S7-1500 Printer Connection via ISO-on-TCP: TIA Portal Setup

The SIMATIC S7-1500 CPU ships with a PROFINET interface that can be used for more than cyclic I/O. The same Ethernet port can also carry open ISO-on-TCP (RFC 1006) communication, which makes it possible to send raw print jobs to a network printer without a dedicated print server. This article walks through the hardware, the TIA Portal configuration, the program blocks, and the diagnostics required to connect a Siemens S7-1500 directly to a printer that exposes an ISO-on-TCP or raw TCP socket.

1. Overview of S7-1500 Ethernet Communication

The S7-1500 CPU family (including the S7-1500T motion variants and the ET 200MP distributed I/O) integrates a PROFINET interface that supports multiple industrial protocols concurrently. The interface can run:

• PROFINET IO controller / device on the same port (typically X1)
• S7 communication (PUT/GET) using ISO-on-TCP or ISO transport
• Open User Communication via TCON, TDISCON, TSEND, TRCV, TSEND_C, TRCV_C
• Modbus TCP, SNMP, DHCP, DNS, NTP, and web server

The integrated PROFINET interface is described in detail in the Overview of the SIMATIC S7-1500 Automation System in the official Siemens TIA Portal documentation. For print jobs the relevant block family is the Open User Communication blocks, which implement the standard TCP, ISO-on-TCP, ISO, and UDP transport layers.

For a printer to be reached from a S7-1500 it must either speak ISO-on-TCP (RFC 1006) directly on a configured TCP port, or expose a raw TCP listener that accepts a printable stream. Most industrial label printers (Zebra ZPL, Sato, Datamax-O'Neil, CAB, Markem-Imaje) accept raw TCP on a configurable port, frequently 9100 (the so-called "RAW" or "JetDirect" port), while some Siemens HMIs and SIMATIC panels use ISO-on-TCP port 102 with a Siemens-specific print template.

2. Prerequisites

2.1 Hardware

• SIMATIC S7-1500 CPU with PROFINET interface (any standard CPU such as CPU 1511-1 PN, CPU 1515-2 PN, CPU 1518-4 PN/DP, or a S7-1500T motion CPU).
• PROFINET port on the CPU (X1 or X2, depending on CPU type) wired to an Ethernet switch or directly crossed to the printer.
• Network printer or print server that supports TCP socket printing. Verify the supported port and protocol in the printer manual.
• Shielded Ethernet cabling (Cat 5e minimum, Cat 6A recommended for industrial environments) terminated to PROFINET M12 or RJ45 connectors as required.

2.2 Software and Firmware

• STEP 7 (TIA Portal) V16 or later. V17 or V18 recommended for the latest S7-1500 CPU firmware support.
• CPU firmware 2.0 or higher for the S7-1500 standard CPUs. The S7-1500T CPUs require firmware 2.5 or higher for full motion and printing features.
• Optional: the SIMATIC S7-1500(T) Printing Standard (LPrint) library described in Siemens Support Entry 109762435.
• Wireshark (optional, for protocol verification on a span port).

3. Network Planning and IP Addressing

Pick a fixed IP scheme for the printer. ISO-on-TCP and raw TCP printing do not require a DHCP server, and a static lease is the most reliable option on the shop floor.

The S7-1500 acts as the active partner and opens the connection; the printer is the passive partner and listens for incoming connections. If the printer sits on a different subnet, add a gateway in the CPU's PROFINET interface properties and confirm the switch is not filtering the chosen TCP port.

4. Configuring the Connection in TIA Portal

4.1 Project Setup

1. Open TIA Portal and open the project that contains the target S7-1500 station.
2. Double-click Devices & Networks in the project tree.
3. Select the S7-1500 CPU and open Properties > PROFINET interface [X1] > Ethernet addresses. Confirm the IP address matches the planning table.
4. Add the printer as an unconnected device on the network view if you want TIA Portal to track the topology, or simply note its IP and port for the connection description.

4.2 Connection Description (Active Connection)

1. Right-click the CPU and choose Properties > Connection mechanism or use the connection editor in the Connections node of the device.
2. Create a new connection of type TCP connection if the printer expects raw TCP (port 9100) or ISO-on-TCP connection if it speaks RFC 1006 (port 102 by default, custom ports possible).
3. Set the local end point to the CPU PROFINET interface and the partner (remote) end point to the printer IP. The TSAP (Transport Service Access Point) for ISO-on-TCP must be supplied for both ends. The S7-1500 uses arbitrary TSAPs in the format 02.xxxx for local and 02.xxxx or printer-defined value for remote.

