HW Config / TIA Portal, drag the camera into the PROFINET topology, assign device name and IP via the PRONETA tool, and download the IO controller configuration to the S7-300.
Choosing the Right Telnet Frame Format
Telnet, as defined in RFC 854, prepends a negotiation handshake (IAC WILL/WONT/DO/DONT) before passing printable data. Most industrial cameras that present "telnet mode" actually present a raw TCP socket on port 23 without the full telnet state machine. Confirm the frame by running a packet capture on a laptop between the camera and the network:
- Install Wireshark on the test laptop. Capture on the wired Ethernet interface.
- Apply display filter
tcp.port == 23. - Trigger a measurement on the camera. Inspect the TCP stream via Follow > TCP Stream.
- If the first bytes are
FF FB xxorFF FD xx(hex), the camera is performing real telnet negotiation. Configure the camera to disable echo, suppress go-ahead, and disable character mode. If the first bytes are printable ASCII, the camera is using port 23 as a raw TCP port; treat the data as a pure line-oriented stream.
Commissioning Procedure (Recommended Sequence)
- Verify the camera is reachable from the WinCC PC:
ping 192.168.10.50andtelnet 192.168.10.50 23from a command prompt. Confirm a frame is received within 1 s. - From the S7-300, ping the camera from the CP343-1 using a simple
PINGvia the CP's Web-based diagnostics page or via FB55 (IP_CONF) / FB56 (IP_SEND) when using ISO-on-TCP. Failure here means the routing table or subnet mask is wrong. - Open Wireshark on a mirror port to validate frame rate, frame size, and whether the camera is using keep-alives.
- If using SIMATIC NET OPC, run OPC Scout V10 on the PC and add an item. Verify the value updates before adding it to WinCC.
- If using WinCC TCP/IP channel, drop a "Diagnostics" screen on the WinCC runtime with a raw data tag display, and add a trigger-based audit log to confirm the buffer is being refreshed.
- Finally, propagate the parsed value to the S7-300 via the S7 channel. Confirm with a STEP 7 VAT table that the value in the target DB matches the value on the WinCC screen.
Verification Checklist
| Check | Method | Pass Criterion |
|---|---|---|
| L2 link | LED on camera NIC and PC NIC | Solid green / link light on both ends |
| L3 reachability | ping from PC and from CP343-1 | <1 ms, 0% loss |
| Telnet stream present | Wireshark, tcp.port==23
|
At least one data segment per trigger |
| OPC item readable | OPC Scout V10 | Quality "Good", value updates within poll period |
| WinCC tag updates | WinCC Online Trend Control | Curve visible, no flat-lining |
| S7-300 DB updated | STEP 7 Monitor/Modify, VAT table | DB offset matches parsed numeric value |
| End-to-end latency | Timestamp on camera frame, compare to WinCC tag time stamp | < 1 s typical, < 5 s acceptable for SCADA |
Troubleshooting Matrix
| Symptom | Likely Cause | Fix |
|---|---|---|
| OPC Scout shows Quality "Bad" | SIMATIC NET PC station not in RUN; OPC server not started | Open Station Configuration Editor, verify OPC server index, restart Station Manager service |
| WinCC TCP/IP channel connection down | Wrong IP/port, or camera uses telnet negotiation that the channel cannot handle | Disable telnet negotiation on camera, or insert gateway |
| FB101 (AG_RECV) returns STATUS 8183h | No data available - normal on first call; also occurs if CP is not in RUN | Check CP RUN/STOP LED; implement polling with DONE bit |
| FB101 returns STATUS 8186h | Resource problem on CP; too many concurrent connections | Reduce number of open connections; check CP343-1 max connections (Lean: 8, Advanced: 16) |
| Telnet camera not responding to poll | Camera in passive (server) mode - expects PC to connect | Switch channel/connection role to "Client" or open socket from PC first |
| Frame truncation | Raw data tag length too short | Increase raw data tag length to 2× expected frame size |
| Values lag by tens of seconds | OB35 cycle time too long or Global Script running on demand only | Set OB35 to 100 ms; trigger Global Script via cyclic timer (250 ms) |
| CP5611 Profibus card "not found" in WinCC | Wrong PG/PC interface selected; CP5611 driver not installed | Use Set PG/PC Interface tool, set S7ONLINE access point to CP5611 (PROFIBUS) |
Performance and Sizing Notes
Camera telnet payloads are typically 32 bytes to 256 bytes per frame. At 10 frames per second, the sustained bandwidth is well under 30 kbit/s, so neither gigabit nor 100 Mbit is the bottleneck. The bottleneck is end-to-end latency, dominated by the WinCC tag acquisition cycle (default 1 s) and the OB35 cycle on the S7-300 (default 100 ms). For a typical SCADA application, an end-to-end latency of 500 ms to 1.5 s is realistic.
If a control loop closes on the parsed camera value, do not run the parser in WinCC - move parsing into OB35 of the S7-300 with FB100/FB101 and update the DB directly. WinCC is a visualization layer, not a deterministic control layer.
Security and Hardening
- Put the camera and the S7 station on a separate VLAN with no default-route to the corporate network. Industrial cameras have well-documented RCE vulnerabilities; isolate them.
- Disable telnet on the camera and use the camera's HTTPS/REST API where possible. If telnet is mandatory, restrict the listening interface and bind to a non-routable address.
- Use the SCALANCE S623 (6GK5623-0AS00-2AC2) or similar security appliance for DMZ-style isolation between the camera and the OT network.
- In WinCC, assign the OPC channel user to a low-privilege Windows account. Disable remote registry access on the runtime station.
FAQ
Can the S7-300 read a raw telnet stream without a PC gateway?
Only with a CP343-1 Lean or Advanced, using FB100/FB101 over a configured TCP connection. Real telnet negotiation (RFC 854) is not supported by the CP, so the camera must be set to a raw TCP mode or you must insert a small gateway to strip the telnet IAC bytes.
Do I need the CP5611 Profibus card for this integration?
No. The CP5611 (6GK1561-1AA01) is a Profibus master/slave PCI card and is irrelevant to the Ethernet traffic from a telnet camera. Use a standard Ethernet NIC on the PC and either a CP343-1 on the S7-300 or a CPU 31x PN/DP with an integrated PROFINET port.
Which WinCC channel is best for reading a TCP socket?
For raw byte streams use the "TCP/IP" channel under "Windows Protocols" and parse the buffer in a Global Script. For structured data, prefer SIMATIC NET OPC with a custom SEND/RECEIVE application - the OPC items are then bound to DB offsets and exposed to WinCC through the OPC channel.
How do I disable telnet negotiation on the camera?
Capture the wire with Wireshark using filter tcp.port == 23. If the first bytes are FF FB or FF FD (hex), the camera is performing real telnet. Consult the camera manual for a "raw socket" or "TCP server" mode; on many industrial cameras, switching the protocol from "Telnet" to "TCP" or "Binary" disables the negotiation. If no such mode exists, use a PC-side bridge or industrial gateway to absorb the negotiation bytes.
Is PROFINET IO a viable replacement for the telnet camera?
Yes. Most modern industrial vision cameras (Cognex In-Sight, Basler ace 2, Keyence CV-X, Sick InspectorP) ship with a PROFINET IO device GSDML. A CP343-1 Advanced or a CPU 31x PN/DP acts as the PROFINET IO controller and reads camera parameters as cyclic I/O - removing the need for byte-stream parsing and a PC gateway.