Reading and Writing Siemens S7-300 Data Blocks from Elipse E3 SCADA over Ethernet

Elipse E3 is a Windows-based SCADA platform that ships with a native Siemens S7-300/S7-400 TCP/IP driver. The driver uses the S7 communication protocol carried over Industrial Ethernet (ISO-on-TCP, RFC1006) to read from and write to Data Blocks (DB) in the user program. This reference explains how to expose a 32-bit REAL value (a tank level, a setpoint, or the radius of an ellipse) to a SCADA tag, and how to write a setpoint back to the same DB, on a CPU 315-2 DP equipped with a CP 343-1 communications processor.

1. Communication Stack Overview

The path between the E3 Studio application on the SCADA PC and a DB variable in the S7-300 is the ISO-on-TCP transport carrying S7 protocol primitives. E3 packages the request in a TPKT/COTP envelope, opens an S7 connection against the configured connection resource on the CP 343-1, and the CP forwards the read/write request to the CPU via the backplane (S7 internal bus). The CPU resolves the DB number, applies access protection, and returns the requested bytes. The S7 protocol defines four primitive types: READ, WRITE, READ SZL (system state list), and PI_START / PI_STOP (programmer commands). E3 uses READ and WRITE for tag polling.

Figure 1. Logical path between E3 and a DB on a CPU 315-2 DP through a CP 343-1.

2. Hardware and Software Prerequisites

Confirm the following items are on the engineering bench before opening STEP 7 or E3 Studio.

3. Configuring the CP 343-1 in STEP 7

Open the S7-300 station in STEP 7 (or the S7-300 device in TIA Portal) and double-click the CP 343-1 in the rack to open the Properties dialog. The default IP address out of the box is 0.0.0.0, which disables Ethernet communication.

1. Select Properties > Ethernet Interface > IP Address. Set an address on the SCADA subnet, e.g. 192.168.0.10, with subnet mask 255.255.255.0. Use the router field only if the SCADA PC is on a different subnet.
2. Open the Options tab. Enable Use the CP for the PG communication and Use the CP for the OP/S7 communication. Both must be enabled for an E3 SCADA station to read and write to the CPU.
3. From the Connections editor (NetPro in STEP 7 V5, Devices & Networks in TIA Portal), create a new S7 Connection. Local endpoint is the CP 343-1; remote endpoint is unspecified because the SCADA PC is an OP/PG endpoint, not a CPU partner. The connection type is S7 connection.
4. On the General tab of the new connection, set the connection name (e.g. SCADA_E3) and the local Connection Resource (a free S7 connection ID on the CP, normally the first free slot starting at 0A hex / 10 decimal for an OP and 01 for a PG). Mark the Active connection establishment checkbox when the SCADA side initiates; this is the normal mode for E3.
5. Download the HW Config (and NetPro) to the rack. The CP keeps the configuration in flash and re-applies it on every power-up.

Verify the configuration by opening the online diagnostics in STEP 7: right-click the CP 343-1 > PLC > Ethernet Node > Browse. The PC's adapter should be visible and report the CP's MAC address. A ping to 192.168.0.10 from the SCADA PC confirms L3 connectivity before S7 is touched. A quick Wireshark capture on the SCADA PC should show TPKT/COTP packets destined to TCP port 102 once the E3 driver starts.

4. Data Block Structure in STEP 7

Data Blocks are organised in the Blocks container of the S7 program. A DB has a fixed number, an optional name, a symbolic name, and a structure declared in the declaration table. Each variable in the structure has an address of the form DBnx.Byte.Bit for booleans and DBnx.Byte for multi-byte types. The TIA Portal documentation on Data Blocks explains the difference between shared and instance DBs in detail; the S7-300 always generates non-optimised, fixed-offset DBs that the SCADA driver can address directly.

Two properties of the DB are critical for SCADA applications:

1. Instance vs. shared DB. Instance DBs are tied to an FB and are not directly accessible from outside the program; shared DBs (the default when you create a new DB and uncheck Instance DB) can be read by any code block and by the SCADA driver. Use a shared DB.
2. Optimised vs. non-optimised (S7-300 note). S7-300 always generates non-optimised DBs. The byte offsets are fixed and stable across firmware loads, which is what the E3 driver expects.

Create DB100 with the following declaration. Save and download to the CPU.

