Troubleshooting ISO-on-TCP Between S7-400 AG_SEND and S7-300

Problem Overview

Establishing ISO-on-TCP (RFC 1006) communication between a SIMATIC S7-400 CPU 414-2 DP paired with a CP 443-1 Ethernet communications processor and a SIMATIC S7-300 CPU 317-2 PN/DP with its integrated PROFINET interface requires asymmetric block selection. The S7-400 CPU 414-2 DP cannot terminate ISO-on-TCP directly because the Ethernet interface lives on the CP 443-1, so the legacy AG_SEND (FB12) / AG_RECV (FB13) or FC5 / FC6 functions are mandatory on the 400 side. The S7-300 PN/DP, in contrast, terminates ISO-on-TCP natively through its integrated PROFINET port using the modern Open Communication block set: TCON, TSEND, TRECV, and TDISCON (FB65 / FB66 / FB67 / FB68).

When this heterogeneous pairing is configured without matching TSAPs, an incomplete TCON_Param (UDT65) data block, or an improperly assembled NetPro project, both sides report idle or failure states: STATUS = 7000 (hex) on the S7-400 AG_SEND (meaning "No job in progress") and RET_VAL = 80B7 (hex) on the S7-300 TCON (indicating "Connection termination / parameter length inconsistency" depending on firmware version). The article below documents the engineering path to resolve both codes by configuring the ISO-on-TCP link end-to-end from NetPro through the user program on both controllers.

System Architecture and Topology

The reference topology pairs a Siemens CPU 414-2 DP with order number 6ES7414-2XJ04-0AB0 (or comparable variant) in slot 2 of an S7-400 rack, an external CP 443-1 (for example 6GK7443-1EX11-0XE0 for ISO-on-TCP support) in slot 4 of the central rack, and an S7-300 CPU 317-2 PN/DP (for example 6ES7317-2EK13-0AB0) hosting the integrated PN port at X2. Both Ethernet nodes occupy the same subnet, but the CP 443-1 must be assigned its own IP address and its logical base address must be read from HW Config.

Block Selection Matrix for ISO-on-TCP

The following matrix is binding for any project that mixes S7-400 + CP 443-1 with an S7-300 PN/DP CPU. Selecting the wrong block on either side is the single most common cause of STATUS 7000 / 80B7 at first compile.

Error Code Reference

Both RET_VAL/STATUS values observed on this topology are documented in the Siemens Open Communication / AG block manuals. Use the table below as the first triage guide.

Root Cause Analysis

The reported pattern - STATUS 7000 on the S7-400 and 80B7 on the S7-300 - has a single dominant root cause in this topology: the ISO-on-TCP connection was not parameterized symmetrically between NetPro (STEP 7 V5.x classic) and the S7-300 TCON_Param data block.

Two failure surfaces must be reconciled:

1. NetPro assignment. The connection object in NetPro must show "established" for both stations. The CP 443-1 side and the S7-300 PN side must agree on the connection type (ISO-on-TCP), the local TSAP, the remote TSAP, the partner IP and the connection ID. If NetPro was opened but the project was not compiled to both stations (PLC > Compile and Download Objects), the S7-300 has no valid connection record and TCON returns 80B7 immediately.
2. TCON_Param data block structure. Even with a correct NetPro project, the S7-300 program must populate TCON_Param with the exact TSAP strings, exact TSAP lengths, the connection ID, and the connection type byte. A common defect is to copy a TCON_Param from a sample project and forget to update the length fields after editing the TSAP string. For example, setting local_tsap_id_len = 16 while the actual string in local_tsap_id is only four ASCII characters (e.g. "10.01") causes the TCON call to walk past the boundary of the local_tsap_id array and read garbage for the next field, surfacing as 80B7.

Secondary root causes that surface identical codes include firewall blocking TCP port 102, mismatched firmware versions (CP 443-1 firmware < V2.1 has limited ISO-on-TCP stability with newer S7-300 CPUs), and a CP 443-1 LADDR that points to the wrong logical address (for example 8191 instead of 8192 when the CP is in slot 4 of a CR2).

NetPro Connection Configuration

Perform the following configuration inside STEP 7 V5.5 SPx (the same procedure applies to STEP 7 Professional V13+ in compatibility mode). For TIA Portal projects on newer firmware, the equivalent is to create a connection from the device view of the S7-300 PN/DP port.

