Providing process

values via CIP with

SIMATIC
Siemens
S7-1500/ S7-1200/ EtherNet/IP Industry
Online
https://support.industry.siemens.com/cs/ww/en/view/109782316 Support
 Legal information
Use of application examples
Application examples illustrate the solution of automation tasks through an interaction of several
components in the form of text, graphics and/or software modules. The application examples are
a free service by Siemens AG and/or a subsidiary of Siemens AG (“Siemens”). They are non-
binding and make no claim to completeness or functionality regarding configuration and
equipment. The application examples merely offer help with typical tasks; they do not constitute
customer-specific solutions. You yourself are responsible for the proper and safe operation of the
products in accordance with applicable regulations and must also check the function of the
respective application example and customize it for your system.
Siemens grants you the non-exclusive, non-sublicensable and non-transferable right to have the
application examples used by technically trained personnel. Any change to the application
examples is your responsibility. Sharing the application examples with third parties or copying the
application examples or excerpts thereof is permitted only in combination with your own products.
The application examples are not required to undergo the customary tests and quality inspections
of a chargeable product; they may have functional and performance defects as well as errors. It is
your responsibility to use them in such a manner that any malfunctions that may occur do not
result in property damage or injury to persons.

Disclaimer of liability
Siemens shall not assume any liability, for any legal reason whatsoever, including, without
limitation, liability for the usability, availability, completeness and freedom from defects of the
application examples as well as for related information, configuration and performance data and
any damage caused thereby. This shall not apply in cases of mandatory liability, for example
under the German Product Liability Act, or in cases of intent, gross negligence, or culpable loss of
life, bodily injury or damage to health, non-compliance with a guarantee, fraudulent
non-disclosure of a defect, or culpable breach of material contractual obligations. Claims for
damages arising from a breach of material contractual obligations shall however be limited to the
foreseeable damage typical of the type of agreement, unless liability arises from intent or gross
negligence or is based on loss of life, bodily injury or damage to health. The foregoing provisions
do not imply any change in the burden of proof to your detriment. You shall indemnify Siemens
© Siemens 2021 All rights reserved

against existing or future claims of third parties in this connection except where Siemens is
mandatorily liable.
By using the application examples, you acknowledge that Siemens cannot be held liable for any
damage beyond the liability provisions described.

Other information
Siemens reserves the right to make changes to the application examples at any time without
notice. In case of discrepancies between the suggestions in the application examples and other
Siemens publications such as catalogs, the content of the other documentation shall have
precedence.
The Siemens terms of use (https://support.industry.siemens.com) shall also apply.

Security information
Siemens provides products and solutions with industrial security functions that support the secure
operation of plants, systems, machines, and networks.
To protect plants, systems, machines, and networks against cyber threats, it is necessary to
implement – and continuously maintain – a holistic, state-of-the-art industrial security concept.
Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines, and networks. Such systems, machines and components should only be connected to
an enterprise network or the Internet if and to the extent such a connection is necessary and only
when appropriate security measures (e.g. firewalls and/or network segmentation) are in place.
For additional information on industrial security measures that may be implemented, please visit
https://www.siemens.com/industrialsecurity.
Siemens’ products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends that product updates are applied as soon as they are available
and that the latest product versions are used. Use of product versions that are no longer
supported, and failure to apply the latest updates may increase customer’s exposure to cyber
threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS Feed
at: https://www.siemens.com/industrialsecurity.

Siemens AG V1.0.0
Division Digital Factory Ⓟ 04/2021 Subject to change
Postfach 48 48
90026 NÜRNBERG Copyright © Siemens AG 2021.
Germany All rights reserved 2
 Table of contents

Table of contents
Legal information ......................................................................................................... 2
1 Preface ................................................................................................................ 4
2 Introduction ........................................................................................................ 5
2.1 Description ........................................................................................... 5
2.2 Common Industrial Protocol ................................................................. 5
2.3 Programmable Controller Communication Commands ....................... 6
2.4 Function principle ................................................................................. 7
2.5 Scope of delivery .................................................................................. 7
3 Commissioning .................................................................................................. 8
3.1 Preparation ........................................................................................... 8
3.2 Connecting the hardware components ................................................ 8
4 Configuration/Engineering ............................................................................... 9
4.1 Creating and managing projects .......................................................... 9
4.2 Creating the server mapping .............................................................. 12
4.2.1 PCCC object ....................................................................................... 12
4.3 Setting up the CIP client ..................................................................... 20
4.3.1 Setting up the EtherNet/IP connection ............................................... 21
5 Operating .......................................................................................................... 24
© Siemens AG 2021 All rights reserved

5.1 Start the application............................................................................ 24

5.2 Troubleshooting .................................................................................. 27
5.2.1 Physical check .................................................................................... 27
5.2.2 Network settings ................................................................................. 28
5.2.3 Configuration check ............................................................................ 29
5.2.4 SIMATIC Program .............................................................................. 30
6 LCCF_CIPServer block.................................................................................... 31
6.1 Parameters ......................................................................................... 31
6.1.1 Block status messages....................................................................... 33
6.1.2 Technical data .................................................................................... 36
7 Appendix .......................................................................................................... 37
7.1 CIP/ PCCC Communication path settings .......................................... 37
7.1.1 Case 1 – Accessing data inside an Allen- Bradley PLC .................... 38
7.1.2 Case 2 – Accessing the Allen- Bradley PLC via integrated
Ethernet port ....................................................................................... 40
7.1.3 Case 3 – Accessing the Allen- Bradley PLC via the ControlNet
interface .............................................................................................. 41
7.2 Service and support ........................................................................... 42
7.3 Industry Mall ....................................................................................... 43
7.4 Links and literature ............................................................................. 43
7.5 Change documentation ...................................................................... 43

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 3
 1 Preface

1 Preface
Purpose of the manual
This document contains information about the LCCF_CIPServer function block for
SIMATIC S7-1200 and S7-1500. It will explain its usage and parameterization as
well as provide some background information about the implemented “Common
Industrial Protocol” as specified by the ODVA.

