S7comm

Decode tested

Siemens S7-300, S7-400, S7-1200, and S7-1500, over ISO-on-TCP by rack and slot.

This driver has not been verified against a physical PLC.

S7comm has not been run against a physical PLC. Its decoding is tested thoroughly, covering every data type, sign extension, the two-byte S7 STRING header, byte ordering, block planning, and read-modify-write for bits. But tested decoding is not the same as a value that came off a real controller. If you are the first person to point it at real hardware, treat it as commissioning and check a known value before trusting a screen.

Verified against Frame-level decode and encode tests

Works with Siemens S7-300Siemens S7-400Siemens S7-1200Siemens S7-1500

Defaults to rack 0, slot 1, which is right for an S7-1200 or S7-1500. An S7-300 or S7-400 is usually slot 2.

connectType defaults to 3 (S7 Basic), so the gateway does not occupy the PG connection slot an engineer wants for TIA Portal.

There is no browse. An S7 CPU does not publish the layout of its data blocks, because that lives in the TIA Portal project.

Addressing

Address	Means
`db1:0:real`	A REAL at DB1.DBD0.
`db1:4:dint`	A DINT at DB1.DBD4.
`db1:8.3:bool`	Bit 3 of DB1.DBB8.
`db2:20:string32`	A 32-character STRING.
`m:10:word`	Merker word MW10.
`i:0.1:bool`	Input I0.1.
`q:2:byte`	Output byte QB2.

The trap

The type is required for anything wider than a byte. The protocol cannot tell you whether four bytes are a REAL or a DINT, because that is a fact about the PLC program, not about the wire.

Configuration

rackslotconnectType