The connection description generates a unique Connection ID (ID = 1 for the first connection) that the program blocks use to reference the established socket. Keep this ID in a constant or in a tag so the application code can be reused.

5. Programming the Open User Communication Blocks

The S7-1500 uses the Open User Communication instruction set. The minimum set of blocks for a one-way print job is:

• TCON — establish the TCP or ISO-on-TCP connection
• TSEND_C — establish + send in a single call (use if you do not need TCON separately)
• TRCV_C — establish + receive (used if the printer returns a status or barcode acknowledgment)
• TDISCON — close the connection when printing is finished

5.1 TCON Instruction Parameters

5.2 TCON_Configured Structure

When the connection is created in the TIA Portal connection editor, the system builds a TCON_Configured data block automatically. If you prefer to set up the structure manually, the following fields are mandatory:

TYPE          : BYTE  := B#16#0C   // 0x0C = ISO-on-TCP, 0x11 = TCP, 0x12 = UDP
ACTIVE_ESTABLISH : BOOL := TRUE    // S7-1500 is the active partner
LOCAL_DEVICE_ID : BYTE := B#16#02  // 0x02 = PROFINET interface X1
LOCAL_TSAP_LEN : BYTE  := B#16#06  // for ISO-on-TCP: 6 bytes
LOCAL_TSAP    : ARRAY[1..6] OF BYTE := B#16#02, B#16#00, B#16#00, B#16#00, B#16#00, B#16#01
REMOTE_TSAP_LEN : BYTE := B#16#06
REMOTE_TSAP   : ARRAY[1..6] OF BYTE := B#16#02, B#16#00, B#16#00, B#16#00, B#16#00, B#16#32
REMOTE_ADDRESS : IP_V4 := 192.168.10.50

For raw TCP (port 9100), set TYPE = B#16#0B and leave the TSAP fields empty. The remote port is encoded in the connection description when TIA Portal creates the structure for you.

5.3 TSEND_C Instruction

TSEND_C is the recommended instruction for print jobs because it combines TCON and TSEND into a single call. It accepts a LENGTH in bytes and a pointer to the data area that contains the ZPL, EPL, or PCL payload.

// ST example: send a ZPL II print job
// Buffer holds the raw ZPL command string
"print_data".ZPL_Buf := 'XA^FO50,50^FDHello World^FS^XZ';

// Initialize TSEND_C
TSEND_C(REQ   := "startPrint",          // trigger from HMI or program
         ID    := W#16#0001,             // same ID as TCON
         LEN   := 24,                    // length of the ZPL string
         DATA  := "print_data".ZPL_Buf,
         DONE  => "printDone",
         BUSY  => "printBusy",
         ERROR => "printError",
         STATUS=> "printStatus");

The STATUS word from TSEND_C carries the same error codes as TCON. When STATUS = W#16#0000 and DONE = TRUE, the data was acknowledged by the printer's TCP stack and the print job should be processed.

5.4 Ladder Logic Equivalent

// Ladder snippet
A "startPrint"
= %DB20.DBX0.0    // TSEND_C.REQ trigger

CALL TSEND_C, DB20
   REQ   := "startPrint"
   ID    := W#16#0001
   LEN   := 24
   DATA  := P#DB30.DBX0.0 BYTE 24
   DONE  := "printDone"
   BUSY  := "printBusy"
   ERROR := "printError"
   STATUS:= "printStatus"

6. Using the SIMATIC Print Standard (LPrint)

Siemens ships a function library called LPrint that wraps the Open User Communication blocks with a more application-friendly interface. LPrint handles connection management, message buffering, and acknowledgement. The library is delivered as a TIA Portal global library and is documented in Siemens Support Entry 109762435 - SIMATIC S7-1500(T) Printing Standard (LPrint).

Typical LPrint workflow:

1. Import the LPrint library into the global libraries of TIA Portal.
2. Drag the LPrint_Instance FB into the project and call it from the cyclic OB.
3. Configure the connection parameters in the FB's instance DB: printer IP, port, ISO-on-TCP or raw TCP, TSAPs, and the print template (text-only, barcode, ZPL pass-through, etc.).
4. Use the LPrint_Send function to push a string or byte buffer to the printer.
5. Use LPrint_Status to read the current job state in the HMI.

