WinLC RTX TCP Communication: S7 Protocol Setup Guide

Overview

WinLC RTX is the Siemens software controller that emulates an S7-300 CPU on a Windows host extended with the IntervalZero RTX real-time subsystem. Engineers migrating from a physical CPU315 (or CPU314/315-2 DP) frequently attempt to reuse the existing tcp_test.exe style Send/Receive (T) communication and find that the connection fails with a runtime internal error. The root cause is structural: WinLC RTX does not execute the S7-300 T communication function blocks because those blocks require the SIMATIC communications stack on a CP or on-board PN interface, neither of which is exposed in the soft controller.

This reference documents the supported communication paths in WinLC RTX, the configuration of the PG/PC interface, the S7 connection model, and the SOFTNET S7 Lean / OPC route used to talk to WinLC RTX from a standard PC application written in C# or C++. The guidance aligns with the WinAC / WinLC RTX documentation on the Siemens Industry Online Support portal.

Prerequisites

• WinLC RTX V4.5 or later installed on a Windows PC with the IntervalZero RTX runtime matched to the WinLC version (per the WinLC RTX manual chapter "System requirements").
• Siemens SIMATIC NET PC software: SOFTNET S7 Lean (or SOFTNET-S7 / S7-1613 depending on the bus) for S7 communication, or SIMATIC NET OPC server for OPC DA/UA access.
• Industrial Ethernet CP1613 / CP1623 / CP1616 PCIe card (or onboard Intel/Realtek NIC accepted by SIMATIC NET) configured for the ISO or TCP protocol stack.
• STEP 7 (TIA Portal or classic) project with the WinLC RTX slot configured as CPU315-compatible or as a WinLC RTX 1500/400 (S7-1500 emulation, requires WinLC RTX V4.6+).
• PG/PC interface assignment consistent on both the WinLC RTX side and the developer PC side.

Why T Communication Fails on WinLC RTX

The S7-300 T communication system (FB63 TSEND / FB64 TRCV, FB65 TCON, FB66 TDISCON, plus U-/B-variants) relies on a CP firmware stack that handles ISO transport, TCP keep-alive, and the RFC 1006 framing. On a CPU315-2 PN/DP, this stack lives in the CPU firmware and is reachable from user OB1/OB35 via the SFB/SFC interface. WinLC RTX, in contrast, exposes only the S7 user-interface side of the S7-300 architecture: OB, FB, FC, SFB, SFC, and the process image. The communication endpoints are exported as a SIMATIC NET station, not as raw BSD sockets.

When tcp_test.exe opens a Winsock socket to the IP of the WinLC RTX host and sends an ISO-on-TCP TPDU, three things can happen:

1. No listening socket: WinLC RTX does not start the T connection endpoint. connect() returns WSAECONNREFUSED (10061) on the client.
2. Wrong port: even when 102/tcp is forwarded by SIMATIC NET, the handshake TPDU is rejected because the WinLC RTX slot is not bound to the ISO transport selector for that connection.
3. Slot not registered: SIMATIC NET logs "internal error" or "resource unavailable" (OPC E_FAIL, S7 err 0x0A0A) because the configured partner is the local WinLC RTX, but no CP-side connection is loaded in the STEP 7 project (NetPro / device configuration).

The fix is not a code patch; it is a change of transport. Use S7 communication, not T communication.

Supported Communication Paths in WinLC RTX

The WinLC RTX manual defines four PG/PC interface assignments that determine how external software reaches the soft CPU. The choices are configured from the WinLC RTX control panel under CPU > Setting the PG/PC Interface.

All four paths terminate the same way at the application layer: an S7 connection (PUT/GET, USEND/URCV as S7 communication — not the S7-300 T blocks) or OPC.

Configuring the PG/PC Interface for WinLC RTX

1. Open the WinLC RTX control panel from the Windows Start menu or from the system tray icon.
2. Select CPU > Setting the PG/PC Interface. The Set PG/PC Interface dialog from SIMATIC NET opens.
3. Choose the interface used for development: typically S7ONLINE (STEP7) → TCP/IP → <your NIC> for a standard Ethernet card, or S7ONLINE (STEP7) → ISO Ind. Ethernet → <CP161x> if a Siemens Industrial Ethernet card is installed.
4. Click Diagnostics and confirm the NIC shows reachable before continuing.
5. From STEP 7 or TIA Portal, open the project, right-click the WinLC RTX station, and select Download > Target system with the same interface assignment. Successful download confirms the S7 routing works.

