S7 Communication Between SIMATIC S7-1500 and SIMATIC S7-300: Step 7 V16 / Bsend / BRCV
S7 Communication Between SIMATIC S7-1500 and SIMATIC S7-300: Step 7 V16 / Bsend / BRCV
S7 Communication Between SIMATIC S7-1500 and SIMATIC S7-300: Step 7 V16 / Bsend / BRCV
between
SIMATIC S7-1500 and
SIMATIC S7-300
Siemens
STEP 7 V16 / BSEND / BRCV Industry
Online
https://support.industry.siemens.com/cs/ww/en/view/18516182 Support
This entry originates from Siemens Industry Online Support. The conditions of use
specified there apply (www.siemens.com/nutzungsbedingungen).
Security Siemens provides products and solutions with industrial security functions that support the
Informa- secure operation of plants, systems, machines and networks.
tion In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions only form one element of such a
concept.
Customers are responsible to prevent unauthorized access to their plants, systems,
machines and networks. Systems, machines and components should only be connected
to the enterprise network or the internet if and to the extent necessary and with
appropriate security measures (e.g. use of firewalls and network segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be taken into
account. For more information about industrial security, please visit
http://www.siemens.com/industrialsecurity.
Siemens’ products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends to apply product updates as soon as available and
to always use the latest product versions. Use of product versions that are no longer
supported, and failure to apply latest updates may increase the customer’s exposure to
cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security
RSS Feed under http://www.siemens.com/industrialsecurity.
© Siemens 2020 All rights reserved
1 Introduction
You can use S7 Communication, for example, for data transfer via the integrated
PROFINET interface and Industrial Ethernet interface of the S7 CPUs.
The following instructions are available for S7 Communication:
• BSEND for sending data
• BRCV for receiving data
The S7 connection has to be configured on both sides, because S7 communication
via the "BSEND" and "BRCV” services is based on the client-client principle.
In STEP 7 V16 (TIA Portal) you will find the "BSEND" and "BRCV” instructions in
the "Instructions" task card under "Communication > S7 Communication".
In STEP 7 V5, depending on the interface used for the data exchange, you call the
following version of SFB/FB 12 "BSEND" and SFB/FB 13 "BRCV" in your user
program:
– Integrated PROFINET interface of the S7-300, IM151-8 PN/DP or
IM154-8 CPU: Use FB12 "BSEND" and FB13 "BRCV" from the Standard
Library under "Communication Blocks > Blocks".
– CP 343-1 or CP 342-5: Use FB12 "BSEND" and FB13 "BRCV" from the
"SIMATIC_NET_CP" library under "CP 300 Blocks".
– S7-400: Use SFB12 "BSEND" and SFB13 "BRCV" from the Standard
Library under "System Function Blocks > Blocks".
The example describes how to configure an S7 connection between an S7-1500
© Siemens AG 2020 All rights reserved
CPU and an S7-300 CPU to exchange data between the S7-1500 CPU and the
S7-300 CPU using the "BSEND" and “BRCV” instructions.
Figure 1-1
S7-1500
S7-300
BSEND: BRCV:
ID: 16#100 ID: 16#1
RID: 16#1 S7 Connection RID: 16#1
BRCV: BSEND:
ID: 16#100 ID: 16#1
RID: 16#2 S7 Connection RID: 16#2
Note The example also applies for data exchange between the following
communication partners:
2 Configuration
2.1 Create the Hardware Configuration
2.1.1 Create the Hardware Configuration in STEP 7 V16
Hinweis If you have configured the connection partners in the same STEP 7 project, you
assign the same subnet to each connection partner.
Hinweis If you have configured the connection partners in the same STEP 7 project, you
assign the same subnet to each connection partner.
3. Drag and drop the relevant modules like Power Supply, CPU etc. from the
hardware catalog into the S7-300 profile channel.
© Siemens AG 2020 All rights reserved
Define IP address and Assign Subnet to the PROFINET interface of the CPU
1. Double-click the PROFINET interface of the S7-300 CPU. The Properties
dialog of the PROFINET interface opens.
2. Click the "Properties" button to change the IP address and subnet mask and
assign the subnet.
© Siemens AG 2020 All rights reserved
Requirements
To create the S7 connection graphically the communication partners have to be
configured in the same project. If you create the S7 connection graphically, the
connection is configured on both sides.
Instructions
Figure 2-1
© Siemens AG 2020 All rights reserved
1. In the Network view you click the "Connections" icon to enable the Connection
mode.
2. Select "S7 connection" as the connection type in the adjacent drop-down list
box.
In the Network view, all devices that are available for an S7 connection are
highlighted in color.
3. With the button held down drag the mouse cursor from the module (CPU, CP
or CM) where the S7 connection is to start (active connection establishment) to
the module (CPU, CP or CM) where the S7 connection is to finish (passive
connection establishment).
