Resolving BSEND Error 1 Siemens S7-300 to WinCC 7.2 Communication

1. Problem Overview

When an SIMATIC S7-300 CPU 315-2 PN/DP is paired with WinCC 7.2 over TCP/IP and the application uses the BSEND function block (FB12 / SFB12) to push raw data into the HMI/SCADA archive, the most common symptom is the block returning STATUS = 1 on the very first call and never advancing. The WinCC side reports a TCP connection UP (standard tags poll fine), but the raw data tag tied to the BSEND partner never receives data, and the BSEND job never transitions out of the BUSY state.

This is a classic S7-communication misconfiguration on CPU 315-2 PN/DP. Three independent faults typically stack on top of each other:

1. The S7 connection in NetPro is configured as a one-way connection instead of a two-way connection.
2. The BSEND instance FB12 was copied from the wrong library (S7-400 family rather than the S7-300 family), so the internal time/ID handling diverges from the PLC firmware expectation.
3. The connection endpoint in NetPro points to the wrong resource (rack/slot) — typically defaulting to rack 0, slot 0 instead of the PN port at rack 0, slot 2.

Each fault alone produces STATUS = 1. Together they guarantee a non-functional link.

2. Affected Hardware, Firmware, and Software

3. BSEND Status / Error Code Reference

STATUS (RET_VAL) of FB12 / SFB12 BSEND returns one of the following values. The values below are extracted from the STEP 7 online help and the Siemens S7-300/400 BSEND/BRCV application example (entry ID 37873547).

4. Root Cause Analysis

4.1 One-way vs Two-way Connection

BSEND/BRCV require an S7 two-way connection (bidirectional). If NetPro is configured with the partner as "Unspecified" or with "One-way" selected, the CPU opens an outgoing transport but the WinCC channel cannot bind to a partner ID, so STATUS = 1 persists. The same applies if the connection is typed as a PUT/GET only passive connection on the HMI side.

4.2 Rack and Slot for the PN Port

On the CPU 315-2 PN/DP, the PROFINET port is logically addressed as Rack 0, Slot 2. The MPI/DP port occupies Slot 3 in some firmware variants. If the S7 connection target is left at the default rack 0, slot 0, the connection is opened against an empty resource (which corresponds to resource ID 02 — accessible for read-only standard tag polling without a configured partner, hence the misleading "connection UP" indicator on WinCC).

4.3 FB12 Library Family

The block instance carries an internal family identifier in the FB header. If the FB12 was dragged from the S7-400 standard library and dropped into an S7-300 program, the family bits do not match the CPU 315 firmware's expected type signature, and the call is rejected. Open the FB properties in STEP 7 — the Family attribute must read S7300 (or specifically S7-300/400 for cross-platform variants, never S7400 only).

4.4 R_ID Mismatch

BSEND/BRCV use a 16-bit R_ID (DWORD LSB) as the job discriminator. The WinCC raw data tag must reference the exact same R_ID as the PLC FB12 instance. R_ID is hexadecimal on the PLC side and integer on the WinCC side — converting R_ID = DW#16#12345678 on the PLC means 305419896 (0x12345678) on the WinCC tag dialog.

5. Prerequisites for a Working BSEND Channel

• STEP 7 V5.5 SP2 or later installed with the S7-300 Communication Blocks library.
• WinCC 7.2 with the S7DOS / S7CHN channel package.
• PLC and PC on the same IP subnet; PN port IP reachable via ping from the WinCC station.
• PG/PC interface set to TCP/IP (Auto) on the engineering station.
• The PLC project is open in STEP 7 (NetPro cannot be edited from WinCC Explorer for S7-300 connections — only TIA Portal or STEP 7 classic allows NetPro editing).
• A second PC or PLC is not required for testing — WinCC can act as the BSEND partner on the same hardware.

6. Step-by-Step Resolution

6.1 Rebuild the NetPro Connection

1. Open the STEP 7 project. Right-click the S7-300 station → Open with NetPro.
2. Locate the existing S7 connection to the WinCC station. Right-click → Delete.
3. Insert a new connection: select the CPU 315-2 PN/DP → Insert New Connection → partner = WinCC station (Unspecified).
4. Set Type = S7 Connection.
5. In the connection properties dialog, set the partner endpoint to Rack 0, Slot 2 (PN port). Verify the CPU-local endpoint is also Rack 0, Slot 2.
6. Set the connection direction to Bidirectional (Two-way). This is the default for new connections — if it reads "One-way", the partner was misidentified; cancel and re-select the partner as the WinCC station.
7. Note the Connection ID (local) and Connection Resource — these will populate the WinCC channel configuration.
8. Download the NetPro configuration to the PLC (online → Download to Target Station). Stop CPU only if required by the firmware build.

