Troubleshooting TCON TCP Connection on CPU 1510SP-1 PN in TIA

Troubleshooting TCON TCP Connection on CPU 1510SP-1 PN in TIA Portal

Open User Communication over TCP using the TCON, TSEND, and TRCV instructions is the standard method for exchanging application data between a SIMATIC S7-1500 / ET 200SP CPU and a Windows PC application. When the TCON instruction reports BUSY = 0 with ERROR = 1 and a status code in STATUS, the connection is never established and the higher-level handshake never completes. The most common root cause on a 6ES7510-1DJ00-0AB0 ET 200SP CPU is a misconfigured TCON instance DB, an active/passive partner mismatch, a blocked PC firewall port, or an out-of-date TIA Portal version that does not match the CPU firmware.

1. Affected Hardware, Firmware, and Software

The 6ES7510-1DJ00-0AB0 is the ET 200SP CPU 1510SP-1 PN with a display, work memory of 150 KB code / 750 KB data, and a single PROFINET interface (X1) on board. Its integrated PN interface supports up to 64 open communication connections (TCP, ISO-on-TCP, UDP) plus the PROFINET and S7 connections. TCON instances on the S7-1500 use connection IDs 1..64 by default; any custom IDs must be unique and within the CPU-supported range. Document the Connection ID, Local TSAP / Port, and Partner IP / Port in the project before commissioning.

2. Problem Symptoms

The reported failure presents with one or more of the following field symptoms:

• TCON output BUSY = 0, ERROR = 1, and STATUS = 16#80??_????.
• TSEND never reaches DONE = 1; BUSY oscillates briefly then returns to ERROR.
• The PC application reports "connection refused" (Winsock error 10061), "connection timed out" (10060), or "host unreachable" (10065) instead of seeing the TCP SYN/ACK handshake.
• Wireshark on the PC shows TCP SYN sent by the PLC, no SYN-ACK from the PC, then retransmits and a final RST from the PC.
• The TCON block in TIA Portal offline/online view is shown as a red instruction rather than green-active, indicating the call has not been enabled or the instance is wrong.

3. Root Cause Analysis

Open User Communication on the S7-1500 has six root-cause categories. Each one is mapped to the failure mode above so that the diagnosis path is unambiguous.

3.1 Active vs. Passive Partner

A TCP connection has exactly one side that issues SYN (active / client) and one side that listens (passive / server). On the S7-1500, the role is set by the Connection type and Active connection establishment check box in the TCON configuration dialog (TIA Portal > PLC > Devices & Networks > Connections). When the TCON instance is marked as active, the PLC will send the SYN; the PC must then be a TCP server bound to the same port. The reverse is also valid, but both sides must agree on the direction. Wireshark will show SYN from the active side only. If both are active, the handshake fails on the second SYN-ACK.

3.2 TCON DB Configuration

The TCON instruction requires an instance DB whose TCON_Param structure holds the connection parameters. A typical TIA Portal-generated TCON_Param for an ET 200SP CPU client connecting to a PC server on TCP port 2000 looks like this:

DATA_BLOCK TCON_DB
  { S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
  STRUCT
    TCON_Param : TCON_Param; // 64 bytes
  END_STRUCT;
END_DATA_BLOCK

// TCON_Param field values
// BlockLength    = 64
// ConnectionId   = 1                       // local handle, must be unique
// ConnectionType = 16#0B (TCP/IP)          // 16#0B = TCP, 16#0C = ISO-on-TCP, 16#0D = UDP
// ActiveEstablishment = TRUE              // PLC is client
// RemoteAddress   = '192.168.0.42'        // partner IP, IPv4 string
// RemotePort      = 2000                   // partner port
// LocalPort       = 0                      // any free local port when PLC is client
// LocalTSAPId     = 16#0000                // not used for TCP, but must be present
// RemoteTSAPId    = 16#0000
// NextStSendLen   = 0
// NextStRecvLen   = 0

4. TCP Connection Architecture

The PC SYN/ACK is generated by the socket layer of the operating system, not by the application. Therefore, even if the PC application is not started, the SYN-ACK should be returned by the OS as long as a server is bound. If no SYN-ACK appears in Wireshark, the failure is either the firewall, the IP/port pair, or the PC network stack itself.

PLC 1510SP (192.168.0.10)               PC (192.168.0.42:2000)
  |                                        |
  |----- SYN  src=49152 dst=2000 --------->|  (active establishment)
  |                                        |
  |<---- SYN,ACK src=2000 dst=49152 ------|  (passive, OS replies)
  |                                        |
  |----- ACK  src=49152 dst=2000 --------->|  (handshake complete)
  |                                        |
  |----- TSEND: 64 bytes ---------------->|  (data)
  |                                        |

If the PC is the active side, the arrow direction is reversed and the PLC's ActiveEstablishment must be FALSE; the local port then defaults to 2000 (or whatever is configured) and the PC's SYN targets that port.

