TIA Portal to STEP 7 V5.5: Configuring S7 PUT/GET Connections

Overview

This procedure covers the configuration of a one-sided ("unspecified") S7 connection between a CPU 317F-2 PN/DP programmed in TIA Portal and a partner CPU programmed in STEP 7 V5.5. Data exchange uses the PUT and GET instructions located in Instructions > Communication > S7 Communication. The TIA Portal side acts as the client (connection owner) and runs PUT/GET. The V5.5 side acts as the server: the partner project requires no connection entry, only the destination data blocks and a CPU protection level that allows S7 PUT/GET access.

An unspecified S7 connection is a unilaterally configured connection that exists in exactly one PLC's project. The partner is reached by IP address and Transport Service Access Point (TSAP); the partner's project is unaware of the connection. This is the standard integration pattern when the new TIA Portal machine has to communicate with an existing STEP 7 V5.5 plant whose project is locked, owned by a different integrator, or otherwise not available for editing. The trade-off is that the partner TSAP and protection level must be known on the TIA Portal side.

Reference the Siemens support entry 82212115 for the official procedure to configure and program PUT/GET in TIA Portal, and the Creating an S7 connection chapter in the SIMATIC S7-1200 manual collection for the connection-wizard reference. The S7-300/400 procedure follows the same structure.

Prerequisites and Hardware Reference

Before starting, confirm that the engineering environment and the partner plant satisfy the requirements below.

The CPU 317F-2 PN/DP provides a two-port PROFINET switch on interface X1, a PROFIBUS DP master/slave on X2, and a bit memory of 4096 bytes. It is F-capable (PROFIsafe) but PUT/GET do not use the F-runtime group and operate on standard data blocks.

S7 Communication Fundamentals: Protocol Stack, Connection Types, and TSAPs

S7 communication between S7-300/400 CPUs runs over the ISO Transport protocol (RFC 1006 / ISO-on-TCP) on TCP port 102. The transport layer is selected automatically by the connection; ISO Transport is the default for S7 connections. The ISO Transport endpoint on each side is identified by a Transport Service Access Point (TSAP), a 2-byte field encoded in the connection configuration.

Connection types

• Specified S7 connection: configured in both PLC projects. Each side has a NetPro/TIA connection entry, and the local IDs on each side map to the same physical connection. Used for tight integration where the partner project is fully available and editable.
• Unspecified S7 connection: configured in one PLC project only. The partner is reached by IP address and TSAP. The partner project has no knowledge of the connection; it only needs to be reachable on the network and to allow the requested service (PUT/GET) at its TSAP.

For a TIA Portal CPU integrating with an existing V5.5 plant, the unspecified connection is the practical choice because: (1) the V5.5 project is often locked, (2) the TIA Portal project is a standalone engineering file, and (3) a single unilateral connection satisfies the data exchange requirement without forcing a re-engineer of the legacy project.

TSAP layout for S7 connections

For S7-300/400 CPUs the default TSAP is 01.01 for a CPU on rack 0 / slot 1. The two bytes are interpreted as rack.slot. For multi-rack configurations, 00.0E maps to slot 14 (the IM interface). The TSAP is also used to disambiguate multiple Ethernet interfaces on the same CPU; in S7-300/400 each Ethernet interface has a distinct TSAP range. For S7-1200/1500 partners, the TSAP format is 01.<slot> with the slot of the CPU in the project.

Network and Subnet Configuration

Both CPUs must share an Ethernet subnet for S7 communication, or be reachable via a routed path. For a CPU 317F-2 PN/DP, the PROFINET interface of the TIA Portal CPU is configured in the Device view > Properties > PROFINET interface. The interface must have a fixed IP address, subnet mask, and (where applicable) a router address consistent with the plant network.

1. In the TIA Portal project, open the device view of the CPU 317F-2 PN/DP and select the PROFINET interface (X1 P1R / X1 P2R port pair).
2. Set IP address to a free address in the plant subnet, e.g. 192.168.0.10, with subnet mask 255.255.255.0.
3. Under Ethernet addresses > PROFINET, verify that the Subnet field references the S7 subnet that also contains the V5.5 partner. If the V5.5 partner is not represented as a device in the TIA Portal project, insert a generic "HMI station" or "S7 station" placeholder into the project to anchor the subnet; otherwise the TIA Portal connection configuration has no subnet to bind to.
4. From the engineering station, ping the partner CPU's IP address to confirm IP-level connectivity before configuring the S7 connection.
5. If the partner is on a different IP subnet, configure a router entry in the TIA Portal CPU's PROFINET interface properties (Ethernet addresses > IP router). S7 communication supports routed connections over IPv4; both ends must be reachable from the client through the configured router(s).

Configuring the Unspecified S7 Connection in TIA Portal

Configure the connection on the TIA Portal side, which owns the connection lifecycle.

