S7-300 CPU 317-2 PN/DP Ethernet Communication: Setup Guide

Overview

The SIMATIC S7-300 CPU 317-2 PN/DP integrates a 2-port PROFINET switch, PROFINET IO controller, and a PROFIBUS-DP master into a single backplane module. Process data exchange between this CPU and a laptop or PC therefore requires only a standard Cat 5e or better patch cable and a TCP/IP stack on the PC side. The Ethernet services exposed by the CPU fall into four families: passive server services (Fetch/Write), S7 communication blocks (PUT/GET, BSEND/BRCV, USEND/URCV), Open IE communication over ISO-on-TCP/TCP/UDP (TCON/TSEND/TRCV), and the PG/OP routing channel used by STEP 7. On the laptop, those services can be consumed through SIMATIC NET (OPC DA/UA), a proprietary Siemens toolset (Prodave), an open-source library (Libnodave/Snap7), or a custom C#/VB/.NET application. Choosing between them is largely a trade-off between engineering effort, license cost, long-term maintainability, and whether the application runs once or as a permanent HMI/SCADA bridge.

For the most current CPU variant (MLFB 6ES7317-2EK14-0AB0, firmware V3.3.x), Siemens ships the same functional surface as the earlier 6ES7317-2EK13-0AB0, 6ES7317-2AK14-0AB0, and 6ES7317-2AJ10-0AB0. Only the security defaults changed in firmware V3.3, where PUT/GET must now be explicitly enabled in the CPU properties.

Hardware Prerequisites

Network Topology and Cabling

For a single PC talking to one CPU, the SCALANCE switch is not required. The PC connects directly to one of the two PROFINET ports (P1 or P2) on the CPU front. Modern laptop NICs (built-in or USB-Ethernet adapters from Intel, Realtek 8153, ASIX AX88179) implement Auto-MDI/MDIX, so a regular straight-through patch cable works in every direction. If Auto-MDI/MDIX is disabled in the laptop NIC driver, use an Ethernet crossover cable (T568A on one end, T568B on the other) for the direct connection.

Add a managed switch when:

• Multiple PCs/PGs need concurrent access to the same CPU.
• The PROFINET network will later host distributed I/O (ET 200S, ET 200MP) on the same switch.
• You need PROFINET diagnostics, port statistics, or LLDP topology.

Recommended IP plan for an isolated engineering link:

Configure the CPU IP in STEP 7 via HW Config > CPU 317-2 PN/DP > Properties > Ethernet Interface > IP Address, or directly from the PG through PLC > Ethernet Node > Edit Ethernet Node after selecting the accessible node.

Communication Methods Compared

Method 1: Fetch/Write Service

Fetch/Write is the oldest of the S7 passive services and the one that the original Siemens "Fetch/Write" application example targets. The CPU acts as a server; the PC (or OPC server) is the client. No FBs are downloaded into the PLC user program; the service is enabled in the CPU configuration.

Step-by-step: Enable Fetch/Write on CPU 317-2 PN/DP

1. Open the S7 project in STEP 7 (V5.5) or TIA Portal.
2. In the device configuration, open Properties > CPU 317-2 PN/DP > Communication.
3. Select the check box "Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC, ...)".
4. For the Fetch/Write service specifically, also enable "Allow Fetch/Write" in the connection configuration.
5. Save and download the hardware configuration to the CPU.

Step-by-step: PC Side with SIMATIC NET OPC Scout

1. Install SIMATIC NET 2008 or later (matches the STEP 7 version). The OPC server component is included with the PC software install.
2. Open Station Configuration Editor and add a PC station with one OPC server and one IE General (ISO-on-TCP) interface.
3. Configure the IE interface to the same IP subnet as the CPU (192.168.0.10 in the example).
4. Open OPC Scout V10 and add a new S7 connection: partner IP 192.168.0.1, connection type ISO-on-TCP, slot/rack 0/2 (CPU 317-2 PN/DP), Fetch/Write attributes enabled.
5. Create items pointing to the data blocks you want to read/write, e.g. DB1.DBD0, DB1.DBD4, MB10, QB0.
6. Write a value to the CPU by toggling the item to "active" with a typed value, then read it back to confirm.

