Siemens S7

The S7-Client module reads and writes the memory of a Siemens PLC directly, over the S7comm protocol on TCP port 102. It is for the controllers that have no OPC UA server of their own (S7-300, S7-400, S7-200 Smart, LOGO! 8), and for an S7-1200 or S7-1500 whose OPC UA server is not switched on.

Enable, Name and the Status and messages tab work the same way in every module. They are described in Settings every module shares.

Siemens S7 Client

The module has the two lists every client module has: collectors read an address into a variable on a schedule, and forwarders write a variable to an address whenever the variable changes. An S7 address states its own type, so there is no separate type column to keep in step with it.

Settings

What choosing a controller fills in:

These are where each family's CPU usually sits. A CPU in another rack or slot needs its own numbers, typed after the controller is chosen.

Collectors and forwarders

A collector row uses every key below. A forwarder row uses field and address.

The Check column beside each address is not stored. It shows what is wrong with the address, or, when nothing is, the variable type the address yields.

Addresses

An address is %, a memory area, a byte offset, an optional bit, a colon and a type, and optionally an element count in brackets:

%DB10:4:REAL        data block 10, byte 4, a 32-bit REAL
%DB10.DBD4:REAL     the same address, in the notation TIA Portal shows
%DB10.DBX4.3:BOOL   data block 10, byte 4, bit 3
%M0.1:BOOL          merker byte 0, bit 1
%I0.0:BOOL          input byte 0, bit 0
%Q0.1:BOOL          output byte 0, bit 1
%MW10:INT           the merker word at byte 10
%IW64:INT           the input word at byte 64
%DB1:0:INT[10]      ten INT values from byte 0 of data block 1

• A bit address takes BOOL, and BOOL takes a bit. An address is a bit address when it has .0 to .7, the size DBX or the size X. The two mistakes are refused, because a PLC would otherwise answer them without complaint: %DB10.DBX4:REAL asks for one bit and calls it a REAL, and %M0:BOOL names no bit.
• There is no symbol browsing. S7comm has no symbol table, so addresses are typed, or pasted from TIA Portal.

An address with a count yields a list of its type. The variable type is what the Check column shows, and what the pencil beside Variable creates a variable as.

What the Check column, and the error of a module that will not open, say about an address:

Test read

Type an address in the box beside Test read and press the button. The engine reads that address once, with the Host, Controller, Rack and Slot on the screen and a timeout of 5000 ms, and shows the value, or why it could not read it: the address's problem, No host, The PLC answered {code}, or the driver's reason. Nothing is saved, and the address does not have to be in a table. It is the quickest way to check the rack, the slot and the PUT/GET setting before the module is enabled.

Behaviour

• Opening. The host, every collector's schedule and every address, collectors and forwarders alike, are checked before anything starts. A problem stops the module opening, naming the variable of the row.
• Collectors sharing a schedule are one request. Collectors whose cron expressions are written exactly the same are read together, and the driver splits the request into as many messages as the CPU needs. Forty addresses on one schedule cost one round trip, not forty.
• Every collector is read once when the module opens, then on its schedule. The first read opens the connection: a PLC that is switched off does not stop the module opening, it shows as a lost connection.
• There are no subscriptions. Every collector is polled.
• A refused address is not a lost link. When the PLC refuses one address, its variable is left as it was, the rest of the request is written, and the module warns.
• Reconnection is the module's own. A request that fails, or takes longer than Timeout (ms), drops the connection, and the next read or write opens a new one. The schedules pace the retries.
• Forwarders write their variable's current value once when the module opens, then every change, one request per write. A value is converted to the width of the address's type before it is sent. Keep it within the type's range: the module does not check it.

Messages

A problem is written into the module's message variables, and the next successful read clears it. A read in which the PLC refuses one address still counts as a successful read: every other address of it is written, and the end of that same read clears the refused address's own warning at once. That warning therefore shows only for a moment, so add the warning variable to a LOGGER to keep a record of it. "then ERROR" follows the thresholds in Settings every module shares: a lost connection becomes an error after errorAfterSeconds. All texts are in English; the full list is in Module messages. {server} and {plc} are the Host, {mapping} is the variable's code, and {address} and {node} are the address as its row gives it. {code} is the driver's answer for one address, such as NOT_FOUND, ACCESS_DENIED or INVALID_ADDRESS.

Example

An oxygen reading and a blower's run state every five seconds, and an oxygen setpoint written back when an operator moves it, on an S7-1500:

Host         10.20.3.40
Controller   S7-1500          Rack 0   Slot 1
Timeout      5000

Collector    AIT_201_O2     %DB10:4:REAL      */5 * * * * ?
Collector    B_201_RUN      %Q0.1:BOOL        */5 * * * * ?
Forwarder    AIT_201_SP     %DB10:8:REAL

The two collectors share a schedule, so they are one request every five seconds. Writing AIT_201_SP from a dashboard or a formula sends it to the PLC as a REAL.

Next steps

• Module catalogue
• Settings every module shares
• Module messages
• OPC UA, for an S7-1200 or S7-1500 with its OPC UA server switched on
• Connectivity

This page describes Data Orchester engine 6.12.0.