Resolving S7-1500 TCON Block Status 7002 Connection Failure to a PC

An S7-1500 CPU 1511-C programmed with TIA Portal V15.1 repeatedly returns status code 7002 from the TCON block and never reaches the DONE state, even when the target PC application is listening on a known TCP port. The BUSY output asserts for roughly ten seconds, then the block falls back to 7000 with no error flag. This article documents the field procedure used to isolate the cause (Windows Firewall inbound rules on the PC), the correct TCON connection DB configuration, and the verification workflow with the Hercules SETUP utility.

1. Problem Symptoms

The reported failure mode, observed in TIA Portal V15.1 online mode on a CPU 1511-C with firmware matching TIA V15.1, is repeatable:

• TCON.REQ is driven to TRUE (initially by a 0.5 Hz clock memory bit, later manually).
• TCON.BUSY rises to TRUE.
• TCON.STATUS reports 7002 (hex 0x1B5A).
• After approximately 10 seconds STATUS falls back to 7000 and BUSY drops.
• No DONE pulse, no ERROR flag, no connection is established at the target IP/port.
• A network sniffer or Hercules TCP server listening on the configured port (2000 or 5000 in the source case) sees zero SYN packets arriving at the PC.

Behavior is identical regardless of whether the TCON block is the only active block in OB1, or whether TSEND, TRCV and TDISCON are present with REQ=FALSE.

2. Environment and Affected Versions

The same symptom class has been reported on the S7-1200 family (CPU 1214C, firmware V4.x) when programmed with the S7-1200 Open User Communication blocks, which expose an identical TCON status code table. The root cause and resolution described in this article apply to both platforms.

3. Decoding TCON Status 7002

Status 16#7002 is a transient state, not a permanent error. According to the SIMATIC S7-1500 Communication Function Manual entry for TCON (FB65 in the S7-1500 namespace), the relevant status code table is:

0x7002 therefore means: "the TCP three-way handshake is in progress". The PLC is waiting for the PC to return the SYN-ACK. When the PLC times out (the default TCON connection-establishment timeout is 10 s), the firmware aborts the handshake internally and returns the connection to the idle state 0x7000 without raising ERROR. This is the exact pattern observed in the source case.

4. Root Cause Analysis

When 7002 is followed by a clean 7000 with no ERROR, the four-way cause tree is:

1. No route / no ARP: The PC never sees the SYN. Verified false in this case – arp -a on the PC shows the PLC MAC after a manual ping, and the same switch is used for a working PROFINET connection to the same HMI panel.
2. TCP port already bound: Verified false – netstat -ano | findstr :2000 on the PC returned no listening PID before Hercules was started.
3. Connection DB misconfigured: Verified false – the wizard-generated DB uses Connection ID = 1, Partner = 10.145.65.209, Active connection establishment, Port 2000. Block instance DB correctly references the wizard DB.
4. PC host firewall drops the SYN-ACK: Confirmed true – Windows Defender Firewall with Advanced Security was rejecting inbound traffic to the Hercules / PuTTY process. Once a per-app inbound rule was added, the handshake completed and the connection established on the first REQ pulse.

The fact that the source case ended with a working connection to one PC (factory-target) and a still-broken connection to a second PC (the engineering laptop) is consistent with the firewall rule being machine-local. Both machines had Firewall on at install time; only the one with the explicit inbound rule allowed the SYN-ACK to leave the TCP/IP stack.

5. TIA Portal Connection DB Configuration

For a CPU 1511-C acting as the active TCP client, the Connection DB parameters must be set exactly as follows. Open PLC > Properties > Communication > Open User Communication in TIA Portal V15.1, add a new connection, and choose TCP connection:

After download, the wizard generates a TCON_<name>_DB in Program blocks > System blocks > Program resources. The TCON block instance must reference that DB, e.g. TCON_DB, and the ID input on the instance FB must equal the Connection ID above (1). A mismatch produces status 0x80A3 at first call; if the mismatch is on the interface assignment you get 0x80B1.

