Connecting STEP7 to LabVIEW: Serial, MPI, and Ethernet Methods

Overview

STEP7 (the SIMATIC programming environment for S7-300/400 and the predecessor of TIA Portal for S7-1200/1500) and National Instruments LabVIEW are two of the most widely deployed software packages in industrial laboratories, test stands, and production cells. Engineers routinely need a bi-directional data path between a Siemens PLC and a LabVIEW Virtual Instrument (VI) for data acquisition, closed-loop test, or supervisory SCADA-style visualization. This reference documents the four physical layers that are stable, supported, and field-proven:

• Native TCP/IP Ethernet using the S7 communication protocol (S7-300/400/1200/1500)
• MPI / PROFIBUS for legacy S7-300/400 hardware
• Point-to-point serial links (RS-232 / RS-485) via SIMATIC CP modules
• OPC / OPC UA bridging through NI OPC Server or third-party servers

Each path is covered with hardware part numbers, STEP7/TIA Portal block names, LabVIEW VIs, and the diagnostics required to confirm a working duplex channel. The target audience is an automation engineer who is comfortable in both environments and needs a deterministic, documented handshake rather than a generic "it works" connection.

Communication Architecture

The following table summarizes the four supported paths, the SIMATIC hardware required, the typical maximum cyclic payload, and the recommended use case. Select the row that matches your PLC family and physical layer availability.

Prerequisites

Before commissioning, confirm the following components are present and licensed:

1. Siemens SIMATIC PLC (S7-200 / S7-300 / S7-400 / S7-1200 / S7-1500) with the corresponding STEP7 or TIA Portal project.
2. For S7-300/400: STEP7 V5.5 + SP4 (or later) with the S7 Communication blocks (FB 8 / FB 9 / FB 12 / FB 13 / FB 14 / FB 15) in the Standard Library → Communication Blocks catalog.
3. For S7-1200/1500: TIA Portal V15.1 (or later) with the PUT/GET instructions enabled in the CPU Properties → Protection & Security area.
4. LabVIEW 2018 (32-bit) or later, installed on a Windows PC with a free Ethernet port and administrator rights.
5. An S7 communication driver for LabVIEW. National Instruments publishes the "S7 PLC Driver for LabVIEW" (NI part number 784314-01) for S7-200/300/400/1200/1500; the open-source Libnodave library is also commonly wrapped in a LabVIEW Call Library Node. Third-party drivers such as ibh NetLink (ibhsoftec) are valid for MPI and TCP/IP.
6. For OPC bridging: NI OPC Server 2016 or later, plus the LabVIEW Datalogging & Supervisory Control (DSC) module or the Variable Engine API.
7. Network connectivity verified with ping from the LabVIEW PC to the PLC IP address. The PLC must be reachable on TCP/UDP port 102 (S7) or the port configured for the OPC server.

Path 1: TCP/IP Ethernet (S7 Protocol) — Recommended

This is the lowest-latency, most flexible path and is supported on every current-generation Siemens PLC. The LabVIEW PC communicates directly with the PLC over TCP/IP using the S7 communication protocol, with no extra gateway hardware.

STEP7 / TIA Portal Side

1. Configure the PLC's IP address in the device configuration. Default subnet mask 255.255.255.0 is acceptable. Example: PLC IP 192.168.0.10, PC IP 192.168.0.20.
2. Open the CPU Properties → Protection & Security tab and ensure PUT/GET is permitted (S7-1200/1500).
3. For S7-300/400 with CP 343-1 or CP 443-1, create an S7 connection in NetPro with the local endpoint set to the CP and the partner IP set to the LabVIEW PC. The connection type S7 connection with active partner = false (LabVIEW acts as the active partner) is correct.
4. Define a data block, e.g. DB100, containing the tags to be exchanged. Example declaration:

   DATA_BLOCK DB100
   STRUCT
     iValue1   : INT;     // 16-bit input from LabVIEW
     iValue2   : INT;     // 16-bit output to LabVIEW
     rSetpoint : REAL;    // 32-bit float
     bFlag     : BOOL;    // 1-bit status
     sString   : STRING[20];
   END_STRUCT;
   END_DATA_BLOCK

5. No PLC-side program is required to expose DB100; the S7 driver reads and writes the data block memory directly. Optional: insert FB 12 (BSEND) / FB 13 (BRCV) for handshake-controlled transfer if the application requires acknowledged delivery.

