Siemens S7 driver

PLC settings, connection steps, automatic switchover to the backup PLC and common errors for connecting to S7-1500, S7-1200 and S7-300 / 400 CPUs via PUT/GET and reading and writing tags with absolute addresses (DB, M, I, Q).

When to use it

Three drivers (Siemens S7-1500, Siemens S7-1200, Siemens S7-300 / 400) use the same protocol: S7 communication, PUT/GET, TCP port 102. Tags are given with an absolute address (DB1.DBX0.0, MW20). The S7-1500 and S7-1200 drivers carry the same set of parameters, addresses and data types; only their IDs differ (s7-1500, s7-1200). The S7-300 / 400 driver has no LReal and SInt types, and its default slot is 2.

In redundant systems with two CPUs, the connection can be set up to communicate with the CPU that is master (Automatic switchover to the backup PLC).

If the data block has Optimized block access enabled (symbolic) or if you need secure communication, this driver is not suitable; use the OPC UA driver.

Prerequisites on the PLC side

1. Allow PUT/GET access

   The CPU properties must allow access by a remote partner through PUT/GET communication (in TIA Portal: CPU properties › Protection and security › Connection mechanisms; menu names may vary depending on the TIA version). If it is off, the CPU rejects the requests and Live reports a PUT/GET error.

2. Turn off "Optimized block access" in the data block

   Optimized block access must be cleared in the properties of every data block you want to read, so that the byte addresses of the variables are fixed. Recompile the block and load it to the CPU. Take the bit, byte and word addresses from the Offset column of the block.

3. Find out the rack and slot number

   On the S7-1200 / 1500, the CPU is in rack 0, slot 1. On the S7-300 it is in slot 2. On the S7-400, take the rack and slot number in which the CPU is installed from the hardware configuration.

4. Network access

   The Live computer and the PLC must be on the same network, and any firewall between them must allow TCP port 102.

Setting up a connection

1. Add a connection

   In the Connections section, click Add and, as the Communication driver, select the S7 driver that matches your CPU.

2. Address and port

   Enter the IP address of the CPU in the IP address / computer name cell. The port remains 102.

3. Rack and slot

   In the Inspector, enter the Rack (0 – 7) and Slot (0 – 31) fields. Slot tooltip: The slot the CPU is plugged into: 2 for S7-300, 1 for S7-1200 / 1500.

4. Add a tag

   In the HMI tags section, create tags bound to this connection. The address cell validates the address as you type and shows its resolution below the cell (Tag addresses).

   1234

   1. Connection — the PLC connection the tag is bound to.
   2. Data type — determines the size letter of the address.
   3. Address — absolute S7 address (DB30.DBD2).
   4. Address resolution — the resolution of the address or an error.

5. Test

   Online›Test connections… only shows that TCP port 102 is open; the S7 session and the PUT/GET permission are tried only in Live, when a tag is read (Connection diagnostics).

Address and data type notes

• The size letter must match the type: Bool → DBX / M10.3, Byte and SInt → DBB / MB, Int and UInt → DBW / MW, DInt, UDInt and Real → DBD / MD.
• Long types (LReal, String, WString, DateTime) take no size letter; the start byte is given in the form DB1.DBX24.0 (DBB is also accepted). These types can be held only in a data block and in the bit memory area.
• String has the STRING[n] format of the PLC (2 byte header + n characters, Windows-1254 encoding). The Length field of the tag is the maximum number of characters to read (default 32, maximum 254); it must be the same as the definition in the PLC. A text longer than the maximum length in the PLC cannot be written.
• WString occupies 2n + 4 bytes as UTF-16.
• DateTime is read as DTL (12 bytes) on S7-1200 / 1500 and as DATE_AND_TIME (8 bytes) on S7-300 / 400.
• The address is not case-sensitive and may start with %; the German notations E (input) and A (output) are also accepted.
• Tags that are close to each other (with a gap of at most 32 bytes in the same area) are read in a single request; the read is split into multi-variable requests according to the PDU size negotiated with the PLC.

Automatic switchover to the backup PLC

In the three S7 drivers, a second CPU address can be given to a connection. Live connects to both CPUs, reads and writes only with the CPU that is master, and switches to the other CPU automatically when the master changes or the connection to the active CPU is lost. Use: redundant systems in which each CPU has its own IP address (S7-1500R/H), or two separate PLCs kept in sync by the PLC program. This feature is not available in other drivers. Redundancy of the Live computer is a separate topic: Redundant server pair.

Prerequisites

• Both CPUs must have the same data blocks at the same addresses; in both, PUT/GET access must be permitted and optimized block access must be off.
• Port, rack, slot and CPU type are the same for both CPUs (the values of the connection are used).
• Live writes only to the master CPU. Keeping the data of the backup CPU in sync is the job of the PLC: on an S7-1500R/H the operating system does this; with two separate PLCs your PLC program must do it.

Settings

1. Enable the backup PLC

   With the connection selected, switch on Backup PLC (automatic switchover) on the parameter card in the Inspector.

2. Enter the address of the backup CPU

   Backup PLC IP address: the IP address or computer name of the second CPU. It cannot be the same as the main address.

3. Select how the master information is read

   Master detection and Master information address (default DB1.DBX0.0); the options are in the table below.

4. Enter the check interval

   Master check interval (s) 1 – 60 (default 2): the master information is read again at this interval, and reconnecting to an unreachable CPU is retried.

   123456

   1. Backup PLC (automatic switchover) — when enabled, connections are made to both CPUs.
   2. Backup PLC IP address — the second CPU; port, rack and slot are the same as for the main PLC.
   3. Master detection — how the master CPU is determined.
   4. Master information address — Bool in bit mode, Int in number mode.
   5. Master check interval (s) — interval at which the master information is read again.
   6. Target — main address and backup address together.

What happens during the switchover

• The connections to both CPUs are kept open; a closed one is reopened in the background and does not delay reading from the active CPU.
• If the master changes while both CPUs are reachable, Live starts reading from the other CPU without dropping the connection. If the PDU sizes of the two CPUs differ, the connection is briefly re-established.
• If the connection to the active CPU is lost, the connection briefly shows No connection; the normal reconnection (after 1 s) selects the CPU that can be reached. Writes waiting in the queue at that moment are rejected, and the tags briefly have bad quality.
• If the master is unknown or the master CPU cannot be reached, Live stays on the current CPU (if there is none, on the main one, and if that is not available either, on the backup) and writes the reason in the information line (— the master PLC cannot be reached, — master information could not be read).

Monitoring in Live

In the Connections section of the system menu, the CPU being communicated with is shown below the connected redundant connection. This information appears only in Live's own system menu; it is not available in the browser viewer or in the PLC connection status object.

When the CPU changes, a system entry is written to the event log: PLC_Proses: switched to the backup PLC (192.168.10.22) or … switched to the main PLC (…); if a warning occurs on the same CPU (such as both PLCs report master), it is written as well. Lines S7 yedek PLC (PLC_Proses): … are written to the program log (logs\Live_yyyyMMdd.log).

In Studio, the Target card shows both addresses together. Online›Test connections… tests only the main address.

Driver reference

The parameter, address format and example tables below are generated from the driver definition in Studio. For S7-1200, the S7-1500 section applies.

Siemens S7-1500

"Permit access with PUT/GET" must be enabled on the CPU; "Optimized block access" must be disabled in the data block. Optimized (symbolic) blocks are accessed with the OPC UA driver.

Driver ID

s7-1500 (name in the project file)

Connection

An IP address / computer name and a port are required (default port 102)

Data types

Bool Byte SInt Int UInt DInt UDInt Real LReal String WString DateTime

Connection parameters

Appears in the Inspector window when a connection is selected.

Address formats

Sample addresses

Siemens S7-300 / 400

The S7-300 / 400 family has no LReal type.

Driver ID

s7-300 (name in the project file)

Connection

An IP address / computer name and a port are required (default port 102)

Data types

Bool Byte Int UInt DInt UDInt Real String DateTime

Connection parameters

Appears in the Inspector window when a connection is selected.

Address formats

Sample addresses

Common errors

The marker at the start of each line tells where the message will appear in Live: [connection] in the Connections section of the system menu; [write] in the notification window of the operator who performed the write; [Studio] in the address cell in Studio. [tag] is a tag error during reading: the tag is left with bad quality, the text of the message is not shown in Live in this version (Tag errors); read the text to understand the cause.

Tips