S7 is the PLC family of Siemens Simatic. EnvisionSCADA communicates with Simatic controllers using the S7 communication protocol (S7comm) over ISO-on-TCP on TCP port 102. This covers the S7-1500, S7-1200, S7-300, S7-400, S7-200 Smart, S7-200 and LOGO! 0BA8 controllers. Each S7 device represents one PLC connection. Variables map data block, memory, input and output addresses into the project variable space.
Configure the device first, then add variables to it. Variables are accessed at runtime as DeviceName.VariableName, for example PLC1.Pump1_Speed.
EnvisionSCADA acts as a client and polls the PLC cyclically at the configured Scan Rate. Reads are grouped into multi-item requests sized to the negotiated PDU length to keep the scan time low. When a CPU does not support multi-item requests, the driver automatically continues with single reads. Writes are executed immediately when an operator or action writes a variable.
Variables reference PLC data by their absolute address, for example DB1.DBW2, M0.0, I0.0 or Q0.0. See the Addressing section for the supported address forms.
Device Settings
Each S7 device defines one PLC connection. Configure the connection endpoint, CPU addressing, and timing options.
Create a new device with the Add button in the toolbar. The Add device dialog contains all device settings organized in the sections General, Connection, Scanning, and Diagnostics, with default values already filled in. Enter at least the Name and IP Address and press Create.
The device row shows Enable, Name, IP Address, Port, CPU Type, Scan Rate, Template, and Description directly and these values can be edited in place. Press the Settings icon on a device row to open the Edit device dialog, which contains the same sections and all settings of the device. Press Save to apply the changes.
| Setting | Description | Example | Units / Format |
|---|---|---|---|
| Enable | Enables or disables this S7 device. | true | Boolean |
| Simulation | Runs the device in simulation mode. The device does not open its real connection; its variables stay available and become read and write in memory like Local variables, with a Good status and a Channel State of Simulation, so the project can be tested without hardware. Written values are held in memory only and reset when the application restarts. | false | Boolean |
| Name | Unique name for this S7 device. Used as the device name prefix in runtime variable references. | PLC1 | Text |
| IP Address | IP address of the PLC. | 192.168.1.10 | IP Address |
| Port | TCP port used for the ISO-on-TCP connection. | 102 | Integer |
| CPU Type | CPU family of the PLC. Available values are S71500, S71200, S7300, S7400, S7200Smart, S7200, and Logo0BA8. | S71500 | Enum |
| Scan Rate | Polling interval. All variables of the device are read once per scan cycle. | 1000 | Milliseconds |
| Template | Optional device template name. When set, this device uses a shared variable list from the named template device. | S7Template | Text |
| Description | Free text description for documentation purposes. | Filling line PLC | Text |
No rows match the filter.
Device Advanced Settings
The following settings are available in the Connection and Diagnostics sections of the Add and Edit device dialog. Rack and Slot identify the CPU in the hardware configuration. S7-1200 and S7-1500 use Rack 0 and Slot 1. S7-300 uses Rack 0 and Slot 2. S7-400 follows the hardware configuration. S7-200 Smart and LOGO! connections do not evaluate Rack and Slot; leave them at 0.
| Setting | Description | Default | Units / Format |
|---|---|---|---|
| Rack | Rack number of the CPU. | 0 | Integer (0 to 7) |
| Slot | Slot number of the CPU. | 1 | Integer (0 to 31) |
| Timeout (ms) | Read and write timeout for requests to the PLC. | 10000 | Milliseconds |
| Verbose | Logging verbosity level. 0 is silent, higher values produce more diagnostic output including write and exception logging. | 0 | Integer |
No rows match the filter.
S7-1200 and S7-1500 Prerequisites
S7-1200 and S7-1500 CPUs require two settings in the TIA Portal project before EnvisionSCADA can access their data.
In the CPU properties under Protection & Security, Connection mechanisms, enable Permit access with PUT/GET communication from remote partner. The access level must permit at least read access.
For every data block that is accessed, open the data block properties, Attributes, and clear Optimized block access. Recompile and download the project after changing the attribute. Global memory (M), input (I) and output (Q) areas are available regardless of the data block attribute.