LabVIEW Side

1. Install the NI S7 driver or import the Libnodave wrapper. The driver exposes VIs such as S7 Open Connection.vi, S7 Read DB.vi, and S7 Write DB.vi.
2. On the block diagram, place S7 Open Connection.vi with the following wired inputs:
   • PLC IP address: 192.168.0.10
   • Rack / Slot: 0 / 1 for S7-300/400, 0 / 1 for S7-1200/1500 (slot 1 = CPU)
   • Connection type: TCP/IP for S7-1200/1500, ISO-on-TCP (RFC1006) for S7-300/400 with CP
3. To read DB100.DBD8 (the REAL rSetpoint), call S7 Read DB.vi with DB number 100, byte offset 8, length 4 (bytes), and datatype Float Single.
4. To write back, call S7 Write DB.vi with the same DB, offset 0, length 2, datatype I16.
5. Wrap the read/write pair in a While Loop with a 50 ms Wait (ms) for a 20 Hz scan. A producer-consumer architecture is preferred for high-throughput or multi-channel use.

UDP Variant (Lightweight)

For non-critical, broadcast-style traffic, the S7-1200 supports the TSEND_C / TRCV_C instruction pair on UDP. From the TIA Portal, place TSEND_C in OB1 with connection ID 1, configured for UDP, and target IP = LabVIEW PC. In LabVIEW, open a UDP socket on the same port and use UDP Read / UDP Write VIs. This bypasses the S7 driver and is useful when the S7 driver is unavailable, but provides no delivery acknowledgement and no application-layer error code beyond the UDP socket status.

Path 2: MPI / PROFIBUS (Legacy S7-300/400)

Many installed S7-300/400 systems only expose MPI (RS-485 physical layer, 187.5 kbit/s default) and have no Ethernet CP. In that case the LabVIEW PC needs a PROFIBUS / MPI adapter.

1. Install a Siemens CP 5611 (PCI) or CP 5612 (PCIe) card in the LabVIEW PC, or use a USB-to-MPI adapter (e.g., ibh NetLink S7-USB, part number 9351-)
2. Install the SIMATIC NET PC software that ships with the CP. The software installs the SAPI-S7 interface, which is consumed by the LabVIEW driver.
3. Set the MPI address of the PC card to a unique value (default 0) and the PLC MPI address (default 2) must be different. Verify in STEP7 → Hardware → CPU Properties → MPI Interface.
4. Use the same DB100 layout described above. The S7 driver transparently carries the S7 protocol over MPI; no PLC program changes are required beyond ensuring the DB is not optimized (set Non-Optimized Block Access in DB Properties → Attributes for S7-1200/1500 compatibility).
5. Bus termination must be enabled at both ends of the PROFIBUS segment using the 9-pin D-sub termination switch or a PROFIBUS connector with built-in terminator (e.g., 6ES7972-0BA12-0XA0).

Path 3: Serial CP Modules (RS-232 / RS-485)

When the application requires a direct cable link to a serial instrument, or when the PLC has no Ethernet port and MPI is already saturated, the SIMATIC CP 340 / CP 341 / CP 441-1 / CP 441-2 modules provide asynchronous serial communication.

Typical configuration procedure:

1. Add the CP to the S7-300 rack in STEP7 Hardware Configuration and assign the MPI/PROFIBUS address.
2. Open the CP configuration and select the protocol (ASCII 3964R), baud rate, parity, and frame format. For 8N1 at 19200 baud, set character delay to 4 ms.
3. Call FB 8 / FB 7 from OB1 with the LADDR pointer from the CP configuration. Example for CP 341 with LADDR = 256 (decimal):

   CALL FB 8, DB30
     REQ   := M10.0
     R     := M10.1
     LADDR := 256
     DB_NO := 100     // Source DB
     DBB_NO := 0      // Byte offset
     LEN   := 20      // Send 20 bytes
     DONE  := M11.0
     ERROR := M11.1
     STATUS:= MW12

4. In LabVIEW, configure the PC COM port at the same baud, parity, and frame. Use VISA Configure Serial Port followed by VISA Read / Visa Write for transparent ASCII, or wrap the Libnodave serial engine for 3964R.

