Resolving S7-300 to S7-400 PUT/GET Communication Errors

This technical reference covers the full diagnostic and remediation cycle for S7 Communication between an S7-300 CPU programmed in TIA Portal (V15.0 / V16 and later) and an S7-400 CPU programmed in SIMATIC Manager (STEP 7 V5.x). The most common failure modes involve status codes 16#0001, 16#001B, and 16#0008 returned on the STATUS output of the PUT / GET function blocks, all of which are rooted in incorrect connection configuration rather than application logic. The procedure below is derived from the official Siemens S7 Communication sample program and validated against cross-project mixed-tool scenarios.

1. Architecture Overview: PUT/GET in S7 Communication

S7 Communication is a Siemens-proprietary application-layer protocol that operates over ISO-on-TCP (RFC 1006), TCP, or PROFIBUS. It uses the S7 Connection object as a logical communication relationship between two stations. Within an S7 Connection, the following instruction families are valid:

The crucial constraint, per Siemens TIA Portal documentation, is that communications instructions used at both ends (with "pairs of blocks") cannot be used on connections configured at one end. PUT/GET are programmed on only the client side; the server CPU must be reachable via the downloaded S7 Connection but contains no PUT/GET code.

1.1 Client vs. Server Role

• Client CPU: Initiates the request. Calls PUT to write remote data and/or GET to read remote data. Requires the S7 Connection object to be configured and downloaded locally.
• Server CPU: Receives the request. Does not require PUT/GET calls; the S7 Connection object must be downloaded so the server's communication processor knows how to accept the partner.

2. Prerequisites

The official Siemens sample application S7 Communication with PUT/GET demonstrates that an S7-300 CPU can call FB14 GET and FB15 PUT sequentially to transfer up to 400 bytes per call. The sample is the canonical reference for rack/slot and connection resource parameters used in this article.

3. PUT / GET Function Block Interface

The instance DB of the PUT block exposes the following inputs and outputs. All outputs, including DONE, BUSY, ERROR, and STATUS, must be wired to readable tags. A floating STATUS output masks the most useful diagnostic channel Siemens provides.

A typical TIA Portal call sequence for an S7-300 client transferring 20 bytes of DB data to an S7-400 server every 200 ms is shown below. The PUT_DB instance DB is auto-generated when FB15 is placed in TIA Portal.

// Trigger pulse from cyclic OB1
IF "clock_200ms" THEN
    "PUT_DB".REQ := TRUE;            // Start PUT job
END_IF;

// Edge monitoring with previous-cycle flag
"PUT_DB".ID    := W#16#0001;        // Connection ID 1 from NetPro/Net view
"PUT_DB".ADDR_1:= P#DB100.DBX0.0 BYTE 20;  // Remote S7-400 DB100, 20 bytes
"PUT_DB".SD_1  := P#DB10.DBX0.0 BYTE 20;   // Local S7-300 DB10, 20 bytes
"PUT_DB".LEN   := 20;

// Read status outputs into your own DB
"diag".DONE   := "PUT_DB".DONE;
"diag".BUSY   := "PUT_DB".BUSY;
"diag".ERROR  := "PUT_DB".ERROR;
"diag".STATUS := "PUT_DB".STATUS;

// Drop REQ once DONE/ERROR activates
IF "PUT_DB".DONE OR "PUT_DB".ERROR THEN
    "PUT_DB".REQ := FALSE;
END_IF;

4. Configuring the S7 Connection

4.1 On the S7-300 Client (TIA Portal)

1. Open the Devices & Networks editor.
2. Select the S7-300 CPU and drag an S7 Connection to the network view.
3. In the Properties → General → Connection mechanism dropdown, choose "Establish an active connection" if this CPU is the PUT/GET client. "Establish a passive connection" makes it a server.
4. In Address Details, set the partner to "Unspecified" if you cannot browse the S7-400 from TIA Portal (the case when the S7-400 is configured only in SIMATIC Manager). The S7-300 will then use the address details you enter manually.
5. Compile and download hardware configuration to the S7-300.

4.2 On the S7-400 Server (SIMATIC Manager)

1. Open NetPro from SIMATIC Manager.
2. Right-click the S7-400 station and insert a new S7 Connection.
3. Choose "Unspecified" partner and accept.
4. Set the partner IP address, rack, and slot to match the S7-300 CPU.
5. Save and compile (Station → Consistency Check → Save and Compile).
6. Download the connection to the S7-400 CPU. The CPU briefly goes to STOP; schedule this during a plant maintenance window if required.

Without the connection downloaded on both ends, the PUT/GET call returns STATUS = 16#0001, indicating the local connection resource is undefined or the partner did not acknowledge the connection setup. The cross-vendor documentation at PTC Kepware confirms the same procedure: "both the CPU and the Ethernet module will need to be configured" with the same connection parameters on each side.

5. Address Details: Rack/Slot, Connection Resource, TSAP

These three fields are the most commonly misconfigured in mixed TIA Portal / SIMATIC Manager projects. They must be set so that both stations agree on the same logical transport address.

5.1 Connection Resource for Unspecified Partner

When the partner is "Unspecified" in TIA Portal or NetPro, the system uses two TSAP bytes encoded as CC.RR:

• CC = connection resource / slot of the CPU on which the connection terminates.
• RR = rack number (00 for central rack).

For an S7-400 CPU on rack 0, slot 3, the local connection resource is 03. For an S7-300 CPU on rack 0, slot 2, it is 02. Both sides must place the partner's TSAP correctly so the ISO transport layer can match the passive open request.