Variable Settings
Variables are added per device. Each S7 variable maps one PLC address to a named variable in the project variable space.
Create a new variable with the Add button in the toolbar. The Add variable dialog organizes all variable settings in the tabs General, Scaling, Historian, and Gateway, with default values already filled in. Enter at least the Name and Address on the General tab and press Create. When the variable is created on a template device, it is also created on all instance devices that use the template. On a template device, start the Name with the {Device} replacer, so that each instance device gets its own variable. The Name must resolve to a different variable on each device; this is checked for every instance device before anything is saved, when a variable is created and when it is renamed.
The variable row shows Enable, Name, Asset, Type, Address, and Description directly and these values can be edited in place. Press the Settings icon on a variable row to open the Edit variable dialog, which contains the same tabs and all settings of the variable. Press Save to apply the changes. Changes made on a template device are also applied to the matching variable on all instance devices, while each instance keeps its own Modbus Address value. The Gateway tab settings Modbus Address, OPC UA, Writeable, MQTT Publisher, Kafka Device, Kafka Remap Device, and Kafka Remap Variable are also available as table columns, which are shown with Columns as described in the Configuration Tables article.
| Setting | Description | Example | Units / Format |
|---|---|---|---|
| Enable | Enables or disables this variable. | true | Boolean |
| Name | Full variable name. The {Device}. replacer prefix is optional: {Device} resolves to the device name when the device loads, so the variable follows a device rename automatically, while a literal name is used exactly as written and keeps working across device renames. The resolved name must be unique across the whole project. | {Device}.Pump1_Speed | Text |
| Asset | Asset tag used to group and filter this variable. | FillingLine | Text |
| Type | Data type of the variable. Available types are BOOL, BYTE, INT, UINT, WORD, REAL, DINT, UDINT, DWORD, LREAL, and STRING. The Type must match the width encoded in the Address. | INT | Enum |
| Address | S7 absolute address, for example DB1.DBW2, M0.0, I0.0 or Q0.0. See the Addressing section for the supported address forms. | DB1.DBW2 | Text |
| Description | Free text description for documentation purposes. | Pump 1 speed setpoint | Text |
| User Groups | Comma-separated list of user groups that have access to this variable at runtime. | Operators,Supervisors | Text |
| Signature Required | Requires an electronic signature for each write to this variable from a page object, the Live Manager, the Runtime API or MCP while Part 11 compliance mode is enabled and Write variables marked Signature Required is selected under Signature Required Actions on the Parameters page. The write rights of the user and the value range are checked first, so a refused write does not open the Electronic Signature dialog. A variable created while Part 11 compliance mode is enabled starts with Signature Required selected. Writes by alarm, event and schedule actions, Python scripts and the gateways run without a signature. See the Electronic Signatures article. | true | Boolean |
| Recipe Targets | Recipe type name (target) this variable belongs to. Supports the {Device} placeholder, which resolves to the owning device name so one naming rule can spread a set of variables across several devices. | Line1 | Text |
| Recipe Parameter Name | Explicit name of the parameter this variable represents inside a recipe. Variables that fill the same role across different targets share the same Recipe Parameter Name, which is how values are matched on Apply and Snapshot. A variable takes part in recipes only when both Recipe Targets and Recipe Parameter Name are set. | Setpoint | Text |
| Trend Groups | Comma-separated list of trend group names this variable belongs to. A variable can be in several groups. The groups are the filter the Trend Analyst offers when picking variables. The names accept the {Device}, {DeviceName} and {VariableName} placeholders, so one UDT definition gives every instance its own group. | Pumps,{Device} | Text |
| Units | Engineering unit label displayed alongside the value. | rpm | Text |
| Format | Display format of the value on screens and in the Trend Analyst: the value of a Label or Input (unless the object uses its own Floating Point and Decimals), the value text of a Knob and a Slider, the Trend tooltip, a Data Grid Variable column, the right-click menu, Quick Trend, the current value in the Recipe Manager, variable tokens in alarm and event messages, and the Trend Analyst tooltip, summary and pen Format. An Input shows the plain value while it is being edited. 0 shows no decimals, 0.00 always shows two decimals, 0.0## shows one to three decimals and #,##0.00 adds a thousands separator, with up to 15 decimals. Values are rounded half away from zero for display only; alarms and expressions keep the full value, and so does the historian unless Round to Format is on. ReadVariable in the runtime API and MCP returns the Format beside the full value. Leave empty to show the value as received. | 0.00 | Text |
