> For the complete documentation index, see [llms.txt](https://docs.cybus.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybus.io/2-4-2/guides/machine-connectivity/plcs-industrial-controllers/connecting-a-simatic-s7-1500-via-s7-plus.md). # Connecting a SIMATIC S7-1500 via S7+ This guide shows you how to read data from a Siemens SIMATIC S7-1500 PLC with the Connectware [S7+ connector](/2-4-2/connectors/shop-floor-connectors/siemens-simatic-s7-plus.md) and map it into an ISA-95 style MQTT topic hierarchy. S7+ addresses PLC variables by their TIA Portal symbol names instead of absolute memory addresses. This makes the configuration readable, type-safe, and independent of the memory layout, and it works with optimized data blocks, which the classic S7 connector cannot read. In more detail, the following topics are covered: * Preparing the S7-1500 in TIA Portal so that Connectware can connect * Understanding symbolic addressing and why optimized data blocks work with S7+ * Finding the symbolic paths of your variables in TIA Portal * Creating the [service commissioning file](/2-4-2/data-flows/service-commissioning-files.md) * Mapping the data points into an ISA-95 style MQTT topic hierarchy * Verifying data in the [Data Explorer](/2-4-2/monitoring/data-explorer.md) This guide focuses on the S7-1500 and symbolic addressing. For S7-300/400 PLCs or absolute addressing with non-optimized data blocks, see [Connecting & Integrating a Siemens S7 Device](/2-4-2/guides/machine-connectivity/plcs-industrial-controllers/connecting-and-integrating-a-siemens-s7-device.md), which uses the classic [S7 connector](/2-4-2/connectors/shop-floor-connectors/siemens-simatic-s7.md). A complete example file is available at the end of this guide. ## Prerequisites To follow this guide, you will need the following: * A running instance of Cybus Connectware 2.1.0 or newer. * A Siemens SIMATIC S7-1500 (or S7-1200) that is reachable over Ethernet from Connectware on TCP port 102. You also need access to the matching TIA Portal project to look up PLC and data block names. * Access to the [Admin UI](/2-4-2/access/admin-ui.md) with sufficient [user permissions](/2-4-2/access/user-management.md). * Basic knowledge of MQTT and the Connectware [services](/2-4-2/data-flows/services.md) concept (for example, [service commissioning files](/2-4-2/data-flows/service-commissioning-files.md), [connections](/2-4-2/data-flows/service-commissioning-files/resources/cybus-connection.md), and [endpoints](/2-4-2/data-flows/service-commissioning-files/resources/cybus-endpoint.md)). ## Symbolic Addressing and Optimized Data Blocks The classic S7 connector reads variables by absolute address, for example `DB10,X0.0` for a bit in data block 10. Absolute addresses only exist in data blocks with standard access. The S7-1200 and S7-1500 create data blocks with **Optimized block access** enabled by default: the PLC arranges the variables in memory itself, there are no fixed byte offsets, and absolute addressing fails. For the classic connector, you have to disable this attribute on every data block you want to read. S7+ takes the opposite approach. It loads the symbol information from the TIA Portal project on the PLC and addresses each variable by its hierarchical symbol path, for example `PLC_1.Blocks.ProductionDB.MachineState`. Because no byte offsets are involved, optimized data blocks stay readable without any changes to the block attributes, and the configuration keeps working when the block layout changes after a recompile. ## Preparing the S7-1500 in TIA Portal Before Connectware can connect, allow external client access on the PLC: 1. In TIA Portal, open the device configuration of the CPU and select **General** > **Protection & Security**. 2. Under **Access level**, select an access level that permits read access without a password, for example **Full access (no protection)**. The S7+ [connection properties](/2-4-2/connectors/shop-floor-connectors/siemens-simatic-s7-plus/s7plusconnection.md) do not include credentials, so the PLC must not require a legitimation password for the connection. 3. Under **Connection mechanisms**, enable **Permit access with PUT/GET communication from remote partner**. 