S7-1500 to S7-300 Communication: S7 and Open TCP Setup

Overview

Brownfield migration projects commonly retain installed SIMATIC S7-300 CPUs while adding S7-1500 controllers for new process cells, machine modules, or replacement of obsolete hardware. Because the two controller families were designed for different engineering tools (STEP 7 V5.x for S7-300/400, TIA Portal for S7-1500), exchanging data between them requires a deliberate connection strategy that works across project boundaries, firmware generations, and instruction-set revisions.

Three mechanisms are used in practice for S7-1500 ↔ S7-300 communication:

• Configured S7 connection (unspecified S7 connection) using PUT/GET or BSEND/BRCV
• Open User Communication (OUC) with TCON, TDISCON, TSEND, TRCV over ISO-on-TCP, TCP, or UDP
• Ad-hoc S7 connection for PUT/GET from a partner that is not configured in the local project

This reference covers engineering steps, block configuration, parameter layout, and diagnostic procedures for each approach, with explicit attention to the block differences that cause first-time failures between S7-300 legacy function blocks (FB12, FB13, FB14, FB15, FB65, FB63, FB64) and the S7-1500 instructions of the same name. Working snippets, parameter tables, and a fault-code matrix are included for field commissioning.

Path Selection: S7 vs Open User Communication

The choice between a configured S7 connection and Open User Communication is driven by data volume, determinism, and engineering footprint. S7-300 to S7-1500 projects often use a hybrid: small cyclic data over configured S7 (PUT/GET), large bursts over BSEND/BRCV or over OUC.

For tens of kilobytes of data, both BSEND/BRCV and the OUC TSEND/TRCV path are viable. BSEND/BRCV provides an application-level acknowledge; OUC gives the developer a free choice of segmentation and is mandatory when the partner is not a Siemens S7 CPU.

Prerequisites and Component Selection

Verify the following before configuring any cross-generation communication.

Configuring an Unspecified S7 Connection

An unspecified S7 connection is the standard mechanism when the partner CPU is configured in a separate project. Both sides must create a connection entry that names the other CPU by IP address and TSAP, but neither needs the partner's project file.

Step-by-step on the S7-1500 side (TIA Portal)

1. Open the device configuration of the S7-1500 CPU and select the PROFINET interface.
2. Set the IP address and subnet; confirm the PN interface is online-capable.
3. In Project Tree → "Devices & Networks", switch to the "Connections" tab.
4. Click "New connection" and select connection type S7 connection.
5. Choose partner "Unspecified"; enter partner IP address and partner TSAP.
6. In connection properties → "Address details", set local TSAP (e.g., 10.00) and remote TSAP (e.g., 03.02). The remote TSAP must match the slot and connection of the S7-300 partner.
7. Confirm "Active connection establishment" per direction. Typically the S7-1500 establishes actively if it is the data consumer (e.g., central collection of S7-300 data).
8. Download the connection configuration; the connection appears in the connection table with a local ID, e.g., ID=W#16#0001.

Step-by-step on the S7-300 side (STEP 7 V5.x / NetPro)

1. In NetPro, right-click the S7-300 CPU → "Insert New Connection".
2. Select connection type S7 Connection and partner "Unspecified".
3. Enter the S7-1500 IP address. The local TSAP defaults to 03.02 (slot 3) and the remote TSAP must be set to the value chosen on the S7-1500 side.
4. Tick "Establish an active connection" only on the side that initiates the first connection setup; otherwise both will be passive and the connection will not come up.
5. Save and download the connection to the S7-300 CPU. The active partner will then set up the connection on next TCON/PUT/BSEND invocation.

PUT/GET: Periodic, Small Data Exchange

PUT and GET are the simplest mechanism for cyclic data exchange of up to 160 user bytes per call (header + data on S7-300, header-stripped data on S7-1500). PUT writes data to a partner DB; GET reads from a partner DB.

Block differences between generations

Working example: S7-1500 PUT/GET against S7-300

The S7-1500 program can use either direction. Below is the S7-1500 as a centralized collector, reading a 100-byte block from each of several S7-300 PLCs and writing a 32-byte command block back.

S7-1500 side (SCL, TIA Portal V20):

// S7-1500 reads 100 bytes from S7-300 DB100 starting at byte 0
#iGetBusy := FALSE;
#iGetDone := FALSE;
#iGetError := FALSE;
#iGetStatus := 16#0000;

GET_DB200  (REQ   := #tGetTrigger,
            ID    := W#16#0001,           // connection ID of the unspecified S7 connection
            ADDR_1:= "DB100" := P#DB100.DBX0.0 BYTE 100, // partner area
            RD_1  := "DB200" := P#DB200.DBX0.0 BYTE 100, // local area
            DONE  => #iGetDone,
            BUSY  => #iGetBusy,
            ERROR => #iGetError,
            STATUS=> #iGetStatus);

