Siemens S7 Data Collection Guide
1. Protocol Overview
- Protocol Description: The S7 protocol is a proprietary communication protocol developed by Siemens for its S7 series PLCs. It is primarily used for data communication between STEP 7 programming software and S7 PLCs, as well as between PLCs and upper-level systems such as HMI and SCADA. It supports connections via Ethernet.
- Application Scenarios: This protocol is widely used in Siemens industrial automation systems to achieve read/write access to internal PLC data, including I/O status, memory areas, and data blocks. It is one of the core protocols for device monitoring and data acquisition.
- E2C Trinity Support: E2C Trinity supports connecting to Siemens S7 series PLCs (including S7-200Smart, S7-1200, S7-1500, etc.) via Ethernet. E2C Trinity acts as a client to read data from the PLC devices.
2. Prerequisites
Before starting the configuration, please ensure the following preparations are complete:
- Hardware Connection:
- Ensure the gateway device where E2C Trinity is located and the Siemens PLC are connected to the same local area network (LAN) and can communicate with each other.
- Connect a debugging computer to the gateway via a network cable to log in to E2C Trinity for configuration.
- Network Parameters:
- Obtain the target PLC's IP address and TCP port. The default TCP port for the Siemens S7 protocol is 102.
- Ensure the IP address of the E2C Trinity gateway is in the same network segment as the PLC and debugging computer, and that there are no IP conflicts.
- Device Parameters:
- Prepare the target PLC project file or data point list.
- Confirm the following key parameters:
- PLC Type: e.g., S7-1200, S7-1500.
- Rack Number and Slot Number: The physical location of the PLC CPU module.
- Data Addresses: e.g.,
I0.0,Q0.1,M10.2,DB1.DBD4. - Data Types: e.g., Bool, Int, Float, etc.
3. Configuration Steps
Follow these steps within the E2C Trinity Web interface.
Step 1: Create Device
- Log into the gateway management page. Navigate to [Data Acquisition] to enter the E2C Trinity configuration page.
- Click the "Create Device"button and fill in the connection information in the pop-up window.
| Parameter (UI Label) | Description | Example |
|---|---|---|
| Name | Unique name for the device. | Packing-Machine-03 |
| Driver | Communication protocol (Select S7). | S7 |
| IP Address | The IP address of the target PLC. | 192.168.0.3 |
| Port Number | TCP port for S7 communication (Default is 102). | 102 |
| Mode | Rack/Slot (Recommended) or TSAP. | Rack/Slot |
| PLC Type | The model series of the PLC. | S7-1200 |
| Rack Number | The PLC rack number. | 0 |
| Slot Number | The PLC slot number. | 0 |
| Polling Cycle | Frequency of data requests (in seconds). | 10 |
| Description | Additional information about the device. | Machine in Workshop A. |
| Enable High-speed Collection Mode | Supports millisecond-level data acquisition. Once published, the system automatically generates high-speed collection groups. Note: High-speed tags and their information cannot be modified after generation; only regular tags can be maintained. To change high-speed settings, create a new device. | Enabled |
| High-speed Polling Cycle | Must be selected when high-speed mode is enabled. Supported intervals: 50ms, 100ms, 200ms, 500ms. | 100ms |
| Package Count | Must be selected when high-speed mode is enabled. Defines how many polling cycles occur before data is reported as a batch. Supported values: 10, 20, 30. | 30 |
| Connection Timeout | Limit for establishing a connection (ms). | 1000 |
| Collection Timeout | Limit for PLC response (ms). | 1000 |
Step 2: Configure Tag (Point Table)
- Select the newly created PLC device from the device list on the left.
- Click the "Add" button to configure individual data points.
| Parameter (UI Label) | Description | |
|---|---|---|
| Name | The name of the point used in data reporting. | |
| Collection Type | If High-speed Collection Mode is enabled for the device, you can choose between High-performance or Normal. Otherwise, it defaults to Normal. | Normal |
| Tag Type | Device Tag (for PLC data) or Virtual Tag (for gateway internal variables). | |
| Address Type | Memory area type: I, Q, M, DB, etc. | |
| DB Index | The DB number (required if Address Type is DB). | |
| Address | The specific offset/address value. | |
| Bit Offset | Used only for "bool" types to specify the specific bit. | |
| Data Type | Must match the PLC data type (e.g., short/int16, float). | |
| Read/Write Permission | Select Read Only or Read/Write. | |
| Decimal Places | Number of decimals (for float/double types). | |
| Unit | Measurement unit (e.g., °C, KWh). | |
| Associated Group | Categorize the tag into a specific group. | |
| Data Operation | Scaling or offset calculations (None, Offset/Scaling, Ratio). |
- Repeat for all tags. Once finished, click "Publish" in the top right corner to apply the configuration.
4. Verification & Troubleshooting
Verification
- Check the device list to ensure the status is Online and tags are successfully collected.A green icon indicates success, and a red icon indicates failure.
- View the Latest Value column to verify data accuracy.