4. Compile the project and download it to the PLC. The PLC serves the symbol information of the downloaded project to Connectware at connection time. 5. Make sure that TCP port 102 is open and reachable from Connectware, including any firewalls in between. On S7-1500 CPUs, PUT/GET access is disabled by default. On CPUs with firmware V3.1 or newer, the setting has moved within the security configuration; see the Siemens FAQ [How do you activate PUT/GET access on an S7-1500 CPU from FW V3.1](https://support.industry.siemens.com/cs/ww/en/view/109925755) for details. ## Finding the Symbolic Paths in TIA Portal An S7+ endpoint addresses a variable through its `nodeId`, a dot-separated path through the TIA Portal project structure, for example `PLC_1.Blocks.ProductionDB.MachineState`. The segments correspond to the project hierarchy: * `PLC_1` is the name of the PLC station in the TIA Portal project tree. * `Blocks` is a fixed segment for the program blocks of the PLC. * `ProductionDB` is the name of the data block as shown under **Program blocks**. * `MachineState` is the tag name inside the data block. Nested structures add one segment per level, for example `PLC_1.Blocks.ProductionDB.Spindle.Temperature`. All names come directly from your TIA Portal project: open the data block in the project tree and read the PLC name, block name, and tag names from there. The tag's declared data type in TIA Portal (for example, `Int`, `DInt`, or `Real`) determines the `dataType` you set on the endpoint. For all supported types, see [Supported Data Types](/2-4-2/connectors/shop-floor-connectors/siemens-simatic-s7-plus.md#supported-data-types). {% hint style="info" %} On the first connection, Connectware loads all symbols from the PLC. Depending on the project size and network, this takes from a few seconds to several minutes. If the connection times out during this phase, increase the `connectionTimeout` connection property, or enable the symbol cache file as described in [Siemens SIMATIC S7+](/2-4-2/connectors/shop-floor-connectors/siemens-simatic-s7-plus.md#symbolic-addressing). {% endhint %} ## Writing the Service Commissioning File The service commissioning file contains all connection and mapping details. This example reads three typical data points from a machining center: a machine state code, a good parts counter, and a spindle temperature. Do not worry about copying the snippets together into one file, the complete example file is available at the end of this guide. ### Description and Metadata These sections contain general information about the service commissioning file. Only the metadata name is required. {% code lineNumbers="true" %} ```yaml description: > Service commissioning file that reads machine data from a Siemens SIMATIC S7-1500 PLC with the S7+ connector using symbolic addressing and maps it into an ISA-95 style MQTT topic hierarchy (Example) metadata: name: SIMATIC S7-1500 S7+ Example provider: cybus homepage: https://www.cybus.io version: 1.0.0 ``` {% endcode %} ### Parameters and Definitions We define the network address of the PLC as parameters, so you can set them when you install the service. The default S7 communication port is 102. The `definitions` section collects the symbolic paths in one place, so the endpoints reference them with `!ref` and you adjust them for your own TIA Portal project in a single spot. The MQTT topics in this guide follow an ISA-95 style equipment hierarchy (`////`). We define the prefix once and reuse it in every mapping with `!sub`. {% code lineNumbers="true" %} ```yaml parameters: plcHost: description: Hostname or IP address of the SIMATIC S7-1500 type: string default: 192.168.1.100 plcPort: description: TCP port of the SIMATIC S7-1500 type: integer default: 102 definitions: MACHINE_STATE: PLC_1.Blocks.ProductionDB.MachineState GOOD_PARTS_COUNTER: PLC_1.Blocks.ProductionDB.GoodPartsCounter SPINDLE_TEMPERATURE: PLC_1.Blocks.ProductionDB.SpindleTemperature MQTT_TOPIC_PREFIX: enterprise/hamburg/assembly/line-1/machining-center ``` {% endcode %} ### Cybus::Connection The connection resource establishes the S7+ connection to the PLC. The connection type `TCPIPTIA` loads the TIA symbols and enables symbolic addressing. The `rack` and `slot` values are 0 and 1 for a standard S7-1500 CPU. The `connectionStrategy` object controls how Connectware retries failed connection attempts with increasing delays. For all connection properties, including the timeout and health check settings, see [S7plus Connection Properties](/2-4-2/connectors/shop-floor-connectors/siemens-simatic-s7-plus/s7plusconnection.md). {% code lineNumbers="true" %} ```yaml resources: s71500Connection: type: Cybus::Connection properties: protocol: S7plus targetState: connected connection: host: !ref plcHost port: !ref plcPort rack: 0 slot: 1 ConnType: TCPIPTIA connectionTimeout: 30000 connectionStrategy: initialDelay: 5000 maxDelay: 30000 incrementFactor: 2 ``` {% endcode %} ### Cybus::Endpoint Each endpoint polls one variable. The `nodeId` references a symbolic path from the `definitions` section, and the `dataType` matches the tag's declared type in TIA Portal. The `interval` sets the polling frequency in milliseconds: the machine state is polled every second, while the counter and temperature change more slowly and are polled every two seconds. For all endpoint properties, see [S7plus Endpoint Properties](/2-4-2/connectors/shop-floor-connectors/siemens-simatic-s7-plus/s7plusendpoint.md). {% code lineNumbers="true" %} ```yaml machineState: type: Cybus::Endpoint properties: protocol: S7plus connection: !ref s71500Connection subscribe: nodeId: !ref MACHINE_STATE dataType: INT interval: 1000 goodPartsCounter: type: Cybus::Endpoint properties: protocol: S7plus connection: !ref s71500Connection subscribe: nodeId: !ref GOOD_PARTS_COUNTER dataType: DINT interval: 2000 spindleTemperature: type: Cybus::Endpoint properties: protocol: S7plus connection: !ref s71500Connection subscribe: nodeId: !ref SPINDLE_TEMPERATURE dataType: REAL interval: 2000 ``` {% endcode %} {% hint style="info" %} Fast polling of many endpoints increases the load on the PLC. A polling interval of one to two seconds works well for most applications. For load management and array reads that fetch many values in one request, see [Performance and Optimization](/2-4-2/connectors/shop-floor-connectors/siemens-simatic-s7-plus.md#performance-and-optimization). {% endhint %} ### Cybus::Mapping The mapping publishes each endpoint on a topic of the ISA-95 hierarchy. {% code lineNumbers="true" %} ```yaml mapping: type: Cybus::Mapping properties: mappings: - subscribe: endpoint: !ref machineState publish: topic: !sub '${MQTT_TOPIC_PREFIX}/state' - subscribe: endpoint: !ref goodPartsCounter publish: topic: !sub '${MQTT_TOPIC_PREFIX}/counter/good-parts' - subscribe: endpoint: !ref spindleTemperature publish: topic: !sub '${MQTT_TOPIC_PREFIX}/temperature/spindle' ``` {% endcode %} With this mapping, the spindle temperature is published on the topic `enterprise/hamburg/assembly/line-1/machining-center/temperature/spindle`, and every other data point follows the same pattern. ## Installing the Service Commissioning File 1. Install the service commissioning file. See [Installing Services](/2-4-2/data-flows/services/managing/installing.md). 2. Enable the service. See [Enabling Services](/2-4-2/data-flows/services/managing/enabling.md). **Result:** The service is enabled. Connectware connects to the PLC, loads the symbol information, and starts polling the configured variables. The first connection takes longer than subsequent ones because of the symbol loading. ## Verifying the Data Open the [Data Explorer](/2-4-2/monitoring/data-explorer.md) and subscribe to `enterprise/hamburg/assembly/line-1/machining-center/#`. Each topic carries a JSON object with the keys `timestamp` and `value`, where the value is the decoded variable: {% code lineNumbers="true" %} ```json { "timestamp": 1784194200354, "value": 42.5 } ``` {% endcode %} A few plausibility checks for the first readings: * The machine state code matches the state shown on the machine or in TIA Portal. * The good parts counter matches the counter in the data block and only increases over time. * The spindle temperature is a plausible physical value