Connecting Siemens S7-1200 / S7-1500 to the cloud via Eziwan

This guide covers the complete configuration process for connecting a Siemens S7-1200 or S7-1500 PLC to the Eziwan platform. It includes Modbus TCP (S7-1200 and S7-1500) and OPC-UA (S7-1500 only) configurations, model-specific details for each CPU, and troubleshooting for common issues.

Compatibility Chart by Model​

Siemens S7-1200​

CPUMin. FirmwareModbus TCPOPC-UANotes
CPU 1211C AC/DC/RelayV4.0✓ MB_SERVER✗50 KB program, limited to 50 registers max
CPU 1211C DC/DC/DCV4.0✓✗—
CPU 1212CV4.0✓✗75 KB program
CPU 1212FCV4.0✓✗Fail-safe version
CPU 1214CV4.0✓✗100 KB, recommended for monitoring
CPU 1214FCV4.0✓✗Fail-safe
CPU 1215CV4.0✓✗125 KB, 2 Ethernet ports
CPU 1217CV4.0✓✗150 KB, high-speed I/O

Recommendation: For projects requiring intensive monitoring (> 50 variables, 1-second polling), use a 1214C CPU or higher. The 1211C CPU, with its 50 KB of program memory, leaves little room for MB_SERVER function blocks and data.

Siemens S7-1500​

CPUMin. FirmwareModbus TCPOPC-UANotes
CPU 1511-1 PNV2.0✓✓ V2.0Standard, 1 Mbit program
CPU 1513-1 PNV2.0✓✓300 KB data
CPU 1515-2 PNV2.0✓✓2 physical Ethernet ports
CPU 1516-3 PN/DPV2.0✓✓Integrated Profibus DP
CPU 1517-3 PN/DPV2.0✓✓High performance
CPU 1518-4 PN/DPV2.0✓✓Top-of-the-line S7-1500
CPU 1511F-1 PNV2.0✓✓Fail-safe
ET 200SP CPU 1510SPV2.0✓✓Compact, for small control cabinets

Advantage of OPC-UA over S7-1500: No function blocks in the program, no database with absolute access. Variables are published directly via the OPC-UA namespace—easier to configure and more robust.

Siemens S7-300 and S7-400 (legacy)​

ModuleProtocolNotes
CPU 31x with CP 343-1 AdvancedModbus TCP (firmware option)CP 343-1 IT (6GK7343-1GX31) required
CPU 41x with CP 443-1 AdvancedModbus TCPCP 443-1 IT (6GK7443-1GX30)
S7-300 with IM 153-2Modbus RTU via RS-485 gatewayVia Eziwan RS-485 port
All S7-300/400S7Comm (unsecured)Not recommended; not supported by Eziwan
warning

The S7Comm protocol (port 102) used by the S7-300/400 is not supported by Eziwan for security reasons: S7Comm has no authentication and is vulnerable to known attacks. Use Modbus TCP via CP 343-1 or RS-485 Modbus RTU.

Modbus TCP Configuration on the S7-1200​

Network Prerequisites​

  • Static IP address on CPU port X1
  • The Eziwan gateway on the same subnet (or inter-VLAN routing if VLANs are separate)
  • TCP port 502 must not be blocked between the gateway and the CPU

Step 1 — Configure the CPU's IP in TIA Portal​

  1. Project tree → double-click on the CPU
  2. Properties → "PROFINET interface [X1]" tab
  3. "Ethernet addresses" → disable DHCP, enter the static IP
  4. Example: 192.168.1.10 / 255.255.255.0
  5. Leave the gateway field blank if there is no inter-VLAN routing

Step 2 — Create the Data Block for MB_SERVER​

Creating a New Data Block in TIA Portal:

// DB Settings
Nom               : "Eziwan_DB"
Number: automatic (e.g., DB10)
Type              : Global DB
Optimized Access: DISABLED ← CRITICAL
warning

Optimized access must be disabled. In the DB properties, uncheck "Optimized block access." Otherwise, absolute access by memory address (required for MB_SERVER) will not work. This is the number one cause of errors during initial integration.