4. Release the mouse button when the cursor is on the target device to create the
S7 connection between the communication partners.
Result
• An S7 connection configured on both sides is created.
• The connection path is displayed highlighted in the graphical area of the
Network view.
• The S7 connection is entered in the "Connections" table in the table area of the
Network view. Since the S7 connection is configured on both sides two
connections are created:
– One S7 connection uses the S7-1500 CPU as local endpoint. This sets up
the S7 connection actively.
– The second S7 connection uses the S7-300 CPU as local endpoint. This
participates passively in establishing the connection.
© Siemens AG 2020 All rights reserved
3. In the “General” tab under “Local ID” you see the local ID of the module from
which the connection is viewed (local partner). You can change the local ID.
You specify the local ID later at the "ID" input parameter of the "BSEND" and
"BRCV" instructions.
In this example we use the local ID with the value 100 (hex).
4. In the "General” tab under "Special connection properties" you can set which
connection partner actively establishes the connection.
© Siemens AG 2020 All rights reserved
5. The address details of the S7 connection are displayed in the "General" tab
under "Address details". The values are taken from the current configuration.
You have the option of changing the connection resource.
If you use the communication services "BSEND" and "BRCV" for the data
exchange, you must create the S7 connection on both sides. The following
instructions show you how to create the S7 connection on both sides when the
communication partners are configured in different projects.
Result
© Siemens AG 2020 All rights reserved
• The S7 connection is entered in the "Connections" table in the table area of the
Unrestricted
Network view.
3. In the “General” tab under “Local ID” you see the local ID of the module from
which the connection is viewed (local partner). You can change the local ID.
You specify the local ID later at the "ID" input parameter of the "BSEND" and
"BRCV” instructions.
In this example we use the local ID with the value 100 (hex).
5. In the "General" tab under "Address details” you enter the partner TSAP. The
partner TSAP is composed as follows:
<Connection resource (hex)>.<Slot of CPU or CP/CM>
– Connection resource (hex): Value range 10-DE, because the
S7 connection is not configured unilaterally with an unspecified partner.
– Slot of the CPU, for example:
S7-1500 CPU: Slot 1
S7-300 CPU: Slot 2
S7-400 CPU: Slot 3
The partner TSAP must match the local TSAP in the communication partner.
© Siemens AG 2020 All rights reserved
Add an S7 Connection
1. In the SIMATIC Manager you open the "NetPro" tool via the menu "Options >
Configure Network". In "NetPro" you configure the S7 connection for the
S7-300 CPU.
© Siemens AG 2020 All rights reserved
6. Enter the rack and slot of the partner CPU or CP/CM, Rack 0 and Slot 1, for
example.
7. Select a connection resource from 10 (hex) onwards for the partner CPU
because the S7 connection is configured on both sides. With these settings the
TSAP in the partner CPU has the value 10.01.
The partner TSAP must match the local TSAP in the communication partner.
8. Apply the settings with "OK".
9. Likewise apply the settings in the Properties dialog of the S7 connection with
"OK".
10. In the "Insert New Connection" dialog you click the "OK" button to close the
dialog. The S7 connection is inserted in "NetPro".
NOTE The sample program can be used for S7 communication with "USEND" and
"URCV". In FB "BsendData" call the system block "USEND" instead of "BSEND".
In FB "BrcvData" call the system block "URCV" instead of "BRCV".
3.1 Overview
The following figure shows an overview of the user program in the S7 CPU.
Figure 3-1
SendData
© Siemens AG 2020 All rights reserved
RecvData
BrcvData BRCV
The data that is transferred to the partner CPU is stored in data block
DB2 "SendData".
In the Properties of DB2 "SendData”, under "Attributes" you can enable or disable
the "Optimized block access" function.
Figure 3-3
© Siemens AG 2020 All rights reserved
The following table shows the structure of the PLC data type "typeBsend".
Table 3-2
Parameter Data type Start value Description
execute Boolean false Control parameter
abort Boolean false Control parameter
connectionId S7-1500: 16#0 Addressing parameter for
CONN_PRG specifying the connection to
S7-300/S7-400: the communication partner.
Word
rid S7-1500: 16#0 Addressing parameter for
CONN_R_ID specifying the instruction
S7-300/S7-400: pair "BSEND" and "BRCV”.
DWord
len Word 16#0 Length in bytes of data block
to be sent
Note for S7-1500
If "len" = 16#0, all the data is
sent by "SD_1".
done Boolean false Status parameters
busy Boolean false Status parameters
© Siemens AG 2020 All rights reserved
The following table shows the structure of the PLC data type "typeBrcv".
