S7-200 SMART TCP_Recv Returns Only One Character Per Send

Problem: TCP_Recv Returns One Character When Sending Multi-Byte Strings

On a Siemens SIMATIC S7-200 SMART CPU (CPU SR20, SR30, SR40, SR60, ST20, ST30, ST40, ST60, CR40, or CR60), the Open User Communication (OUC) library blocks TCP_Connect, TCP_Send, and TCP_Recv are configured to communicate with a Windows terminal emulator. The TCP connection establishes successfully, the handshake completes (Status = 0x0002), and the Done bit pulses on the receive block. The defect appears as follows:

The data path is correct; the loss is in application-side buffer management. The PLC receives one TCP segment per keystroke, and the user program is not buffering segments or detecting the end of a logical message.

Affected Hardware, Firmware, and Software

Root Cause Analysis

Four distinct causes can produce the "single-character" symptom. Diagnose which one applies before applying a fix.

Cause 1 – TCP Segmentation Is Independent of Application Framing

TCP is a byte-stream protocol; it does not preserve message boundaries. When HyperTerminal transmits 17 with a line ending, the kernel may emit one segment 0x31 0x37 or two segments 0x31 and 0x37, depending on Nagle algorithm, terminal echo, and time between keystrokes. TCP_Recv returns whatever bytes are currently queued; it does not wait for a logical message end.

Cause 2 – Done Bit Is Not Polled Continuously

The OUC blocks use a standard EN/ENO pattern. The Done bit (Status = 0x7002) is set for one scan only when the internal job is complete. If user logic only latches the buffer on the first rising edge, subsequent segments overwrite the buffer before being read.

Cause 3 – ASCII Mode Mismatch Between HyperTerminal and PLC

HyperTerminal can be configured to send characters in different ways: raw per keystroke, on CR (carriage return 0x0D), on LF (0x0A), or on CR+LF (0x0D 0x0A). If the PC sends 17 followed by a line terminator, the PLC receives 0x31 0x37 0x0D 0x0A. If user code reads the buffer immediately and only writes the first byte to the destination, the rest is dropped on the next scan cycle.

Cause 4 – HyperTerminal Encoding Anomaly

HyperTerminal's character map is tied to the Windows "Country" codepage. On systems set to non-Latin codepages (e.g., Eastern European), characters in the 0x80-0xFF range can be silently translated. Use Hercules SETUP, Tera Term, or PuTTY with UTF-8 or ANSI Latin-1 codepage to eliminate the variable.

S7-200 SMART Open User Communication Block Reference

Three blocks are used in this scenario. Refer to the S7-200 SMART System Manual, section on Open User Communication for the complete parameter list and timing diagrams.

TCP_Connect (UTCP_Connect) Parameters

TCP_Send (UTCP_Send) Parameters

TCP_Recv (UTCP_Recv) Parameters

TCP_Recv and TCP_Connect Status Codes

Step-by-Step Fix: Buffer Multi-Byte Messages Until Terminator

The robust pattern: always arm TCP_Recv with EN=1, and on every Done pulse append the buffer contents to a FIFO while scanning for a CR/LF or fixed-length terminator. The sequence below assumes CPU SR30, STEP 7 Micro/WIN SMART V2.5+, and a server port of 5001.

Prerequisites

1. CPU S7-200 SMART with firmware ≥ V2.0 (check in System Information → CPU Information).
2. STEP 7 Micro/WIN SMART V2.5 or later installed.
3. Open User Communication library installed (default location: C:\Program Files (x86)\Siemens\Automation\MicroWIN SMART\Lib\Open_User_Communication).
4. PC and PLC on the same subnet. CPU has a static IP (e.g., 192.168.1.50); the PC has a compatible static IP (e.g., 192.168.1.10).
5. Hercules SETUP utility for reliable terminal emulation. HyperTerminal is deprecated on Windows 10/11 and has known codepage issues.

