Installation
MacTools S7 Explorer is a native macOS app built with Rust and Tauri. It runs natively on Apple Silicon and Intel Macs — no Rosetta, no Parallels, no TIA Portal, no Windows. One-time purchase, no subscription.
Download
- Direct purchase: buy direct ($14.99 one-time) — you receive a download link by email
- Product page: /s7-explorer/
System Requirements
| Requirement | Minimum |
|---|---|
| macOS | 12 Monterey or newer (Apple Silicon & Intel) |
| Network | Reachability to the PLC on TCP/102 (ISO-on-TCP, RFC 1006) |
| PLC firmware | S7-1200 (firmware ≥ 4.0) or S7-1500. S7-300/400 via optional CP also supported. |
| PLC configuration | PUT/GET communication must be enabled in TIA Portal (see Quick Start) |
First Launch
If you downloaded the direct build outside the App Store, macOS Gatekeeper may block the unsigned binary on first run. Right-click the app, choose Open, then confirm. This is only required once.
Quick Start
0. Enable PUT/GET in TIA Portal (one-time PLC setup)
S7-1200/1500 PLCs block external reads by default. Before the app can reach the data, the PLC engineer must enable it:
- In TIA Portal, open the PLC properties → Protection & Security.
- Under Connection mechanisms, check "Permit access with PUT/GET communication from remote partner".
- For any data block you need to read, open its properties → Attributes → uncheck "Optimized block access". Optimized DBs have no fixed byte offsets and can't be read by absolute addressing.
- Download the hardware configuration and the recompiled DBs to the PLC.
This step is the single most common reason a fresh connection returns data for markers (M-area) but zeros/errors for DBs.
1. Connect to an S7-1200/1500 PLC (2 minutes)
- Open the app and create a new Connection.
- Enter the PLC IP address and port
102. - Set Rack and Slot. For S7-1200 and S7-1500, this is almost always rack 0, slot 1. (S7-300/400 use slot 2 for the CPU.)
- Click Connect. The app negotiates the ISO-on-TTP connection and S7 handshake.
If the connect hangs or returns a negative NACK, jump to Troubleshooting — the most frequent cause is a wrong rack/slot or PUT/GET disabled.
2. Read a marker (%M) bit or word
- Add a read variable: area M (markers), address
MW10(marker word 10) orM0.0(marker bit 0.0). - Select data type:
WORD,INT,REAL,BOOL. - Click Read. The current PLC value appears in the table.
3. Read a data block (DB)
- Add a read variable: area DB, DB number
1, start byte0, typeREAL. - The app reads
DB1.DBD0as a 32-bit float. Adjust the byte offset to match your symbol (e.g.DB1.DBD4for the second REAL). - Add as many variables as needed. Group them by DB number for batch reads.
If the value reads as 0 or you get an access error on a DB you know exists, that DB is optimized (no fixed offset). Either disable optimized access in TIA Portal, or ask the PLC engineer to publish the variable to a non-optimized DB.
4. Write a value
- Right-click a writable variable → Write.
- Enter the new value (type-validated — don't write 32768 into an INT16).
- Confirm. The write uses the same PUT/GET path as the read.
Configuration
Connection Parameters
| Parameter | Values |
|---|---|
| IP address | PLC Ethernet IP |
| Port | 102 (ISO-on-TCP, fixed) |
| Rack | 0 for S7-1200/1500/300/400 (almost always) |
| Slot | 1 for S7-1200/1500; 2 for S7-300/400 CPU |
| Connection type | PG (programming), OP (HMI), or S7 (basic). Use PG or OP for reads. |
| Timeout | Default 5000 ms — raise on slow or routed networks |
Memory Areas
The S7 protocol accesses PLC memory by area code. Each area has its own address space.
| Area | Step 7 Symbol | What's There |
|---|---|---|
| DB | %DB | Data blocks — DB number + byte offset. The main place user data lives. |
| Inputs | %I / E | Physical input image (sensors wired to the PLC) |
| Outputs | %Q / A | Physical output image (actuators) |
| Markers | %M | Internal flags / memory — the "scratchpad" variables |
| Timers | %T | Timer values (S5TIME) |
| Counters | %C / Z | Counter values |
| Peripheral | %IW/%QW (PEW/PAW) | Direct I/O read, bypassing the image — rarely needed |
Data Types & Sizes
| Type | Size | Example |
|---|---|---|
| BOOL | 1 bit | M0.0, DB1.DBX0.0 |
| BYTE | 1 byte | MB0, DB1.DBB0 |
| WORD / INT | 2 bytes | MW10, DB1.DBW10 |
| DWORD / DINT | 4 bytes | MD20, DB1.DBD20 |
| REAL | 4 bytes (IEEE 754 float) | MD40, DB1.DBD40 |
| S5TIME | 2 bytes | BCD-encoded timer (S5#2s, S5#1m30s) |
| TIME | 4 bytes | Milliseconds as DINT (T#10s = 10000) |
| STRING | variable | 2-byte header + ASCII — read with explicit length |
Optimized vs Non-Optimized DBs
This is the single biggest stumbling block for S7-1200/1500 reads. Non-optimized (standard) DBs have fixed byte offsets and can be read by absolute addressing (DB1.DBD4). Optimized DBs (the TIA Portal default) store data internally with a vendor layout that has no stable byte offset — they can only be read symbolically, which the classic S7 protocol does not support over PUT/GET.
| DB Type | Absolute Read? | Symbolic Read? |
|---|---|---|
| Standard (non-optimized) | Yes — DB1.DBD4 | Not over PUT/GET |
| Optimized (default) | No — offset is unstable | Only via OPC-UA or TIA Portal symbol API |
If you need to read an optimized DB, the cleanest path is to mirror the variables into a non-optimized DB, or switch the DB to standard access in TIA Portal.
