Siemens S7 Data Collection Guide
1. Protocol Overview
- Protocol Description: The S7 protocol is a proprietary communication protocol developed by Siemens for its S7 series PLCs. It is primarily used for data communication between STEP 7 programming software and S7 PLCs, as well as between PLCs and upper-level systems such as HMI and SCADA. It supports connections via Ethernet.
- Application Scenarios: This protocol is widely used in Siemens industrial automation systems to achieve read/write access to internal PLC data, including I/O status, memory areas, and data blocks. It is one of the core protocols for device monitoring and data acquisition.
- E2C Trinity Support: E2C Trinity supports connecting to Siemens S7 series PLCs (including S7-200Smart, S7-1200, S7-1500, etc.) via Ethernet. E2C Trinity acts as a client to read data from the PLC devices.
2. Prerequisites
Before starting the configuration, please ensure the following preparations are complete:
- Hardware Connection:
- Ensure the gateway device where E2C Trinity is located and the Siemens PLC are connected to the same local area network (LAN) and can communicate with each other.
- Connect a debugging computer to the gateway via a network cable to log in to E2C Trinity for configuration.
- Network Parameters:
- Obtain the target PLC's IP address and TCP port. The default TCP port for the Siemens S7 protocol is 102.
- Ensure the IP address of the E2C Trinity gateway is in the same network segment as the PLC and debugging computer, and that there are no IP conflicts.
- Device Parameters:
- Prepare the target PLC project file or data point list.
- Confirm the following key parameters:
- PLC Type: e.g., S7-1200, S7-1500.
- Rack Number and Slot Number: The physical location of the PLC CPU module.
- Data Addresses: e.g.,
I0.0,Q0.1,M10.2,DB1.DBD4. - Data Types: e.g., Bool, Int, Float, etc.
3. Configuration Steps
Follow these steps within the E2C Trinity Web interface.
Step 1: Create Device
- Log into the gateway management page. Navigate to [Data Acquisition] to enter the E2C Trinity configuration page.
- Click the "Create Device"button and fill in the connection information in the pop-up window.
| Parameter (UI Label) | Description | Example |
|---|---|---|
| Name | Unique name for the device. | Packing-Machine-03 |
| Driver | Communication protocol (Select S7). | S7 |
| IP Address | The IP address of the target PLC. | 192.168.0.3 |
| Port Number | TCP port for S7 communication (Default is 102). | 102 |
| Mode | Rack/Slot (Recommended) or TSAP. | Rack/Slot |
| PLC Type | The model series of the PLC. | S7-1200 |
| Rack Number | The PLC rack number. | 0 |
| Slot Number | The PLC slot number. | 0 |
| Polling Cycle | Frequency of data requests (in seconds). | 10 |
| Description | Additional information about the device. | Machine in Workshop A. |
| Enable High-speed Collection Mode | Supports millisecond-level data acquisition. Once published, the system automatically generates high-speed collection groups. Note: High-speed tags and their information cannot be modified after generation; only regular tags can be maintained. To change high-speed settings, create a new device. | Enabled |
| High-speed Polling Cycle | Must be selected when high-speed mode is enabled. Supported intervals: 50ms, 100ms, 200ms, 500ms. | 100ms |
| Package Count | Must be selected when high-speed mode is enabled. Defines how many polling cycles occur before data is reported as a batch. Supported values: 10, 20, 30. | 30 |
| Connection Timeout | Limit for establishing a connection (ms). | 1000 |
| Collection Timeout | Limit for PLC response (ms). | 1000 |
Step 2: Configure Tag (Point Table)
- Select the newly created PLC device from the device list on the left.
- Click the "Add" button to configure individual data points.
| Parameter (UI Label) | Description | |
|---|---|---|
| Name | The name of the point used in data reporting. | |
| Collection Type | If High-speed Collection Mode is enabled for the device, you can choose between High-performance or Normal. Otherwise, it defaults to Normal. | Normal |
| Tag Type | Device Tag (for PLC data) or Virtual Tag (for gateway internal variables). | |
| Address Type | Memory area type: I, Q, M, DB, etc. | |
| DB Index | The DB number (required if Address Type is DB). | |
| Address | The specific offset/address value. | |
| Bit Offset | Used only for "bool" types to specify the specific bit. | |
| Data Type | Must match the PLC data type (e.g., short/int16, float). | |
| Read/Write Permission | Select Read Only or Read/Write. | |
| Decimal Places | Number of decimals (for float/double types). | |
| Unit | Measurement unit (e.g., °C, KWh). | |
| Associated Group | Categorize the tag into a specific group. | |
| Data Operation | Scaling or offset calculations (None, Offset/Scaling, Ratio). |
- Repeat for all tags. Once finished, click "Publish" in the top right corner to apply the configuration.
4. Verification & Troubleshooting
Verification
- Check the device list to ensure the status is Online and tags are successfully collected.A green icon indicates success, and a red icon indicates failure.
- View the Latest Value column to verify data accuracy.
