Siemens S7-300 to LabVIEW Ethernet: Open IE TCP/UDP Setup Guide

Integrating a Siemens SIMATIC S7-300 with National Instruments LabVIEW over Ethernet is a recurring requirement in test-stand, laboratory, pilot-plant and small-batch automation architectures. The S7-300 can be linked to a LabVIEW host through three principal paths: Open IE Communication (raw TCP or UDP using the integrated PROFINET interface or a CP 343-1), an OPC server (SIMATIC NET OPC Scout or NI OPC Servers), or Modbus TCP. The Open IE path is the only one that does not require an additional runtime licence on the PC side and is therefore the preferred choice for small- and mid-budget projects. This reference covers the configuration of TCON, TDISCON, TSEND and TRCV on the S7-300 side and the matching LabVIEW TCP/UDP VIs, including the byte-packing work that is unavoidable when using UDP or raw TCP.

1. Communication Pathways Compared

The table below summarises the three integration approaches covered in the article. Cycle time is end-to-end latency for a small payload (≤32 bytes) on a 100 Mbit/s link; per-packet overhead is the proportion of every frame that is consumed by protocol headers.

2. Prerequisites

• SIMATIC S7-300 CPU with Ethernet port – CPU 314C-2 PN/DP, CPU 315-2 PN/DP, CPU 315F-2 PN/DP, CPU 317-2 PN/DP, CPU 317F-2 PN/DP, CPU 319-3 PN/DP, or any S7-300 CPU paired with a CP 343-1 Lean / CP 343-1 / CP 343-1 Advanced / CP 343-1 ERPC.
• STEP 7 V5.5 + SP2 or higher for classic projects, or TIA Portal V13+ when the project is built against the S7-300 firmware ≥V2.6 (TIA) targets. Open IE FBs are identical in both toolchains; the wizard is the STEP 7 V5.5 version.
• Open Communication Wizard for STEP 7 – Siemens FAQ Entry ID 25209116. The download is free and integrates as a stand-alone executable that runs against any open STEP 7 project.
• LabVIEW 2018 or later (32-bit or 64-bit; 64-bit requires the matching NI network driver). The TCP and UDP VIs are part of the base install; no additional module is needed for raw TCP/UDP. The LabVIEW DSC module is only required for the OPC client path.
• Network connectivity – 100 Mbit/s Ethernet switch, static IP addresses on both ends, common subnet mask (e.g. 192.168.0.0/24). Disable energy-saving features on the PC Ethernet port that put the interface into sleep mode.

3. Method 1 – Open IE Communication (TCP / UDP)

Open IE Communication refers to the set of standard FBs (TCON, TDISCON, TSEND, TRCV, TUDP_*) provided by Siemens in the IEC 61131-3 standard library SIMATIC_NET_CP for STEP 7 V5.5, or the SIMATIC NET blocks included in the S7-300 / S7-400 standard library for TIA Portal. They allow raw TCP, ISO-on-TCP (RFC 1006) and UDP transport without requiring a SIMATIC NET runtime licence on the PC side.

3.1 Connection Types and Block Numbers

3.2 Open Communication Wizard

The Open Communication Wizard is shipped as a free download and integrates into STEP 7 as a stand-alone executable. It performs the following actions automatically:

1. Creates a connection DB (e.g. DB 100) with one entry per partner. Each entry contains a UDT 65 instance for TCP/ISO-on-TCP or a UDT 66 instance for UDP.
2. Generates the UDT 65 / UDT 66 source if it does not exist in the master data library.
3. Inserts the TCON call skeleton inside OB 100 (startup) so the connection is established automatically at run-up.
4. Generates a TDISCON call inside OB 102 (restart) for clean shutdown.
5. Inserts ready-to-fill TSEND and TRCV call skeletons inside OB 1.
6. Compiles the project so the engineer can download and run it without manual editing.

To launch the wizard, double-click the executable, point it at the active STEP 7 project, choose the connection partner (a free-form "unspecified" connection when talking to LabVIEW), select TCP / ISO-on-TCP / UDP, and fill in the local and remote TSAPs. Detailed screenshots and a sample project are provided in the Siemens FAQ at Entry ID 25209116.