6. TCON Block Programming in TIA Portal V15.1

The minimum required code in OB1 for an active TCP client connection is shown below. Cyclic clocking of REQ is unnecessary and is the source of an additional class of edge-case bugs (re-triggering TCON before the prior handshake completes); drive REQ from a single rising edge, or from a control bit that is set TRUE on startup and latched until DONE OR ERROR:

// OB1 - S7-1500 / S7-1200 compatible
// Tags (PLC data block or static area of FB):
//   "startConnect"  : Bool  - start pushbutton or startup flag
//   "connectBusy"   : Bool
//   "connectDone"   : Bool
//   "connectError"  : Bool
//   "connectStatus" : Word  - raw STATUS word
//   "sendReq"       : Bool
//   "sendDone"      : Bool
//   "sendError"     : Bool
//   "sendStatus"    : Word
//   "sendData"      : String[254]
//   "recvEn"        : Bool
//   "recvDone"      : Bool
//   "recvError"     : Bool
//   "recvLen"       : UInt
//   "recvData"      : String[254]
//   "disconReq"     : Bool

// TCON - open / maintain active connection
     CALL "TCON" , "TCON_DB"
          REQ    := "startConnect"
          ID     := 1                          // Connection ID
          DONE   => "connectDone"
          BUSY   => "connectBusy"
          ERROR  => "connectError"
          STATUS => "connectStatus";

// TSEND - send string once connection is up
     IF "connectDone" THEN
       CALL "TSEND" , "TSEND_DB"
            REQ    := "sendReq" AND NOT "sendBusy"
            ID     := 1
            LEN    := INT_TO_WORD(LEN("sendData"))
            DATA   := "sendData"
            DONE   => "sendDone"
            BUSY   => "sendBusy"
            ERROR  => "sendError"
            STATUS => "sendStatus";
     END_IF;

// TRCV - non-blocking receive
     CALL "TRCV" , "TRCV_DB"
          EN_R   := "connectDone"
          ID     := 1
          LEN    := 0                          // 0 = copy all available
          DATA   := "recvData"
          NDR    => "recvNDR"
          BUSY   => "recvBusy"
          ERROR  => "recvError"
          STATUS => "recvStatus"
          RCVD_LEN => "recvLen";

// TDISCON - tear down on shutdown
     IF "disconReq" THEN
       CALL "TDISCON" , "TDISCON_DB"
            REQ    := TRUE
            ID     := 1
            DONE   => "disconDone"
            BUSY   => "disconBusy"
            ERROR  => "disconError"
            STATUS => "disconStatus";
     END_IF;

7. Windows Firewall Resolution Procedure

Windows Defender Firewall on a default install of Windows 10 / 7 silently drops inbound TCP traffic that is not bound to an exception rule. The fix is to add an Inbound Rule for the specific executable that is listening on the partner port. Do not disable the firewall globally on a machine that is also connected to the internet.

1. Open Start > wf.msc to launch Windows Defender Firewall with Advanced Security.
2. Click Inbound Rules > New Rule….
3. Rule type: Program. Click Next.
4. Program path: browse to the executable that is the TCP server (for the source case, Hercules.exe or the customer-specific terminal app). Click Next.
5. Action: Allow the connection. Click Next.
6. Profile: leave Domain, Private, and Public enabled for a workshop PC; for a factory-line cell, restrict to Private only. Click Next.
7. Name: PLC_TCON_Inbound. Description: Allow TCP from 10.145.65.210 on workshop bench. Click Finish.
8. For belt-and-braces security, also create a complementary Inbound Rule of type Port restricted to the specific partner port (e.g. TCP 2000) and a scope of 10.145.65.210/32. This survives replacement of the listening executable.
9. Repeat for the Outbound Rules if the PC app is acting as a client and the PLC is the server; the source case does not need this.

Once the inbound rule is in place, drive TCON.REQ TRUE. The expected state machine is:

• t=0: STATUS=0x7000, BUSY=0.
• t=0+ε: STATUS=0x7001, BUSY=1. SYN sent.
• t=1..2 RTT: STATUS=0x7002, BUSY=1. SYN-ACK received from PC.
• t=1..2 RTT + ACK: STATUS=0x0000, BUSY=0, DONE pulses TRUE for one cycle. Connection ID 1 is now ESTABLISHED.

