S7-1200 Web Server: Exposing Array Data as CSV String

S7-1200 Web Server: Exposing Array Data as CSV String for PHP Clients

The SIMATIC S7-1200 CPU ships with a built-in Web Server that is intended for diagnostics, status visualization, and lightweight custom HTML pages driven by PLC tag references. Many integrators quickly discover that the Web Server cannot iterate or render ARRAY tags directly inside an HTML fragment, which breaks the obvious approach of dropping :="MYDB".EXCHANGE_STRING: into a custom page when the underlying tag is ARRAY[0..1000] OF CHAR.

This reference documents a field-proven workaround: assemble the array contents into a single STRING tag (CSV-encoded) inside an SCL block, expose that one string on a custom Web Server page, and pull the page body from any PHP process using file_get_contents(). A Snap7 alternative for non-Web-Server deployments is also documented.

1. Problem Statement and Architectural Constraints

The S7-1200 Web Server (firmware V4.0 and later, with significant improvements through V4.5/V4.6) supports only elementary data types as direct tag substitutions inside an HTML page. The substitution syntax :="DB_Name".TagName: accepts:

• BOOL, BYTE, WORD, DWORD, LWORD
• SINT, INT, DINT, LINT and their unsigned variants
• REAL, LREAL
• CHAR, WCHAR
• STRING, WSTRING

Arrays, structures (STRUCT), and user-defined data types (UDTs) cannot be dereferenced by the Web Server tag interpreter. The Web Server will return a parse error or a blank substitution when asked to render ARRAY[0..1000] OF CHAR, regardless of how the tag is named or qualified in the HTML. This is documented in the S7-1200 Web Server function manual (entry ID 109755216) under the section describing AWP (Automation Web Programming) commands.

2. System Architecture and Topology

The deployment pattern is typically:

The S7-317F (or any automation CPU) publishes its process image to the S7-1200 over PROFINET. The S7-1200 serializes the resulting data into a single STRING tag, exposes it on a custom HTML page, and the PC polls that page. The Web Server is not designed as a high-throughput webservice; it is sized for diagnostics traffic. For polling intervals of one to five seconds, it performs reliably on a CPU 1212C, 1214C, or 1215C.

3. Prerequisites

• SIMATIC S7-1200 CPU with firmware V4.0 or higher (V4.4 or V4.6 recommended for the most stable AWP behavior and TLS support).
• Siemens TIA Portal V15.1 or higher matching the CPU firmware (TIA V17 with FW 4.5, TIA V18 with FW 4.6, etc.).
• CPU with sufficient work memory — a 1000-byte CSV buffer with surrounding logic fits comfortably in any 1212C and above.
• Ethernet interface configured, HTTP/HTTPS service enabled under Device configuration → Web Server.
• A user with read privileges for the target DB (configured under Web Server → User management).
• PC running PHP 7.4+ with allow_url_fopen = On in php.ini (default).
• Optional: Snap7 (snap7.sourceforge.net) if the PHP path is replaced by a native C/C++/Python client.

4. Building the CSV String on the S7-1200

4.1 Data Block Layout

Create a global DB (e.g., DB_DataExchange) containing a header DB and the CSV buffer:

4.2 SCL Block: Build CSV

The following SCL FB (callable from OB1 or a cyclic OB) assembles CSV rows from internal tags and a PROFINET-transferred input area. The block uses CONCAT, DELETE, INSERT, and STRING_TO/TO_STRING from the standard IEC library.

FUNCTION_BLOCK "FB_BuildCsvString"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
   VAR_INPUT
      i_Trigger   : Bool;     // rising edge rebuilds the string
      i_Timestamp : DTL;      // from RD_SYS_T
      i_TagName   : String[32];
      i_Value     : Real;
   END_VAR
   VAR_OUTPUT
      o_Built     : Bool;
      o_BytesUsed : DInt;
   END_VAR
   VAR
      sLine       : String[200];
      sValue      : String[32];
      fbTof       : TOF;       // edge qualifier
      rTrigPrev   : Bool;
   END_VAR
BEGIN
   // Edge detection on i_Trigger
   IF i_Trigger AND NOT rTrigPrev THEN
      // Convert timestamp DTL to ISO-like string
      sLine := '';
      sLine := CONCAT(IN1 := STRING_TO_INT(IN := INT_TO_STRING(IN := i_Timestamp.YEAR)),
                      IN2 := '-');
      // ... append month/day/hour/minute/second (omitted for brevity)