If H1 (Industrial Ethernet) is the desired path, the manual explicitly notes: "If you are using H1 as your network communication path, select the TCP/IP" assignment for the Intel NIC case; the ISO assignment is used only with a CP161x. Mixing the two on the same host causes the WinLC RTX slot to start in a state where it does not accept incoming PUT/GET.

Replacing the T-Block Link With S7 Communication

The S7 communication model is bidirectional and connection-oriented. From the WinLC RTX (server) side, a partner connection is declared in NetPro or in the device configuration of TIA Portal. From the client side (your VB/C# program), SOFTNET S7 Lean provides the API.

Step 1 — Define the S7 Connection in STEP 7 / TIA

1. In the WinLC RTX station, open NetPro (STEP 7 V5.x) or the Devices & Networks editor (TIA Portal).
2. Insert a new S7 connection on the WinLC RTX CPU. Set the partner to "unspecified / PC station" with the IP of the SOFTNET S7 Lean host.
3. Set the connection ID (locally and remotely) and the connection name. Note the local ID: this is the handle used by the WinLC RTX-side SFB calls (SFB12 BSEND, SFB13 BRCV, SFB8 USEND, SFB9 URCV — the S7-400 SFBs that are also available on WinLC RTX V4.5+).
4. Download the connection configuration to WinLC RTX.

Step 2 — Install SOFTNET S7 Lean on the PC Application Host

SOFTNET S7 Lean is the lean license of the SIMATIC NET S7 programming interface. It exposes the same functions used by STEP 7: S7_GET, S7_PUT, S7_ASYNC_READ, S7_ASYNC_WRITE, and connection lifecycle calls S7_SET_TARGET, S7_CONNECT, S7_DISCONNECT, and the multi-block call S7_MULTI_READ / S7_MULTI_WRITE. The DLL is s7onlinx.dll for the C/C++ interface and S7.Net for the OPC-based managed wrapper.

Step 3 — Map the Old T-Block Data Layout

T communication carries a length-prefixed byte stream. S7 communication carries S7 data blocks: each item is a typed address (DB1.DBD0 = DWORD, DB1.DBB10 = BYTE array of 32). Convert the T-block payload into a flat data block and reference it from both sides.

Sample C# Application Using SOFTNET S7 Lean

The following example targets a 32-bit or 64-bit Windows PC with SOFTNET S7 Lean installed. It opens a connection to a WinLC RTX running on host 192.168.0.10, rack 0 slot 2, reads 32 bytes from DB1 starting at byte 0, and writes 4 bytes back to DB1.DBD0. Reference the S7.Net NuGet package or the underlying s7onlinx.dll via P/Invoke.

using S7.Net;
using System;

class WinLCClient
{
    static void Main()
    {
        // WinLC RTX exposes a S7-300-compatible slot. Rack 0, Slot 2 is default.
        var plc = new Plc(CpuType.S7300, "192.168.0.10", 0, 2);
        plc.Open();
        if (plc.IsConnected)
        {
            // Read 32 bytes from DB1 starting at byte 0
            byte[] rx = plc.ReadBytes(DataType.DataBlock, 1, 0, 32);
            Console.WriteLine($"RX[0..3] = {rx[0]:X2} {rx[1]:X2} {rx[2]:X2} {rx[3]:X2}");

            // Write a DWORD to DB1.DBD0 (bytes 0..3)
            plc.WriteBytes(DataType.DataBlock, 1, 0, new byte[] { 0xDE, 0xAD, 0xBE, 0xEF });

            plc.Close();
        }
        else
        {
            Console.WriteLine("S7 connection to WinLC RTX failed");
        }
    }
}

For native C/C++ the equivalent is S7_GET_EX(pConn, AREA_DB, 1, 0, 32, pBuf, &pCount) and S7_PUT_EX(pConn, AREA_DB, 1, 0, 4, pBuf, &pCount) after a successful S7_SET_TARGET and S7_CONNECT. Header files and the full function reference are in the SIMATIC NET Programming Interface manual that ships with SOFTNET S7 Lean.

OPC Path (Optional, Slower, but Zero Coding)

If writing a DLL client is undesirable, install the SIMATIC NET OPC server on the same PC as WinLC RTX and access variables through OPC DA 2.0 / 3.0 or OPC UA. The OPC server reads the same S7 connection configuration; the client just subscribes to items such as S7:[WinLC]DB1,BYTE0,32 or browses the address space by symbolic name.

Advantages of OPC over a custom DLL:

• No code: SCADA tools (WinCC, Ignition, FactoryTalk) connect directly.
• Symbolic names resolve server-side; client need not know offsets.
• DA 1.0..3.0/UA covers the same PUT/GET semantics.

