The SOLISCADA software comes with a built-in S7 driver that can collect data from Siemens PLCs of model S7-200, S7-200 Smart, S7-300, S7-400, S7-1200, and S7-1500 via the S7 protocol, and it also supports parameter writing control.

l S7-200 and S7-200 SMART: It can read data from the area I, Q, M, and V. During configuration, if the data in the area V needs to be read, the data block can be filled in as DB1.

l S7-300, S7-400, S7-1200, and S7-1500: It can read data from the area I, Q, M, and DB.

Today we will share knowledge about SOLISCADA's S7 driver application to help you get started quickly and apply it as soon as possible!

1. Add the Driver

Right-click on the Local Node under the Database to add a driver. Select the driver Siemens S7.

2. Configure the Driver

Double-click the driver to enter the driver configuration page.

Scan Period: The collecting period of the device data, i.e., scanning frequency.

Overtime: The communication timeout for data collection. If the data response time continuously exceeds this duration, the communication is considered disconnected.

Repeat Connect Period: The time interval for the system to reconnect after data collection communication is disconnected.

PLC Model: S7-200, 200 Smart, 300, 400, 1200, 1500.

PDU Size Upper/Lower Limits: 240, 480, 960. It is the maximum PDU size (bytes) requested from the device.

Connection Type: The type of the connection resource used to communicate with the device: PG (programming device), OP (operator panel), PC (application).

CPU SLOT: The slot number of the rack where the device's CPU module is located. For details, check the PLC programming software.

RACK: The rack number where the device's CPU module is located. For details, check the PLC programming software.

TSAP: The client TSAP used to communicate with the device, where TSAP denotes the Transport Service Access Point.

In the Siemens S7 communication protocol, TSAP is a value similar to an address and is represented by two bytes. TSAP can be divided into LocalTSAP (equivalent to the address of the collection program) and RemoteTSAP (equivalent to the address of the PLC). The default values of the addresses differ for different PLC models, and these two values can be modified. If they have been modified, they can only be obtained by querying.

When communicating with the device, both the local TSAP and remote TSAP need to be set. The default value of local TSAP is 4D.57. For other default and possible values, please refer to the table above.

Remote TSAP offers two configuration methods:

(1) Set the CPU slot number and rack number. The remote TSAP is then automatically calculated by the program using the following formula:

Remote

TSAP = 0x03 ((rack<<5) | slot)

where "rack" and "slot" represent the rack number and CPU slot number, respectively.

(2) Customize the remote TSAP address (refer to the above figure).

Attention:

(1) For S7-300, S7-400, S7-1200, and S7-1500 series PLCs, if you know the rack number (rack) and slot number (slot), you can configure the remote TSAP using the first method to communicate with the device. For the values of the rack number and slot number, refer to the PLC programming software.

(2) If the device still cannot be connected after configuring the CPU slot number and rack number, you can try connecting by modifying custom local TSAP/remote TSAP.

(3) When accessing data from S7-1200 and S7-1500, the PLC configuration must meet the following requirements: CPU protection: set the access level to "Full Access (No Protection)"; connection mechanism: check "Allow PUT/GET Communication Access from Remote Partners".

(4) For S7-200 SMART, if the custom remote TSAP is set to 01.01, this driver and the STEP7-MicroWIN SMART programming software cannot simultaneously communicate with the PLC over Ethernet. To achieve parallel communication, the remote TSAP should be set to any one of 02.00, 02.01, 03.00, or 03.01; these settings allow concurrent access to the PLC. During configuration, you need to consider the impact on system performance and security.

3. Tag I/O Address

After configuring the Siemens S7 driver, you can manually add I/O addresses of tags. Or you can also create a template of tag I/O addresses and then right-click the driver to export/import the tag I/O addresses of Siemens S7 driver as/from an Excel spreadsheet.

1. Add a tag and set the I/O address. The I/O address setting interface is shown in the figure below.

Device ID: Device name added internally by the driver.

Offset Address: Offset address of reading data. When reading by bit, the address format is [Address].[0-7].

Data Block: The block where the data to be read is located, such as I, M, Q, and DB[n].

Data Type: BOOL, BYTE, WORD, DWORD, INT, DINT, REAL, etc.

Examples:

1. From Device1, read a value of type WORD at offset address 100 in data block DB2.

Fill in the Offset Address with 100, fill in the Data Block with DB2, fill in the Data Type with WORD, and the composed I/O address is Device1.DB2.WORD.100.

2. From Device1, read the 3rd bit of a value of type BOOL at offset address 200 in data block M.

Fill in the Offset Address with 200.2, fill in the Data Block with M, fill in the Data Type with BOOL, and the composed I/O address is Device1.M.BOOL.200.2.

4. FAQ

1. What is the meaning of TSAP in S7 communication service?

TSAP is the abbreviation of Transport Service Access Point. In the Siemens S7 communication protocol, TSAP is similar to an address and is represented by two bytes. There are two types of TSAP: local TSAP (equivalent to the collection program address) and remote TSAP (equivalent to the PLC address).

2. How to collect data from the area V in S7-200 and S7-200 Smart?

The data in area V can be directly collected using data block DB1.

3. How can the S7 driver and the Step7 programming software communicate with S7-200 Smart at the same time?

By setting different TSAPs for the S7 driver, simultaneous connections are possible. Optional TSAPs: 02.00, 02.01, 03.00, 03.01.

4. How should the PLC controller be configured when communicating with S7-200?

When connecting to the S7-200 PLC, a CP243-1 expansion module needs to be installed on the PLC and the CP243-1 needs to be configured.

5. What configuration items should be noted when the S7 driver accesses PLCs of model S7-1200 and S7-1500?

1) CPU Protection: Set the access level to "Full Access (No Protection)".

2) Connection Mechanism: Check "Allow PUT/GET Communication Access from Remote Partners".

3) DB Block Attribute: Uncheck "Optimized Block Access".