Siemens CPU 315-2 PN/DP Configuring Third-Party TCP Communication

Overview

The SIMATIC S7-300 CPU 315-2 PN/DP is a compact PLC with an integrated PROFINET interface that supports both PROFINET IO and open TCP/UDP communication. Unlike the older CP 343-1 communications processor path, the on-board PROFINET port of the CPU 315-2 PN/DP can be programmed directly with the T-block family (TCON, TSEND, TRCV, TDISCON) without inserting a CP in the hardware catalog. This avoids the recurring confusion of mixing AG_SEND/AG_RECV (CP-only) with the T-functions (CPU PN port) inside the same project.

For Modbus/TCP interoperability with non-Siemens controllers, Siemens provides a free library (OpenModbusTCP PN CPU - Entry ID 25209116) that runs entirely on the CPU and uses the same T-block primitives underneath. A configuration wizard (the "OC Wizard" for Open Communication) generates the connection DB, MODBUS application DB, and instance DBs automatically, dramatically cutting engineering time.

This reference covers the on-board PN port, the T-block interface, the connection description UDT, TIA Portal / STEP 7 V5.x configuration, the OpenModbusTCP library, the OC wizard workflow, and field-proven verification and troubleshooting steps.

Hardware Identification: CPU 315-2 PN/DP Variants

Before programming, identify the exact order number (MLFB) because firmware (FW) behavior changes the supported connection counts and OpenModbusTCP library compatibility.

For T-block communication with third-party devices, FW V2.5 or higher is recommended because the TCON "active connection establishment" became fully stable across all integrated PN interface revisions. The OpenModbusTCP PN CPU library requires FW V2.6 or higher on the CPU 315-2 PN/DP. Always confirm the exact number of supported open connections in the device manual for your MLFB; the table above is a guideline, not a guarantee.

Communication Options on the Integrated PN Port

The CPU 315-2 PN/DP integrated PROFINET interface supports the following open communication services in parallel with PROFINET IO:

For a true third-party (non-Siemens, non-PROFINET) device, the two most common paths are raw TCP via TCON/TSEND/TRCV or Modbus/TCP via the OpenModbusTCP library. ISO-on-TCP is technically open (RFC 1006) but the framing is rarely implemented outside Siemens and a handful of vendors; use it only when the partner explicitly supports RFC 1006.

Native TCP Communication with TCON / TSEND / TRCV / TDISCON

The T-block library is part of the SIMATIC system library and ships with STEP 7 V5.5 SPx and TIA Portal V13+. The blocks are reusable, multi-instance capable, and can run from any priority class (OB1, OB35) provided that the user program does not exceed the cyclic OB1 budget. Refer to the Siemens Entry ID 34677186 for the canonical T-block manual.

Block Roles

• TCON - establishes or aborts the connection on the rising edge of REQ. After the call the connection is held in a CONNECT data block.
• TSEND - sends a user-defined number of bytes from a source data area on the rising edge of REQ. It returns DONE when the partner ACKs the bytes.
• TRCV - receives bytes into a destination data area. LEN, ADHOC, and DATA determine the receive length and behavior.
• TDISCON - cleanly terminates the connection on the rising edge of REQ.

Unlike the legacy AG_SEND/AG_RECV pair used with CP 343-1, the T-block family uses a single call per request, supports partial-length reception with LEN, and uses a single connection ID per partner. The ID is part of the connection description, not a separate call parameter.

Connection Description Structure (UDT / DB)

The T-block interface requires a structure (typically a DB) describing the connection. In TIA Portal V18+ the system UDT TCON_Param is auto-instanced when you drop TCON. In STEP 7 V5.5 SPx the engineer must build the structure manually. Below is a working example for raw TCP to 192.168.0.50:2000 with the CPU as active client.

DATA_BLOCK DB100
TITLE = TCON_Param_ThirdParty
VERSION : 0.0
STRUCT
   BlockLength       : WORD    := 64;          // total length of this structure
   Id                : WORD    := 1;           // Connection ID (must be unique project-wide)
   ConnectionType    : BYTE    := 16#0B;       // 0x0B = TCP
   ActiveEstablished : BOOL    := TRUE;        // TRUE = active (client), FALSE = passive (server)
   LocalDeviceId     : BYTE    := 16#00;       // 0x00 = PN interface of the CPU
   LocalTsapIdLen    : BYTE    := 0;           // 0 for TCP (TSAP only for ISO-on-TCP)
   LocalTsapId       : ARRAY[1..16] OF BYTE;
   RemoteTsapIdLen   : BYTE    := 0;           // 0 for TCP
   RemoteTsapId      : ARRAY[1..16] OF BYTE;
   RemoteAddressLen  : BYTE    := 4;           // 4 for IPv4
   RemoteAddress     : ARRAY[1..4] OF BYTE := 192,168,0,50;
   RemotePort        : UINT    := 2000;        // destination port
   LocalPort         : UINT    := 0;           // 0 = any free local port
   Spare             : WORD    := 16#0000;
END_STRUCT;
END_DATA_BLOCK

