Resolving Node-RED Offline Status on IOT2040 with S7-200 Smart

1. Problem Description

A SIMATIC IOT2040 (6ES7647-0AA00-1YA2) running Node-RED with the node-red-contrib-s7 palette reports a persistent offline / connecting status on the S7 in and S7 out nodes even though the LAN is healthy: ping 192.168.200.4 succeeds from the IOT shell, port 102/tcp answers on the PLC, and the same PG/PC can reach the S7-200 SMART CPU (typical catalog numbers: CPU SR20 6ES7288-1SR20-0AA0, CPU ST40 6ES7288-1ST40-0AA0, CPU SR60 6ES7288-1SR60-0AA0) through STEP 7 Micro/WIN SMART. The S7 node toggles between connecting and offline, never reaches online, and read values stay undefined.

This behavior is a symptom, not a Node-RED bug. The underlying S7 communication driver (s7comm over ISO-on-TCP, port 102) is rejecting or being refused by the CPU because either (a) another engineering station already holds the only allowed PG/OP connection, or (b) the S7 node parameters do not match the rack/slot and TSAP expectations of the SMART CPU.

2. Network Topology and IP Plan

The reference topology for this scenario uses a SCALANCE switch (e.g., SCALANCE XB005 6GK5005-0BA00-1AB2 or XB208 6GK5208-0BA00-2AB2) on a single /24 industrial subnet, with the IOT2040 X1P1 acting as the field-facing LAN interface and X2P1 facing the WAN/cloud:

3. Root Cause Analysis

The S7-200 SMART CPU supports a fixed number of simultaneous S7 connections, governed by the S7-200 SMART system manual. With the standard firmware (FW ≥ V2.5, article SIMATIC S7-200 SMART system manual entry page), the CPU exposes up to one PG connection plus one OP/HMI connection, plus a configurable number of GET/PUT partner connections (default 1). When STEP 7 Micro/WIN SMART is online on the laptop, it occupies the PG slot. The IOT2040 then tries to open an S7 connection to the same TSAP pair, the CPU rejects it with an S7 connection refused / resource unavailable error, and the Node-RED s7 driver reports offline.

The second contributing cause is mismatched node parameters. The node-red-contrib-s7 node sends the request with the configured TSAP. If the IP, Rack, or Slot fields in the S7 node config do not match the CPU, the connection attempt will silently fail or be refused. The S7-200 SMART always answers on Rack 0 / Slot 1 (or Slot 2 for an EM module that owns the Ethernet port, depending on firmware version). For the integrated Ethernet port (CPU SR/ST/SR60), the canonical answer is Rack = 0, Slot = 1.

4. Prerequisites

1. IOT2040 with the SIMATIC Industrial OS image or the SIMATIC IOT2040 operating instructions configured image, Example Image ≥ V3.x.
2. Node-RED pre-installed on the IOT2040 (default port 1880). Verify with systemctl status node-red from an SSH session.
3. node-red-contrib-s7 palette installed via the Node-RED Palette Manager or with npm install node-red-contrib-s7 inside ~/.node-red. See the official node-red-contrib-s7 flow library entry for installation details.
4. S7-200 SMART CPU firmware ≥ V2.5 (CPU article numbers in section 1) with the Ethernet port configured for TCP/IP access.
5. STEP 7 Micro/WIN SMART (V2.5 or later) only if you need to verify the CPU side; it must be offline before opening the Node-RED S7 connection.
6. A stable LAN, RJ45 cabling to the SCALANCE switch, and SSH/PuTTY access to the IOT2040 (root, default password on older images: root).

5. S7 Node Configuration Parameters

Configure the S7 node (both S7 in and S7 out) with the values that match the S7-200 SMART Ethernet port exactly. Any mismatch causes the ISO-on-TCP connect to fail without surfacing a clear error inside Node-RED:

For S7-200 SMART, the V-memory area is the canonical data area (VB, VW, VD). MW14 is technically the same word as VW14 (both start at byte offset 14 in the V area), but using the VW prefix is recommended because it documents intent. M-memory is reserved and should be avoided in production code. See the S7-200 SMART system manual, chapter "Memory areas".