5. Block Set and Call Wiring

The complete instruction set for an S7-1500 TCP client to PC server looks as follows. All blocks live in the "Communication" extended-instructions palette of TIA Portal V13 SP1 Update 4 and later.

Wire the instructions as follows. TCON fires on the rising edge of a start flag, the connection ID is taken from the TCON_Param structure, and the CONNECT input is a DB_ANY / VARIANT pointer to the parameter DB. TSEND uses the same ID and a user-defined DATA buffer; TRCV uses the same ID and an LEN of 0 to receive ad-hoc (any length up to the buffer size). The T_DIAG block should be called in the same OB1 cycle to surface status changes immediately.

6. Step-by-Step Configuration Procedure

6.1 Prerequisites

• TIA Portal V13 SP1 Update 4 (or higher) installed and licensed.
• CPU 6ES7510-1DJ00-0AB0 with firmware V1.6 or higher online.
• ET 200SP station with a BaseUnit type B (BU15-P16+A0+2B or similar) for the CPU.
• PC reachable on the same PROFINET subnet, with a static IP address.
• Wireshark installed on the PC for live capture.
• Windows administrator rights to open firewall rules.

6.2 Configure the TCON Instance DB

1. In the project tree, expand Program blocks and add a new block of type DB; name it Inst_TCON.
2. Open the DB and add a variable of type TCON_Param named TCON_Param. TIA Portal will scaffold all sub-fields automatically.
3. Set BlockLength = 64 (mandatory), ConnectionId = 1, ConnectionType = 16#0B for TCP.
4. Set ActiveEstablishment = TRUE (PLC is client) and enter the partner IP and port.
5. Compile the DB. Verify that the offline view shows the instruction block in green (active) and not red. A red instruction usually means the call is on a non-existent instance or the wrong block number.
6. Download the DB to the CPU.

6.3 Wire TCON, TSEND, and TRCV in OB1

1. From the Instructions palette, open Communication > Open User Communication.
2. Drag TCON into OB1. Connect REQ to a start flag (e.g., StartConn) and CONNECT to "Inst_TCON".TCON_Param.
3. Drag TSEND into OB1, immediately after TCON. Connect ID to the constant 1, DATA to your send buffer tag (e.g., DB_Send), and LEN to the byte length.
4. Drag TRCV into OB1. Connect EN_R to a permanent TRUE, ID = 1, DATA = receive buffer tag, and LEN = 0 (ad-hoc length).
5. Compile and download the OB1 to the CPU.

6.4 Configure the PC Server

1. On the PC, ensure the application opens a TCP listening socket on the configured port (e.g., 2000) and binds to 0.0.0.0 or the PLC-facing NIC IP.
2. Open Windows Defender Firewall with Advanced Security and add an inbound rule for the port: protocol TCP, local port 2000, action allow, profile domain+private+public. Disable the rule only for testing; do not leave it disabled in production.
3. Start Wireshark, capture on the PLC-facing interface, and apply a display filter such as tcp.port == 2000 or ip.addr == 192.168.0.10.
4. Trigger the TCON job from the PLC (set StartConn). The PLC should issue a SYN; the PC should reply with SYN, ACK.

6.5 Verify Connection State

After the handshake completes, verify three independent sources of truth:

1. Wireshark: a complete SYN -> SYN,ACK -> ACK exchange followed by data segments and ACK responses.
2. PLC online diagnostics: in TIA Portal, go to Online & Diagnostics > Diagnostics > Connection overview and confirm the connection ID is in Established state.
3. Application feedback: TCON.DONE = 1, TCON.ERROR = 0; TRCV.NDR pulses each time a new datagram arrives.

7. Network and Firewall Requirements

PROFINET networks typically use 100 Mbit/s or 1 Gbit/s full-duplex, and the integrated interface X1 of the 6ES7510-1DJ00-0AB0 supports 10/100 Mbit/s. The interface must be assigned a unique IPv4 address in the same subnet as the PC; the default PROFINET device name is empty and must be assigned through TIA Portal or the primary setup tool.

8. TIA Portal Version and HSP Compatibility

TIA Portal V13 SP1 was released in late 2014 and reached general stability with the Update 4 patch in 2015. The Open User Communication instructions of that era were known to emit TCON_Param structures that newer CPU firmware versions would reject with a non-zero STATUS on the first TCON call. The mitigation is straightforward: install the latest Update of the installed TIA Portal version, or upgrade to a newer TIA Portal major release (V14, V15, V15.1, V16, V17) with the matching HSP (Hardware Support Package) for the CPU. The CPU firmware is updated through TIA Portal or the SIMATIC Automation Tool, and the firmware version on the 6ES7510-1DJ00-0AB0 must be V1.6 or higher to operate with modern TIA Portal revisions.

