Why Siemens has so many protocols
Siemens is the world's largest PLC manufacturer by installed base, and their controller families span multiple industrial eras. The SIMATIC S5 series was the dominant platform of the 1980s and early 1990s; the S7-300 and S7-400 defined the mid-range and high-end market for three decades; the S7-200 addressed the compact/micro segment; and the current S7-1200 and S7-1500 families represent the TIA Portal generation with modern Ethernet and OPC UA capabilities. Each of these families arrived with its own communication stack — and most plants still have multiple generations running simultaneously.
This is not just a Siemens problem. Any PLC manufacturer with a 40-year product history has this layered protocol reality. What makes it particularly relevant for connectivity engineers is that the right approach for connecting to an S7-300 via Industrial Ethernet is completely different from connecting to an S7-1500 for symbolic tag access — and using the wrong method results in a connection that either fails outright or succeeds with significant limitations.
SIMATIC is Siemens' automation brand. All of the PLC families discussed here — S5, S7-200, S7-300, S7-400, S7-1200, S7-1500 — are SIMATIC products. TIA Portal (Totally Integrated Automation Portal) is the current unified engineering environment for S7-1200 and S7-1500. Earlier families used STEP 7 Classic (S7-300, S7-400) or STEP 7 Micro/WIN (S7-200).
The major Siemens protocols at a glance
Siemens protocols divide cleanly into three eras: the S5 serial protocols (AS511 and 3964/3964R), the classic S7 protocols (MPI, Profibus DP, Industrial Ethernet/S7 Comm, PPI), and the modern S7 protocols (S7 Comm Plus and OPC UA) introduced with the S7-1200 and S7-1500. Here is a reference overview of each.
EthernetS7 Comm (Industrial Ethernet)
The classic S7 Ethernet protocol — S7-200 through S7-1500
S7 Comm is Siemens' proprietary application-layer protocol that runs over ISO-on-TCP (RFC 1006) on standard Ethernet. It is the protocol used by STEP 7 Classic for PG/PC communication with S7-300, S7-400, and older S7-1200/1500 controllers. S7 Comm uses absolute (offset-based) addressing into data blocks, inputs, outputs, merkers (flags), timers, and counters.
Used by: S7-300 (via CP 343), S7-400 (via CP 443), S7-1200 (built-in port), S7-1500 (built-in port, non-symbolic access), S7-200 (via CP 243)
EthernetS7 Comm Plus
The modern protocol for symbolic access to S7-1200 and S7-1500
S7 Comm Plus is Siemens' enhanced protocol for the TIA Portal generation. It extends the S7 Comm foundation to support symbolic tag addressing, optimized data blocks, arrays, structures, and UDTs. TOP Server's S7 Plus Ethernet driver implements this protocol natively without requiring OPC UA.
Used by: S7-1500 (firmware 2.0+, all CPU variants), S7-1200 (firmware 4.x+, built-in Ethernet port)
NetworkMPI (Multi-Point Interface)
Siemens' proprietary PLC bus for programming and inter-PLC comms
MPI is a Siemens-proprietary RS-485-based network that runs at 187.5 kbps and supports up to 32 nodes. MPI is the native programming port on S7-300 and S7-400 controllers and is used for both PG/PC communication and peer-to-peer data exchange between controllers.
Used by: S7-300 (MPI port on CPU), S7-400 (MPI port on CPU), some S7-200 variants
FieldbusProfibus DP
Siemens' dominant fieldbus for distributed I/O and drives
Profibus DP (Decentralized Periphery) is a 9-pin RS-485 fieldbus operating at up to 12 Mbps. It is the dominant Siemens fieldbus for connecting distributed I/O, drives, HMIs, and third-party devices to S7-300 and S7-400 controllers.
Used by: S7-300 (built-in DP port on most CPUs), S7-400 (CP 443 or built-in), distributed I/O: ET 200 family
SerialPPI (Point-to-Point Interface)
The native serial protocol of the S7-200 micro PLC family
PPI is the native communication protocol of the S7-200 family. It is a master/slave token-passing serial protocol operating over RS-485 at 9.6 or 19.2 kbps. PPM (Point-to-Point Modem) is a variant supporting dial-up connections via the EM 241 modem module.