Core content
The following core issues are covered in this document:
• Purpose of the function block
• Parameterization
• Data exchange with a CIP client

Required basic knowledge

General knowledge in communications over Ethernet and programming and
configuring the S7-1200 or S7-1500 with the TIA Portal is assumed and will not be
part of this document. It is also assumed that the terms Server and Client and their
meaning are familiar to the reader.

Delimitation
© Siemens AG 2021 All rights reserved

The document does not describe:

• How to setup Ethernet networks
• How to assign IP addresses and the split into subnets
• How to configure the controllers in this example
Basic knowledge about the above topics is assumed.

Validity
This document is valid for the following components
• TIA Portal
• SIMATIC S7 Controller

The following hardware and software are used throughout this document

Table 1-1: used components

Name Part number Version
SIMATIC S7-1511-1PN 6ES7 511-1AK01-0AB0 V2.6 (or above)
SIMATIC S7-1215C 6ES7 215-1AG40-0XB0 V4.2 (or above)
TIA Portal STEP7 Prof. V15.1 Update 4
TIA Portal WinCC Adv. V15.1 Update 4
SCALANCE X208 6GK5 208-0BA10-2AA3

The screens in the Comfort Panel are created using the HMI Template Suite, which
can be downloaded using the SIOS ID: 91174767.
https://support.industry.siemens.com/cs/ww/en/view/91174767

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 4
 2 Introduction

2 Introduction
2.1 Description
Often SIMATIC controller exchange data with other controller, peripheral systems,
and upper level control systems or with MES or SCADA systems. To do this in a
meaningful manner the communication partners need to use the same protocol.
The following application example demonstrates the use of CIP/ PCCC as the
protocol to perform this data exchange.
The simplified setup is shown below

Figure 2-1: simplified setup

Third party HMI/ SCADA system

CIP client
© Siemens AG 2021 All rights reserved

IE

CIP server CIP server

SIMATIC S7-1200

SIMATIC S7-1500
The physical connection uses Ethernet cable, such as PROFINET cable.
A SCALANCE X 208 switch has been put in between, but is not shown, as direct
connections are possible as well.
In the above shown schematic only one of the two SIMATIC controller is required.
As a CIP client typically can maintain multiple connections, both controller and
even multiple of each can be operated at the same time.
The number of connectable servers depend on the technical data of the CIP client.

2.2 Common Industrial Protocol

The Common Industrial Protocol (for short CIP) is defined by the Open DeviceNet
Vendor Association (ODVA®). This protocol is an object-oriented mechanism to
access process values as well as configuration and diagnostic data of a
conformant device. The CIP defines several objects, which in turn provide services

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 5
 2 Introduction

to access the attributes of that object. Each attribute has a certain meaning, which
is either predefined or vendor specific
The “LCCF_CIPServer” function block implements the PCCC object and a few of
its services.

2.3 Programmable Controller Communication Commands

The Programmable Controller Communication Commands (for short PCCC, PC³ or
PC cube) are a standardized set of services defined in the PCCC object. These
services allow the access to process values inside the automation system
implementing this object.
The SIMATIC implementation provided in the “LCCF_CIPServer” function block
implements two services.
• SLC typed protected logical read with 3 address fields
• SLC typed protected logical write with 3 address fields
These two services are sufficient to access a wide range of automation system
internal memories. There are Rockwell controller families supporting the PCCC
object directly. These families are:
• SLC 5/0x programmed with RS Logix 500
therefore, known as SLC500
• MicroLogix 1x00 programmed with RS Logix 500
Both families of Rockwell Automation PLC have the same memory addressing
© Siemens AG 2021 All rights reserved

schema. Variables are collected in so called files of common data type. This
means, that variables of the same data type are stored in a file of that data type.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 6
 2 Introduction

2.4 Function principle

The application example demonstrates the necessary steps to set up the
communication and to start the data exchange between a SIMATIC controller and
a third-party system.
The communication with CIP/ PCCC uses the Client-Server principle. In this
application the CIP server is being realized by the SIMATIC controller. With the
LCCF_CIPServer the SIMATIC controller provide process data to CIP clients.
The CIP client in this application example is implemented with WinCC Adv. RT.
WinCC offers multiple means of connecting to SIMATIC as well as to third party
systems. For this it offers several communication drivers. This application example
uses the built in “EtherNet/IP” driver.
The CIP protocol is embedded into the payload of the EtherNet/IP packets sent to
the SIMATIC automation system.
The CIP client establishes the connection and requests data from the CIP server to
display on a screen. The application will also allow writing to process values inside
the SIMATIC controller.

Figure 2-2: schematic functional principle

CIP Server CIP Client

Client initiates connection
© Siemens AG 2021 All rights reserved

Client requests (REQ) tag

Server responds (RSP) w.

tag value

The configuration for both scenarios, reading process values and writing values to
tags inside the PLC will be explained.
The server maintains one TCP connection from a single client. On the upper layers
of communication (7-Layer model ISO- OSI) the server block can handle of to 16
sessions. This number may not be obtainable on all CPU models.

2.5 Scope of delivery

The application example consists of a TIA Portal project containing two SIMATIC
controller and an HMI panel as CIP client.
The program in the S7-1200 is identical to the S7-1500 controller and provides a
mapping of PLC internal tags to the CIP/ PCCC compatible addressing schema.
The HMI configuration contains two connections, one connection link to each
SIMATIC. The connections are of type EtherNet/IP and addressing a Rockwell
controller of type SLC or MicroLogix. The addressed Rockwell controller are being
replaced with the SIMATIC S7-1200 and SIMATIC S7-1500 systems. The
necessary parameterization is shown in this document.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 7
 3 Commissioning

3 Commissioning
3.1 Preparation
As preparation for the application example to work the above-mentioned hardware
components should be placed into a rack or on a solid table to prevent slip or fall.

