Implementing One-Sided S7 Communication (PUT and GET) Between PCS 7 and Non-PCS 7 Controllers

Interfacing a SIMATIC PCS 7 AS controller (e.g., AS 410-5H) with non-PCS 7 controllers (such as S7-1200, S7-1500, or classic S7-300/400) without configuring connection partners on the third-party CPUs is implemented using one-sided S7 connections with PUT (FB15) and GET (FB14) communication blocks. In NetPro, an unspecified S7 connection is created on the PCS 7 controller targeting the remote CPU IP address with partner connection resource 03 (hex). Crucially, for remote S7-1200 and S7-1500 controllers, the target Data Blocks must have 'Optimized block access' disabled, and the CPU security option 'Permit access with PUT/GET communication from remote partner' must be enabled in TIA Portal.

One-Sided S7 Communication Protocol Architecture

In SIMATIC PCS 7 architectures, automation stations within the same multiproject typically communicate via inter-AS communication without manual programming. However, when interfacing with standalone third-party controllers (packaged vendor skids, OEM machinery) programmed outside the PCS 7 engineering station, One-Sided S7 Communication provides a robust, standardized method.

The PCS 7 AS 410 acts as the active communication client, executing standard function blocks PUT (FB15) to write data and GET (FB14) to read data. The remote partner acts as a passive communication server, processing data transfers automatically within its operating system firmware without executing any user communication code.

Prerequisites for Non-PCS 7 Partners (S7-1200, S7-1500, S7-300)

To ensure the passive partner permits external read/write access without connection rejections:

Remote Controller FamilyProgramming EnvironmentMandatory Data Block SettingMandatory Security SettingSIMATIC S7-300 / S7-400 (Classic)STEP 7 V5.xStandard classic DB (Absolute addressing).None (Permitted by default in firmware).SIMATIC S7-1200 (Firmware V4.0+)TIA Portal (V13/V14/V15)Uncheck 'Optimized block access' (Standard DB required).Check 'Permit access with PUT/GET communication from remote partner'.SIMATIC S7-1500 (All Firmware)TIA Portal (V13/V14/V15)Uncheck 'Optimized block access' (Standard DB required).Check 'Permit access with PUT/GET communication from remote partner'.

Implementation Workflow in NetPro and CFC

To configure the one-sided interface on the PCS 7 Engineering Station:

Step 1: Configure Unspecified S7 Connection in NetPro

Open NetPro in the PCS 7 multiproject.
Select the AS 410 CPU -> in the connection table, insert a new connection.
Set Connection Partner to Unspecified, and Type to S7 connection.
In the Connection Properties dialog:
- Enter the remote CPU's IP address.
- Set Partner Rack = 0 and Slot = 1 (for S7-1200/1500) or Slot = 2 (for S7-300).
- Verify Partner Connection Resource is set to 03 (hex).
Note the local Connection ID (e.g., W#16#0001), then save, compile, and download NetPro.

Step 2: Implement Communication in CFC

In the CFC Editor, instantiate GET (FB14) and PUT (FB15) from the Standard Library (Communication Blocks).
Set input parameter ID matching the NetPro connection ID (W#16#0001).
Configure parameter ADDR_1 with an ANY pointer defining the remote DB address (e.g., P#DB1.DBX0.0 BYTE 32).
Configure parameter RD_1 / SD_1 to point to a local AS 410 data structure.
Connect a pulse generator (e.g., 500 ms) to parameter REQ to drive cyclic polling.

Verification

To verify that data exchange functions reliably:

In NetPro, activate online monitoring on the AS 410 connection table: verify connection status indicates Set up (green checkmark).
Open the CFC chart containing the GET block and switch to Online Test mode.
Confirm that parameter NDR (New Data Received) pulses True cyclically and ERROR remains False (0).
Modify a test value in the remote partner's Data Block: verify that parameter RD_1 in CFC updates immediately.
Write a command value via PUT: confirm output parameter DONE pulses True and the remote DB reflects the new value.

Limitations and Operational Precautions

Operational boundaries for one-sided S7 communication:

Single Client Contention: A passive partner CPU can only service a limited number of simultaneous one-sided S7 connections. Avoid pointing multiple unrelated PCS 7 controllers to the same passive partner simultaneously.
Cycle Time Impact: Rapid polling (e.g., every 10 ms) consumes communication buffers on both CPUs. Schedule REQ triggers between 200 ms and 1000 ms.
CFC Any Pointer Restrictions: Classic ANY pointers (P#DB...) cannot be interconnected dynamically on CFC chart pins at runtime; wrap communication blocks inside a custom SCL wrapper FB if dynamic pointer construction is required.

Engineer FAQ

Why does PUT/GET communication fail against S7-1500 controllers by default?

TIA Portal enforces two security features by default on S7-1500 CPUs: Data Blocks have 'Optimized block access' enabled (which scrambles absolute byte addresses), and PUT/GET access is blocked under CPU Protection settings.

What partner resource number is required for an unspecified S7 connection?

The partner connection resource must be set to 03 (hex), which is the standard reserved resource for passive S7 communication servers.

Can PUT and GET be executed over PROFINET Industrial Ethernet?

Yes, PUT and GET execute over Industrial Ethernet (TCP/IP or ISO-on-TCP) via standard onboard PROFINET interfaces or CP 443-1 processors.

Is there a dedicated APL block for PUT/GET?

No. The PCS 7 Advanced Process Library does not provide PUT/GET blocks because native PCS 7 inter-AS communication uses configured connections. Standard blocks FB14 (GET) and FB15 (PUT) from the Standard Library are used.