Resolving WinAC RTX 2008 Open IE Error 80A7 with T_CON/T_DISCON

Overview

Siemens WinAC RTX 2008 is a Windows-based soft PLC that executes the S7-300 instruction set as a real-time task under the Ardence (now IntervalZero) RTX real-time extension. Unlike a hardware CPU 315/317, the controller's industrial Ethernet interface is virtualized: TCP/IP connections are bound to a physical NIC on the host PC instead of the onboard PROFINET/Industrial Ethernet port of a SIMATIC S7 CPU. When a user migrates the Open IE block library (FB65 T_CON, FB66 T_DISCON, FB63 T_SEND, FB64 T_RCV, plus UDT65) from a hardware CPU 315-2 PN/DP to WinLC RTX, the connection almost always fails on the first call with status word DW#16#80A7_0000 in the STATUS output of T_CON or T_DISCON.

This article documents the three hardware and software conditions that must be satisfied before Open IE will work on a WinAC RTX 2008 controller, and walks through the parametrization of UDT65 — most importantly the DEV_ID byte — that resolves the 80A7 fault. The fix is documented in Siemens Support entry 29737950, the official Open IE sample project for WinAC RTX, and is cross-referenced to the WinAC RTX 2008 manual.

Problem Description

Symptom: A program compiled in STEP 7 V5.4 SP4 with the standard Open IE blocks (FB63 T_SEND, FB64 T_RCV, FB65 T_CON, FB66 T_DISCON, plus the TCON_PAR data structure instance built from UDT65) downloads to the WinLC RTX controller and starts without compile errors. The first scan calls FB65 T_CON with REQ = TRUE; on the next scan, DONE stays FALSE and the STATUS output equals W#16#80A7 (or DW#16#80A7_0000). The same status reappears in FB66 T_DISCON if the user attempts a forced disconnect.

The 80A7 error is not listed in the standard Open IE function manual that ships with STEP 7 V5.4, because the Open IE manual was written for the S7-300/400 firmware, where 80A7 has a different meaning. On WinAC RTX, 80A7 is a generic communication subsystem failure that has three documented causes:

1. The host NIC is not on the Siemens hardware compatibility list — most commonly the user is running a Realtek, Broadcom, or Intel NIC other than the Intel 82573 (Pro/1000 PL) chipset.
2. The DEV_ID byte inside the UDT65-based TCON_PAR data block is left at the S7-300 default (B#16#00) or set to a value appropriate to the hardware CPU's PN port (B#16#03 / B#16#05) instead of the WinLC RTX virtual interface identifier.
3. STEP 7 is missing the WinAC RTX 2008 Hot Support Package (HSP) that supplies the WinLC-specific device identifiers in the hardware catalog and the Open IE block headers.

Root Cause Analysis

The Open IE blocks were originally designed for the S7-300/400 CPU's onboard Industrial Ethernet CP. Each port of the CP was assigned a fixed device identifier (B#16#03 for port 1, B#16#05 for port 2 on a CPU 315-2 PN/DP, for example). When the same blocks run on WinLC RTX, the industrial Ethernet stack is replaced by the RTX real-time TCP/IP stack that is bound to a Microsoft NDIS miniport on the host PC. The WinLC firmware reports up to four logical interfaces, and each one is assigned a WinLC-specific device identifier that does not match the S7-300 numbering scheme.

If UDT65 is parameterized with the wrong DEV_ID, the TCON request is dispatched to a non-existent internal CP slot. The RTX TCP/IP stack returns a transport-layer "interface not bound" error, which the Open IE FB translates into the generic 80A7 status. The error is identical whether it surfaces on the first T_CON call or on a subsequent T_DISCON call, because T_DISCON inherits the connection ID of an ID that was never successfully created.

Prerequisites

Before reconfiguring the project, verify the following host and software environment. Mismatches in any row will reproduce 80A7 even after the DEV_ID is corrected.

DEV_ID Mapping for WinLC RTX

The mapping below is taken from the official Siemens sample project (entry 29737950). The "Logical IF" column refers to the WinLC RTX port number exposed in the hardware configuration; the "DEV_ID" byte is what you must load into TCON_PAR.dev_id inside your DB. Do not use the S7-300 default (B#16#00) — WinLC will not fall back to it.