Risk of electric shock

To operate this application example the connection of the above hardware to
electrical power is required. Disregarding local regulations and common sense
WARNING
may cause an electric shock and because of that injury or death.
Always follow the rules for working with electrical equipment.

Further download the TIA Portal project from the SIOS entry or download the latest
version of the LCCF (Library of Competitor Conversion Functions). Store the
downloaded file onto your local computer for later use.

3.2 Connecting the hardware components

Connect 24V DC electrical power to the SIMATIC controller(s) and the other
equipment such as SIMATIC Panel and SCALANCE switch.
© Siemens AG 2021 All rights reserved

Establish a connection between the SIMATIC controller and either the SCALANCE
X208 switch or directly the SIMATIC Panel.

Figure 3-1: network setup

L+ M L+ M L+ M

SIMATIC
SCALANCE X208 SIMATIC Panel
Controller

PN PN PN PN PN PN PN PN PN PN PN PN

L+ M L+ M

SIMATIC PC
Controller (TIA Portal)

PN PN PN PN

PROFINET / IE

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 8
 4 Configuration/Engineering

4 Configuration/Engineering
4.1 Creating and managing projects
In this application example the used TIA Portal project should have been
downloaded and stored on your local computer.

Table 4-1: Configuration instructions

Step Instruction Notes
1. Start TIA Portal
2. Retrieve the downloaded TIA Portal project This will extract the
(CIPServer.zap15_1) compressed TIA
Portal archive into a
folder of your
selection.
© Siemens AG 2021 All rights reserved

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 9
 4 Configuration/Engineering

Step Instruction Notes

3 Open one of the contained SIMATIC Controller You will see some
(S7-1215 is shown) data types and the
“LCCF_CIPServer”
block.
© Siemens AG 2021 All rights reserved

4. Open the [OB1] Main block. The programming

editor opens and
shows an empty
block

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 10
 4 Configuration/Engineering

Step Instruction Notes

5. Place a call to the “LCCF_CIPServer” function block a dialog box opens,
asking for the
instance data block.

6. Assign the instance data block name Here it is named:

“InstCIPServer”
© Siemens AG 2021 All rights reserved

7. Assign actual parameter to the block call this parameterization

uses the integrated
PROFINET Interface
of the CPU for
communication.

Until now the server doesn’t have a mapping of process values to tags, which are
provided to CIP clients, although it is already operable.
In its next chapter this document describes how the mapping is created.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 11
 4 Configuration/Engineering

4.2 Creating the server mapping

The LCCF_CIPServer function block communicates with CIP clients. CIP is an
acyclic data transfer protocol usable over several carrier protocols. In this
implementation TCP/IP over Ethernet are used as the underlying transport and
networking protocols.
As the SIMATIC systems have an internal method of addressing process tags,
which is different to what the implemented PCCC services require, a mapping is
necessary.
For the creation of the mapping of SIMATIC internal variables to PCCC conformant
attributes, it is necessary to understand, which object is implemented in the CIP
server and what the impact on the mapping is.

4.2.1 PCCC object

The LCCF_CIPServer block implements the PCCC object only partially. This object
allows the addressing of certain memory areas within specific PLC families. The
following table explains the different addressable memory areas and their
organization.

Table 4-2: Data types of SLC500/ MicroLogix systems

Data type Prefix Example Notes
© Siemens AG 2021 All rights reserved

Output O O0:5/3 allows access to Boolean

like Process values (discrete channels)
Image of accessing: but is organized in WORD
Outputs
Output file 0 (zero)
Word 5
Bit 3

like:
SIMATIC Q10.3
Input I I1:2/5 allows access to Boolean
like Process values (discrete channels)
Image of accessing: but is organized in WORD
Inputs
Input file 1
Word 2
Bit 5

like:
SIMATIC I4.5
Boolean B B3:0/14 allows access to Boolean
values organized in WORD
accessing:
Boolean file 3
Word 0
Bit 14

like:
SIMATIC M1.6
Timer T T4:7 allows access to Timers. A
timer has a size of 3
accessing: WORDs.
Timer file 4 • ControlWord

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 12
 4 Configuration/Engineering

Data type Prefix Example Notes

Timer 7 • Preset value
• Accumulated value
Counter C C5:0 allows access to Counters. A
timer has a size of 3
accessing: WORDs.
Counter file 5 • ControlWord
Counter 0 • Preset value
Accumulated value
Control R R6:8 allows access to Control
Structures of a not further
accessing: specified size and varying
format.
ControlStructure file 6
ControlStructure 8
Integer N N7:0 allows access to Integer (16-
bit) values.
accessing:
Integer file 7
Integer 0
Long Integer L L9:13 allows access to Long
Integer (32-Bit) values
accessing:
© Siemens AG 2021 All rights reserved

Long Integer file 9

Integer 13
Float F F8:22 allows access to floating
point (single precision)
accessing: values
Float file 8
Integer 22
String ST ST10:4 allows access to String80
data type variables.
accessing: String80 is a string variable
of a maximum length of 80
characters.
String file 10
String 4
The LCCF_CIPServer block offers individual parameters for each of the data types
in the table above.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 13
 4 Configuration/Engineering

Figure 4-1: PCCC file type defining User Defined Data types
© Siemens AG 2021 All rights reserved

There may be not only one, but multiple files of a specific type in the mapping. The
size of each “file” although is fixed and predefined.
To create the mapping follow the instructions in the next table.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 14
 4 Configuration/Engineering

Table 4-3: Instructions to create mapping

Step Instruction Notes
1. Create a new global DB The newly created DB
opens in the DB editor.

