Configuring S7-1200 Read-Only Access for Third-Party SCADA

Third-party SCADA platforms (Movicon.NExT, WinCC, Ignition, GeoSCADA Expert, iFIX, Zenon, Citect, AVEVA) routinely poll Siemens S7-1200 CPUs over ISO-on-TCP (S7Comm) or Modbus TCP. The engineering question is straightforward: how do you let the SCADA read every tag it needs while guaranteeing that no SCADA operator can write a single value back into the PLC? This reference walks through the exact TIA Portal configuration that enforces read-only visibility, then layers the S7-1200 CPU security model on top so the protection survives a project download, a firmware update, and a remote desktop session from a curious integrator.

1. Prerequisites and Supported Firmware

For firmware 4.4 and later the S7Plus protocol is available and offers symbolic access to optimised data blocks. Earlier firmware must use the classic S7Comm Put/Get path with non-optimised (absolute-addressed) DBs. Confirm the CPU order number (MLFB) and firmware from the online > Online & diagnostics view before configuring.

2. CPU Protection and Security Settings (TIA Portal V17+)

Modern S7-1200 firmware defaults deny any external write request. You must therefore re-enable the channels a SCADA needs without re-enabling full PG/PC write authority.

1. Open the project in TIA Portal and select the S7-1200 CPU in the project tree.
2. Open Properties > Protection & Security.
3. Under Access level set:
   • Full access (no protection) — disabled (do not use).
   • Read access — passwords optional, write access from HMI/SCADA still blocked by default.
   • HMI access — recommended when SCADA must write, but for read-only keep this at default with no password.
   • No access / Complete protection — confirms nothing can be written, but may break SCADA polling on older drivers that expect the HMI access level.
4. Configure a strong Full access password. Without this password, an attacker with Ethernet reach cannot go online, cannot download a modified project, and cannot re-enable write flags.

2.1 Connection mechanisms (TIA V17 / V18)

1. Expand Protection & Security > Connection mechanisms.
2. Set Permit access with PUT/GET communication from remote partner = Enabled only if the SCADA uses S7Comm Put/Get (most drivers do).
3. Set Communication mode TIA Portal and HMI = Only allow secure PG/PC and HMI communication (V17+). This blocks legacy unsecured PG/PC routes used by some SCADA engineering tools.
4. Disable Permit access via OPC UA if your SCADA will not use OPC UA, to shrink the attack surface.

3. Data Block Configuration for Read-Only Symbol Access

The DB is the contract between PLC and SCADA. Every variable the SCADA needs must live in a single, named DB so the engineer can audit it line by line.

1. Add a new Global DB (Project tree > PLC > Program blocks > Add new block > Data block).
2. Name it DB_SCADA_Interface (or project convention).
3. Define the tag list. Example for a pumping station:

DATA_BLOCK "DB_SCADA_Interface"
{ S7_Optimize_Access := 'FALSE' }
  VERSION : 0.1
  STRUCT
    Motor1_Running       : BOOL;     // 0.0
    Motor1_Speed_Hz      : REAL;     // 2.0
    Motor1_Current_A     : REAL;     // 6.0
    Tank1_Level_Pct      : REAL;     // 10.0
    System_Alarm_Word    : WORD;     // 14.0
    Last_Update_Timestamp: DTL;      // 16.0
  END_STRUCT;
END_DATA_BLOCK

3.1 Non-optimised vs Optimised Block Access

For maximum SCADA compatibility (Movicon, WinCC non-Siemens, most generic drivers) keep the block non-optimised. For GeoSCADA Expert or Ignition S7Plus drivers, optimised access is acceptable and even preferred on firmware 4.4+.

3.2 Per-tag HMI access flags

1. Right-click the DB header > Properties > Attributes.
2. Tick Accessible from HMI (this is the master switch for SCADA visibility).
3. For each tag inside the DB, open the tag's properties and on the Attributes tab set:
   • Accessible from HMI = checked
   • Writable from HMI = unchecked
   • Visible in HMI = checked

To make this faster on a 200-tag DB, multi-select all tags in the DB, open properties, and apply the same three settings. TIA Portal will set the attribute identically on every selected element.

4. Enabling Put/Get Communication on the CPU

For S7-1200 firmware V4.0 to V4.3, Put/Get must be explicitly enabled or no S7Comm read will succeed. For V4.4+, Put/Get is still required for non-optimised DB reads over S7Comm; S7Plus symbolic access does not need it.

1. CPU > Properties > Protection & Security > Connection mechanisms.
2. Tick Permit access with PUT/GET communication from remote partner.
3. Compile and download the hardware configuration to the CPU.

Verify the setting is active in the CPU: Online > Online & diagnostics > Security > Connection mechanisms.