// S7-1500 writes 32 bytes of commands into S7-300 DB101
PUT_DB201  (REQ   := #tPutTrigger,
            ID    := W#16#0002,
            ADDR_1:= "DB101" := P#DB101.DBX0.0 BYTE 32,
            SD_1  := "DB201" := P#DB201.DBX0.0 BYTE 32,
            DONE  => #iPutDone,
            BUSY  => #iPutBusy,
            ERROR => #iPutError,
            STATUS=> #iPutStatus);

S7-300 side (STEP 7 V5.x, STL):

// FB15 GET, triggered by cyclic OB35 (100 ms typical)
CALL  FB 15, DB120
  REQ   :=M100.0
  ID    :=W#16#1                     // connection ID 1 (NetPro)
  ADDR_1:=P#M 200.0 BYTE 32         // source: S7-1500 area
  RD_1  :=P#DB101.DBX 0.0 BYTE 32   // local destination
  DONE  :=M100.1
  BUSY  :=M100.2
  ERROR :=M100.3
  STATUS:=MW102

// FB14 PUT, triggered by bit toggle when a command is queued
CALL  FB 14, DB121
  REQ   :=M110.0
  ID    :=W#16#1
  ADDR_1:=P#M 250.0 BYTE 64         // destination: S7-1500 area
  SD_1  :=P#DB100.DBX 0.0 BYTE 64   // local source
  DONE  :=M110.1
  BUSY  :=M110.2
  ERROR :=M110.3
  STATUS:=MW112

BSEND/BRCV: Tens of Kilobytes per Transfer

For payload between 1 KB and 64 KB per call, BSEND/BRCV is the natural choice. The blocks break the data into a sequence of frames and reassemble them at the partner, providing an application-level handshake that is not present in TSEND/TRCV.

Block differences between generations

Working example: S7-1500 BSEND 32 KB to S7-300 BRCV

S7-1500 side (SCL, TIA Portal V20):

// BSEND 32 768 bytes from DB300 to S7-300 DB300
BSEND_DB300 (REQ    := #tSendTrigger,
             ID     := W#16#0010,
             R_ID   := DW#16#C0FFEE01,
             SD_1   := "DB300" := P#DB300.DBX0.0 BYTE 32768,
             LEN    := 32768,
             DONE   => #iBsDone,
             BUSY   => #iBsBusy,
             ERROR  => #iBsError,
             STATUS => #iBsStatus);

S7-300 side (STEP 7 V5.x, STL):

// BRCV with the same R_ID
CALL  FB 13, DB150
  EN     :=TRUE
  ID     :=W#16#1
  R_ID   :=DW#16#C0FFEE01
  ADDR_1 :=P#DB300.DBX 0.0 BYTE 32768
  NDR    :=M200.0
  ERROR  :=M200.1
  STATUS :=MW202
  LEN    :=MW204

The R_ID value DW#16#C0FFEE01 ties the BSEND and BRCV pair on both CPUs. Each S7 connection can carry multiple R_ID streams in parallel, allowing segmented data (e.g., one R_ID per cell).

Open User Communication: TCON / TSEND / TRCV

OUC is the most flexible path because it does not require a configured connection in NetPro or TIA Portal. Both CPUs create a connection description (TCON_PARAM / TCON_IP_RFC) and establish the connection entirely from program code. This is the only path available when the partner IP is not known at engineering time, or when the project files cannot be merged.

Connection description layout

Both S7-300 (FB65 TCON) and S7-1500 (TCON instruction) use a data block of type TCON_IP_RFC (or TCON_IP_V4 on newer TIA Portal V17+ versions) of length 64 bytes. Fields must match on both sides:

Note that the S7-300 side uses the same 64-byte layout in DBxx; the field names and offsets are identical. Mismatched active/passive flags or mismatched TSAP are the dominant cause of failed TCON calls.

Working example: S7-1500 TCON/TSEND/TRCV ↔ S7-300 FB65/FB63/FB64

S7-1500 side (SCL, TIA Portal V20):

// Data block "TCON_Config_DB" of type TCON_IP_V4 (64 bytes)
// Pre-load via startup or HMI; fields shown at runtime in HEX view
TCON_S7300  (REQ    := #tConnectTrigger,
             ID     := W#16#0020,
             CONNECT:= "TCON_Config_DB",
             DONE   => #iConDone,
             BUSY   => #iConBusy,
             ERROR  => #iConError,
             STATUS => #iConStatus);

// TSEND after TCON is established
TSEND_500  (REQ    := #tSendTrigger,
            CONT   := 1,
            ID     := W#16#0020,
            LEN    := 16384,
            DATA   := "DB500.Diakoppler_Block_0",
            DONE   => #iSendDone,
            BUSY   => #iSendBusy,
            ERROR  => #iSendError,
            STATUS => #iSendStatus);