When mixing versions, the rule is simple: the TIA Portal project version must be greater than or equal to the CPU firmware version, with a matching HSP installed. An older project opened in a newer TIA Portal will be upgraded automatically; a newer project opened in an older TIA Portal is blocked.

9. Data Stream Handling on the PC

TCP is a byte stream protocol, not a datagram protocol. There is no one-to-one mapping between a TSEND call and a recv() call on the PC. Two or more TSEND calls may be concatenated into a single recv(), and a single TSEND may be split across two recv() calls. The standard remedy is a length-prefixed protocol:

[ 4 bytes: payload length N ][ N bytes: payload ]

The PC application first reads 4 bytes, parses the integer, then reads exactly N bytes. The PLC side either appends the length header manually or, in TIA Portal V14 and later, uses the NextStSendLen field of TCON_Param together with a structured send block. Wireshark is the fastest way to confirm the framing: filter tcp.stream eq <stream_index> and follow the TCP stream to see how the application layer bytes are actually grouped.

10. Verification Checklist

11. Troubleshooting Matrix

12. Diagnostics with T_DIAG and Online Tools

The T_DIAG instruction returns a structured DIAG tag that mirrors the connection state. Bind it to a global DB and monitor the Status, Kind, and Detail fields. The Status field value of 0 means "connection not configured", 1 means "connection being established", 2 means "connection established", 3 means "connection being terminated". When Status never moves past 1, the handshake is stuck on the wire, almost always due to one of the causes listed in section 3.

Complement T_DIAG with TIA Portal's Online & Diagnostics > Diagnostics > Connection overview, which shows every configured connection and its current state. Right-click on the connection to get a hex dump of the internal state, including the last error, retry counters, and last successful I/O timestamp.

13. Field-Proven Cautions

• Always download both ends. An edited TCON DB on the PLC without re-downloading the program block leaves the CPU running on the previous version of the connection descriptor, and the TCON call silently fails.
• Watch the green / red indicator. In TIA Portal, click outside the instruction block to verify the call is green (active). A red call means the instance does not exist or the call chain is broken.
• Do not leave the firewall disabled. A temporary disable is acceptable during commissioning; for production, add a scoped inbound rule.
• Use Wireshark as a truth source. If the application reports a fault but Wireshark shows a healthy exchange, the bug is in the application. If Wireshark shows a stalled exchange, the bug is in the network or configuration.
• Do not rely on auto-assigned local ports. When the PLC is the active side, leave LocalPort = 0 and the OS will pick a free ephemeral port. When the PLC is the passive side, set the LocalPort explicitly to the well-known port the PC expects.
• Document the connection ID space. S7-1500 / ET 200SP CPUs support up to 64 open user communication connections. Keep a table of used IDs in the project to prevent collisions when adding more devices.

14. Reference Implementation: ST Snippet for OB1

The following Structured Text snippet illustrates the canonical call pattern. Adapt the tag names to your project.

// OB1 - SCL
IF "StartConn" AND NOT "StartConn_Old" THEN
    "Inst_TCON".REQ := TRUE;                       // rising edge triggers connect
END_IF;
"StartConn_Old" := "StartConn";

"Inst_TCON"(
    REQ     := "Inst_TCON".REQ,
    ID      := 1,
    CONNECT := "Inst_TCON".TCON_Param,
    DONE    => "TCON_Done",
    BUSY    => "TCON_Busy",
    ERROR   => "TCON_Error",
    STATUS  => "TCON_Status"
);

IF "TCON_Done" THEN
    "Inst_TCON".REQ := FALSE;
END_IF;

IF "TCON_Done" AND NOT "TCON_SendBusy" THEN
    "Inst_TSEND"(
        REQ     := TRUE,
        ID      := 1,
        LEN     := 64,
        DATA    := "DB_Send",
        DONE    => "TCON_SendDone",
        BUSY    => "TCON_SendBusy",
        ERROR   => "TCON_SendError",
        STATUS  => "TCON_SendStatus"
    );
END_IF;

"Inst_TRCV"(
    EN_R    := TRUE,
    ID      := 1,
    LEN     := 0,                                    // ad-hoc length
    DATA    := "DB_Rcv",
    NDR     => "TCON_RcvNDR",
    BUSY    => "TCON_RcvBusy",
    ERROR   => "TCON_RcvError",
    STATUS  => "TCON_RcvStatus",
    RCVD_LEN=> "TCON_RcvLen"
);

15. Official Documentation References

• Setting up Open User Communication via TCP, ISO-on-TCP, UDP and ISO — Siemens TIA Portal manual, ET 200SP function manual collection.
• SIMATIC S7-1500 / ET 200SP Communication Function Manual (entry IDs 59191779, 109751826 on the Siemens Industry Online Support portal).
• CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0) device manual and operating instructions on the Siemens Industry Online Support portal.

FAQ