S7-300 to Third-Party EtherNet/IP Devices: TIA Portal TCP Setup

The S7-300 CPU family does not embed a native EtherNet/IP™ scanner (CIP™ over Ethernet) the way Logix Designer does for Allen-Bradley controllers or the way a Schneider Electric Modicon M580 EIO scanner does. The integrated PROFINET interface of an S7-300 CPU only speaks PROFINET, TCP, UDP, ISO-on-TCP (RFC 1006), and S7 communication. When an application requires data exchange with a third-party device that exposes EtherNet/IP as its only industrial Ethernet protocol, you cannot drop a GSDML into the TIA Portal device catalog and instantiate the device the way you would a Siemens or third-party PROFINET node.

The standard engineering response is therefore to fall back to TCP where the third-party device offers a TCP command interface in parallel to its CIP object model. For Applied Motion Products ST5/10/Si stepper drives such as the ST10-IP-EN, SCL/SCL command language is available over the TCP port configured by the drive (default 7776). This guide walks through configuring an S7-300 CPU with firmware V3.x and TIA Portal V11 SP5 (or V13/V14) as a TCP client to such a device using TCON, TSEND, TRCV and the TCON_Para UDT. The procedure is also the canonical answer when only an EDS file is supplied (no GSDML, no HSP), and the device does not need to appear as a configurable node in the network view.

1. Why S7-300 Cannot Directly Use EtherNet/IP

The PROFINET stack on the integrated interface of an S7-300 CPU (CPUs 315-2 PN/DP, 317-2 PN/DP, 319-3 PN/DP, and their F variants) is implemented by the firmware and is not extensible from user code. CIP encapsulation (the request/response header documented in CIP Networks Library Volume 2, Chapter 3) is not part of that stack. To run a CIP encapsulation session (command field 0x006F for SendRRData, 0x0070 for SendUnitData, register session 0x0065, etc.) you need either:

• A Siemens CP 343-1 with add-on firmware that supports EtherNet/IP (legacy CP 343-1 PN with the "EtherNet/IP" option; discontinued, replaced by CPs 343-1 LEAN / Advanced / PN with firmware-specific functions), or
• A third-party gateway module in the S7-300 rack that scans EtherNet/IP and exchanges data with the CPU via backplane I/O (e.g. HMS Anybus X-gateway AB7648-F, ProSoft PLX32-EIP-S7300), or
• A move to TCP if the drive exposes a TCP command channel in addition to CIP.

The question of "add a third-party device to the TIA Portal hardware catalog" therefore reduces to two completely different problems:

1. Adding the device as a PROFINET node (requires a GSDML from the vendor). If the vendor only ships an EDS file, that file is for EtherNet/IP only and cannot be imported by TIA Portal — the device cannot be placed as a PROFINET device.
2. Communicating with the device over raw TCP/UDP from an SCL program, where no hardware catalog entry is needed and the connection is built from a TCON_Para UDT only.

2. Prerequisites

3. Hardware and Network Configuration in TIA Portal

1. Insert the S7-300 station. In the project tree, add a new SIMATIC S7-300 station and drag the CPU (for example 6ES7317-2EK14-0AB0 with firmware V3.3) into slot 2.
2. Configure the PROFINET interface. Open "Properties > PROFINET interface [X2]" and assign:
   • IP address: 192.168.1.10
   • Subnet mask: 255.255.255.0
   • Router: 0.0.0.0 (no router required on a flat subnet)
   • PROFINET device name: plc-300-1
3. Do not drag a third-party device into the network view. The device has no GSDML and no HSP. Trying to insert it via "Other field devices > PROFINET IO" will fail with "No GSDML installed" or, with an EDS import attempt, "EDS files are not supported by this catalog". This is expected.
4. Verify the drive is reachable. Open a command prompt on the engineering station and ping 192.168.1.20 (the ST10-IP-EN default IP). If ping fails, the TCP attempt below will also fail; do not continue until ICMP is successful.

4. Building the TCON_Para Instance

The TCON_Para UDT is declared in the "Communication Blocks" standard library of STEP 7 V5.x and is regenerated automatically by TIA Portal when you insert a TCON block. In TIA Portal V11 SP5 the wizard creates the UDT inside an instance DB the first time you place the TCON instruction. For multi-instance style programming, declare the UDT manually in your DB to gain full visibility of every field.

