July 11, 2026 · Guide

Siemens S7 Rack and Slot Addressing: How PLC Routing Works

The rack and slot parameters are the most common source of connection errors when working with Siemens S7 PLCs. You configure the S7 connection with the IP address, port (102), and rack/slot values. You attempt to connect. Connection refused. You check the IP address — it's correct. You check the port — 102 is correct. You check firewall rules — they allow port 102. The connection still fails. The problem is almost always the rack and slot.

This guide explains what rack and slot actually mean in the S7 protocol, how to find the correct values for different PLC generations, and how S7 routing allows you to reach PLCs that are not directly accessible. If you are building SCADA systems, debugging S7 connections, or integrating with Siemens automation, you need to understand this.

What Are Rack and Slot?

Siemens S7 hardware uses a modular architecture where PLC components are mounted on racks (backplanes) with slots for individual modules. The rack is the physical backplane or enclosure. The slot is the position on that backplane where a module is inserted.

In a traditional S7-300 or S7-400 system, you have a physical rack with a power supply module in slot 1, a CPU module in slot 2 or 4, and I/O modules in subsequent slots. The rack number identifies which backplane the module is on (rack 0 for the main rack, rack 1 for the first extension rack). The slot number identifies the position on that backplane.

The S7 protocol includes the rack and slot parameters in every connection request. When you connect to an S7 PLC, you are not just connecting to an IP address — you are connecting to a specific CPU module at a specific physical location. The PLC validates that the rack and slot in your connection request match where the CPU is actually located. If they do not match, the PLC rejects the connection.

This validation is a feature, not a bug. In multi-rack systems with multiple CPUs, it prevents accidental connections to the wrong controller. But it means you must provide the correct rack and slot, or the connection fails.

        The rack and slot are not arbitrary configuration values. They must match the physical hardware configuration of the PLC. You cannot guess these values. You must determine them from the hardware configuration in TIA Portal, STEP 7, or from the physical installation.
      

S7-1200 and S7-1500: Almost Always Rack 0, Slot 0

Modern Siemens S7-1200 and S7-1500 PLCs use integrated CPU modules without separate backplanes and rack hardware. The CPU, power supply, and I/O are combined in a single unit. There are no separate rack numbers or slot positions in the traditional sense.

However, the S7 protocol still requires rack and slot parameters for backwards compatibility. For S7-1200 and S7-1500, the correct values are almost always:

Rack: 0
Slot: 0

This is the default configuration for these PLCs. The rack/slot are vestigial — they exist because the protocol expects them, but they do not correspond to physical hardware in the way they do for S7-300/400.

When to Use Different Values

The only time you would use different rack/slot values for S7-1200/1500 is if the PLC has been explicitly configured otherwise in TIA Portal. In the device configuration, under "General" → "PROFINET interface" → "Ethernet addresses", there is a field for "Rack/Slot". If this has been changed from the default (0/0), use the configured values. In practice, this is rare. Almost all S7-1200/1500 deployments use rack 0, slot 0.

PUT/GET Communication Must Be Enabled

Even with correct rack and slot, S7-1200/1500 connections will fail unless PUT/GET communication is enabled. These PLCs ship with external S7 access disabled for security. To enable it:

Open the PLC project in TIA Portal.
Select the PLC device in the project tree.
Navigate to "Properties" → "General" → "Protection & Security".
Find "Connection mechanisms" in the properties tree.
Check the box for "Put/GET communication from remote partner (S7-compatible)".
Compile and download the configuration to the PLC.

Without this setting, the PLC rejects external S7 connections even if rack, slot, and IP address are correct. This is a security feature that must be explicitly enabled.

        S7-1200/1500 optimized DBs require additional configuration. If the PLC uses "optimized" data blocks (the default in TIA Portal), you must also enable "Optimized block access" in the connection mechanism settings. Without this, external clients cannot access optimized DBs even with PUT/GET enabled.
      

S7-300 and S7-400: Physical Rack and Slot

For older S7-300 and S7-400 PLCs, the rack and slot correspond to actual physical hardware. You must determine the correct values from the hardware configuration or the physical installation.