Used by: S7-200 (all CPU models: 212, 214, 215, 216, 224, and others)
Embedded OPC UAOPC UA (S7-1500 built-in server)
Standards-based symbolic access built into S7-1500 firmware
S7-1500 controllers with firmware 2.0.1 or newer include a built-in OPC UA server that exposes symbolic tag data directly over standard OPC UA. OPC UA access must be enabled in TIA Portal (disabled by default).
Used by: S7-1500 (firmware 2.0.1 or newer) — not available on S7-300, S7-400, or S7-1200
Legacy SerialAS511 (S5 PG Port)
The programming port protocol for SIMATIC S5 controllers
AS511 is the serial current-loop protocol used on the PG (Programmer) port of SIMATIC S5 controllers. It runs at 9.6 kbps over a 20mA current loop interface.
Used by: S5-100U, S5-101U, S5-115U, S5-135U, S5-155U, S5-90U, S5-95U
Legacy Serial3964 / 3964R Serial
Character-framing serial protocol for S5 data exchange
3964 and 3964R are character-framing serial protocols used by SIMATIC S5 controllers for point-to-point data exchange. 3964R adds a CRC for error detection. These run over RS-232 or RS-422.
Used by: S5-115U, S5-135U, S5-155U
Classic vs. symbolic addressing: the most important practical distinction
The single most practically important difference between connecting to a classic S7 controller (S7-300, S7-400) and a modern TIA Portal controller (S7-1200, S7-1500) is the addressing model. Getting this wrong is the most common source of connectivity problems in mixed Siemens environments.
Classic absolute addressing (S7-300, S7-400, S7-200)
Classic S7 controllers organize data into typed memory areas, each accessed by an offset or bit address. The addressing is absolute — it refers to a specific byte or bit location in memory, not to a named variable. Any OPC server using S7 Comm accesses data this way. If the controller program is modified and a data block is restructured, the absolute addresses change and must be updated in the OPC server tag configuration.
Symbolic addressing (S7-1200, S7-1500 with S7 Comm Plus or OPC UA)
TIA Portal controllers assign every data element a symbolic name at programming time. "Reactor4_Temp_SP" is a tag — it has a name, a data type, and a physical memory location that TIA Portal manages internally. When you access data via S7 Comm Plus or OPC UA, you reference the tag by name. This is far more resilient to program changes: if the controller program is restructured, the tag names remain the same even if the underlying memory layout changes.
Additionally, TIA Portal's "optimized" data blocks — the default in modern projects — deliberately prevent absolute offset access as a safety and efficiency measure. If a controller's data blocks are optimized (and they almost always are in new projects), you cannot access them with classic S7 Comm. You must use S7 Comm Plus or OPC UA.
Classic S7 Comm — absolute addressing
DB1.DBD0REAL in Data Block 1, offset 0
DB1.DBW4WORD in Data Block 1, offset 4
MW100Merker (flag) word at address 100
Q0.0Output bit 0.0
I1.3Input bit 1.3
T5Timer 5
S7 Comm Plus / OPC UA — symbolic addressing
Reactor4_Temp_SPREAL, DB "ReactorControl"
Line2_ConveyorSpeedINT, DB "LineData"
MotorRunningBOOL, DB "DriveStatus"
BatchCounter.TotalDINT, UDT struct member
TempArray[0]REAL, array element
Alarm.HighTempActiveBOOL, nested struct
The optimized block problem: When TIA Portal creates a data block with the default "Optimized block access" setting enabled, Siemens controls the physical memory layout internally. There is no accessible absolute offset. Any driver that uses classic S7 Comm to access the controller will either fail entirely or return incorrect values for optimized blocks. The only correct approaches are S7 Comm Plus (via TOP Server's S7 Plus Ethernet driver) or OPC UA. If you are seeing access errors or bad-quality reads on an S7-1200 or S7-1500, the first thing to check is whether the target data blocks are optimized.
