S7-1200 to PC Ethernet: Data Transfer via TIA, OPC UA, FTP

Connecting a Siemens S7-1200 to a PC over Ethernet for Data Transfer

This reference consolidates the field-proven methods for transferring live process data, program data, and file data between a SIMATIC S7-1200 controller and a Windows PC over Ethernet. The four primary paths are: TIA Portal online access (engineering), S7 communication / OPC UA (cyclic process data), FTP (file-based exchange of data logs and recipes), and Open User Communication (TCP/UDP blocks such as T_Send / T_Recv or the LCom library). Each method is detailed below with parameters, port numbers, firmware compatibility, and verification steps.

1. Overview of Available Data Paths

The S7-1200 CPU (firmware V4.0 and later) exposes several communication interfaces that map directly to PC applications:

2. Prerequisites and Hardware Setup

2.1 Required Hardware

• SIMATIC S7-1200 CPU (any variant, firmware ≥ V4.0 recommended for OPC UA and full LCom support).
• Ethernet cable: Cat 5e or higher. Direct connection (PC ↔ PLC) is supported without a switch using Auto-Crossover (Auto-MDI/MDIX) on all S7-1200 PROFINET ports.
• PC with Ethernet port (1 Gbit recommended; 100 Mbit is sufficient for S7-1200 traffic).
• Optional: Managed switch for multi-node networks (e.g., SCALANCE XC-100).

2.2 Required Software on PC

• TIA Portal V13 SP1 or later (matching the CPU firmware generation). TIA Portal V17+ supports S7-1200 firmware V4.5.
• For OPC UA: SIMATIC NET OPC UA Server (catalog number 6GK1704-1LW13-0AK0) or a third-party server such as Kepware or Ignition.
• For FTP: Any RFC 959 compliant FTP client. Windows Explorer, FileZilla, or WinSCP are recommended.
• For Open User Communication: Any TCP/UDP socket library (C# / .NET, Python sockets, LabVIEW TCP nodes).

2.3 IP Address Planning

Assign both devices to the same subnet. Default S7-1200 IP is 192.168.0.1 / 24; TIA Portal can reassign this during initial commissioning.

3. Method 1 — TIA Portal Online Access (Engineering Channel)

TIA Portal's Accessible Nodes function performs a PROFINET DCP broadcast to discover all SIMATIC devices on the local Ethernet segment. This is the fastest path for program transfer, online monitoring, and watch tables.

3.1 Step-by-Step Procedure

1. Connect the PC's Ethernet port directly to the S7-1200 PROFINET port (X1).
2. Open TIA Portal → Online → Accessible Devices.
3. Select the network adapter bound to the direct connection from the dropdown (e.g., "Intel I219-LM Ethernet").
4. Click Start Search. The PLC appears as a node with its current MAC address and IP.
5. If the PLC has no IP, right-click → Assign IP Address. Enter 192.168.0.1, subnet 255.255.255.0, router 192.168.0.254.
6. Open the project, select the PLC, and click Download to Device (icon: lightning bolt). TIA Portal will compile the program, establish the S7 online connection over TCP/102, and write the blocks.
7. To read data into the PC application, expand Online & Diagnostics → Watch Tables or use the Online view of program blocks.

3.2 Port and Protocol Reference

4. Method 2 — S7 Communication and OPC UA for Process Data

The S7-1200 can be a server for two protocols: the proprietary S7 Communication (used by PC clients like Snap7, libnodave, S7.Net) and the standardized OPC UA. OPC UA is preferred for new applications because it is portable, secure, and discoverable.

4.1 Enabling OPC UA on the S7-1200 (firmware V4.4 or later)

1. In TIA Portal, open the PLC device view.
2. Navigate to Properties → OPC UA Server.
3. Enable the server, set the port (default 4840), and choose Authentication: Anonymous for trusted networks (otherwise configure username/password or certificate-based auth).
4. Select which DBs, M, I, Q areas to publish. TIA Portal generates an OPC UA address space automatically.
5. Compile and download. The OPC UA server starts immediately and is reachable at opc.tcp://192.168.0.1:4840.