Disadvantages:

• Latency is dominated by the OPC refresh group (typical 100 ms to 1 s).
• Add-on licensing (SIMATIC NET OPC server + S7-1613 or S7-1613 Lean variant).

Diagnostics and Error Codes

When SOFTNET S7 Lean or a S7-300-style SFB on WinLC RTX returns an error, the status word uses the S7-300 numbering. The most common failure modes observed in the field are listed below.

Verifying the S7 Stack from the Command Line

SIMATIC NET ships a small diagnostic utility s7dbstat.exe and the "S7 Connection Diagnostics" tool. From the WinLC RTX host, run s7dbstat /all and confirm the configured connection shows STATUS = ESTABLISHED and PARTNER IP is the SOFTNET S7 Lean host. On the SOFTNET host, the same tool lists the connection from the local view.

Performance and Timing Notes

WinLC RTX shares the host CPU with Windows. Time-slice priority must be raised on the RTX subsystem (refer to the WinLC RTX manual chapter "Execution of the WinLC RTX control program") and the WinLC RTX execution time setting should leave at least 30% headroom for the SIMATIC NET PC station. The WinAC RTX documentation appendix discusses the trade-off in detail: a smaller WinLC RTX cycle reduces jitter for S7 communication, while a larger cycle improves the Windows-side responsiveness for HMI/SCADA.

Migration Checklist From CPU315 T Communication

1. Inventory every T-block instance in the STEP 7 project: FB63 TSEND, FB64 TRCV, FB65 TCON, FB66 TDISCON, plus the U-/B-variants.
2. For each T-block, identify the partner IP, port (always 2000/2001 for S7-300 ISO), and the byte payload.
3. Replace the T-block pair with S7 connection objects in NetPro and the SFB12/13 or SFB8/9 blocks on the WinLC RTX side.
4. Add DBs that hold the payload and map the byte layout to typed variables.
5. Configure the PC station running SOFTNET S7 Lean (or the SIMATIC NET OPC server) and download the PC station configuration with the same connection ID.
6. Rework the VB/C# program to use S7_GET/S7_PUT (or S7.Net) instead of Winsock calls.
7. Validate with the S7 Connection Diagnostics tool on both sides; both must show ESTABLISHED before the first user data exchange.

Limitations and Edge Cases

• WinLC RTX V4.5 and earlier: The SFB12/SFB13 Bsend/Brcev blocks are present but only one outstanding call per R_ID is supported. Multi-R_ID streaming requires WinLC RTX V4.6+.
• WinLC RTX 1500 (S7-1500 emulation): The S7-1500 user-side blocks (TSEND_C, TRCV_C) are available, but only when the project is compiled with a WinLC RTX 1500 slot. Mixing S7-300 and S7-1500 blocks in the same project is rejected by the compiler.
• PROFINET IO controller: WinLC RTX can be a PROFINET IO controller on a CP1616. The S7 communication runs in parallel, but the PROFINET cycle locks out Windows for the IO update window. Plan cycle time ≥ 1 ms.
• Security: S7 communication in plain mode has no authentication. Put WinLC RTX behind a firewall or use the Security variant of SOFTNET S7 (TLS 1.3) for untrusted networks.
• Determinism vs. throughput: The RTX subsystem gives a deterministic user cycle (1 ms typical) but the S7 communication jobs run in the SIMATIC NET PC station, not in the RTX thread. The S7 latency on a 100 Mbit link is dominated by the Windows scheduler when many HMI tags are subscribed.

Verification Procedure

1. From the WinLC RTX host, open a command prompt and run ping <SOFTNET host>. The reply must be < 1 ms on a switched LAN.
2. Open the SIMATIC NET Configuration Console and confirm the S7 connection is listed with status = active on both the local and partner sides.
3. Launch the diagnostic client s7dbstat (or the S7 Connection Diagnostics GUI). Trigger a single PUT/GET and confirm the data block on WinLC RTX is updated within the timing table above.
4. Force a STOP/RUN transition of WinLC RTX and re-run the test. The S7 connection must re-establish automatically; if it does not, increase the connection monitoring time on the S7 connection object from the default 30 s to 10 s.
5. Capture a Wireshark trace on the link filtered to tcp.port == 102 and confirm the S7 TPDU sequence is COTP CR/CC then S7 ROSCTR Job (PUT/GET) and Ack_Data. Raw ISO-on-TCP frames with no S7 payload indicate the wrong transport and the original T-block design is still in use.