Protocol comparison
The table below summarizes the key characteristics of each Siemens protocol to help engineers identify what they have in the field and what connectivity method is appropriate.
| Protocol | Transport | Addressing | Symbolic access | Optimized blocks | Status |
|---|
| S7 Comm (Industrial Ethernet) | ISO-on-TCP (port 102) | Absolute (DB.offset) | No | No | Classic — widely deployed |
| S7 Comm Plus | TCP/IP (S7+ connection) | Symbolic tag names | Yes | Yes | Current — S7-1200 / S7-1500 |
| OPC UA (embedded S7-1500) | TCP/IP (port 4840) | Symbolic / OPC UA node | Yes | Yes | Current — S7-1500 only |
| MPI | RS-485, 187.5 kbps | Absolute (DB.offset) | No | No | Legacy — requires PC adapter |
| Profibus DP | RS-485, up to 12 Mbps | Process image (via controller) | No | No | Active in installed base |
| PPI (S7-200) | RS-485, 9.6/19.2 kbps | Absolute (V, I, Q, M areas) | No | N/A | Legacy — S7-200 only |
| AS511 (S5 PG port) | 20mA current loop serial | Absolute (E, A, F, D areas) | No | N/A | Legacy — S5 family only |
| 3964 / 3964R | RS-232 / RS-422 serial | Absolute (S5 memory areas) | No | N/A | Legacy — S5 family only |
Which protocol does my Siemens controller use?
Use this matrix to identify which communication protocols are available natively on your controller family, and which require an additional communication processor (CP) module.
| Controller Family | Industrial Ethernet (S7 Comm) | S7 Comm Plus (Symbolic) | OPC UA (Built-in) | MPI | Profibus DP | PPI | AS511 / 3964R |
|---|
| S7-1500 | ✓ | ✓ | ✓
FW 2.0.1+ | – | Via CP | – | – |
| S7-1200 | ✓ | ✓ | – | – | – | – | – |
| S7-400 | Via CP 443 | – | – | ✓ | ✓ | – | – |
| S7-300 | Via CP 343 | – | – | ✓ | ✓ | – | – |
| S7-200 | Via CP 243 | – | – | – | – | ✓ | – |
| S5 (all models) | – | – | – | – | – | – | ✓ |
✓ Native / built-in Via CP = requires communication processor module – = not supported
Siemens Suite vs. Siemens Plus Suite: which do you need?
TOP Server offers two Siemens licensing options. The choice depends entirely on whether you need to access S7-1200 or S7-1500 controllers with symbolic tag addressing and optimized data blocks.
Siemens S5/S7 Suite
✔Siemens TCP/IP Ethernet (S7 Comm)
✔Siemens TCP/IP Server Ethernet (unsolicited)
✔Siemens S7-200 PPI/PPM Serial
✔Siemens S7 MPI
✔Siemens S5 AS511 Serial
✔Siemens S5 3964/3964R Serial
Best for: S7-300, S7-400, S7-200, and S5 controllers. Also works for S7-1200 and S7-1500 with non-optimized blocks via classic S7 Comm.
Siemens Plus SuiteRecommended
✔All 6 drivers from the S5/S7 Suite
+S7 Plus Ethernet (S7-1200 & S7-1500 symbolic)
+OPC UA Client (S7-1500 embedded OPC UA server)
+Access to optimized data blocks
+UDT, array, and structure support
+Password-protected controller access
Best for: Any environment with S7-1200 or S7-1500 controllers, or mixed environments spanning all Siemens generations.
How TOP Server connects to Siemens controllers
TOP Server's Siemens Plus Suite bundles eight drivers in a single license. Each targets a specific protocol family. Here is what each driver does, and which hardware it covers.
S7 Plus Ethernet
Siemens S7 Plus Ethernet Driver
The driver for symbolic access to S7-1200 and S7-1500 controllers using the S7 Comm Plus protocol — no OPC UA required. Connects via the controller's built-in Ethernet port, retrieves the tag database, and allows configuration by tag name. Supports optimized data blocks, UDTs, arrays, strings, nested structures, and all standard TIA Portal data types.
Covers: S7-1500 (all CPU variants, firmware 2.0+), S7-1200 (firmware 4.x+, built-in Ethernet port)
TCP/IP Ethernet
Siemens TCP/IP Ethernet Driver
The classic S7 Comm driver for Industrial Ethernet connectivity. Connects to S7-300 and S7-400 controllers via their CP modules, S7-1200 and S7-1500 via their built-in Ethernet ports (absolute addressing only), and S7-200 via CP 243. Supports Hilscher NetLink adapter for Ethernet-to-MPI conversion.
