Overview
The Revolution Pi RevPi7 (Kunbus) gateway exposes a Siemens S7 client over its integrated PROFINET/Industrial Ethernet port so that a Raspberry-Pi-based controller can read and write data blocks in an S7-1200, S7-1500, S7-300 or S7-400 CPU. Unlike the S7-300/400 generations, the S7-1200 and S7-1500 do not expose the classic non-optimized block access by default; the target DB must be created with non-optimized block access enabled in TIA Portal before the RevPi7 can address it via the S7 protocol. This article documents the field-proven configuration sequence, the parameter set required for the connection setup, and the addressing rules that govern the read/write tag mapping inside piCtory.
S7 communication on the integrated PN/IE interface of the S7-1200 is documented in S7 communication between SIMATIC S7-1200 and SIMATIC S7-1500 and in the S7-1200 manual collection entry Communication protocols and ports used by Ethernet communication. The RevPi7 role is comparable to a Siemens PUT/GET client — the CPU is configured as a PUT/GET server and the RevPi7 issues the requests.
Prerequisites
- RevPi Core/Connect/Compact running the latest Kunbus firmware with the RevPi7 module enabled in piCtory.
- Simatic S7-1200 CPU with firmware V4.0 or higher (PUT/GET support on the integrated PROFINET interface).
- TIA Portal V15 or higher with the S7-1200 project.
- Ethernet connectivity between the RevPi PROFINET port and the S7-1200 PROFINET interface on the same subnet (e.g. 192.168.0.0/24).
- At least one DB on the S7-1200 created with Standard (non-optimized) block access and the Permit access with PUT/GET option enabled on the CPU properties.
- Read/write permission to write piCtory configuration files and to execute
sudo rebooton the RevPi.
Protocol and Access Model
The RevPi7 driver is a S7-communication OP-type client (active partner) that uses the Siemens S7 communication protocol over TCP port 102. The TSAP values used to identify the connection endpoints are derived from the rack/slot numbers of the target CPU and the connection type. Internally the driver resolves the connection endpoints, so leaving both TSAPs at zero is supported and recommended even when multiple RevPi7 gateways coexist on the same subnet.
The exchange is based on two operation directions:
-
Data Direction = Read — Data is transferred from the S7-1200 to the RevPi7. Internally the PLC is writing, the RevPi7 is reading. On the RevPi7 side the values appear under
Input_...tags. -
Data Direction = Write — Data is transferred from the RevPi7 to the S7-1200. Internally the RevPi7 is writing, the PLC is reading. On the RevPi7 side the values are written via
Output_...tags.
Step-by-Step RevPi7 Configuration
1. Open piCtory and Place the RevPi7 Module
Start piCtory from the RevPi dashboard (http://<revpi-ip>/app/%230). The RevPi7 module is added from the device catalogue to the virtual DIN rail. Once placed, right-click the RevPi7 module to open the Configure dialog.
2. Set the Connection Parameters
The driver reads the following MEM entries from the RevPi configuration. The values shown are the field-proven defaults for an S7-1200 CPU.
| Setting | Value | Description |
|---|---|---|
MEM PLC_IP |
192.168.0.99 | IPv4 address of the S7-1200 PROFINET interface |
MEM Local_TSAP |
0 | Local transport service access point (driver default) |
MEM Remote_TSAP |
0 | Remote TSAP; resolved automatically from Conn_Type/PLC_Rack_No/PLC_Slot_No
|
MEM Conn_Type |
OP | Operator-connection type; PG is reserved for programming devices |
MEM PLC_Rack_No |
0 | Rack number of the CPU (0 for S7-1200/1500/300) |
MEM PLC_Slot_No |
1 | Slot number of the CPU (1 for S7-1200, 0 for S7-1500, 2 for S7-300) |
MEM PLC_Type |
S7 | Protocol family (no quotes around the value) |
0), not as quoted strings ("0") at runtime. When piCtory persists them, the storage representation will be string-typed but the driver accepts either.3. Configure Extended Data (Read/Write)
Right-click the RevPi7 module and select Setup Extended Data. Add a new line per logical tag group and fill in the columns per the table below.