3.3 TCON – Establishing the Connection

TCON is the standard FB (FB 65 in the IEC 61131-3 Standard Library) used to set up a communications connection from the S7-300 to a partner. The block requires the following inputs and outputs:

Example call inside OB 1 in STL (STEP 7 V5.5 syntax):

CALL  "TCON" , DB65
       REQ    := M0.0
       ID     := W#16#0001
       CONNECT:= P#DB100.DBX0.0 BYTE 64
       DONE   := M10.0
       BUSY   := M10.1
       ERROR  := M10.2
       STATUS := MW12

The CONNECT pointer must reference a UDT 65 instance for TCP/ISO-on-TCP. UDT 65 contains the following fields (excerpt from the Siemens manual SIMATIC NET – Programming with STEP 7 V5.5):

3.4 TSEND / TRCV – Data Transfer

TSEND (FB 68) and TRCV (FB 67) are the standard send/receive blocks for Open IE. A typical 32-byte data exchange with LabVIEW is implemented as follows:

CALL  "TSEND" , DB68
       REQ    := M0.1
       ID     := W#16#0001
       LEN    := 32
       DATA   := P#DB200.DBX0.0 BYTE 32
       DONE   := M20.0
       BUSY   := M20.1
       ERROR  := M20.2
       STATUS := MW22

CALL  "TRCV" , DB67
       EN_R   := M0.2
       ID     := W#16#0001
       LEN    := 32
       DATA   := P#DB201.DBX0.0 BYTE 32
       NDR    := M30.0
       BUSY   := M30.1
       ERROR  := M30.2
       STATUS := MW32
       RCVD_LEN:= MW34

LEN is the number of bytes to be sent (TSEND) or the maximum number of bytes to receive (TRCV). On the receive side, the actual number of bytes copied into the DATA area is reported in RCVD_LEN; a value lower than LEN means the next packet is still being assembled and the application must wait for the next NDR pulse.

3.5 TDISCON – Clean Disconnection

TDISCON (FB 66) is called from OB 102 (restart) or any time the application needs to close the connection gracefully. It accepts the same ID parameter as TCON. For projects that re-initialise the connection dynamically (e.g. on a recipe change), call TDISCON first, then TCON with a rising edge on REQ.

4. Method 2 – SIMATIC NET OPC Scout

The OPC Scout tool, shipped with SIMATIC NET PC software, exposes S7 tag addresses as OPC items. LabVIEW can subscribe to those items using the DataSocket API or the NI OPC client VIs (LabVIEW DSC module or NI OPC Servers). Configuration is documented in the SIMATIC NET manual Commissioning PC Stations – OPC Scout. The trade-offs are:

• Pros: Symbolic tag access (e.g. DB100.Pressure), no manual byte packing, fully asynchronous subscription with dead-band filtering, automatic reconnect on link loss.
• Cons: Requires SIMATIC NET V14+ licence on the PC, plus a configured PC station (Station Configuration Editor) with an OPC server entry that points at the S7-300's IP. The PC must run the SIMATIC NET Windows service.

For a single LabVIEW host connecting to a single S7-300, the SIMATIC NET licence cost usually exceeds the engineering time saved when compared to a TCP/UDP Open IE implementation, especially if the variables are limited in number and the cycle time budget is ≥100 ms. OPC is the right answer when the LabVIEW host must read/write hundreds of tags asynchronously, or when a SIMATIC NET installation already exists for an HMI.

5. Method 3 – Modbus TCP

Modbus TCP (port 502) is supported by every S7-300 PN port through the Modbus TCP PN-CPU library (Siemens FAQ Entry ID 22660304). The library is free but ships as sample code that must be integrated into the S7 project. LabVIEW provides a Modbus library (NI Modbus Library, free add-on) on the LabVIEW Tools Network. Modbus is a good fit if the LabVIEW host must talk to multiple devices in parallel; for a single S7-300, the Open IE approach offers higher throughput and lower per-packet overhead.

6. LabVIEW Implementation – TCP

LabVIEW exposes the TCP transport through the VIs located on the Data Communication → Protocols → TCP palette. The four primary nodes are TCP Open Connection, TCP Read, TCP Write, and TCP Close Connection. The block diagram below documents a minimal client; see Data Communication Methods in LabVIEW for the full reference.

6.1 TCP Open Connection

• address (string): the S7-300 IP, e.g. "192.168.0.20". For ISO-on-TCP, the S7-300 is the server; for raw TCP, either side can be the active opener.
• port (numeric, U16): the remote port configured in UDT 65 (2000 for ISO-on-TCP, 2001 for raw TCP – Siemens defaults in the wizard).
• connection ID (numeric, I32): returned on the output side. Route it through a shift register so every subsequent node uses the same handle.

6.2 TCP Write

Pass the connection ID and a string. The string is the raw byte payload. For floating-point variables, use Flatten To String on a cluster of numeric values, then write the resulting string. To force a big-endian on-wire representation, right-click the cluster terminal and check "Byte order: Big-Endian, Network Order".

[DB200 cluster of 8 REAL values + 4 WORD + 8 BOOL]
   → Flatten To String (Big-Endian)
   → TCP Write (connection ID, "192.168.0.20:2000")

6.3 TCP Read

Two modes are available: byte count and delimiter / CR-LF. For ISO-on-TCP, set the byte count to the expected payload size and read with the mode = Standard input. For raw TCP, use the mode = Buffered input and parse the response with String Subset and Type Cast nodes. The default timeout ms is 25 000; lower it to 1000 ms for a polling loop so a stuck read does not freeze the VI.