Data Addressing in OPC Scout

Method 2: S7 Communication with PUT/GET (FB14/FB15)

PUT/GET is the simplest bidirectional S7 communication pair. The S7-300 side calls FB14 to read a data block from a remote partner and FB15 to write to one. The laptop side typically initiates via SIMATIC NET or a library like Snap7; for a one-CPU-only network, the laptop becomes the partner and the CPU is the server.

FB15 PUT Call Interface

CALL "PUT" , %DB20
  REQ    := TRUE                  // rising edge triggers the job
  ID     := 1                     // connection ID from NetPro / connection table
  DONE   := M30.0                 // TRUE on success, single cycle
  ERROR  := M30.1                 // TRUE on error
  STATUS := MW32                  // 16-bit status word
  ADDR_1 := P#DB1.DBX0.0 BYTE 10  // remote area 1: pointer to send buffer
  ADDR_2 := P#DB1.DBX20.0 BYTE 10 // remote area 2 (optional)
  ADDR_3 := P#DB1.DBX40.0 BYTE 10 // remote area 3 (optional)
  ADDR_4 := P#DB1.DBX60.0 BYTE 10 // remote area 4 (optional)
  SD_1   := P#DB100.DBX0.0 BYTE 10 // local source area 1
  SD_2   := P#DB100.DBX10.0 BYTE 10
  SD_3   := P#DB100.DBX20.0 BYTE 10
  SD_4   := P#DB100.DBX30.0 BYTE 10

Up to four data areas can be packaged in a single PUT, with a combined maximum of 160 bytes for S7-300 PUT. FB14 GET has identical parameters but with RD_1..RD_4 as the receive areas on the local side.

Status Word Interpretation

Method 3: S7 Communication with BSEND/BRCV (FB12/FB13)

Use BSEND/BRCV when the data payload is variable and may exceed the 160-byte PUT/GET limit, up to 32 KB (S7-300) or 64 KB (S7-400). The handshake is two-phase: BSEND hands a pointer to a data buffer to the operating system, the OS fragments and transmits the data with acknowledgements, then sets DONE.

CALL "BSEND" , %DB21
  REQ    := M50.0
  R      := FALSE
  ID     := 2
  DONE   := M50.1
  ERROR  := M50.2
  STATUS := MW52
  SD_1   := P#DB200.DBX0.0 BYTE 5000  // up to 32 KB per call
  LEN    := #SendLen                  // actual length this call

The remote side uses FB13 BRCV to accept the incoming buffer. Pair BSEND/BRCV with the Snap7 BSEND/BRCV on the PC for the cleanest bidirectional tunnel.

Method 4: Open IE Communication with TCP/ISO-on-TCP

Open IE is the lowest-level family. The CPU program owns the full TCP state machine, while the PC uses ordinary Berkeley sockets or a wrapper library. This is the only path that lets you bypass SIMATIC NET entirely.

Connection DB UDT65 Layout

Fill a connection DB (instance of UDT 65 "TCON_PAR") with the parameters for ISO-on-TCP (connection type 12) or TCP (connection type 11):

TSEND Call

CALL "TSEND" , %DB30
  REQ    := M60.0
  ID     := 3
  LEN    := 32
  DATA   := P#DB300.DBX0.0 BYTE 32
  DONE   := M60.1
  ERROR  := M60.2
  STATUS := MW62

C# .NET TCP Client Skeleton

using System.Net.Sockets;
TcpClient cli = new TcpClient("192.168.0.1", 2000);
NetworkStream ns = cli.GetStream();
byte[] payload = BitConverter.GetBytes(1234.567f); // example REAL
ns.Write(payload, 0, payload.Length);
byte[] rx = new byte[32];
int n = ns.Read(rx, 0, rx.Length);

For ISO-on-TCP from .NET, use the Snap7.NET package or implement RFC 1006 framing manually (length prefix is one 16-bit big-endian integer; data follows immediately).