Field guidance:

• Id must be unique across the whole S7-300 station - the same ID cannot be reused for the HMI panel and the third-party TCP partner.
• LocalDeviceId 0x00 selects the on-board PN port. 0x01 / 0x02 select the first/second CP if installed. Do not use these values for the integrated port.
• ActiveEstablished = TRUE means the CPU opens the connection. Set FALSE only when the CPU must accept an incoming connection from a foreign server (for example when the partner is port-forwarded through a router).
• RemoteAddress uses 4 bytes (one per IPv4 octet). For DNS names the structure must be expanded with the UDT "TCON_Param_v4" or the TIA Portal UDT65.
• LocalPort = 0 lets the OS pick a free ephemeral port. Set a fixed value only when the partner's firewall requires a specific source port.

TIA Portal Configuration Procedure

This procedure assumes a CPU 315-2 PN/DP with FW V3.3 and TIA Portal V17/V18. The third-party partner is a generic TCP server on 192.168.0.50:2000.

1. In the project tree, open Devices > [CPU 315-2 PN/DP] > Properties > PROFINET interface [X2]. Assign IP address (for example 192.168.0.10) and subnet mask. Activate "Use router" only if the partner is across a router.
2. Confirm the PN port is NOT configured as a PROFINET IO controller with strict IRT real-time settings; mixing IRT and T-block communication on the same port is permitted, but T-blocks use standard priority and may be delayed by IRT cycles.
3. Add a new Global DB (for example DB_ConnModbus) and two Data Blocks for send and receive buffers (for example DB_TxData, DB_RxData). Mark the DBs as non-optimized (S7-300-compatible access) - the T-block system library does not work with optimized DBs on the S7-300 CPU.
4. Insert the T-blocks from Instructions > Communication > Open Communication:
   • TCON in OB100 (cold start) or in OB1 (first cycle flag).
   • TSEND in OB1, triggered by a handshake bit.
   • TRCV in OB1, set to ADHOC = FALSE, LEN = expected payload length.
   • TDISCON in OB100 (warm restart) or in the user stop sequence.
5. Wire the CONNECT pin of TCON to the TCON_Param DB. Wire the ID pin of TSEND/TRCV to the same ID word from the CONNECT DB (Word 0 in the structure).
6. Compile and download to the CPU. Go online and force TCON to establish the connection.

STEP 7 V5.x Configuration Procedure

The traditional engineering tool is still widely deployed in brownfield S7-300 sites. The PN port is configured in HW Config by opening the CPU's Properties > PROFINET IO > IP Address tab. There is no "connection" object in NetPro for the integrated port; NetPro is only used to configure the CP 343-1 route.

1. Open SIMATIC Manager > S7 Program > Blocks. Right-click and add a new DB (DB100 from the previous example).
2. From Libraries > Standard Library > Communication Blocks, copy TCON, TSEND, TRCV, and TDISCON from the Open Communication subfolder. Do NOT use FC5/FC6 (AG_SEND/AG_RECV) - those are CP 343-1 only.
3. Call TCON in OB1 with:

   CALL "TCON" , DB_TCON
      REQ     := TRUE
      ID      := W#16#1
      CONNECT := DB100.DBX0.0 BYTE 64
      DONE    := M100.0
      BUSY    := M100.1
      ERROR   := M100.2
      STATUS  := MW102
   

4. Add a multi-instance or a standalone instance DB for TSEND and TRCV with the matching ID := W#16#1. Build the S7 program and download the blocks, then go online and monitor STATUS.

Cycle-Time and Performance Considerations

Raw TCP is a stream protocol with no message framing. The CPU 315-2 PN/DP does not buffer beyond the receive window of the IP stack, so the user program must drain incoming bytes on a deterministic schedule. The recommended pattern:

• Call TRCV every OB1 cycle with a fixed LEN. If no data is present, the block returns NDR = FALSE, RC = 16#7000 (BUSY).
• Maintain a circular buffer in the user DB; TRCV writes into the head, the user program consumes the tail.
• For payload > 8 KB, do not use a single TSEND with a 32 KB buffer. Fragment at the application layer into 1 KB packets and TSEND them back-to-back.

The CPU 315-2 PN/DP FW V3.3 sustains roughly 200 TPS of TSEND/TRCV calls of 240 bytes each when OB1 runs at 10 ms and the program is otherwise idle. Real numbers depend on OB1 cycle and PROFINET IRT share. Always validate with a long-duration Wireshark capture before signing off.

Open Modbus/TCP PN CPU Library

When the third-party device speaks Modbus/TCP (Schneider M340, ABB AC500, Wago 750, Red Lion, many SCADA servers), the OpenModbusTCP PN CPU library provides ready-made function blocks and saves weeks of manual frame building. Download it from the Siemens Industry Online Support entry 25209116.

