Configure the Siemens S7 Connector
Configure Siemens S7 instances and absolute-address items, read and write PLC data, use arrays and identity items, and troubleshoot communication.
The Siemens S7 Connector reads and writes absolute addresses in Siemens S7 PLC memory. Use it with non-optimized data blocks and direct input, output, or marker addresses on S7-300, S7-400, S7-1200, and S7-1500 controllers.
This guide combines instance setup, item addressing, data types, arrays, read and write behavior, and troubleshooting.
This Connector uses absolute addresses. For optimized data blocks and symbolic addresses on S7-1200 and S7-1500 PLCs, use the Siemens S7 Plus Connector. Use the separate Siemens LOGO! Connector for S7-200 and LOGO! controllers.
Prerequisites
- Install the Siemens S7 Connector.
- Connect SIA Connect and the PLC to a network where they can reach each other.
- Allow ISO-on-TCP communication to the PLC on TCP port
102. - For PLCs configured in TIA Portal, enable PUT/GET communication when required.
- Use non-optimized data blocks for DB addresses.
- Confirm that the PLC protection settings permit the required access.
- Identify the PLC rack, slot, absolute addresses, and data types.
See Prepare PLC in TIA Portal for external communication for the PLC-side settings.
Configure a Siemens S7 instance
- Open Workspace > Instances.
- Create an instance and select the Siemens S7 Connector.
- Enter a clear instance name.
- Enter the PLC IP address or hostname in Address.
- Enter the PLC Rack and Slot.
- Create the instance.
Instance parameters
| Parameter | Required | Default | Description |
|---|---|---|---|
| Address | Yes | None | The IPv4 address or hostname of the PLC. |
| Rack | Yes | 0 |
The rack number used for the S7 connection. |
| Slot | Yes | 0 |
The slot containing the target CPU or communication endpoint. |
Typical values are shown below. Confirm the correct values for your PLC and hardware configuration.
| PLC family | Typical Rack | Typical Slot |
|---|---|---|
| S7-300 | 0 |
2 |
| S7-1200 | 0 |
0 |
| S7-1500 | 0 |
0 |
PLC identity items
The Connector automatically creates the following read-only items for each Siemens S7 instance:
| Item | Description |
|---|---|
| Vendor | The PLC manufacturer. The value is Siemens. |
| Model | The CPU module type or a model derived from the CPU order code. |
| Serial | The CPU serial number. |
| Firmware | The CPU firmware version. |
| Product code | The Siemens CPU order code. |
The available values depend on the information returned by the PLC. Vendor can still report Siemens when the other identity values are unavailable.
Configure an item
The Siemens S7 Connector does not discover PLC tags. Create each item manually from its absolute address.
- Open the Siemens S7 instance.
- Create an item.
- Enter a clear item name.
- Enter the absolute PLC memory address in Address.
- Select the matching Type.
- Configure the item's read, write, and polling settings as required.
- Create the item.
The selected Type determines how many bytes are read and how the value is decoded or encoded. It must match the PLC tag.
Item parameters
| Parameter | Required | Default | Description |
|---|---|---|---|
| Address | Yes | None | The absolute DB, input, output, or marker address. |
| Type | Yes | BOOL | The Siemens data type used to decode reads and encode writes. |
Addresses are not case-sensitive. Use periods in the documented address format.
Supported data types
| Type | Size | Value | DB example |
|---|---|---|---|
| BOOL | 1 bit |
0 or 1
|
DB2.DBX19.3 |
| BYTE | 1 byte |
0 to 255
|
DB2.DBB20 |
| WORD | 2 bytes |
0 to 65535
|
DB2.DBW20 |
| INT | 2 bytes |
-32768 to 32767
|
DB2.DBW20 |
| DWORD | 4 bytes |
0 to 4294967295
|
DB2.DBD22 |
| DINT | 4 bytes |
-2147483648 to 2147483647
|
DB2.DBD22 |
| REAL | 4 bytes | 32-bit floating-point value | DB2.DBD26 |
| STRING | Configured in the address | Siemens S7 string | DB2.DBB20-12 |
| TIME | 4 bytes | Not implemented by the current Connector runtime | Do not use |
TIME is available in the Type list, but the current Connector source does not implement TIME conversion for reads or writes.
Address data blocks
| Purpose | Type | Example |
|---|---|---|
| Bit in a data block | BOOL | DB2.DBX19.3 |
| Byte in a data block | BYTE | DB2.DBB20 |
| Two-byte value | WORD or INT | DB2.DBW20 |
| Four-byte value | DWORD, DINT, or REAL | DB2.DBD22 |
The Connector uses the selected Type to determine the value size. The DBX, DBB, DBW, and DBD notation keeps the configured address aligned with standard Siemens absolute-address conventions.
