Connecting Siemens TDC to GE iFIX HMI/SCADA via SI7 Driver

Connecting Siemens SIMATIC TDC to GE iFIX HMI/SCADA via the SI7 Driver

1. Integration Overview

The SIMATIC TDC (Technology and Drives Controller) is a high-performance Siemens control platform typically applied to drive and process control duties. TDC controllers do not advertise a native iFIX/SCADA communication profile, so integrating them with GE iFIX requires the controller to expose itself as an S7-400-compatible station over Industrial Ethernet. Two integration paths are commonly used:

• SI7 native driver — the GE Vernova-supplied driver that is bundled with iFIX and that speaks S7 protocol directly to a TDC rack. This is the lowest-overhead path because iFIX talks to TDC without an intermediate OPC server.
• Siemens PMC OPC Server — Siemens order code 2XV9450-1WC44-0CA0. The server brokers S7 traffic between TDC and a client (iFIX OPC DA client, or iFIX PDB via OPC). Use it when iFIX must share the controller with other OPC clients or when SI7 is not licensed.

This article focuses on the SI7 driver path because it eliminates the OPC round-trip that frequently causes multi-second-to-minute poll times on 1024-byte blocks over Simatic Net OPC.

2. Prerequisites

2.1 Hardware

• SIMATIC TDC rack with a CPU module (typically CPU 555 or CPU 551) and an Ethernet CP module (e.g., CP 444, CP 443-1, or CPEB).
• Managed industrial Ethernet switch (SCALANCE-class or equivalent). Full duplex on every port; no blocking of TCP port 102.
• iFIX SCADA workstation with a fixed IP address on the same subnet. Multiple NICs are only useful if iFIX also serves other VLANs.

2.2 Software on the TDC engineering station

• SIMATIC Manager (STEP 7 V5.x) with the optional TDC add-on (CFC and S7 add-ons).
• SIMATIC NET PC software — used only to generate the XDB export and as a fallback path.
• S7 block library containing S7CON and DB_P system blocks.

2.3 Software on the iFIX PC

• GE iFIX with the SI7 driver license active in the iFIX License Manager.
• SIMATIC NET PC software installed on the iFIX PC. The SI7 driver does not speak TCP/102 by itself — it relies on Simatic Net's S7ONLINE access point and S7-1613 DLL. At minimum, install the S7 communication components.

2.4 Firmware and version compatibility

• TDC CPU 555 firmware V8.x or later is recommended; older firmware has known issues negotiating large S7 PDUs.
• Verify the iFIX build against the SI7 driver release notes. Mismatched Simatic Net versions on the iFIX PC are the most common cause of intermittent disconnects.

3. Reference Architecture

The connectivity model is a single S7 connection between the TDC and the iFIX PC, terminated at iFIX by Simatic Net's S7ONLINE access point and consumed by the iFIX SI7 driver.

Protocol on the wire is S7 communication over ISO-on-TCP (RFC 1006) on TCP port 102. TDC announces itself with S7-400-style addressing even though the physical rack is TDC hardware. From iFIX's perspective the TDC is just another S7 station.

4. Method A — Native SI7 Driver Configuration

4.1 Build the S7-visible image of the TDC

In a TDC project, S7 communication is not automatically exposed. To make DBs visible to iFIX, three components must be present:

1. An S7CON block instantiated in the TDC project that opens the S7 connection channel.
2. A DB_P block (per-instance data block) that holds the data iFIX must read or write.
3. A NetPro configuration that defines the partner as a PC Station so the XDB export target is well-formed.

4.2 Configure the S7CON block

Place an S7CON block in the CFC editor (or as an S7 block call in a TDC chart). The relevant parameters are:

After compiling, download the TDC program and verify in the online view that connection ID=1 is in ESTABLISHED state.