Procedure

1. Reserve V memory. Allocate a 200-byte receive scratch buffer VB200..VB399 and a 200-byte assembly buffer VB400..VB599. Also allocate a counter VW600 for "bytes in assembly buffer" and a "terminator received" flag VB610.0.
2. Configure TCP_Connect (one-shot). Set ConnID = 1, IPaddr1..4 = 192, 168, 1, 10, RemPort = 5001, LocPort = 0. Drive EN with a one-shot from the first scan, gated by a connection-failed retry timer.
3. Configure TCP_Recv (continuously armed). Set ConnID = 1, DataPtr = &VB200, DataLen = 200. Wire EN to SM0.0 (always TRUE) AND a "not in error state" boolean. The block re-arms automatically after each Done pulse.
4. Implement FIFO copy on Done. In a sub-routine triggered by the rising edge of TCP_Recv.Done:
   • Copy VB200..VB(200+DataLen-1) byte-by-byte to VB400+VW600.
   • Increment VW600 by the number of bytes copied (use a fixed assumption of 200 if actual length is unknown, and rely on the terminator to mark end).
   • Scan the freshly-copied range for 0x0D (CR) or 0x0A (LF). When found, set VB610.0 = 1.
5. Process complete message. In a network that tests VB610.0, copy the assembly buffer to the application variable area, reset VW600 = 0, clear VB400..VB599, and reset VB610.0 = 0.
6. Send response (optional). Drive TCP_Send with a rising edge after processing. Set DataPtr = &VB700, DataLen = actual response length.

Sample Ladder Excerpt (Conceptual)

Network 1 - TCP_Connect (one-shot on first scan)
   SM0.1        TCP_Connect_EN   (EN)
                ConnID=1
                IP: 192.168.1.10:5001
                LocPort=0
                -> TCP_Connect.Done  -> Set M0.0 (Connected)
                -> TCP_Connect.Error -> Set M0.1 (ConnectError)

Network 2 - TCP_Recv continuously armed
   SM0.0        TCP_Recv_EN       (EN)
   NOT M0.1     (gate on no error)
                ConnID=1
                DataPtr = &VB200
                DataLen = 200
                -> TCP_Recv.Done  -> SBR_0  (Process_Recv)

Network 3 - SBR_0: copy and scan for terminator
   FOR VW700 = 0 TO 199
     VB[400 + VW600 + VW700] = VB[200 + VW700]
   NEXT
   VW600 = VW600 + 200
   FOR VW700 = 0 TO 199
     IF VB[400 + VW700] == 0x0D THEN
       SET VB610.0
       EXIT FOR
     END_IF
   NEXT

ASCII Framing Alternatives

Replace HyperTerminal With Hercules SETUP

HyperTerminal Private Edition (last release 2008) is not shipped with Windows 10/11. It exhibits three problems on modern systems:

1. Codepage substitution: characters above 0x7F are remapped based on Windows regional settings.
2. No raw byte view: it forces an ANSI/UTF display, hiding protocol bytes.
3. No persistent log: it is not possible to capture a session for post-mortem.

Hercules SETUP is a freeware utility by HW-Group. To configure a TCP server on port 5001:

1. Launch Hercules, click the TCP Server tab.
2. Set Port = 5001.
3. Click Listen. The status panel reads Listening on 0.0.0.0 : 5001.
4. Type 17<Enter> in the Send box and click Send. Switch to hex view to confirm the bytes 31 37 0D 0A.

Alternatives: Tera Term (free, supports VT100 and hex view) or PuTTY with Connection type: Raw.

Verification Procedure

1. Watch TCP_Recv.Done in a status table. It must pulse on every segment arrival, not just on the first.
2. Monitor VB200..VB220 in a status table. After sending 17 from the PC, the buffer must read 31 37 0D 0A (assuming CR+LF).
3. Confirm VW600 grows with each segment. After three Done pulses from a single line, the count must equal the number of bytes sent (typically 4 for 17\r\n).
4. Trigger on VB610.0. Set a watch on this flag – it must transition to 1 the instant a CR/LF is seen in the assembly buffer.
5. Wireshark cross-check. Capture the PC Ethernet port with Wireshark filter tcp.port == 5001. Confirm segment boundaries match what the PLC receives.
6. Load test. Send 100 commands of 20 characters each from a script (Python socket, nc on Linux, or Hercules "send file"). All 100 must reach the application variable area intact.

Troubleshooting Matrix

Performance and Limit Reference

Safety and Liveness Checks

1. Watchdog on TCP_Connect failure. If Error remains TRUE for > 5 s, drop and re-arm with a 1 s delay to avoid thrashing the OUC state machine.
2. Limit assembly buffer growth. If VW600 > 190 without a terminator detected, discard the buffer and reset the counter. This prevents an attacker (or noisy line) from filling V memory.
3. Validate payload. If a command frame has unknown length or unknown opcode, drop it and reply with NAK. Do not act on incomplete frames.