LPrint is the preferred path on the S7-1500T because it is also aware of motion-related print triggers (for example "print barcode at axis position X"). On a standard S7-1500 you can still use LPrint for plain text and barcode printing without motion triggers.

7. Verification

1. Online connection check. In TIA Portal, go online with the CPU and open Diagnostics > Connection diagnostics. The connection should show as established with the configured Connection ID and the printer's IP as the partner.
2. STATUS inspection. Force the print trigger and observe the STATUS word. Expected sequence: W#16#7000 (job running) → W#16#0000 with DONE = TRUE (success). Any other non-zero STATUS is an error that must be decoded using the table in section 8.
3. Printout check. Confirm the physical printout matches the buffer content. Mismatched characters usually mean an incorrect character set (UTF-8 vs. ANSI) or a wrong line terminator (CR+LF vs. LF).
4. Wireshark capture. On a managed switch with port mirroring, capture the conversation. For ISO-on-TCP you should see RFC 1006 TPDUs (first byte = 0x03, length byte = 0xC0 or 0x80, followed by the user data). For raw TCP you should see only the user data after the TCP handshake.
5. CPU diagnostic buffer. Open Online & Diagnostics > Diagnostic buffer and verify that no communication alarms have been logged.

8. Error Codes and Troubleshooting Matrix

The Open User Communication blocks return a 16-bit STATUS word. The high byte is the general error class; the low byte gives the specific cause.

CPU-specific maximum connection counts (Open User Communication only) for the common S7-1500 CPUs are:

9. Field-Proven Tips

• Always force a clean disconnect on shutdown. Trigger TDISCON from the startup OB or from a fault OB so that the printer does not accumulate half-open sockets after a CPU restart.
• Use a separate VLAN. Keep printer traffic off the PROFINET IO VLAN. Many managed switches filter multicast PROFINET frames, and printer TCP traffic can be routed normally.
• Watch the receive direction. Some printers reply with an XON/XOFF byte or with a status string. If you ignore TRCV, the printer may stall after a few hundred jobs because its internal buffer remains full.
• Do not exceed 8 KB per send. The TSEND_C instruction in firmware 2.x is limited to 8192 bytes per call. For long ZPL print batches, segment the buffer in the application and call TSEND_C repeatedly.
• Test with Telnet first. From a service laptop, run telnet 192.168.10.50 9100 and type a test ZPL string. If the printer responds, the network and printer side are healthy and any issue is in the PLC program.
• Disable PROFINET on the printer port. If the printer advertises LLDP, the switch may put the port into a PROFINET mode. Set the printer port to "Standard" or "Transparent" on the switch.

10. Alternate Controllers and Protocol Notes

The same pattern works on the S7-1200 CPU with the same instruction names, but the maximum OUC connection count is lower (8 for CPU 1214C, 16 for CPU 1217C). For larger S7-1500 fleets, consider centralizing printing on a single CP 1543-1 communications module to free CPU cycles.

If the printer only supports LPR/LPD (the original Berkeley line printer protocol), add a small Linux print server (Raspberry Pi, Siemens IOT2050, or an IPC) that exposes port 9100 and forwards the stream. The S7-1500 cannot speak LPR natively.

11. Security Considerations

Open User Communication on the S7-1500 is plain TCP by default. To restrict who can open the connection, use the CPU's access protection in Properties > Protection & Security > Connection mechanisms. The S7-1500 firmware 2.9 and later supports TLS-secured Open User Communication with the TCON variant that uses the security layer; verify the printer supports TLS before enabling it.

Disable unused services (web server, FTP, DCP discovery) on the CPU's PROFINET interface if the printer does not need them. A printer on the same physical switch that also carries PROFINET IO is a frequent cause of broadcast storms that take down the cell.

12. Summary

An S7-1500 can print to a network printer directly over its PROFINET port. Define a connection in the TIA Portal connection editor, call TCON to open the socket, send the print job with TSEND_C, and close with TDISCON. The LPrint library from Siemens Support Entry 109762435 wraps these calls for application use and is the recommended path on S7-1500T. Always verify with the CPU's online connection diagnostics and, when in doubt, capture the wire with Wireshark to confirm that the protocol on the wire matches the printer's expectation.