5.2 Field-validated TSAP matrix

6. PUT_S vs. PUT: The CP Module Caveat

The original FB15 PUT block was designed for the S7-300 CPU's integrated PN interface or for the S7-400 CPU with a CP443-1. When the path traverses a CP module (e.g., CP343-1 on the S7-300 side) rather than the CPU's integrated interface, the firmware requires the PUT_S (single) instruction variant from the IEC standard library, or the CP-specific instruction set supplied with the CP.

The field-reported failure mode is unmistakable:

• Error with FB15 PUT: STATUS = 16#001B, connection reports as established but no data transferred.
• Resolution: Replace FB15 PUT with the CP-specific PUT_S block from the "Communication Blocks" library matching the CP catalog number (e.g., library for CP343-1 Lean / Standard / Advanced).

Status code 16#001B is documented as "connection cannot be established because the local CPU has not yet completed startup", but in mixed CP topologies it is also returned when the active partner tries to use the standard PUT against a CP-served port. Confirm by checking CP343-1 → Properties → Connection tab in the S7-300 project; the entry there must align with the instruction family you call.

7. Step-by-Step Procedure (Mixed Tool Environment)

1. Verify hardware wiring: both PLCs on the same Ethernet subnet, pingable.
2. TIA Portal → Devices & Networks → Connections: insert S7 Connection with unspecified partner, set IP of S7-400 as partner. Compile and download hardware to S7-300.
3. SIMATIC Manager → NetPro: insert S7 Connection on S7-400 station, unspecified partner, set IP of S7-300 as partner. Compile and download. CPU will stop briefly.
4. Online → Accessible Nodes on TIA Portal: confirm both CPUs are reachable.
5. Online → Online & Diagnostics → Connection diagnostics: verify the S7 Connection shows "Established".
6. Insert FB15 PUT in TIA Portal into a cyclic OB; wire all outputs as in Section 3. If a CP343-1 is in use, replace with PUT_S from the CP library.
7. Compile and download the program block changes to the S7-300.
8. Monitor: place the instance DB in a watch table and force REQ=TRUE. Confirm DONE rises, ERROR remains FALSE, STATUS = 16#0000.

8. Status Code Reference Table

For any STATUS not listed, refer to the online help of the PUT/GET block in TIA Portal. The plain-text description attached to each code is the most reliable first-stop source.

9. Verification

After the procedure above, validate the communication as follows:

1. Connection status: TIA Portal → Online & Diagnostics → Connection diagnostics. The S7 Connection should report "Established" with the partner's IP address.
2. Watch table: place the source DB on the S7-300 client and the destination DB on the S7-400 server in a watch table each. Trigger REQ=TRUE and verify the destination values match the source within one PLC cycle.
3. Diagnostic buffer: on the S7-400, open the diagnostic buffer (SIMATIC Manager → CPU → Module Information → Diagnostic Buffer). No entry of class "Communication Error" should appear.
4. SFB/SFB status: with a free port (e.g., PG port), use SIMATIC Manager → Accessible Nodes → Online & Diagnostics → SFB/SFC status to verify both PUT/GET blocks entered without runtime errors on a single cycle.

10. Troubleshooting Matrix

11. Edge Cases and Field-Proven Caveats

11.1 Avoid Triggering PUT in Startup OBs

OB100 / OB101 run only on startup. The communication stack is not fully up until OB1 first executes. Trigger PUT only in OB1 or in a cyclic interrupt OB.

11.2 Mixing Online & Offline Address Changes

TIA Portal's online editing will display the current value of an ANY pointer, but it does not propagate to the offline project. After any change in Address Details, you must re-download hardware configuration so the S7 Connection is re-established with the new TSAP. Skipping this download leaves the connection pointing to the old slot and may silently produce ERROR=TRUE / STATUS=16#0001.

11.3 Connection Resources Limit

An S7-300 CPU has a maximum of 16 S7 Communication connections, an S7-400 CPU up to 64 (CPU-dependent). Each connection consumes one local connection resource. Exhausting the table returns STATUS=16#80A1 or STATUS=16#001B on the next setup attempt.

11.4 Firewalls and Routed Networks

S7 Communication uses TCP port 102. Routed scenarios require firewall rules opening TCP 102 between both ends. ISO-on-TCP (RFC 1006) defaults to the same port and is not encrypted; place both stations on a trusted control VLAN.

11.5 S7-1500 vs. S7-300/400 Compatibility

The instructions FB14 GET and FB15 PUT are still present in TIA Portal V16+ for compatibility, but Siemens recommends using the instruction PUT / GET from the "Communication" palette (System→Blocks→Communication) on S7-1500. The behavior on S7-300 clients is unchanged, but server-side firmware V6.0 or higher on S7-400 is strongly recommended for predictability.

12. Summary Checklist

• PUT/GET programmed on the client side only.
• S7 Connection configured on both TIA Portal and SIMATIC Manager projects, downloaded to both CPUs.
• Rack and slot of the remote CPU correctly entered in Address Details.
• Connection resource = remote slot for the unspecified partner (e.g., 03 for an S7-400 in slot 3).
• If a CP343-1 / CP443-1 is in the path, use the CP-specific PUT_S instruction set.
• REQ latched until DONE rises; all four outputs (DONE/BUSY/ERROR/STATUS) wired.
• Verify with Connection diagnostics and a watch table after first successful PUT.

Applying the procedure above resolves the typical mixed-tool PUT/GET failures, including the STATUS=16#0001 and STATUS=16#001B cases observed in the field, without any change to the S7-400 application code when the S7-400 is acting as pure server.