Method 5: Libnodave and Snap7 (Open Source PC Clients)

Libnodave (pre-2015) and Snap7 are BSD-style libraries that speak the S7 protocol directly over ISO-on-TCP/TCP without requiring SIMATIC NET. Snap7 is the modern, actively maintained successor and exposes C, C++, .NET, Java, Python, Node.js, and LabVIEW bindings.

Snap7 C# Client (Process Data Read/Write)

using Snap7;
// ...
S7Client plc = new S7Client();
plc.ConnectTo("192.168.0.1", 0, 1, 0); // IP, rack, slot, rack again for slot 0
byte[] buf = new byte[32];
int res = plc.DBRead(1, 0, buf.Length, buf);  // read DB1 from offset 0
float value = BitConverter.ToSingle(buf, 0);
BitConverter.GetBytes((float)42.0f).CopyTo(buf, 4);
plc.DBWrite(1, 0, buf.Length, buf);
plc.Disconnect();

Throughput

Snap7 over ISO-on-TCP achieves roughly 800-1500 requests per second for short reads on a 100 Mbit link, which is more than sufficient for SCADA polling and well above OPC DA's typical 100-200 tag updates per second.

Method 6: Prodave

Prodave (current release Prodave S7 Windows V7.2) is a Siemens-licensed C DLL that exposes S7 functions similar to the FBs but on the PC side. It is appropriate when you have an existing Prodave installation and want to add a TCP path without rewriting the application. New projects should prefer Snap7 because Prodave requires a paid runtime license tied to a USB dongle or activation key.

Method 7: WinCC Flexible with OPC Client Add-in

WinCC flexible 2008 SP5 / TIA Portal WinCC Comfort/Advanced includes an OPC DA server that can be enabled on the runtime PC. Excel can then read tags as an OPC client via the Siemens OPC DA Automation Wrapper or the free OPC Scout V10. This is the lowest-effort path when the goal is data into a spreadsheet for trending.

Excel OPC Automation Example (VBA)

Dim opc As New OPCAutomation.OPCServer
Dim grp As OPCAutomation.OPCGroup
Dim items() As OPCAutomation.OPCItem
opc.Connect("OPC.SimaticNET.1")
Set grp = opc.OPCGroups.Add("S7Group")
grp.OPCItems.AddItem "S7:[CPU317]DB1,REAL0", 1
items(1).Read 1, value, quality, timestamp
Range("A1").Value = value

Connection Limits on CPU 317-2 PN/DP

If "no more connections available" is reported, raise the OP/HMI reservation count in CPU Properties > Communication > Connection Resources and recompile the hardware configuration.

Verification and Diagnostics

1. From the laptop, ping the CPU: ping 192.168.0.1. TTL should be 64 and round-trip <1 ms on a direct cable.
2. In STEP 7 / TIA Portal, choose Online > Accessible Nodes. The CPU should appear with its IP and PROFINET device name.
3. Read the CPU diagnostic buffer via Online > CPU Diagnostics and confirm "Communication established with [PC IP]".
4. For S7 communication, monitor FB14/FB15 STATUS after a job. 0x0000 confirms data round-trip.
5. For OPC, monitor the OPC Scout watch window. Quality code should be Good (0xC0, 192).
6. For Snap7, log the return value of ConnectTo. 0 = success; -1 = TCP error; -2 = ISO-on-TCP PDU mismatch.

Troubleshooting Matrix

Best Practice Recommendations

• For long-term PC applications, prefer Snap7 (open source, royalty free) over Libnodave, which has not been actively maintained since 2015.
• For one-off data inspection and quick commissioning, use SIMATIC NET OPC Scout - it is already installed with STEP 7 and does not require code.
• Always enable PUT/GET in the CPU security properties unless your environment strictly forbids remote writes.
• Reserve at least two OP connections and two free S7 connections in NetPro / TIA connection table when commissioning new programs.
• Wrap any user program in OB100 startup with a "set first connection to active" once at startup, then leave the OS to maintain it. Do not call TCON repeatedly.
• Use BSEND/BRCV (FB12/FB13) for any payload above 100 bytes; PUT/GET silently truncates or returns 0x80B0 above the 160-byte limit.
• Do not enable PG/OP routing through the CPU for production panels - it is a debugging convenience that bypasses firewall isolation.

FAQ