May 14, 2026 · Guide

S7 Communication Protocol: A Practical Guide for Engineers

If you work with Siemens PLCs, the S7 communication protocol is how your software talks to S7-1200, S7-1500, S7-300, and S7-400 controllers. Unlike Modbus or OPC-UA, which are vendor-neutral standards, S7 is Siemens' proprietary protocol — but it is the most direct way to access PLC data without running TIA Portal or Step 7. Here is how it works, what memory areas you can access, and how to use it in practice.

What Is the S7 Protocol?

The S7 communication protocol (sometimes called S7comm or S7 Communication) is Siemens' application-layer protocol for exchanging data with S7-family PLCs over Ethernet. It runs on top of TCP/IP, typically on port 102. The protocol was originally developed for the S7-300 and S7-400 series and later extended for S7-1200 and S7-1500 controllers.

Unlike Modbus, which treats everything as registers, the S7 protocol understands Siemens' memory model natively. You address data by its memory area (DB, I, Q, M, T, C) and its exact byte offset — no register mapping needed. You read and write the same variables that a Step 7 program uses.

S7 Memory Areas

Siemens PLCs organize data into distinct memory areas, each identified by a prefix:

Data Blocks (DB)

Data blocks are the primary storage for user data in S7-1200 and S7-1500 PLCs. Each DB has a number (DB1, DB2, DB100, etc.) and contains structured data — arrays, structs, individual variables. A data block might hold recipe parameters, production counters, setpoints, or alarm configurations.

When reading a DB, you specify the DB number, the byte offset within the block, and the data type. For example, reading DB1.DBD0 (Data Block 1, Double Word at byte offset 0) returns a 32-bit value. The protocol returns raw bytes; your software interprets them as INT, DINT, REAL, BOOL, STRING, or any other S7 data type.

Marker Memory (M)

Marker memory (also called Merker or flag memory) is a global internal memory area shared across all program blocks. Engineers use markers for inter-block communication, status flags, and temporary storage in PLC programs. M0.0 through M0.7 give you 8 boolean flags in the first byte. MB0 is byte 0, MW0 is word 0, MD0 is double word 0.

Inputs (I) and Outputs (Q)

Inputs (I) represent the physical digital and analog input signals wired to the PLC. Outputs (Q, from the German "Quelle") represent the physical output signals. Reading I0.0 tells you the state of digital input 0. Writing Q0.0 turns on physical output 0. For analog I/O, IW64 might be analog input channel 0, and QW64 might be analog output channel 0.

Timers (T) and Counters (C)

S7 timers and counters are special function elements. T0 through T255 are timer values (in S5 time format). C0 through C255 are counter values. These are less commonly accessed externally but available if you need to monitor timer states or counter accumulations.

How S7 Communication Works

The S7 protocol uses a connection-oriented communication model over TCP:

1. TCP connection is established to the PLC on port 102.
2. COTP connection request (Connection Oriented Transport Protocol) sets up the transport layer with the correct rack and slot number.
3. S7 communication setup establishes the application-layer session.
4. Read/Write requests are sent as S7 data frames specifying the memory area, DB number, byte offset, and length.

Rack and Slot Addressing

Each S7 PLC has a rack number and slot number that identifies the CPU module. For S7-1200 and S7-1500, this is almost always rack 0, slot 1. For S7-300 and S7-400, the rack/slot depends on the hardware configuration — you may need rack 0 slot 2 or other values depending on which module holds the CPU.

S7 Data Types

When reading from a PLC, the protocol returns raw bytes. Your software must interpret them based on the S7 data type: