PRODAVE S7 Toolbox: MPI Communication Reference for S7-300/400

1. Overview of PRODAVE S7 and Siemens MPI

PRODAVE S7 is the Siemens toolbox that supplies a Dynamic Link Library (DLL) and static LIB interface for establishing data links between PCs / programming devices (PGs) and SIMATIC S7 PLCs over the proprietary Siemens Multi-Point Interface (MPI). The library exposes read and write access to PLC process data without requiring detailed knowledge of the underlying MPI frame handling, which lets developers concentrate on data processing rather than low-level bus mechanics.

Siemens MPI is a proprietary industrial networking protocol carried on an RS-485 physical layer at 187.5 kbit/s or 1.5 Mbit/s. It is used for programming, HMI, and peer-to-peer traffic between SIMATIC S7 CPUs, programming devices (PG 7xx), and operator panels sharing a common bus segment. PRODAVE wraps the MPI frame exchange and presents it as callable C / Pascal / Delphi / VB function calls.

The library supports MS-DOS, Windows 3.11, Windows 95, Windows 98, and Windows NT. The Windows NT/95 release ships as a 32-bit DLL compiled with Microsoft Visual C++ 5.0; the Windows 3.11 release is a 16-bit DLL compiled with Borland C++ 3.1. MS-DOS adaptors are delivered as MSC and Borland C large-model libraries. The PRODAVE functions divide into three groups:

• Basic Functions — initialize/deinitialize the system (load_tool, unload_tool) and activate connections (new_ss).
• S7-300/400 Data Transfer — process image, bit memory (flags), data blocks, timers, counters, and mixed access.
• S7-200 Data Transfer — variable memory (V), special markers (SM), bit memory (M), process image, timers, and counters.

PRODAVE S7 is no longer the recommended path on modern systems; current Siemens-supported alternatives include the S7-communication / S7-Plus OPC UA server (e.g. SIMATIC S7-1500 / ET 200 CPUs) and the LibNoDave open-source library. The historical PRODAVE API is documented here because existing plant code, especially in VB 6, Delphi 7, and BC++ 3.1 applications, still depends on it.

2. Hardware and Software Prerequisites

On modern Windows 10 / 11 installations, the legacy COM PC/MPI cable requires a virtual COM port driver and a virtualized 16-bit / 32-bit execution environment. CP 5611 / CP 5613 PCIe cards require the SIMATIC NET PC software stack (which is the modern successor to the STEP 7 bundled MPI drivers). For new development, prefer LibNoDave or the SIMATIC S7-PLCSIM / OPC UA path instead of PRODAVE.

3. Connection Parameter Reference

Every PRODAVE session begins with load_tool(). The connection is described by a device name (e.g. S7ONLINE) and a 5-byte address table. The address table layout is fixed across the C, Delphi, and Pascal adaptors:

A second identifier used by some functions is the device string, passed as a null-terminated PChar. The default value S7ONLINE selects the MPI driver. Other drivers (e.g. TCPIP for S7 communication over Ethernet) were added in later PRODAVE versions, but the original 1.x / 2.x toolbox only supported MPI and the proprietary PPI / AS511 paths for S7-200.

4. Core API Functions

4.1 Basic Functions

4.2 PLC Status

5. Data Transfer Functions — S7-300 / S7-400

All access functions follow the same pattern: a starting index, an amount, and a buffer pointer. The buffer is interpreted in STEP 5 byte order (high byte first) unless the helper functions Swap() / ReadInt() are applied.

For d_field_read / d_field_write / db_read / db_write, dwno is the data-word offset (0-based). If anzahl exceeds the DB size the function silently trims it and returns the PRODAVE warning code 0x0303 (data length truncated). On DB-not-found the function returns a negative error code without modifying anzahl.

6. Data Transfer Functions — S7-200

S7-200 is supported through the as200_* family of functions. Memory map differences vs S7-300 are reflected in the symbol prefixes (V = variable memory, SM = special markers, M = bit memory).

7. Byte Order Handling — STEP 5 vs Intel

SIMATIC stores 16-bit values in STEP 5 notation: the high byte first, then the low byte. Intel (x86) processors store the low byte first. The functions below swap the two bytes for INT, DINT, and REAL data exchange:

The implementation pattern (Delphi 32-bit, Pascal) is:

function ReadInt(Word_: Word): Integer;
begin
  if Swap(Word_) < 32767 then
    Result := Swap(Word_)
  else
    Result := Swap(Word_) - 65536;  // sign-correct for INT range -32768..32767
end;

procedure WriteInt(IntNr: Integer; var Word_: Word);
begin
  Word_ := Swap(IntNr);
end;

8. Error Code Reference

Every PRODAVE function returns 0 on success and a hexadecimal error code on failure. The Error_Message() helper translates the codes below:

9. Delphi 32-bit Integration Example

The Delphi wrapper imports w95_s7.dll via the stdcall calling convention and uses Swap() for byte-order conversion. The unit shown below reproduces the canonical S7_DLL.PAS interface used in the field:

unit S7_DLL;
interface
uses SysUtils, Dialogs;

function Connect(no:Byte; name:PChar; adr:PChar):Integer; stdcall;
  external 'w95_s7.dll' name 'load_tool';

function DB_read(dbno:Integer; dwno:Integer; var amount:Integer;
  var buffer):Integer; stdcall;
  external 'w95_s7.dll' name 'db_read';

function DB_Write(dbno:Integer; dwno:Integer; var amount:Integer;
  var buffer):Integer; stdcall;
  external 'w95_s7.dll' name 'db_write';

function PLC_Status(var buffer):Integer; stdcall;
  external 'w95_s7.dll' name 'ag_zustand';

function Error_Message(Res:Integer):STRING;
function Disconnect:Integer; stdcall;
  external 'w95_s7.dll' name 'unload_tool';

function ReadInt(Word_: Word):Integer;
procedure WriteInt(IntNr:Integer; var Word_: Word);
function ReadDInt(Low_Word: Word; High_Word: Word):Longint;
procedure WriteDInt(LongNr:Longint; var Low_Word: Word;
  var High_Word: Word);
function ReadReal(Low_Word: Word; High_Word: Word):Single;
procedure WriteReal(FloatNr:Single; var Low_Word: Word;
  var High_Word: Word);

implementation

function Error_Message(Res:Integer):STRING;
begin
  if Res <> 0 then
  begin
    Result := 'ERROR: ' + Format('%x',[Res]);
    case Res of
      $00CA: Result := Result + ' No resources available';
      $00CB: Result := Result + ' Configuration error';
      $00CD: Result := Result + ' Illegal call';
      $00CE: Result := Result + ' Module not found';
      $00CF: Result := Result + ' Driver not loaded';
      $00D0: Result := Result + ' Hardware fault';
      $00D1: Result := Result + ' Software fault';
      $00D2: Result := Result + ' Memory fault';
      $00D7: Result := Result + ' No message';
      $00D8: Result := Result + ' Storage fault';
      $00DB: Result := Result + ' Internal timeout';
      $00E1: Result := Result + ' Too many channels open';
      $00E2: Result := Result + ' Internal fault';
      $00E7: Result := Result + ' Hardware fault';
      $00E9: Result := Result + ' Sin_serv.exe not started';
      $00EA: Result := Result + ' Protected';
      $00F0: Result := Result + ' Scp db file does not exist';
      $00F1: Result := Result + ' No global dos storage available';
      $00F2: Result := Result + ' Error during transmission';
      $00F3: Result := Result + ' Error during reception';
      $00F4: Result := Result + ' Device does not exist';
      $00F5: Result := Result + ' Incorrect sub system';
      $00F6: Result := Result + ' Unknown code';
      $00F7: Result := Result + ' Buffer too small';
      $00F8: Result := Result + ' Buffer too small';
      $00F9: Result := Result + ' Incorrect protocol';
      $00FB: Result := Result + ' Reception error';
      $00FC: Result := Result + ' Licence error';
      $0101: Result := Result + ' Connection not established / parameterised';
      $010A: Result := Result + ' Negative acknowledgement received / timeout error';
      $010C: Result := Result + ' Data does not exist or disabled';
      $012A: Result := Result + ' System storage no longer available';
      $012E: Result := Result + ' Incorrect parameter';
      $0132: Result := Result + ' No memory in DPRAM';
      $0201: Result := Result + ' Incorrect interface specified';
      $0202: Result := Result + ' Maximum amount of interfaces exceeded';
      $0203: Result := Result + ' PRODAVE already initialised';
      $0204: Result := Result + ' Wrong parameter';
    end;
    ShowMessage(Result);
  end;
end;

function ReadInt(Word_: Word):Integer;
begin
  if Swap(Word_) < 32767 then
    Result := Swap(Word_)
  else
    Result := Swap(Word_) - 65536;
end;

procedure WriteInt(IntNr:Integer; var Word_: Word);
begin
  Word_ := Swap(IntNr);
end;

function ReadDInt(Low_Word: Word; High_Word: Word):Longint;
var Rec: array[0..1] of Word;
begin
  try
    Rec[0] := Swap(High_Word);
    Rec[1] := Swap(Low_Word);
    Move(Rec, Result, SizeOf(Result));
  except
    Result := 0;
  end;
end;

procedure WriteDInt(LongNr:Longint; var Low_Word: Word; var High_Word: Word);
var Rec: array[0..1] of Word;
begin
  try
    Move(LongNr, Rec, SizeOf(LongNr));
    Low_Word := Swap(Rec[1]);
    High_Word := Swap(Rec[0]);
  except
    Low_Word := 0;
    High_Word := 0;
  end;
end;

function ReadReal(Low_Word: Word; High_Word: Word):Single;
var Rec: array[0..1] of Word;
begin
  try
    Rec[0] := Swap(High_Word);
    Rec[1] := Swap(Low_Word);
    Move(Rec, Result, SizeOf(Result));
  except
    Result := 0;
  end;
end;

procedure WriteReal(FloatNr:Single; var Low_Word: Word; var High_Word: Word);
var Rec: array[0..1] of Word;
begin
  try
    Move(FloatNr, Rec, SizeOf(FloatNr));
    Low_Word := Swap(Rec[1]);
    High_Word := Swap(Rec[0]);
  except
    Low_Word := 0;
    High_Word := 0;
  end;
end;
end.

