CODESYS to Siemens S7 PLUS Tag Communication Without Programming
Background Overview
Siemens S7-1200 and S7-1500 series PLCs are among the most widely used mid-to-high-end controllers in industrial automation. These PLCs are programmed using TIA Portal, where data blocks (DBs) are categorized into two types: optimized blocks and non-optimized blocks. Non-optimized blocks support traditional absolute addressing (e.g., DB10.DBD20), while optimized blocks do not allow absolute address access and require data to be read or written via symbolic names (tags).
In many engineering projects, users enable the “optimized block access” feature to simplify programming and maintenance. However, traditional S7 communication methods based on absolute addresses cannot access these optimized data blocks. To address this, advanced industrial communication gateways with built-in S7 PLUS protocol natively support tag-based access to Siemens optimized data blocks, enabling millisecond-level real-time data exchange between PLCs from different brands such as Rockwell Allen-Bradley, Mitsubishi, Omron, and Siemens.
This article demonstrates how to achieve bidirectional real-time data exchange between a CODESYS V3 TCP controller and a Siemens S7-1200/1500 PLC using S7 PLUS tag communication via a smart gateway. The entire process requires no PLC programming, no hardware configuration, and no address conversion. It supports cross-network segments, multi-threading, and automatic recovery after power or network interruptions, making it ideal for applications in automotive, new energy, equipment manufacturing, and smart production lines.
Introduction to S7 PLUS Protocol
Siemens PLC communication protocols have evolved through three main versions: S7Comm (traditional S7 protocol), early S7CommPlus, and the latest S7CommPlus protocol. The key differences between S7 PLUS and the traditional S7 protocol are as follows:
- Different Addressing Methods: Traditional S7 protocol communicates based on physical memory addresses (e.g., DB10.DBD20 or DB61.DBD0), requiring precise knowledge of variable offsets within data blocks. In contrast, S7 PLUS protocol enables true symbolic addressing, allowing direct access using variable names defined in the PLC (e.g., DataBlock_2.Arr_Dint[50]), without concern for physical memory layout.
- Support for Optimized Block Access: S7 PLUS natively supports optimized data blocks and symbolic tag addressing for S7-1200/1500. Traditional S7 protocol requires disabling optimized block access and enabling PUT/GET communication permissions in hardware configuration, adding extra engineering effort.
- Enhanced Security Mechanisms: S7 PLUS includes built-in TLS encryption support to ensure data confidentiality and integrity, a critical security feature lacking in traditional S7 protocol. To use TLS encryption, S7-1200 requires firmware version V4.5 or higher (all S7-1200 G2 series support it), and S7-1500 requires V2.9 or higher.
- More Flexible Configuration: S7 PLUS supports reading and writing of all data types, including boolean, integer, floating-point, string, as well as complex types like array elements and structure members. Integration with TIA Portal allows automatic online tag generation without manual import.
Device Connection and Network Structure
In typical scenarios, the CODESYS controller and Siemens PLC are located in different subnets. The smart gateway acts as a router, enabling data interaction between devices across network segments. The following diagram illustrates the network topology:
The gateway features multiple Ethernet ports and serial ports, with optional Wi-Fi wireless communication. It supports hot-plugging and automatically resumes operation after power or network interruptions.
Configuration Steps
4.1 Preparation
- Siemens PLC Configuration: In TIA Portal, ensure the data block has “Optimized block access” enabled. In the CPU properties, check “Allow access from remote objects” and “PUT/GET communication activated”. For CODESYS controller, ensure the symbol configuration file has access permissions set for relevant variables.
- Determine the IP addresses and network parameters of both PLC controllers, and ensure normal network connectivity between the PLCs and the smart gateway.
- Download the parameter configuration software and user manual for the gateway from the manufacturer’s website.
4.2 Gateway Parameter Configuration
Step 1: Select Function Type and Device Driver
Open the parameter configuration software, navigate to Function → Function Type and Device Driver, select “Real-time communication between PLCs (instruments)”, and click “Confirm current selection”.
