Example Program Drafts

Showing results for 
Search instead for 
Did you mean: 

S7 PLC TCP/IP Protocol Reference Example


This example provides a library of LabVIEW VI's that can be used to communicate with a Siemens S7-300 PLC via an Ethernet port over TCP/IP.


This example communicates with a S7-300 series PLC through Ethernet TCP/IP - no adapter is needed. The example provides an API to read from / write to registers on the PLC.


To my knowledge, Siemens has never released the details of the S7 protocol.  Much of what is publicly available on S7 is based on observations of the protocol by others.  There is an open source S7 data exchange package available at http://libnodave.sourceforge.net/ that documents many S7 features.

These VIs were based upon the example posted at http://decibel.ni.com/content/docs/DOC-5467.  They were modified by observing and mimicking a S7 data exchange between a protocol converter and a S7-300 series PLC.  The observations were accomplished with the wireshark network protocol analyzer, available at http://www.wireshark.org/ and the Wireshark Plugin für S7-Protokoll, available at http://sps-forum.de/showthread.php?p=202763.

Steps to Execute Code

The example contains two top-level VIs: S7Com_Once.vi and S7Com_W+R_Loop.vi.

     1.S7Com_Once.vi performs one read or write per execution.  It writes to the target PLC from an array of I32, it reads from the target PLC into an array of I32.  The number of bytes written is proportional to the number of elements in the array to be written and the transport size parameter.

     2.S7Com_W+R_Loop.vi regularly writes to and reads from a pair of DBs in the target PLC.  In order to use it, your Step7 PLC project should provide two Data Blocks, DB11 and DB12.  See the screen capture image db11&12.PNG for their layout.  After downloading the DBs to your PLC, monitor and change DB VAlues with a VAT.  As can be seen in the VI, the transfer size is DWORD.

     3. For more information, refer to the Read Me included in the download.



LabVIEW 8.5 or Later


Siemens S7-300

Download Versions

Siemens S7 TCP v3_3 LV 8_5.zip

     This code is setup to be fault tolerant; i.e. - if a cable is disconnected or connection is lost the "S7_Error_Reconnect.vi" can be called to cleanup the bad connection and re-open a good connection. There are some optimizations for reading multiple registers from a single DB block.This code is derived from the Serial MPI S7 Protocol Exaple


     This code was provided by a fellow developer (thanks!) and uses a slightly different architecture.

Note - the attached files are experimental VIs provided for educational purposes only.  No warrantee is expressed or implied.  You should test your code and completely understand the implications of writing to or reading from an operating PLC.

**This document has been updated to meet the current required format for the NI Code Exchange. For more details visit this discussion thread**

Member MarcoPolo5

sounds like potentially a byte swap issue; check if the PLC is setting MSB and LSB locations different; or if there's some issue with recieving the code as a different data type.

Member led986

I'm working with a 315 Vipa plc, 100% compatible with Siemens! However, this may be the problem ?!

Member Current_93

Dear Bobi

Thank you very much for sharing this new modification for S7-1200.

Please help me - what about I did wrong (see the picture). I'm opening connection to my PLC S7-1214 and at once occur 66 error code from "Read TCP command"


Member Current_93

Dear Bobi and all fellows!

All good working now, I've simply setting up all formats TPKT exactly!

"people who share knowledge - live in eternity"

Member heribert


My connection to a Siemens PLC is running well. But, has anybody tried to read or write varable of type REAL?!

Does it work? How?

KR heri

Member bobi


I tried and everything works fine. Do you get any error message?

BR Bobi

Best Regards
Member awink

For your information - also working perfectly for Siemens LOGO! 0BA8 over Ethernet.

Thank you very much!

Member cortocircuito2003

can you help me to reead my logo8?

Tank you

Member awink

Of course!

Based on the project of the threadstarter find the FP as picture containing the request-settings and the BD as snippet (why are no attachments possible here?).

Best regards!



Member Current_93

Dear fellows!

Really it doesn't work!    I can't to read/write any REAL data types of variables

Member led986

.... I have the same problem.... I can't read/write any real data types correctly.

Member kunalbhate

To read the REAL datatypes, you have to read 4 or 8 bytes depending upon the data type (single or double) and then TYPECAST to real (single or double).

Remember the bytes might be transmitted in bigendian format. You will have to rearrange them and then typecast.