10. C Adapter Reference Call-Sequence

A minimal C program that opens a connection, reads 32 words from DB 10, prints the result, and closes:

#include <stdio.h>
extern int load_tool(int, char*, char*);
extern int unload_tool(void);
extern int db_read(int, int, int*, void*);
extern int ag_zustand(void*);

int main(void)
{
  unsigned char adr[5] = { 2, 0, 2, 0, 0 };
  unsigned short buffer[64];
  int amount = 32;
  int rc;
  unsigned char plc_state;

  rc = load_tool(1, "S7ONLINE", (char*)adr);
  if (rc != 0) { printf("load_tool error 0x%04X\n", rc); return 1; }

  rc = ag_zustand(&plc_state);
  if (rc != 0) { printf("ag_zustand error 0x%04X\n", rc); return 1; }
  printf("PLC state = %d\n", plc_state);

  rc = db_read(10, 0, &amount, buffer);
  if (rc != 0 && rc != 0x0303) {
    printf("db_read error 0x%04X\n", rc);
    return 1;
  }

  for (int i = 0; i < amount; i++)
    printf("DB10.DBW%d = 0x%04X (%d)\n", i*2, buffer[i], buffer[i]);

  unload_tool();
  return 0;
}

11. Visual Basic 6 / VB.NET Migration Notes

When STEP 7 is installed, two relevant DLLs are registered:

• komfort.dll — high-level wrapper exposing read/write of DB, M, I, Q areas with property-style access; recommended for VB 6.
• w95_s7m.dll — additional MPI-direct functions for advanced uses (e.g. db_read, db_write); same calling convention as the C adaptor.

For VB 6: declare the functions with Declare Function ... Lib "komfort.dll" (Alias "db_read") and call them through the API. For VB.NET: PRODAVE is not directly callable across the managed/native boundary without a P/Invoke wrapper; instead, install an OPC server (e.g. the SIMATIC NET OPC server, the Softing S7-OPC server, or the open-source Sharp7 / libnodave bridge) and consume OPC DA 2.0 / 3.0 from .NET. The legacy PRODAVE path is preserved only for VB 6 maintenance scenarios.

12. Session Lifecycle — State Diagram

13. Troubleshooting Matrix

14. Migration to Modern Siemens Paths

The recommended replacement for PRODAVE depends on the target system:

15. Notes on Field-Proven Caveats

1. Always call unload_tool in a finally / __finally block. If the application exits via an unhandled exception without unloading, subsequent load_tool calls return 0x0203 until the PC is rebooted or the sin_serv.exe service is restarted.
2. Do not mix komfort.dll and w95_s7.dll in the same process without coordination. Both bind the S7ONLINE device, and concurrent use leads to 0x00D2 memory faults.
3. Bus scan order matters: with multiple CPUs, address them by their actual MPI addresses (set in STEP 7 hardware configuration). new_ss() re-activates the connection but does not change routing.
4. For S7-200, always set the PPI/MPI mode switch on the CPU before scanning. PRODAVE does not auto-detect PPI vs MPI; it always speaks MPI.
5. STEP 5 byte order on multi-word values: a 32-bit DINT is stored as word 0 = high word, word 1 = low word. Skipping the high/low swap yields values that are off by a factor of 65 536.
6. REAL byte order inside a 32-bit word: the helper uses Move() after Swap(), which assumes a little-endian host. On big-endian platforms the helper must be inverted.

16. Quick-Start Checklist

1. Install STEP 7 V5.x or SIMATIC NET on the engineering PC; confirm the S7ONLINE access point exists.
2. Connect the CP 5611 / CP 5613 / PC-MPI cable; verify termination (220 Ω at both ends of the bus).
3. Run "Set PG/PC Interface" → select the CP / cable → test connection with "Accessible Nodes".
4. In the application, populate plc_adr_table with the PLC's MPI address (default 2), slot 2, rack 0.
5. Call load_tool(1, "S7ONLINE", adr_table); check return = 0.
6. Read/write using db_read / db_write or the byte-area functions, applying Swap() on every word.
7. Always call unload_tool() before exit.
8. Translate any non-zero return with Error_Message(); map to the table above.