S7 Plus

S7 Plus communicates with Siemens S7-1200 and S7-1500 controllers using the S7CommPlus protocol, the native protocol that TIA Portal itself uses, over ISO-on-TCP on TCP port 102 with TLS encryption. Each S7 Plus device represents one PLC connection. Variables address PLC tags by their symbol name, resolved from the symbol dictionary the CPU itself carries.

S7 Plus is the secure, symbolic alternative to the S7 device type and complements it rather than replacing it. Compared to the S7 device type it reads optimized data blocks, addresses tags by name instead of by absolute address, encrypts the connection with TLS 1.3, and requires no PUT/GET communication to be enabled on the CPU. The S7 device type remains the option for S7-300, S7-400, S7-200, S7-200 Smart and LOGO! controllers, which do not support S7CommPlus, and for S7-1200/1500 firmware versions below the requirements listed below.

Because addressing is symbolic, the Browse Symbols function on the S7 Plus Variables page reads the tag list directly from the running CPU. Selected symbols are created as variables with their data type filled in, so no byte or bit offset bookkeeping is needed and tags in optimized data blocks are reachable.

Variables integrate with the full project variable space: scaling, converters, historian, trends, alarms, events, recipes, the Gateway tab settings (Modbus Address, OPC UA exposure, Writeable, MQTT publishing and Kafka mapping) and UDT membership work the same as for every other device type. The History Source on the Historian tab decides where the trends read the history of a variable; see the History Sources article.

Device Settings

Each S7 Plus device defines one PLC connection. Configure the connection endpoint, the CPU access credentials and the timing options.

Create a new device with the Add button in the toolbar. The Add device dialog contains all device settings organized in the sections General, Connection, Scanning, and Diagnostics, with default values already filled in. Enter at least the Name and IP Address and press Create.

The device row shows Enable, Name, IP Address, Port, Username, Password, Scan Rate, Template, and Description directly and these values can be edited in place. Press the Settings icon on a device row to open the Edit device dialog, which contains the same sections and all settings of the device. Press Save to apply the changes.

CPU Prerequisites

The connection is TLS encrypted end to end and uses the same secure PG/HMI communication path as TIA Portal. PUT/GET communication does not need to be permitted on the CPU, and data blocks keep their Optimized block access setting. This is the reverse of the S7 device type, which needs PUT/GET permitted and optimized block access disabled on every addressed data block.

When the CPU is configured with access protection, enter the password of an access level that permits HMI communication in the Password field. When the TIA Portal project uses local user management (TIA V17 and later), enter the user name and password of a user with HMI access rights in Username and Password.

The CPU identifies itself with a certificate in the TLS handshake, and Certificate validation decides whether that certificate is accepted before the password is sent. With Trust on first connection, the default, the certificate of the first successful connection is stored in Trusted certificate (SHA-256) and every later connection must present the same one, in the same way TIA Portal asks to trust a CPU certificate once. When the CPU certificate is renewed, for example after a firmware update or a new certificate from the TIA Portal certificate manager, the device stays Offline and the device log reports PLC certificate rejected with the trusted and the presented thumbprint; clear Trusted certificate (SHA-256) and save the device to trust the new certificate.

With Trusted CA (machine certificate store), for CPUs that carry a certificate issued by a project CA, the certificate must chain to a CA in the Trusted Root Certification Authorities store of the local machine on the server; import the CA certificate there with the Windows certificate manager. Nothing is stored on the device in this mode. With None, any certificate is accepted; use this only in a lab or with PLCSIM, because it leaves the CPU password exposed to anyone who can intercept the connection.

The Channel State variable of the device (DeviceName.ChannelState) reports Connecting, Connected, Offline, Disabled or Simulation. A rejected password, an insufficient protection level or a rejected CPU certificate is reported in the device log, and the driver stops retrying the same configuration until the device is saved again or the application restarts. With Verbose set to 1 the device log also lists the limits the CPU reported at connection time, such as the number of tags per read request, which is the figure that determines how long a scan of many variables takes. A connection the CPU closes, for example during a restart or a download, is reported as Connection to the PLC lost in the device log, the variables show Connection Lost, and the device reconnects on its next scan.

Variable Settings

Variables address PLC tags by symbol path. Select a device on the S7 Plus Devices page and press the Variables icon to open its variables.

Create a new variable with the Add button, or use Browse Symbols to pick tags directly from the running CPU. The variable row shows the main columns directly and these values can be edited in place. Press the Settings icon on a variable row to open the Edit variable dialog with all settings, organized in the tabs General, Scaling, Historian, and Gateway. The table below lists the S7 Plus specific settings and the Gateway tab settings. The Gateway tab settings Modbus Address, OPC UA, Writeable, MQTT Publisher, Kafka Device, Kafka Remap Device, and Kafka Remap Variable are also available as table columns, which are shown with Columns as described in the Configuration Tables article.

The Address is the symbol path as it appears in the PLC program. A path level that contains spaces or special characters is written in double quotes. Array elements use the index in square brackets.

Browse Symbols

The Browse Symbols button on the S7 Plus Variables page reads the tag list from the running CPU over a separate, short-lived connection, so it works whether or not the device scan is running.

The dialog lists every readable symbol with its address, the PLC data type and the mapped EnvisionSCADA type. Use the search field to narrow the list; the select all checkbox applies to the filtered rows. Press Add Selected to create the selected symbols as variables.

With Start names with {Device}. selected, which is the default, each variable name starts with the {Device} replacer, so the same symbol added on several devices, or on a template device and its instance devices, gives each device its own variable. Clear Start names with {Device}. to use the suggested Name as it is. A plain name must be unique across the whole project, and a template device with instance devices requires the {Device} replacer.

A symbol that already exists as a variable on the device, with or without the {Device}. prefix, is skipped, so browsing again after a PLC program change only adds the new tags. When one of the selected symbols cannot be added, the dialog names its address and no variable is created.

Data block symbols are listed with the data block name as the first level, and a level that contains spaces or other characters outside letters, digits and underscores is quoted automatically, so the Address column can be used as it is. Inputs, outputs and memory tags are listed by their tag name. S7 timers and counters are not listed, because the driver has no symbolic access path for them.
The suggested Name is the address without quotes; an array index becomes an underscore suffix, so Motors[2].Speed is suggested as Motors_2.Speed, and any other character outside letters, digits, underscores and dots becomes an underscore. With Start names with {Device}. selected, Motors_2.Speed is created as {Device}.Motors_2.Speed.

The list is limited to the first 5000 symbols to keep the dialog responsive; the search field narrows the list on the CPU content already loaded.

Scanning and Writing

All variables of a device are resolved to their symbol handles once when the device connects, and every scan reads the whole list in batched requests sized to the limits the CPU negotiates. A symbol that cannot be resolved, for example after it was removed from the PLC program, is reported in the device log and its variable shows a Format Error status while the rest of the device keeps scanning.

Writes are sent through the same symbolic path, so a write always addresses exactly what the read addressed. The Writeable setting and the standard write actions (Set, Reset, Toggle, Momentary On) behave the same as on other device types. Scaling and converters are applied in reverse before the value is written. A write the CPU refuses, for example because the protection level allows reading only or because the value does not fit the tag, is reported in the device log and the variable shows a Format Error status until the next successful read.

Symbols are resolved when the device connects. After a PLC program change that moves or renames tags, the symbols are resolved again on the next connection; a tag that can no longer be read shows a Format Error until then. Tags addressed by name follow a recompile that moves their memory location; a renamed tag must be updated in the variable's Address.