4.3 Generate the S7-accessible DB_P block

The DB_P (“DB permanent”) block in TDC is a per-instance data block that survives a warm restart and lives in load memory. To make the DB addressable over S7:

1. Declare the data structure in the TDC symbol table or DB source.
2. Place a DB_P block in the CFC and connect the data points you want to publish.
3. Use S7-conformant data types only: BOOL, INT, REAL, BYTE, WORD, DWORD, STRING. UDTs and arrays of UDTs may not be fully understood by the SI7 driver; prefer flat structures.
4. Note the resulting DB number — SI7 will reference it as DB<n>,REAL<offset>, DB<n>,BOOL<offset>, etc.

Recommended source pattern:

DB_P "iFIX_INTERFACE"
   STRUCT
     Tag_001_INT  : INT  := 0;
     Tag_002_REAL : REAL := 0.0;
     Tag_003_BOOL : BOOL := FALSE;
     ...
   END_STRUCT
END_DB

Compile and download. The DB must be visible in the TDC online block view as DB <n> for SI7 to see it.

4.4 NetPro configuration and XDB export

This is the step most engineers miss. The TDC project must contain a partner PC Station for the iFIX PC, and the project must be exported to an XDB file. The XDB is imported into Simatic Net on the iFIX PC; Simatic Net uses it to bind the S7 connection name to the S7ONLINE access point the SI7 driver consumes.

1. Open NetPro for the TDC project.
2. Add a partner station: Insert → Station → PC Station. Set its name to match the Windows host name of the iFIX PC (or its Simatic Net station name).
3. On the TDC CPU, add a new S7 connection targeted at this PC Station. Connection type: S7 connection. Connection partner: the PC Station just created.
4. Assign the local connection ID (e.g., 1). The remote access point must be S7ONLINE.
5. Save and compile. NetPro reports the configured connection.
6. Export to XDB: right-click the TDC project → Export → XDB to disk or directly to the iFIX PC.

4.5 iFIX SI7 driver SCU configuration

On the iFIX PC:

1. Install Simatic Net PC software and verify the S7ONLINE access point is configured.
2. Import the XDB into Simatic Net (Start → Simatic Net → Commissioning Wizard). The wizard creates a logical connection named after the one defined in NetPro and binds it to S7ONLINE.
3. Open the iFIX SCU (System Configuration Utility). Add a new SCADA server. Under Drivers, ensure SIM (SI7) is listed with status Started.
4. Configure the SI7 channel:
   • Channel Name: TDC_CPU1
   • Primary Address: TDC CP IPv4 address.
   • Connection Name: the Simatic Net connection name imported from the XDB (e.g., S7CONN_1).
5. Under the SI7 Device:
   • Protocol: S7-400 (use this even for TDC; TDC responds as S7-400).
   • Rack: 0 (typical TDC CPU logical rack — verify in the TDC hardware configuration).
   • Slot: 2 (typical CPU slot in TDC; wrong slot is the single most common reason tags fail to read).
   • Poll Time (ms): 500–1000 ms typical; lower only if network latency is low and DB size is small.

Map PDB tags to the driver fields:

For array reads of large buffers, set RAW_VALUE_TYPE = X (raw bytes) and ADDRESS = DB101,X0.1024. This maps the entire block into a single PDB tag, pushes a single S7 read PDU, and is the fastest path for large DBs.

5. Method B — PMC OPC Server Fallback

If SI7 is not licensed or iFIX must share data with other SCADA clients, the Siemens PMC OPC Server (2XV9450-1WC44-0CA0) is the supported fallback.

5.1 Server installation

Install the PMC OPC Server on a Windows node that has Simatic Net and read access to the same XDB used for the SI7 path. License the server with the supplied Siemens license key.

5.2 Add the TDC station

1. Create a new S7 station. Point it at the XDB (preferred) or directly at the TDC CP's IP.
2. Specify rack 0, slot 2 for the TDC CPU.
3. Enable block-oriented subscription mode. Without it the server defaults to per-item reads and performance collapses on multi-field DBs.

