Siemens S7 Configuration

Connect to Siemens S7 PLCs for high-speed data collection

Siemens S7 Configuration

DataForeman supports direct communication with Siemens S7 PLCs (S7-300, S7-400, S7-1200, S7-1500) using the native S7 protocol via node-snap7.

Overview

The Siemens S7 driver provides:

  • Direct PLC communication without OPC UA
  • Support for all S7 data types
  • Read from Data Blocks, Inputs, Outputs, and Markers
  • Multi-rate polling for optimization
  • High-speed data collection

Connection Setup

Required Information

Field Description Typical Value
IP Address PLC network address 192.168.1.100
Connection Name Friendly identifier S7 Main PLC
Rack PLC rack number 0 (most common)
Slot CPU slot number S7-300/400: 1
S7-1200/1500: 0
Port TCP port 102 (default)

Creating a Connection

  1. Navigate to Connectivity → DEVICES tab
  2. Select the SIEMENS S7 protocol tab
  3. Click Setup New Connection
  4. Fill in the connection details:

IP Address:

  • Must be reachable from DataForeman server
  • Use static IP (avoid DHCP for PLCs)
  • Example: 192.168.1.50

Rack and Slot:

  • S7-300/400: Usually Rack=0, Slot=1
  • S7-1200/1500: Usually Rack=0, Slot=0
  • Check your PLC hardware configuration to confirm
  1. Click Save to create the connection
  2. Connection will start automatically

Note: Test connection feature is not currently available for S7. The connection will attempt to connect when saved.

S7 Addressing

Tags must be added manually using S7 address notation.

Address Format

Data Blocks (DB):

DB<number>.DB<type><byte>.<bit>
Format Data Type Example Description
DBX<byte>.<bit> Bool DB1.DBX0.0 Bit at byte 0, bit 0
DBB<byte> Byte (8-bit) DB1.DBB0 Byte at byte 0
DBW<byte> Word (16-bit INT) DB1.DBW2 Word at byte 2
DBD<byte> DWord (32-bit REAL) DB1.DBD4 DWord/REAL at byte 4

Marker Area (M):

M<type><byte>.<bit>
Format Example Description
MX<byte>.<bit> M0.0 Marker bit
MB<byte> MB0 Marker byte
MW<byte> MW0 Marker word
MD<byte> MD0 Marker double word

Input Area (I):

I<type><byte>.<bit>
Format Example Description
IX<byte>.<bit> I0.0 Input bit
IB<byte> IB0 Input byte
IW<byte> IW2 Input word
ID<byte> ID4 Input double word

Output Area (Q):

Q<type><byte>.<bit>
Format Example Description
QX<byte>.<bit> Q0.0 Output bit
QB<byte> QB0 Output byte
QW<byte> QW2 Output word
QD<byte> QD4 Output double word

Address Examples

Temperature sensor in DB10:

DB10.DBD0    (REAL type, 32-bit float)

Motor status bits in DB20:

DB20.DBX0.0  (Motor 1 Running - Bool)
DB20.DBX0.1  (Motor 2 Running - Bool)
DB20.DBX0.2  (Motor 3 Running - Bool)

Process values in DB1:

DB1.DBW0     (Setpoint - INT)
DB1.DBD2     (Current Value - REAL)
DB1.DBX6.0   (Alarm Active - Bool)

Adding Tags

Tags must be added manually through the Tags tab.

Manual Tag Entry

  1. Go to Connectivity → TAGS tab

  2. Select SIEMENS S7 protocol

  3. Choose your S7 connection

  4. Enter tag information:

    • Address: S7 address (e.g., DB1.DBD0)
    • Tag Name: Display name (e.g., Tank1_Level)
    • Data Type: Select from dropdown
    • Poll Group: Choose sampling rate

  5. Click Add Tag to save

  6. Repeat for additional tags

Supported Data Types

Type Description Size Range
BOOL Boolean 1 bit true/false
BYTE Unsigned byte 8 bits 0-255
INT Signed integer 16 bits -32768 to 32767
DINT Double integer 32 bits -2147483648 to 2147483647
REAL Floating point 32 bits IEEE 754 float

CSV Import/Export

For bulk tag management, use CSV import/export:

Export existing tags:

  1. Click CSV Import/Export button
  2. Select Export CSV
  3. Edit in Excel

Import tags:

