Siemens CP 443-1 RFID Communication: NetPro TCP Setup Guide

Siemens CP 443-1 RFID Communication: NetPro TCP Setup Guide

Establishing reliable TCP/IP communication between a SIMATIC S7-400 CP 443-1 Industrial Ethernet module and a third-party RFID scanner requires a clear understanding of the two open-communication paths available in the S7-400 firmware: the classical configured connection in NetPro with the AG_SEND/AG_RCV function blocks, and the Open Communication Wizard in SIMATIC Manager that generates the UDTs for TCON/TSEND/TRCV. This reference walks through hardware selection, port assignment, connection configuration, data-exchange programming, Telnet-based verification, and the receive-side implementation needed to fetch tag data from the scanner.

1. System Overview and Architecture Constraints

The CP 443-1 is the Industrial Ethernet CP for the S7-400 family. Two physical RJ-45 ports are exposed by every EX30/EX40/EX41/EX50 variant, but those two ports are bonded to a single internal switch on the CP. From a TCP/IP and NetPro perspective this is one logical interface, not two. That means both the SCADA traffic and the RFID traffic share the same IP address and the same connection-resource pool. The only way to isolate services at L4 is by assigning them distinct port numbers on the same IP, or by using the CP 443-1 only for the IP subnet and placing a downstream managed switch with VLANs if true segmentation is required.

The supported socket interface of the CP is documented in the SIMATIC NET S7-CPs for Industrial Ethernet CP 443-1 manual and includes raw TCP, UDP, and ISO-on-TCP (RFC 1006) for both SEND/RECEIVE and TCON-style open communication. Refer also to the Siemens TIA portal reference on Ethernet protocols and port numbers for the reserved port ranges and the default port assignments for S7, HTTP, and SNMP services on the CP.

2. Prerequisites

1. STEP 7 V5.5 + SPx or TIA Portal V15.1 or later with the S7-400CP HSP installed so the EX30/EX40 CP type appears in the hardware catalog.
2. Configured S7-400 station with a CPU 41x and the CP 443-1 inserted in the same rack (slot 4–11 of the central rack for the older variants, free slot in UR for newer ones).
3. IP address of the CP and a free IP for the RFID scanner inside the same subnet. The CP is set in the hardware object properties > "Ethernet Interface" > "IP Protocol".
4. RFID scanner documentation stating its TCP role (server / client), the port number it listens on or connects from, the command frame format (ASCII or binary), and the terminator bytes (often <CR><LF> = 0x0D 0x0A).
5. Connection-resource budget: each NetPro configured TCP connection consumes one S7-400 connection resource on the CP. The CPU has its own connection limit, typically 16–32 for S7-400 CPUs; these are independent of the CP.
6. For diagnostics, a Windows engineering station with Telnet client enabled (Windows feature) or PuTTY in raw-TCP mode.

3. Decide the Active vs Passive Role

Before opening NetPro, the application must decide which side opens the TCP connection. The two choices map to two completely different NetPro configurations and two different port behaviors on the CP.

If you can Telnet from a PC to the RFID reader on its listening port and see the reader respond, the reader is a TCP server. The PLC, therefore, must act as the TCP client and use a NetPro connection that specifies the partner port. If the reader expects to be told what to do, the CP is the active side; if the reader reports tag events on its own, the CP is the passive side and the partner port is left blank.

4. Method 1 – NetPro Configured Connection with AG_SEND / AG_RCV

This is the most common path on CP 443-1 because it does not require the Open Communication Wizard and uses the SEND/RECEIVE interface that has been available on SIMATIC NET CPs since the CP 343-1 era.

4.1 Create the connection in NetPro

1. Open the S7 project in SIMATIC Manager and launch NetPro.
2. Select the CP 443-1 row in the S7-400 station.
3. Right-click and choose "Insert New Connection".
4. In the connection partner dialog, choose "Unspecified" and connection type "TCP Connection" or "UDP Connection" as required by the RFID scanner.
5. Set the Partner IP address to the scanner's IP, for example 192.168.0.20.
6. Set the Partner Port if the CP is the active side, or leave it blank if the CP is the passive side. Set the Local Port only on the passive side.
7. Confirm. NetPro generates an ID (e.g. 1) for the connection. Note that ID – it is the handle for AG_SEND/AG_RCV.
8. Download the hardware configuration and the connection table to the S7-400. The CP must be STOP/RUN with the new connection active. The CP's connection status can be read with the diagnostic buffer (Module Information > Diagnostic Buffer).

4.2 Call AG_SEND and AG_RCV

After the NetPro connection exists, the application uses FC5 (AG_SEND) and FC6 (AG_RCV) from the standard library "SIMATIC_NET_CP". For data blocks longer than 240 bytes, the long versions FC50 (AG_LSEND) and FC60 (AG_LRECV) are used. The interface is identical in STEP 7 V5.5 and TIA Portal (TIA: instruction catalog > Communication > S7 Communication > AG_SEND/AG_RCV under the legacy CP block set).

