S7 Plus

S7 Plus is the symbolic half of S7: a variable is addressed by its name in the PLC program rather than by a byte offset. It works with S7-1200 and S7-1500 CPUs.

Its most practical consequence: you do not have to turn off optimized block access on your DBs. The TIA Portal step that causes most of the trouble with classic S7 does not exist here.

Addressing

Connection

Parameter	Default	Description
Protocol	S7 Plus	—
IP Address	—	The CPU’s address
Port	102	—
Timeout (ms)	—	At least 100
Certificate Fingerprint	—	The pinned fingerprint of the CPU’s certificate
Trust Any Certificate	off	Accept any certificate

There is no rack or slot. S7comm-plus connects to a fixed TSAP and the CPU answers whatever its rack and slot are, so those fields would ask for something that is never sent.

TLS trust

S7comm-plus speaks inside a TLS tunnel carried in COTP frames, and the CPU’s certificate is self-signed — there is no authority for a public trust store to check it against. The question “is this the right CPU” has only two honest answers: you pin the certificate’s fingerprint, or you deliberately say any certificate will do.

The first connection fails on purpose

The first connection to an unpinned CPU fails. That is not a fault: a connector that trusted anything out of the box would be making a security decision on your behalf and leaving no trace of it.

The failure carries the fingerprint it saw, so pinning it is a copy and a paste rather than a hunt through TIA Portal.

Device

Parameter	Description
Scan Time	The polling interval (at least 100 ms)
Scan Type	PERIODIC or FIXED_DELAY

Frame

A frame has one field, and it is not an address:

Parameter	Default	Description
Use Subscription Mode	off	Take values from the CPU’s notifications

With it off the frame is polled; with it on the CPU reports changes itself. The default is off because a subscription costs a frame per cycle even while nothing changes.

The same name as OPC UA

This field’s name matches its counterpart in OPC UA and BACnet exactly. Three names for one concept would mean learning three things across three protocols.

Variable

Parameter	Description
Access Sequence	The symbol’s access sequence — filled in by the browse
Type	The data type — filled in by the browse
Symbol CRC	The symbol’s checksum, kept for the drift check

A member of a nested struct and an element of an array can be picked too: they are addressed by a path of several identifiers, and the whole path travels in the access sequence.

Data types

BOOL, BYTE, WORD, INT, DWORD, DINT, REAL, LREAL, LWORD, USINT, UINT, UDINT, ULINT, SINT, LINT

You do not declare the data type: in classic S7 the operator must, because the CPU does not hold the symbol table; here the browse fills it in from what the CPU reported.

Browsing symbols

The CPU’s symbol catalogue is browsed and variables are picked from the list. A symbol the catalogue could not address at all — a type object the CPU did not send, a type that contains itself, a list cut at its size limit — appears not as a pickable variable but as a notice saying why.

Why a notice rather than a silent skip

A single-identifier read of a nested member reads the wrong region without erroring. You would be handed a variable with a plausible wrong value rather than a failure you could see.

Symbol drift — after a TIA download

The warning that matters most

After a TIA download a symbol’s internal identifier can shift: the name stays the same while the address points at something else. Reading that address does not error — the CPU really does have a value there and gives it to you. The symptom is a quietly wrong process value: a trend or an alarm showing a different quantity, with nothing saying so.

What inSCADA does about it: the catalogue gives a CRC for each symbol, and the browse writes it into the variable’s configuration. When the program is recompiled the CRC changes even if the name does not, so comparing the two CRCs answers whether that address is something else now.

The comparison is done on the inSCADA side. The protocol’s request has a checksum field, and had the CPU validated it the check would have been server-side — the strongest form; but when measured, this firmware rejected a correct checksum and a wrong one with the same return value, meaning it does not accept the field at all.

In practice: re-browse the symbols after every download to the PLC program. If a symbol has drifted, the comparison says so.

Related

• Siemens S7 overview — the two protocols compared
• S7 — byte addressing