5. Step-by-Step TIA Portal Configuration

5.1 Declare the configuration DB

1. In the project tree right-click "Program blocks > Add new block > Data block".
2. Choose DB name cfg_TCP_ST10, type "Global DB", and confirm.
3. Open the DB and paste the structure shown below (SCL view).

TYPE UDT_TCON_Para_ST10
STRUCT
    BlockID          : WORD  := W#16#0001;
    ID               : WORD  := W#16#0001;
    ConnectionType   : BYTE  := B#16#11;       // TCP
    ActiveEstablished: BOOL  := TRUE;          // PLC = client
    LocalDeviceId    : BYTE  := B#16#02;       // PROFINET interface
    LocalTSelector   : ARRAY[0..9] OF BYTE := [0,0,0,0,0,0,0,0,0,0];
    RemSubnetId      : BYTE  := B#16#00;
    RemStaddr        : ARRAY[0..5] OF BYTE := [B#16#C0,B#16#A8,B#16#01,B#16#14,B#16#00,B#16#00];
    RemTSelector     : ARRAY[0..9] OF BYTE := [2,B#16#1E,B#16#66,0,0,0,0,0,0,0];
    ConnectionName   : STRING[32] := 'ST10IPEN_TCP';
END_STRUCT
END_TYPE

DATA_BLOCK cfg_TCP_ST10
{ S7_Optimized_Access := 'FALSE' }
STRUCT
    settings : UDT_TCON_Para_ST10;
    tx_buf   : ARRAY[0..63] OF BYTE;        // raw outgoing command buffer
    rx_buf   : ARRAY[0..63] OF BYTE;        // raw incoming response buffer
    tx_len   : INT;                          // number of valid bytes in tx_buf
    rx_len   : INT;                          // number of bytes received
    step     : INT;                          // handshake state machine
    err      : WORD;                         // last TCON/TSEND/TRCV status
END_STRUCT
END_DATA_BLOCK

5.2 Instantiate the FBs

Drag the following blocks from the task card "Instructions > Communication > Open User Communication":

• FB65 "TCON" with instance DB DB_TCON_ST10
• FB63 "TSEND" with instance DB DB_TSEND_ST10
• FB64 "TRCV" with instance DB DB_TRCV_ST10
• FB66 "TDISCON" with instance DB DB_TDISCON_ST10

Use single instance, not multi-instance, for visibility in the online watch table. The instance DBs are auto-generated when the block is compiled.

5.3 Wire TCON in OB1 (or OB35 for cyclic)

// Trigger edge: start handshake once on operator request
IF "op_StartTCP" AND NOT "hold_StartTCP" THEN
    "cfg_TCP_ST10".step := 10;
END_IF;
"hold_StartTCP" := "op_StartTCP";

CASE "cfg_TCP_ST10".step OF
10: // Establish connection
    "TCON_DB".REQ := TRUE;
    "TCON_DB".ID  := W#16#0001;
    // TCON_Para is the in-out parameter of TCON; pass by reference
    "TCON_DB".DONE   := FALSE;
    "TCON_DB".ERROR  := FALSE;
    "TCON_DB".STATUS := 0;
    IF "TCON_DB".DONE THEN
        "cfg_TCP_ST10".step := 20;
        "cfg_TCP_ST10".err  := 0;
    ELSIF "TCON_DB".ERROR THEN
        "cfg_TCP_ST10".step := 90;
        "cfg_TCP_ST10".err  := "TCON_DB".STATUS;
    END_IF;

20: // Build and send a SCL command, e.g. read encoder position
    IF "tick_100ms" THEN
        // SCL command frame for Applied Motion ST10-IP-EN: "PR P" + CR (0x0D)
        "cfg_TCP_ST10".tx_buf[0] := 'P';
        "cfg_TCP_ST10".tx_buf[1] := 'R';
        "cfg_TCP_ST10".tx_buf[2] := ' ';
        "cfg_TCP_ST10".tx_buf[3] := 'P';
        "cfg_TCP_ST10".tx_buf[4] := 16#0D;
        "cfg_TCP_ST10".tx_len   := 5;

