Siemens PC to PLC Communication: MPI, Profibus, and S7-200 Setup

Overview

Interfacing a desktop PC to a Siemens S7 PLC lets you build a low-cost HMI, log process data, or develop a SCADA application without licensing a full WinCC runtime. The feasible paths depend on which S7 family is in the cabinet and how much engineering effort you are willing to invest. For an S7-200, the cheapest viable path is the PC/PPI cable (Siemens 6ES7901-3CB30-0XA0) plus PRODAVE or LIBNODAVE on the PC side. For an S7-300/400, the PC/MPI adapter (6ES7972-0CA23-0XA0) plus PRODAVE MPI (6ES7807-4BA00-0YA0) is the historic baseline, although the S7-300/400 can also be reached over PROFIBUS DP and Ethernet (ISO-on-TCP / S7 Communication) if a CP card is fitted.

Before you start, decide three things:

1. Which PLC family and firmware is in the rack? S7-200, S7-300, S7-400, S7-1200, and S7-1500 use different transport layers.
2. Do you need a one-off pet-project link, or do you need a maintainable, vendor-supported interface that a maintenance technician can re-install in three years?
3. Will the PC port be RS-232, USB, or Ethernet? Most legacy adapters assume RS-232, so plan for a USB-to-serial bridge if the laptop lacks DB9.

Prerequisites

Siemens S7 Communication Protocols at a Glance

Hardware Adapters: PC/MPI and PC/PPI

Siemens sold two RS-232 adapters that have been the workhorse of PC-to-PLC links for over twenty years. They remain the cheapest supported route for a learning project on a real S7.

The original PC/MPI cable terminated in DB9 female on the PC side and DB9 male on the PLC side. It piggybacks 24 V from the PLC's MPI connector (pins 6 and 7) to power its own RS-232 to RS-485 converter. The later USB variant (6GK1571-1AA00) draws power from the PC and is the only safe option on laptops without a serial port.

Pin Assignment Reference

S7-200 Freeport Mode

The cheapest way to put a process value from an S7-200 on a PC screen is the Freeport mode of the S7-200. Freeport is the CPU's own RS-485 UART: you set SMB30 (port 0) or SMB130 (port 1) to protocol 01 (Freeport), pick a baud rate and parity, and use the XMT (transmit) and RCV (receive) instructions to ship bytes. The PC side just needs a terminal program or a 20-line QBasic program.

The full procedure lives in S7-200 Tips and Tricks Application Examples, TIP 52 ("Freeport Communication with a PC"). The S7-200 System Manual is the official reference for the SMB30 protocol field encoding:

Sample ST code (S7-200) - send a process value as ASCII once per second

// MAIN OB1 - cycle every 100 ms
IF First_Scan THEN
    SMB30 := 16#09;          // 0x09 = 0000 1001 = 9600 baud, no parity, 8 bits, Freeport
    RCV_Buf_SIZE := 32;      // RCV buffer length
END_IF;

IF T_Pulse THEN              // 1 Hz clock bit from SMB34/SMW34
    Transmit_Buffer[0] := 'V';
    Transmit_Buffer[1] := 'W';
    Transmit_Buffer[2] := ':';
    INT_TO_ASCII(VW100, Transmit_Buffer[3]);   // convert signed word to 4 ASCII digits
    XMT(Transmit_Buffer, 8, 0);                // transmit 8 bytes from port 0
END_IF;

PC side in QBasic (DOS box, Win9x only)

OPEN "COM1:9600,N,8,1,CD0,CS0,DS0,OP0,RS" FOR RANDOM AS #1 LEN=256
CLS
DO
   LINE INPUT #1, dataline$
   LOCATE 1,1: PRINT dataline$
   IF INKEY$ = CHR$(27) THEN EXIT DO
LOOP
CLOSE #1

PRODAVE Library

PRODAVE is the classic Siemens-supplied DLL that wraps the PC/MPI or PC/PPI cable into a small C/VB API. It hides the byte-level MPI framing and exposes simple read/write calls to data blocks, M, I, Q, and timers.

