Skip to content

Siemens S7 PLC integration

For Siemens S7-300/400/1200/1500 PLCs, install node-red-contrib-s7 from the Install tab of Manage palette — see Managing the palette. It isn't installed on this gateway by default.

Filter the palette for "s7" to find three new nodes under a plc category:

Node-RED palette filtered to "s7", showing the s7 in, s7 out, and s7 control nodes

Node Role
s7 endpoint A shared config node — one connection to the PLC, its variable table, and its poll cycle, reused by any number of In/Out/Control nodes
s7 in Reads a variable (or all variables) from the endpoint's table on every poll cycle
s7 out Writes a value to a variable
s7 control Changes the endpoint's cycle time at runtime, or forces an immediate read

Setting up the endpoint

Double-click an in/out/control node and click the pencil next to PLC to create an s7 endpoint config node. Its Connection tab covers the link to the PLC itself:

s7 endpoint config node, Connection tab, with Transport, Address, Mode, Rack/Slot, Cycle time and Timeout filled in

Field Default Notes
Transport Ethernet (ISO-on-TCP) The normal case, over the network. MPI/PPI/DP Adapter talks over a physical MPI/PPI/DP adapter instead, and needs the separate node-red-contrib-mpi-s7 package
Address — The PLC's IP address (Ethernet transport only)
Port 102
Mode Rack/Slot Or TSAP, needed for devices (e.g. Logo!) that don't expose rack/slot addressing
Rack / Slot 0 / 2 The CPU's rack and slot number
Local/Remote TSAP 01.00 / 01.00 Only shown in TSAP mode — hex TSAP pairs
Cycle time 1000 ms How often the endpoint polls the PLC. 0 disables automatic reading — a manual trigger via s7 control is then required
Timeout 2000 ms Maximum time the PLC may take to answer a request; raise it on a busy or high-latency network

PLC-side setup, not a Node-RED setting

The PLC itself has to allow this. On an S7-1200/1500 in TIA Portal: turn off "Optimized block access" on any data block you want to address by byte offset, and turn on "Permit access with PUT/GET communication" under the CPU's protection properties. None of this can be done from the Node-RED side.

Its Variables tab is where you list the tags this endpoint reads and writes, each as a name and an addr:

s7 endpoint config node, Variables tab, with motor_running and temperature rows filled in

Variable addressing

The S7 addressing scheme is a little different from Step 7/TIA Portal's own notation. Some examples, both accepted forms where there are two:

Address Step 7 equivalent Meaning
DB5,X0.1 DB5.DBX0.1 Bit 1 of byte 0 in DB5
DB23,B1 or DB23,BYTE1 DB23.DBB1 Byte 1 (0–255) of DB23
DB42,I3 or DB42,INT3 DB42.DBW3 Signed 16-bit at byte 3 of DB42
DB57,WORD4 DB57.DBW4 Unsigned 16-bit at byte 4 of DB57
DB13,DI5 or DB13,DINT5 DB13.DBD5 Signed 32-bit at byte 5 of DB13
DB21,R7 or DB21,REAL7 DB19.DBD7 32-bit float at byte 7 of DB21
DB2,S7.10 — String of length 10, starting at byte 7 of DB2
I1.0 or E1.0 I1.0 / E1.0 Bit 0 of byte 1, input area
Q2.1 or A2.1 Q2.1 / A2.1 Bit 1 of byte 2, output area
M3.2 QM3.2 Bit 2 of byte 3, memory area

I/Q/M (English) and E/A/M (German, as used in Step 7) are both accepted for the input/output/memory areas.

Reading (s7 in)

Set Mode to:

  • Single variable — pick one row from the endpoint's table; every cycle (or only when the value changes, if diff is ticked) it outputs msg.payload = that value and msg.topic = the variable's name
  • All variables, one per message — the same, but one message per variable per cycle (with diff ticked, only when that variable changes) — watch the message rate if the endpoint has many variables
  • All variables — msg.payload is an object keyed by variable name, covering every row in the table at once

s7 in node, PLC set to the endpoint, Mode set to Single variable, Variable set to temperature

Writing (s7 out)

Bind the node to one variable from the table, or leave Variable unset and drive both msg.variable (name, or an array of names) and msg.payload (value, or an array of values) from upstream:

s7 out node, PLC set to the endpoint, Variable set to motor_running, with the package's write-caution note visible

The node casts the incoming value to the variable's PLC data type where possible. Writing multiple variables at once (via the array form) may not land in the same PLC write cycle, depending on how many there are.

Warning

As the node's own documentation puts it: fully test everything before using this against a production PLC.

s7 control

The endpoint's cyclic behavior can be changed at runtime — this node has exactly two functions:

s7 control node, PLC set to the endpoint, Function set to Cycle time

  • Cycle time — send a positive number on msg.payload (milliseconds between reads); 0 disables cyclic reading entirely
  • Trigger read — any incoming message forces one read cycle immediately, ignoring the configured cycle time. Useful when a long cycle time is set but an instant readback is needed (e.g. right after a write) — the same message is passed through as the node's output. Note that s7 in nodes are still what actually deliver the read values; this just makes them read sooner

Next: MQTT broker (Aedes), or back to Modbus / PLC integration if your PLC speaks Modbus instead.