Resolving S7-1200 to S7-200 Ethernet Communication Failures

Overview

Bidirectional S7 communication between a SIMATIC S7-1200 (CPU firmware V4.0 or later) and a legacy SIMATIC S7-200 with CP243-1 Ethernet module is fully supported, but it requires that both controllers are configured with consistent TSAP identifiers, correct active/passive partner roles, and matching connection resource IDs. A common field failure is that the S7-200 successfully reads and writes into the S7-1200 when the S7-200 is set up as the Ethernet client, while the reverse direction (S7-1200 to S7-200) returns no data and no connection error at the application level.

The root cause is almost always a mismatch between how the S7-200's Ethernet Wizard declares the partner TSAP and how the S7-1200's TSEND_C/TRCV_C or T_SEND/T_RECEIVE blocks expect to open the connection. The S7-200 has no true "client and server" combined mode in the Ethernet Wizard; it can only act as either initiator or acceptor on any given connection. Once the role, TSAP pair, and connection ID are aligned, both directions operate on a single TCP connection using the ISO-on-TCP (RFC 1006) transport.

This reference covers the S7-200 (CP 243-1, 6GK7 243-1EX00-0XE0 and 6GK7 243-1EX01-0XE0) Ethernet Wizard configuration, the S7-1200 (CPU 1211C/1212C/1214C/1215C/1217C) connection configuration inside TIA Portal, the alternative GET/PUT path, and the diagnostic checks that confirm a healthy exchange. For background on the S7-200 to S7-1200 transition including discontinued I/O modules, refer to the Siemens Making the transition from S7-200 to S7-1200 manual.

System Architecture and Protocol Stack

Both PLCs use ISO-on-TCP (RFC 1006) on top of TCP port 102, which is the standard S7 Communication port reserved by Siemens. The CP 243-1 module on the S7-200 presents one or more Ethernet connections, each of which is bound to a 16-bit Transport Service Access Point (TSAP). The TSAP is composed of two ASCII-encoded bytes; for CPU slot 1 rack 0 the S7-1200 default local TSAP is 01.00, and a partner TSAP of 03.00 targets rack 0 slot 3 (the CP 243-1).

The CP 243-1 physically occupies an I/O slot on the S7-200 expansion bus. Slot 0 is always the CPU; CP modules therefore appear at slot 1 or higher. In the Ethernet Wizard, the local TSAP encodes the slot number where the CP 243-1 is installed. If the CP 243-1 sits in slot 1 the local TSAP is 03.01 (the leading 03 byte is the Siemens S7 family identifier, the trailing byte is the slot in hex).

Why the Reverse Direction Fails: Active/Passive Mismatch

S7 Communication over ISO-on-TCP is connection-oriented. The first device to send the open TPDU is the active partner; the other device must be preconfigured to accept that connection on the matching TSAP. The S7-200's Ethernet Wizard exposes this as two distinct configuration pages:

• Client Connections — S7-200 initiates the TCP open using ETHx_CTRL and per-connection read/write subroutines. The S7-200 specifies the Remote TSAP (the S7-1200's local TSAP, typically 01.00) and the connection is opened by the CP 243-1.
• Server Connections — S7-200 is the passive partner. The local TSAP of the CP 243-1 is published in the wizard, and an external active partner (the S7-1200) opens the TCP connection by sending to that TSAP. ETHx_CTRL must still be called in the S7-200 OB1 to keep the module alive, but no read/write subroutine is needed on this connection.

The original failure described in the source content stems from inserting a Server connection in the S7-200 wizard for the S7-1200's traffic, but the S7-1200's T_SEND/T_RECEIVE blocks were placed on the connection with an active partner setting pointing at the wrong TSAP, or the CP 243-1 local TSAP was left at the default 03.00 while the S7-1200 was sending to 03.01. The TIA Portal will not raise a compile error in this case; the connection simply times out at runtime with STATUS = W#16#80A7 (partner TSAP unreachable) or W#16#8085 (connection ID already in use / setup error).

Step-by-Step: S7-200 Ethernet Wizard Configuration (Server Role)

Configure the CP 243-1 in STEP 7 Micro/WIN V4.0 SP9 (or the latest SP available for the S7-200 toolset) to accept an incoming connection from the S7-1200.