DATA_BLOCK DB100
TITLE = SCADA Interface
VERSION : 0.1
  STRUCT
    Level_PV    : REAL;    // Process value, %
    Level_SP    : REAL;    // Setpoint, %
    Valve_Cmd   : BOOL;    // Open valve command
    Pump_Run    : BOOL;    // Pump running feedback
    Spare_01    : BYTE;    // 1 byte padding
    Spare_02    : WORD;    // 2 byte padding
    Counter     : DWORD;   // 32-bit unsigned
  END_STRUCT;
END_DATA_BLOCK

The byte offsets are deterministic:

Figure 2. Byte offset layout of DB100 used in this example.

Level_PV starts at byte 0, Level_SP at byte 4, Valve_Cmd at byte 8.0, Pump_Run at byte 8.1, Spare_01 at byte 10, Spare_02 at byte 12, Counter at byte 14. The driver reads these offsets directly from the configuration table in E3.

5. E3 SCADA Siemens TCP/IP Driver Configuration

Open E3 Studio and start a new application. The driver is added at the application level under Drivers > Add Driver > Siemens S7 TCP/IP (also labelled "Siemens S7 Ethernet" in some E3 releases). Configure each property as follows.

The Remote TSAP is the most important field. The CP 343-1 advertises each configured S7 connection with a TSAP of the form 03.xx where xx is the connection ID in hex. Connection 10 decimal = 0A hex, so the Remote TSAP is 03.0A. The Local TSAP can be set to any free value between 01.00 and 01.FF; 01.00 is the default for an OP endpoint.

The S7 protocol also distinguishes Active and Passive connection establishment. The SCADA station is the Active partner; the CPU/CP is Passive. In the CP's connection configuration, leave the Active connection establishment checkbox on the SCADA side enabled and unchecked on the CP side. This avoids both ends trying to open the same TCON simultaneously.

6. Configuring DB Tags in E3

Once the driver is online, create a Tag for every variable exposed from the DB. The address format in E3 is DBn:offset:type (some releases use DBn,offset,type with commas; the studio help shows the accepted form). A double-click on the Address field opens the address picker.

The driver groups adjacent reads in the same scan to minimise round-trips. Because Level_PV, Level_SP, and the BOOLs lie within the first 9 bytes, the driver issues a single READ S7 primitive for bytes 0..10 of DB100. Spare_01 through Counter form a second read group from bytes 10..18. This behaviour can be verified in the driver diagnostic log by enabling Verbose mode.

The MAX_RAW and MIN_RAW scaling fields in the tag configuration are critical when the PLC value uses a scaled integer (e.g. 0..27648 for a 0..100% analogue input). For a true REAL value in the DB, leave both at their defaults (0 and 100) and set the engineering range in the Limits tab.

7. Reading a Float/Real Value for an Ellipse

The original use case is to drive the radius of an ellipse on the E3 screen from a REAL tag in the PLC. Bind the ellipse to a Drawing Object property:

1. Insert an Ellipse from the E3 toolbox.
2. In the property grid, expand Appearance > Geometry and bind RadiusX to Level_PV. The binding dialog accepts both direct and indirect tags; use the direct binding for the demo.
3. Bind RadiusY to the same tag for a circle, or to Level_SP for an interactive preview.
4. Run the application in Run mode. The ellipse should grow and shrink in sync with the value written to Level_PV in the PLC.

If the ellipse does not move, open the E3 LogViewer and look for S7 driver errors. The most common cause at this stage is Address out of range, which means the offset in the E3 tag does not match the byte offset in the DB declaration. Re-check the DB declaration in STEP 7 against the offsets configured in E3. A VAT table in STEP 7 with DB100.Level_PV open in monitor mode is the fastest cross-check.

8. Writing Values to the Data Block

Writing follows the same addressing scheme. The driver issues an S7 WRITE primitive when the SCADA tag is marked Output in the E3 tag editor. The write is committed by an explicit command in the SCADA logic (e.g. a button on a screen calling Write("Level_SP")) or by an automatic OnChange subscription when AutoWrite is enabled.

To command a setpoint from a screen:

1. Place a Numeric Input object on the screen.
2. Bind the Value property to Level_SP and set the property WriteOnChange to True.
3. Set the property MinValue / MaxValue to 0 / 100 to clamp operator entries.
4. Press Enter in the running application. E3 sends a 4-byte write of the new REAL value to DB100 at offset 4.0.

