Resolving S7-1200 Open TCP Connection Refused Errors with PC

Problem Definition: S7-1200 Refuses Open TCP Connection From PC

When configuring Open User Communication between a SIMATIC S7-1200 CPU and a PC application (Python socket, .NET TcpClient, C++ winsock, MATLAB tcpclient, etc.), the most common failure mode is that the S7-1200 returns a non-zero STATUS at the TCON block output and the CPU rejects the incoming or outgoing TCP connection. The PLC never enters the CONNECTED state, DONE stays FALSE, and the ERROR output toggles TRUE within one scan cycle. Remote applications observe either ECONNREFUSED (10061), ETIMEDOUT (10060), or a silent socket hang.

The error stems from one of four root cause families:

1. Incorrect Connection type selection in the TCON data block (active vs. passive establishment confused with client vs. server).
2. Mismatched or absent Local / Remote IP address and port configuration in the TCON_Parameters UDT.
3. Windows Firewall, antivirus, or third-party host-based intrusion prevention software (HIPS) blocking inbound TCP on the configured port.
4. The active_est parameter (also documented as ActiveEstablishment) is set opposite to the intended direction of the connection initiation.

Architecture: Open User Communication on S7-1200 CPUs

The S7-1200 family supports the TIA Portal Open User Communication instruction set using the PROFINET interface integrated on the CPU. The relevant instruction set comprises:

Per the SIMATIC S7-1200 System Manual, a single S7-1200 supports up to 8 active Open User Communication connections on the integrated PROFINET interface. Each connection consumes one Connection ID (WORD, range 1 to 4095 with sub-range restrictions per firmware). The connection is established by calling TCON with a TCON_Param data block that conforms to the TCON_Parameters UDT.

TCON_Parameters UDT Mapping

The TCON_Param data block must be of PLC data type TCON_Parameters (DB assigned to TCON_Param pin). The following table shows the fields that drive the connection handshake:

The two flags that control the direction of the handshake are ConnectionType (must be 16#0B for raw TCP) and ActiveEstablishment. A passive connection (ActiveEstablishment = FALSE) corresponds to a TCP server that listens on LocalPort; an active connection (ActiveEstablishment = TRUE) corresponds to a TCP client that issues a connect() call to RemoteAddress:RemotePort.

Root Cause Analysis: Why the S7-1200 Refuses the Connection

When the S7-1200 rejects the PC peer, the underlying TCP stack returns one of a small set of failure codes. The PLC surfaces them through the STATUS WORD output of TCON. The Siemens documentation identifies the following relevant error codes for the Open User Communication blocks on S7-1200/S7-1500:

The STATUS is updated only for one cycle following a rising edge on REQ. To capture the value, latch it into a static variable on the falling edge of BUSY or on the same scan ERROR rises. Siemens provides a dedicated FAQ explaining the recommended edge-triggered capture pattern for these system blocks.

Solution: Step-by-Step Resolution Procedure

Step 1 - Verify CPU Firmware and Instruction Set

1. Open the device configuration of the S7-1200 in TIA Portal.
2. Right-click the CPU and select Online & diagnostics > General > CPU information. Confirm firmware is V4.0 or later (V4.4 or later is recommended for stable Open User Communication, and V4.6+ introduces additional ISO-on-TCP options).
3. If firmware is older than V4.0, update via the Siemens SIMATIC Automation Tool or TIA Portal Online & diagnostics > Firmware update.

Step 2 - Configure the TCON_Param DB Correctly

Create a global DB of type TCON_Parameters (named e.g. iOUC_Param):

DATA_BLOCK "iOUC_Param"
{ S7_Optimized_Access := 'FALSE' }
TCON_Parameters
BEGIN
   BlockLength       := 64;
   Id                := 1;
   ConnectionType    := 16#0B;   // TCP
   ActiveEstablishment := FALSE; // S7-1200 = passive = server
   RemoteAddress[1]  := 192;
   RemoteAddress[2]  := 168;
   RemoteAddress[3]  := 0;
   RemoteAddress[4]  := 50;      // PC IP (or 0.0.0.0 = accept any)
   RemotePort        := 2000;    // Must match PC client source port or any
   LocalPort         := 2500;    // S7-1200 listen port
   LocalAddress[1]   := 192;
   LocalAddress[2]   := 168;
   LocalAddress[3]   := 0;
   LocalAddress[4]   := 10;      // CPU IP from device config
   LocalTsapIdLen    := 0;
   RemoteTsapIdLen   := 0;
   EstablishmentMode := 0;
END_DATA_BLOCK

If the S7-1200 should instead act as a TCP client, set ActiveEstablishment := TRUE and the PLC will issue a connect() to the remote IP/port of the PC server. Ensure that LocalPort = 0 in active mode so the stack assigns an ephemeral source port.

Step 3 - Trigger TCON with a Rising Edge

In an OB1 network, use a positive-edge-detected REQ signal. Latch the status and error flags:

A "iStart_OUC";
FP "iEdge_Start";
= "iOUC_Tcon".REQ;

"iOUC_Tcon"(REQ := "iEdge_Start",
            ID  := 1,
            CONNECT := "iOUC_Param");

A "iOUC_Tcon".ERROR;
= "iOUC_ErrLatch";

L "iOUC_Tcon".STATUS;
T "iwOUC_Status"; // captured for HMI/diagnostics

The STATUS value remains valid for one cycle; the latched copy in iwOUC_Status preserves it across cycles.