1. Open the Ethernet Wizard from the Tools menu and select the CP 243-1 module position. Enter the module's IP address (for example 192.168.0.10), subnet mask, and gateway. Click Next.
2. On the second page, set the number of client connections to 0 and the number of server connections to 1. The CP 243-1 (6GK7 243-1EX01-0XE0) supports up to 8 server and 8 client connections; older 6GK7 243-1EX00-0XE0 supports 1 client and 1 server only.
3. Click Next until the Server Connection page appears. Set This PLC Local TSAP to 03.01 (or whatever slot the CP 243-1 physically occupies). Leave the Remote TSAP field empty or enter 01.00 for documentation only — it is not enforced on a server connection.
4. Select Always for the Accept All Connection Requests option if the S7-1200 IP may change, or restrict by IP if the network is fixed.
5. Assign a connection ID (1 through the maximum). Record this ID; the S7-1200 will not use it directly, but the S7-200 ETHx_CTRL uses it to associate the buffer.
6. Generate the wizard subroutines and copy them into OB1. The generated code includes ETH0_CTRL (or ETH1_CTRL for the second CP 243-1) and the data block that backs the wizard.
7. In OB1, call ETH0_CTRL on the first scan with Always_On set so the module stays connected. Do not call read or write subroutines on the server connection — the S7-200 will not initiate any data transfer; it only services incoming PDUs.

Step-by-Step: S7-1200 Connection Configuration in TIA Portal

On the S7-1200 side, the S7 connection is established with the active partner configured to point at the S7-200's CP 243-1.

1. In the TIA Portal project tree, expand Devices & Networks and double-click Networks view.
2. From the catalog on the right, drag an S7 connection onto the S7-1200 CPU. The partner endpoint is created automatically.
3. Right-click the S7 connection line and choose Properties > General > Addresses:
   • Local endpoint: S7-1200, IP 192.168.0.20, Local TSAP = 01.00 (CPU 1214C, slot 1, rack 0).
   • Partner endpoint: S7-200, IP 192.168.0.10, Partner TSAP = 03.01 — this must match the Local TSAP configured in the S7-200 wizard for the server connection.
4. Under Properties > General > Connection mechanism, the S7-1200 must be the active connection establishment point. The default is "Active connection establishment" enabled; if this is unchecked, the S7-1200 will not open the TCP connection and TSEND_C will return W#16#80A3 (connection not yet established) repeatedly.
5. Compile and download the hardware configuration to the S7-1200.

The TIA Portal assigns a connection ID (for example, ID 100). This ID is passed to TSEND_C/TRCV_C or to the older T_SEND/T_RECEIVE pair. Using the modern TSEND_C (combined send/receive with built-in connect) is recommended for S7-1200 firmware V4.0 onward; the older T_SEND/T_RECEIVE blocks from the "Communications" palette require a separate TCON block to establish the connection.

TIA Portal Block Calls: TSEND_C/TRCV_C

// TSEND_C instance data block "TSEND_DB"
TSEND_DB.REQ        := bSendRequest;          // rising edge triggers send
TSEND_DB.CONT       := TRUE;                  // keep connection established
TSEND_DB.LEN        := 10;                    // bytes to send
TSEND_DB.DATA       := P#DB1.DBX0.0 BYTE 10;  // source buffer
TSEND_DB.COM_RST    := FALSE;
TSEND_DB.DONE       => bSendDone;
TSEND_DB.BUSY       => bSendBusy;
TSEND_DB.ERROR      => bSendError;
TSEND_DB.STATUS     => wSendStatus;           // 16#0000 = success
TSEND_DB.CONNECT_ID := 100;                   // must match connection ID
TSEND_DB.ID         := 100;

For receiving from the S7-200, mirror the call with TRCV_C on the same CONNECT_ID. The RCVD_LEN output reports the byte count returned by the S7-200's client read PDU, and the DATA pointer receives the payload into a known DB.

Alternative Path: S7-1200 GET/PUT Blocks to S7-200

The discussion in the source noted that Profinet with GET/PUT can also be used. In practice, S7-1200 PUT/GET on the S7-1200 (firmware V4.0 and later, with "Permit access with PUT/GET communication" enabled in the CPU's protection settings) can read and write S7-200 data when the S7-200's CP 243-1 has been configured with a server connection. The S7-1200 PUT/GET uses the same ISO-on-TCP transport and TSAP model, but the configuration is performed inside the PUT and GET instruction boxes rather than the connection editor.

The S7-1200's CPU Properties > Protection > "Permit access with PUT/GET communication from remote partner" must be checked. The S7-200 does not have a corresponding access-level switch on the CP 243-1; the server connection in the wizard implicitly allows PUT/GET PDUs to read or write the configured address ranges.

TSAP Reference Table for S7-200 ↔ S7-1200

If the CP 243-1 sits in a slot other than 1, the local TSAP byte increments accordingly: slot 1 = 03.01, slot 2 = 03.02, slot 3 = 03.03, up to the maximum of 7 modules on the S7-200 expansion bus.