| Column | Field-proven value | Meaning |
|---|---|---|
| Data Direction |
Read or Write
|
Direction of the data transfer (see model above) |
| Memory Area | DB |
Always data block; other Siemens areas are not exercised by the bundled driver |
| DB number | e.g. 80
|
DB identifier in the S7-1200 project |
| Start databyte | e.g. 0
|
0-based offset within the DB; DBB<start>
|
| Number/size | in bytes | 20 means 20 B = 10 W = 5 DW |
| Device Value (RevPi side) |
Input_... or Output_...
|
Tag the application reads/writes |
4. Worked Examples
-
PLC → RevPi7 (Read): Data Direction = Read, Memory Area = DB, DB number = 80, Start databyte = 0, Number/size = 20. The driver fetches the byte range
DB80.DBB0 .. DB80.DBB19(20 bytes = 10 INTs or 5 REALs) and exposes them under theInput_...tags the application reads via PiControl / python or C++. -
RevPi7 → PLC (Write): Data Direction = Write, Memory Area = DB, DB number = 81, Start databyte = 100, Number/size = 20. The application writes to
Output_...tags; the driver pushes the same byte range toDB81.DBB100 .. DB81.DBB119.
5. Save as Start-Config and Reboot
In piCtory select File → Save as Start-Config. The driver reads Start-Config at boot; otherwise the configuration on the virtual rail is volatile. Restart the RevPi with:
sudo rebootAn alternative that does not require a full reboot is to cycle the RevPi7 service if it is exposed by the firmware version; the reboot is recommended during commissioning because it also restarts the daemon and clears any stale S7 connections in TIME_WAIT.
Sizing the Tag Group
The Number/size column is expressed in bytes, not words. Use the conversion below to plan tag widths.
| Bytes | Words (INT/WORD) | Double words (DINT/REAL) | Typical use |
|---|---|---|---|
| 2 | 1 | — | Single holding register |
| 4 | 2 | 1 | Single REAL sensor value |
| 8 | 4 | 2 | REAL + INT pair, or 8 BOOL-packed flag byte |
| 20 | 10 | 5 | Tabular process image (example) |
| 100 | 50 | 25 | Batch recipe block |
Rule of thumb: the byte offset must remain within the declared DB length, otherwise the driver reports a S7 item-status error. Plan offset + size ≤ DB length at the TIA Portal side and mirror the calculation in piCtory.
Rack and Slot Reference Table
| CPU family | Rack No | Slot No | Conn_Type | Notes |
|---|---|---|---|---|
| S7-1200 | 0 | 1 | OP | Slot 1 is the CPU on the integrated PN port |
| S7-1500 | 0 | 0 | OP | Slot 0 is the CPU on the integrated PN port |
| S7-300 | 0 | 2 | OP | Slot 2 if the CPU is in slot 2 of rack 0 |
| S7-400 | 0 (typical) | 2 or 3 | OP | Avoid the CP/PN card slot; target the CPU slot |
PLC_Rack_No = 1 accordingly. The driver does not auto-detect rack/slot — the values are used to build the remote TSAP.Verifying the Link
- After reboot, check the RevPi system log:
tail -f /var/log/revpi-driver.log— look for entries S7 connect to 192.168.0.99:102. - In piCtory, the RevPi7 module status LED turns green when at least one configured Extended Data line exchanges data successfully.
- Use a simple piTest loop to read the
Input_...tag:piTest -1 -d /dev/virtualio -r Input_1_1. With data direction = Read and Number/size ≥ 2 the first byte appears asInput_1_1. - Conversely, write a known pattern with
piTest -1 -d /dev/virtualio -w Output_1_1 0x1234and observe the same value at the configured DB offset in TIA Portal via a watch table.