Typical VB6 snippet using PRODAVE MPI

' Must reference "PRODAVE_MPI.DLL" (regsvr32 it first)
Dim adr As Long
Dim ok  As Long

ok = MpiInit()                        ' load the driver
ok = MpiSetBaud(7, 0, 0, 0)           ' 187.5 kbaud, 8N1, MPI bus, PC = master
ok = MpiConnect(2, 0)                 ' PLC at MPI address 2, slot 0 of rack 0
ok = MpiReadS7(0, 0, 1, 100, 20, buf) ' read MB0..MB19 from DB1 starting at DBB100
ok = MpiWriteS7(0, 0, 1, 200, 4, cmd)' write 4 bytes into DB1.DBB200

PRODAVE was designed for Windows 95/98/2000; on a 64-bit Windows 10/11 host you need to either run the host application as 32-bit (WOW6432) and install the legacy USB driver for the PC/MPI cable, or migrate the application to a modern library such as LIBNODAVE, S7.Net, or Snap7.

LIBNODAVE - Open-Source Replacement for PRODAVE

LIBNODAVE is the most common open-source C library for S7 communication. It compiles on Windows, Linux, and macOS, supports MPI (via the PC/MPI cable or a CP5611 card), TCP, and ISO-on-TCP, and exposes the same data-block primitives as PRODAVE.

• Latest stable series: 0.8.5 (Thomas Herger's continuation, hosted on the libnodave source tree at the time of writing; the dotNET binding "libnodave.net" and the "Sharp7" port are also widely used).
• Licence: LGPL - safe to use in a closed-source SCADA project as long as the library and any modifications remain open.
• Transports: daveMPIserial (PC/MPI cable over RS-232), daveMPIcard (Siemens CP5611/CP5621), daveTcp, daveIsoTcp, davePPIserial.

Sample C client reading 16 bytes from a DB

#include "nodave.h"
#include <stdio.h>

int main(void) {
    daveInterface *di = daveNewInterface(IFType_mpiPPI, "COM1:9600", 0, daveProtoMPI2, daveSpeed187k);
    daveInitAdapter(di);
    daveConnection *dc = daveNewConnection(di, 2, 0, 0);  // MPI addr 2
    if (daveConnectPLC(dc) == 0) {
        unsigned char buf[16];
        daveReadBytes(dc, daveDB, 1, 100, 16, buf);       // DB1.DBB100..DBB115
        printf("DB1.DBW100 = %d\n", (buf[1]<<8)|buf[0]);
        daveDisconnectPLC(dc);
    }
    daveFree(dc);
    daveFree(di);
    return 0;
}

OPC Server Approach

OPC is the standard for SCADA-to-PLC communication. If you already have a SCADA package (WinCC, Citect, iFIX, Ignition) that speaks OPC DA or OPC UA, the cheapest path is a thin OPC server in front of the S7.

• SIMATIC NET OPC Server (Siemens, part of STEP 7 V5.5 / TIA Portal): full-featured, supports MPI/PROFIBUS/Ethernet, ships as S7OPCSim for offline testing.
• IBH OPC Server (IBHsoftec): supports MPI/PPI/TCP, works with LIBNODAVE-style transport, runs as a service on Windows.
• openSCADA / Eclipse SCADA: open-source OPC DA/UA server with an S7 driver built on LIBNODAVE.

OPC UA is the right long-term choice for any new S7-1200/1500 install, since the S7-1500 CPU can host an OPC UA server directly without an extra PC. The S7-1200 needs firmware V4.0+ and a licence on the CPU; see the S7-1200 System Manual for activation.

SCADA / HMI Software Options

Citect's 15-minute runtime is the most common way to get a "free" SCADA onto a laptop for a learning project - it is a real Citect runtime with the full driver set, and the 15-minute window restarts cleanly on a service or by re-launching the runtime. Use it to learn the alarm/IO/trend primitives; once the project is stable, the licence cost is the only difference between a demo and a production install.

Alternative: AutomationDirect CLICK PLC as a Reference

If you are flexible on the PLC brand, the AutomationDirect CLICK series ships a built-in RS-232 port and a free programming environment. The CLICK C0, C2, and C3 modules expose DB1-style "XD" registers over Modbus RTU on port 2 and an ASCII protocol on port 1, which is far simpler than MPI for a one-evening project. See the AutomationDirect CLICK PC-to-PLC communications video for a worked example. The trade-off is that the CLICK CPU and its free software are limited to ~200 tags - fine for a bench project, not for a plant install.