// TRCV 8 KB into DB600
TRCV_600   (EN_R   := TRUE,
            CONT   := 1,
            ID     := W#16#0020,
            LEN    := 8192,
            DATA   := "DB600.EmpfangsPuffer",
            NDR    => #iRcvNewData,
            BUSY   => #iRcvBusy,
            ERROR  => #iRcvError,
            STATUS => #iRcvStatus,
            RCVD_LEN=> #iRcvLen);

S7-300 side (STEP 7 V5.x, STL):

// FB65 TCON, passive. Connection description in DB200 (64 bytes)
CALL  FB 65, DB210
  REQ     :=M300.0
  ID      :=W#16#2
  CONNECT :=P#DB200.DBX 0.0 BYTE 64
  DONE    :=M300.1
  BUSY    :=M300.2
  ERROR   :=M300.3
  STATUS  :=MW302

// FB63 TSEND, triggered by trigger bit
CALL  FB 63, DB211
  REQ     :=M310.0
  ID      :=W#16#2
  LEN     :=16384
  DATA    :=P#DB500.DBX 0.0 BYTE 16384
  DONE    :=M310.1
  BUSY    :=M310.2
  ERROR   :=M310.3
  STATUS  :=MW312

// FB64 TRCV, always enabled after connection is up
CALL  FB 64, DB212
  EN_R    :=M320.0
  ID      :=W#16#2
  LEN     :=8192
  DATA    :=P#DB600.DBX 0.0 BYTE 8192
  NDR     :=M320.1
  ERROR   :=M320.2
  STATUS  :=MW322
  LEN     :=MW324

The S7-1500 is configured as active (it initiates the TCP handshake); the S7-300 is passive. Both use connection ID 0x0020 (S7-1500) and 0x2 (S7-300), which are local identifiers. The same connection description block layout is used on both sides — the legacy TCON_IP_RFC and the newer TCON_IP_V4 are byte-compatible for the standard fields.

PLCSIM Cross-Version Testing

Cross-version simulation is limited: the legacy S7-PLCSIM (V5.4 SP8 and earlier) cannot communicate with S7-PLCSIM in TIA Portal (V14+), and TIA Portal S7-PLCSIM instances only communicate with other TIA Portal S7-PLCSIM instances of compatible firmware ranges. Cross-generation testing of S7-300 ↔ S7-1500 therefore requires one of the following:

• Two physical CPUs, or a CPU 31x PN/DP and an ET 200S CPU paired with an S7-1500 (any S7-1500 CPU/PN with a physical PN port)
• An HMI device simulation in TIA Portal plus a PLCSIM instance for the S7-1500 and the S7-300, with PN-IO routing through the local interface of the engineering PC
• Loopback on a single engineering PC using the SIMATIC NET IE Softnet, two virtual MAC addresses, and the Softbus driver

Error Codes and Diagnostics

Two families of error codes apply: TCON/TCON family (any OUC) and PUT/GET/BSEND/BRCV family. The S7-1500 reports STATUS as DWORD; the S7-300 reports STATUS as WORD. The lower 16 bits of the S7-1500 status match the S7-300 status.

TCON family

PUT/GET family

BSEND/BRCV family

When the S7-1500 receives a STATUS of W#16#8301 on a PUT/GET, this is a "connection aborted by partner, partner at maximum number of connections" — typically resolved by enabling "Permit access with PUT/GET communication" on the S7-300 CPU properties page.

Troubleshooting Matrix

Verification and Commissioning

1. Network reachability: PING the S7-300 from the S7-1500 online diagnostics; PING the S7-1500 from STEP 7 V5.x on the same PC.
2. Connection state: Open "Online & Diagnostics" on the S7-1500 → "Connections" tab. Verify the connection reports "Established".
3. Functional test, PUT/GET: Force a value in DB101 on the S7-300; observe the mirror in DB201 on the S7-1500; verify DONE pulses and STATUS = 0000.
4. Functional test, BSEND/BRCV: Send a 32 KB block; check NDR on the S7-300 BRCV and LEN = 32768.
5. Functional test, OUC: Send a 16 KB block over TCON/TSEND; verify RCVD_LEN on the S7-1500 TRCV.
6. Stress test: Trigger 1000 cycles; check STATUS for any non-zero values; check CPU connection diagnostics for retransmits or aborted frames.
7. Restart behavior: Power-cycle the S7-300; verify the S7-1500 reports STATUS 80A1 transiently, then re-establishes automatically (active partner).
8. CPU mode change: Switch the S7-300 to STOP; verify the S7-1500 reports STATUS 80A1, then recovers on S7-300 RUN return.

For full engineering reference, the official Siemens application example S7 Communication between SIMATIC S7-1500 and SIMATIC S7-300 provides step-by-step TIA Portal V15.1 and STEP 7 V5.5 SP4 sample projects. The TIA Portal V20 instruction catalog reference Instructions for communication tasks (S7-300, S7-400, S7-1500) documents the S7-1500 instruction set and the differences from the legacy S7-300 function blocks.

FAQ