Visual C# .NET to Siemens S7-300 Communication: OPC, Prodave, and Open-Source Paths

When porting an HMI or supervisory application from a Beckhoff TwinCAT environment to a Siemens S7-300 controller, the first engineering question is almost always the same: "How do I read and write PLC tags from a Visual C# .NET program over Industrial Ethernet?" Siemens offers two first-party toolkits (SIMATIC NET OPC Server and the Prodave/Comfort libraries) and the open-source community has produced a third path (Snap7, libnodave, S7.NetPlus) that often beats the licensed options on both cost and ease of deployment. This reference walks through every layer of the stack, the trade-offs of each option, and a working C# implementation path for both the licensed and open-source routes.

1. Problem Definition: Porting from TwinCAT ADS to SIMATIC S7

Beckhoff TwinCAT exposes the ADS (Automation Device Specification) protocol as a pure .NET class library (TcAdsDll, TcAdsApi). The application calls AdsClient.ReadAny, WriteAny, and AddDeviceNotification directly, with the TwinCAT router acting as a TCP broker on the engineering or target IPC. The mental model is "PLC = object, tag = property".

On a SIMATIC S7-300 the mental model is different. There is no in-process router and no first-party .NET class library for arbitrary tag access. Every PC-side path terminates on either:

• A Siemens-supplied server (SIMATIC NET, Prodave, WinCC) that exposes data through a Microsoft-defined interface, or
• A third-party or open-source implementation of the S7 communication protocol stack over ISO-on-TCP (port 102) or TCP (port 102 with TPKT).

The target functionality is identical: read a tag, write a tag, and ideally register for value changes. Only the transport and the abstraction layer change.

2. S7-300 Communication Stack: What Is Actually on the Wire

An S7-300 CPU with a PROFINET interface (CPU 31x-2 PN/DP) or a separate CP 343-1 Lean/Advanced provides the following external interfaces:

For the C# → S7-300 link the relevant layer is the S7 Communication protocol (commonly called S7Comm or the Put/Get service). It runs on top of ISO-on-TCP (RFC 1006), uses TPKT/COTP framing, and exchanges user data through PDU types 0x32 (read), 0x05 (write), 0x32 with subfunction 0x04 (read SZL), and 0x00 (CPU services). The CPU must allow external Put/Get access — by default on a fresh S7-300 this is enabled, but a locked configuration in STEP 7 will block it silently with an 0x8104 error.

3. Option A — SIMATIC NET S7 OPC Server (the recommended path)

The most flexible long-term answer is the SIMATIC NET S7 OPC Server bundled with the SIMATIC NET PC software DVD. The PC-side topology is:

3.1 Why OPC wins for multi-vendor fleets

If the same C# application is later expected to read tags from an Allen-Bradley ControlLogix, a Schneider Modicon M340, or a GE RX3i, only the OPC server (or the equivalent DA Server) needs to change. The C# client code stays identical because OPC Data Access 3.0 is vendor-neutral. This is the central reason the field report converged on OPC as the long-term answer.

3.2 License variants

For a single S7-300 the SOFTNET-IE S7 Lean license is the correct minimum order. A working C# example against this server is published at the Siemens support entry SIMATIC NET: Programming an OPC DA Client with C# (.NET).

4. Option B — Prodave (in-process S7 library)

Prodave (current name: SIMATIC S7-PLCSIM / Prodave V6, historically distributed as Prodave MPI/IE) is a Windows DLL that exposes the S7Comm protocol directly to user code without a server. Variants:

Prodave is officially callable from C/C++ and VB. A .NET caller must declare the functions with [DllImport], or use the third-party LibProdave 6.2 managed wrapper. There is no Microsoft-supported direct C# binding. For a Visual C# project this is a non-trivial constraint: the application must either be compiled as x86 to host the 32-bit Prodave DLL, or the managed wrapper must be sourced separately.

4.1 Prodave vs OPC decision matrix

5. Option C — Open-Source / Third-Party Native Libraries

For engineers who do not want a licensed server and do not want DCOM, the S7-300 S7Comm protocol has been reverse-engineered to a high degree of fidelity. The three notable stacks are:

Snap7 plus the managed Sharp7 wrapper is the current industry favorite for greenfield .NET integrations. It implements the S7Comm PDU types in-process, supports parallel partner connections, and is actively maintained (current stable 1.4.x). S7.NetPlus is a pure C# implementation that wraps the same protocol and is easier to ship in a single assembly — the S7.NetPlus NuGet package installs into any .NET Framework 4.6+ or .NET 6+ project without an external native dependency.