Step 4 - Configure the PC Peer

1. Confirm the PC has a static IP (or DHCP reservation) in the same subnet as the CPU, e.g. 192.168.0.50/24 with gateway 192.168.0.1.
2. Verify reachability by issuing ping 192.168.0.10 from an elevated command prompt. The S7-1200 responds to ICMP echo by default once the PROFINET interface is online.
3. Disable or configure the OS firewall to allow inbound TCP on LocalPort if the PC is the server, or outbound to the PLC RemotePort if the PC is the client.

Step 5 - Add a Windows Firewall Rule (PC Side)

The Windows Defender Firewall with Advanced Security will silently drop inbound TCP SYN segments unless an explicit rule is configured. To add a rule via PowerShell (administrator):

New-NetFirewallRule -DisplayName "S7-1200 OUC TCP 2500" `
  -Direction Inbound -Protocol TCP -LocalPort 2500 `
  -Action Allow -Profile Any -Enabled True

If the PC is the client, also confirm outbound rules permit TCP traffic to the PLC port. If third-party security suites (Symantec, McAfee, Trend Micro, Kaspersky, Sophos) are installed, repeat the allow rule inside their HIPS configuration because the host firewall in Windows is bypassed when the third-party driver takes ownership of the filter.

Step 6 - Terminating Connections Cleanly

Per the SIMATIC S7-1200 Manual Collection, two methods exist to terminate a TCP connection on the S7-1200:

• TCP-Reset (default): the CPU sends an RST segment. The peer immediately drops the socket. Use this for fault recovery.
• TCP-Finish: the CPU performs a graceful FIN handshake. Use this when the PC application has unsent data or maintains transactional state.

To select TCP-Finish instead of TCP-Reset, navigate in TIA Portal to Device configuration > PROFINET interface > Properties > Advanced options > Port statistics > Open User Communication settings, and check TCP-Finish for termination. The setting is global to all OUC connections on the integrated PN interface.

Verification Checklist

1. STATUS = 16#0000_0000 at TCON output within 5 seconds of REQ.
2. DONE = TRUE, ERROR = FALSE, BUSY = FALSE.
3. From the PC, run netstat -an | findstr :2500 and confirm ESTABLISHED for the connection.
4. Issue a TSEND with 10 bytes and confirm the PC receives them within the cycle time + 100 ms.
5. Issue a TRCV with LEN = 0 (variable-length) and send data from the PC; verify DATA length returns the expected byte count.

Troubleshooting Matrix

Edge Cases and Field-Proven Caveats

• Optimized DB access: TIA Portal V14+ defaults to optimized (symbolic-only) access for new DBs. The TCON_Param DB must be set to non-optimized (standard access), because the OUC blocks interpret its memory layout as the raw UDT. Disable Optimized block access in the DB properties.
• Multiple instances of TCON with the same ID: two TCON calls referencing the same Connection ID cause 80A3. Each ID is unique per established connection.
• Port 102: ISO-on-TCP and S7 communication use TCP port 102 by default. Avoid assigning this to Open User Communication or set it aside via port statistics.
• Port 80 / 443: some web-based HMI panels reserve these; do not reuse for OUC on the same PN port.
• PROFINET cable vs. Ethernet cable: the integrated PN interface on S7-1200 supports 10/100 Mbps auto-negotiation. If the PC link is forced to 1000 Mbps full duplex, the handshake can stall. Set the NIC to auto-negotiate.
• CPU in STOP: OUC connections are torn down automatically when the CPU transitions to STOP. DONE will go FALSE and STATUS will report 16#80A7 (aborted by local).
• Firmware V4.0 vs V4.4: V4.0 supports 8 OUC connections; later firmware supports additional ISO-on-TCP features but the 8-connection cap on the integrated interface is unchanged.
• Time synchronization: if TRCV uses EN_R toggling, ensure the enable signal is held TRUE long enough for the receive to complete; otherwise partial frames accumulate in the receive buffer.

Alternative Controllers and Cross-Platform Notes

The same Open User Communication pattern is implemented on S7-1500 (firmware V1.0+) and ET 200SP CPU with identical block names and parameter UDTs. On S7-1500, TCON may also use the CONN_OUC data type which is referenced via the TCON_Param ID field. S7-300/400 use legacy AG_SEND / AG_RECV via CP and are not interchangeable.

Third-party PC libraries that have been validated against S7-1200 Open User Communication:

• Python: snap7 for S7 protocol, or raw socket module for plain TCP. Confirm byte order (big-endian) for multi-byte values.
• .NET: System.Net.Sockets.TcpClient with NetworkStream.
• LabVIEW: TCP Open Connection and TCP Read/Write VIs.
• Node-RED: node-red-contrib-s7 or generic TCP In/Out nodes.

In all cases, the PC must open the socket to the PLC IP and the configured LocalPort when the PLC is the server, or accept on a free port when the PLC is the active client.

Acceptance Test Script

The following PowerShell snippet performs a complete TCP handshake test against an S7-1200 configured as a TCP server on 192.168.0.10:2500:

$client = New-Object System.Net.Sockets.TcpClient
try {
    $client.Connect("192.168.0.10", 2500)
    Write-Host "TCP connected: $($client.Connected)"
    $stream = $client.GetStream()
    $payload = [System.Text.Encoding]::ASCII.GetBytes("PING\r\n")
    $stream.Write($payload, 0, $payload.Length)
    $stream.Flush()
    $client.Close()
} catch {
    Write-Host "Connection error: $($_.Exception.Message)"
}

Pair this with an OB1 routine that calls TRCV immediately after TCON reports DONE = TRUE. The received string PING should appear in the RCVDATA tag within one PLC scan.

FAQ