S7-1200 to Beckhoff CX2030: TCP/IP, S7 Protocol, PROFINET Setup

1. Overview

Integrating a Siemens S7-1200 PLC with a Beckhoff CX2030 Embedded PC running TwinCAT 3 is a common requirement in mixed-vendor automation cells. The two controllers expose different but converging communication stacks, and the right choice depends on data volume, deterministic requirements, and whether you can install a vendor-specific GSD or library on either side.

The S7-1200 CPU (firmware V4.0 and later) supports three relevant protocols on its integrated PROFINET interface:

• TCP/IP via the Open User Communication instructions (TCON, TSEND, TRECV, TCON_SET, TDISCON).
• UDP via TUSEND / TURCV for low-overhead cyclic datagrams.
• S7 Communication via PUT/GET (partner connections) or BSEND/BRCV.

On the Beckhoff side, the CX2030 (TwinCAT 3.1 build 4024 and later) supports the same TCP/UDP socket primitives plus an optional Tc3_S7Communication add-on product that natively speaks the Siemens S7 protocol over TCP/port 102. No PROFINET controller or slave license is required if you choose the TCP/S7 routes; you only need PROFINET if you want real-time IRT or device-level diagnostics.

This reference covers three deployment options, the configuration of each side, and the diagnostic steps you need to verify a healthy link.

2. Communication Options Compared

For most brownfield retrofits, Option B is the fastest path because it requires no S7-1200 program changes and no PROFINET hardware on the Beckhoff. For greenfield cells that need < 1 ms determinism, Option C with PROFINET IRT is the correct choice.

3. Prerequisites

• S7-1200 CPU: Any 12xx with firmware V4.2 or later recommended (V4.4 for full S7 protocol feature parity). The integrated PN interface must be configured as an Ethernet node with a fixed IP.
• Beckhoff CX2030: TwinCAT 3.1 build 4024.56 or later for the S7 protocol library; build 4026.x for PROFINET device support.
• TIA Portal: V15.1 or later (V17+ recommended).
• Network: Managed switch, both devices in the same subnet (e.g., 192.168.0.0/24). PROFINET uses LLDP; ensure the switch does not filter it.
• Engineering access: TIA Portal project online access to the S7-1200 and TwinCAT XAE (Visual Studio shell) installed locally or via RDP.

4. Option A — Open TCP/IP Communication (TCON / TSEND / TRECV)

Use Open User Communication when you need full control of the telegram layout or when the Beckhoff side already exposes a TCP server. The S7-1200 acts as either the active connection partner (TSEND initiates) or passive (T_CON waits for an active partner on the CX2030).

4.1 S7-1200 Configuration in TIA Portal

1. In the device view, open the CPU properties and select Ethernet addresses. Set the IP address (e.g., 192.168.0.10), subnet mask 255.255.255.0, and leave the PROFINET device name blank if you will not use PROFINET IO.
2. Open the program blocks and create a new FB (e.g., FB_S7_TCP_Com). Declare the following STAT variables:

   VAR
       Connect : TCON_IP_v4;          // connection description
       Id      : WORD := 1;           // connection ID, unique per CPU
       Req     : BOOL;                // send trigger
       SendBuf : ARRAY[0..99] OF BYTE;// send buffer
       RcvBuf  : ARRAY[0..99] OF BYTE;// receive buffer
       SentLen : INT;
       RcvLen  : INT;
       Status  : WORD;
   END_VAR

3. Call TCON in OB1 to establish the connection. Use Connect.ActiveEstablished := TRUE if the CX2030 is the active partner, or FALSE if the S7-1200 initiates.
4. Call TSEND with REQ := Req, DATA := SendBuf, LEN := 8 (for one INT + tag).
5. Call TRECV with EN_R := TRUE and DATA := RcvBuf. Set LEN := 8 to allow variable-length telegrams (TRECV writes the actual length to RCVD_LEN).

4.2 Beckhoff CX2030 TwinCAT Configuration

1. Reference the Tc2_TcpIp library in your TwinCAT project (Project → Add Library → Tc2_TcpIp).
2. Declare an instance of FB_Socket for the server port and call FB_Listen on port 2000 (arbitrary, must match the S7-1200 TCON RemotePort).
3. Use FB_Accept in a cyclic task to spawn per-client FB_Send and FB_Receive blocks.
4. Map the received bytes into TwinCAT variables. A simple way is to overlay a structure with {attribute 'pack_mode' := '1'} to match the S7 byte order.

4.3 Packing Bits and INTs

For a typical "8 bits + 1 INT" payload, define:

// S7-1200 side, packed buffer
Packed AT SendBuf : STRUCT
    bits   : BYTE;     // bits 0..7 in bit 0 of byte 0
    word1  : WORD;     // INT, big-endian (use SWAP_B or manual byte reorder)
    word2  : WORD;
    reserved : ARRAY[0..91] OF BYTE;
END_STRUCT;

Send length = 96 bytes minimum to keep the buffer aligned; the Beckhoff can decode by reading bits as BOOL[0..7] and using SWAP on the two WORDs.

5. Option B — Native S7 Protocol via TwinCAT Tc3_S7Communication

Beckhoff introduced the Tc3_S7Communication add-on in 2021 to allow direct S7 protocol access without an S7 PLC program change. See the Beckhoff press release "TwinCAT software now supports S7 communication protocol" for the original announcement.

5.1 Supported Data Areas

According to the Beckhoff Information System: Tc3_S7Communication supported systems and functionalities, the following Siemens data areas are accessible:

• INPUT (I) — process input image
• OUTPUT (Q) — process output image
• DATA_BLOCKS (DB) — arbitrary data blocks including DB1 with optimized access disabled
• FLAGS (M) — bit memory

Counters (C) and timers (T) are not part of the supported area list and must be mirrored into M or DB if needed.