For boolean commands, bind a Toggle or Push Button object to Valve_Cmd (offset 8.0). The driver performs a read-modify-write on byte 8 to set the single bit, preserving the value of Pump_Run at bit 8.1 across the write. This is automatic and does not require any extra configuration on the SCADA side.

9. Symbolic vs. Absolute Addressing

STEP 7 supports symbolic addressing by importing the tag table into E3. The benefit is that renaming a variable in the PLC no longer breaks the SCADA tag. The mechanism is the export of a Symbol File from STEP 7 and import into E3 as an OPC-style address space.

1. In STEP 7, select the Symbols table and choose Options > Export > Symbol File. Save as DB100.sdf.
2. In E3 Studio, right-click the driver > Import Symbols and select the exported file. The driver creates a tag for every symbol that points to a DB address.
3. Re-link the screen objects to the imported tag names. Renaming a variable in STEP 7 only requires re-exporting the symbol file; the offsets are recalculated automatically.

Symbolic import is mandatory when the project uses a TIA Portal S7-300 with optimised block access. For the classic S7-300 (non-optimised), the import works the same way and helps when the SCADA team is decoupled from the PLC team. Keep the symbol file under version control so the SCADA and PLC teams are working from the same source of truth.

10. Verification and Diagnostics

Run a five-step verification procedure on every SCADA-PLC link before going to the field.

1. L1 — link. The Link LED on the CP 343-1 and on the SCADA PC NIC must be solid green. A dark LED on either side points to a cable, connector, or switch port issue.
2. L3 — ping. ping 192.168.0.10 from the SCADA PC must succeed in <1 ms on a switched LAN. A high RTT or packet loss points to switch congestion, duplex mismatch, or EMI.
3. Port — TCP/102. From the SCADA PC run Test-NetConnection 192.168.0.10 -Port 102 in PowerShell. The result must be TcpTestSucceeded: True. If it fails, a Windows Firewall rule, an antivirus, or a switch ACL is blocking the port.
4. S7 — online. In STEP 7, PLC > Online & Diagnostics > Communication must show the CP online and the configured S7 connection Established. A Not established state indicates a TSAP or local-endpoint misconfiguration.
5. Driver — read. In E3, open the Watch Window and add Level_PV. Force a value in the PLC using a VAT table; the E3 value must follow within one scan period (default 500 ms).

The driver's built-in diagnostics are accessed at Drivers > Siemens S7 TCP/IP > Diagnostics. The dialog shows the connection state, the last error code, the configured TSAP, the round-trip time in ms, and a counter of successful / failed reads and writes. Persist this screen as a screenshot for the commissioning report. For an S7 protocol-level trace, attach a SPAN port on the switch and capture with Wireshark; the S7 dissector decodes the READ / WRITE primitives directly.

11. Troubleshooting Matrix

For deeper diagnostics, attach an S7 protocol trace tool to the SCADA PC (port mirroring on the switch) and capture the TCP stream. The S7 protocol uses TPKT (4 bytes) and COTP (3 bytes) headers; the first user-data byte is the S7 function group, 0x04 for read, 0x05 for write. The E3 driver can be placed in verbose mode to write each request/response to the log file %ProgramData%\E3\Logs\SiemensS7.log.

12. Performance and Polling Best Practices

E3 polls each tag at the configured scan period. Badly-tuned scans waste bandwidth and can starve other applications. Use the following rules of thumb for a CP 343-1 EX30 on a 100 Mbit/s LAN.

Avoid the temptation to set every tag to 100 ms. The CP 343-1 handles roughly 100 S7 PDUs/s in real-world conditions; 500 tags at 100 ms scan = 5000 PDUs/s, which overruns the CP. Either aggregate tags into a contiguous block and use the Block Read feature (E3 v3.6+), or push alarms via S7-comm event-driven blocks from the PLC side using READ_DBL transfers.

For very large applications, consider moving the SCADA station to a CP 343-1 Advanced (6GK7 343-1GX30-0XE0), which supports 32 S7 connections, 8 IT connections, and 4 FTP connections, and provides an integrated 4-port switch that simplifies daisy-chained topologies. Alternatively, deploy two CP 343-1 modules in the rack and split the SCADA traffic across them, with E3 configured to fail over to the second CP after a configurable timeout.

13. Frequently Asked Questions