6.4 TCP Close Connection

Called once when the consumer loop stops, usually wired after a Stop boolean OR a connection error. Failure to close the connection leaves the socket in TIME_WAIT on the S7-300 side and may delay reconnection by up to 4 minutes.

6.5 Error Codes

Every TCP node returns an error in / error out cluster. A typical error code for "connection refused" is 56; "network unreachable" returns 66; "remote host forcibly closed" returns 54; "timeout" returns 56. The full list is in the LabVIEW Help for the TCP palette.

7. LabVIEW Implementation – UDP

The UDP palette mirrors the TCP one: UDP Open, UDP Read, UDP Write, UDP Close. Because UDP is connectionless, every send/recv node requires the destination (IP, port) or source filter (IP, port).

7.1 UDP Open

• port (U16): local port to bind, e.g. 0x3000 (12288) – must match the local TSAP / port configured in UDT 66 on the S7-300.

7.2 UDP Write

Pass the connection ID, the destination IP / port, and the byte payload. For multiple variables, build the payload with a cluster Flatten To String.

7.3 UDP Read

Specify a max size (e.g. 64 bytes) and a timeout ms (e.g. 1000). The VI returns the payload string and the source IP / port, which can be used for re-send logic. For broadcast reception, leave the net address input unwired.

8. Data Encoding – Packing REAL / WORD / BOOL on the Wire

When using UDP or raw TCP (no protocol-imposed framing), the application must define a binary layout that both ends understand. The following table documents a typical 16-byte status frame from the S7-300 to LabVIEW:

Siemens S7 CPUs store REAL and DWORD in big-endian format internally but transmit them in the order specified by the BSEND / TSEND block. To send them in network order (big-endian) – which is required by some LabVIEW decoders – no byte-swap is needed on the S7 side. LabVIEW's Type Cast function interprets a string as a SGL, but the platform endianness of the host must be considered: on x86/x64 hosts, SGL is little-endian. Therefore, when receiving big-endian REALs, apply a 4-byte byte swap (Reverse 1D Array on a 4-element U8 array, then Join Numbers and Type Cast) or use the Swap Bytes variant of Flatten To String on the LabVIEW side.

9. Verification and Performance

A typical commissioning run on a CPU 315-2 PN/DP (firmware V3.3) talking to a LabVIEW 2020 host over a 100 Mbit/s link produces the following metrics. The S7-300 records a timestamp (SFC 1 "READ_CLK") before the TSEND call and after the corresponding TRCV call; the LabVIEW host performs the same measurement using the Tick Count (ms) function and the iteration time of the polling loop.

The verification procedure is:

1. Compile and download the S7 project. Watch the SF / BF LEDs on the CPU; both should remain off.
2. In STEP 7, open PLC → Module Information on the CPU and confirm no diagnostic entries in the buffer.
3. Open the LabVIEW project, run the consumer loop, and check the error out cluster: it should remain unwired after the first iteration.
4. Use Wireshark with the filter tcp.port == 2000 (or udp.port == 12288) to confirm the handshake and the frame cadence.
5. Toggle a BOOL on the S7 side from STEP 7 (Monitor / Modify) and confirm the corresponding bit in LabVIEW changes within the cycle-time window.

10. Troubleshooting Matrix

11. Platform Notes and Cross-Compatibility

LabVIEW is available in 32-bit and 64-bit flavours. The TCP / UDP VIs in the base install are bitness-agnostic, but the Flatten To String / Type Cast nodes produce the same byte sequence in both. OPC clients, however, differ: the 32-bit LabVIEW DSC module uses the in-process OPC DA 2.05 wrapper; the 64-bit LabVIEW must use the OPC UA wrapper (LabVIEW 2020+) or NI OPC Servers 2018+ running out-of-process. When in doubt, prefer Open IE TCP/UDP: it is bitness-agnostic, has no COM dependency, and is fully supported on Linux-based LabVIEW NXG Web VIs (via the Network Stream or the TCP palette).

On the S7-300 side, the Open IE FBs require a PN port or a CP 343-1 with firmware ≥V1.0 for the standard library; CP 343-1 Lean firmware ≥V1.1 supports ISO-on-TCP. UDP support was added in CP 343-1 firmware V2.0 and is available on integrated PN ports from CPU firmware V2.6. The wizard checks the firmware version and refuses to generate UDP blocks on incompatible hardware.

For projects that need to survive a PC reboot, configure the LabVIEW service as a Windows service (NI Service Locator + the System Manager's Start as service option). The Open IE connection on the S7-300 side will retry every few seconds until the LabVIEW host comes back online; no manual intervention is required.

12. FAQ