Siemens S7
Communicates using the standard protocols of the SIEMENS SIMATIC S7 series (ISO-on-TCP / S7 protocol).
Supported series: S7-300 / S7-400 / S7-1200 / S7-1500 (+ S7-200 / S7-200 SMART / SINUMERIK 828D)
Registration form entries
| Field | What to enter | Example |
|---|---|---|
| IP address | IP of the PLC | 192.168.0.70 |
| Port | S7 communication port | 102 (standard / changing not recommended) |
| Controller Type (controller-type) | PLC series | S7_400 (default) / S7_300 / S7_200 / S7_200_SMART / S7_1200 / S7_1500 / SINUMERIK_828D |
| Rack (local-rack) | Rack number | Usually 0 |
| Slot (local-slot) | CPU slot number | Varies by series (see table below) — 3 if not specified |
| Multi read (multi-read) | Whether to read each chunk in a single round trip | true when checked (disabled by default — reads each tag individually) |
| Multi read max items (multi-read-max-items) | Upper limit of items per chunk | 18 (default, based on a 240-byte PDU budget) |
Rack / slot by series
| Series | rack | slot |
|---|---|---|
| S7-300 | 0 | 2 |
| S7-400 | 0 | 3 (may differ depending on the CPU slot) |
| S7-1200 | 0 | 0 (or 1) |
| S7-1500 | 0 | 0 (or 1) |
Prerequisite settings in TIA Portal
For security reasons, Siemens PLCs require the following settings before values can be read externally.
- In TIA Portal, go to PLC properties → Protection & Security → enable “Permit access with PUT/GET communication from remote partner”
- In the data block (DB) properties → turn Optimized block access OFF (switch to absolute addressing mode)
If either of these is not set, “Address out of range” or “Connection rejected” will occur.
PLC address notation for tags
Standard Siemens memory notation is used as-is. Addresses begin with %.
| Notation | Meaning |
|---|---|
%DB1.DBX0.0 | Bit 0 of byte 0 in DB1 (boolean value) |
%DB1.DBB0 | Byte 0 of DB1 (8-bit) |
%DB1.DBW0 | Word 0 of DB1 (16-bit) |
%DB1.DBD0 | Double word 0 of DB1 (32-bit / float) |
%I0.0 | Input bit 0.0 |
%Q0.0 | Output bit 0.0 |
%M0.0 | Memory bit 0.0 |
%MW100 | Memory word 100 |
%MD100 | Memory double 100 (32-bit) |
It also works without %, but we recommend adding % for consistency with the manual and other tools.
Data type matching
| PLC value | Data type | Type qualifier | PLC address example |
|---|---|---|---|
| Bool | Boolean | (leave empty) | %DB1.DBX0.0, %I0.0, %M0.0 |
| 8-bit | Integer | B | %DB1.DBB0 |
| 16-bit integer | Integer | (leave empty) | %DB1.DBW0, %MW100 |
| 32-bit integer | Integer | DW | %DB1.DBD0, %MD100 |
| 32-bit float (most common float type) | Float | REAL | %DB1.DBD0 |
| 64-bit float | Double | LREAL | %DB1.DBD8 |
| String (S7 STRING) | String | STR[N] | %DB1.DBB100 |
Check the Bool notation
Bool must always use the %DB1.DBX{byte}.{bit} format. Don't omit the trailing .0 – .7.
Common problems and solutions
| Symptom / message | Possible cause | Solution |
|---|---|---|
| “Connection refused” | Port 102 blocked, PUT/GET disabled | Enable PUT/GET communication in TIA Portal |
| “Connection rejected by remote” | rack/slot mismatch | Correct the rack/slot using the table above |
| “Address out of range” | DB is in Optimized mode (not absolute addressing mode) | In TIA Portal, go to DB properties → turn off Optimized block access |
All values are 0 | Wrong DB number / offset | Verify in the TIA Portal watch table that the same address actually works |
| Only Bool values fail to read | .bit missing | Specify down to .bit exactly, as in %DB1.DBX0.0 |
Frequently used examples
Tags commonly grouped on a single line PLC
| Tag name | PLC address | Data type | Type qualifier |
|---|---|---|---|
| Pump running (DB) | %DB1.DBX0.0 | Boolean | (leave empty) |
| Input signal | %I0.0 | Boolean | (leave empty) |
| Pressure (kPa, float) | %DB1.DBD8 | Float | REAL |
| Cumulative counter | %MD100 | Integer | DW |
| Batch name | %DB1.DBB100 | String | STR[16] |
More detailed examples / automated registration
See the S7 examples in Advanced — REST API.