      // Convert REAL value with fixed 3 decimals
      sValue := '';
      // Use the SCL built-in conversion for predictable formatting
      sValue := Real_To_String(i_Value, 3);   // platform helper or manual FORMAT

      // Build the row: TIMESTAMP;TAG;VALUE\r\n
      sLine := CONCAT(IN1 := sLine, IN2 := ';');
      sLine := CONCAT(IN1 := sLine, IN2 := i_TagName);
      sLine := CONCAT(IN1 := sLine, IN2 := ';');
      sLine := CONCAT(IN1 := sLine, IN2 := sValue);
      sLine := CONCAT(IN1 := sLine, IN2 := '$r$n');

      // Append to the buffer
      IF (LEN("DB_DataExchange".EXCHANGE_STRING) + LEN(sLine)) < 2000 THEN
          "DB_DataExchange".EXCHANGE_STRING :=
              CONCAT(IN1 := "DB_DataExchange".EXCHANGE_STRING,
                     IN2 := sLine);
      END_IF;

      "DB_DataExchange".BUILD_COUNT := "DB_DataExchange".BUILD_COUNT + 1;
      o_Built := TRUE;
   ELSE
      o_Built := FALSE;
   END_IF;

   rTrigPrev := i_Trigger;
   o_BytesUsed := LEN("DB_DataExchange".EXCHANGE_STRING);
END_FUNCTION_BLOCK

4.3 Reset and Watchdog

Because the buffer is finite, clear it periodically or on a dedicated RESET_REQ bit. A simple watchdog in OB1 triggers a rebuild every N milliseconds using RD_SYS_T deltas:

// In OB1, call once per cycle
IF (ton_Build.Q = FALSE) THEN
   ton_Build(IN := TRUE, PT := T#2S);  // rebuild every 2 s
END_IF;
IF ton_Build.Q THEN
   "DB_DataExchange".UPDATE_REQ := TRUE;
END_IF;

5. Configuring the Custom Web Page in TIA Portal

5.1 Create the HTML Fragment

Under the CPU device configuration open Web Server → User-defined pages, add a new page named data. TIA Portal generates a default .htm entry with the AWP syntax already wired. Replace the body with:

<!-- :AWP_Use_Fragment="data,fragment1" -->
<h1>DATA:</h1>
<pre>
:="DB_DataExchange".EXCHANGE_STRING:
</pre>

The AWP fragment directive tells the Web Server compiler that the contents of the file should be embedded inside a default chrome (header, navigation) at request time. The substitution line is processed by the Web Server on every HTTP request, so the latest string is always returned.

5.2 Tag Read Permission

Open Web Server → User-defined pages → Tag access and add DB_DataExchange.EXCHANGE_STRING with read-only permission for the PHP user. Without this entry the substitution returns an empty string, even when the DB is correctly populated.

5.3 Compile and Download

After saving, TIA Portal compiles the HTML fragments and stores them in the CPU file system on download. Verify in Project tree → CPU → Web server → User-defined pages that data.htm is checked for generation.

6. Web Server Activation and Security

1. Open the CPU Properties → Web Server and tick Activate web server on this module.
2. Tick Permit access only with HTTPS for production deployments — self-signed certificates are acceptable when the PC trusts the CPU's CA.
3. Under User management, add a user (e.g., phpclient) with the role Read for the data DB. Do not use the Administrator role for unattended scripts.
4. Compile hardware and download to the CPU. The Web Server starts within 5–10 seconds of run-up.
5. From the PC, test with:
   curl -k -u phpclient:<password> https://<plc_ip>/data

7. PHP Client Implementation

The PHP side does not need a browser engine. The Web Server response is plain HTML/CSV text, so file_get_contents() with HTTP Basic authentication is sufficient:

<?php
declare(strict_types=1);

$plcIp   = '192.168.0.10';
$plcUser = 'phpclient';
$plcPass = 'ChangeMe!2024';
$url     = "https://$plcIp/awp/data.htm";

