Connecting a SIMATIC S7-1500 via S7+
How to read data from a Siemens SIMATIC S7-1500 PLC with the S7+ connector using symbolic addressing, including optimized data blocks, and map it into an ISA-95 style MQTT topic hierarchy.
This guide shows you how to read data from a Siemens SIMATIC S7-1500 PLC with the Connectware S7+ connector and map it into an ISA-95 style MQTT topic hierarchy. S7+ addresses PLC variables by their TIA Portal symbol names instead of absolute memory addresses. This makes the configuration readable, type-safe, and independent of the memory layout, and it works with optimized data blocks, which the classic S7 connector cannot read. In more detail, the following topics are covered:
Preparing the S7-1500 in TIA Portal so that Connectware can connect
Understanding symbolic addressing and why optimized data blocks work with S7+
Finding the symbolic paths of your variables in TIA Portal
Creating the service commissioning file
Mapping the data points into an ISA-95 style MQTT topic hierarchy
Verifying data in the Data Explorer
This guide focuses on the S7-1500 and symbolic addressing. For S7-300/400 PLCs or absolute addressing with non-optimized data blocks, see Connecting & Integrating a Siemens S7 Device, which uses the classic S7 connector.
A complete example file is available at the end of this guide.
Prerequisites
To follow this guide, you will need the following:
A running instance of Cybus Connectware 2.1.0 or newer.
A Siemens SIMATIC S7-1500 (or S7-1200) that is reachable over Ethernet from Connectware on TCP port 102. You also need access to the matching TIA Portal project to look up PLC and data block names.
Access to the Admin UI with sufficient user permissions.
Basic knowledge of MQTT and the Connectware services concept (for example, service commissioning files, connections, and endpoints).
Symbolic Addressing and Optimized Data Blocks
The classic S7 connector reads variables by absolute address, for example DB10,X0.0 for a bit in data block 10. Absolute addresses only exist in data blocks with standard access. The S7-1200 and S7-1500 create data blocks with Optimized block access enabled by default: the PLC arranges the variables in memory itself, there are no fixed byte offsets, and absolute addressing fails. For the classic connector, you have to disable this attribute on every data block you want to read.
S7+ takes the opposite approach. It loads the symbol information from the TIA Portal project on the PLC and addresses each variable by its hierarchical symbol path, for example PLC_1.Blocks.ProductionDB.MachineState. Because no byte offsets are involved, optimized data blocks stay readable without any changes to the block attributes, and the configuration keeps working when the block layout changes after a recompile.
Preparing the S7-1500 in TIA Portal
Before Connectware can connect, allow external client access on the PLC:
In TIA Portal, open the device configuration of the CPU and select General > Protection & Security.
Under Access level, select an access level that permits read access without a password, for example Full access (no protection). The S7+ connection properties do not include credentials, so the PLC must not require a legitimation password for the connection.
Under Connection mechanisms, enable Permit access with PUT/GET communication from remote partner.
Compile the project and download it to the PLC. The PLC serves the symbol information of the downloaded project to Connectware at connection time.
Make sure that TCP port 102 is open and reachable from Connectware, including any firewalls in between.
On S7-1500 CPUs, PUT/GET access is disabled by default. On CPUs with firmware V3.1 or newer, the setting has moved within the security configuration; see the Siemens FAQ How do you activate PUT/GET access on an S7-1500 CPU from FW V3.1 for details.
Finding the Symbolic Paths in TIA Portal
An S7+ endpoint addresses a variable through its nodeId, a dot-separated path through the TIA Portal project structure, for example PLC_1.Blocks.ProductionDB.MachineState. The segments correspond to the project hierarchy:
PLC_1is the name of the PLC station in the TIA Portal project tree.Blocksis a fixed segment for the program blocks of the PLC.ProductionDBis the name of the data block as shown under Program blocks.MachineStateis the tag name inside the data block. Nested structures add one segment per level, for examplePLC_1.Blocks.ProductionDB.Spindle.Temperature.