8. Network Topology and Switch Configuration

The source deployment uses a SCALANCE XC-208. The switch is unmanaged from a TIA perspective but has a Web UI. Verify the following before suspecting a firmware bug:

• No MAC-based ACL on ports 1 or 2.
• No Port Security with sticky MAC (would silently drop frames from a new MAC after a link flap).
• No IGMP / multicast filtering that could affect PROFINET LLDP on the same VLAN.
• The SCALANCE is in Learning mode, not Forwards Unknown Unicast = Discard (default is discard in some firmware versions; either way, ARP must be in the CAM table for unicast TCP to a known IP to flow).

The PLC and PC must be in the same IP subnet, or a properly configured default gateway must exist on both devices. The source case uses 10.145.65.0/24 with no router, so default gateway can be left blank on both devices, or set to a non-routable address such as 10.145.65.1 as a placeholder.

9. Verification with Hercules SETUP Utility

Hercules SETUP utility (HW-group.com) is the de-facto field tool for TCP/UDP bench testing of SIMATIC open user communication. The protocol is:

1. Start Hercules on the PC.
2. Switch to the TCP Server tab.
3. Set Port = 2000 (matches Connection DB partner port).
4. Click Listen. The status line shows Listening on 0.0.0.0 : 2000.
5. On the PLC, drive TCON.REQ=TRUE. Hercules should show TCP Client connection from 10.145.65.210:<ephemeral> within one RTT. The Received Data pane will populate once TSEND fires.
6. Send a string back from Hercules by typing into the Send box and clicking Send. The PLC's TRCV should produce a single NDR pulse with the bytes in recvData and the length in RCVD_LEN.

10. Extended Diagnostic Table

The matrix below is the field reference for any TCON 7002 / 80xx combination that arises during commissioning:

11. Alternative Path: Sending Strings to a PC Serial Port

If the production requirement is "send a string from the PLC to a PC" and the reason TCP/IP was chosen was simply convenience, consider that the S7-1500 family can also be reached over a PtP (point-to-point) module such as the CM 1241 (RS-232 / RS-485) for ASCII traffic. On the PC side, .NET provides a direct path: Send Strings to Serial Ports in Visual Basic describes the My.Computer.Ports namespace usage:

' Visual Basic - .NET Framework / .NET 5+
' Add reference: Microsoft.VisualBasic (built-in)

Dim portName As String = "COM3"
Dim baudRate As Integer = 9600
Dim parity   As System.IO.Ports.Parity = IO.Ports.Parity.None
Dim dataBits As Integer = 8
Dim stopBits As System.IO.Ports.StopBits = IO.Ports.StopBits.One

Using comPort As New IO.Ports.SerialPort(portName, baudRate, parity, dataBits, stopBits)
    comPort.Open()
    comPort.WriteLine("Hello from the cell")
    comPort.Close()
End Using

This path bypasses the Windows Firewall completely, but requires an RS-232 or RS-485 CM at the PLC side and the corresponding physical port at the PC. For new designs, Ethernet-based open user communication is preferred.

12. Commissioning Checklist

1. Confirm CPU 1511-C firmware is on the TIA V15.1 support list (refer to the Siemens Industry Online Support release notes for the V15.1 compatibility matrix).
2. Compile and download the project with the Connection DB and TCON instance DB present in Program blocks > System blocks > Program resources.
3. In TIA Portal online mode, open the TCON instance DB and confirm the InterfaceId, ID, and ConnectionType fields are populated.
4. From the PC, ping 10.145.65.210 -t in a command window. The first ping populates the ARP cache; subsequent pings should be sub-millisecond on the bench.
5. Start Hercules TCP Server on the configured partner port. Verify netstat -ano | findstr :2000 shows the PID of the listening process.
6. Drive TCON.REQ=TRUE in OB1. Confirm STATUS walks 7001 → 7002 → 0000 and DONE pulses TRUE.
7. Drive TSEND.REQ=TRUE with a 50-character string. Confirm the string appears in the Hercules Received Data pane.
8. Send a reply from Hercules. Confirm TRCV.NDR pulses TRUE and RCVD_LEN matches the byte count.
9. Document the Windows Firewall rule (or the network-segment ACL on the SCALANCE) in the cell cybersecurity log before handing the line to operations.

13. Frequently Asked Questions