Assign a name (here: “Mapping”)

© Siemens AG 2021 All rights reserved

2. Create a DB variable of type you will get a new variable,

“LCCF_typeFileTypeN” which is a structure
containing 100 elements
and a variable for the
fileNumber

3. Assign the desired file number.

The default file number 7 for N-files is

preassigned.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 15
 4 Configuration/Engineering

Step Instruction Notes

4. Compile the created DB

5. Assign the variable to the LCCF_CIPServer This finalizes the

block. assignment of a single file
parameter.
© Siemens AG 2021 All rights reserved

Make sure you pick the formal parameter

“nFiles”. Any other assignment will cause an
error on startup of the server.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 16
 4 Configuration/Engineering

NOTE You may also assign an array of files to the appropriate formal parameters, if you
have multiple of them, as shown for F-files below

The assignment to the block looks like this:

© Siemens AG 2021 All rights reserved

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 17
 4 Configuration/Engineering

The maximum size of an array of files is limited by the memory available in the
used CPU module only. The LCCF_CIPServer block itself, doesn’t apply a
limitation here.

NOTE As the files data types always define a fixed size array for a file, it is
recommended to fill them up as much as possible before creating a new file.
This saves memory in the controller.

The file sizes are shown in the below table.

Table 4-4: Supported file types and sizes

File Type Elements Size
(in bytes per file)
LCCF_typeFileTypeB 100 WORD 202 BYTE
LCCF_typeFileTypeC 100 LCCF_typeRokCounter 602 BYTE
LCCF_typeFileTypeF 100 REAL 402 BYTE
LCCF_typeFileTypeL 100 DINT 402 BYTE
LCCF_typeFileTypeN 100 INT 202 BYTE
LCCF_typeFileTypeST 16 STRING[82] 1346 BYTE
LCCF_typeFileTypeT 100 LCCF_typeRokTimer 602 BYTE
© Siemens AG 2021 All rights reserved

NOTICE The controller may go into stop mode, when you change the limits in the
file type definitions
The controller may go into STOP mode seizing process control when you
change the limits of the file type definitions. It may also occur, that the CIP server
block needs to be recompiled. As the block remains protected, only the person
who knows the password can unprotect and compile the block.

To have different limits send a request to the SIOS entry.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 18
 4 Configuration/Engineering

NOTICE Data exchange may not take place with ambiguous file numbers
The CIP server block searches for the file number starting with the first file
element in the array. Each element within the file is identified by its index.

In the above parameterization the file with index 1 is hidden by the file with
index 0. The elements “multipleFiles[1].elements[x]” are not accessible as they
have the same fileNumber as the previous defined “multipleFiles[0].elements[x]”.
To avoid this hiding of data, make sure the file numbers are unambiguous as
© Siemens AG 2021 All rights reserved

shown below.

Here the “multipleFiles[1].elements[x]” representing the values within the file

“F19”, while “multipleFiles[0].elements[x]” is representing the file values of “F18”

Once the block is properly configured, the program is compiled and downloaded to
the controller, the CIP client needs to be configured before it can access the
mapped data.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 19
 4 Configuration/Engineering

4.3 Setting up the CIP client

As CIP client multiple different devices are in question. For the sake of ease this
document describes the use of a SIMATIC Comfort Panel TP1200 to fulfill this
purpose.
In this application example we configure the SIMATIC Comfort Panel in such a way
that it communicates with a Rockwell PLC. This uses CIP and makes the SIMATIC
Comfort Panel the client connecting to the server.
Following the instructions below will create and configure such an EtherNet/IP
connection. As preparation we need to get the IP address of our controller.
In the provided TIA Portal project, the IP addresses are as follows:

Table 4-5: IP addresses used

Device IP v4 address
SIMATIC S7-1511-1PN 10.11.20.51
SIMATIC S7-1215C 10.11.20.45
SIMATIC TP1200 10.11.20.14
The above listed devices are all connected through the switch, which is used
unmanaged and therefore, doesn’t need an IP address.

From the Mappings DB in this example the SIMATIC panel will access the following
© Siemens AG 2021 All rights reserved

addresses:

Table 4-6: Mapping of PLC tag to HMI Tag

PLC tag CIP address HMI tag
“Mapping”.setPoints.elements[0] N7:0 setPointTemperature
“Mapping”.setPoints.elements[19] N7:19 setPointSpeed
“Mapping”.multipleFiles[2].elements[2] F28:2 currentTemperature

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 20
 4 Configuration/Engineering

4.3.1 Setting up the EtherNet/IP connection

Table 4-7: Instructions to set up an EtherNet/IP connection

Step Instruction Notes
1. Open the Connections of the panel. The Connections editor
opens

2. Add a new connection of type A new connection

“Allen-Bradley EtherNet/IP” “Connection_1” is created.
© Siemens AG 2021 All rights reserved

3. Adjust the connection parameter The connection is now

configured as EtherNet/IP
connection using the CIP/
PCCC protocol.

Set the CPU type to: “SLC, MicroLogix”

Set the IP address to the SIMATIC S7-1200 IP
address
Leave the communication path at: “1,0”

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 21
 4 Configuration/Engineering

Step Instruction Notes

4. Create a new folder for HMI tags using the You get a new folder here
emulated SLC connection. named
“emulatedSLC_1200”

5 Create new tags inside the newly created If you followed the previous
folder. instructions, you have
created an HMI tag, which
accesses the PLC tag
“Mapping”.setPoints.element
s[0] inside our S7-1200
controller using CIP.
© Siemens AG 2021 All rights reserved

Specify the address: [N7:0]

Set the connection to: “Connection_1”

Set the File type to: N
Set the File number to: 7
Set the Element number to: 0
6. Repeat the previous step for the remaining The tags can now be used
tags: in a screen of your
application.

setPointSpeed [N7:19] of type INT

currentTemperature [F28:2] of type REAL

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 22
 4 Configuration/Engineering

Step Instruction Notes

7. Create your screen and place the tags in there.
The following screen is shown as an example

As you have seen, there is no S7 connection from the Panel to the PLC. This
means it uses the EtherNet/IP based communication reading the variables in the
PLC or writing to them.