  1. Create CSV with required columns:
    • address: S7 address (required)
    • tag_name: Display name (required)
    • data_type: BOOL, BYTE, INT, DINT, or REAL (required)
    • poll_group: Poll group name (optional)
    • unit: Engineering unit (optional)
  2. Click Import CSV and select file
  3. Review and confirm

Example CSV:

address,data_type,tag_name,poll_group,unit
DB10.DBD0,REAL,Tank1_Level,Fast,%
DB10.DBD4,REAL,Tank1_Temperature,Medium,°C
DB10.DBX8.0,BOOL,Tank1_High_Alarm,Fast,
M0.0,BOOL,System_Running,Slow,

Multi-Rate Polling

Configure different sampling rates using Poll Groups:

Poll Group Rate Use Case
Ultra Fast 50ms Critical control
Very Fast 100ms High-speed monitoring
Fast 250ms Process control
Normal 500ms Standard monitoring
Standard 1000ms Default rate
Slow 2000ms Slow-changing values
Very Slow 5000ms Status flags

Assign tags to appropriate poll groups to optimize PLC load and network traffic.

Connection Management

Starting/Stopping

  • Connections start automatically when created
  • Click Start/Stop button to control connection
  • Green indicator = connected and healthy
  • Red indicator = disconnected or error

Editing Connections

  1. Click edit icon (✏️) on connection row
  2. Modify IP address, rack, or slot
  3. Save changes
  4. Connection restarts automatically

Deleting Connections

Cannot delete connections with saved tags. Remove all tags first.

Troubleshooting

Connection Failed

“Cannot connect to PLC”:

  • Verify PLC IP address is correct
  • Ping the PLC from DataForeman server
  • Check firewall allows port 102
  • Verify rack and slot numbers
  • Ensure PLC has accessible data blocks

“Wrong rack/slot”:

  • S7-300/400: Try Rack=0, Slot=1
  • S7-1200/1500: Try Rack=0, Slot=0
  • Check PLC hardware configuration in TIA Portal/STEP 7

Tags Not Updating

Check connection status:

  • Green dot on Devices tab = connected
  • Red dot = connection failed

Verify addresses:

  • Address format correct? (e.g., DB1.DBD0)
  • Data block exists in PLC program?
  • Byte offset within DB boundaries?

PLC mode:

  • PLC must be in RUN mode for data collection
  • STOP mode prevents reading process values

Performance Issues

Slow polling:

  • Reduce number of tags
  • Use slower poll groups for non-critical tags
  • Optimize address ranges (consecutive reads are faster)

High PLC load:

  • Group tags by poll rate
  • Don’t over-poll slow-changing values
  • Consider using write-on-change to reduce database writes

Best Practices

Performance

  • Group consecutive addresses: Reading DB1.DBD0, DB1.DBD4, DB1.DBD8 in same poll is faster than scattered addresses
  • Appropriate poll rates: Use Fast (250ms) for control, Standard (1000ms) for monitoring
  • Limit tag count: Keep under 500 tags per connection for best performance
  • Enable write-on-change: Reduce database storage significantly

Addressing

  • Use data blocks: Easier to organize and manage than marker areas
  • Document offsets: Keep track of byte offsets in TIA Portal/STEP 7
  • Consistent naming: Follow plant naming standards
  • Reserve space: Leave gaps in data blocks for future expansion

Reliability

  • Static IP addresses: Never use DHCP for PLCs
  • Dedicated network: Isolate OT network from IT network
  • Monitor connection: Use Live Status to verify health
  • Backup configurations: Export tag CSV files regularly

Security

  • Network isolation: Use VLANs to separate PLC network
  • Firewall rules: Restrict access to port 102
  • Read-only access: Configure DataForeman for read-only (write support coming soon)
  • Monitor access: Review diagnostic logs

Network Requirements

Firewall Rules:

  • Outbound TCP: Port 102 (S7 protocol)
  • Direction: DataForeman → PLC
  • Protocol: TCP only

Docker Considerations:

  • No port mapping needed (outbound connection)
  • Ensure Docker network can reach PLC IPs
  • Use host network or bridge with proper routing

Limitations

Current version:

  • Write support not yet implemented
  • No PLC program upload/download
  • No tag browse capability (manual entry only)
  • No support for S7-200 (different protocol)

Coming soon:

  • Tag write operations
  • Improved error diagnostics
  • Connection test before save

For PLC programming and data block configuration, refer to Siemens TIA Portal or STEP 7 documentation.