Path 4: NI OPC Server Bridge

When multiple clients must read the same PLC data, or when the engineer wants tag-browsing capability inside LabVIEW, an OPC server is the cleanest abstraction. National Instruments' OPC Server 2016 (or later) speaks S7 natively and exposes the PLC tags as OPC DA 2.05 / 3.0 / OPC UA nodes.

1. Install NI OPC Server 2016 (or current) and launch the Configuration console.
2. Add a new S7 channel; set the device driver to "S7 MPI/TCP" and enter the PLC IP address (TCP) or local MPI node (MPI).
3. Add a device, scan the PLC, and select the DBs and tags to expose. The server auto-generates OPC tag addresses, e.g. DB100.DBD8,REAL for rSetpoint.
4. Open NI OPC Servers' Quick Client and verify the tags are updating in real time. This is the single best step to isolate whether a problem is the S7 link or the LabVIEW client.
5. In LabVIEW, use the Variable API (DSC module) or the DataSocket Read/Write VIs with the URL opc:\machine1\S7-1500\DB100.DBD8. Bind the variable to a front-panel indicator or control to enable HMI-style binding.

Step-by-Step Commissioning: S7-1500 ↔ LabVIEW over TCP/IP

The following 12-step procedure is the canonical commissioning path for a green-field S7-1500 to LabVIEW link.

1. In TIA Portal, open the S7-1500 project and assign the PROFINET interface IP 192.168.0.10/24 with the PROFINET device name plc1500.
2. Open the CPU Properties → Protection & Security → Connection mechanisms. Tick Permit access with PUT/GET communication from remote partner. Compile and download the project to the PLC.
3. Create a new global DB, e.g. DB100 "LabIO", with the following non-optimized layout:

     iCmd     : INT;     // command from LabVIEW
     iStatus  : INT;     // status to LabVIEW
     rSetP    : REAL;    // setpoint from LabVIEW
     rProcV   : REAL;    // process variable to LabVIEW
     bStart   : BOOL;    // start flag
     bStop    : BOOL;    // stop flag
     bAck     : BOOL;    // handshake from PLC

4. Download the hardware and software to the PLC. Put the CPU in RUN.
5. From the LabVIEW PC, open a command prompt and execute ping 192.168.0.10. Confirm reply time < 5 ms.
6. Open the NI S7 driver example project. Confirm Open Connection.vi returns error code 0 (no error).
7. Wire a numeric indicator to S7 Read DB.vi with DB=100, byte offset=2, length=2, datatype=I16. Verify iStatus is visible.
8. Wire a numeric control to S7 Write DB.vi with DB=100, byte offset=0, length=2, datatype=I16. Enter a value, click write, and read the value back from iCmd on a second indicator to confirm round-trip.
9. Add the REAL read/write for rSetP and rProcV at offset 4 and 8 respectively.
10. Add a Boolean toggle for bStart at offset 12.0 and verify in TIA Portal by adding a watch table on DB100.DBX12.0.
11. Wrap the block diagram in a state machine with states: INIT → CONNECT → READ → WRITE → IDLE. Use an event structure for front-panel button presses.
12. Build the VI into an executable. Run the executable on a separate PC to confirm that the path is not dependent on the development environment.

Duplex Data Exchange Pattern

Duplex (full-duplex) means the LabVIEW VI can read and write at the same time, and the PLC can both publish and consume data. The S7 protocol is inherently request/response; the master (LabVIEW) polls, the slave (PLC) responds. To implement duplex:

• Use a handshake tag pair in DB100: bLabVIEW_Trigger (set by LabVIEW when new write data is ready) and bPLC_Ack (set by PLC after it has consumed the data). The PLC program resets the trigger after acknowledging.
• Maintain a sequence counter in DB100 (UINT) that increments on every successful exchange. LabVIEW compares the counter to the previous read to detect lost or duplicated packets.
• Use the driver error code as a watchdog. If two consecutive reads fail, stop the test or raise a fault in the PLC via a dedicated tag.