4.2 OPC UA Server on PC (SIMATIC NET)

The PC-side OPC server with catalog number 6GK1704-1LW13-0AK0 is the SIMATIC NET OPC UA Server. Configuration is via the SIMATIC NET Configuration Console:

1. Install SIMATIC NET PC Software (≥ V16).
2. Launch SIMATIC NET Configuration Console → add an OPC UA connection.
3. Enter the S7-1200 IP, slot 1, rack 0, and choose S7 Protocol.
4. Browse tags and bind them to OPC UA variables.
5. Any OPC UA client (Ignition, WinCC, custom C# client using Opc.UaClient) can now consume the data.

4.3 Direct S7 Protocol without OPC UA (Python / C#)

For non-OPC UA clients, use the Snap7 open-source library or the S7.Net wrapper for .NET:

Python Example (using python-snap7)

import snap7
from snap7.util import get_bool, get_int, get_real

client = snap7.client.Client()
client.connect('192.168.0.1', 0, 1, 102)  # IP, rack, slot, port

# Read DB1 (recipe data, 200 bytes)
data = client.db_read(1, 0, 200)
int_value = get_int(data, 0)
bool_value = get_bool(data, 2)
real_value = get_real(data, 4)

# Write DB1
client.db_write(1, 0, bytearray(b'\x01\x00\x2A\x00'))

client.disconnect()

C# Example (using S7.Net)

using S7.Net;

var plc = new Plc(CpuType.S71200, "192.168.0.1", 0, 1);
plc.Open();

// Read DB1 starting at byte 0, length 4
var result = (uint)plc.Read("DB1.DBD0");

// Write to output byte 0
plc.Write("Q0.0", true);

plc.Close();

5. Method 3 — FTP File Transfer to the Memory Card

The S7-1200 (firmware V4.0+) includes a built-in FTP server that exposes the SIMATIC Memory Card (SMC) as a folder tree. The recipe, DataLog, and program archive files all live on this card.

5.1 Enabling FTP

1. TIA Portal → PLC Properties → Web Server / FTP Server (firmware V4.4+) or Protection & Security → FTP (older firmware).
2. Enable the FTP server.
3. Set User name, Password, and choose Read-only for read-back or Read/write for recipe download.
4. Compile and download.

5.2 Accessing the PLC from the PC

ftp 192.168.0.1
# User: ftpuser
# Password: (configured in TIA)
cd /DataLogs
ls
get Recipe_001.csv C:\Reports\Recipe_001.csv
put Recipe_New.csv /Recipes/Recipe_New.csv
bye

Windows Explorer also supports FTP directly: enter ftp://ftpuser:[email protected] in the address bar. Drag-and-drop file transfer works once authenticated.

5.3 Standard Directory Layout on the SMC

6. Method 4 — Open User Communication with T_Send / T_Recv

The Open User Communication (OUC) blocks in TIA Portal implement ISO-on-TCP (RFC 1006), TCP, and UDP directly in the PLC program. They are the right choice when the PC application already has a TCP socket interface and you want to bypass OPC UA middleware.

6.1 Supported Firmware and Library Versions

6.2 Structured Text Sample (TCP Server on PLC)

// OB1 – TCP echo server listening on port 2000
// Connection ID 1
"dbTcp".TRCV_C_Instance(EN := TRUE,
                         ID := 1,
                         LEN := 100,
                         ADDR := "dbTcp".rcvArea);

IF "dbTcp".TRCV_C_Instance.NDR THEN
    // Data received – echo back to client
    "dbTcp".TSEND_C_Instance(EN := TRUE,
                             ID := 1,
                             LEN := "dbTcp".rcvLen,
                             DATA := "dbTcp".rcvArea,
                             COM_RST := FALSE);
END_IF;

