Configuring Open TCP Socket Communication (TCON, TSEND, TRCV) Between PCS 7 and Allen-Bradley ControlLogix

Establishing open Ethernet TCP socket communication between a SIMATIC PCS 7 controller (such as CPU 410-5H or CPU 410E) and an Allen-Bradley ControlLogix PLC (via 1756-EN2T) requires utilizing standard Open User Communication (OUC) blocks: TCON (FB65), TSEND (FB63), TRCV (FB64), and TDISCON (FB66). Status codes #7000 (idle) and #7002 (connection in progress), followed by #70A1 on TSEND/TRCV, occur when connection parameters mismatch active/passive roles, when TSAP/port lengths are misconfigured, or when the remote socket is closed. Exactly one partner must be configured for active establishment (active_est = TRUE), the remote port must match the partner's listening port, and local_device_id must point to the integrated PN interface (16#05).

Open User Communication (OUC) Architecture Between S7-400 and ControlLogix

In industrial automation facilities with hybrid vendor architectures, plant engineers frequently need to exchange continuous process telemetry between a SIMATIC PCS 7 distributed control system (e.g. CPU 410-5H 6ES7410-5HX08-0AB0 or CPU 410E 6ES7410-5HM08-0AB0) and third-party programmable logic controllers, such as an Allen-Bradley ControlLogix system equipped with an EtherNet/IP communication module (1756-EN2T).

Because native S7 communication (PUT / GET or BSEND / BRCV) is proprietary to Siemens, cross-vendor Ethernet communication is typically implemented using raw Open TCP/IP Sockets. In PCS 7, this is handled via standard Open User Communication (OUC) function blocks:
- TCON (FB65): Allocates communication resources and initiates the TCP 3-way handshake.
- TSEND (FB63): Transmits byte streams across the established socket.
- TRCV (FB64): Receives incoming byte streams into a destination data block.
- TDISCON (FB66): Terminates the socket connection and releases controller memory.

Root Causes of OUC Connection Errors: Status 7000, 7002, and 70A1

When commissioning open socket communication, engineers frequently encounter persistent status codes that prevent data exchange:

Status Code 16#7000: Indicates that no job is currently in progress (REQ = 0). The block is idle.
Status Code 16#7002: Indicates that connection establishment is currently running. If the block remains stuck at 16#7002, the active partner is sending TCP SYN packets, but the passive partner is not responding (port closed, firewall blocking, or incorrect IP address).
Error Code 16#70A1 on TSEND / TRCV: Indicates: Communications error: The specified connection ID does not exist or is currently being terminated. Calling TSEND or TRCV while TCON is still stuck at 16#7002 (or after TCON failed) triggers 16#70A1 immediately.
Active/Passive Role Collision: TCP sockets require exactly one client (Active initiator) and one server (Passive listener). If both PCS 7 and ControlLogix are set to Active (active_est = 1), both send SYN packets simultaneously, causing connection collision. If both are Passive (active_est = 0), both listen indefinitely and no connection is ever established.

TCON_PAR Connection Data Structure and Parameter Assignments

The configuration of TCON is governed by a user data block containing the standardized UDT 65 (TCON_PAR) structure:

block_length: Length of parameter block (typically 16#40 / 64 bytes).
id: Unique communication connection identifier within the CPU (e.g. 16#0014 / 20 decimal).
connection_type: Protocol type: 16#11 (TCP native) or 16#01 (TCP compatible).
active_est: TRUE (Active / Client) or FALSE (Passive / Server).
local_device_id: For integrated PROFINET interface of CPU 410, set to 16#05 (or 16#03 on classic CP 443-1).
local_tsap_id_len / rem_tsap_id_len: In native TCP mode, the port number is represented as a 2-byte hexadecimal value. The length MUST be set to 16#02 (2 bytes). Setting length to 0 prevents port binding!
local_tsap_id / rem_tsap_id: The 2-byte port number (e.g. port 2849 decimal = 16#0B21).
rem_staddr: Array of 4 bytes containing the remote partner's IPv4 address.