If the program is intended to be portable between WinLC RTX and a hardware CPU 31x PN, use a tag-symbolic constant for DEV_ID in a separate DB (for example DB200) and switch it at compile time with a COMPACT/SWITCH block. This avoids silent regressions when the project is downloaded to the wrong target.

Step-by-Step Configuration

Step 1 — Install the WinAC RTX 2008 HSP

1. Close STEP 7 and the SIMATIC Manager.
2. Extract the HSP archive to C:\Siemens\Automation\HSP (or any empty folder).
3. Start SIMATIC Manager → Options → Hardware Updates → Install Hardware Updates.
4. Browse to the folder, accept the EULA, and let STEP 7 merge the new hardware catalog. The HSP adds WinLC RTX under SIMATIC 300 → WinAC in HW Config.
5. Restart SIMATIC Manager.

Step 2 — Build the WinLC RTX Station

1. Insert a new SIMATIC 300 Station.
2. Open HW Config and drag WinLC RTX (from SIMATIC 300 → WinAC) into slot 2 of the rack.
3. Open the WinLC properties and confirm that the four logical interfaces (IF1…IF4) are listed. Bind IF1 to the physical Intel 82573 NIC; bind IF2 to a second NIC if used.
4. Compile and download HW Config to the WinLC controller.

Step 3 — Add the Open IE Block Library

The Open IE blocks are not part of the standard STEP 7 standard library on WinAC RTX 2008. They ship as the HSP-supplied library Open IE for WinLC RTX (or the older Open_IE library from entry 29737950). Procedure:

1. In SIMATIC Manager, open the project library list (Options → Libraries).
2. Insert Open_IE (the WinLC version, not the S7-300 one) from the HSP install path, typically ...\Siemens\Automation\HSP\WinAC_RTX_2008_SP1\Open_IE\Open_IE.wsl or .s7lib.
3. Copy FB63 T_SEND, FB64 T_RCV, FB65 T_CON, FB66 T_DISCON, and UDT65 TCON_PAR into your project's Blocks folder.

Step 4 — Parameterize UDT65 in the Connection DB

Create DB100 (or any application DB) with one TCON_PAR instance. The data block layout — for a passive connection (server) on TCP port 2000 — looks like the following. Replace the placeholder values with your project parameters.

DATA_BLOCK DB100
TITLE = 'Open IE TCON parameters for WinLC RTX'
STRUCT
    BlockLength      : WORD := W#16#40;     // 64 bytes standard length
    BlockId          : BYTE := B#16#11;     // 17 = TCP passive (server)
    ConnectionType   : BYTE := B#16#11;     // 0x11 = TCP, 0x13 = ISO-on-TCP
    ActiveEstabl     : BYTE := B#16#00;     // 0 = passive (server)
    LocalDeviceId    : BYTE := B#16#01;     // DEV_ID = 01 for IF1
    LocalTsapIdLen   : BYTE := B#16#02;     // 2-byte TSAP for TCP (0 for UDP)
    LocalTsapId      : ARRAY[0..3] OF BYTE := B#16#00, B#16#00, B#16#00, B#16#00;
    RemSubNetIdLen   : BYTE := B#16#00;     // not used for TCP passive
    RemSubNetId      : ARRAY[0..5] OF BYTE := 6(B#16#00);
    RemStAddrLen     : BYTE := B#16#00;     // 0 = accept any remote
    RemStAddr        : ARRAY[0..5] OF BYTE := 6(B#16#00);
    RemTsapIdLen     : BYTE := B#16#00;
    RemTsapId        : ARRAY[0..3] OF BYTE := 4(B#16#00);
    NextStAddrLen    : BYTE := B#16#00;
    NextStAddr       : ARRAY[0..5] OF BYTE := 6(B#16#00);
    NextStTsapIdLen  : BYTE := B#16#00;
    NextStTsapId     : ARRAY[0..3] OF BYTE := 4(B#16#00);
    Spare            : WORD := W#16#0000;
END_STRUCT
BEGIN
END_DATA_BLOCK

The LocalDeviceId field at byte offset 4 is the DEV_ID. Set it to:

• B#16#01 for the first Ethernet interface (most common)
• B#16#06 for the second
• B#16#0B for the third
• B#16#0F for the fourth

Step 5 — Call T_CON in OB1

CALL FB65, DB50  // TCON instance DB
REQ     := M10.0   // rising edge triggers connect
ID      := 1       // connection ID 1
DONE    := M20.0   // 1 cycle DONE pulse
BUSY    := M20.1   // busy flag
ERROR   := M20.2   // error flag
STATUS  := MW22    // 80A7 will appear here if misconfigured
CONNECT := DB100   // pointer to TCON_PAR in DB100

Set REQ = TRUE for exactly one cycle by using a positive edge of a one-shot or by gating it with a start-up flag. Leaving REQ = TRUE permanently causes repeated connect attempts and is a less-common source of 80A7 if the remote side rejects the SYN.