1. Open SIMATIC Manager > Options > NetPro.
2. Right-click the CP 443-1 in the S7-400 station and choose Insert New Connection.
3. In the connection partner dialog select the S7-300 station and the S7-300 PN port, then choose connection type ISO-on-TCP connection.
4. Assign a unique Connection ID (for example W#16#0001 / decimal 1). This is the ID used by both AG_SEND.ID on the 400 side and TCON.ID / TCON_Param.id on the 300 side.
5. On the General tab of the connection properties set:
   • Interface: CP 443-1 (S7-400) / PN/DP (S7-300)
   • Local TSAP: typically the slot-internal TSAP of the CP, e.g. 10.01 for CP in slot 4 of a CR (rack 0, slot 4 means rack 0 / slot 4 -> 10 01). With explicit strings, use ASCII characters and keep them 2 to 16 bytes.
   • Partner TSAP: typically 10.02 or any user-defined string that the S7-300 TCON_Param.rem_tsap_id echoes back.
   • Connection path: leave at default ("Use the configuration in the connection partner").
6. Confirm with OK and verify the connection object appears under the CP 443-1 with the configured ID and TSAPs.
7. Save and compile: PLC > Compile and Download Objects. Both stations must be online to download. If the S7-300 is offline, NetPro will compile but the connection will not be resident on the partner.

TCON_Param UDT65 Configuration on the S7-300

The TCON_Param is a UDT65 structure that TCON passes to the PROFINET stack. Every length field is counted in bytes and must be consistent with the actual TSAP strings stored in the same DB.

A worked example for the S7-300 in OB1, calling TCON with a DB120 TCON_Param instance, looks like the declaration below.

DATA_BLOCK DB120
  STRUCT
    block_length       : WORD  := W#16#0040;     // 64 bytes total
    id                 : WORD  := W#16#0001;     // Connection ID 1
    connection_type    : BYTE  := B#16#12;       // ISO-on-TCP
    active_establish   : BOOL  := TRUE;          // S7-300 acts as active client
    local_device_id    : BYTE  := B#16#01;       // PN port
    local_tsap_id_len  : BYTE  := B#16#05;       // "10.02" = 5 bytes
    rem_subnet_id_len  : BYTE  := B#16#00;       // no subnet string
    rem_staddr_len     : BYTE  := B#16#04;       // IPv4
    rem_tsap_id_len    : BYTE  := B#16#05;       // "10.01" = 5 bytes
    next_staddr_len    : BYTE  := B#16#00;
    spare_word         : WORD  := W#16#0000;
    local_tsap_id      : ARRAY[1..16] OF BYTE := B#16#00,B#16#00,B#16#00,B#16#00,
                                            B#16#00,B#16#00,B#16#00,B#16#00,
                                            B#16#00,B#16#00,B#16#00,B#16#00,
                                            B#16#00,B#16#00,B#16#00,B#16#00;
    rem_staddr         : ARRAY[1..4]  OF BYTE := B#16#C0,B#16#A8,B#16#00,B#16#0A;
                                            // 192.168.0.10 = CP 443-1
    rem_tsap_id        : ARRAY[1..16] OF BYTE := B#16#00,B#16#00,B#16#00,B#16#00,
                                            B#16#00,B#16#00,B#16#00,B#16#00,
                                            B#16#00,B#16#00,B#16#00,B#16#00,
                                            B#16#00,B#16#00,B#16#00,B#16#00;
    next_staddr        : ARRAY[1..4]  OF BYTE := B#16#00,B#16#00,B#16#00,B#16#00;
    spare_array        : ARRAY[1..10] OF BYTE := B#16#00,B#16#00,B#16#00,B#16#00,
                                            B#16#00,B#16#00,B#16#00,B#16#00,
                                            B#16#00,B#16#00;
  END_STRUCT;
END_DATA_BLOCK

Then in OB1 initialize the TSAP strings exactly once on cold restart (OB100) and call TCON:

// OB100 - Cold restart
CALL  FB65  , DB65   // TCON instance DB
      REQ    := FALSE
      ID     := W#16#0001
      CONNECT:= "DB120".
      DONE   := DONE_1
      BUSY   := BUSY_1
      ERROR  := ERROR_1
      STATUS := STATUS_1;

// Initialize TSAP strings in OB100
DB120.local_tsap_id[1]  := B#16#31;   // '1'
DB120.local_tsap_id[2]  := B#16#30;   // '0'
DB120.local_tsap_id[3]  := B#16#2E;   // '.'
DB120.local_tsap_id[4]  := B#16#30;   // '0'
DB120.local_tsap_id[5]  := B#16#32;   // '2'
DB120.rem_tsap_id[1]    := B#16#31;
DB120.rem_tsap_id[2]    := B#16#30;
DB120.rem_tsap_id[3]    := B#16#2E;
DB120.rem_tsap_id[4]    := B#16#30;
DB120.rem_tsap_id[5]    := B#16#31;

AG_SEND / AG_RECV Configuration on the S7-400

On the S7-400, the AG_SEND / AG_RECV blocks call the CP 443-1 over its logical base address. The CP's base address must be read from HW Config (Properties > CP 443-1 > Diagnostic). For a CP 443-1 in slot 4 of a CR2, the typical LADDR is W#16#2000 (decimal 8192) for input area and W#16#2001 for output area; the AG_SEND.LADDR points to the diagnostic base, typically one slot above the input area. Verify with the configuration dialog.