4.3 Sample STL / SCL call (STEP 7 V5.5)

// AG_SEND trigger for NetPro connection ID 1, CP at HW address 256
CALL  FC5   // AG_SEND
 ACT    := M 10.0          // rising edge triggers send
 ID     := 1               // connection ID from NetPro
 LADDR  := W#16#100        // logical base address of CP 443-1
 SEND   := P#DB100.DBX0.0 BYTE 32
 LEN    := 32
 DONE   := M 20.0
 ERROR  := M 20.1
 STATUS := MW 22

// AG_RCV polling (call in OB1 / OB35)
CALL  FC6   // AG_RCV
 ID     := 1
 LADDR  := W#16#100
 RECV   := P#DB101.DBX0.0 BYTE 240
 NDR    := M 30.0
 ERROR  := M 30.1
 STATUS := MW 32
 LEN    := MW 34

5. Method 2 – Open Communication Wizard with TCON / TSEND / TRCV

The Open Communication Wizard in SIMATIC Manager (right-click the S7-400 station > "Open Communication Wizard") is the path recommended by Siemens for newer CPs when the application needs dynamic establishment/teardown of TCP connections, multiple partner endpoints, or symmetry with the S7-1500 Open User Communication programming model. On a CP 443-1 EX30 it is supported but the wizard is not always installed by default; it ships with STEP 7 V5.5 + SP2 or later.

5.1 Wizard output

The wizard generates two UDTs that the programmer must fill in the user program before calling TCON:

• UDT 65 (TCON_PAR) – the connection parameter block containing block_init, conn_type, active_est, local_tsap_id_len, local_tsap_id, rem_tsap_id_len, rem_tsap_id, rem_staddr_len, rem_staddr (IPv4), and spare.
• UDT 66 (TCON_ADD) – the address extension that holds the local interface description (local_device_id, next_staddr_len, next_staddr) used to bind the connection to a specific CP.

5.2 TCON interface (FB65)

5.3 TCON_PAR setup for active TCP client to RFID on port 2000

// Pre-assign the connection parameter block (DB100 starting at byte 0)
// UDT 65 layout for an active IPv4 TCP client
DB100.DBX   0.0   BYTE   16#11      // block_init / version
DB100.DBX   1.0   BYTE   16#01      // 1 = conn_type TCP (ISO-on-TCP=12, UDP=13)
DB100.DBX   2.0   BOOL   TRUE       // active_est = TRUE (CP opens connection)
DB100.DBX   2.1   BOOL   FALSE      // leave default
DB100.DBX   3.0   BYTE   0          // local_tsap_id_len = 0 (port assigned by CP)
DB100.DBX   4.0   BYTE   0          // rem_tsap_id_len
DB100.DBB   8.0   BYTE   16#02      // rem_tsap_id length 2 bytes (port)
DB100.DBB   9.0   BYTE   16#00
DB100.DBW  10.0   WORD   16#07D0    // rem port 2000
DB100.DBB  12.0   BYTE   16#04      // rem_staddr_len = 4 (IPv4)
DB100.DBB  16.0   BYTE   192        // 192
DB100.DBB  17.0   BYTE   168        // 168
DB100.DBB  18.0   BYTE   0          // 0
DB100.DBB  19.0   BYTE   20         // 20  -> 192.168.0.20

5.4 Send and receive

// TSEND (FB63 / in some installs FB67) – trigger a send of a command frame
CALL  FB63
 REQ   := M 40.0
 ID    := W#16#1
 LEN   := 16
 DATA  := P#DB102.DBX0.0 BYTE 16
 DONE  := M 41.0
 BUSY  := M 41.1
 ERROR := M 41.2
 STATUS:= MW 42

// TRCV (FB64 / in some installs FB68) – poll for the reader response
CALL  FB64
 EN_R  := TRUE
 ID    := W#16#1
 LEN   := 240
 DATA  := P#DB103.DBX0.0 BYTE 240
 NDR   := M 50.0
 BUSY  := M 50.1
 ERROR := M 50.2
 STATUS:= MW 52
 RCVD_LEN := MW 54

To bring the connection down at end of shift, use FB66 (TDISCON). The CP 443-1 will then release the local port, allowing another active client to connect on the same ID.

6. UDP Variant – When the Reader Is Fire-and-Forget

Many RFID readers used in conveyor applications are configured to broadcast UDP datagrams every time a transponder is read. For this case, select UDP Connection in NetPro, mark the connection as unspecified partner (leave the partner IP empty), and set the local port to the reader's destination port. The CP will then bind a UDP socket and accept datagrams from any IP inside the subnet. AG_RECV (FC6) or TRCV can be used to read the datagrams. UDP is connectionless, so AG_RCV will return as soon as one datagram arrives; the application must then re-trigger or call in a fast OB (OB35 / OB1) to avoid losing subsequent datagrams.

7. Port-Number Selection and Reserved-Range Check

The CP 443-1 reserves several TCP/UDP ports for its own services. According to the Siemens Ethernet ports reference, the most common reserved ports are:

Pick the RFID port from the recommended user range (2000–5000) to avoid collisions. If a Telnet test to 192.168.0.20 2000 fails, first verify with a second PC that the reader is actually listening on 2000 using telnet 192.168.0.20 2000 from outside the PLC. If Telnet from a normal Windows PC fails, the reader is not on port 2000 and the NetPro configuration is the wrong target.

8. Verifying the Connection with Telnet

1. Open a Windows command prompt as administrator.
2. Enable the Telnet client: dism /online /Enable-Feature /FeatureName:TelnetClient (Windows 10/11/Server 2019+).
3. From the engineering PC, test telnet 192.168.0.20 2000. A blank screen with a cursor means the reader accepted the TCP connection. If you see "Could not open connection", the reader is not listening on 2000, a firewall is blocking, or the reader's IP is wrong.
4. Test the CP's own port. If the CP is the passive side and listening on 2000, run telnet <CP_IP> 2000. If the cursor appears, the CP is bound. If you get refused, the NetPro connection has not been downloaded, the CP is in STOP, or another connection has the same ID.
5. Use netstat -an | findstr :2000 on the engineering PC to see whether the local port is in LISTENING or ESTABLISHED state once the connection is up.

9. Reading the Data on the Receive Side

Once the TCP connection is established and the reader is pushing tag events (or the CP is polling and getting responses), the receive side is handled by AG_RCV (FC6) or TRCV (FB64). Two implementation patterns are common:

9.1 Polling in OB1

Call AG_RCV / TRCV in OB1. Each scan the block checks whether new data is available and, if so, copies it into the receive DB and raises NDR. The application code in OB1 latches NDR with an edge bit and then parses the data block.

9.2 OB35 cyclic acquisition

Call AG_RCV / TRCV in OB35 (e.g. 100 ms). This decouples the receive rate from the OB1 cycle time and prevents overruns when the reader is sending many small frames in burst.

9.3 Typical RFID frame parsing

Most ASCII-protocol RFID readers return a fixed-length or terminator-delimited string such as "EPC: 30 14 22 11 A0 87 33 90 4F 88 22 0D 0A". The application should:

1. Concatenate partial frames using a length field or terminator scan (CR/LF at byte offset RCVD_LEN - 2).
2. Strip the reader's command preamble.
3. Convert the hex EPC into a readable string or push it directly into a tag DB at offset 0 for SCADA consumption.
4. Reset the receive buffer (e.g. fill the first 4 bytes with 0) so the next AG_RCV call does not see a stale NDR.

10. Common STATUS / Error Codes and Their Meaning

11. Troubleshooting Matrix

12. Quick-Start Recipe for the Common Case (CP Active, RFID on Port 2000)

1. Verify from the engineering PC that telnet 192.168.0.20 2000 opens a TCP connection. If it does, the reader is a server on port 2000.
2. In NetPro, on the CP 443-1, insert a TCP connection. Partner = unspecified, partner IP = 192.168.0.20, partner port = 2000, local port = blank. Note the connection ID (e.g. 1) and the CP's logical address (e.g. W#16#100).
3. Download the HW config and the NetPro connection table to the S7-400. The CP must be in RUN.
4. Call FC5 (AG_SEND) with ID = 1, LADDR = W#16#100, SEND = DB100, LEN = the command length. Trigger with a rising edge on ACT.
5. Call FC6 (AG_RCV) with ID = 1, LADDR = W#16#100, RECV = DB101 (240 bytes). Poll in OB1 or OB35.
6. Read the STATUS word on both blocks. 16#0000 means no error, 16#0001 means DONE. Anything else, look it up in Table 8 and the CP diagnostic buffer.
7. Once NDR comes in, parse the data in DB101 and forward to the SCADA DB on the existing S7 connection.

13. Operational Best Practices

• Always download both the HW config and the NetPro connection table; missing either leaves the CP in a partially configured state where AG_SEND returns 80A1.
• Use a single connection ID pool on the CP; document each ID in the project comments to prevent two programmers from choosing the same ID.
• Wrap the AG_SEND/AG_RCV calls in a function block with an internal enabled flag so the connection can be paused for maintenance without changing the user program.
• For high-availability, implement an auto-reconnect OB that re-establishes the TCP connection (TDISCON + TCON) when ERROR is raised with STATUS 80A1 or 80C4.
• Capture a baseline Wireshark trace during commissioning and store it in the project; this trace is invaluable for the next incident.
• Use connection monitoring in the CP properties (Properties > Ethernet Interface > "Keep Alive") to detect dead TCP peers even when the peer fails to close the socket gracefully.

14. Frequently Asked Questions