// PLC ladder example (S7-1200/1500) - Acknowledge LabVIEW write
A     "LabIO".bLabVIEW_Trigger  // trigger from LabVIEW
AN    "LabIO".bPLC_Ack          // not yet acknowledged
S     "LabIO".bPLC_Ack          // set ack
// In next cycle:
A     "LabIO".bPLC_Ack
R     "LabIO".bLabVIEW_Trigger  // reset trigger
R     "LabIO".bPLC_Ack

Verification and Diagnostics

Verification confirms the link is operational, accurate, and stable. Use the following checklist:

1. Layer 1 – Link: PLC Link LED green; PC shows Ethernet link 100/1000 Mbit/s full-duplex.
2. Layer 2 – Network: ping round-trip < 5 ms on LAN, < 50 ms on plant-wide VLAN.
3. Layer 3 – Protocol: Driver Open Connection returns 0. First read returns 0 (or last good value if the DB is pre-initialized).
4. Layer 4 – Application: Write a known pattern (e.g., 0xDEADBEEF) into a test DB and read it back from LabVIEW. Confirm the value matches exactly.
5. Layer 5 – Timing: Use a 1000-sample timing test. Maximum jitter should be < 5 ms on TCP/IP, < 20 ms on MPI.
6. Stability: Run the VI for 24 hours with logging. Confirm zero driver errors and stable memory usage in the LabVIEW process.

Troubleshooting Matrix

Performance Tuning

When scaling above 100 tags or above 50 Hz, the following optimizations apply:

• Batch reads: Combine adjacent tags into a single read of 240 bytes (CP 343-1 maximum per call). The S7 driver internally splits this into chunks but the application code stays simple.
• Asynchronous polling: Use the driver's async API to issue multiple reads in parallel. LabVIEW should keep one read outstanding while processing the previous response.
• Reduce DB scans: If the application only needs change-of-state, enable the driver's dead-band filter and only write when the value changes by more than 0.5 %.
• Network segmentation: Put the LabVIEW PC and the PLC on a dedicated VLAN with no other traffic. A single broadcast storm on a shared VLAN can stall S7 communication for seconds.
• Adjust CPU cycle time: On the S7-1500, the OB1 priority can be raised and the cycle time set to a fixed value (e.g., 2 ms) for deterministic response. Avoid OB1 cycle times below 1 ms unless the application specifically requires it; the S7 communication processor (CP) may not be able to keep up.

Security and Plant-Network Considerations

Plant IT increasingly requires the S7 link to coexist with firewalls, intrusion detection, and least-privilege accounts. Engineering recommendations:

• Place the LabVIEW PC in a DMZ or industrial DMZ. The firewall should allow only TCP/102 between the LabVIEW PC and the PLC subnet.
• Disable unused services on the PLC: in TIA Portal → CPU Properties → Protection & Security, uncheck Permit access with Web server, Permit access with OPC UA, and Permit PUT/GET if not required by another client.
• Enable the SIMATIC Security Configuration. The S7-1500 supports signed firmware and signed communication. Use TLS-wrapped S7CommPlus (port 102, "Secure S7 Communication") when the LabVIEW driver supports it.
• Use a dedicated service account for the NI OPC Server and LabVIEW executable. Restrict the account to log on locally only.
• Document the data flow in the network diagram. The IT security auditor will ask for the S7 protocol, port, and direction.

References to Official Documentation

The following Siemens and National Instruments manuals are the primary reference set for this document. They are the authoritative source for the parameter values, error codes, and configuration procedures cited above.

• Siemens "S7-1500 Communication" Function Manual, edition 11/2023, article ID 109756202. Covers PUT/GET, TSEND/TRCV, and secure S7 communication.
• Siemens "S7-300/400 Communication with SIMATIC NET" manual, entry ID 20982954. Details on CP 343-1, CP 443-1, FB 8/FB 9/FB 12/FB 13/FB 14/FB 15.
• Siemens "CP 340 / CP 341" manual, entry ID 1117397. ASCII and 3964R parameter set, diagnostic buffer interpretation.
• Siemens "CP 441-1 / CP 441-2" manual, entry ID 1117417. Modbus RTU loadable driver configuration and RK512 framing.
• Siemens "S7-1200 Programmable Controller" System Manual, edition 09/2023, entry ID 109751651. PUT/GET enable, TSEND/TRCV, security levels.
• National Instruments "S7 PLC Driver for LabVIEW" Readme, NI part number 784314-01. Supported PLC families, function-block reference, error codes.
• National Instruments "NI OPC Servers 2016 User Manual". Channel configuration, tag import, UA certificate handling.