S7-300 Typical Configuration

S7-300 PLCs typically use:

Rack: 0 (for the main rack; 1+ for extension racks)
Slot: 2 (where the CPU module is located)

In an S7-300 system, slot 1 is typically occupied by the power supply module (PS). Slot 2 is the CPU. Slots 3 and higher are occupied by signal modules (SM), function modules (FM), and communication processors (CP). If you have a single-rack S7-300 without extension racks, use rack 0, slot 2.

If the PLC uses extension racks connected via interface modules (IM), the CPU is still at rack 0, slot 2. Extension racks have their own rack numbers (1, 2, 3...), but the CPU is always on the main rack. You only use a different rack number if you are connecting to a CPU on an extension rack — which is rare, because CPUs are almost always on the main rack.

S7-400 Typical Configuration

S7-400 PLCs typically use:

Rack: 0
Slot: 3 or 4 (depending on rack type)

The exact slot depends on the S7-400 rack type:

UR1 / UR2 racks: CPU is typically at slot 4. Slot 1 is for the power supply (PS). Slot 2 is for the CPU in some configurations, but slot 4 is more common.
CR3 racks: CPU is typically at slot 3. CR3 racks have a different layout where the CPU is positioned earlier.
UR2-H racks: CPU is at slot 4 in the left partition of the rack.

The safest way to determine the correct rack and slot for S7-400 is to check the hardware configuration in STEP 7 or TIA Portal. Open the hardware configuration, find the CPU module, and note its rack and slot position. These are the values you must use in your S7 connection.

Finding Rack and Slot in STEP 7/TIA Portal

To find the correct rack and slot values:

Open the PLC project in STEP 7 or TIA Portal.
Open the hardware configuration editor.
Locate the CPU module in the station configuration tree.
The properties window or tooltip displays the rack and slot position.
Use these exact values in your S7 connection configuration.

        The rack and slot must match the hardware configuration exactly. If the CPU is physically at rack 0, slot 2, but you configure rack 0, slot 3, the connection will be rejected. The PLC validates the connection parameters against its internal hardware table.
      

Why Wrong Rack/Slot Causes Connection Refused

When you attempt to connect to an S7 PLC, the S7 protocol includes the rack and slot parameters in the connection setup request. The PLC receives this request and performs validation:

Check if a CPU exists at the specified rack and slot.
Check if the CPU is in RUN mode (some configurations reject connections in STOP mode).
Check if the CPU allows external S7 connections (PUT/GET must be enabled on S7-1200/1500).
Check if the maximum number of S7 connections has been reached.

If any of these checks fail, the PLC rejects the connection with a "connection refused" error. The IP address and port may be correct, the network may be functional, but if the rack and slot do not match the hardware, the connection is rejected.

This validation is intentional. In multi-CPU systems (redundant systems, systems with multiple PLCs in one rack), it ensures that you connect to the intended CPU, not a different one. It prevents misconfiguration from causing accidental connections to the wrong controller.

        Connection refused does not always mean wrong rack/slot. Other causes include: PUT/GET not enabled on S7-1200/1500, maximum connections reached, CPU in STOP mode (with "Connections only in RUN mode" enabled), or firewall rules blocking port 102. But rack/slot mismatch is the most common cause and should be checked first.
      

S7 PG/PC Routing: Connecting Through Intermediate PLCs

S7 routing allows you to connect to a target PLC through one or more intermediate PLCs. This is useful when the target PLC is not directly accessible from your PC — for example, when the target PLC is behind a firewall, in a different subnet, or connected only to the plant network while your PC is on the office network.

How Routing Works

S7 routing uses a chain of PLCs to reach the target. If PLC A can reach PLC B, and PLC B can reach PLC C, your PC can connect to PLC A and specify a route through PLC B to reach PLC C. Each PLC in the chain validates the rack and slot of the next hop.

The connection request includes the full route: [your PC] → [PLC A, rack X, slot Y] → [PLC B, rack M, slot N] → [target PLC]. Each intermediate PLC checks that the next hop's rack and slot match its configuration before forwarding the connection request.