        "TSEND_DB".REQ := TRUE;
        "TSEND_DB".ID  := W#16#0001;
        "TSEND_DB".LEN := "cfg_TCP_ST10".tx_len;
        // DATA points to tx_buf[0] - ADR on the byte array
        IF "TSEND_DB".DONE THEN
            "cfg_TCP_ST10".step := 30;
        ELSIF "TSEND_DB".ERROR THEN
            "cfg_TCP_ST10".step := 90;
            "cfg_TCP_ST10".err  := "TSEND_DB".STATUS;
        END_IF;
    END_IF;

30: // Receive response
    "TRCV_DB".EN_R := TRUE;
    "TRCV_DB".ID   := W#16#0001;
    "TRCV_DB".LEN  := 64;
    IF "TRCV_DB".NDR THEN
        "cfg_TCP_ST10".rx_len := "TRCV_DB".RCVD_LEN;
        "cfg_TCP_ST10".step   := 40;
    ELSIF "TRCV_DB".ERROR THEN
        "cfg_TCP_ST10".step := 90;
        "cfg_TCP_ST10".err  := "TRCV_DB".STATUS;
    END_IF;

40: // Parse response (drive replies with ASCII, e.g. "12345\r")
    IF "cfg_TCP_ST10".rx_len > 0 AND "cfg_TCP_ST10".rx_buf[0] <> 0 THEN
        "op_PositionRaw" := "cfg_TCP_ST10".rx_buf[0];
        // additional parsing as required by drive manual
        "cfg_TCP_ST10".step := 20;
    END_IF;

90: // Error handler
    "TDISCON_DB".REQ := TRUE;
    "TDISCON_DB".ID  := W#16#0001;
    IF "TDISCON_DB".DONE OR "TDISCON_DB".ERROR THEN
        "TDISCON_DB".REQ := FALSE;
        "cfg_TCP_ST10".step := 10; // reconnect
    END_IF;

ELSE
    "cfg_TCP_ST10".step := 0;
END_CASE;

6. TCON_Para Field Reference (V11 SP5)

Every byte is significant. A typical failure mode is the connection being refused because the RemStaddr field was entered as four separate BYTE values by the wizard in the wrong order. The PROFINET stack expects the IP as four octets in network byte order (big-endian) in the first four bytes of RemStaddr, followed by two padding bytes of zero. Below is the full field map from the TIA Portal help (WinCC / STEP 7 Help > Communication > Open User Communication > TCON_Param).

7. SCL Frame Builder for SCL Command Language

Most modern Applied Motion steppers (ST5, ST10, Si, SV200) accept SCL commands terminated with CR (0x0D) and reply with ASCII text terminated with CR. The CPU is therefore acting as a request/response client over TCP. The frame builder below constructs a typed command from a tag-style address (e.g. SA for acceleration, SD for distance, PR for print register).

FUNCTION_BLOCK fb_SCL_Request
VAR_INPUT
    i_cmd     : STRING[8];   // e.g. 'PR', 'SA', 'SD'
    i_arg     : STRING[16];  // optional numeric/ASCII argument
END_VAR
VAR_OUTPUT
    o_status  : WORD;
END_VAR
VAR
    tx : ARRAY[0..31] OF BYTE;
    len : INT;
END_VAR
BEGIN
    // Reset buffer
    FOR len := 0 TO 31 DO tx[len] := 0; END_FOR;
    len := 0;

    // Copy command bytes
    FOR len := 0 TO 7 DO
        IF i_cmd[len] <> 0 THEN
            tx[len] := i_cmd[len];
        ELSE
            EXIT;
        END_IF;
    END_FOR;

    // Append space if argument present
    IF i_arg[0] <> 0 THEN
        tx[len] := 32; // ' '
        len := len + 1;
        FOR len := len TO len + 15 DO
            IF i_arg[len - 4] <> 0 THEN
                tx[len] := i_arg[len - 4];
            ELSE
                EXIT;
            END_IF;
        END_FOR;
    END_IF;

    // Append CR terminator
    tx[len] := 16#0D;
    len := len + 1;

    "cfg_TCP_ST10".tx_buf := tx;
    "cfg_TCP_ST10".tx_len := len;
    o_status := 0;
END_FUNCTION_BLOCK

8. Wireshark Diagnostics Procedure

Wireshark on a mirrored switch port is the fastest way to confirm what is and is not on the wire.

1. Configure port mirroring on the managed switch such that the port facing the drive is mirrored to the engineering laptop port.
2. Start Wireshark with capture filter host 192.168.1.20 and tcp port 7776 so only drive traffic is captured.
3. Display filter tcp.flags.syn == 1 shows the TCP handshake initiated by the PLC. The first packet must show SYN only (no ACK), source IP 192.168.1.10, destination IP 192.168.1.20, destination port 7776.
4. Display filter tcp.payload shows the ASCII payload of the SCL command. You should see the bytes 0x50 0x52 0x20 0x50 0x0D for PR P.
5. If you see SYN retransmissions with no SYN/ACK response, the drive is not listening on the configured port. Verify with the drive configuration utility (Applied Motion "StepperWire") that TCP server mode is enabled.
6. If you see TCP RST from the drive, the IP or port in TCON_Para does not match. Recheck RemStaddr byte order and RemTSelector port encoding.
7. If you see the TCP data but the drive replies with non-printable bytes, the wrong terminator was sent. SCL always expects 0x0D (CR); 0x0A (LF) alone will not be recognized.

9. Common TCON/TSEND/TRCV Status Codes

10. Verification Checklist

Run each step in order before declaring the link live.

1. Compile and download the program. TIA Portal > right-click S7-300 station > Compile > Download to device.
2. Online > Watch table: monitor cfg_TCP_ST10.step. It should leave 0 within one scan cycle after a positive edge on op_StartTCP.
3. Step should reach 20 within ~3 seconds (typical TCON timeout is 2–5 s). If step jumps straight to 90, capture cfg_TCP_ST10.err and look up the code in section 9.
4. Watch cfg_TCP_ST10.rx_buf. For a ST10-IP-EN running PR P, expect ASCII text such as "+00000 " or a position value.
5. Wireshark capture confirms three-way handshake followed by client data, server response, FIN-ACK termination on operator stop.
6. Apply Motion StepperWire (or vendor utility): open the drive's web configuration, confirm TCP server port 7776 is enabled and a security/authentication string is not required.
7. Force CPU to STOP and back to RUN: connection must re-establish without power cycling the drive. If not, check that OB100 / OB101 / OB102 are not leaving TCON in a stale state.
8. Cold restart test: power-cycle CPU, drive, and switch in that order, verify step state machine reaches 20 within 10 seconds of RUN.

11. Troubleshooting Matrix

12. When to Use a Gateway Instead

If the application cannot tolerate the polling latency of TCP SCL (typically 10–50 ms per request/response cycle), or if the third-party device truly only supports EtherNet/IP CIP objects with no TCP fallback, the cleanest path is a gateway module in the S7-300 backplane. The two most common options are:

• HMS Anybus X-gateway AB7648-F: scans EtherNet/IP as a class 1 client on one side, maps the I/O into a Siemens backplane format that the CPU reads with standard PEW/PAW access. The EtherNet/IP assembly instance and connection size are configured in HMS IPCress; no EDS import is needed by TIA Portal.
• ProSoft PLX32-EIP-S7300: native S7-300 backplane module, EtherNet/IP scanner on the field side, exposes up to 248 bytes of input and 248 bytes of output to the CPU. EDS file for the scanner is included; the field device's EDS is consumed by the scanner module directly, again no TIA Portal GSDML needed.

For new designs where a CIP scanner is required, migrate the application to an S7-1500 with the Open User Communication libraries and a hand-written CIP encapsulation parser in SCL; or to an Allen-Bradley CompactLogix 5380 / ControlLogix 5580 with the built-in EtherNet/IP scanner, which natively consumes EDS files from RSLinx EDS Hardware Installation Tool.

13. Notes on EDS vs GSDML

An EDS (Electronic Data Sheet) is the standard device descriptor format maintained by ODVA for CIP-based networks (EtherNet/IP, DeviceNet, ControlNet). A GSDML (General Station Description Markup Language) is the equivalent descriptor for PROFINET devices, governed by PROFIBUS International. TIA Portal imports GSDML only; it cannot import EDS. This is by design: the underlying protocols differ at the application layer (CIP vs PROFINET IO), and the project file format is incompatible. When a vendor such as Applied Motion Products supplies only an EDS for their EtherNet/IP stepper, the file is useful for Rockwell or Schneider controllers but provides no benefit inside TIA Portal beyond documentation. The workarounds in this guide (TCP via TCON, or a third-party gateway) are the only practical integration paths.

14. Frequently Asked Questions