5.2 Activating S7 Protocol Access on the S7-1200

S7-1200 CPUs (and S7-1500) ship with the "Permit access with PUT/GET communication from remote partner" disabled by default. Enable it as described in the Beckhoff Information System page "Activating the S7 protocol access":

1. In TIA Portal, open the CPU device properties.
2. Navigate to Protection & Security → Connection mechanisms.
3. Tick Permit access with PUT/GET communication from remote partner.
4. Compile and download the hardware configuration.

For S7-1500 and newer S7-1200 firmware, also ensure the CPU's "Access level" for the HMI/Read/Write password configuration allows the connection. No password is required when "Full access (no protection)" is selected.

5.3 Beckhoff TwinCAT Configuration

1. Install the Tc3_S7Communication add-on product (TwinCAT Package Manager → Install → Beckhoff Automation GmbH → Tc3_S7Communication).
2. Reference the library in the TwinCAT project.
3. Declare function block instances: fbS7_Read and fbS7_Write from the library.
4. Configure the connection: target IP = 192.168.0.10 (the S7-1200), rack = 0, slot = 1, connection type = S7ONLINE (ISO-on-TCP) or S7TCP (pure TCP on port 102). For S7-1200 use S7TCP.
5. Set the data area (e.g., DB100), byte offset, and length. Maximum single read = 480 bytes in legacy mode, 960 bytes with the extended S7 protocol.
6. Call fbS7_Read(Execute := TRUE, Area := S7_AREA_DB, DBNumber := 100, Start := 0, Length := 32) in a 10 ms task to poll INT and bit data.

5.4 Mapping Bits and INTs

Because the CX2030 reads raw bytes, overlay the data on a TwinCAT structure with {attribute 'pack_mode' := '1'}:

TYPE ST_S7Payload :
STRUCT
    bCmd    : BOOL;      // bit 0 of byte 0
    bEnable : BOOL;      // bit 1
    bStatus : BOOL;      // bit 2
    nSpeed  : INT;       // bytes 2..3, big-endian → use SWAP
    nPos    : DINT;      // bytes 4..7, big-endian → use SWAP
END_STRUCT
END_TYPE

Use SWAP on every multi-byte variable to convert from Siemens big-endian to Intel little-endian.

6. Option C — PROFINET with GSD File

If your application requires deterministic cyclic I/O with sub-millisecond jitter, configure the S7-1200 as a PROFINET IO Device (slave) and either run TwinCAT as PROFINET IO Controller using an EL6631-0010 terminal, or as a PROFINET Device using the CX2030 PROFINET device runtime.

6.1 S7-1200 PROFINET Device Configuration

1. In TIA Portal device view, right-click the CPU's PROFINET interface and choose Properties → PROFINET interface → Operating mode.
2. Select IO Device. Assign a unique device name (e.g., s71200-slave-1).
3. Add slots under Device configuration → Slot 1: e.g., Input 16 bytes / Output 16 bytes. The GSD importer on the Beckhoff side will read these slot definitions.
4. Download the hardware configuration.

6.2 Beckhoff TwinCAT PROFINET

1. For the CX2030 as controller, attach an EL6631-0010 (PROFINET IRT controller) or EL6632 terminal to the EtherCAT coupler. The CX2030 PROFINET device runtime uses the on-board Ethernet port instead.
2. Import the GSDML file for the S7-1200 (TIA Portal → Extras → Export GSDML or download from Siemens Industry Online Support).
3. Add the S7-1200 as a PROFINET device in the TwinCAT IO tree. Match the slot configuration to the TIA Portal definitions.
4. Map the PROFINET process image to TwinCAT variables using the IO mapping dialog.

7. Configuration Checklist (All Options)

• Both devices have static IP addresses (no DHCP).
• Subnet masks match (255.255.255.0 in the example).
• Any managed switch passes LLDP frames (PROFINET only).
• Firewall on the CX2030 Windows / TwinCAT real-time side allows TCP/102 (S7), TCP/2000 (Option A example), or PROFINET UDP/34964/49152.
• Time synchronization is handled (NTP for logging, not strictly required for data exchange).

8. Verification and Diagnostics

8.1 TCP/IP Connection State (S7-1200)

Monitor the STATUS output of TCON. Healthy values:

• 0x0000 — Connection established, idle.
• 0x7000 — Call active, no error.
• 0x8001-0x8007 — Recoverable errors (partner not reachable, transient).
• 0x80C3 / 0x80C4 — Resource / partner-side errors, check PLC partner state.

8.2 S7 Protocol Diagnostics

The fbS7_Read and fbS7_Write blocks return a ErrorId:

8.3 PROFINET Diagnostics

Use the TwinCAT IO diagnostics tab to read the PROFINET alarm frame. Common faults:

• Station failure (red) — Name assignment failed; verify PROFINET device name matches exactly, including case.
• Slot mismatch — The slot module defined in TwinCAT does not match the TIA Portal export. Re-import the GSDML after changes.

8.4 End-to-End Verification

1. From the S7-1200, force a value in the mapped DB byte/INT.
2. Watch the TwinCAT variable update within one task cycle (Options B and C) or after the next TCP send trigger (Option A).
3. Reverse the direction by writing from TwinCAT and observing the S7-1200 input.
4. Capture a Wireshark trace on the mirrored switch port to confirm the protocol (TCP/102, TCP/2000, or PNIO frames).

9. Troubleshooting Matrix

10. FAQ