$ctx = stream_context_create([
    'http' => [
        'method'        => 'GET',
        'header'        => "Authorization: Basic " .
                              base64_encode("$plcUser:$plcPass") . "\r\n",
        'timeout'       => 5,
        'ignore_errors' => true,
    ],
    'ssl' => [
        'verify_peer'      => false,   // self-signed PLC cert
        'verify_peer_name' => false,
    ],
]);

$body = @file_get_contents($url, false, $ctx);
if ($body === false) {
    error_log("PLC unreachable at $url");
    exit(1);
}

// Strip HTML chrome, keep only the <pre> block
if (preg_match('/<pre>(.+?)<\/pre>/s', $body, $m)) {
    $csv = $m[1];
} else {
    error_log('No <pre> payload in PLC response');
    exit(2);
}

// Import to MySQL via LOAD DATA INFILE or batch INSERT
$rows = array_filter(explode("\r\n", trim($csv)));
$stmt = $pdo->prepare(
    'INSERT INTO plc_history (ts, tag, value) VALUES (?, ?, ?)'
);
foreach ($rows as $row) {
    [$ts, $tag, $value] = explode(';', $row);
    $stmt->execute([$ts, $tag, (float)$value]);
}

Schedule this script with cron, Windows Task Scheduler, or a systemd timer. Polling at 1–2 s is realistic for a 1214C; above 5 s the buffer should be cleared on the PLC side to prevent duplicate rows on each rebuild.

8. Alternative Path: Snap7 Direct Connection

If the PC cannot (or should not) rely on the Web Server, Snap7 provides a native S7 communication library that talks ISO-on-TCP (port 102) directly to the CPU. A PHP wrapper around the C library, or a small Python service that pushes to MySQL, removes the HTML/Web Server layer entirely and exposes the original DB tags — including arrays — to the application.

For multi-vendor or OPC UA environments, an OPC UA server can be added via the S7-1200 as of firmware 4.4 with the OPC UA server option activated, or via a Siemens SIMATIC IPC running the S7-1500 OPC UA server in proxy mode. This is documented in Siemens entry 109748955.

9. Performance and Sizing Considerations

The S7-1200 Web Server processes AWP substitutions sequentially. Each substitution involves a DB lookup, type conversion to ASCII, and write into the response buffer. A 1500-byte CSV string with a single substitution costs roughly 0.3–0.6 ms of OB1 time on a CPU 1214C at FW 4.4 — negligible against a 100 ms OB1 cycle, but a concern on a 1 ms cycle.

Best practices observed in field deployments:

• One tag per page, three pages max: split large exports across data1.htm, data2.htm, data3.htm instead of one 4 KB page. The Web Server handles multiple short pages more predictably than one long one.
• Trigger rebuilds, not polling: if the PC polls faster than the PLC rebuilds, the response is identical and the buffer is not updated. Rebuild on a 1–2 s timer driven by RD_SYS_T.
• Avoid HTML in the buffer: characters like <, >, &, and " will be HTML-escaped by the Web Server. Keep the payload as plain CSV; encode on the PC side if the values can contain special characters.
• Watch the SD card: extended user-defined pages are stored on the SD card. Do not generate the page dynamically on the PLC; use static fragments compiled by TIA Portal.
• Use HTTPS: HTTP Basic authentication over plain HTTP exposes the password to network capture. Enable HTTPS even with a self-signed cert.

10. Verification and Troubleshooting

Verification Steps After Commissioning

1. From a browser, log in to https://<plc_ip>/ and navigate to the custom page. Confirm the CSV header row appears.
2. Force a tag value change on the S7-317F, wait 2 s, refresh the page — the new value should be visible in the <pre> block.
3. From the PC, run the PHP script manually. Confirm rows are inserted into MySQL with the expected ts, tag, and value columns.
4. Inspect DB_DataExchange.BUILD_COUNT and LAST_BUILD_MS in the Web Server diagnostics to confirm rebuilds are happening at the configured interval.
5. Run for 24 h, then check the MySQL row count and confirm zero duplicate primary keys (indicates that the consumer is keeping up with the rebuild rate).

11. Frequently Asked Questions