Database Structure:

DATA_BLOCK "Eziwan_DB"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1

VAR
    // Holding register area (500 16-bit words)
    // Accessible via Modbus FC=03, addresses 0 through 499
    MB_HOLD_REG : ARRAY [0..499] OF WORD;
    
    // Variables internes (non accessibles en Modbus)
    MBStatus     : WORD;
    MBError      : BOOL;
    NewData      : BOOL;
END_VAR

Step 3 — Add MB_SERVER to OB1​

// TCP Connection Block (in an FC or directly in OB1)
// Type: TCON_IP_v4 (instantiate as a static variable in a function block)
//        or as a static connection database)

"ConnectDB".InterfaceId    := 64;       // Port X1 = always 64 on the S7-1200
"ConnectDB".ID             := W#16#0001; // Connection ID (1 to 0xFFF)
"ConnectDB".ConnectionType := 11;       // 11 = TCP
"ConnectDB".ActiveEstablished := FALSE; // Server: Waiting for connection
"ConnectDB".RemoteAddress.ADDR[1] := 0; // Allow all IP addresses
"ConnectDB".RemoteAddress.ADDR[2] := 0;
"ConnectDB".RemoteAddress.ADDR[3] := 0;
"ConnectDB".RemoteAddress.ADDR[4] := 0;
"ConnectDB".RemotePort    := 0;         // Port source quelconque
"ConnectDB".LocalPort     := 502;       // Port Modbus TCP

// Calling the MB_SERVER function (instance in an instance database)
"MB_SERVER_DB"(
    DISCONNECT   := FALSE,               // TRUE to close the connection
    MB_HOLD_REG  := "Eziwan_DB".MB_HOLD_REG,
    CONNECT      := "ConnectDB",
    NDR          => "Eziwan_DB".NewData, // TRUE if new data is received
    DR           => #DataReady,
    ERROR        => "Eziwan_DB".MBError,
    STATUS       => "Eziwan_DB".MBStatus
);

Step 4 — Populate the registers from the program​

// In OB1 or a cyclic OB (OB30, OB35...)
// Recommended convention:
//   Registres 0-49   : variables analogiques
//   Registers 50–99: Counters and Accumulators
//   Registers 100–127: Status and Error Codes (Bitfields)

// Analog values (×10 for 1 decimal place)
"Eziwan_DB".MB_HOLD_REG[0] := REAL_TO_UINT("GVL_Process".Temperature_Four * 10.0);
"Eziwan_DB".MB_HOLD_REG[1] := REAL_TO_UINT("GVL_Process".Debit_Ligne * 100.0);
"Eziwan_DB".MB_HOLD_REG[2] := REAL_TO_UINT("GVL_Process".Pressure * 100.0);

// 32-bit float in 2 registers (if the decimal precision is sufficient with ×10 above)
// Use MOVE to copy bytes
"Eziwan_DB".MB_HOLD_REG[10] := WORD("GVL_Analog".Debit_MSW); // Poids fort
"Eziwan_DB".MB_HOLD_REG[11] := WORD("GVL_Analog".Debit_LSW); // Poids faible

// Status bitfield (16 Booleans in a single register)
"Eziwan_DB".MB_HOLD_REG[100] := 0;  // Reset
IF "GVL_Status".Pompe_1_Marche  THEN "Eziwan_DB".MB_HOLD_REG[100] OR= 16#0001; END_IF;
IF "GVL_Status".Pompe_2_Marche  THEN "Eziwan_DB".MB_HOLD_REG[100] OR= 16#0002; END_IF;
IF "GVL_Alarms".Defaut_Thermique THEN "Eziwan_DB".MB_HOLD_REG[100] OR= 16#0004; END_IF;
IF "GVL_Status".Arret_Urgence    THEN "Eziwan_DB".MB_HOLD_REG[100] OR= 16#0008; END_IF;

// Production counter (int32 across 2 registers)
"Eziwan_DB".MB_HOLD_REG[50] := INT_TO_WORD("GVL_Count".Pieces_SHR 16); // MSW
"Eziwan_DB".MB_HOLD_REG[51] := INT_TO_WORD("GVL_Count".Pieces_AND 16#FFFF); // LSW

The advantage of OPC-UA over S7-1500: no function blocks in the program. Variables are published directly from the OPC-UA namespace without modifying the PLC code.