When to Use Routing

Network Segmentation: The target PLC is in a subnet that your PC cannot reach, but an intermediate PLC has interfaces in both subnets and can act as a router.
Firewall Traversal: Port 102 is blocked to the target PLC, but an intermediate PLC has port 102 accessible and can route connections internally.
Multi-Hop Access: The target PLC is several network hops away, and routing through intermediate PLCs is simpler than configuring VPN tunnels or opening firewall rules for each hop.

Configuring Routing

To configure routing, you need to specify the route in your S7 client configuration. The route is typically specified as an array of hops, where each hop includes the IP address, rack, and slot of the intermediate PLC:

Route:
  Hop 1: 192.168.1.100, Rack 0, Slot 2 (intermediate PLC)
  Hop 2: 192.168.2.50, Rack 0, Slot 0 (target PLC)

The S7 client connects to the first hop, establishes a routing session, and then forwards the connection request to the next hop. This continues until the target PLC is reached.

        Routing requires that all intermediate PLCs have S7 routing enabled. Not all S7 CPUs support routing. S7-300 and S7-400 CPUs with communication processors (CP) typically support routing. S7-1200/1500 have limited routing support and may require specific firmware versions and configuration.
      

Maximum S7 Connections and Resource Limits

S7 PLCs have a maximum number of simultaneous S7 connections. This limit varies by CPU model and firmware. When the limit is reached, additional connection attempts are rejected with "connection refused" even if rack and slot are correct.

Typical Connection Limits

S7-1200: Typically 8-16 simultaneous S7 connections, depending on CPU model.
S7-1500: Typically 16-64 simultaneous S7 connections, depending on CPU model.
S7-300: Typically 8-32 connections, depending on CPU and communication processor.
S7-400: Typically 32-128 connections, depending on CPU and communication processor.

Checking Active Connections

In TIA Portal or STEP 7, you can view active S7 connections under "Online & Diagnostics" → "Functions" → "Display accessible nodes". This shows all currently connected S7 clients and their connection parameters. If the connection limit is reached, you may need to disconnect unused connections or upgrade to a CPU model that supports more connections.

Connection Pooling

If you are building a SCADA system or HMI that needs to read data from many S7 PLCs, use connection pooling. Do not open a new connection for each read. Open a connection, read data, and keep the connection open for subsequent reads. Close the connection only when you are done with the PLC. This prevents exhausting the PLC's connection limit.

        Some S7 clients open multiple connections internally. A single "connection" in your application may translate to multiple S7 connections on the PLC side — one for data transfer, one for alarms, one for block transfers. Check your S7 client documentation to understand its connection model.
      

Troubleshooting S7 Connection Failures

When an S7 connection fails, follow this troubleshooting checklist:

Verify IP address: Can you ping the PLC? Is the IP address correct?
Verify port 102: Is port 102 open? Use telnet or netcat to test: nc -zv <PLC IP> 102
Check rack and slot: Are they correct for the PLC model? S7-1200/1500 should be 0/0. S7-300 should be 0/2. S7-400 should match the hardware configuration.
Enable PUT/GET (S7-1200/1500 only): Is "Put/GET communication from remote partner" enabled in TIA Portal?
Check CPU mode: Is the CPU in RUN mode? Some configurations reject connections in STOP mode.
Check connection limit: Has the maximum number of S7 connections been reached? Try disconnecting other clients.
Check for routing: If the PLC is behind a firewall or in a different subnet, configure routing through an intermediate PLC.

Voltrus S7 Explorer provides diagnostic tools for troubleshooting S7 connections. It can test connections, display active connections, and show PLC information including CPU model, firmware version, and connection status.

How Voltrus S7 Explorer Works with Rack and Slot

Voltrus S7 Explorer is a native macOS application for connecting to Siemens S7 PLCs. It handles rack and slot configuration and provides tools for troubleshooting connection issues.

Automatic Rack/Slot Detection

S7 Explorer attempts automatic detection of rack and slot for common PLC configurations. It tries the most common combinations (0/0 for S7-1200/1500, 0/2 for S7-300) and reports which combination successfully connects. This saves time when you are unsure of the correct values.

