Siemens S7 ISO TCP

Siemens S7 ISOTCP is a protocol developed by Siemens for communication with Siemens S7 series PLCs. This protocol is based on the TCP/IP protocol stack and uses the ISO-TSAP protocol for handling connections and data transmission. It enables read and write operations on various data types of the PLC, including bits, bytes, word, double word, timers, and counters.

For the generic steps, see Create a Southbound Driver and Groups and Tags.

For measured tag counts and polling intervals, see Siemens S7 Driver Performance.

The implementation of S7 ISOTCP in EMQX Neuron is divided into two drivers.

• The Siemens S7 ISOTCP driver is mainly used to connect to PLC modules such as Siemens S200, S200smart, S1200, and S1500.
• The Siemens S7 ISOTCP for 300/400 driver is mainly used to connect to PLC modules such as Siemens S300 and S400 that have an Ethernet module.

Add Driver

On Data Collection → South Devices, click Add Device.

• Name: The name of this device node.
• Driver: Select the Siemens S7 ISOTCP driver or Siemens S7 ISOTCP for 300/400.

Driver	Description
Siemens S7 ISOTCP	For Siemens S200, S200smart, S1200, S1500 PLC
Siemens S7 ISOTCP for 300/400	For Siemens S300, S400 PLC

Connection Parameters

Click the driver card to open the Device Configuration page and fill in:

Parameter	Description
PLC IP Address	Target PLC IPv4 Address
PLC Port	Target PLC port, default 102
PDU Size	PDU size, default 960
PLC Module	Target PLC module, S7-200/300/400/1200/1500
Connection Type	Only for S7-300/400/1200/1500, Connection type, default PG
CPU Rack	Only for S7-300/400/1200/1500, PLC CPU rack, default 0
CPU Slot	Only for S7-300/400/1200/1500, PLC CPU slot, default 1
Local TSAP	Only for S7-200, local TSAP
Remote TSAP	Only for S7-200, remote TSAP
T1	write request batch size
T2	wait time after send request
T3	read request batch size

TIP

When interfacing with Siemens S7 1200/1500 PLC using the Siemens S7 ISOTCP driver, certain modifications are required in the Siemens software (TIA16) settings:

• The optimized block access must be turned off.
• The access level must be full and the connection mechanism must allow GET/PUT.

For detailed operating steps, please refer to Tailor S7 1200/1500 PLC for Effective ISOTCP Driver Use.

Tag Configuration

The data types and address formats supported by this driver are listed below.

Data types

• INT8
• UINT8
• INT16
• UINT16
• INT32
• UINT32
• FLOAT
• DOUBLE
• BIT
• STRING
• ARRAY_CHAR

Address Format

AREA ADDRESS[.BIT][.LEN][STR_TYPE]

AREA ADDRESS

AREA	DATA TYPE	ATTRIBUTE	REMARK	PLC Area
I	int8/uint8/int16/uint16/bit/int32/uint32/float	read	input	Input I, E
O/Q	int8/uint8/int16/uint16/bit/int32/uint32/float	read/write	output	Output Q, A
F/M	int8/uint8/int16/uint16/bit/int32/uint32/float	read/write	flag	FLAG Memory M
T	int32/uint32/float	read/write	timer	Timer T
C	int16/uint16	read/write	counter	Counter C
DB	int8/uint8/int16/uint16/bit/int32/uint32/float/double/string	read/write	global DB block	Variable Memory V, DB index 1

TIP

For the global data block DB, in the PLC side of the address such as DBX, DBW, DBB, etc., directly converted to DBW can be, do not need to do byte conversion, such as DBX1.0 -> DBW1.0 .

Example:

Address	Data Type	Description
I0	int16	I area, address is 0
I1	uint16	I area, address is 1
O2	int16	O area, address is 2
O3	uint16	O area, address is 3
Q4	uint16	Q area, address is 4
F4	int16	F area, address is 4
F5	int16	F area, address is 5
M6	int16	M area, address is 6
T6	int32	T area, address is 6
T7	int32	T area, address is 7
C8	uint16	C area, address is 8
C9	uint16	C area, address is 8
DB10.DBW10	int16	In a data block of 10, the starting data word is 10
DB12.DBW10	uint16	In a data block of 12, the starting data word is 10
DB10.DBW10	float	In a data block of 10, the starting data word is 10
DB11.DBW10	double	In a data block of 11 , the starting data word is 10

.BIT

Optional, referring to a bit of an address, range 0 - 7.

.LEN

When the data type is a string or char array type, it is required and indicates the length of the string.

STR_TYPE

Optional, indicates the string type, default is single-byte character, option value is 'D', indicating double-byte character.

Example Addresses

Address	Data Type	Description
I0.0	bit	I area, address 0, bit 0
I0.1	bit	I area, address 0, bit 1
O1.0	bit	O area, address 1, bit 0
O1.2	bit	O area, address 1, bit 2
F2.1	bit	F area, address 2, bit 1
F2.2	bit	F area, address 2, bit 2
DB1.DBW10.0	bit	In a data block of 1, the starting data word is 10, bit 0
DB2.DBW1.7	bit	In a data block of 2, the starting data word is 1, bit 7
DB1.DBW12.20	string	In a data block of 1, the starting data word is 12, string length is 20
DB1.DBW12.20D	wstring	In a data block of 1, the starting data word is 12, string length is 20, double-byte character
DB1.DBW100.20	ARRAY_CHAR	In a data block of 1, the starting data word is 100, char array length is 20

ARRAY_CHAR displays and writes in the form of a string.

Use Case

This chapter also provides practical examples to facilitate a quick start.

Siemens S7-1200 PLC