NOTE WinCC Runtime Advanced has a simulation mode built in, which can be started
directly from within the TIA Portal.
This way for testing purposes you won’t need the real panel.
To start the simulation, click on the Simulation icon in the symbol menu bar.
© Siemens AG 2021 All rights reserved

This will establish the connection to the configured communication partner. In the
case of this application example, it will be either of the SIMATIC S7 controller.

NOTE The above shown example screen uses the HMI Template Suite. Parts of the
used templates are contained in the example project.
The complete HMI Template suite can be downloaded from SIOS
(ID: 91174767):
https://support.industry.siemens.com/cs/ww/en/view/91174767

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 23
 5 Operating

5 Operating
5.1 Start the application
Once the PLC program is loaded into the PLC, put the CPU module into RUN
mode. This can be achieved by clicking on the “Start CPU” entry in the symbol
menu.
Figure 5-1: TIA Portal Symbol menu

Alternatively, you may use the “RUN-STOP” switch at the S7-1500 CPU.
The LCCF_CIPServer block is now executed and in IDLE mode. It does not
communicate with any partner. For this to happen the CIP server needs to be
enabled.
Best way to do that is to open the provided watch table “watch CIP Server”.

Figure 5-2: watch table “watch CIP server”.

© Siemens AG 2021 All rights reserved

You may also create a new watch table and insert the variables according to your
configuration. The Instance of the LCCF_CIPServer block has an enable input,
which needs to turn to TRUE.
Figure 5-3: watch table – enable CIP server block.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 24
 5 Operating

If everything is configured properly the status information should be

Table 5-1: status information
Variable name Value
„InstCIPServer“.enable TRUE
„InstCIPServer“.busy TRUE
„InstCIPServer“.error FALSE
„InstCIPServer“.valid TRUE
„InstCIPServer“.status 16#0000

You may now modify values in the watch table.

Figure 5-4: watch table – modifying values
© Siemens AG 2021 All rights reserved

Verify that the modifications are transferred to the WinCC Runtime Advanced
Simulation or the Panel you have used. This communication represents the
“reading” of tags from the PLC.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 25
 5 Operating

You may also modify values in the running Simulation or the real SIMATIC Comfort
Panel.
Figure 5-5: WinCC RT Advanced Simulation

Verify that the changes you made are visible in the watch table, as this represents
the “writing” direction of the communication.
© Siemens AG 2021 All rights reserved

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 26
 5 Operating

5.2 Troubleshooting
In case the result is not as expected the cause could be found on both sides of the
communication path.
Before you try to change any of the program or configuration, check the physical
installation first.

5.2.1 Physical check

1. Is the SIMATIC powered up?

2. Is the SCALANCE switch powered up if you have used a network switch?
3. Is the SIMATIC Comfort Panel powered up?
4. Are the network cable properly inserted into the LAN sockets?
This can be determined by evaluating the port LEDs of the devices. At least the
Link LED should be illuminated.

Table 5-2: Physical checks

Observation Possible cause Remedy
SIMATIC is not reachable SIMATIC is not powered • Check power supply and
from TIA Portal up. wiring with the installation
manual.
•
© Siemens AG 2021 All rights reserved

Correct wiring
• Power the Power Supply up
SIMATIC doesn’t have • Check network cable to be
network connection inserted properly into the
network socket (P1.X1 or
P1.X2)
• Check and correct network
settings of your PC
SIMATIC Comfort Panel Comfort Panel is not • Check and correct the power
is not reachable from TIA powered up supply to Comfort Panel
Portal
Comfort Panel doesn’t • Check and correct the power
have network connection supply to the network switch
• Check network cable to be
inserted properly into the
network socket.
• Check and correct network
settings of your PC.
SIMATIC cannot Network switch is not • Check and correct power
communicate with powered up supply to the network switch.
SIMATIC Comfort Panel
If you checked everything and there is no communication at all, then perform the
checks recommended in the next chapter.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 27
 5 Operating

5.2.2 Network settings

Communication issues can be caused also by a misconfiguration of one of the

communication partners along the whole path.
Check the Ethernet settings for the communication partners to have
1. The same subnet mask (here: 255.224.0.0)
Figure 5-6: Ethernet Settings for S7-1200
© Siemens AG 2021 All rights reserved

2. Different IP addresses of the same subnet

For example this application example uses
10.11.20.45 for the S7-1200
10.11.20.14 for the Comfort Panel

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 28
 5 Operating

5.2.3 Configuration check

As next measure you can take to make the configuration workable is to check the
configuration made.
Check the connection in the Comfort Panel to address the correct SIMATIC S7.

Figure 5-7: Connection parameters

© Siemens AG 2021 All rights reserved

If you have set up multiple connections the configured tags may use another, then
misconfigured, connection. Check for the tags to be assigned to the correct
connection.

Figure 5-8: Tag parameters

If this is all corrected and downloaded to the Comfort Panel, you may want to
check the LCCF_CIPServer block as well.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 29
 5 Operating

5.2.4 SIMATIC Program

Answering the following questions may give you a hint on what needs to be
corrected.

Table 5-3: LCCF_CIPServer block checks

Observation Cause Remedy
status information doesn’t The block is not executed place an unconditional call
change their values, when to the block in either
enable is set to true
• cyclic program
• cyclic interrupt program
error is true, the moment Parameterization error check the status code and
enable is set to true correct the parameterization
valid becomes false after a Connection problems check the status code and
certain time follow the specific
recommendations further
down in the document.
The LCCF_CIPServer block reports certain error codes to inform the user about
issues in the execution. This document describes the status codes the CIP server
block reports in the chapter “Block Parameter”.
© Siemens AG 2021 All rights reserved

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 30
 6 LCCF_CIPServer block

6 LCCF_CIPServer block
6.1 Parameters
The LCCF_CIPServer block has been designed to require a minimum of
parameters to make its use as easy as possible. Still a minimum external
configuration is necessary, which is explained in the following chapter.
A call to the “CIP Server” block requires an instance DB to store operation relevant
data internally as shown in the below figure.

