# Siemens S7

Siemens S7 PLC data right in the chat

ПЛК S7-300/400 по адресам STEP 7 через назначенный шлюз, только чтение; S7-1200/1500 через OPC UA

## How the agent works with Siemens S7

Data is read by the gateway: a program installed as a service on a computer or server on the site network that reaches the PLC over ISO-on-TCP, port 102. The connection takes the PLC address, the CPU rack and slot (0 and 2 by default, as on an S7-300) and a tag map: one line per tag with a path, the STEP 7 absolute address and a type. The gateway sends data out over outbound connections only.

The PLC names its PDU size at every connect: 240 bytes on an S7-300, 480 or 960 on an S7-400 and S7-1500. The driver packs requests to that size: tags of one area standing at most 5 bytes apart are read as one range, a request holds up to 20 items, and a long string is cut into pieces. S7 stores numbers big endian, so there is no byte order to choose.

The driver only reads: it sets up communication and sends Read Var, and has no write, block download, CPU stop or start. A tag the PLC refuses (address out of range, no data block, an optimized block) is marked bad with its code while the others keep reading. A whole request refused on an S7-1200/1500 means PUT/GET is not permitted in the CPU protection.

The gateway sends value changes and repeats a tag that has not changed every 1800 seconds; a deadband is set as a number or a percent of range. If the link to the cloud drops, data piles up on the gateway's disk and arrives once it is back. S7-300/400 timers and counters are read as elements T5 and C3, while S7-1200/1500 keeps its timers in a data block.

## Integration scenarios

### What is on the line now
The agent finds tags by path, such as line1/tank, and shows current values from data blocks and markers with their timestamp and whether they are fresh.

### Shift summary
The agent takes the temperature, pressure or flow history for a shift and shows the minimum, maximum, average and last value per hour.

### Pump running hours
The agent takes a week of raw samples of a run flag, such as DB1.DBX0.3, and counts how many hours the pump ran and how many times it started.

### A task on a threshold
The agent sets up a task that fires when a tag goes past a threshold and stays there for a set time, not on every sample past it.

### Tags the PLC refuses
The agent names tags the PLC refused with its code, such as address out of range, no such data block or access denied, and suggests what to fix in the tag map.

### Gaps in the data
The agent shows history intervals without samples and says whether the site gateway is online right now.

## How to connect

**Before you connect**

- An S7-300/400, S7-1200/1500, S7-200 or LOGO! PLC reachable over the network
- Port 102 open between the PLC and the gateway computer
- On S7-1200/1500: PUT/GET permitted in the CPU protection
- On S7-1200/1500: optimized access turned off on the data blocks you read
- A computer on the site network for the gateway service
- Absolute tag addresses from the STEP 7 or TIA Portal project

### Allow PUT/GET on S7-1200/1500
Enable «Permit access with PUT/GET» in the CPU protection in TIA Portal. Without it the PLC refuses every read and the connection gets an access denial.

### Turn off optimized access to the DBs
On S7-1200/1500 clear «Optimized block access» on every data block you read. The PLC refuses absolute address reads of an optimized block.

### Find the CPU's rack and slot
An S7-300 sits in slot 2, an S7-1200/1500 in slot 1, an S7-400 in the slot of its hardware configuration. LOGO! and S7-200 take TSAPs instead, 20.00 on LOGO! 0BA7/0BA8.

### Let port 102 through to the gateway
The gateway reaches the PLC over ISO-on-TCP on port 102. The network between the gateway computer and the PLC has to let this connection through.

### List the tags' absolute addresses
One line per tag: a path, the STEP 7 address and a type, such as DB1.DBD8 real or M10.1 bool. Write the address without the space TIA shows: DB1.DBX5.2.

## FAQ

### How do I connect Siemens S7?
Add a gateway on the Gateways tab and install it as a service on a computer on the site network. In the connection enter the PLC address, such as tcp://10.0.12.5:102, the CPU rack and slot and a tag map: one line per tag with a path, a STEP 7 address and a type, such as line1/tank/level DB1.DBD8 real. Assign the connection to the gateway and it starts polling.

### What does the agent see in Siemens S7?
The tags of the map: data blocks, markers, process image inputs and outputs, peripheral inputs, S7-300/400 timers and counters, and V memory of S7-200 and LOGO!. For each tag the agent reads the current value with its timestamp, the history in intervals and raw samples.

### Does the agent change values in the PLC?
No. The driver sends the PLC only communication setup and variable reads. It has no write, no block download and no command to stop or start the CPU.

### An S7-1200 answers with access denied. What should I check?
A whole request refused means «Permit access with PUT/GET» is not enabled in the CPU protection. If single tags are refused, check that their data block has optimized access turned off and the address does not run past its end. Symbolic tags of S7-1200/1500 are easier to read through their built-in OPC UA server.