Step-by-Step: Cheapest Viable S7-200 to PC Link

1. Install STEP 7 Micro/WIN on the PC. Connect the PC/PPI cable (6ES7901-3CB30-0XA0) between the PC's COM1 and the S7-200's port 0. Verify the PC sees the CPU with Communications > PC/PPI Cable PPI - you should read the CPU type and firmware.
2. Set the S7-200 to PPI slave address 2, 9.6 kbaud, via the System Block configuration in Micro/WIN.
3. Open the TIP 52 example from the S7-200 Tips and Tricks CD. Copy the ST code above into a new OB1, compile, and download to the CPU. Put the CPU in RUN.
4. On the PC, run the QBasic program (or a free terminal like PuTTY set to 9600-8-N-1, XON/XOFF off). You should see VW:<value> rolling up the screen once per second.
5. Replace the QBasic print loop with a small VB6, VB.NET, or Python application that parses the line and updates a label. At this point you have a working HMI for the price of a PC/PPI cable and an evening's work.

Step-by-Step: S7-300/400 to PC over MPI

1. Install STEP 7 V5.5 SP2 (or higher) on the PC. Use the PC/MPI cable (6ES7972-0CA23-0XA0) on COM1. The cable draws 24 V from the CPU MPI connector - you do not need a separate power supply.
2. In STEP 7, set Set PG/PC Interface to "PC Adapter (MPI)", 187.5 kbaud, MPI = 0, PC = master.
3. Use Accessible Nodes to confirm the PLC is online. Note its MPI address (default 2) and slot (default 2 for an S7-300 CPU).
4. Either install PRODAVE MPI (6ES7807-4BA00-0YA0) and use the VB snippet above, or compile LIBNODAVE with the daveMPIserial transport and link it to your C/VB application.
5. For a quick visual check, install Citect or the free Interact edition, point its S7 driver at "PC Adapter (MPI)", and drop a couple of tags. The 15-minute demo runtime is enough to prove the link.

Verification

After the link is up, run these checks before declaring the project complete:

• Cyclic heartbeat: Write a 16-bit counter in the PLC, increment every cycle, and verify the PC side sees the same count over the cable. A stuck or replayed value is the classic sign of a buffer corruption.
• Round-trip time: Measure write-then-read latency. PPI/MPI at 187.5 kbaud is roughly 1-3 ms per 16-byte block, 12 Mbaud PROFIBUS is ~200 microseconds. If your read takes >50 ms, suspect a wrongly addressed partner (MPI bus scan is expensive).
• Bus load: On PROFIBUS, use the diagnostic counters in STEP 7 (PLC > Diagnostics/Settings > Bus Statistics). Bus load >60% on a 1.5 Mbaud segment will cause retries and jitter.
• Driver-level error: PRODAVE returns the error code in the last parameter of every call. Common values: 0x8000 (cable not found), 0x8001 (timeout), 0x8002 (PLC not online), 0x8003 (MPI address conflict).
• Visual confirmation: If using a SCADA, write a tag value from the PLC's HMI and confirm the SCADA animation follows within one scan.

Troubleshooting Matrix

Field-Proven Notes

A few practical constraints collected from real benches:

• RS-232 ports are gone from most new laptops. Keep one USB-to-RS-232 adapter (FTDI chipset) in your toolbox for legacy Siemens cables. Chipsets labelled "FT232" or "CP2102" work; some Prolific PL2303 clones do not.
• The PC/MPI cable supports MPI up to 1.5 Mbaud; the PC/PPI cable supports PPI up to 187.5 kbaud only. Don't expect to reach PROFIBUS DP 12 Mbaud with the older PC/MPI cable - the bandwidth is hard-limited in the firmware.
• On an S7-300 rack with a CP 343-1, use the Ethernet port - it is faster, electrically isolated, and supported by every modern driver. Save the PC/MPI cable for S7-300 CPUs that have no Ethernet port (older CPU 31x, CPU 31x-2DP).
• For a long-lived plant install, the Maintenance Manual is unambiguous: "Custom HMI applications must be documented, version-controlled, and re-buildable from source code held on a controlled repository." A Freeport QBasic program on a Windows 98 laptop is not a plant install - it is a learning machine.