5.3 iFIX OPC client configuration

In iFIX, choose the OPC power tool instead of the SI7 driver. Add an OPC DA connection to the PMC server, browse the tags by DB number, and subscribe at a poll interval appropriate to the data. Avoid mapping a 1024-byte block to a single OPC tag polled faster than 1 Hz; OPC DA servers typically cannot sustain this at the default subscription rate and will buffer, producing multi-second-to-minute scan times that have been observed in field deployments.

6. Performance Tuning for Large Data Blocks

A 50-second update time on a 1024-byte DB is a typical symptom of an OPC pipeline that has not been configured for block reads. Common causes and mitigations follow.

6.1 Root-cause matrix

6.2 DB segmentation

A 1024-byte DB is large but not extreme. If a single block read still exceeds the required scan time:

1. Split the data into multiple smaller DBs (e.g., four DBs of 256 bytes each).
2. Subscribe via four block reads instead of one.
3. iFIX assembles the values; from the operator's perspective the data still appears as one logical group.

Each S7 read PDU is bounded by MIN(MAX_PDU_LENGTH, MAX_PDU_LENGTH_TDC). Two or three smaller DBs typically round-trip faster than one large DB because TCP sends them in parallel and the S7 channel can pipeline them.

6.3 SI7 driver tuning parameters

Verify the parameter names against the installed driver version; field names can differ between iFIX releases.

6.4 iFIX PDB scan groups

1. Place fast tags (≤500 ms) in scan groups A–H assigned 500 ms.
2. Place normal tags in scan groups at 1000 ms.
3. Place slow-control and status tags at 2000–5000 ms.
4. Avoid placing a 1024-byte block tag on a 250 ms scan; even 500 ms is sufficient for operator HMI purposes.

6.5 Network considerations

• Confirm full duplex on every switch port along the path. Half duplex is the single most common cause of intermittent 5–30 second stalls on S7 over Ethernet.
• Disable flow-control or storm-control on the S7 path if those have been imposed for other VLANs.
• Do not route through firewalls that perform deep packet inspection on TCP/102. S7 is sensitive to MTU and fragmentation.

7. Verification and Diagnostics

After configuration, validate the link with the following checks:

1. Driver online status — in the iFIX System Configuration Utility, the SI7 channel and device should show Started/OK. Verify Communication Active: Yes.
2. Single-tag test — in the iFIX Database Manager, right-click any mapped tag and use Force/Test Value to confirm the read path round-trips.
3. Block test — in the SI7 driver diagnostic (or via Simatic Net diagnostic), force a DB<X>,X0..N read and confirm the response time.
4. Throughput benchmark — record the average and worst-case scan time over 10 minutes with all tags subscribed. Re-tune if average exceeds 1 s or worst case exceeds 3 s.
5. S7 view from TDC — open the connection diagnostics on the TDC online view; OP_count should increment at the configured poll rate. Lost connections should remain 0.
6. OPC view (Method B) — use an OPC test client to confirm the PMC server returns the same data with latency <1 s; delay here implicates Simatic Net, not iFIX.

8. Troubleshooting Matrix

9. Field Notes and Caveats

• The Dummy PC Station workaround in NetPro is intentional. TDC does not need a real PC Station on the engineering station; it only needs a named connection target so the XDB can be generated. Remove the dummy after the XDB is exported if it confuses tool validation.
• TDC DB_P blocks retain data across warm restarts but require a download or INIT after first creation. If iFIX reads garbage on the first poll after a download, force a one-shot DB_P initialization on the TDC side.
• SI7 polls are best-effort and are not safety-rated. If the iFIX HMI displays TDC status, treat any “no communication” alarm as informational, not as a safety interlock. Use the TDC's internal safety mechanisms for that.
• TDC firmware changes affect S7 PDU negotiation. After any TDC firmware update, re-run the verification suite in section 7; maximum PDU length can drop without a visible alarm.

For additional product background on the SCADA side, see GE Vernova iFIX SCADA. For cyber-security context applicable to iFIX deployments, see CISA ICSA-23-073-03.

FAQ