Table 6-1: Block call to LCCF_CIPServer

LAD SCL
© Siemens AG 2021 All rights reserved

The instance DB is generated automatically be the TIA Portal, when the call to the
block is placed.

Table 6-2: Parameter of the LCCF_CIPServer block

Name Direction Data Type Description
enable Input BOOL Rising edge enables the functionality
of the block. Any previously reported
fault will be cleared, and conditions re-
evaluated.
Falling edge shuts down the block and
stops any communications.
interface Input HW_ANY Hardware Identifier of the interface to
use for the communication. This
typically uses a system defined
constant.
It is possible to use any “Open User
Communication” supporting
interfaces. This includes Industrial
Ethernet CMs and CPs
bFiles InOut VARIANT Gets the variable assigned, which is
allocated for the mapping of binary
variables, organized as ARRAY of
WORD.
Equivalent to the B-Files in SCL500
and MicroLogix

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 31
 6 LCCF_CIPServer block

Name Direction Data Type Description

nFiles InOut VARIANT Gets the variable assigned, which is
allocated for the mapping of 16-Bit
integer variables, organized as
ARRAY of INT.
Equivalent to the N-Files in SCL500
and MicroLogix
fFiles InOut VARIANT Gets the variable assigned, which is
allocated for the mapping of Floating-
Point variables, organized as ARRAY
of REAL.
Equivalent to the F-Files in SCL500
and MicroLogix
lFiles InOut VARIANT Gets the variable assigned, which is
allocated for the mapping of 32-Bit
integer variables, organized as
ARRAY of DINT.
Equivalent to the L-Files in MicroLogix
stFiles InOut VARIANT Gets the variable assigned, which is
allocated for the mapping of String
variables with a length of 80
characters, organized as ARRAY of
STRING.
Equivalent to the ST-Files in SCL500
and MicroLogix
© Siemens AG 2021 All rights reserved

cFiles InOut VARIANT Gets the variable assigned, which is

allocated for the mapping of counter
variables, organized as ARRAY of
“LCCF_typeRokCounter”.
Equivalent to the C-Files in SCL500
and MicroLogix
tFiles InOut VARIANT Gets the variable assigned, which is
allocated for the mapping of timer
variables, organized as ARRAY of
“LCCF_typeRokTimer”.
Equivalent to the T-Files in SCL500
and MicroLogix
valid Output BOOL TRUE indicates that the values in the
mapping variables are valid.
FALSE some or all values are invalid
and should NOT be used for process
control.
busy Output BOOL TRUE indicates the CIP server block
is actively processing requests.
FALSE indicates the block is not
processing requests.
error Output BOOL TRUE indicates that an error occurred
during the operation of the block.
Depending on the type of the error
indicated by status (see below)
cycling of the enable flag may clear
the error.
FALSE indicates no error.
status Output WORD Status information about the
operational state of this block. For
details see CIP Server block status
messages

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 32
 6 LCCF_CIPServer block

Name Direction Data Type Description

diagnostic1 Output LCCF_typeDiagnostic A structure containing additional
information in case of an error, which
are relevant for debugging the CIP
server block. The content is of value
for the developer.

6.1.1 Block status messages

The LCCF_CIPServer block reports a status information to the user, which follows
a standardized pattern.
The status code is split into the error flag and a status information value.

Table 6-3: Error and status message format

15 14 12 11 8 7 0
Error Info/ Warning Class Code Specific Status Codes
16#7 = Information 0 = Information
16#8 = Error 2 = Parameter
related
4 = Internal Cause
6 = External Cause
© Siemens AG 2021 All rights reserved

Table 6-4: CIP Server block status messages

Valid Busy Error Status Cause Remedy
Code
(in hex)
TRUE TRUE FALSE 16#0000 Success/ OK --
FALSE FALSE FALSE 16#7000 No Call/ Idle Block is called with
enable = FALSE.
Create rising edge on
enable to start execution
FALSE TRUE FALSE 16#7001 Initial call Block starts initialization
and performs parameter
check
TRUE TRUE FALSE 16#7002 Follow Up call Block continues
initialization
TRUE TRUE FALSE 16#7601 Warning: Server Nothing to do. Server will
TimeOut reset connection and
restart automatically.
FALSE FALSE TRUE 16#8201 Error: B-File is not The parameter bFile does
an Array not have an array assigned
to it.
FALSE FALSE TRUE 16#8202 Error: N-File is not The parameter nFile does
an Array not have an array assigned
to it.
FALSE FALSE TRUE 16#8203 Error: F-File is not The parameter fFile does
an Array not have an array assigned
to it.
FALSE FALSE TRUE 16#8204 Error: L-File is not The parameter lFile does
an Array not have an array assigned

1 The parameter „diagnostics“ may be hidden in the block call.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 33
 6 LCCF_CIPServer block