5. Modbus TCP Alternative for Read-Only

If the SCADA client does not speak S7Comm, configure a Modbus TCP server inside the S7-1200 and expose the same interface DB through MB_HOLD_REG instructions. Because Modbus is a separate protocol path, the Put/Get switch and the HMI access flags above are not required for SCADA visibility — but the HMI access flags on the DB tags still apply if the SCADA also reads the same DB through S7Comm.

1. Add the MB_SERVER instruction (Instructions > Communication > Communication processor > Modbus TCP).
2. Connect MB_DATA_PTR to a dedicated Modbus holding-register DB, non-optimised, with one WORD per tag.
3. For bit-level access, use MB_HOLD_REG data blocks pre-mapped from the DB_SCADA_Interface tags using move instructions in cyclic OB1.
4. Set the connection ID to a free number, and bind the server to the PROFINET interface of the CPU.

Modbus TCP supports Function Codes 1, 2, 3, 4, 5, 6, 15, 16. The SCADA can read FC 3 (Read Holding Registers) and FC 4 (Read Input Registers). Writes using FC 5/6/15/16 are still permitted by the protocol, but if the SCADA never issues them the protection holds. For protocol-level write prevention, place the Modbus interface DB outside the area that any ladder writes into, and use a one-way copy from DB_SCADA_Interface to the Modbus DB so no value can flow back.

6. S7Plus Protocol Notes (Firmware V4.4+)

S7Plus is the modern Siemens transport that gives the SCADA direct symbolic access to optimised DBs without the legacy Put/Get handshake. The official Siemens documentation confirms symbolic DB access on S7-1200/1500 CPUs running firmware V4.4 or later. Driver support varies:

When using S7Plus, the configuration is simpler: the DB stays optimised, the SCADA imports the symbols directly, and the Writable-from-HMI flag still controls write authorisation at the CPU.

7. SCADA Client Configuration (Movicon.NExT Example)

1. Open the Movicon.NExT project and add a new Siemens S7 TCP/IP driver.
2. Enter the S7-1200 IP address and rack/slot = 0 / 1 (CPU 1200 default).
3. Add tag entries pointing at the DB_SCADA_Interface offsets (e.g. DB100.DBX0.0 BOOL for Motor1_Running).
4. On the screen designer, drag the tags onto read-only display widgets (numeric indicator, bar, label). Do not bind them to input boxes, sliders, or command buttons.
5. Lock the SCADA user accounts to Operator role with no write privileges for this driver.
6. Poll at 1 s for status, 5–10 s for analogue values, and enable driver diagnostics so write attempts are logged.

8. Verification Procedure

After every configuration change, run the following four-point test. Document the result in the project FAT/SAT report.

1. Read test. From a laptop with the SCADA driver tool (or a generic S7 client such as S7NetPlus), poll every tag in DB_SCADA_Interface. All must return a current value.
2. Write test — driver level. Attempt a single PUT to DB_SCADA_Interface.Motor1_Running. The CPU must return an access error (W#16#80D1 or W#16#8082 in the diagnostic buffer). The tag value must remain unchanged.
3. Write test — SCADA level. From the SCADA operator screen, if a writable widget was inadvertently bound, attempt to change a value. The value must not change in the PLC. The SCADA should display a driver error or a non-volatile alarm.
4. Security test. From a second TIA Portal installation, try to go online to the CPU. The connection must be refused or, if a read-only password is configured, granted only for read access. Full-access password must be required to download a new project.

9. Troubleshooting Matrix

10. Recommended Network Architecture

Place the SCADA server on a dedicated VLAN with stateful firewall rules that allow only the S7Comm (TCP 102), Modbus (TCP 502), or OPC UA (TCP 4840) ports inbound to the S7-1200 IP. Disable any outbound rule from the PLC to the SCADA network so the CPU cannot be used to pivot. Enable the S7-1200's built-in port statistics and log anomalies through SNMP or PROFINET diagnostics to a central syslog.

11. Firmware-Specific Behaviour Summary

12. Field-Proven Configuration Checklist

• [ ] Dedicated DB_SCADA_Interface with absolute addressable structure (or optimised for S7Plus).
• [ ] Every tag has Accessible from HMI = ON, Writable from HMI = OFF, Visible in HMI = ON.
• [ ] Put/Get enabled only when S7Comm is in use.
• [ ] CPU Full access password set and stored in the project password vault.
• [ ] Connection mechanisms > Only allow secure PG/PC and HMI communication enabled (TIA V17+).
• [ ] OPC UA server disabled if unused.
• [ ] SCADA user accounts locked to read-only role for this driver.
• [ ] FAT document includes a read test, a write-rejection test, and a screenshot of the diagnostic buffer showing the access error.