Adding Siemens S7 PLCs

Last updated

The Siemens S7 driver uses ISO-on-TCP (RFC 1006) on port 102. It addresses memory by data block and byte offset, not by symbol name.

One-time PLC setup

S7-1200 / S7-1500 (TIA Portal)

1. PLC Properties → Protection & Security → Connection mechanisms: tick Permit access with PUT/GET communication from remote partner.
2. For every data block you'll read: DB Properties → Attributes: untick Optimized block access, compile, and note the Offset column that appears.
3. Download to the PLC.

S7-300 / S7-400: PUT/GET is allowed by default. Note the CPU's rack and slot in the hardware configuration (usually rack 0, slot 2).

Connection fields

Field	Value
IP Address	CPU's PROFINET/Ethernet port or CP module.
Port	102, the ISO-on-TCP port. Change it only for a router or gateway that forwards another port to the CPU's 102.
Rack, Slot	Under Driver Settings. Defaults rack 0, slot 1.

Slot 1 suits S7-1200/1500 (slot 0 also works on most). S7-300/400 CPUs are normally in slot 2: set Slot to 2 and save.

Address syntax

AREA/TYPE/OFFSET, case-insensitive:

Example	Reads	Type
DB1/REAL/0	4-byte REAL at DB1.DBD0	float
DB1/LREAL/0	8-byte LREAL	float
DB1/INT/4	2-byte signed INT at DB1.DBW4	int
DB1/WORD/6, DB1/UINT/6	2-byte unsigned WORD / UINT	int
DB1/DINT/8	4-byte signed DINT at DB1.DBD8	int
DB1/DWORD/8, DB1/UDINT/8	4-byte unsigned DWORD / UDINT	int
DB1/TIME/8	4-byte TIME, in milliseconds	int
DB1/BYTE/2, DB1/USINT/2, DB1/SINT/2	one byte (SINT is signed)	int
DB1/LINT/0, DB1/ULINT/0, DB1/LWORD/0	8-byte integers	int
DB1/BOOL/12.3	bit 3 of byte 12 (DB1.DBX12.3)	bool
DB1/STRING/20	S7 STRING starting at byte 20	string
M/BYTE/10	merker byte MB10	int
M/BOOL/10.2	merker bit M10.2	bool
I/BYTE/0, I/BOOL/0.3	input byte IB0, input bit I0.3	int, bool
Q/WORD/0	output word QW0	int
T/TIMER/5 (or T/5)	timer T5's current value, in milliseconds	int
C/COUNTER/5 (or C/5)	counter C5's current value, 0–999	int

• M, I and Q take every type a DB does.
• T and C are the timer and counter areas of S7-300/400 CPUs. S7-1200/1500 timers and counters (TON, CTU…) keep their values in instance data blocks: read the ET member as TIME and CV as INT from that DB (with optimized access off).
• The driver speaks the classic S7 protocol, which only knows absolute addresses. To pick tags by name, import the symbols from TIA Portal (below). Optimized blocks have no absolute addresses at all; read those with the Siemens S7 (OPC UA) device type.
• Not supported: DATE_AND_TIME, DTL, WSTRING, arrays and structures as one tag (read their members one by one).

Browse Tags doesn't read the PLC. It lists nine example addresses (DB1/REAL/0, DB1/BOOL/10.0, M/BYTE/0 …), or the symbols you imported and any list in driverConfig.tags. Subscribe real addresses with Manage Tags → Add Tag.

Symbols from TIA Portal (optional)

On the device page, Settings → Driver Settings → TIA Portal symbols → Import from TIA Portal… reads TIA Portal exports in the browser and maps each symbol to its address. Select one or more files:

Export	How to make it in TIA Portal	Gives
PLC tag table, .xlsx	Open the tag table, Export	I, Q, M, T and C tags with their addresses
PLC tag table, CSV or text	Save that .xlsx as CSV, or copy the table's rows (with the header row) into a text file	the same
Data block source, .db / .scl (plus .udt)	Select the data blocks (and the PLC data types they use), Generate source from blocks	global DBs; the DB number is asked for, since sources do not hold it
Openness XML	An Openness export of global DBs, PLC data types or tag tables	the same, with DB numbers

The import shows how many symbols it found and what it left out, then Add symbols puts them in the table; Save keeps them. Importing again replaces symbols of the same name and keeps the rest. Up to 5,000 symbols per device; arrays are expanded to their first 1,000 elements.

• Browse Tags then lists the symbols by name, such as "Motor_DB".Speed or "Start_PB", and a tag made from one reads the address behind it. The tag path is the symbol, so after a change to the block, import again and the tag follows the new offset. Quotes are optional: Motor_DB.Speed is the same symbol.
• Only standard blocks are imported. A block with Optimized block access on, an instance DB, and members of types the driver can't read (DTL, DATE_AND_TIME, WSTRING, CHAR…) are listed and skipped; the members that follow keep their right offsets. A member whose PLC data type is missing from the files stops that block there: add the data type's source and import again.
• Offsets of data block members are calculated from the declarations with Siemens' standard-access layout rules, since neither export holds them. Compare a few with the Offset column in TIA Portal before relying on them, especially after strings and arrays.
• Peripheral addresses (%IW64:P) and tags whose data type does not fit their address are skipped.

Writes

With Allow Tag Writes on, every type above can be written in the DB, M and Q areas, plus timers and counters. BOOL is a read-modify-write of its byte; STRING keeps the declared length and refuses longer text; a timer value is converted to S5TIME (up to 9990 s, rounded to the timer's resolution); a counter takes 0–999. A value outside the type's range (for example 70000 into a WORD, or −1 into a UINT) is refused and nothing is written. Inputs (I) aren't writable — the CPU overwrites them every scan.

Worked example: line speed and fault bit from DB10

The PLC programmer gives you DB10 "LineData" (non-optimized) with Speed : Real at offset 0.0 and Fault : Bool at 4.1.

1. Add a Siemens S7 device at 192.168.0.10.
2. Manage Tags → Add Tag: DB10/REAL/0, Data Type float, Display Name Line Speed.
3. Add Tag: DB10/BOOL/4.1, Data Type bool, Display Name Line Fault.

Troubleshooting

Symptom	Cause	Fix
Error — Could not reach device at IP:102	IP wrong, port 102 blocked, or wrong rack/slot.	Ping the CPU; check Rack and Slot under Driver Settings.
Connected, reads Bad; log function refused by CPU	PUT/GET not permitted.	Enable PUT/GET and download.
Reads Bad; log Address out of range	DB doesn't exist, offset past the end, or optimized block access on.	Turn optimized access off; check offsets in the DB.
Values look wrong	Wrong offset or type (e.g. reading a REAL as INT).	Confirm offsets from the DB's Offset column.
Prefer symbolic names	The classic protocol has none.	Import symbols from TIA Portal (standard blocks), or use Siemens S7 (OPC UA) (any block).
A symbol tag reads Bad; log unknown S7 area	The symbol is no longer in the imported table.	Import the symbols again, or change the tag path.
T/… or C/… reads Bad on an S7-1200/1500	Those CPUs have no T and C areas.	Read the timer's or counter's instance DB instead.

See also

• Adding a Device (Add Device Wizard)
• Advanced Driver Settings (driverConfig)
• Polling, Reconnect and Connection Status
• Adding OPC-UA and MQTT Devices