and changes gradually, not erratically. If the connection does not reach the **Connected** state, verify that PUT/GET access is enabled on the PLC, that the access level permits access without a password, and that port 102 is reachable from Connectware. If the connection fails with a timeout while the service starts, the symbol loading probably exceeds the `connectionTimeout`; increase it to 60000 ms or more. If a single endpoint reports an invalid `dataType` or delivers no data, check that the symbolic path exactly matches the PLC name, block name, and tag name in TIA Portal, and that the `dataType` matches the declared tag type. For more error patterns, see the [Troubleshooting](/2-4-2/connectors/shop-floor-connectors/siemens-simatic-s7-plus.md#troubleshooting) section of the connector reference. ## Service Commissioning File Example {% file src="/files/u7fDOtYUqBoj2CWLXjqB" %} {% code title="s7-1500-s7-plus-example.yml" lineNumbers="true" expandable="true" %} ```yaml --- # ---------------------------------------------------------------------------- # Service Commissioning File # ---------------------------------------------------------------------------- # Copyright: Cybus GmbH # Contact: support@cybus.io # ---------------------------------------------------------------------------- # Connecting a SIMATIC S7-1500 via S7+ (Example) # ---------------------------------------------------------------------------- description: > Service commissioning file that reads machine data from a Siemens SIMATIC S7-1500 PLC with the S7+ connector using symbolic addressing and maps it into an ISA-95 style MQTT topic hierarchy (Example) metadata: name: SIMATIC S7-1500 S7+ Example provider: cybus homepage: https://www.cybus.io version: 1.0.0 parameters: plcHost: description: Hostname or IP address of the SIMATIC S7-1500 type: string default: 192.168.1.100 plcPort: description: TCP port of the SIMATIC S7-1500 type: integer default: 102 definitions: # Symbolic paths from the TIA Portal project: # .Blocks.. MACHINE_STATE: PLC_1.Blocks.ProductionDB.MachineState GOOD_PARTS_COUNTER: PLC_1.Blocks.ProductionDB.GoodPartsCounter SPINDLE_TEMPERATURE: PLC_1.Blocks.ProductionDB.SpindleTemperature # ISA-95 style topic prefix: //// MQTT_TOPIC_PREFIX: enterprise/hamburg/assembly/line-1/machining-center resources: # Connection to the SIMATIC S7-1500 (S7+ with symbolic addressing) s71500Connection: type: Cybus::Connection properties: protocol: S7plus targetState: connected connection: host: !ref plcHost port: !ref plcPort rack: 0 slot: 1 ConnType: TCPIPTIA # Loads the TIA symbols and enables symbolic addressing connectionTimeout: 30000 # Increase for TIA Portal projects with many symbols connectionStrategy: initialDelay: 5000 maxDelay: 30000 incrementFactor: 2 # Machine state code (INT tag in the ProductionDB data block) machineState: type: Cybus::Endpoint properties: protocol: S7plus connection: !ref s71500Connection subscribe: nodeId: !ref MACHINE_STATE dataType: INT interval: 1000 # Good parts counter (DINT tag, changes slowly, longer poll interval) goodPartsCounter: type: Cybus::Endpoint properties: protocol: S7plus connection: !ref s71500Connection subscribe: nodeId: !ref GOOD_PARTS_COUNTER dataType: DINT interval: 2000 # Spindle temperature (REAL tag) spindleTemperature: type: Cybus::Endpoint properties: protocol: S7plus connection: !ref s71500Connection subscribe: nodeId: !ref SPINDLE_TEMPERATURE dataType: REAL interval: 2000 mapping: type: Cybus::Mapping properties: mappings: - subscribe: endpoint: !ref machineState publish: topic: !sub '${MQTT_TOPIC_PREFIX}/state' - subscribe: endpoint: !ref goodPartsCounter publish: topic: !sub '${MQTT_TOPIC_PREFIX}/counter/good-parts' - subscribe: endpoint: !ref spindleTemperature publish: topic: !sub '${MQTT_TOPIC_PREFIX}/temperature/spindle' ``` {% endcode %} {% hint style="info" %} Disclaimer: TIA Portal, S7, S7-1200, S7-1500, and SIMATIC are trademarks of Siemens AG. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cybus.io/2-4-2/guides/machine-connectivity/plcs-industrial-controllers/connecting-a-simatic-s7-1500-via-s7-plus.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.