August 11, 2026 · How-To

How to Read a Siemens S7 Data Block (DB) Over the Network

Reading a Siemens S7 PLC from outside TIA Portal comes down to one operation: read a data block (DB) at a byte offset and length, then decode the bytes against the DB's declared types. Do that and you can pull any value the program exposes — setpoints, process values, machine state — into SCADA, a dashboard, or a script. The mechanics are simple; the two things that stop people are the rack/slot connection and PUT/GET being off by default.

This guide walks through the full read. For the protocol background, see the S7 protocol guide; for the connection gotcha, rack and slot routing.

Prerequisites

Network reachability. The PLC's PROFINET port is on your subnet; TCP 102 is open.
PUT/GET enabled. S7-1200/1500 ship with it off. See enabling PUT/GET.
The DB number, offset, type, and the rack/slot of the target CPU.
A non-optimized DB if you want fixed-offset reads (optimized blocks have no predictable offsets — see FAQ).

Step 1 — Connect with the Right Rack and Slot

The S7 protocol routes the connection to the CPU by rack and slot. Wrong values give a connection error, not a data error:

S7-1200 / S7-1500 (built-in PROFINET port): rack 0, slot 1.
S7-300: rack 0, slot 2.
S7-400: rack 0, slot varies (often slot 2-4).

See rack and slot routing for the full per-model table.

Step 2 — Read the DB at an Offset

A data block is identified by its DB number (e.g. DB10). You read from a byte offset for a length in bytes:

DB number — which data block.
Offset — byte position within the DB (0-based).
Length — number of bytes to read.

The bytes come back raw. You decode them against the DB's declared types — a REAL at offset 0 is four IEEE-754 bytes; an INT at offset 4 is two bytes, big-endian; a BOOL is one bit of a byte.

Optimized blocks: S7-1500 DBs default to "optimized" — internal layout, no fixed offsets. For offset reads, untick "Optimized block access" in the DB properties, recompile, and download. Or use OPC UA for symbolic access.

Step 3 — Decode and Scale

Cast the bytes to the S7 type (BOOL, BYTE, INT, DINT, REAL, STRING, ...).
Mind byte order — S7 is big-endian.
Apply engineering scaling if the raw value is an integer count (e.g. counts × 0.1 → engineering units).
For DATE_AND_TIME, STRING, and structured types, follow the S7 encoding rules — they are not plain ASCII or Unix time.

Common Failure Modes

Connects but reads fail — PUT/GET is disabled, or the DB is optimized and the offset is wrong.
Connection refused — wrong rack/slot, or TCP 102 blocked.
Garbage values — wrong offset, wrong type, or wrong byte order (remember big-endian).
Reads work for one DB, fail for another — the failing DB is optimized; the working one is standard.

Reading on macOS

MacTools S7 Explorer connects on port 102, handles the rack/slot negotiation, reads DBs by number/offset/length, and decodes the common S7 types so you see DB10.DBX0.0 = TRUE or DB10.DBD4 = 74.3 instead of a hex blob. No TIA Portal, no Windows.

Read S7 Data Blocks on macOS

MacTools S7 Explorer — connect to S7-1200/1500, read DBs by offset, decode types, monitor live. Native macOS app.

Get MacTools S7 Explorer

Frequently Asked Questions

How do I read a Siemens S7 data block?

Connect to the PLC over the S7 protocol on port 102 using the correct rack and slot (rack 0 slot 1 for S7-1200/1500 with the built-in port; rack 0 slot 0 or slot 2 for S7-300 depending on model), ensure PUT/GET access is enabled in the CPU properties, then issue a read for a specific DB number at a byte offset and length. The bytes come back raw and you decode them according to the DB's declared data types.

What rack and slot do I use to connect to an S7-1200 or S7-1500?

For S7-1200 and S7-1500 using the CPU's built-in PROFINET port, the connection is rack 0, slot 1 (older snap7 convention sometimes uses rack 0 slot 0). S7-300 CPUs use rack 0, slot 2. Getting this wrong returns a connection error, not a data error — see our rack and slot addressing guide for the per-model values.

Why can't my tool read an S7 data block even though it connects?

Almost always because PUT/GET access is disabled. Siemens ships S7-1200/1500 with Permit access with PUT/GET turned off for security. You enable it in TIA Portal under CPU Properties > Protection & Security > Connection mechanisms. Without it, the connection succeeds but reads of arbitrary DBs return an access error. Also check that the DB is not marked optimized (optimized blocks use symbolic addressing, not fixed offsets).

What is an optimized data block in S7-1500?

An optimized DB is stored by Siemens in an internal layout for performance and download-without-recompile — its members do not have fixed, predictable byte offsets. Direct offset-based reads over S7 cannot address individual members reliably. For offset reads, mark the DB as non-optimized (standard) in TIA Portal, or use OPC UA / symbolic access instead.

Related: Continuous Monitoring

Voltrus SCADA reads S7 data blocks continuously — dashboards, alarms, historian. From $249 lifetime.