Siemens S7

inSCADA offers two separate protocols for talking to Siemens PLCs. Both run over ProfiNET on port 102 and are client-only — but they address data in fundamentally different ways.

Protocol value	How it addresses
S7	By byte — a memory area, a start address and offsets
S7 Plus	By symbol — the variable’s name in the PLC program

Which to choose

	S7	S7 Plus
PLC series	S7-300, S7-400, S7-1200, S7-1500	S7-1200, S7-1500
Optimized block access	Must be turned off	Not needed, left on
Address	A byte offset such as DB8.DBD12	A symbol name from the PLC program
Data type	Declared by the operator	Read from the CPU
Encryption	None	TLS
Rack / slot	Required	Not used

In short: with an S7-300 or S7-400 you use S7, there is no alternative. On an S7-1200/1500 either works, and S7 Plus is the one to prefer because it uses the PLC program’s own symbols — you neither turn off optimized access on your DBs nor calculate byte offsets.

Why calculating byte offsets is risky

In classic S7 a variable is read from wherever it sits by byte within a DB. Add a variable to the PLC program and everything after it shifts — but inSCADA does not know that and does not error either: it keeps reading the old offset, where some other quantity now lives. The symptom is a quietly wrong process value.

With S7 Plus the address is the symbol itself, so that shift cannot happen. A different kind of shift can, and there is a separate guard against it — see the symbol drift warning on the S7 Plus page.

Three structural differences

S7 Plus is not only a name instead of an address; it behaves differently at three points in the hierarchy. All three are measured properties of the protocol rather than choices.

	Classic S7	S7 Plus
Rack / slot	Required on the connection	Absent — S7comm-plus connects to a fixed TSAP and the CPU answers whatever its rack and slot are
Frame	Carries an area, a start address and a quantity — a read is a byte range	Carries no address — the address is on the variable, and a frame is only the batch polled together
Data type	Declared by the operator, since the CPU does not hold the symbol table	Comes from the CPU — the browse fills it in

Sub-pages

• S7 — byte addressing, memory areas and the TIA Portal settings
• S7 Plus — symbolic addressing, TLS and symbol drift