S7

Classic S7 talks to Siemens PLCs by byte: a memory area, a start address and offsets within that range. It is the only option for an S7-300 or S7-400; it works on an S7-1200/1500 too, but there S7 Plus needs less upkeep.

Port 102, client role only.

Supported PLC series

• Siemens S7-300
• Siemens S7-400
• Siemens S7-1200
• Siemens S7-1500

Data Model

Configuration

Connection

Parameter	Example	Description
Protocol	S7	Protocol selection
IP Address	192.168.1.1	PLC IP address
Port	102	S7 port (default: 102)
Rack	0	PLC rack number (default: 0)
Slot	0	PLC slot number (0 for S7-1200/1500, 2 for S7-300/400)
Timeout	5000 ms	Connection timeout duration
Connection Type	S7_BASIC	Connection type

Connection Types

Type	Description
PG	Programming device connection
OP	Operator panel connection
S7_BASIC	Standard S7 connection (default)

Device

Parameter	Example	Description
Scan Time	1000 ms	Scan period
Scan Type	PERIODIC	PERIODIC or FIXED_DELAY

Frame (Data Block)

Parameter	Example	Description
Type	DB	Memory area type (see below)
Start Address	0	Starting byte address
Quantity	100	Number of bytes to read
DB Number	8	Datablock number (for DB and DI types only)

Memory Areas (Frame Types)

Type	Description	Usage
DB	DataBlock (Peripheral I/O) Area	Most common — Global Data Block
DI	DataBlock Area	Instance Data Block
DB_LOCAL	DataBlock (local) Area	Local Data Block
MK	Marker (Flags) Area	Marker area (M)
PE	PE (Inputs) Instance Area	Input area (I)
PA	PA (Outputs) Instance Area	Output area (Q)
TM	S7 Timer Area	Timer
CT_INPUTS	S7 Counter Area	Counter
SYS_INFO	System Information	System information
SYSTEM_FLAGS	S7 Counters	System flags
TM_IEC	IEC Counters (200 Family)	IEC counters
TM_V	IEC Timers (200 Family)	IEC timers
ANALOG_INPUTS	Analog Inputs (200 Family)	Analog input
ANALOG_OUTPUTS	Analog Outputs (200 Family)	Analog output

Tip

The DB (DataBlock) type is used in most applications. You can read/write data by creating a Global DB in the PLC program and entering its number, start address, and byte count in inSCADA.

Variable

Parameter	Example	Description
Start Address	0	Byte offset within the frame
Bit Offset	0	Bit offset (for BIT type, 0-7)
Type	REAL	S7 data type
Max Len	0	Maximum length for string variables

Supported Data Types

Data Type	Size	Description
BIT	1 bit	Single bit (Bool) — accessed via Bit Offset
BYTE	8 bit	Unsigned 8-bit integer
WORD	16 bit	Unsigned 16-bit integer
INT	16 bit	Signed 16-bit integer
DWORD	32 bit	Unsigned 32-bit integer
DINT	32 bit	Signed 32-bit integer
REAL	32 bit	32-bit floating point (Float)
LREAL	64 bit	64-bit floating point (Double)
DATETIME	8 byte	Date and time
S7STRING	Variable	S7 string format
S7WSTRING	Variable	S7 wide string format

Address Calculation Example

S7 addressing is byte and bit based. Variable addresses are calculated relative to the start address of the Frame:

Siemens TIA Portal Settings

Some settings need to be configured on the PLC side for communication with the S7 protocol. These settings apply to TIA Portal V12 and later versions.

1. PUT/GET Permission

The S7 protocol works with the PUT/GET mechanism, and this is the setting that decides everything: while the permission is off, the CPU accepts the connection and answers its identity, but refuses every data service, including reads and writes.

1. Go to the CPU Properties section in TIA Portal
2. In the Protection & Security tab
3. Enable (check) the “Permit access with PUT/GET communication from remote partner” option

The order matters

While PUT/GET permission is off, turning optimized block access off changes nothing. The connection appears as “Connected” but no variable is ever updated. Measured as a controlled experiment on a real CPU 1511-1 PN: with PUT/GET off and a DB’s optimized access turned off, DB reads, M/I/Q reads and block info requests kept being refused with the same error. The moment the permission was enabled, M/I/Q reads started working.

So the order is: PUT/GET first, then optimized. Working the other way round wastes time.

2. Full Access Level Setting

The PLC access level must be configured to allow external communication:

1. Go to the CPU Properties section in TIA Portal
2. Open the Protection & Security tab
3. Set the Access Level to “Full access (no protection)”

3. Disabling Optimized Block Access

On S7-1200 and S7-1500 PLCs, the optimized block access feature of Global DBs is enabled by default. In an optimized block the variables have no fixed byte offsets, so the S7 protocol’s byte-based addressing cannot reach them. This feature must be disabled on the DBs inSCADA will communicate with:

1. Double-click the relevant DB (Data Block) in TIA Portal
2. Open the DB’s Properties window
3. In the Attributes tab, uncheck the “Optimized block access” option
4. Save the DB and download to the PLC

Important

This setting must be configured separately for each Global DB. And it is not enough on its own: while PUT/GET permission is off it changes nothing (item 1).

S7-300 / S7-400

The three items above are for S7-1200 and S7-1500. On S7-300/400 there is no optimized block access and no PUT/GET permission checkbox; only the access level (protection level) applies there.

Summary: TIA Portal Checklist

The order matters — top to bottom:

#	Setting	Location	Status
1	PUT/GET permission	CPU Properties → Protection	☐ Enabled
2	Access Level	CPU Properties → Protection	☐ Full access
3	Optimized block access	DB Properties → Attributes	☐ Disabled

Frame Parameters Detail

Minutes Offset

The Minutes Offset parameter applies a minute-based offset to timestamps read from the PLC. For example, if the PLC runs in UTC time and inSCADA needs to display local time:

• For UTC+3 (Turkey): 180 (3 hours × 60 minutes)
• To set the time back, use a negative value: -60 (1 hour back)
• Default: 0 (no offset)

Scan Time Factor

The Frame’s scan period is calculated by multiplying the Device’s Scan Time value:

Frame Scan Time = Device Scan Time × Scan Time Factor

For example, if Device Scan Time = 1000 ms and Frame Scan Time Factor = 5, this frame is scanned every 5 seconds. For slow-changing data, increasing the factor reduces unnecessary communication overhead.