Enable OPC-UA in TIA Portal V16+​

  1. CPU Properties → "OPC UA" → "Server" → check "Activate OPC UA server"
  2. Port: 4840 (OPC-UA standard, or 48010/48020 depending on network constraints)
  3. Security: select "Basic256Sha256 - Sign & Encrypt" (SL2+ level recommended)
  4. Authentication: Enable "Username/Password" or "Certificate" (disable "Anonymous")

Configure the exposed variables​

In TIA Portal, create OPC UA Access Points:

  1. In the data block or PLC Tags → select the variables to expose
  2. Right-click → "Properties" → enable "Accessible from HMI/OPC UA"
  3. The variables appear in the OPC UA Address Space under ns=3;s=<NomVariable>

Configuration in Eziwan for OPC-UA​

In the dashboard, create the S7-1500 device with the OPC-UA protocol:

equipement:
  protocole: opc_ua
  endpoint: "opc.tcp://192.168.1.10:4840"
  securite: "Basic256Sha256"
  authentification: "username"
  identifiant: "eziwan"
  mot_de_passe: "votre-mot-de-passe"

Modbus TCP Connection Test​

Quick Test Using Python​

from pymodbus.client import ModbusTcpClient

# Test S7-1200 avec MB_SERVER
client = ModbusTcpClient("192.168.1.10", port=502, timeout=3)

if client.connect():
    # Unit ID = 1 for S7-1200 with MB_SERVER
    result = client.read_holding_registers(address=0, count=10, slave=1)
    
    if not result.isError():
        print(f"✓ Connexion OK. Registres 0-9 : {result.registers}")
    else:
        print(f"✗ Erreur Modbus : exception_code={getattr(result, 'exception_code', '?')}")
else:
    print("✗ TCP connection failed — check the IP and that the S7 program is running")

client.close()

Checking the MB_SERVER Status​

In TIA Portal, monitor the DB status variables:

"Eziwan_DB".MBStatus = ?

Valeur   Signification
0x0000   No connection established (waiting)
0x7002   Connection established, waiting for a request
0x7003   Request being processed
0x8XYZ   Erreur (voir tableau codes erreur TIA Portal)

Troubleshooting​

SymptomProbable CauseSolution
TCP connection refusedProgram not loaded or CPU in STOP modeSet CPU to RUN mode; verify that OB1 is running
MB_STATUS 0x8090Optimized DB access enabledDisable S7_Optimized_Access
Modbus Exception 01FB MB_SERVER not called in the programVerify that MB_SERVER is present in OB1
Modbus Exception 02Address > size of the MB_HOLD_REG arrayIncrease the array size or check the address
All values set to 0Process variables not copied to MB_HOLD_REGCheck the copy section in OB1
MB_STATUS 0x80C3Connection ID already in useChange the connection ID in TCON_IP_v4
Incorrect REAL valuesIncorrect byte orderTry float32_abcd vs. float32_cdab in Eziwan
Random disconnectTimeout set too shortIncrease the timeout in the connection settings
OPC-UA: certificate rejectedEziwan certificate not trustedTrust the certificate in TIA Portal > Server > Trusted Clients
👉 Additional Resources

Frequently Asked Questions​

What is the difference between the S7-1200 and the S7-1500 in terms of cloud connectivity?​

Both support Modbus TCP and OPC-UA (native OPC-UA server on the S7-1500; runtime license on the S7-1200, depending on the firmware). The S7-1500 supports more simultaneous OPC-UA nodes; for simple data acquisition, Modbus TCP is sufficient on both.

Should PUT/GET be enabled in TIA Portal?​

Applies only to native S7 communications. For Modbus TCP via the MB_SERVER blocks or for OPC-UA, PUT/GET is not required—in fact, it is preferable for security reasons.

Modbus TCP or OPC-UA: Which Should You Choose for an S7?​

Modbus TCP is easier to implement (mapping from databases to registers); OPC-UA provides data typing, structure, and security through certificates. For a new project on the S7-1500, OPC-UA is recommended; for a quick retrofit, Modbus TCP.

Is remote access to TIA Portal possible?​

Yes, through the gateway's VPN tunnel: the engineering workstation connects to the machine's network, and TIA Portal operates as if it were running locally (online, diagnostics, loading), without exposing the PLC to the Internet.