Member awink

So what is the Error-Cluster saying?

What do you mean with "correctly"?

Member Siegmund

Thought this might help. I managed to succesfully connect to a Siemens S7 1200, after implementing the changes proposed by Bobi. However, i wasn't able to read or write any data. Then i came across this Forum:


and the solution that worked for me was enabling:

"Permit acces with PUT/GET communication from remote partner (PLC, HMI, OPC,...)" in the TIA Portal (the setting can be found under Properties > Protection > Connection mechanisms). Until this option was set, i couldnt write or read the sps.

Member Jahi

Seems to work nicely with S7-300 but has anyone tried these VIs with S7-1500 series?

I tried with CPU 1516F but VIs did not work directly. With little bit modification I was able to "open" connection with PLC but was not able to read data from PLC (memoery area). VIs gave error “Error 66 occurred at TCP Read”

I was wondering has someone already figured out how to modify VIs to work with S7-1500?

Member swdegs

Jahi - I have a CPU 1515-2 PN.  I was able to get it communicating with LabView after making the modification somebody mentioned earlier in the thread about S7-1200's.  I modified the 18th element of the "Connected to Adapter" and "Connect to Adapter" arrays from "x 2" to "x 0".  Arrays are found in the "S7_Init_Adapter_TCP.vi".Capture.PNG

Member Current_93

Really does this code works with Logo8?

Member bobi

Communicatio works OK. You must set the 18.octet in "TPDU connection request" to x00 (in Init TCP). For S7-300 x02, for S7-400 x03, for S7-1200 and Logo x00. I think it work also with VIPA S7-300 if you set it to x00. I hope this will help you.

Best Regards
Member søren_hallberg_jensen

I can confirm that it works great with Logo8 !. But do be carefull with fast polling. I have observed strange behaviours if pooling rates go below 100ms. The logo8 acted as if it closed the TCP connection if the polling rate was set to fast.

Thanks for everyone for sharing theese great tools.


Member Advait123

Thanks for the code..it is very useful.

I suceed to read and write with the PLC-300 but only when the values are integer. But when I force the float values (like 40.6, 24.8) from the PLC, I am not able to read in LabVIEW and vice versa.

Do I need to make setting change in the current code or it communicates only with the integer values?

Trusted Enthusiast
Trusted Enthusiast

Hello dear PLC gurus. We did not have too much success testing the shared example VIs, but this is mainly because of our very little knowledge of PLCs. However, using a simple TCP Listen VI we are now able to read data coming from the PLC. However the "from-PC-to-PLC" data communications seems non deterministic, namely we have to send around 100 data blocks until the PLC reacts and updates the target value.

Our issues are explained in the following post, someone might give us a hint what else to try. Thanks very much!


Member sqrt(-1)


I tried this library with S7-300 and it works very very fine.

Does this library can be used wit S7-1200 1300 and 1500?


Member Adrien_31


I'm using this Library with S7-1200 CPU 1212C and I am not able to write/read BYTE data in DB areas.

The connection seems good ; confirmed by the S7Com_OPEN(SubVI).vi execution, but when I uses the S7Com_WRT+READ(SubVI).vi in order to write a BYTE data into the DB#1, an error occurs and nothing is writting.

I send this following frame {0x32; 0x01; 0x00; 0x00; 0x00; 0x03; 0x00; 0x0E; 0x00; 0x07; 0x05; 0x01; 0x12; 0x0A; 0x10; 0x02; 0x00; 0x03; 0x00; 0x01; 0x84; 0x00; 0x00; 0x00; 0x00; 0x04; 0x00; 0x18; 0x01; x03; 0x05} according to these inputs parameters :

   S7_Function = Write ;

   S7_Transport_Size = BYTE ;

   Read Length = 4 ;

   Data Block # = 1 ;

   S7_Add_Area = DB_Area ;

   Start_Address = 0 ;

   Write_Data = {1; 3; 5}

So, I do not understand why the 3 values are not written into DB#1 area, addresses 0 to 2.

Could someone please help me to resolve this issue ?

Thanks in advance,


Member 梦魂飞

 Dear ALL,

                 Could you help me to write data to S7-1200 PLC using the S7 APIs i dint understand the method of writing since i randomly gave output values in APIs and checked,but entered data and output on PLC is different,also can you share some document or manual on S7 API LABVIEW