| Min Raw | Minimum raw value from the PLC, used for scaling. | 0 | Number |
| Max Raw | Maximum raw value from the PLC, used for scaling. | 32767 | Number |
| Min Scaled | Minimum engineering value corresponding to Min Raw. | 0 | Number |
| Max Scaled | Maximum engineering value corresponding to Max Raw. | 3000 | Number |
| Converter | Name of a Converter defined in the Converters configuration to apply a custom read/write expression. | RawToPressure | Text |
| Historian | Enables logging of this variable's values to the historian database. | true | Boolean |
| Round to Format | Stores the historian samples of this variable rounded to the decimals of its Format, as a plain number: with Format 0.00 the value 34.30487 is stored as 34.3. The deadband compares the rounded values, so with Deadband 0 a sample is written only when the rounded value changes. On a variable without scaling the Raw value is stored empty, since it equals the value. The live value, alarms, expressions and all interfaces keep the full value. Applies to new samples only; samples already stored keep their values. Requires a Format. | false | Boolean |
| Deadband | Minimum change in value required before a new historian record is written. | 0.5 | Number |
| Minimum Time (s) | Minimum time in seconds between historian records for this variable. | 0 | Seconds |
| Sample Group | Name of the Sample Group that controls the historian sampling rate for this variable. | Text | |
| History Source | Where the trends read the history of this variable: Project default (the History Source with Project default enabled on the History Sources page, or the EnvisionSCADA Historian when no source has it), EnvisionSCADA Historian (the samples recorded while Historian is on) or a History Source of the History Sources page (a query on a Database Connection or the fetch() function of a Python Module script). In the table, an empty History Source is Project default and Historian is the EnvisionSCADA Historian. Live values always come from the variable itself. Test reads the last 24 hours with the settings in the dialog. See the History Sources article. | Project default | Enum |
| History Reference | What the History Source reads for this variable: the reference passed to fetch(), or @Variable of the History Query. When empty, the History Reference of the source is used, by default the full name of the variable; the field shows it in italics. {Name} is replaced by the full name of the variable. Browse lists the references that a Script source offers. | CDT158 | Text |
| History Parameters | Shown for a Script source: optional key=value pairs separated by ;, added to the History Parameters of the source. A key set here replaces the same key of the source. The field shows the History Parameters of the source in italics. | scale=0.1 | Text |
| Modbus Address | Optional address on the built-in Modbus TCP and Modbus RTU servers where this variable is exposed. The servers are enabled in the Gateways section of the Parameters page. Each instance device keeps its own value. | %MW0 | See Modbus TCP Addressing |
| OPC UA | Exposes this variable as an OPC UA node. When Historize is also ticked, the Historian data of the variable is readable through OPC UA Historical Access. | true | Boolean |
| Writeable | Allows external systems to write this variable through the gateways: the OPC UA Server, the Modbus TCP and Modbus RTU servers, the MQTT publisher when Subscribe is enabled on the publisher, and Kafka when Consumer is enabled on the Kafka device. Writes from pages, actions, scripts and the API are independent of this setting. | false | Boolean |
| MQTT Publisher | Name of the MQTT publisher that publishes this variable, typed or chosen with the ... button. A variable is published by one publisher, and the name must match a publisher on the MQTT Publishers page. Leave empty to keep the variable unpublished. Writes from the broker need Subscribe on the publisher and Writeable on the variable. See the MQTT Publishers article. | CloudIoT | Text |
| Kafka Device | Name of the Kafka device this variable is linked to, typed or chosen with the ... button. Every value change of a linked variable is produced to the Producer Topic of the Kafka device while the device is enabled. Writes from the Consumer Topic need Consumer on the Kafka device and Writeable on the variable. Leave empty to keep the variable unlinked. See the Kafka Devices article. | KafkaBroker1 | Text |
| Kafka Remap Device | Device name used for this variable in Kafka messages instead of the name of the device that owns the variable. Inbound messages from the Consumer Topic are matched on this name as well. Leave empty to use the device name. | RemotePLC1 | Text |
| Kafka Remap Variable | Variable name used for this variable in Kafka messages instead of its own name. Inbound messages from the Consumer Topic are matched on this name as well. Leave empty to use the variable name without the device name, for example Pump1_Speed for PLC1.Pump1_Speed on device PLC1. | Speed | Text |
No rows match the filter.