Troubleshooting Matrix
| Symptom | Likely cause | Fix |
|---|---|---|
RevPi7 status LED red, driver.err shows connection refused
|
Wrong IP or PLC firewall | Ping 192.168.0.99 from the RevPi; verify S7-1200 PROFINET IP and that Permit access with PUT/GET is enabled on the CPU |
| LED green but Input tag stays 0 | DB has Optimized block access | In TIA Portal, open the DB, Properties → Attributes, uncheck Optimized block access; recompile and download |
| Driver returns S7 item status 0x05 / 0x0A | Offset+size exceeds DB length | Verify DB length ≥ (start databyte) + (number/size); reorganize offsets |
| Tag reads garbage values | Wrong byte order (BIG- vs LITTLE-endian) | Reverse byte order in the application, or swap WORD pairs in the S7 program |
| Multiple RevPi7 devices, only first works | Duplicate TSAPs (legacy issue) | Keep Local_TSAP/Remote_TSAP = 0; the driver auto-uniquifies them per socket |
| Random disconnects every few minutes | PLC in STOP, or DB rebuilt | Confirm S7-1200 is in RUN; rebuild the DB after every TIA Portal download |
Alternative Communication Paths on the RevPi Platform
| Module | Protocol | Best when | Constraint |
|---|---|---|---|
| RevPi7 | S7 (non-optimized) | Existing S7-300/400 fleet, structured DB layout | Requires non-optimized DB access on S7-1200/1500 |
| RevPi Modbus Master | Modbus TCP | S7-1200 has no DB with optimized access, or you want simpler polling | Must be enabled on the CPU; MB_SERVER/MB_CLIENT blocks in TIA Portal |
| RevPi PROFINET Gateway | PROFINET IRT | Deterministic real-time I/O exchange | Requires a Siemens PROFINET GW card add-on on the RevPi side |
| Open TCP (Node-RED, Python, C++) | TCP/UDP via T-Blocks | Cross-vendor, cloud, or SQL pipeline integration | PLC must run T_Blocks; reference Communication between two S7-1200 |
Topology and Data Flow
CPU Configuration on the S7-1200 (TIA Portal)
- Open the project and double-click the S7-1200 CPU.
- Properties → Protection & Security → check Permit access with PUT/GET communication from a remote partner.
- Create the DB: Add new block → Data Block. On its Attributes tab, uncheck Optimized block access. Save and compile.
- Define the data layout matching the RevPi7 byte offsets: e.g.
DB80with 100 bytes from offset 0;DB81with 200 bytes from offset 0. - Download the hardware and software to the CPU and put it in RUN.
Field-Proven Caveats
- If the DB layout is changed after the RevPi7 has already established a connection, the driver caches the connection and may serve stale bytes until the next polling cycle. Trigger a Save as Start-Config + reboot to force a reconnect.
- When a Python or C++ application reads
Input_…tags through/dev/virtualio, never assume atomicity across the full tag group — serialize writes from a single thread to avoid torn values inside the 20-byte window. - The integrated PROFINET interface of the S7-1200 supports a bounded number of S7-communication connections. Each RevPi7 uses one. Check the Communication tab of the TIA Portal device properties to ensure you stay below the per-CPU connection budget.
- The CPU's integrated PROFINET port uses port 102 (TCP) for S7 communication; see Communication protocols and ports used by Ethernet communication. Ensure corporate firewalls do not strip ISO-on-TCP / S7 packets.
- For multi-CPU S7-400 racks, never direct the RevPi7 at the slot of the Ethernet CP — always target the CPU slot itself.
FAQ
Does the RevPi7 work with an S7-1200 that uses optimized block access?
No. The bundled driver implements only the non-optimized S7 protocol. In TIA Portal, open every DB the RevPi7 will access and uncheck Optimized block access under Attributes; otherwise the driver will return item-status errors and the Input tags will stay at zero.
What Rack and Slot numbers should be configured for an S7-1200?
Set PLC_Rack_No = 0 and PLC_Slot_No = 1. The S7-1200 CPU always occupies slot 1 of rack 0 on its integrated PROFINET interface.
Can the same RevPi7 poll multiple DBs at once?
Yes. Add one Extended Data line per logical tag group, each with its own Data Direction, DB number, start databyte and number/size. Direction = Read produces Input_… tags, Direction = Write produces Output_… tags.
Is PUT/GET access required on the S7-1200?
Yes. In TIA Portal, CPU Properties → Protection & Security → enable Permit access with PUT/GET communication from a remote partner. Without it, the S7-1200 rejects third-party read/write requests on TCP/102.
Do I have to reboot the RevPi after every config change?
Yes for Start-Config changes during commissioning. Save the configuration as Start-Config (File → Save as Start-Config) and then run sudo reboot. The driver loads Start-Config once at boot; runtime edits are discarded on the next reboot.