Valid Busy Error Status Cause Remedy

Code
(in hex)
to it.
FALSE FALSE TRUE 16#8205 Error: ST-File is The parameter stFile does
not an Array not have an array assigned
to it.
FALSE FALSE TRUE 16#8206 Error: C-File is not The parameter cFile does
an Array not have an array assigned
to it.
FALSE FALSE TRUE 16#8207 Error: T-File is not The parameter tFile does
an Array not have an array assigned
to it.
FALSE FALSE TRUE 16#8211 Error: B-File has The parameter bFile has an
an invalid type element or an array of
elements of an invalid type
assigned to it. The type
needs to be of the supplied
data type
“LCCF_typeFielTypeB”
FALSE FALSE TRUE 16#8212 Error: N-File has The parameter nFile has an
an invalid type element or an array of
elements of an invalid type
assigned to it. The type
needs to be of the supplied
© Siemens AG 2021 All rights reserved

data type
“LCCF_typeFielTypeN”
FALSE FALSE TRUE 16#8213 Error: F-File has The parameter fFile has an
an invalid type element or an array of
elements of an invalid type
assigned to it. The type
needs to be of the supplied
data type
“LCCF_typeFielTypeF”
FALSE FALSE TRUE 16#8214 Error: L-File has The parameter lFile has an
an invalid type element or an array of
elements of an invalid type
assigned to it. The type
needs to be of the supplied
data type
“LCCF_typeFielTypeL”
FALSE FALSE TRUE 16#8215 Error: ST-File has The parameter stFile has
an invalid type an element or an array of
elements of an invalid type
assigned to it. The type
needs to be of the supplied
data type
“LCCF_typeFielTypeST”
FALSE FALSE TRUE 16#8216 Error: C-File has The parameter cFile has an
an invalid type element or an array of
elements of an invalid type
assigned to it. The type
needs to be of the supplied
data type
“LCCF_typeFielTypeC”
FALSE FALSE TRUE 16#8217 Error: T-File has The parameter tFile has an
an invalid type element or an array of
elements of an invalid type
assigned to it. The type
needs to be of the supplied

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 34
 6 LCCF_CIPServer block

Valid Busy Error Status Cause Remedy

Code
(in hex)
data type
“LCCF_typeFielTypeT”
FALSE FALSE TRUE 16#8401 Error: Cannot set The CIP server block
up server cannot set up a TCP
connection connection. This indicates
either an improperly
selected interface or the
lack of communication
resources
FALSE FALSE TRUE 16#8402 Error: Cannot The CIP server block fails
disconnect the to reset the server
server connection connection.
It is recommended to reset
the SIMATIC controller.
FALSE FALSE TRUE 16#8601 Error: failure The CIP server failed to
during receive of complete a receive system
data call. This may indicate a
connection break. Reset
the server by cycling
enable is recommended.
FALSE FALSE TRUE 16#8602 Error: failure The CIP server failed to
during send of complete a send system
data call. This may indicate a
© Siemens AG 2021 All rights reserved

broken connection. Reset

the server by cycling the
enable in recommended.
FALSE FALSE TRUE 16#8600 Error: Undefined The CIP server block
state requested an undefined
internal state. This needs to
be reported to the
developer alongside with
the information stored in
the diagnostics parameter.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 35
 6 LCCF_CIPServer block

6.1.2 Technical data

For better planning of the automation program the user must be aware, that
operating the LCCF_CIPServer has certain impacts on the PLC load.
As all the protocol handling is done in a user program, the cycle time will be
extended by the time the selected CPU model needs to answer the placed request.
As one could imagine the more often data are requested, the more often these
requests need to be answered.
Setting the update rates to the lowest acceptable value will reduce the load on the
automation program.
Besides program execution time memory considerations should also be made,
when selecting a CPU model.

For the S7-1200 controller family the technical data are listed in the below table
Table 6-5: Memory Consumption S7-1200
Block Load Memory Work Memory
LCCF_CIPServer 527.249 Bytes 45.236 Bytes
Instance DB 10.379 Bytes 2.132 Bytes

The execution time of the block is CPU model dependent and was measured on a
SIMATIC S7-1215C to be less than 1ms in average.
© Siemens AG 2021 All rights reserved

In the S7-1500 controller family the two required blocks require the memory listed
in the below table

Table 6-6: Memory Consumption S7-1500

Block Load Memory Work Memory
LCCF_CIPServer 547.766 Bytes 45.442 Bytes
Instance DB 10.920 Bytes 2.094 Bytes

The LCCF_CIPServer block serves requests from a single client. It is possible to

use multiple instances of the block to serve requests from different clients.
The number of parallel served clients depends on the number of available OUC
connection resources in the selected CPU model. For details refer to the technical
data of the specific CPU model.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 36
 7 Appendix

7 Appendix
7.1 CIP/ PCCC Communication path settings
The CIP uses a method of encapsulating the messages adding communication
path segments to the command segment. This leads to a longer and longer
growing message as the number of routing stations grows.
As an example, the following simple layout is used to explain that fact. Here the
S7-1500 is acting as a CIP Client instead the WinCC Adv. RT used throughout the
application example. The CIP server is represented by a ControlLogix or
CompactLogix system.

Figure 7-1: Schematic communication path setup

ControlLogix CompactLogix
(w. external Ethernet Interface) (integrated Ethernet Interface)

Backplane vBackplane
X1 X1 X1 X1 X1
© Siemens AG 2021 All rights reserved

X2 X2 X2 X2

C ontrolN et
22 32

192.168.0.22 192.168.0.32

Ethernet

192.168.0.12

Each CIP message contains the routing information to the target. Every time a
bridge accepts such a CIP message it strips out its own address information and
forwards the modified CIP message to the next addressee along the way. When
there is no further routing information available the destination target has been
reached and the CIP message will be interpreted. Once interpreted the response
will be send the same way back the request came. This means each bridge keeps
a reference to the request package.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 37
 7 Appendix

7.1.1 Case 1 – Accessing data inside an Allen- Bradley PLC

In this case a ControlLogix uses the ENET bridge in slot 4 (0 based counting) for
communicating with the CIP client. The processor module itself is in slot 1. An
additional ControlNet Bridge is in slot 6 and is not used in this scenario.
The S7-1500 sends a request to the ControlLogix on 192.168.0.22, slot 1.