Table 3-3
Parameter Data type Start value Description
enable Boolean false Control parameter
connectionId S7-1500: 16#0 Addressing parameter for
CONN_PRG specifying the connection to
S7-300/S7-400: the communication partner.
Word
rid S7-1500: 16#0 Addressing parameter for
CONN_R_ID specifying the instruction
S7-300/S7-400: pair "BSEND" and "BRCV”.
DWord
len Word 16#0 Length in bytes of the data
received so far.
valid Boolean false Status parameters
busy Boolean false Status parameters
error Boolean false Status parameters
status Word 16#0 Status parameters
The following table shows the structure of the PLC data type "typeDiagnostic".
Table 3-4
Parameter Data type Start value Description
statusSend Word 16#0 Parameter to store the status of
FB "BsendData”.
statusRecv Word 16#0 Parameter to store the status of
FB "BrcvData”.
lenRecv Word 16#0 Parameter to store the length of
the data received so far.
© Siemens AG 2020 All rights reserved
3.4 FB "BsendData"
The FB "BsendData” calls the "BSEND" instruction to execute the following
functions:
• Send data to the partner via the configured connection as soon as the input
"execute" recognizes a positive edge. When the Send job is running, it is not
possible to trigger a new Send job.
• Output the status of the FB and data transmission at the "status" output.
Overview
Figure 3-4
BsendData
Parameters
The following table shows the parameters of FB "BsendData".
Table 3-5
Name P type Data type Comment
execute IN Bool Control parameter:
Enables the Send job on a rising edge.
abort IN Bool Control parameter
Enables the abort of a running data exchange on a rising
edge.
connectionId IN CONN_PRG Local ID:
Addressing parameter for specifying the connection to the
partner CPU.
Note
The local ID is available in the Properties of the configured
S7 connection.
The following local ID is used in this example: 100 (hex)
rid IN CONN_R_ID Addressing parameter for specifying the instruction pair
"BSEND" and "BRCV”.
done OUT Bool TRUE: The Send job was executed error-free.
busy OUT Bool TRUE: The Send job is running.
error OUT Bool Status parameters "error" and "status":
© Siemens AG 2020 All rights reserved
Overview
Figure 3-5
BsendData
Parameters
The following table shows the parameters of FB "BsendData".
Table 3-6: Parameters of BsendData
Name P type Data Comment
type
© Siemens AG 2020 All rights reserved
3.5 FB "BrcvData"
The FB "BrcvData” calls the "BRCV" instruction to execute the following functions:
• Receive data from the partner via the configured connection as soon as the
input "enable" is set to the value "TRUE".
• Output the status of the FB and data transmission at the "status" output.
Overview
Figure 3-6
BrcvData
status Word
RD1
© Siemens AG 2020 All rights reserved
Variant Variant
LEN
Word Word
Parameters
The following table shows the parameters of FB "BrcvData".
Table 3-8:
Name P type Data type Comment
enable IN Bool Control parameter:
Signals the readiness to receive if the "enable" parameter
has the value "TRUE".
connectionId IN CONN_PRG Local ID:
Addressing parameter for specifying the connection to the
partner CPU.
Note
The local ID is available in the Properties of the configured
S7 connection.
The following local ID is used in this example: 100 (hex)
rid IN CONN_R_ID Addressing parameter for specifying the instruction pair
"BSEND" and "BRCV”.
valid OUT Bool TRUE: Readiness to receive is active, in other words data
can be received.
busy OUT Bool TRUE: FB is being processed.
error OUT Bool Status parameters "error" and "status":
status OUT Word • "error" = 0:
– "status" = 0000 (hex): neither warning nor error
© Siemens AG 2020 All rights reserved
Overview
Figure 3-7
BrcvData
status Word
RD1
Any Any
LEN
Word Word
Parameters
The following table shows the parameters of FB "BrcvData".
Table 3-9
Name P type Data Comment
type
© Siemens AG 2020 All rights reserved
RD_1 − P#DB1.DBX0.0 −
BYTE 8192
LEN len 16#0 −
3.6 Function
The FBs "BsendData" and "BrcvData" are implemented as a state machine. The
design model of a state machine is particularly suitable for modeling more complex
asynchronous processes, such as communication between partners, which can
extend over several cycles.
A certain state is run through cyclically until a transition condition is fulfilled and the
machine switches to the next subsequent state. This not only improves the clarity
compared to conventional link control, but also makes it easier to find any errors in
the program logic more quickly.
3.6.1 Overview
FB "BsendData"
The following figure shows the sequence of FB "BsendData".
Figure 3-8
Wait for
external
trigger
FB_STATE_
NO_PROCE
SSING
© Siemens AG 2020 All rights reserved
FB_STATE_
PROCE
SSING_1
Unrestricted
3 User Program of the S7 CPU
FB "BrcvData"
The following figure shows the sequence of FB "BrcvData".