Addressing
Addresses use the Simatic absolute address notation: an area identifier followed by the byte offset, and a bit number for BOOL. Data block addresses start with the data block number, for example DB1.DBX0.0. Memory (M), input (I) and output (Q) addresses omit the data block prefix. The German mnemonics E for inputs and A for outputs are accepted as alternatives to I and Q.
The Type must match the width encoded in the Address. The configuration is validated against this rule when a variable is saved.
| Type | Address Form | Example |
|---|---|---|
| BOOL | Bit address | DB1.DBX0.0, M0.0, I0.0, Q0.0 |
| BYTE | Byte address | DB1.DBB0, MB0, IB0, QB0 |
| INT, UINT, WORD | Word address | DB1.DBW2, MW2, IW0, QW0 |
| DINT, UDINT, DWORD, REAL | Double word address | DB1.DBD4, MD4, ID0, QD0 |
| LREAL | Data block double word address | DB1.DBD44 |
| STRING | Data block string address with byte offset and maximum length | DB1.DBS10.32 |
No rows match the filter.
A STRING address specifies the data block, the byte offset of the string and the maximum string length. DB1.DBS10.32 reads an S7 STRING declared at byte offset 10 with a maximum length of 32 characters. LREAL is available on S7-1200 and S7-1500 data blocks only.
Variable Arrays
A variable can expand into an array by setting the Array size field to a value between 2 and 512. The variable itself is the first element and its Name must end in the first index, for example Temps[0]. The remaining elements are created automatically as Temps[1], Temps[2] and so on. Each element advances the Address by the width of the data type, so consecutive elements land exactly where an array of that type lives in the PLC. A string block cannot form an array, because its width cannot be derived from the address.
The element rows are managed by the first element: they follow its settings, appear locked in the variable list, and are edited by editing the first element. Changing the Array size adds or removes elements at the end. Renaming the first element or changing its address renames and re-addresses all elements. Setting Array size back to 0 while elements exist removes the elements.
To turn the elements into ordinary independent variables, use the Ungroup array action on the first element's row in the variable list, or the Configuration API (POST /API/Config/VariableArrays/Ungroup). All rows are kept and only the grouping is removed. This is one-way. The element count badge next to the first element's name folds and unfolds the element rows in the list.
Notes
The device provides the system variables DeviceName.ChannelState and DeviceName.ExecutionTime. ChannelState reports Connecting, Connected, Offline, or Disabled. ExecutionTime reports the scan execution time in milliseconds.
The connection is re-established automatically after a communication loss. Variable statuses indicate connection lost until the device reconnects.
Writes are executed immediately when an operator or action writes a variable. When a CPU rejects single-bit writes, bit writes fall back to a byte read-modify-write.
The Set, Reset, Toggle and Momentary On actions write to BOOL variables. Momentary On writes the bit on, waits 1.5 seconds and writes the bit off.
Enable Verbose only during commissioning or diagnostics. Verbose level 1 and higher logs write actions and communication exceptions and increases log volume.
A value written to a variable must match its type: a number for the numeric types, and true, false or a number for a BOOL, where any number other than 0 sets the bit. A value that does not match, for example text written to a REAL, is not sent and the PLC keeps its value. The System Log records the rejected write, and the variable status shows FormatError until the next successful read of the variable.