Diagnostic Steps When the Connection Stays Idle

1. Check the S7-1200 connection status in TIA Portal online: Right-click the S7 connection > Go online. The status icon turns green when the connection is established. If it stays gray, the active establishment attempt is not reaching the CP 243-1.
2. Read the S7-1200 diagnostic buffer: Online > Diagnostics > Diagnostic buffer. Look for events of class "Communication error" referencing the connection ID. Common entries:
   • Connection established (event ID 0x0801) — confirms TCP open succeeded.
   • Connection terminated (0x0802) — partner sent disconnect; usually follows a CP 243-1 power cycle.
   • Partner not reachable (0x0804) — TSAP or IP mismatch.
3. Ping the CP 243-1: From the TIA Portal project, use Online > Accessible devices or a Windows ping 192.168.0.10. If the ping fails, the issue is IP/routing, not S7 Communication.
4. Read CP 243-1 status word in S7-200: The ETH0_CTRL subroutine's CP_Ready output must be TRUE. If it stays FALSE, the CP 243-1 has not finished initialization, which is usually a duplicate IP address or a missing Always_On call to ETH0_CTRL.
5. Check the S7-200 wizard configuration memory: The CP 243-1 stores its configuration in the S7-200's V memory (starting at VB0 of the wizard data block). If a power cycle wipes the configuration, the project must be re-downloaded with the wizard-generated subroutines still present in OB1.
6. Confirm port 102 is not blocked: Corporate firewalls occasionally filter port 102. Use Wireshark on a mirrored port to confirm the S7-1200 is sending CR TPDUs (Connection Request TPDUs, ISO 8073 class 0) to the S7-200's IP.

Common STATUS Codes from TSEND_C, T_RECEIVE, PUT, and GET

Bidirectional Configuration Template (Reference Wiring)

The simplest topology that solves the source content's failure uses two S7 connections on the CP 243-1:

Verification Procedure

1. Download the S7-200 project with the Ethernet Wizard subroutines and call ETH0_CTRL unconditionally in OB1. Verify CP_Ready = TRUE.
2. Download the S7-1200 hardware configuration. Online > Accessible devices should list both CPUs.
3. Go online with the S7 connection in TIA Portal. The connection state must show Established.
4. Set a watch table on the S7-1200 with a forcing value of 16#1234 in the first two bytes of the S7-200's target V area (for PUT path) or in the source DB for TSEND_C.
5. Monitor the S7-200's V memory from Micro/WIN via the Ethernet connection: the value should reflect the S7-1200's data within one OB1 cycle of the S7-200 plus the configured S7-1200 send interval.
6. Reverse the test: read the S7-200's VB1000 from the S7-1200 using GET or TRCV_C and confirm the S7-200's locally set value appears in the S7-1200 DB.
7. Disconnect the patch cable to the CP 243-1 and confirm that the S7-1200 diagnostic buffer logs Connection terminated within 30 seconds. This confirms the link is being supervised and not silently dead.

Field-Proven Caveats

• The CP 243-1 (6GK7 243-1EX00-0XE0) supports only one client and one server connection. Replace with the 6GK7 243-1EX01-0XE0 if two S7 partners need to exchange with the S7-200 simultaneously.
• S7-200 V memory is byte-addressed. The S7-1200's PUT/GET address syntax P#V1000.0 BYTE 10 refers to bytes VB1000..VB1009. Word and double-word accesses are byte-aligned only; the S7-200 does not have a bit-alignment problem but the S7-1200's ANY pointer must start on a byte boundary.
• Microwin V4.0 SP9 is the last service pack for the S7-200 toolset. It runs only on 32-bit Windows. Modern 64-bit Windows 10/11 installations must use a virtual machine or compatibility shim.
• The S7-1200 "Permit access with PUT/GET communication from remote partner" setting is a CPU-level flag. With firmware V4.0 this is at CPU Properties > Protection > Connection mechanisms; on firmware V4.1 and later it is under Protection > Read/Write access levels. Both must be enabled for the PUT/GET blocks to work.
• If both controllers are on different subnets and a router is in the path, the router must allow TCP port 102. Industrial managed switches with ACLs frequently block this port by default.
• S7-200 cannot act as a PROFINET IO device on the CP 243-1; only the CP 243-1 IT (6GK7 243-1GX00-0XE0) supports PROFINET. The comment in the field report about "Profinet protocol" is more accurately described as "S7 Communication over Ethernet," which is the same protocol stack used by the CP 243-1 IT and standard CP 243-1.