AiVibeSiemens S7 Communication (S7comm)
S7 communication, often called S7comm, is Siemens' proprietary protocol for exchanging data with SIMATIC S7 PLCs, used by engineering software, HMIs and third-party drivers to read and write controller memory over industrial networks.
Over Ethernet, S7 communication runs on ISO-on-TCP, defined in RFC 1006, which carries ISO transport (COTP) packets over TCP port 102. A client establishes a connection to the CPU, negotiates parameters and then issues read and write requests for memory areas such as inputs, outputs, bit memory and data blocks, addressed by area, block number, offset and data type. Many third-party SCADA systems, gateways and open-source libraries implement S7 drivers.
S7 drivers let historians, MES and IIoT platforms collect data from S7-300, S7-400, S7-1200 and S7-1500 controllers without changing the PLC program, which is valuable on installed lines where OPC UA is unavailable or not licensed. Newer S7-1200 and S7-1500 CPUs also use an enhanced protocol variant, often called S7comm-plus, which adds security mechanisms for engineering and HMI connections.
On S7-1200 and S7-1500 CPUs, classic S7 access by external clients typically requires enabling PUT/GET access in the hardware configuration and using data blocks without optimised block access, which has security implications. Classic S7comm has no strong authentication, so connections should be restricted through network segmentation and read-only access wherever possible, following IEC 62443. Changes to PLC configuration must be made by qualified personnel under change control.
Key points
- Proprietary Siemens protocol for SIMATIC S7 controllers
- Over Ethernet it runs on ISO-on-TCP (RFC 1006) using TCP port 102
- Reads and writes inputs, outputs, bit memory and data blocks
- S7-1200 and S7-1500 access by external clients usually needs PUT/GET enabled
- Lacks strong authentication; restrict with segmentation and read-only access
Where AiVibe comes in
AiAmbA IoT lists Siemens S7 among its supported protocols, with driver availability confirmed per installation and writes to machines deny-by-default.
Related terms
- Programmable Logic Controller (PLC)PLC & Industrial Control
- Industrial EthernetPLC & Industrial Control
- PROFINETPLC & Industrial Control
- Supervisory Control and Data Acquisition (SCADA)PLC & Industrial Control
- OPC Unified Architecture (OPC UA)Industrial IoT & Edge
- IEC 62443 (ISA/IEC 62443)OT & Industrial Cybersecurity