Step 6 — Call T_DISCON in a Safe Manner

Once the connection is established (DONE = 1), record the connection ID and only call T_DISCON in the stop/shutdown sequence:

CALL FB66, DB51  // TDISCON instance
REQ     := M10.1   // disconnect request (rising edge)
ID      := 1       // must match TCON ID
DONE    := M30.0
BUSY    := M30.1
ERROR   := M30.2
STATUS  := MW32

Calling T_DISCON before T_CON has reached DONE = TRUE — or with a mismatched ID — is the textbook trigger for the 80A7 message and is the meaning Siemens attaches to the status code on WinAC RTX.

Verification

1. Go online with the WinLC RTX target and monitor DB100.LocalDeviceId in the VAT — confirm it equals B#16#01 (or whichever IF you bound).
2. Watch MW22 (the STATUS output of T_CON) — within one cycle of REQ = TRUE, it should transition through W#16#0000 (in-progress) to W#16#0000 with DONE = TRUE on success.
3. From a partner PLC or a netcat/OpenSocket test client, initiate a TCP connection to the IP and port bound in DB100. Verify on the host that the RTX TCP/IP stack shows the established socket in the WinLC RTX log.
4. Send one T_SEND (FB63) frame and confirm the partner receives the bytes. Monitor STATUS on T_SEND — success is W#16#0000 with DONE = 1; a 80A7 here would indicate the connection is up but the wrong ID is referenced.
5. For ISO-on-TCP (connection type 0x13) tests, the TSAP pair must be byte-swapped (high/low) on the WinLC side relative to the S7-300 convention — another common 80A7 source on first integration.

Error Code Reference

Troubleshooting Matrix

Sample Project and Downloads

• Siemens Support entry 29737950 — Sample_open_TCP.zip: complete STEP 7 V5.4 SP4 project with the corrected DEV_ID mapping for all four WinLC interfaces. Open the project, switch to your IF number, and recompile.
• WinAC RTX 2008 manual (PDF) — official product manual; Appendix B lists compatible NIC chipsets and Open IE block error codes.
• STEP 7 V5.4 SP4 + HSP 2009-2 (or later WinAC RTX 2008 SP1 HSP) — install via Options → Hardware Updates in SIMATIC Manager.

Best Practices and Field Notes

• Always start from the Siemens sample. Entry 29737950 is the only project that ships with the correct UDT65 byte order for WinLC RTX. Building a project from scratch against a generic S7-300 Open IE template is the most common path to 80A7.
• Centralize DEV_ID in a single DB. Add a comment line above DB100.LocalDeviceId with the IF number (IF1, IF2, IF3, IF4) so that any engineer re-using the DB on a different IPC picks the matching value.
• Document the binding in HW Config. In the WinLC RTX properties under Interfaces, type a free-form note next to each IF indicating the physical NIC and the DEV_ID hex value. This avoids "which NIC is IF2 again?" loops during commissioning.
• Use a NIC with two ports if you need plant and cell separation. The Intel Pro/1000 PL dual-port server adapter (chipset still 82573) is a popular choice. Bind IF1 to port A and IF2 to port B.
• Watch for CPU 31x-2 PN project rewrites. When a project is migrated from a CPU 315-2 PN/DP to WinLC RTX (or vice versa), the UDT65 must be re-imported from the matching library, otherwise DEV_ID lands in the wrong byte and the user sees 80A7 even though the IP and port are valid.
• Disable Windows firewall on the industrial interface. Even on the 82573, the Windows firewall can intercept the RTX-bound socket and return an error that WinLC reports as 80A7. Add the WinLC RTX service (WinLC.exe) to the exception list, or open the port explicitly.
• Keep the RTX real-time task priority at the WinLC default. Lowering it (or letting another RTSS process preempt it) delays T_CON and can cause WinLC to time out internally, again surfacing as 80A7 with no other diagnostic on the wire.

Safety and Operational Notes

FAQ