6.3 PC-Side Python Socket Client

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('192.168.0.1', 2000))

# Read input byte I0.0 status (offset 0 = status word)
payload = bytes([0x01, 0x00])
s.sendall(payload)

resp = s.recv(64)
print('PLC reply:', resp.hex())

s.close()

6.4 Connection Parameter Block (TCON)

7. LCom Library for S7-1200

The LCom library (catalog reference in Siemens KB 48955385) provides simplified, parameterized blocks for TCP/UDP communication tailored for S7-1200/1500. It is smaller than the full Open User Communication blocks and is intended for simple ASCII or binary protocols such as barcode readers, scales, and printer interfaces.

7.1 Included Function Blocks

7.2 Typical Use Case: Sending Status String to PC

// LCOM TCP server FB instance
#instLCOM_TCP_Server(Port := 2001,
                     InterfaceId := 64,
                     TxBuffer := 'I/O status: ' + INT_TO_STRING("DB_Stat".iCount));

The PC connects on TCP 2001 and receives the status string at every buffer update (typically every scan or on event).

8. Tag Selection and Data Mapping

Whichever method is chosen, the PC application must agree with the PLC on the memory layout. Define a single process image DB on the PLC side and document each variable's byte offset and data type.

8.1 Example DB1 Layout

8.2 Big-Endian / Little-Endian Note

The S7-1200 stores multi-byte values in big-endian order. PC clients written in C# (default little-endian on x86/x64) or Python must byte-swap INT, DINT, REAL, and LREAL values after reading raw bytes from db_read. Snap7 and S7.Net handle this automatically; raw socket implementations (T_Send / T_Recv) do not.

9. Network and Firewall Configuration

Windows Firewall blocks unsolicited inbound traffic by default. The following inbound rules must be enabled on the PC for each method used:

To create an inbound rule from the elevated PowerShell:

New-NetFirewallRule -DisplayName "PLC TCP 2000" -Direction Inbound `
  -LocalPort 2000 -Protocol TCP -Action Allow

10. Verification Steps

After configuration, verify connectivity with a layered approach:

1. Ping test: From the PC command prompt, run ping 192.168.0.1. Expect reply time ≤ 1 ms on a direct connection.
2. ARP table check: arp -a should show the S7-1200 MAC address bound to 192.168.0.1.
3. TIA Accessible Nodes: Confirm the CPU appears with the correct firmware version.
4. Watch table read: Force a known tag (e.g., DB1.DBX0.0) to TRUE in the watch table; verify the OPC UA / Snap7 client reads the same value within the configured update interval.
5. FTP round-trip: Upload a 1 kB test file to /UserFiles/test.txt and read it back via ftp get. CRC must match.
6. Loopback with T_Send / T_Recv: Have the PC echo the PLC's payload and verify bit-exact match.

11. Troubleshooting Matrix

12. Selection Guide — Which Method to Use

• Single engineer commissioning: TIA Portal direct download + watch tables.
• HMI / SCADA on plant floor: OPC UA with SIMATIC NET server or third-party (Ignition).
• Python / C# data logger on a separate server: Snap7 or S7.Net (no OPC required).
• Custom TCP peer-to-peer with existing PC software: T_Send / T_Recv or LCom blocks.
• Batch report export: DataLog block writes CSV to memory card; PC retrieves via FTP.

13. Safety and Operational Notes

• Never enable remote PLC STOP/RUN control from a PC connected to a safety-critical machine without a physical key-switch override.
• Disable PUT/GET access if the project does not require external write-back. Use the Access Level setting in TIA Portal to enforce this.
• For ESD/EMI sensitive cabinets, use shielded Cat 5e (SF/UTP) and bond the cable shield at the cabinet entrance.
• FTP traffic is plaintext. Isolate the PLC on a private subnet or upgrade to FTPS (firmware V4.5+) for sensitive recipes.
• Always validate that the application code handles connection lost states; the S7-1200 will not hold the last value of a closed OPC UA subscription.