- Test Writing: Click the edit icon in the "Latest Value" column, modify the value, and verify if the PLC accepts the change.
Common Troubleshooting
- Issue: Device status fails to connect for a long time?
- Solution 1: Check if the network cable between the gateway and PLC is secure and if LEDs are normal.
- Solution 2: Use the
pingcommand in [System-Tools] to check communication with the PLC IP. - Solution 3: Double-check that IP, Port (102), Rack, and Slot match the PLC configuration.
- Solution 4: Check PLC settings. Newer PLCs (S7-1200/1500) often prohibit PUT/GET by default. In TIA Portal, go to "Properties" -> "Protection & Security" -> "Connection Mechanisms" and check "Permit access with PUT/GET communication from remote partner."
- Issue: Device connected, but point values are empty?
- Solution 1: Verify the Address Type, DB Index, Address, and Data Type. For example, a 32-bit float at DBD4 requires Address Type: DB, DB Index: 4 (if in DB4), and Data Type: float.
- Solution 2: Confirm the data block (DB) is downloaded and running in the PLC.
- Issue: An error occurred; where can I view the logs?
- Debug Logs: View via the interface debug section.
- System Logs: View via the interface system section.
Appendix
Data Type Mapping
When configuring tags in E2C Trinity, use the following mapping:
| Edge2Cloud d Pro Data Type | Length / Sign | Siemens PLC Corresponding Type | Typical Address Example | Notes & Cautions |
|---|---|---|---|---|
| bool | 1 bit | BOOL | M0.0, DB1.DBX0.1 | Bit-wise read/write; address must be in "word.bit" format; can be directly entered as "DB1.DBX0.1" in E2C Trinity |
| byte | 8 bit unsigned | BYTE (USInt) | DB1.DBB0, MB0 | Single byte; Siemens side USInt range: 0-255 |
| ushort (uint16) | 16 bit unsigned | WORD (UInt) | DB1.DBW0, MW0 | Must use even-byte address; enter "DB1.DBW0" in E2C Trinity |
| short (int16) | 16 bit signed | INT | DB1.DBW2, MW2 | Must use even-byte address; range: -32768…32767 |
| uint (uint32) | 32 bit unsigned | DWORD (UDInt) | DB1.DBD0, MD0 | Must be 4-byte aligned; range: 0…4294967295 |
| int (int32) | 32 bit signed | DINT | DB1.DBD4, MD4 | Must be 4-byte aligned; range: -2147483648…2147483647 |
| ulong (uint64) | 64 bit unsigned | (No direct native type) | Must use ARRAY[0..7] OF BYTEor STRUCT custom definition |
No native UInt64 in Siemens S7; must be handled as 8-byte array or split into two DWORDs manually |
| long (int64) | 64 bit signed | LINT (S7-1500 only) | DB1.DBD0 (occupies 8 B) | LINT not supported in S7-300/400; must use ARRAY[0..7] OF BYTEand convert on the host side |
| float (float32) | 32 bit IEEE | REAL | DB1.DBD8, MD8 | 4-byte aligned; range: ±3.4E38 |
| double (double64) | 64 bit IEEE | LREAL (S7-1500 only) | DB1.DBD12 (occupies 8 B) | LREAL not supported in S7-300/400; must use ARRAY[0..9] OF BYTEand convert on the host side |
| string | 1…n bytes | STRING[n] | DB1.STRING20 (max 20 characters) | Siemens STRING format: byte 0 = actual length, byte 1 = max length, followed by characters; in E2C Trinity, confirm if first 2 bytes are skipped automatically, otherwise offset by 2 bytes manually before reading |
Revision History
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | 2025-09-19 | Ken Li | Initial document creation. |
Related Articles
OPC UA Data Collection Guide
1. Protocol Overview Protocol Description: Modbus TCP is a common industrial automation protocol based on TCP/IP network transmission. Application Scenarios: This protocol is widely used for data acquisition and control of devices such as PLCs, ...Omron CipNet Data Collection Guide
1. Protocol Overview Protocol Description: CipNet is the term used by Omron for its EtherNet/IP network solution. EtherNet/IP is a widely adopted industrial Ethernet communication protocol that encapsulates the Common Industrial Protocol (CIP) within ...Melsec MC 3E Data Collection Guide
1. Protocol Overview Protocol Description: The MC 3E (Melsec Communication Protocol 3E) is a proprietary Ethernet communication protocol developed by Mitsubishi Electric for its Q, L, and iQ-R series PLCs. The protocol supports both Binary and ASCII ...Modbus TCP Data Collection Guide
1. Protocol Overview Protocol Description: Modbus TCP is a common industrial automation protocol based on TCP/IP network transmission. Application Scenarios: This protocol is widely used for data acquisition and control of devices such as PLCs, ...Omron FINS TCP Data Collection Guide
1.Protocol Overview Protocol Description: FINS (Factory Interface Network Service) is a communication protocol developed by Omron for its PLC series (e.g., CP, CJ, and CS series) to facilitate data exchange between PLCs and host systems (such as HMI ...