6. Step-by-Step Resolution

1. Confirm cabling and addressing. From a PuTTY SSH session on the IOT2040 (SSH to 192.168.200.1, user root), run:
   ping -c 4 192.168.200.4
nc -zv 192.168.200.4 102
   Both must succeed. If nc reports "Connection refused", check the SCALANCE port VLAN and CPU firewall settings.
2. Remove NetToPLCSIM if you have a real CPU. NetToPLCSIM is a TCP/UDP bridge for the S7-PLCSIM simulator and has no role on real S7-200 SMART hardware. If installed on the laptop, disable or uninstall it. The real CPU speaks S7comm on TCP/102 natively.
3. Take the engineering laptop offline from the CPU. In STEP 7 Micro/WIN SMART, click the Disconnect button or close the project. The CPU only allows one PG/HMI connection at a time on its standard firmware, so the IOT2040 cannot share the bus.
4. Configure the S7 in node in the Node-RED flow editor at http://192.168.200.1:1880:
   - IP: 192.168.200.4
   - Port: 102
   - Rack: 0, Slot: 1
   - Variable: e.g. FlowIn
   - Address: MW14 (read WORD)
5. Configure the S7 out node (only the Address field typically changes):
   - IP: 192.168.200.4
   - Address: MW100 or another free V word
   - Connect to an inject or function node setting msg.payload = { MW100: 1234 }
6. Deploy the flow. The status indicator under the S7 in node should transition from connecting to online within 2-5 seconds if the CPU is reachable and no PG is holding the connection.
7. Add a debug node to the S7 in output to view msg.payload. A correct read shows a numeric value, e.g. 1234, not undefined.
8. Persist the configuration. Make sure the .node-red/flows_*.json file is committed or backed up, because Node-RED restart re-reads from disk.

7. Verification

After deploy, verify the S7 connection from three angles:

1. Node-RED status pill: the S7 in / S7 out nodes display a green dot with text online instead of grey offline or yellow connecting.
2. Node-RED log: open http://192.168.200.1:1880 → menu → log. Look for the absence of S7comm: Connection refused or Trying to connect to ... repeating lines.
3. Live tag verification: in STEP 7 Micro/WIN SMART Status Chart add VW14, force a value, and watch the value stream into the Node-RED debug panel.
4. Linux-level check (optional): from IOT2040 shell, ss -tnp | grep :102 should show an ESTABLISHED socket to 192.168.200.4:102.

8. Common Error Messages and Codes

9. Advanced Troubleshooting

9.1 Capture the S7 handshake

If the node still refuses to come online after the steps above, capture the ISO-on-TCP frames from the IOT shell using tcpdump and inspect with Wireshark:

The Wireshark dissector for S7COMM shows the connect-request TPDU and the CPU's response. A CR TPDU with a wrong TSAP yields a DR TPDU with reason code 0x0001 (invalid TSAP) or 0x0002 (resource shortage). Adjust the rack/slot or close the PG client accordingly.

9.2 S7-200 SMART connection limits

The S7-200 SMART system manual documents a maximum of 1 PG + 1 OP/HMI + up to 8 GET/PUT active partners (FW ≥ V2.5). With GET/PUT disabled in the CPU's Ethernet configuration (block PUT/GET = "Permit only with PUT/GET"), any non-PG/OP client connection will be refused. In Micro/WIN SMART, navigate to System Block → Ethernet → Connection Mechanisms and ensure Permit PUT/GET communication is checked if you intend to use the S7 driver as a generic S7 client.

9.3 Avoiding connection thrash

Disable the S7 node's automatic reconnect bursts by setting Cycle time ≥ 1500 ms. If the CPU is intermittently busy, the driver will otherwise flood with CR TPDUs. Some users mitigate this by adding a delay node downstream of the S7 in node.

9.4 IOT2040 firmware and image notes

The IOT2040 ships with Example Image V2.x or V3.x. Node-RED ≥ 1.3 and node-red-contrib-s7 ≥ 3.x are recommended for stable operation on the Yocto-based image. Outdated images occasionally produce offline events due to a default Node.js version that mishandles ISO TSAPs; in that case upgrade to the latest SIMATIC IOT2000 SD card image per the SIMATIC IOT2040 operating instructions.

9.5 Switching to S7-1200/S7-1500

If the application allows it, replacing the S7-200 SMART with an S7-1200 (e.g., CPU 1214C 6ES7214-1AG40-0XB0) or S7-1500 (e.g., CPU 1511-1 PN 6ES7511-1AK02-0AB0) removes the single-PG limitation: both families support up to 16 active S7 connections plus OPC UA. The node-red-contrib-s7 node uses the same parameter model for the S7-1200/1500 (Rack 0 / Slot 0/1, port 102), so existing flows port with only an IP change.

10. Best Practices for Stable IOT2040 ↔ S7-200 SMART Operation

• Designate one single S7 client on the subnet. If you must run Micro/WIN SMART and Node-RED simultaneously, place the engineering station in a separate VLAN and use a router/switch that allows multiple PG sessions - which still requires a CPU firmware that supports it.
• Use a static IP for the S7-200 SMART CPU via the Ethernet system block; never rely on DHCP for field devices.
• Set the IOT2040 X1P1 as the dedicated LAN port; leave X2P1 for cloud/Internet to avoid accidental routing of S7 traffic to the WAN.
• Tag every Node-RED flow with descriptive variable names and persist flows_*.json via Git so you can roll back after a deploy.
• When commissioning, perform a controlled cutover: deploy Node-RED, confirm online, then close Micro/WIN SMART last.
• Document the rack/slot/TSAP triplet in the panel HMI or in the panel builder; do not assume defaults across CPU families.

11. Field-Proven Checklist

12. Frequently Asked Questions