Siemens S7-1200 and S7-1500 Symbolic Connector

Siemens S7-1200 and S7-1500 controllers, accessed by TIA Portal symbol, including optimized data blocks.

Overview

The Siemens S7-1200 and S7-1500 Symbolic connector reads and writes PLC variables by their TIA Portal symbol, for example "DataDB".Speed. Tags in optimized data blocks work without a DB number or byte offset, and PUT/GET communication can stay disabled on the PLC.

The connection uses the secure PG/HMI communication of the CPU over TLS 1.3. The connector trusts only the PLC certificate whose thumbprint is entered on the node. For a CPU with a protected access level, the password is entered on the node as well.

For absolute addressing (DB number and offset), use the Siemens S7 Plus Devices Connector.

Requirements

• CPU firmware: S7-1500 V2.9 or later, or S7-1200 V4.5 or later.
• TIA Portal project: V17 or later, with secure PG/HMI communication enabled on the CPU.
• Password login: S7-1500 V3.1 or later, S7-1200 V4.7 or later, or an S7-1200 G2. Older firmware works only on a CPU that grants access without a password.

CPUs without TLS support, and absolute addresses such as %DB1.DBW0 or %M0.0, are not supported by this connector.

Channel Configuration

Protocol Options

• BlockSize: maximum number of points read together in one block. Default is 100, range 1 to 1000. The connector splits a block into as many requests as the PDU size of the PLC requires.

Node Configuration

Station Configuration

Station syntax: <IP>;<TCP Port>;<Certificate Thumbprint>;<Username>;<Password>

Where:

• <IP>: IP address of the S7-1200 or S7-1500 CPU.
• <TCP Port>: ISO-on-TCP port, fixed at 102.
• <Certificate Thumbprint>: SHA-256 thumbprint of the PLC TLS certificate, 64 hexadecimal characters. Spaces and colons are ignored.
• <Username>: optional. User name for a CPU protected with TIA Portal user management. Leave empty to log in with the password only. It cannot contain a semicolon.
• <Password>: optional. Password of the CPU protection level, used only when the CPU does not grant full access without one.

E.g.: 192.168.0.1;102;;; for the first connection, before the thumbprint is known.

Pinning the PLC Certificate

1. Leave the thumbprint empty and start the connection. The connector refuses it and writes the thumbprint the PLC presented to the Trace Window.
2. Verify that thumbprint against the PLC certificate in TIA Portal.
3. Paste it into the Certificate Thumbprint field of the node and restart communication.

A certificate that does not match the configured thumbprint is always refused. When the PLC certificate is renewed, repeat these steps.

Points Configuration

The point address is the TIA Portal symbol, written as in a TIA watch table. Names with spaces or dots go in double quotes.

Each array element and each structure member uses its own point. A whole structure or a whole array cannot be read or written as one point.

Data Types

Writes

• A value out of range for the PLC type is refused with the reason in the Trace Window, and the PLC keeps its value.
• A text longer than the declared string length is refused, never truncated.
• A refused item fails its whole write block, so the other points written in the same block are retried with it.

Troubleshooting

• Connection refused with a thumbprint in the Trace Window: the thumbprint is empty or does not match the PLC certificate. Follow the pinning steps above.
• Access denied: the CPU is protected and the password, or the user name and password, are wrong or missing.
• Connection stops with a message about the older password login: the CPU firmware is older than required for the password login. Update the firmware, or configure the CPU to grant access without a password.
• A point is Bad with a reason in the Trace Window: the symbol does not exist in the PLC, or it names a whole structure or array. The other points in the same block keep reading.

Browsing and importing tags from the PLC are not part of this version. Enter the symbols as points.

Driver Revision History

In this section...