Covers: S7-1500 (absolute access only), S7-1200, S7-400 (CP 443 or via NetLink), S7-300 (CP 343 or via NetLink), S7-200 (CP 243)
S7-200 PPI/PPM Serial
Siemens S7-200 PPI / PPM Serial Driver
Connects directly to S7-200 CPUs via the PPI serial port using the Siemens PC/PPI cable. Supports both PPI (11-bit cable mode) and PPM (10-bit cable mode for EM 241 modem module).
Covers: S7-200 models: 212, 214, 215, 216, 224, and all other S7-200 CPU variants
S7 MPI
Siemens S7 MPI Driver
Connects to S7-300 and S7-400 controllers via the MPI port using a PC MPI adapter (USB or serial type) or via a null modem cable for direct PC-to-CPU connections. Supports multi-drop MPI networks with stations 0–126.
Covers: S7-300 (MPI port), S7-400 (MPI port); multi-drop configurations up to 32 active stations
OPC UA Client
OPC UA Client Driver
Connects TOP Server to the embedded OPC UA server in S7-1500 controllers (firmware 2.0.1 or newer) as an OPC UA client. This is the second Siemens-approved method for symbolic access to S7-1500 data. Supports certificate-based authentication and encrypted sessions.
Covers: S7-1500 (firmware 2.0.1+, OPC UA enabled in TIA Portal); also general-purpose for any OPC UA server
Ethernet Encapsulation for serial protocols: TOP Server supports Ethernet Encapsulation for the serial-based Siemens drivers (PPI/PPM, MPI, S5 AS511, S5 3964R). This allows a serial-to-Ethernet converter (such as a Moxa NPort or similar device) to bridge the serial protocol over TCP/IP, enabling the PC running TOP Server to be located anywhere on the network rather than requiring a physical serial cable run to the controller. The driver connects to the converter's TCP endpoint and the converter handles the serial communication to the device transparently.
Frequently asked questions
Why can't the Siemens TCP/IP Ethernet driver access optimized data blocks on an S7-1500?+−
TIA Portal's optimized data blocks do not have fixed, predictable memory offsets. Siemens deliberately controls the internal memory layout of optimized blocks for performance and safety reasons, and that layout is not exposed through the classic S7 Comm protocol.
There are two solutions: use the S7 Plus Ethernet driver (S7 Comm Plus protocol), which accesses tags by symbolic names; or use the OPC UA Client driver to connect to the S7-1500's embedded OPC UA server. Both handle optimized blocks correctly.
A third workaround is to convert the target data blocks from "Optimized" to "Standard" in TIA Portal, though this changes the controller project.
How do I enable OPC UA access on an S7-1500?+−
OPC UA is disabled by default on S7-1500 controllers. To enable: open the CPU properties in TIA Portal, navigate to "Protection & Security" > "OPC UA," enable the OPC UA server, configure the port (default 4840), define which tags are exposed, and download the updated configuration. Only firmware 2.0.1 or newer supports the embedded OPC UA server.
What is the difference between the S7 Plus Ethernet driver and the OPC UA Client driver for S7-1500 connectivity?+−
Both provide symbolic access and handle optimized data blocks. The S7 Plus Ethernet driver uses S7 Comm Plus protocol, requires no TIA Portal configuration changes, and also covers S7-1200. The OPC UA Client driver uses the embedded OPC UA server, requires explicit OPC UA enablement in TIA Portal, and supports X.509 certificate security. For most projects, the S7 Plus Ethernet driver is simpler. OPC UA is preferred when security policy requires encrypted connections.
Does the Siemens Plus Suite include a license for all eight drivers?+−
Yes. The Siemens Plus Suite is a single perpetual license that includes all eight drivers: S7 Plus Ethernet, TCP/IP Ethernet, TCP/IP Server Ethernet, S7-200 PPI/PPM Serial, S7 MPI, S5 3964/3964R Serial, S5 AS511 Serial, and OPC UA Client. All drivers can be used simultaneously on the licensed machine.
The base Siemens S5/S7 Suite (without "Plus") includes all drivers except S7 Plus Ethernet and OPC UA Client. Contact Software Toolbox to determine the best option for your device mix.
Ready to connect your Siemens controllers?
TOP Server's Siemens Plus Suite covers every Siemens PLC generation from S5 through S7-1500. Try it free or talk to an engineer about your specific hardware and firmware versions.
