# Siemens S7 communication

> Read and write SIMATIC controllers over their built-in Ethernet port with the S7 protocol, without an extra gateway, OPC server or PLC programming.

PLCGateway speaks the S7 protocol (ISO-on-TCP, port 102) that every SIMATIC CPU with an Ethernet interface understands. Data blocks, markers, inputs, outputs and S7 strings are read directly, nearby areas are merged and fetched in optimised multi-item requests sized to the PDU of the CPU.

For S7-1200 and S7-1500, enable PUT/GET access and switch off optimised block access for the data blocks you read. Controllers with their own OPC UA server can be connected through the OPC UA client as well; PLCGateway then works with symbolic names.

- **Driver id:** `s7`
- **Connection:** ISO-on-TCP (RFC 1006) · TCP 102
- **Address browsing:** addresses are typed or imported
- **Writing:** yes
- **Included in:** PLCGateway Connect, PLCGateway SCADA, PLCGateway Embedded

## What PLCGateway reads and writes

- Data blocks: bits, bytes, words, double words, REAL, LREAL
- Markers (M), inputs (I / E) and outputs (Q / A)
- S7 STRING with its two-byte header, or raw character arrays
- Timers and counters of classic CPUs
- Writing of single values from screens, OPC UA, MQTT or MCP
- Rack / slot and TSAP settings for S7-300/400, S7-1200/1500 and LOGO!

## Address examples

| Address | Meaning |
|---|---|
| `DB1.DBX0.3` | Data block 1, byte 0, bit 3 |
| `DB1.DBW2 · DB1.DBD4` | Word / double word (width from the tag type) |
| `DB10.DBS20[32]` | S7 STRING with a capacity of 32 characters |
| `MW100 · M10.3` | Marker word / marker bit |
| `I0.0 · IW2` | Input bit / input word |
| `Q4.1 · QW2` | Output bit / output word |

## Controllers and devices

- [Siemens SIMATIC](https://plcgateway.com/controllers/siemens.md)

## Connect in a few steps

1. In TIA Portal allow PUT/GET communication and switch off optimised block access for the data blocks to read (S7-1200 / S7-1500).
2. Add an S7 device with the IP address; rack 0, slot 1 for S7-1200/1500, rack 0, slot 2 for S7-300/400, or the TSAP for LOGO!.
3. Enter the tags with their addresses or import them from CSV and test the connection.
4. Use the values in SCADA screens or share them over OPC UA with MES, ERP and cloud systems.

## Questions and answers

### Do I have to change the PLC program?

No. Only the CPU properties change: PUT/GET access and, for data blocks, optimised block access off. The program logic stays as it is.

### Which is better for an S7-1500: S7 or OPC UA?

Both work. The S7 driver needs no OPC UA licence on the CPU and is very fast; the OPC UA client uses the symbolic names and the security of the CPU's OPC UA server. Many sites use S7 for fast cyclic values and OPC UA where symbolic access matters.

### Is LOGO! supported?

Yes. LOGO! 0BA7 and LOGO! 8 are connected with the S7 driver using the TSAP configured in LOGO!Soft Comfort.

## Related protocols

- [OPC UA client](https://plcgateway.com/protocols/opc-ua.md)
- [Modbus TCP / RTU](https://plcgateway.com/protocols/modbus.md)
- [Allen-Bradley EtherNet/IP (CIP)](https://plcgateway.com/protocols/ethernet-ip.md)
- [Mitsubishi MC protocol (SLMP)](https://plcgateway.com/protocols/mitsubishi-mc.md)
- [All protocols](https://plcgateway.com/protocols.md)

_Product and model names are trademarks of their owners. They are named only to show which equipment the drivers communicate with; PLCGateway is not affiliated with these companies._

---
Source: https://plcgateway.com/protocols/siemens-s7