Address inputs, outputs, and markers
| Memory area | Supported prefixes | BOOL example | Multibyte example |
|---|---|---|---|
| Inputs |
I, E, DI, DE, AI, AE
|
I1.0 |
I2 with Type WORD, INT, DWORD, DINT, or REAL |
| Outputs |
Q, A, O, DQ, DA, DO, AQ, AA, AO
|
Q2.1 |
Q4 with the required multibyte Type |
| Markers |
M, MB, MW, MD
|
M3.0 |
M4, MB4, MW4, or MD4 with the matching Type |
Read arrays
Add a range to the address to read a block of values. Array values are returned as a compact JSON array.
| Type | Example | Result |
|---|---|---|
| BOOL | DB2.DBX10-12 |
Reads bytes 10 and 11 and returns 16 bit values. |
| BYTE | DB2.DBB10-13 |
Reads bytes 10 through 12 and returns three values. |
| WORD or INT | DB2.DBW12-17 |
Reads three two-byte values. |
| DWORD, DINT, or REAL | DB2.DBD20-31 |
Reads three four-byte values. |
For BOOL and BYTE ranges, the ending offset marks the first byte after the range. For WORD, INT, DWORD, DINT, and REAL ranges, use the last byte occupied by the final value.
Read strings and string arrays
A Siemens S7 STRING stores two header bytes before its characters. The configured length must include these two bytes.
| Purpose | Example | Description |
|---|---|---|
| Single string using byte length | DB2.DBB20-12 |
Starts at byte 20 and reads a 12-byte Siemens string, allowing up to 10 characters. |
| Single string using final byte | DB2.DBB20-31 |
Reads bytes 20 through 31, which is also 12 bytes. |
| String array | DB2.DBB0(27)-54 |
Reads three strings. Each string occupies 27 bytes and starts at byte 0, 27, or 54. |
When writing a string, the Connector limits the text to the configured character capacity.
Write values and arrays
Configure an item for writing only when the target PLC address is intended to accept external values.
- Write scalar BOOL, BYTE, WORD, INT, DWORD, DINT, REAL, and STRING values in their normal value format.
- Write an array as a valid JSON array, such as
[10,20,30]. - The Connector writes no more values than the configured array length.
- An empty value is skipped.
- If several writes for the same item are waiting, the Connector uses the newest pending value.
Test writes with a safe PLC address and process state. Incorrect writes can change machine operation.
Understand grouped reads
The Connector groups nearby items from the same data block or memory area into one read operation. This reduces communication overhead. It separates different DB, input, output, and marker areas, and splits groups when the address gap is larger than the negotiated PDU size.
If a grouped read fails, several items in that read group can show the same error. Check every configured address in the affected group, not only the first item that reports the problem.
Verify communication
- Enable the Siemens S7 instance and its items.
- Confirm that the instance has no connection error.
- Check whether the PLC identity items contain the expected information.
- Confirm that item values update at the configured interval.
- For a writable item, perform a controlled write when it is safe.
- Confirm the value in the PLC and verify that the item reads back the expected result.
Troubleshoot the Siemens S7 Connector
| Issue or message | Cause | Action |
|---|---|---|
Unreachable peer |
The PLC address cannot be reached. | Confirm the IP address or hostname, PLC power, cable, interface configuration, subnet, routing, and firewall. Test network reachability with the Ping tool. |
Connection timed out |
The host is reachable but the S7 connection was not established. | Confirm Rack and Slot. Check TCP port 102, PLC protection, and PUT/GET settings. |
| An ISO connection error | The established connection was interrupted or ISO-on-TCP communication failed. | Check the network and PLC state. The Connector closes the failed connection and attempts to reconnect during a later operation. |
Function refused by CPU |
The PLC rejected the requested PUT/GET operation. | Enable PUT/GET communication and select a protection level that permits the required access. |
Item not available |
The requested address is unavailable or cannot be accessed. | Confirm that the DB exists, uses non-optimized access, and contains the requested offset. Check PUT/GET and protection settings. |
Address out of range |
The configured offset or range extends beyond the available PLC memory. | Correct the address or reduce the configured array or string range. |
Unsupported memory area |
The address prefix is not recognized as DB, input, output, or marker memory. | Use one of the address prefixes documented in this guide. |
Invalid offset in address |
The Connector could not find a numeric byte offset. | Correct the address and include the DB number and offset, or the direct-area offset. |
Invalid address. Address: ... |
The absolute address does not contain the expected area and offset structure. | Compare the address with the examples in this guide and correct its separators and numbers. |
Could not determine length of string |
The STRING address does not include a valid byte length or final offset. | Use a format such as DB2.DBB20-12 or DB2.DBB20-31. |
Write array error: Invalid format... |
An array item received a value that is not a JSON array. | Write a valid JSON array such as [1,2,3]. |
Internal error (Code: ...) |
The underlying S7 communication library returned an internal error. | Review the system and Connector logs. Check the preceding network or item operation, then retry. |
| Several items show the same read error | One grouped DB or memory-area read failed. | Check all addresses in the affected group for an invalid or inaccessible offset. |
| Model, Serial, Firmware, or Product code is empty | The PLC did not return the corresponding CPU information or the Connector could not establish a complete connection. | Resolve the connection first. Some PLCs may not provide every identity field. |