Figure 7-2: Access Path ControlLogix with external Ethernet Interface

ControlLogix
(w. external Ethernet Interface)

Backplane
X1 X1 X1
© Siemens AG 2021 All rights reserved

X2 X2

22
ControlNet
192.168.0.22 X2

X2
Ethernet

Therefore, the parameters in the WinCC Panel’s driver configuration needs to be:

Table 7-1: WinCC EtherNet/IP driver settings

Parameter Name Value
IPv4 192.168.0.22
Communication Path 1,1

This communication path is formed as follows:

“192.168.0.22, 1, 1”
The IPv4 address (192.168.0.22) is addressing the X2 interface of the ENET
card. With the following part (1) in the communication path the interface X1 (more
accurate the backplane) is being addressed. This means the CIP message is being
forwarded to the backplane after it has removed the IPv4 address from the
communication path. The backplane therefore sees a reduced communication path
like this
“1, 1”
It recognized that the CIP message wasn’t meant for it and therefore, it removes its
address part (1) from the CIP message. The remaining CIP message is being

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 38
 7 Appendix

forwarded to the processor module as indicated by the remaining address

information (1). The message has now a reduced communication path. Only the
slot number is contained. The processor removes that information and starts
interpreting the remaining message as there is no further routing information in the
packet.
The following Wireshark packet analysis shows the additional segment.

Figure 7-3: Access Path encoding

© Siemens AG 2021 All rights reserved

Contrary to the above described situation, the communication path here shows that
the processor module is in slot 5. Here the CIP message follows the same path as
above, only difference is the slot number.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 39
 7 Appendix

7.1.2 Case 2 – Accessing the Allen- Bradley PLC via integrated Ethernet
port

In this scenario the CIP client wants to put some data into the CPU module using
the integrated Ethernet port. In a CPU module with integrated Ethernet port the
Ethernet port is in the same slot as the CPU module.
The CIP client (here the S7-1500) sends a request package to the CPU module at
192.168.0.32 addressing the processor module in slot 0.

Figure 7-4: Access Path CompactLogix with internal Ethernet Interface

CompactLogix
(integrated Ethernet Interface)

vBackplane
X1 X1
© Siemens AG 2021 All rights reserved

X2 X2

32

192.168.0.32
X2

X2 ControlNet

Ethernet

Following the previous schema, the communication path would look like this
“192.168.0.32, 1, 0”
Following the previous made explanations the CIP message would first travel
through the processor module to the backplane to be bounced back to the
processor module for interpretation. For such situations it is possible to use an
abbreviated communication path only containing the IPv4 address.

Table 7-2: WinCC EtherNet/IP driver settings

Parameter Name Value
IPv4 192.168.0.32
Communication Path 1,0

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 40
 7 Appendix

7.1.3 Case 3 – Accessing the Allen- Bradley PLC via the ControlNet
interface

In this scenario the CIP client (here S7-1500) wants to read data from the Allen-
Bradley PLC. Now the communication path will be through the CompactLogix
acting as bridge between EtherNet/IP and ControlNet.
Figure 7-5: Access Path with CompactLogix as bridge
ControlLogix CompactLogix
(w. external Ethernet Interface) (integrated Ethernet Interface)

Backplane vBackplane
X1 X1 X1 X1 X1

X2 X2 X2 X2
ControlNet
22 32

192.168.0.22 192.168.0.32

Ethernet
© Siemens AG 2021 All rights reserved

192.168.0.12

The yellow line in the above picture is represented by the following communication
path.
“192.168.0.32, 1, 6, 2, 22, 1, 1”
In the communication path the red marked sections always contain a network
specific address. The blue marked part identifies the backplane or the interface to
be used. Here it doesn’t matter, whether this backplane is physically existing or
virtual. The green part identifies the slot number of the next bridge module (next
hop) or the destination module.

Table 7-3: WinCC EtherNet/IP driver settings

Parameter Name Value
IPv4 192.168.0.32
Communication Path 1,6,2,22,1,1

NOTICE This scenario is not supported by the LCCF_CIPClient block. There is no

possibility to define the communication path to such an extend at the
LCCF_CIPClient block.

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 41
 7 Appendix

7.2 Service and support

Industry Online Support
Do you have any questions or need assistance?
Siemens Industry Online Support offers round the clock access to our entire
service and support know-how and portfolio.
The Industry Online Support is the central address for information about our
products, solutions and services.
Product information, manuals, downloads, FAQs, application examples and videos
– all information is accessible with just a few mouse clicks:
support.industry.siemens.com

Technical Support
The Technical Support of Siemens Industry provides you fast and competent
support regarding all technical queries with numerous tailor-made offers
– ranging from basic support to individual support contracts. Please send queries
to Technical Support via Web form:
www.siemens.com/industry/supportrequest

SITRAIN – Digital Industry Academy

© Siemens AG 2021 All rights reserved

We support you with our globally available training courses for industry with
practical experience, innovative learning methods and a concept that’s tailored to
the customer’s specific needs.
For more information on our offered trainings and courses, as well as their
locations and dates, refer to our web page:
www.siemens.com/sitrain

Service offer
Our range of services includes the following:
• Plant data services
• Spare parts services
• Repair services
• On-site and maintenance services
• Retrofitting and modernization services
• Service programs and contracts
You can find detailed information on our range of services in the service catalogue
web page:
support.industry.siemens.com/cs/sc

Industry Online Support app

You will receive optimum support wherever you are with the "Siemens Industry
Online Support" app. The app is available for iOS and Android:
support.industry.siemens.com/cs/ww/en/sc/2067

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 42
 7 Appendix

7.3 Industry Mall

The Siemens Industry Mall is the platform on which the entire siemens Industry
product portfolio is accessible. From the selection of products to the order and the
delivery tracking, the Industry Mall enables the complete purchasing processing –
directly and independently of time and location:
mall.industry.siemens.com

7.4 Links and literature

Table 7-4
Topic
© Siemens AG 2021 All rights reserved

\1\ Siemens Industry Online Support

https://support.industry.siemens.com
\2\ Download page of this entry
https://support.industry.siemens.com/cs/ww/en/view/109782316

7.5 Change documentation

Table 7-5
Version Date Modifications
V1.0 04/2021 First version

CIP server
Entry-ID: 109782316, V1.0.0, 04/2021 43