1. In the project tree, expand the CPU 317F-2 PN/DP and double-click Devices & networks.
2. Switch to the Network view and select the Connections button in the top toolbar.
3. Click the CPU 317F-2 PN/DP; a connection list appears at the bottom of the editor.
4. Choose Add new connection and select S7 connection as the connection type. In the partner drop-down, select "Unspecified" from the partner station list — this creates the unilaterally configured connection.
5. Click Add. A new connection appears in the list with an automatically assigned local ID (typically 1 for the first S7 connection).

Open the connection properties to set the partner address and TSAP:

• Partner address / IP address: the IP address of the V5.5 CPU's PROFINET or Ethernet interface, e.g. 192.168.0.20.
• Partner TSAP: 01.01 for an S7-300/400 CPU on slot 1, rack 0. For S7-1200/1500 partners use the format 01.<slot> matching the partner CPU's slot.
• Local TSAP: leave at the TIA Portal default (01.00) or assign a free TSAP. The client TSAP does not need to match a specific partner setting because the partner does not know the connection exists.
• Active connection establishment: keep this enabled (default). The TIA Portal CPU opens the connection at startup. If disabled, the connection only opens when the application actively establishes it via UPDAT_PI/UPDAT_PO or via the PUT/GET REQ edge under specific conditions.
• Connection name: the symbolic name in the TIA Portal project tree (e.g., S7_Connection_1); the local ID is what the PUT/GET instruction will reference.

Specified vs unspecified: when to switch

If the V5.5 partner project becomes available for editing, an unspecified connection can be promoted to a specified connection by replacing the partner placeholder with the actual V5.5 station from the partner project archive. The PUT/GET program and local ID remain valid; only the connection entry is regenerated. The reverse (specified → unspecified) is also possible by switching the partner drop-down to "Unspecified"; the connection IP and TSAP are preserved.

Preparing the STEP 7 V5.5 Partner

On the V5.5 side the partner project does not need a matching connection entry. The required steps are minimal but mandatory.

1. Ensure target DBs exist. PUT/GET writes into or reads from DBs on the partner. Create or confirm that the DBs the TIA Portal client will reference (e.g., DB200 for received data via GET, DB300 for sent data via PUT) exist in the V5.5 project. The DBs must be long enough to hold the maximum data length of one PUT/GET call. The classic S7-300/400 PUT/GET transfers 1 to 462 bytes per call; the multi-element PUT/GET in TIA Portal still has a 462-byte total ceiling per call, distributed across up to four 32-byte regions (ADDR_1..ADDR_4 / SD_1..SD_4).
2. Permit S7 communication. In HW Config, right-click the CPU, choose Object Properties > Protection. The default in older projects is "No protection"; if the project uses a password level, set it to a level that allows PUT/GET. For an F-CPU ("F" suffix), the protection level "Write-protect for F-blocks" is the minimum required to allow standard S7 communication while still protecting F-blocks.
3. Verify the IP address. The partner CPU's PROFINET or Ethernet interface must be configured with a known IP in the same subnet as the TIA Portal CPU. Use PLC > Ethernet > Edit Ethernet Node in STEP 7 V5.5 to assign the IP if it has not been set. This is also the path to discover the partner's MAC and current IP if the IP is unknown.
4. Assign PROFINET device name (only for PN CPUs in PROFINET IO mode): the CPU 317F-2 PN/DP may operate as a PROFINET IO controller; if the V5.5 partner is also a PN CPU and is to be a PROFINET IO device, assign a PROFINET device name using PLC > Ethernet > Assign Device Name in STEP 7 V5.5. S7 communication does not require the PROFINET device name, but IO operation does.

Programming PUT and GET in TIA Portal

Both instructions are added to the client (TIA Portal) program. They are typically placed in a cyclic OB (e.g., OB1) and triggered by a clock bit or a control bit from the application. In TIA Portal, drag PUT and GET from the Instructions > Communication > S7 Communication task card into the code block.

GET instruction (read from partner)

Use GET to read a defined data area from the V5.5 partner into a local DB on the TIA Portal CPU.

|  GET_DB                                       |
|  REQ   := "db_comm".start_read               |
|  ID    := W#16#1                             |
|  ADDR_1 := P#DB200.DBX0.0 BYTE 32            |
|  RD_1   := P#DB100.DBX0.0 BYTE 32            |
|  NDR    => "db_comm".read_ndr                |
|  DONE   => "db_comm".read_done               |
|  ERROR  => "db_comm".read_error              |
|  STATUS => "db_comm".read_status             |

PUT instruction (write to partner)

PUT writes a local data area to the partner.

For more than 32 bytes per call, use the multi-element variants with ADDR_2/SD_2 through ADDR_4/SD_4. Each region can be up to 32 bytes, and the total length across all regions must not exceed 462 bytes per call. TIA Portal exposes these as PUT (multi) and GET (multi) in the same task card group.

Connection ID match

The ID parameter in the PUT/GET instruction must be the local ID assigned to the S7 connection. To verify, right-click the S7 connection in the TIA Portal project tree, choose Properties, and read the Local ID field. For example, if the project assigned local ID 1, the instruction uses W#16#1. Mismatched ID is the single most common commissioning error for PUT/GET and presents as STATUS = 0x0001 (resource problem) or STATUS = 0x0007 (TSAP/partner not found).

