The short answer
Siemens
Siemens controllers are less common than Rockwell or Schneider in North American water utilities but arrive regularly inside packaged equipment from European manufacturers, membrane skids, ultraviolet systems, dewatering equipment, and generators, and are the standard in many plants elsewhere. The current families are the compact S7-1200 and the modular S7-1500, both programmed in TIA Portal with PROFINET as the native network; the older S7-300 and S7-400 run under the classic STEP 7 software with PROFIBUS and are in their phase-out period. The platform has a block-oriented program model with organization blocks as the entry points, function blocks with instance data blocks, and data blocks for storage, a mandatory memory card on the S7-1500 that holds the project, and access protection levels on the CPU that must be understood before anyone connects. Modbus TCP and OPC UA make it interoperable with the rest of a plant.
Key points
- S7-1200 compact and S7-1500 modular with TIA Portal and PROFINET; S7-300 and S7-400 with the classic software and PROFIBUS.
- Blocks: organization blocks are the tasks, function blocks with instance data blocks are the reusable logic, data blocks are the storage.
- The S7-1500 project lives on its memory card; the card is the controller memory.
- CPU protection levels control read, write, and HMI access; know the password before a site visit.
- Modbus TCP and OPC UA are the usual bridges to SCADA and to other controllers.
Families
| Family | Software | Network | Notes |
|---|---|---|---|
| S7-1200 | TIA Portal | PROFINET built in | Compact; signal boards and expansion modules; typical for a skid or a small station |
| S7-1500 | TIA Portal | PROFINET built in, PROFIBUS by module | Modular; a display on the CPU; distributed I/O families for the field; redundant variants |
| S7-300 | STEP 7 classic | PROFIBUS, PROFINET by CPU or module | Widely installed; in phase-out; migration target is S7-1500 |
| S7-400 | STEP 7 classic | PROFIBUS, PROFINET | Large and redundant systems in older plants; migration target is S7-1500 and its redundant variants |
The block model
- Organization blocks
- The entry points the operating system calls: the cyclic main block, cyclic interrupts at fixed periods, hardware interrupts, the startup block, and the diagnostic and error blocks. They are the task model.
- Function blocks
- Reusable logic with memory; each use has an instance data block that holds its state. The pump and valve blocks of a site library.
- Functions
- Reusable logic without memory; calculations and conversions.
- Data blocks
- Structured storage; global data blocks for shared data, instance data blocks for function block state.
- Optimized and standard access
- Optimized blocks are addressed by name only and are faster; standard blocks allow absolute addressing, which some communication methods need. The choice is per block and matters for SCADA access.
Languages are ladder, function block diagram, structured control language, which is the structured text of the platform, statement list on the larger families, and a graph language for sequences on the S7-1500. The program structure is the same across the families, which is what makes migration from the older families a conversion rather than a rewrite.
Memory card and protection
On the S7-1500 the memory card is not a backup; it is where the project is stored and the controller runs from it. A card removed from a running system stops it; a card from another system starts that other project. The card is labeled and its contents recorded. The CPU has protection levels: full access, read access, HMI access only, and no access, each with a password, and a block can carry know-how protection that hides its logic. A site visit begins with knowing which level is set and having the password from the site record, because a CPU at a restrictive level with an unknown password cannot be read.
Communications
- PROFINET for distributed I/O, drives, and controller-to-controller data; ring topology with media redundancy where the devices support it.
- PROFIBUS on the older families and by module on the S7-1500 for older devices.
- Modbus TCP as client or server through library blocks, which is the usual link to non-Siemens devices and SCADA.
- OPC UA server built into the S7-1500 and recent S7-1200 firmware, which is the cleanest link to SCADA and historians.
- The native S7 communication used by Siemens HMIs and some SCADA drivers, with access controlled by the protection level and, on recent firmware, disabled by default for put and get access from other devices.
In a water plant
The most common encounter is a packaged system with its own S7-1200 or S7-1500 and its own touchscreen, delivered by the equipment manufacturer with a Modbus TCP or OPC UA interface to the plant SCADA. The plant does not usually own the program; it owns the interface, and the interface document listing every register or node, its meaning, and its units is the item to obtain at delivery. Plants that run Siemens throughout have the same needs as any other platform: the site library, the backup discipline, the version record, and a machine that runs the software version each controller needs.
Frequently asked questions
- Can the plant SCADA read a Siemens skid controller directly?
- Over Modbus TCP if the manufacturer enabled a Modbus server in the program, over OPC UA if the CPU offers it and the nodes are exposed, or over the native protocol with a driver, subject to the protection level and the put and get setting. The interface document from the manufacturer says which.
- The CPU refuses the connection with a password prompt we do not have.
- The protection level is set and the password is with whoever built it. Contact the manufacturer or integrator; a CPU at a restrictive level cannot be read without it, and resetting the CPU to factory settings erases the program.
- Is the S7-300 still supported?
- It is in the manufacturer phase-out program with defined dates for the end of delivery and of service; check the current status. Plan migration for any S7-300 that runs a critical process, with the classic software kept alive until the conversion is done.
- What is different about optimized blocks for SCADA?
- Optimized blocks have no absolute addresses, so drivers that read by address cannot reach them; drivers that read by symbolic name, and OPC UA, can. A data block that SCADA must read by address is set to standard access, or the data is copied to one that is.
Related topics
- IEC 61131-3The standard behind PLC programming languages: the five languages, the common elements of data types, variables, and program organization units, what conformance actually means, and how the standard shows up in real platforms.
- OPC UAWhat OPC UA is for, how its information model, security, and transports differ from OPC Classic, where it belongs in a plant, and what to check before relying on it.
- Modbus TCPModbus over Ethernet: what the MBAP header changes, why the CRC disappears, how the unit identifier works, and what does not get easier just because it is on Ethernet.
- Tasks and Execution PriorityHow a controller schedules its work: the continuous task, periodic tasks at a fixed rate, event tasks triggered by something happening, how priority preempts, and where each kind of logic belongs.
- Controller HardeningWhat can be locked down on a PLC or RTU: keyswitch and mode, credentials, unused services, access lists, firmware, and the engineering workstation that is the real target.
- Legacy SystemsKeeping older controllers running and planning a migration: the families still found in water plants, the risks that grow each year, software to keep alive, batteries and memory, tested spares, the security problem, and a migration the plant can survive.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.