// OB1 cycle - call AG_SEND on the 414 side
CALL  FB12  , DB12
      ACT    := M10.0        // rising edge triggers a send job
      ID     := 1            // Connection ID 1 (matches NetPro)
      LADDR  := W#16#2000    // CP 443-1 diagnostic base
      SEND   := P#DB200.DBX0.0 BYTE 20   // 20 bytes from DB200
      LEN    := 20
      DONE   := M10.1
      ERROR  := M10.2
      STATUS := MW12;

// OB1 cycle - call AG_RECV on the 414 side
CALL  FB13  , DB13
      ID     := 1
      LADDR  := W#16#2000
      RECV   := P#DB201.DBX0.0 BYTE 20   // 20 bytes from DB201
      NDR    := M10.3
      ERROR  := M10.4
      STATUS := MW14;
      LEN    := MW16;

If MW12 (STATUS) = 7000 continuously, the block is in idle state: either ACT never rose, or the connection record has not been downloaded to the CP 443-1. Open NetPro, right-click the connection object, choose Connection Status (only available online) and confirm the connection shows established. If the status shows not established, the partner CPU is not in RUN, the CP is not online, or the TSAP negotiation failed.

Step-by-Step Commissioning Procedure

1. Verify cabling and IP plan. Connect CP 443-1 (port X1) and S7-300 PN (X2) to a managed switch. Assign static IPs in the same /24 subnet (e.g. 192.168.0.10 / 255.255.255.0 on the CP, 192.168.0.20 on the PN). Disable any firewall on the engineering PG and confirm a basic ping succeeds.
2. Configure HW Config. Open the S7-400 station, place the CPU 414-2 DP, place the CP 443-1 in slot 4, assign the IP address, set the diagnostic base LADDR (default OK in most projects). Open the S7-300 station, place the CPU 317-2 PN/DP, configure the integrated PN port (X2) with its IP, verify that the port is enabled in HW Config (Properties > Port X2 > "Port is used").
3. Create the NetPro connection. Follow the procedure in the previous section. Verify that the connection appears under both stations in NetPro with matching ID and TSAPs.
4. Compile and download. PLC > Compile and Download Objects. Both PLCs must be in STOP or RUN; download to both. The connection record now lives in the S7-300 connection DB (generated by NetPro) and in the CP 443-1 of the S7-400.
5. Build the user program. Declare DB120 (TCON_Param) on the S7-300 as shown above, and add FB12 / FB13 instances on the S7-400.
6. Trigger initial connect. In OB100 of the S7-300, set the initialize flag and call TCON with REQ = TRUE exactly once. TCON transitions REQ and reports DONE / STATUS. After a successful connect, the connection is owned by the PN port until TDISCON is called.
7. Drive cyclic data. Call TSEND / TRECV in OB35 on the S7-300, and AG_SEND / AG_RECV in OB1 or OB35 on the S7-400. Use a falling-edge monitor on ERROR to clear latching fault latches.

Verification and Diagnostics

After commissioning, run the following checks. Each check maps to a specific element of the topology.

For deeper diagnostics, open Online > Diagnostics > Communication in STEP 7 to view all ISO-on-TCP connections and their current state. On the CP 443-1, the diagnostic page lists the connection state as connection established, connection terminated, connection setup active, or no connection. Match the diagnostic output to the STATUS codes returned by AG_SEND/AG_RECV.

Advanced Troubleshooting

When the standard checks do not clear STATUS 7000 / 80B7, the following extended diagnostics apply.

Firmware and Compatibility

The CP 443-1 must be on a firmware version that supports ISO-on-TCP coexistence with the partner firmware. For S7-400 with S7-300 PN/DP combinations, the minimum recommended firmware is CP 443-1 V2.1.x (for the EX11 / EX20 / GX20 variants) and CPU 317-2 PN/DP V3.x. Mismatches below V2.0 on the CP produce intermittent 80B7 with a corrected TCON_Param. Apply firmware via the SIMATIC Manager > Options > Install Firmware dialog using the UPD file published in the Siemens Product Support portal.