Comparison of Communication Roles: PCS 7 vs Allen-Bradley ControlLogix

The following table details the necessary parameter pairing for PCS 7 Client vs Server roles:

Configuration ParameterConfiguration A: PCS 7 as Client (Active)Configuration B: PCS 7 as Server (Passive)PCS 7 active_estTRUE (Active)FALSE (Passive)AB ControlLogix RoleServer (Passive listener via Socket Listen AOI)Client (Active initiator via Socket Connect AOI)PCS 7 local_tsap_id_len16#00 (Dynamic local port assigned by OS)16#02 (Listening port length: 2 bytes)PCS 7 local_tsap_idUnused (16#0000)Listening port (e.g., 16#0B21 for 2849)PCS 7 rem_tsap_id_len16#02 (Remote server port length: 2 bytes)16#00 (Any remote client allowed)PCS 7 rem_tsap_idAB Server Port (e.g., 16#0B21 for 2849)Unused (16#0000)PCS 7 rem_staddrIP Address of 1756-EN2T card (Hex array)IP Address of 1756-EN2T (or zeroes for any)Recommended RoleRecommended (PCS 7 controls data polling cycles)Alternative (AB controls connection timing)

Step-by-Step Procedure to Configure TCON and Socket Communication

Follow this procedure to establish error-free open TCP communication from PCS 7 to ControlLogix:

Define the Shared Parameter DB in STEP 7:
- Create a shared data block (e.g. DB100) containing UDT 65 (TCON_PAR).
- Set id = 16#0014, connection_type = 16#11, and local_device_id = 16#05 (for CPU 410 PN interface).
- If configuring PCS 7 as Client: set active_est = TRUE, local_tsap_id_len = 16#00, rem_tsap_id_len = 16#02, rem_tsap_id = 16#0B21 (port 2849), and enter the EN2T IP in rem_staddr.
Implement Communication Control Logic in CFC:
- In the CFC chart, insert TCON (FB65), TSEND (FB63), and TRCV (FB64).
- Interconnect input CONNECT of TCON to DB100.
- Apply a rising edge on TCON.REQ. Monitor TCON.STATUS.
- When TCON.DONE = 1, TCON.STATUS transitions to 16#0000 (Connection established).
Synchronize TSEND and TRCV Execution:
- Only trigger TSEND.REQ when TCON.STATUS = 16#0000.
- Set TRCV.EN_R = 1 continuously to accept incoming packets.
- Point DATA pointers of TSEND and TRCV to dedicated array DBs (e.g. 100 DINT array = 400 bytes).
Configure Rockwell ControlLogix Side:
- In Studio 5000, import the Rockwell Open Sockets AOI (Socket_Create, Socket_Open, Socket_Listen or Socket_Connect).
- Ensure the 1756-EN2T module firmware supports open sockets and port 2849 is open on the industrial firewall.

Verification

Verify socket communication and packet transfer:
1. In CFC Online test mode, verify that TCON.STATUS = 16#0000 and TCON.BUSY = 0.
2. Trigger a single send cycle: pulse TSEND.REQ. Confirm that TSEND.DONE = 1 and TSEND.STATUS = 16#0000.
3. In Rockwell Studio 5000, inspect the destination DINT array tag; verify that the 100 DINT values match the values transmitted from PCS 7.
4. Transmit data from ControlLogix; verify that TRCV.NDR = 1 (New Data Received) and the received data block in PCS 7 updates.

Limitations and Operational Precautions

Byte Ordering / Endianness Conversion: Rockwell ControlLogix processors are Little-Endian (Intel), while Siemens S7-400 CPUs are Big-Endian (Motorola). 32-bit DINT and REAL values transmitted across raw TCP sockets will arrive byte-swapped unless converted using byte-reversal logic (SWAP / CAW).
TCP Streaming Packet Fragmentation: TCP is a stream-based protocol, not message-based. If TRCV is configured with a variable length, multiple send packets can be coalesced or fragmented. Always configure fixed-length byte transfers (e.g. LEN = 400) with ad-hoc mode disabled.
Socket Resource Limits: The integrated PN interface of CPU 410-5H supports up to 120 total open communication connections. Ensure communication blocks close sockets properly via TDISCON during communication recovery.

Engineer FAQ

Why does TSEND report error #70A1?

Error 16#70A1 indicates that the connection ID passed to TSEND does not exist or has not been established. This occurs when TSEND is triggered before TCON has finished its handshake or after TCON aborted with an error.

What does local_device_id = 16#05 mean in CPU 410?

local_device_id = 16#05 designates the integrated PROFINET interface (X1) on S7-400 CPUs and CPU 410-5H controllers. Setting an incorrect ID prevents the CPU operating system from routing socket packets to the physical Ethernet port.

How do I fix byte-swapping between Siemens and Allen-Bradley?

You must swap the four bytes of each 32-bit DINT or REAL. In PCS 7, this can be done in SCL using the ROR / ROL instructions or by moving bytes through a union/structure; in ControlLogix, use the SWPB (Swap Byte) instruction.