Manual Configuration

For custom configurations, S7 Explorer allows manual rack and slot entry. You can specify any rack number (0-7) and slot number (0-31) to match non-standard hardware setups. The connection test immediately reports whether the combination works.

Connection Diagnostics

When a connection fails, S7 Explorer provides detailed diagnostics:

Network reachability (ping test)
Port 102 availability
Rack/slot validation
CPU mode (RUN/STOP)
Active connection count
PLC information (model, firmware, serial number)

This information isolates whether the failure is at the network layer, the protocol layer, or the PLC configuration layer.

PG/PC Routing Support

S7 Explorer supports PG/PC routing through intermediate PLCs. You can configure multi-hop routes, and the app handles the routing handshake. This allows reaching PLCs that are not directly accessible from your Mac.

Memory Block Reading

Once connected, S7 Explorer can read memory blocks (DBs, Merkers, Inputs, Outputs, Timers, Counters). You can browse the available blocks, view their contents, and export data. This is useful for debugging PLC logic, verifying values, and extracting data without loading the full PLC project.

        S7 Explorer runs natively on macOS. No STEP 7 license, no TIA Portal, no Windows VM required. Universal binary for Intel and Apple Silicon. $49 for a lifetime license. If you are commissioning S7 PLCs or troubleshooting S7 networks, this tool provides everything you need to test and debug connections.
      

Frequently Asked Questions

What is the correct rack and slot for S7-1200 and S7-1500 PLCs?

For S7-1200 and S7-1500 PLCs, the correct rack and slot is almost always Rack 0, Slot 0. These modern PLCs use integrated CPUs without separate backplanes and rack hardware. The rack/slot parameters are vestigial for backwards compatibility. When configuring S7 connections to S7-1200/1500, always use Rack 0, Slot 0 unless the PLC has been explicitly configured otherwise in TIA Portal.

What is the correct rack and slot for S7-300 and S7-400 PLCs?

For S7-300 PLCs, the CPU is typically located at Rack 0, Slot 2. The rack parameter can be 0 for a single-rack configuration or 1+ for multi-rack systems with extension racks. For S7-400 PLCs, the CPU is typically at Rack 0, Slot 4 in UR1 or UR2 racks, or Slot 3 in CR3 racks. The exact slot depends on the rack type and whether the PLC uses a separate power supply module. Check the physical hardware configuration in STEP 7 or TIA Portal.

Why do wrong rack and slot settings cause connection refused?

The S7 protocol includes the rack and slot parameters in the connection request. The PLC compares these values against its internal hardware configuration. If the rack/slot in the connection request does not match where the CPU is physically located, the PLC rejects the connection. This is a security and validation feature — it prevents accidental connections to the wrong module in multi-rack systems. Wrong rack/slot is the most common cause of 'connection refused' errors when connecting to S7 PLCs.

What is S7 PG/PC routing and how does it work?

S7 PG/PC routing allows connections through intermediate S7 PLCs to reach target PLCs that are not directly accessible. If PLC A can reach PLC B but your PC cannot, you configure a route through PLC A. The connection request includes the route: [your PC] → [PLC A] → [PLC B]. Each hop in the route validates the rack and slot of the next hop. This enables reaching PLCs behind firewalls or in subnets without direct network access.

How do I enable PUT/GET communication on S7-1200 and S7-1500?

In TIA Portal, open the PLC properties and navigate to 'Protection & Security' → 'Connection mechanisms'. Check the box for 'Put/GET communication from remote partner (S7-compatible)'. This allows external S7 clients to read and write memory blocks (DBs, Merkers, I/Q) via the S7 protocol. Without this setting enabled, external connections are rejected even if rack and slot are correct. This is a security feature that must be explicitly enabled.

Test S7 Connections on macOS

Voltrus S7 Explorer connects to S7-300, S7-400, S7-1200, and S7-1500 PLCs. Automatic rack/slot detection, PG/PC routing, memory block reading, and connection diagnostics. Native macOS app, no Windows VM required. $49 lifetime.

Explore S7 Connections