The zip contains the OC Wizard, the library, and an example STEP 7 project. The current release targets FW V3.2 and V3.3 of the CPU 315-2 PN/DP. The library is not formally maintained; always test it with the target firmware combination before commissioning.

OpenModbusTCP Wizard Workflow

The OC Wizard is a standalone executable that ships with the library zip. It generates a complete STEP 7 project sub-tree, including connection DB, MODBUS DB, instance DBs, and a sample OB1 call structure. This avoids hand-typing 64 bytes of TCON_Param and the symbolic MODBUS request table.

1. Unzip 25209116_OC_Wizard.zip to a writable directory on the engineering station. Run Setup.exe and choose Open Communication Wizard.
2. Select CPU 315-2 PN/DP from the device dropdown. The wizard then offers only the libraries compatible with the CPU FW.
3. Add a Modbus connection: assign ID (1..255), Connection Type "TCP", partner IP, partner port (default 502), local TSAP / port. The wizard fills the connection DB fields automatically.
4. Add jobs (MODBUS requests). For each job specify a name, function code, unit ID (Modbus slave address 0..255), data type, start address, length, and a target data block. The wizard allocates the offsets in the MODBUS DB.
5. Click Generate. The wizard produces the library FBs (typically MB_CYCLIC, MB_READ, MB_WRITE, optionally MB_SLAVE), DBs for connection / Modbus / instance, and a sample OB1. Merge or copy these into the STEP 7 / TIA Portal project.
6. Recompile the S7 program. Download all new blocks to the CPU. The first OB1 call will establish the TCP connection and the Modbus layer.

Comparison: CPU PN Port vs. CP 343-1

Choose the integrated PN port when the third-party device count is ≤ 16 and no second physical network is required. Choose CP 343-1 when you must exceed 16 open connections, isolate the third-party traffic on a separate switch, or need additional diagnostics interfaces.

Security and Hardening

Open TCP on the integrated PN port is a plain Ethernet service. The CPU 315-2 PN/DP does not provide encryption, authentication, or rate limiting at the application layer. The following hardening steps are field-proven:

• Place the CPU behind a managed switch with port security (MAC lockdown) so the partner cannot be MAC-spoofed.
• Use a dedicated VLAN for the third-party traffic; do not mix with the HMIs and engineering stations.
• Disable the integrated Web server on the CPU if not strictly required - it shares the same TCP stack.
• Enable Access Protection (CPU Properties > Protection) with a password so an attacker with physical access cannot stop TCON and start a rogue server.
• For Modbus/TCP, configure the partner to accept only explicit unit IDs in the 1..247 range; reject 0 (broadcast) and 248..255 (reserved).

Verification and Diagnostics

Once the program is loaded, verify the connection is open and traffic is flowing before declaring success.

1. Open Online & Diagnostics > PROFINET interface > Statistics in TIA Portal, or PLC > Diagnostics/Settings > PN Statistics in STEP 7. Verify the port shows non-zero counters on TPA Frames Sent / Received.
2. Monitor the TCON STATUS word (MW102 in the example). For TCP, the standard positive return values are 16#0000 for DONE and 16#7000 for BUSY. A common fault is 16#80A1 (connection aborted by remote) or 16#80A3 (connection aborted by local IP stack).
3. On the third-party device side, capture Wireshark on the partner port. Look for the TCP 3-way handshake to port 2000 (or 502 for Modbus), then payload PDUs at the expected cadence.
4. Trigger a TSEND with a known pattern. The third-party partner should see the same byte sequence. Trigger a TRCV; verify LEN returned equals bytes received.
5. For Modbus/TCP, the wizard's example OB1 has a watch table with MB_DB.state. State values:
   • 0 - Init, not connected
   • 1 - TCP open, Modbus idle
   • 2 - Request issued, waiting for response
   • 3 - Response received, valid
   • 4 - Error (see MB_DB.error)

Common Faults and Troubleshooting Matrix

Migrating an Existing CP 343-1 Project to the Integrated PN Port

When modernizing a brownfield S7-300 site, the integrated PN port can replace a CP 343-1 with code changes only:

1. Re-route the Ethernet cable from the CP 343-1 front connector to the CPU X2 PN port (Port 1 or Port 2 of the integrated switch).
2. Update HW Config: remove the CP 343-1 from the rack; keep the existing IP address on the CPU PN port. Save and recompile.
3. Replace AG_SEND/AG_RECV calls with the equivalent TSEND/TRCV calls. The CONNECT DB (DB100 in the example) replaces the LADDR / ID pair of the CP variant.
4. Re-test the partner with a Wireshark capture. The on-the-wire payload is identical; the only change is the local TCP source port range.

Frequently Asked Questions