Polling
The app batches reads by area and DB number into a single PDU, reducing round-trips. Set the poll interval per variable group — 1000 ms is typical for process values; 100 ms for fast diagnostics. The S7-1500 PDU size is 480 bytes; larger reads are split automatically.
Key Features
Variable table with symbolic + absolute addressing
Build a watch table mixing markers (%M), inputs (%I), and data blocks (DB), each with its own type. The table is saved per project and re-polled on reconnect — your commissioning view survives across sessions.
Batched multi-read in one PDU
Instead of one request per variable, the app packs a read-item list into a single READ_VAR PDU. On a 50-variable watch table, this cuts traffic from 50 round-trips to one, keeping the PLC's connection pool free for the SCADA.
Live read + write in one table
Every row has a read value and a write field. You can force a setpoint, toggle a marker bit, or nudge a counter without leaving the table — the same workflow as a TIA Portal watch table, without TIA Portal.
Online bit-level view
For any WORD/DWORD, expand to see all 16/32 bits as a row of LEDs with symbolic labels you assign. Essential for decoding a status word or alarm bitmap field by field.
Direct access without TIA Portal
Commissioning and troubleshooting an S7 PLC from a Mac normally means RDP into a Windows VM with TIA Portal installed. The app reads the live data directly over the wire — no project file, no online connection handshake, no license dongle.
Decoded S7 PDU log
Every request and response is decoded at the S7 layer: parameter header, read/write item lists, transport sizes, and result codes. Filter by parameter error to find which variable in a batch returned "access denied."
Troubleshooting
Common S7 error codes
| Code (hex) | Name | Likely Cause |
|---|---|---|
| 0xD2 / 0xD5 | Param/Item error | Malformed request — usually a DB number out of range or a read length exceeding the PDU |
| 0x85 | Address out of range | Byte offset beyond the DB's size, or area code wrong |
| 0xD6 | Access to object denied | PUT/GET disabled, or the DB is protected/locked |
| 0xDA | Resource not available | PLC's connection pool full — too many PG/OP clients connected |
| 0xDC | Invalid block / size mismatch | Reading a STRING without the correct length, or type mismatch on the offset |
| TPKT NACK | Negative acknowledgment | Wrong rack/slot, or PLC refuses the connection type |
Connection refused / can't reach PLC
Symptom: Connect hangs or fails with a transport error.
Fix: Confirm the PLC is reachable on port 102:
nc -zv 192.168.1.10 102If nc fails, the PLC is offline, the IP is wrong, or a firewall blocks 102. The S7-1200/1500 must have its Ethernet port configured and "Permit access with PUT/GET" enabled in TIA Portal.
Reads M-area fine, errors on DBs
Symptom: Markers (%M) read correctly, but every DB read returns "access denied" or garbage.
Fix: Two possibilities: (1) PUT/GET is enabled but the specific DB is optimized — disable "Optimized block access" in TIA Portal and recompile. (2) The DB is protected/know-how-protected — remove the protection or read a non-protected DB. This is by far the most common S7-1200/1500 issue.
Wrong rack/slot (negative NACK)
Symptom: ISO-on-TCP connect succeeds but the S7 handshake returns NACK.
Fix: Rack/slot must point at the CPU. For S7-1200 and S7-1500, that's rack 0, slot 1. For S7-300 and S7-400, it's rack 0, slot 2. If you're connecting through a CP (communications processor) rather than the integrated PN port, the slot is wherever the CP sits in the rack — check the hardware config.
REAL value reads as garbage / huge integer
Symptom: A 23.5 °C temperature reads as 1115725824 or similar.
Fix: Type/offset mismatch. You're reading 4 bytes as INT/DINT instead of REAL, or the byte offset is off by 2 (misaligned). Confirm the variable's type in the PLC symbol table, set the same type in the watch table, and ensure the byte offset is where the 4-byte REAL actually starts (PLC symbol offset, in bytes).
"Resource not available" (0xDA)
Symptom: Reads work for a while, then start returning 0xDA, then recover.
Fix: The PLC's connection resources are exhausted. S7-1200/1500 have a limited number of PG/OP/S7 connection slots (8–32 depending on CPU). A TIA Portal online session, an HMI, a SCADA, and your app may exceed the pool. Disconnect a client, or raise the connection count in the CPU's communication load settings.
Support
- Email: support@voltrus.id
- Product page: /s7-explorer/
When reporting a read/write issue, attach the decoded PDU log (IPs redacted), the CPU model and firmware, and whether PUT/GET is enabled on the PLC. Knowing the DB is optimized or standard saves a round-trip.