S7 communication (S7comm, ISO-on-TCP port 102)

S7 communication is Siemens' proprietary protocol used between SIMATIC S7 controllers, HMIs, SCADA drivers and engineering tools. Third-party HMIs and drivers (Weintek, Kepware, Ignition, many SCADA packages) use the classic variant often called S7comm.

Protocol stack

The connection is addressed by IP address plus rack and slot of the CPU (encoded in the remote TSAP). Typical values: S7-300 rack 0 slot 2; S7-400 depends on the rack; S7-1200/1500 rack 0 slot 1 (the CPU accepts 0 as well in many drivers).

Access on S7-1200/S7-1500

Classic S7comm reads and writes absolute addresses (DB10.DBW4, M0.0, I/Q). On S7-1200/1500 this needs two settings in TIA Portal:

1. CPU properties → Protection & Security → Permit access with PUT/GET communication from remote partner.
2. For data blocks: disable Optimized block access, so the block has fixed offsets.

The engineering and HMI connections of TIA Portal use the newer S7comm-plus protocol with symbolic access and integrity protection; most third-party drivers do not speak it and rely on PUT/GET.

Security note

PUT/GET gives unauthenticated read/write access to the enabled areas. Enable it only where needed, keep the controller in a protected network segment and prefer OPC UA (S7-1500 has a built-in server) for new integrations.

Troubleshooting

• Connection refused → wrong IP/firewall, or port 102 blocked.
• Connected but "access denied"/errors on read → PUT/GET disabled or optimized DB.
• Wrong values → address offset or data type mismatch (REAL vs DINT, byte order — S7 is big-endian).