6. Change Notification: Why S7-300 Cannot Push

The field report explicitly raised "registering for variable changes". On Beckhoff this is a first-class feature (IAdsNotification). On SIMATIC the equivalent is split across two capabilities:

1. S7-300 cyclic service — the PC (or server) is the polling master; the CPU returns the current value on each request. There is no CPU-initiated push.
2. S7-400 "trigger by symbol" — only available on S7-400 CPUs (e.g., 416-3, 417-4) paired with WinCC or PCS7, and only for DB tags. The CPU detects a defined value change and pushes a single telegram; the WinCC station receives it without polling.

There is no analogue on the S7-300. A C# → S7-300 change-notification feature must be emulated on the PC side with a polling loop (typically 100–500 ms, fast enough to look like an event but slow enough to avoid overwhelming the S7Comm queue). The recommended pattern is:

1. Open a single S7.NetPlus or Snap7 connection to the CPU (rack 0, slot 2 by default for S7-300 PN).
2. Use a System.Threading.Timer or async loop at the desired poll interval.
3. Read the data block(s) in bulk (a single PDU can carry up to 480 bytes of contiguous data).
4. Compare to the cached copy; only raise the C# event when the value has actually changed.

7. Multi-Vendor Strategy: Adding Allen-Bradley ControlLogix

The original requirement mentioned a follow-on project using Allen-Bradley ControlLogix. The OPC choice preserves the C# code base because:

• Siemens path: SIMATIC NET S7 OPC server (DA 3.0) reads S7-300 DBs.
• Rockwell path: RSLinx Enterprise (now FactoryTalk Linx) exposes ControlLogix tags through the same OPC DA 3.0 interface, or through OPC UA.
• Universal path: Kepware KEPServerEX or Softing's OPC Router exposes both vendors in one server.

The C# client code is identical in all three cases because OPC DA 3.0 server enumeration (IOPCServerList) and item access (IOPCItemMgt, IOPCSyncIO) are vendor-neutral COM interfaces, and the .NET OPC Foundation wrapper (OPCAutomation or the newer OPC .NET Standard) consumes them uniformly.

8. Step-by-Step: Building a C# OPC DA Client for S7-300

Prerequisites:

• SIMATIC NET PC software 2022 or newer installed (v15.1, v16, v17, v18, v19 supported). The S7 OPC server is registered as a local COM service under Siemens.SimaticNET.OPCServer.DA.
• STEP 7 V5.7 (for S7-300) or TIA Portal V15+ (for newer projects) project with the CPU's PROFINET IP address, rack 0, slot 2.
• Visual Studio 2019/2022 with a C# project targeting .NET Framework 4.8 (OPC DA via COM interop) or .NET 6+ with OPC UA.

8.1 Add the OPC reference

1. In Visual Studio choose Add Reference → COM → OPC Automation 2.0 (this is the wrapper provided by the OPC Foundation; SIMATIC NET installs it).
2. If your project targets .NET 6 or later you cannot consume the classic COM wrapper directly. Use the OPC .NET Standard package (1.5.x) plus a UA wrapper on the server side, or fall back to the .NET Framework 4.8 project type for OPC DA 3.0.

8.2 Connect to the S7 OPC server

using OPCAutomation;
using System;

namespace S7OpcClientDemo
{
    internal class Program
    {
        static void Main()
        {
            var opcServer = new OPCServer();
            // Siemens ProgID as registered by SIMATIC NET
            string progId = "Siemens.SimaticNET.OPCServer.DA";
            string node = Environment.MachineName; // local OPC server
            opcServer.Connect(progId, node);

            Console.WriteLine("Server state: " + opcServer.ServerState);
            opcServer.Disconnect();
        }
    }
}

8.3 Browse and add items

Items are addressed by the Siemens item ID convention: S7:[CPU_ip]DB<DBnum>,<byte_offset><type_letter><bit>. Example: S7:[192.168.0.10]DB1,REAL0 reads a 32-bit REAL at offset 0 of DB1.

