Connecting to S7-1500 and S7-1200

[StefanHasensperling]

In the past I had the possibility to do some tests with this library on the new generation of Simatic PLC’s, namely 1200 and 1500 series. Here I wanted to share my experience about how things work, and what works and what does not.

First off, the New 1x00 PLCs are using an completely new communication protocol, which has not yet been reverse engineered as open source. But the 1x00 series still support the old communication method that his library implements, but not all of it. I must stress this a little bit but, the new and old communication protocols are completely different, and have no resemblance whatsoever. This library does currently only implement the old method and is thus restricted to only a subset of what you could to with 300 PLCs.

So, in short. Yes, you can read some data out of 1200 and 1500 PLC’s, but with Caveats.

To connect to the plc, you must set the following settings in the connection settings:
PLCConnectionConfiguration.CpuRack = 0
PLCConnectionConfiguration.CpuSlot = 0
PLCConnectionConfiguration.CpuIP =

Sometimes you must enable “Get/Put” connections in the “Security Settings” of the Hardware configuration of your PLC. I have found that generally on 1200 it is enabled by default, but on some 1500 it is not. So, check for this setting. After that your connection should be established successfully.

If you upload data-blocks, you MUST deactivate the “Optimized” option. Optimized blocks can not be read whatsoever. If you have those, and cannot change them, unfortunately you are out of luck with this library.

I found that generally the following functions are supported by the PLC’s:
DB Read/Write: Yes, but only for not “Optimized Blocks”. Optimized blocks will always fail.
M, E, A Read/Write: Yes
T and C Read/Write: Never tried
Generally, all “normal” read/write (GET/PUT) are working if the memory is not optimized.

The GET/PUT functions basically operate on Byte arrays. So if you upload the "Raw Bytes" of new 1x00 series data types, I think this should still work, as long as you parse them correctly. Currently this library does only support the "Traditional" datatypes of 300/400 series PLCs. I have never tested this library with 1x00 exclusive datatypes, but I think it should work.

SZL function to not work at all, since these do not exist anymore in the 1x00 plcs. So, if you are loading the Profinet state of your devices, the MFLB number or whatever, you cannot do that.

PLC Inventory function like “Block Upload”, “Block Download” or “Get Block Lists” are not supported at all, since they rely on the online MC7 code that does not exist anymore on these PLCs.

So if you just use typical “Operator Panel (OP)” functions, like GET/PUT aka “read/write”, then you are good to go. If you need SZL, Inventory, or other advanced functions, then you are out of luck.