Downloading and Going Online

1. Compile the TIA Portal project (Project > Compile > All or right-click the CPU and choose Compile > Hardware and software). The connection entry is part of the hardware configuration and must be compiled consistently.
2. Connect the engineering station to the TIA Portal CPU's PROFINET network and select the correct PG/PC interface.
3. Download the configuration to the CPU 317F-2 PN/DP via Online > Download to device. The download includes the hardware configuration, the S7 connection, and the program blocks containing PUT/GET. Use Download to device > Extended download only if the CPU is in RUN and a stop is not desired; the standard download stops the CPU briefly.
4. On the V5.5 partner, download only if the project was changed (DB additions, protection changes). If the V5.5 project is already running with the required DBs, no V5.5 download is needed — the TIA Portal connection works against the running V5.5 project.
5. After the download, observe the connection state in TIA Portal via Online > Online & diagnostics > Connections. The S7 connection should show state "Established". If it shows "Not established" or cycles, proceed to the troubleshooting matrix.

Verification and Diagnostics

Verify the communication path with the following checks, in order:

1. Connection state. In TIA Portal, Online & diagnostics > Connections shows the local ID, partner IP, partner TSAP, and state. State "Established" means the TCP/ISO transport connection is open and PUT/GET can be executed.
2. Trigger and observe. Force REQ = 1 on a PUT or GET block in the watch table and watch the DONE/ERROR outputs. With a single-instance PUT/GET, after DONE or ERROR rises, reset REQ in the same cycle to avoid the next call being issued while the prior call is still flagged.
3. Watch tables (data round-trip). Use two watch tables: one on the TIA Portal side (monitor local DB100 after GET, local DB110 before PUT) and one on the V5.5 side (monitor the remote DB200/DB300). Compare values to confirm the data round-trip. Mismatch in length or offset typically presents as STATUS = 0x0002 (data length error) or as silently truncated data.
4. Diagnostic buffer. If ERROR = 1, read the diagnostic buffer on the V5.5 partner (in STEP 7 V5.5: PLC > Diagnostic Buffer) and on the TIA Portal CPU (TIA Portal: Online & diagnostics > Diagnostic buffer). Connection-related events such as "Connection aborted" or "Partner not reachable" are recorded with timestamps and an event ID.
5. Communication status. On the V5.5 partner, PLC > Diagnostics > Communication Status lists all open S7 connections with their local and partner TSAPs. Confirm the TIA Portal CPU is present and the partner TSAP on the V5.5 side matches the configured value.

Connection Resource Planning and Performance

S7-300 CPUs limit the total number of S7 connections across PG, OP, and S7 communication. For the CPU 317F-2 PN/DP the limit is 16; for older S7-300 CPUs the limit can be as low as 4 (CPU 312) to 12 (CPU 315-2 DP). When multiple PUT/GET clients are reading from a single partner CPU, the partner's connection resources are the bottleneck — each active PUT/GET consumes one S7 connection. Plan headroom for HMI panels and engineering access on the partner CPU.

Throughput per PUT/GET call is dominated by the round-trip time of the S7 connection. For a direct Ethernet connection with no router hops, a single 32-byte PUT/GET call typically completes in 10-30 ms on a CPU 317F-2 PN/DP with firmware V3.3. The CPU's OB1 cycle time should be at least 3-5× the call duration to allow for jitter; if PUT/GET is called every cycle and the cycle is shorter than the call duration, calls queue internally and STATUS = 0x0001 (resource problem) is returned intermittently.

Security and Access Protection

PUT/GET provides no authentication and no encryption. The protection model is the CPU's access level, which applies per connection. Configure the partner CPU's access level to the minimum required by the application:

• No protection (level 0): full S7 communication, including PUT/GET. Suitable for isolated plant networks.
• Write-protect (level 1): read access only; PUT is rejected. Used for read-only HMI access.
• Read/write protect (level 2): no HMI access; PG access still possible with password. PUT/GET blocked unless password is configured at the same level.
• Password protection (level 3): all access requires the configured password.

For a TIA Portal CPU that needs PUT/GET into a V5.5 partner, the partner CPU must be at level 0 or level 1 (GET only). A PUT into a level-1 partner is rejected with STATUS = 0x0006 (access error). The same applies to an S7-1200/1500 partner with "Permit access with PUT/GET communication" disabled — the call is rejected at the partner regardless of the password level set.

Plant network segmentation is the primary defense. S7-300/400 CPUs do not provide modern security features (no role-based access, no TLS, no certificate); place the S7 communication path on an isolated VLAN, restrict routing to the plant subnet, and apply a stateful firewall at the network boundary.

Troubleshooting Matrix and Status Codes

For a comprehensive STATUS code reference, see the Siemens support entry 82212115 for PUT/GET and the TIA Portal online help for the S7 communication instructions (F1 on the PUT/GET block in the editor).

FAQ