Figure 3-9
FB_STATE_
FB_STATE_
PROCE
ENABLING
SSING
New data
Enable the „BRCV“ received Evaluate the
© Siemens AG 2020 All rights reserved
Unrestricted
FB "BsendData"
The following table describes the implemented states and the possible transitions
of FB "BsendData".
Table 3-11
State Description Transition
FB_STATE_NO_ In this state the FB has the The FB switches to the state
PROCESSING following properties: "FB_STATE_PROCESSING_1”
• No Send job is active. when a positive edge is
detected at the "execute" input
• The value 16#7000 is output
of the FB.
at the "status" output of the
FB.
FB_STATE_ In this state the FB executes the The state is exited when the
PROCESSING_1 following actions: Send job is completed
• The FB starts the Send job successfully or with an error.
with the "BSEND” instruction. • If the Send job is completed
• The FB monitors whether the successfully, the following
"BSEND" instruction has actions are performed:
terminated successfully – The "done" output is set
(DONE = true) or with an to the value "true" for
error (ERROR = true). one cycle.
– The FB switches to the
© Siemens AG 2020 All rights reserved
state "FB_STATE_
NO_PROCESSING"
• If the Send job is completed
with an error, the following
actions are performed:
– The "error" output is set
to the value "true" for
one cycle.
– The status display of the
"BSEND" instruction is
output at the "status"
output.
– The FB switches to the
state "FB_STATE_
NO_PROCESSING"
FB "BrcvData"
The following table describes the implemented states and the possible transitions
of FB "BrcvData".
Table 3-12
State Description Transition
FB_STATE_NO_ In this state the FB has the If the input "enable" of the FB is
PROCESSING following properties: set to the value "TRUE", the
• No readiness to receive, in following actions are performed:
other words no data can be – The "valid" output is set
received. to the value "true".
• The value 16#7000 is output – The "busy" output is set
at the "status" output of the to the value "true".
FB. – The "error" output is
reset to the value "false".
– The FB switches to the
state "FB_STATE_
ENABLING"
If a negative edge is recognized
at the input "enable", the FB
switches to the state
"FB_STATE_DISABLING".
FB_STATE_ In this state the FB executes the The state is exited when one of
ENABLING following actions: the following conditions is met:
© Siemens AG 2020 All rights reserved
If an error occurs in FB "BsendData”, the cause of the error is written to the "status"
output parameter.
Table 3-13
error status Description Remedy
0 16#7000 FB "BsendData" is not Status information
active. Enable FB "BsendData” by
setting the "execute" input to
"true".
0 16#7001 FB "BsendData" is Status information
initialized.
0 16#7002 Send job is running Status information
1 <>16#0000 Status display of the Detailed information is
"BSEND” instruction. available in the STEP 7
Online Help or in the
following manual:
"SIMATIC STEP 7
Basic/Professional V16 and
SIMATIC WinCC V16".
© Siemens AG 2020 All rights reserved
3.7.2 FB "BrcvData"
If an error occurs in FB "BrcvData”, the cause of the error is written to the "status"
output parameter.
Table 3-14
error status Description Remedy
0 16#7000 FB "BrcvData" is not Status information
active. Enable FB "BrcvData” by
setting the "execute" input to
"true".
0 16#7001 FB "BrcvData" is Status information
initialized.
0 16#7002 Readiness to receive is Status information
active.
1 <>16#0000 Status display of the Detailed information is
"BRCV” instruction. available in the STEP 7
Online Help or in the
following manual:
"SIMATIC STEP 7
Basic/Professional V16 and
SIMATIC WinCC V16".
4 Information
NOTE The parameters "ID" and "R_ID" cannot be used dynamically because they are
evaluated when "BSEND" or "BRCV" is called for the first time and defined for
this instance. They cannot be changed in subsequent calls.
The outputs "DONE", "NDR", "ERROR" and "STATUS" are only available in the
cycle in which the event occurred. For this reason, the evaluation and the event
handling must be carried out in the same cycle or at least triggered.
Detailed information about the "BSEND" instruction is given in the manual entitled
"SIMATIC STEP 7 Basic/Professional V16 and SIMATIC WinCC V16".
5. A receive job is completed with "NDR" = true or "ERROR" = true. Only when
the receive job has been completed with "NDR" = true can the data in the
receive buffer be accessed (data consistency).
6. If the "ERROR" output is set, you evaluate the "STATUS" output to retrieve any
additional information available on the cause of the error and thus clear it
directly. If necessary, the "STATUS" output can be evaluated generally, since
in one case (job is still running, this means STATUS = 11 (dec.)) the "ERROR"
output does not have to be set.
Detailed information about the "BSEND" instruction is given in the manual entitled
"SIMATIC STEP 7 Basic/Professional V16 and SIMATIC WinCC V16".