S7

The S7 PLC component is an S7comm (Siemens S7 communication) client for Siemens programmable logic controllers (PLCs). It connects to one PLC and polls the addresses you list in its point map, publishing each one as a Profinity tag. It supports S7-300, S7-400, S7-1200, and S7-1500 controllers. The S7 plugin requires the Industrial Protocols licensed component group, and Install an industrial protocol plugin explains how to obtain, install, and licence it.

flowchart LR
    PLC["Siemens PLC"]
    subgraph Profinity
        Component["S7 PLC"] --> Tags
    end
    PLC --> Component

The S7 PLC component in Profinity polls the addresses in its point map from one Siemens PLC and publishes each as a Profinity tag

Add an S7 PLC to your Profile from the Industrial Protocols group in the component catalogue, as described in How to add a component to your profile. Add one component for each PLC you want to read. You can change the settings in the Communications settings section later from the component's Change Settings menu action.

You specify the memory area and byte offset of each value. Symbolic tag names are not supported. For symbolic access to an S7-1200 or S7-1500, use the OPC UA Client against the PLC's Open Platform Communications Unified Architecture (OPC UA) server.

Before you add the component, prepare the PLC:

Enable Put/Get access on S7-1200 and S7-1500 PLCs, which do not answer without it.
Do not use optimised block access on data blocks, because optimised blocks cannot be read by absolute address.

Whoever maintains the PLC program changes both in the PLC's project, in the Siemens engineering software (TIA Portal).

Communications settings

Setting	Description
Name	The name of the component. Must be unique within the profile.
Host	The IP address of the PLC. Required. The default is `127.0.0.1`.
Port	The Transmission Control Protocol (TCP) port. Between `1` and `65535`. The default is `102`.
Rack	The rack number of the PLC. Between `0` and `7`. The default is `0`.
Slot	The slot number of the CPU (central processing unit). Between `0` and `31`. The default is `1`.
CPU type	The PLC family: `S7-300`, `S7-400`, `S7-1200` (the default) or `S7-1500`.
Poll interval (ms)	How often the point map is read, in milliseconds. Between `50` and `600000`. The default is `1000`.
Request timeout (ms)	How long Profinity waits for the PLC to answer a request, in milliseconds. Between `50` and `60000`. The default is `1000`.
Reconnect delay (ms)	How long Profinity waits between connection attempts, in milliseconds. Between `0` and `600000`. The default is `2000`.
Auto Connect	Connects to the PLC automatically when the profile is loaded. Off by default, as described in Connections and reconnecting.

Profinity keeps trying to connect when the PLC is down at start and after a connection is lost, as described in Connections and reconnecting.

The usual rack and slot is 0 and 1 for S7-1200 and S7-1500 controllers, and 0 and 2 for most S7-300 controllers. Confirm the values in the PLC's hardware configuration.

Point map

The point map lists the PLC addresses to read. Each row becomes one tag.

Column	Description
Name	The name of the tag, published under the component's `Points` tags. Use a unique name for each row.
Area	The memory area: `DataBlock` (the default), `Memory` (M), `Input` (I) or `Output` (Q).
DB number	The data block number. Used only when the area is `DataBlock`, and ignored otherwise. The default is `1`.
Offset	The byte offset within the selected area.
Data type	How the value is read: `Boolean`, `Word` (the default), `SignedWord`, `Dword`, `SignedDword` or `Real`.
Writable	Allows Profinity to write the PLC value from the tag. Off by default.
Unit	An optional unit label for the tag.

The data types map to the width of the value in the PLC, and to the type of the Profinity tag.

Data type	Size	Profinity tag
`Boolean`	1 bit (bit `0` of the byte)	Boolean
`Word` / `SignedWord`	2 bytes (unsigned / signed)	Integer
`Dword` / `SignedDword`	4 bytes (unsigned / signed)	Integer
`Real`	4 bytes (floating point)	Number

A Boolean point always reads bit 0 of the byte at its offset, because the point map has no bit number. The PLC program must therefore place the value you need in bit 0 of a byte. At offset 10, the address each point reads is:

Area and data type	Address read
`DataBlock` 1, `Boolean`	`DB1.DBX10.0`
`DataBlock` 1, `Word`	`DB1.DBW10`
`DataBlock` 1, `Dword` or `Real`	`DB1.DBD10`
`Memory`, `Word`	`MW10`
`Input`, `Word`	`IW10`
`Output`, `Word`	`QW10`

Siemens tools set to German show the input and output areas as E and A rather than I and Q.

Writing to a PLC

A write can change the controlled process, so turn Writable on only for values that must be set from Profinity.

Dashboard

The component dashboard shows the connection STATUS and whether the PLC is CONNECTED. It also shows the number of values read (RECEIVED) and values written (SENT). Use the Connect / Disconnect menu action to start or stop polling manually. Viewing the dashboard requires the Security administration permission, described under Roles and permissions.

Polled values behave like any other tag, so they can be shown on a dashboard, logged, watched by a rule, or read by a script.

If a point shows bad quality

If a point cannot be read, its tag is marked as bad quality. Check the usual causes in this table before reading the Log for the reason.

Cause	Fix
Put/Get access is disabled on the PLC.	Enable Put/Get access in the PLC's project.
A data block uses optimised block access.	Turn off optimised block access for the data block in the PLC's project.
Rack or Slot is wrong.	Set the values from the PLC's hardware configuration.
The PLC does not have the DB number or Offset.	Correct the point map row to an address that exists in the PLC.

Refer to Connections and reconnecting for how the Log records failed reads and recovery.