OPCGroups groups = opcServer.OPCGroups;
OPCGroup group = groups.Add("Group1");
group.IsActive   = true;
group.IsSubscribed = true;
group.UpdateRate = 250; // ms

OPCItems items = group.OPCItems;
int clientHandle = 1;
object itemIds = new object[] { "S7:[192.168.0.10]DB1,REAL0",
                                "S7:[192.168.0.10]DB1,REAL4",
                                "S7:[192.168.0.10]DB10,BYTE0" };
int[] serverHandles = new int[3];
int[] errors        = new int[3];
items.Add((int)itemIds.Length,
          ref itemIds,
          ref clientHandle,
          out serverHandles[0],
          out errors[0]);

8.4 Read, write, and async data change

// Synchronous read
object values; object qualities; object timestamps;
items.Read((short)serverHandles.Length,
           serverHandles,
           out values,
           out qualities,
           out timestamps,
           out errors);

// Asynchronous subscription (closest analogue to TwinCAT AddDeviceNotification)
group.DataChange += OnGroupDataChange;

private static void OnGroupDataChange(int transactionId, int numItems, ref Array clientHandles,
                                      ref Array itemValues, ref Array qualities, ref Array timestamps)
{
    for (int i = 1; i <= numItems; i++)
    {
        Console.WriteLine($"handle={clientHandles.GetValue(i)} val={itemValues.GetValue(i)} ts={timestamps.GetValue(i)}");
    }
}

9. Step-by-Step: Using S7.NetPlus (open-source) from C#

This is the path that avoids any Siemens license when the project is single-vendor and the same C# code is the only consumer.

9.1 Install the package

dotnet add package S7NetPlus --version 2.2.0

9.2 Connect and read

using S7.Net;
using S7.Net.Types;

using var plc = new Plc(CpuType.S7300,
                        "192.168.0.10",
                        0,      // rack
                        2);     // slot (CPU 31x-2 PN default)
plc.Open();

if (plc.IsConnected)
{
    float  temperature = plc.Read("DB1.DBD0");     // REAL at DB1 byte 0
    bool   valveOpen   = plc.Read("DB1.DBX10.0");
    ushort word        = plc.Read("DB10.DBW2");
    Console.WriteLine($"{temperature} {valveOpen} {word}");
}

9.3 Write a value

plc.Write("DB1.DBD0",  23.5f);     // REAL
plc.Write("DB1.DBX10.0", true);   // BOOL bit
plc.Write("DB10.DBW2", (ushort)42);

9.4 Emulated change notification (polling)

var lastSeen = new Dictionary<string, object>();
var timer = new System.Threading.Timer(_ => {
    float t = plc.Read("DB1.DBD0");
    if (!lastSeen.TryGetValue("temp", out var prev) || !prev.Equals(t))
    {
        lastSeen["temp"] = t;
        OnTemperatureChanged?.Invoke(t);
    }
}, null, 0, 250);

10. S7-300 Hardware Sizing for PC Communication

When the S7-300 is in the cabinet and a new C# application will be added, verify the following before commissioning:

11. Performance, Timing, and Error Codes

11.1 Typical round-trip times

11.2 Common S7Comm error codes

12. Verification & Diagnostics

1. Layer 1–2: From the PC, ping 192.168.0.10. Use arp -a to confirm MAC learning on the switch.
2. Layer 3: From the PC open TCP/102 with Test-NetConnection 192.168.0.10 -Port 102 (PowerShell) or nc -vz 192.168.0.10 102. A successful connect proves the CP 343-1 is accepting ISO-on-TCP.
3. STEP 7 online: Open the S7 project online, expand Accessible nodes, confirm the CPU appears. This proves that the same connection budget the C# application will use is functional from STEP 7.
4. OPC ping: The SIMATIC NET OPC Scout tool (Start → SIMATIC → SIMATIC NET → OPC Scout) browses the server, adds a single item, and forces a read/write. If OPC Scout works and the C# client does not, the problem is in the C# client, not the network or the S7-300.
5. End-to-end smoke test: In the C# application, read a known DB byte (e.g. DB1.DBB0 set to a constant in OB1) and assert the value matches.

13. Troubleshooting Matrix

14. Selection Flowchart

15. Field-Engineer Notes

• License of the OPC server is per S7 connection, not per PC. If the C# application reads 4 different S7-300 CPUs, count the OPC connection licenses, not the number of running clients.
• Symbolic addressing on S7-300 with S7Comm works only on firmware that supports it (V3.x on 31x-2 PN, V2.x on CP 343-1 V2.x). On older firmware the address must be absolute (DB number + byte offset).
• DCOM is the #1 reason OPC projects fail late. If you can choose OPC UA from the start, choose it. The SIMATIC NET variants supporting OPC UA are the V15+ SOFTNET-IE S7 and the newer SIMATIC NET 2022 editions.
• Snap7 + Sharp7 is the path of least resistance for a single-vendor, license-free .NET deployment and is the de-facto standard for small SCADA / data-acquisition projects talking to S7-300 / S7-400 / S7-1200 / S7-1500.
• Do not attempt to emulate AddDeviceNotification with sub-second polls. S7-300 OB1 cycle plus the S7Comm queue cannot absorb < 50 ms polling from multiple clients. Stay at 200–500 ms per subscription group.