All names come directly from your TIA Portal project: open the data block in the project tree and read the PLC name, block name, and tag names from there. The tag's declared data type in TIA Portal (for example, Int, DInt, or Real) determines the dataType you set on the endpoint. For all supported types, see Supported Data Types.
On the first connection, Connectware loads all symbols from the PLC. Depending on the project size and network, this takes from a few seconds to several minutes. If the connection times out during this phase, increase the connectionTimeout connection property, or enable the symbol cache file as described in Siemens SIMATIC S7+.
Writing the Service Commissioning File
The service commissioning file contains all connection and mapping details. This example reads three typical data points from a machining center: a machine state code, a good parts counter, and a spindle temperature. Do not worry about copying the snippets together into one file, the complete example file is available at the end of this guide.
Description and Metadata
These sections contain general information about the service commissioning file. Only the metadata name is required.
Parameters and Definitions
We define the network address of the PLC as parameters, so you can set them when you install the service. The default S7 communication port is 102.
The definitions section collects the symbolic paths in one place, so the endpoints reference them with !ref and you adjust them for your own TIA Portal project in a single spot. The MQTT topics in this guide follow an ISA-95 style equipment hierarchy (<enterprise>/<site>/<area>/<line>/<work-cell>). We define the prefix once and reuse it in every mapping with !sub.
Cybus::Connection
The connection resource establishes the S7+ connection to the PLC. The connection type TCPIPTIA loads the TIA symbols and enables symbolic addressing. The rack and slot values are 0 and 1 for a standard S7-1500 CPU. The connectionStrategy object controls how Connectware retries failed connection attempts with increasing delays. For all connection properties, including the timeout and health check settings, see S7plus Connection Properties.
Cybus::Endpoint
Each endpoint polls one variable. The nodeId references a symbolic path from the definitions section, and the dataType matches the tag's declared type in TIA Portal. The interval sets the polling frequency in milliseconds: the machine state is polled every second, while the counter and temperature change more slowly and are polled every two seconds. For all endpoint properties, see S7plus Endpoint Properties.
Fast polling of many endpoints increases the load on the PLC. A polling interval of one to two seconds works well for most applications. For load management and array reads that fetch many values in one request, see Performance and Optimization.
Cybus::Mapping
The mapping publishes each endpoint on a topic of the ISA-95 hierarchy.
With this mapping, the spindle temperature is published on the topic enterprise/hamburg/assembly/line-1/machining-center/temperature/spindle, and every other data point follows the same pattern.
Installing the Service Commissioning File
Install the service commissioning file. See Installing Services.
Enable the service. See Enabling Services.
Result: The service is enabled. Connectware connects to the PLC, loads the symbol information, and starts polling the configured variables. The first connection takes longer than subsequent ones because of the symbol loading.
Verifying the Data
Open the Data Explorer and subscribe to enterprise/hamburg/assembly/line-1/machining-center/#. Each topic carries a JSON object with the keys timestamp and value, where the value is the decoded variable:
A few plausibility checks for the first readings:
The machine state code matches the state shown on the machine or in TIA Portal.
The good parts counter matches the counter in the data block and only increases over time.
The spindle temperature is a plausible physical value and changes gradually, not erratically.
If the connection does not reach the Connected state, verify that PUT/GET access is enabled on the PLC, that the access level permits access without a password, and that port 102 is reachable from Connectware. If the connection fails with a timeout while the service starts, the symbol loading probably exceeds the connectionTimeout; increase it to 60000 ms or more. If a single endpoint reports an invalid dataType or delivers no data, check that the symbolic path exactly matches the PLC name, block name, and tag name in TIA Portal, and that the dataType matches the declared tag type. For more error patterns, see the Troubleshooting section of the connector reference.
Service Commissioning File Example
Disclaimer: TIA Portal, S7, S7-1200, S7-1500, and SIMATIC are trademarks of Siemens AG.
Last updated
Was this helpful?