Connection ID Collision

Connection IDs must be unique across the entire S7-300 station, not just per PN port. If the project also holds an S7 connection to a different CPU using ID 1, TCON with the same ID returns 80B1 (already established) on a duplicate attempt and 80B3 (parameter assignment error) on a re-attempt. Re-number the ISO-on-TCP connection to ID 2, 3, ... 16 (PN port limit is 16 connections).

Local TSAP ID Length Mismatch (the Original Symptom)

This is the specific defect that produced the symptoms in the source. In OB1 the original program copy-pasted a TCON_Param from a sample with local_tsap_id_len := W#16#10 (16), rem_tsap_id_len := W#16#10 (16), and rem_staddr_len := W#16#04 (4). With the actual TSAP "10.02" being 5 bytes, the PN stack reads bytes 6..16 of the local_tsap_id array - which were initialized to 0 - and constructs a TSAP of 10.02\0\0\0\0\0\0\0\0\0\0\0. The CP 443-1 rejects this because its TSAP declaration in NetPro is only 5 bytes. TCON returns 80B7. Correct both length fields to B#16#05 and the connection establishes.

Firewall and Port 102

ISO-on-TCP uses TCP port 102. Industrial firewalls (for example SCALANCE S with firewall enabled) drop port 102 unless an explicit rule allows it. If the project crosses a managed switch with ACLs, configure the ACL to permit TCP 102 from 192.168.0.0/24 to 192.168.0.0/24.

Active vs Passive

Only one side should set active_establish := TRUE. If both sides are active, TCON returns 80B4 / 80B7 depending on who wins the TCP handshake race. If neither side is active, the connection waits forever. Pick the controller that powers up first as active.

CP 443-1 in the Wrong Slot

If the CP 443-1 is moved between slots without updating HW Config, AG_SEND LADDR points to a non-existent logical address. The error is 80A1 (pointer error) or 80C3 (CP resource not available). Open HW Config and re-read the diagnostic base address.

Migrating to TIA Portal

For projects moving to TIA Portal V15.1 or later, the same topology is implemented as a PUT/GET or Open User Communication connection. TIA Portal automatically generates TCON_Param when the user adds an Open User Communication block (TSEND_C, TRCV_C, TCON, TDISCON) to the S7-300 PN/DP. For the S7-400 with CP 443-1, TIA Portal still exposes the AG_SEND / AG_RECV blocks under Instructions > Communication > Open User Communication. Importing the STEP 7 V5.x project retains the NetPro configuration, but the TCON_Param must still be reviewed for length accuracy because the import can default the TSAP lengths to 16.

From TIA Portal V16 onward the recommended pattern is to use TSEND_C / TRCV_C on both sides (these combine TCON + TSEND + TRECV into a single block) when the partner also supports the Open User Communication block set. For the S7-400 with CP 443-1, TSEND_C / TRCV_C is available in the CP 443-1 function set; verify firmware compatibility before migration.

Safety and Best-Practice Notes

• Do not mix ISO-on-TCP and TCP native traffic on the same connection - the connection_type byte selects the framing and is fixed per connection.
• Always initialize TCON_Param in OB100 (cold restart) so that the strings survive a STOP->RUN transition without re-initialization. Initializing in OB1 with conditional logic may produce intermittent 80B7 during a hot restart.
• Monitor ERROR rising edges and latch a global "Communication Fault" flag. Bring the process to a safe state when the flag is set; do not allow the application to consume stale data from the partner.
• For critical data, validate received bytes with a CRC or a sequence counter. AG_RECV / TRECV do not perform data integrity checks beyond what the underlying TCP stack provides.

Summary Checklist

1. CP 443-1 placed in STEP 7 project, IP and LADDR configured, firmware >= V2.1.
2. S7-300 PN/DP port X2 configured with IP and subnet, port enabled.
3. NetPro connection created, ID 1, ISO-on-TCP type, TSAPs configured symmetrically.
4. NetPro compiled and downloaded to both stations.
5. DB120 (TCON_Param) on the S7-300 populated with block_length = 64, connection_type = B#16#12, TSAP strings byte-accurate, TSAP lengths matching the string lengths.
6. FB12 / FB13 called on the S7-400 with the correct LADDR (CP 443-1 diagnostic base) and ID 1.
7. TCON called once in OB100 to establish the connection.
8. TSEND / TRECV on the S7-300 and AG_SEND / AG_RECV on the S7-400 drive the data exchange.
9. Diagnostics verified: CP 443-1 status = established, AG_SEND transitions 7000 -> 7001 -> 7002, TCON RET_VAL = 0000, TRECV NDR pulses per receive.