- Test Writing: Click the edit icon in the "Latest Value" column, modify the value, and verify if the PLC accepts the change.
Common Troubleshooting
- Issue: Device status fails to connect for a long time?
- Solution 1: Check if the network cable between the gateway and PLC is secure and if LEDs are normal.
- Solution 2: Use the
pingcommand in [System-Tools] to check communication with the PLC IP. - Solution 3: Double-check that IP, Port (102), Rack, and Slot match the PLC configuration.
- Solution 4: Check PLC settings. Newer PLCs (S7-1200/1500) often prohibit PUT/GET by default. In TIA Portal, go to "Properties" -> "Protection & Security" -> "Connection Mechanisms" and check "Permit access with PUT/GET communication from remote partner."
- Issue: Device connected, but point values are empty?
- Solution 1: Verify the Address Type, DB Index, Address, and Data Type. For example, a 32-bit float at DBD4 requires Address Type: DB, DB Index: 4 (if in DB4), and Data Type: float.
- Solution 2: Confirm the data block (DB) is downloaded and running in the PLC.
- Issue: An error occurred; where can I view the logs?
- Debug Logs: View via the interface debug section.
- System Logs: View via the interface system section.
Appendix
Data Type Mapping
When configuring tags in E2C Trinity, use the following mapping:
| E2C Trinity Type | Length / Sign | Siemens PLC Corresponding Type | Typical Address Example | Notes & Cautions |
|---|---|---|---|---|
| bool | 1 bit | BOOL | M0.0, DB1.DBX0.1 | Bit-wise read/write; address must be in "word.bit" format; can be directly entered as "DB1.DBX0.1" in E2C Trinity |
| byte | 8 bit unsigned | BYTE (USInt) | DB1.DBB0, MB0 | Single byte; Siemens side USInt range: 0-255 |
| ushort (uint16) | 16 bit unsigned | WORD (UInt) | DB1.DBW0, MW0 | Must use even-byte address; enter "DB1.DBW0" in E2C Trinity |
| short (int16) | 16 bit signed | INT | DB1.DBW2, MW2 | Must use even-byte address; range: -32768…32767 |
| uint (uint32) | 32 bit unsigned | DWORD (UDInt) | DB1.DBD0, MD0 | Must be 4-byte aligned; range: 0…4294967295 |
| int (int32) | 32 bit signed | DINT | DB1.DBD4, MD4 | Must be 4-byte aligned; range: -2147483648…2147483647 |
| ulong (uint64) | 64 bit unsigned | (No direct native type) | Must use ARRAY[0..7] OF BYTEor STRUCT custom definition |
No native UInt64 in Siemens S7; must be handled as 8-byte array or split into two DWORDs manually |
| long (int64) | 64 bit signed | LINT (S7-1500 only) | DB1.DBD0 (occupies 8 B) | LINT not supported in S7-300/400; must use ARRAY[0..7] OF BYTEand convert on the host side |
| float (float32) | 32 bit IEEE | REAL | DB1.DBD8, MD8 | 4-byte aligned; range: ±3.4E38 |
| double (double64) | 64 bit IEEE | LREAL (S7-1500 only) | DB1.DBD12 (occupies 8 B) | LREAL not supported in S7-300/400; must use ARRAY[0..9] OF BYTEand convert on the host side |
| string | 1…n bytes | STRING[n] | DB1.STRING20 (max 20 characters) | Siemens STRING format: byte 0 = actual length, byte 1 = max length, followed by characters; in E2C Trinity, confirm if first 2 bytes are skipped automatically, otherwise offset by 2 bytes manually before reading |
Revision History
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | 2025-09-19 | Ken Li | Initial document creation. |
Related Articles
OPC UA Data Collection Guide
1. Protocol Overview Protocol Description: Modbus TCP is a common industrial automation protocol based on TCP/IP network transmission. Application Scenarios: This protocol is widely used for data acquisition and control of devices such as PLCs, ...Omron CipNet Data Collection Guide
1. Protocol Overview Protocol Description: CipNet is the term used by Omron for its EtherNet/IP network solution. EtherNet/IP is a widely adopted industrial Ethernet communication protocol that encapsulates the Common Industrial Protocol (CIP) within ...Mitsubishi MELSEC MC 3E Data Collection Guide
1. Protocol Overview Protocol Description: The MC 3E (MELSEC Communication Protocol 3E) is a proprietary Ethernet communication protocol developed by Mitsubishi Electric for its Q, L, and iQ-R series PLCs. The protocol supports both binary and ASCII ...Omron FINS TCP Data Collection Guide
1.Protocol Overview Protocol Description: FINS (Factory Interface Network Service) is a communication protocol developed by Omron for its PLC series (e.g., CP, CJ, and CS series) to facilitate data exchange between PLCs and host systems (such as HMI ...Modbus TCP Data Collection Guide
1. Protocol Overview Protocol Description: Modbus TCP is a common industrial automation protocol based on TCP/IP network transmission. Application Scenarios: This protocol is widely used for data acquisition and control of devices such as PLCs, ...