Step 2: Configure Communication Task Table
Go to Function → PLC Communication Configuration to open the data communication table editor. Each communication task consists of two rows, configuring the source device address and target device address respectively. Below is the detailed configuration for four example tasks:
| Task | Source Device | Source Tag | Target Device | Target Tag | Data Size | Cycle |
|---|---|---|---|---|---|---|
| ① | CODESYS | GVL_TB1.S7_Int0 | Siemens | DataBlock_1.Tag1 | 2 bytes (1 INT) | 10 ms |
| ② | Siemens | DataBlock_1.Bool0 | CODESYS | PLC_PRG.S7_State | 1 bit (BOOL) | 10 ms |
| ③ | Siemens | DataBlock_2.Arr_Dint[0..9] | CODESYS | GVL_TB2.Arr_Dint_50[1..10] | 40 bytes (10 DINT) | 10 ms |
| ④ | CODESYS | GVL_TB3.Arr_Real_20[11..20] | Siemens | DataBlock_3.Arr_Real_5_10[2,0..2,9] | 40 bytes (10 REAL) | 10 ms |
Step 3: Write Parameters to Gateway and Restart
After completing the configuration, click Parameter → Write Parameters to Gateway to download the configuration file to the smart gateway. Once written successfully, click Tools → Restart Gateway to apply the new parameters.
Step 4: Communication Status Monitoring
After the gateway restarts, you can read back the configuration parameters via Parameter → Read Parameters from Gateway. Check the “Status Messages” area at the bottom of the software for debugging and troubleshooting. When communication is normal, you can monitor data source values using Tools → Gateway Data Monitoring.
Frequently Asked Questions
Q1: Why can’t I access the data block of Siemens S7-1200/1500?
A: First, confirm whether the data block has “Optimized block access” enabled. If optimized access is enabled, you must use the S7 PLUS protocol to read/write via symbolic names (tags); traditional absolute addressing will not work. Second, check if “Allow access from remote objects” and “PUT/GET communication activated” are enabled in the CPU properties.
Q2: How to configure when CODESYS controller has username/password authentication?
A: In the gateway communication configuration table, fill in the “Device Description” field with the format [username:password]. For multiple rows under the same connection ID, only the first configuration item needs to include this. For example, [:Admin1921682222] indicates anonymous user with password Admin1921682222.
Q3: What if the byte order between CODESYS and Siemens PLC is inconsistent?
A: The smart gateway supports byte order adjustment. You can set the byte conversion mode in the communication configuration table without any PLC programming. Refer to the parameters in the configuration table and the manual’s section 6.1 for details.
Q4: Can it communicate with multiple PLCs of different brands and models?
A: Yes. Assign different “Connection IDs” to different communication tasks (range 1~255). The smart gateway supports multiple parallel connections for multi-threaded high-speed data exchange.
Conclusion
This case demonstrates how to achieve tag-based data communication between a CODESYS controller and a Siemens S7-1200 PLC using the S7 PLUS protocol via a smart gateway. The solution requires no PLC programming or complex communication configuration—simply define the data tag mapping in the gateway’s parameter configuration software. It is particularly suitable for cross-platform data exchange between CODESYS controllers and Siemens S7-1200/1500 PLCs with optimized block access enabled.
The smart gateway offers multiple Ethernet ports, serial ports, and optional Wi-Fi wireless communication. It eliminates the need for PLC programming; only the start address and data length need to be configured. With millisecond-level communication speed, hot-plug support, and automatic recovery after power or network loss, it ensures reliable operation. It supports many-to-many communication among PLCs of various brands, with a maximum data exchange capacity of 8000 bytes. Each connection within the gateway runs on an independent thread, achieving millisecond-level data interaction. All relevant parameters are configured on a single page, providing convenience and clarity. During debugging, detailed status feedback, comprehensive data monitoring, and error handling mechanisms are available. Due to its simplicity, speed, and long-term stability, it is widely used in industries such as glass and building materials, cement and steel, rubber and textiles, automotive, and new energy. For more application cases, visit the manufacturer’s official website.