6.2 Insert the Correct FB12 into the S7 Program

1. In the STEP 7 project, right-click Blocks → Insert → Standard Library → Communication Blocks for S7-300.
2. Drag FB12 BSEND into the project blocks container.
3. Open FB12 properties — confirm Family = S7300 and Author = SIEMENS. If the family reads S7400, replace the block.
4. Call FB12 from OB1 (or the cyclic archive OB). Standard call signature for raw data transfer to WinCC:\li>

CALL "BSEND", DB100
  REQ     := M 100.0
  R       := M 100.1
  ID      := W#16#0001          // local connection ID from NetPro
  R_ID    := DW#16#00000001     // must match WinCC raw tag R_ID
  DONE    := M 110.0
  ERROR   := M 110.1
  STATUS  := MW 112
  SD_1    := P#DB200.DBX0.0 BYTE 200
  LEN     := MW 120            // length in bytes, <= 32 KB and even

5. Compile and download to the PLC.

6.3 Configure the WinCC Raw Data Tag

The WinCC side uses a Raw Data Tag on the S7DOS / S7CHN channel. Per the Siemens documentation for raw data tags for BSEND/BRCV functions of S7 communication (RT Professional) and the WinCC 7.2 information system, the procedure is:

1. Open WinCC Explorer → Tag Management.
2. Select the S7DOS channel unit (or S7CHN for legacy installations). Add a new connection if one does not exist, pointing to the WinCC station defined in NetPro with the IP address of the CPU 315-2 PN/DP.
3. Right-click the connection → New Tag.
4. Set Type = Raw Data Tag.
5. Set the R_ID to match the PLC value. If the PLC uses DW#16#00000001, set WinCC R_ID = 1 (decimal). If the PLC uses DW#16#12345678, set WinCC R_ID = 305419896.
6. Configure the buffer length to match the PLC LEN field, in bytes.
7. Activate WinCC Runtime.

6.4 Verify with Status/Force Table

With the corrected connection in place, FB12 should transition to STATUS = 7001 (busy), then DONE = TRUE / STATUS = 0000 within one to three OB1 cycles, depending on PLC scan and WinCC poll interval.

7. Connection Endpoint Reference (CPU 315-2 PN/DP)

8. Verification Procedure

1. Open STEP 7 → Monitor/Modify. Force REQ TRUE, then FALSE.
2. Observe STATUS = 0000, DONE = TRUE on the next cycle.
3. In WinCC Explorer → Tag Management → right-click the raw data tag → Properties shows the last successful transfer timestamp.
4. In the WinCC channel diagnostics (right-click connection → Status), confirm the connection state is Established rather than Establishing or Error.
5. Toggle a known bit in the source DB and confirm the change is visible in WinCC via the raw data tag raw view.

9. Alternative: AR_SEND for Process-Driven Archiving

If the ultimate goal is process-driven archiving (automatic WinCC archive entries triggered by PLC events), the proper Siemens path is SFB37 (AR_SEND). However, SFB37 AR_SEND requires the AR_SEND mode in WinCC and is only supported with CPU 400 / S7-400. On CPU 315 the BSEND/BRCV workaround described in this article is the documented substitute. Reference: Siemens entry ID 23629327 — How do you use SFB37 (AR_SEND) for process-driven archiving.

For TIA Portal projects on newer S7-1500 hardware, use the native ArchiveData functions in the WinCC Unified / RT Professional configuration. The raw data tag documentation for S7 communication covers the TIA-side variant.

10. Troubleshooting Matrix

11. Field-Engineering Notes

• On older CPU 315 firmware (V2.x), BSEND is supported only via the CP 343-1 external PROFINET/Industrial Ethernet CP, not via the integrated PN port. If STATUS = 1 persists after fixing rack/slot, check whether the project is targeting the integrated PN or an external CP; the connection endpoint must match the physical interface.
• WinCC 7.2 Update Rollups later than UR5 changed the default S7CHN handshake behavior. After upgrading WinCC, re-test the connection to ensure the partner endpoint resource ID is still matched. Recreating the WinCC connection (delete + re-add) forces a fresh resource negotiation.
• If multiple WinCC clients must receive the same payload, BSEND supports only one BRCV partner per R_ID. Use separate R_IDs and separate raw data tags, or move to AR_SEND on a CPU 400 station.
• For very large archives, segment the DB into 30 KB chunks. Each chunk is a separate BSEND call with a unique R_ID. Avoid >32 KB per call — STATUS = 80F1 fires immediately on overflow.
• Do not use BSEND to send raw data to a third-party HMI panel. BSEND is S7-protocol-specific; the partner must implement the S7 BSEND/BRCV handshake, which WinCC and TIA Portal HMI panels do natively.
• If the PLC is behind a managed switch, disable flow control negotiation on the PN port — some switches throttle TCP port 102 and delay the BSEND handshake beyond the firmware watchdog, causing STATUS = 1.