S7

The S7 PLC component is an S7comm (Siemens S7 communication) client for Siemens programmable logic controllers (PLCs). It connects to one PLC and polls the addresses you list in its point map, publishing each one as a Profinity tag. It supports S7-300, S7-400, S7-1200 and S7-1500 controllers.

flowchart LR
    PLC["Siemens PLC"]
    subgraph Profinity
        Component["S7 PLC"] --> Tags
    end
    PLC --> Component

The S7 PLC component in Profinity polls the addresses in its point map from one Siemens PLC and publishes each as a Profinity tag

Licence required

The S7 plugin is not part of the standard installation, and it requires the Industrial Protocols licensed component group. Refer to Industrial Protocols for how to obtain, install, and licence it.

Add an S7 PLC to your Profile from the Industrial Protocols group in the component catalogue, as described in Adding Components to Your Profile. Add one component for each PLC you want to read. The settings below can be changed later from the component's Change Settings menu action.

You specify the memory area and byte offset of each value, and symbolic tag names are not supported. For symbolic access to an S7-1200 or S7-1500, use the OPC UA Client against the PLC's OPC UA server.

Prepare the PLC

S7-1200 and S7-1500 PLCs must have Put/Get access enabled before they answer, and data blocks must not use optimised block access, because optimised blocks cannot be read by absolute address. Both are changed in the PLC's project, in the Siemens engineering software (TIA Portal), by whoever maintains the PLC program.

Communications settings

Setting	Description
Name	The name of the component. Must be unique within the profile.
Host	The IP address of the PLC. Required. The default is `127.0.0.1`.
Port	The TCP port. Between `1` and `65535`. The default is `102`.
Rack	The rack number of the PLC. Between `0` and `7`. The default is `0`.
Slot	The slot number of the CPU (central processing unit). Between `0` and `31`. The default is `1`.
CPU type	The PLC family: `S7-300`, `S7-400`, `S7-1200` (the default) or `S7-1500`.
Poll interval (ms)	How often the point map is read, in milliseconds. Between `50` and `600000`. The default is `1000`.
Request timeout (ms)	How long Profinity waits for the PLC to answer a request, in milliseconds. Between `50` and `60000`. The default is `1000`.
Reconnect delay (ms)	How long Profinity waits between connection attempts, in milliseconds. Profinity keeps trying when the device is down at start and after a connection is lost, as described in Connections and reconnecting. Between `0` and `600000`. The default is `2000`.
Auto Connect	Connects to the PLC automatically when the profile is loaded. Off by default.

The usual rack and slot is 0 and 1 for S7-1200 and S7-1500 controllers, and 0 and 2 for most S7-300 controllers. Confirm the values in the PLC's hardware configuration.

Point map

The point map lists the PLC addresses to read. Each row becomes one tag.

Column	Description
Name	The name of the tag, published under the component's `Points` tags. Use a unique name for each row.
Area	The memory area: `DataBlock` (the default), `Memory` (M), `Input` (I) or `Output` (Q).
DB number	The data block number. Used only when the area is `DataBlock`, and ignored otherwise. The default is `1`.
Offset	The byte offset within the selected area.
Data type	How the value is read: `Boolean`, `Word` (the default), `SignedWord`, `Dword`, `SignedDword` or `Real`.
Writable	Allows Profinity to write the PLC value from the tag. Off by default.
Unit	An optional unit label for the tag.

The data types map to the width of the value in the PLC, and to the type of the Profinity tag.

Data type	Size	Profinity tag
`Boolean`	1 bit (bit `0` of the byte)	Boolean
`Word` / `SignedWord`	2 bytes (unsigned / signed)	Integer
`Dword` / `SignedDword`	4 bytes (unsigned / signed)	Integer
`Real`	4 bytes (floating point)	Number

A Boolean point always reads bit 0 of the byte at its offset, because the point map has no bit number, so the PLC program must place the value you need in bit 0 of a byte. A Boolean point at data block 1, offset 10 reads the address DB1.DBX10.0. Other types are read as, for example, DB1.DBW10 (word) or DB1.DBD10 (double word or real). For the Memory, Input and Output areas, a word at offset 10 is MW10, IW10 and QW10. Siemens tools set to German show the input and output areas as E and A rather than I and Q.

Writing to a PLC

A write can change the controlled process, so turn Writable on only for values that must be set from Profinity.

Dashboard

The component dashboard shows the connection STATUS, whether the PLC is CONNECTED, and the number of values read (RECEIVED) and values written (SENT). Use the Connect / Disconnect menu action to start or stop polling manually. Viewing the dashboard requires the Security administration permission, described under Roles and Permissions.

Polled values behave like any other tag, so they can be shown on a dashboard, logged, watched by a rule, or read by a script.

If a point shows bad quality

If a point cannot be read, its tag is marked as bad quality. The usual causes are Put/Get access disabled on the PLC, a data block that uses optimised block access, a wrong Rack or Slot, and a DB number or Offset that the PLC does not have. Check these before reading the Log for the reason. The Log records the first failed read of an outage as a warning, repeat failures in the same outage at debug level, and the first success afterwards at information level, as described in Connections and reconnecting. The first success is the first poll in which every point reads correctly.