How to integrate Siemens S7 PLCs with open SCADA using Snap7

The challenge of connecting the factory floor to open software

In the world of industrial automation, PLCs (Programmable Logic Controllers, which act as the electronic brains of machines) from Siemens communicate exceptionally well with the brand's own software. However, when engineers need to integrate these devices with open SCADA systems (supervisory software that monitors industrial processes in real time), protocol barriers usually appear. In practice, this means manufacturers close their ecosystems to force purchases of expensive licenses. To bypass this commercial bottleneck without violating safety standards, engineers turn to open-source communication libraries.

It is precisely in this scenario that Snap7 stands out as an indispensable tool. It is a free, open-source library developed specifically to communicate with Siemens' SIMATIC S7 line. While commercial software charges fortunes for communication drivers, Snap7 allows any modern programming language — such as Python, C++, or C# — to talk directly to the controller's memory. If you have ever needed to extract temperature data or send start commands to a conveyor belt without spending on proprietary licenses, you know the value of a robust and free alternative.

How the ISO-on-TCP protocol works under the hood

To understand Snap7, we must first look at the network. Siemens S7 PLCs use a proprietary protocol stack running over ordinary industrial Ethernet networks. At the transport layer, they employ ISO-on-TCP, which basically encapsulates industrial messages inside standard network packets that any computer can send and receive. In practice, your computer or Linux server acts as an HMI (Human-Machine Interface) on the network, talking directly to the controller's communication port.

When configuring the connection, we provide the PLC's IP address and two crucial parameters: the Rack and the Slot. These numbers physically indicate where the processor is housed in the electrical panel rack. With this data, the library establishes a direct TCP communication channel. It is a process very similar to opening an SSH connection to a remote server, but instead of typing terminal commands, you are reading and writing directly to memory locations called data blocks, or DBs.

Preparing the Siemens PLC in TIA Portal

Before writing any code to read data from your PLC, you need to make a small change in Siemens' programming software, TIA Portal. By default, recent versions of S7-1200 and S7-1500 controllers come with a security and block optimization feature enabled, which scrambles memory addresses for performance gains. For Snap7 to find data predictably, we must disable this optimization.

Open the desired data block (DB) in the project properties, uncheck the optimized block access option, and recompile the project before downloading it to the hardware. Additionally, in the CPU protection settings, enabling permission for PUT/GET communication access from external partners is fundamental. Without this explicit authorization, the PLC will reject any connection attempts coming from outside its proprietary software bubble, generating frustrating timeout errors in your supervisory application.

Reading and writing data using Python scripts

Now that the groundwork is laid, let's get hands-on with a practical example using Python and the python-snap7 library. This approach is excellent for powering custom web-based SCADA systems, Grafana dashboards, or monitoring tools like how to monitor Docker containers with Prometheus and Grafana. The library translates complex network calls into simple memory block read and write functions.

The code below connects to the PLC, reads an entire data block, and alters the value of a boolean variable controlling a process valve. Remember to install the library via terminal with the pip command before running the script on your workstation or industrial server.

import snap7
from snap7.util import *

# Initialize client and connect to PLC
client = snap7.client.Client()
client.connect('192.168.0.1', 0, 1)  # IP, Rack, Slot

if client.get_connected():
    print('Successfully connected to Siemens PLC!')
    
    # Read 100 bytes starting from Data Block DB1, address 0
    db_number = 1
    start_address = 0
    size = 100
    data = client.db_read(db_number, start_address, size)
    
    # Extract a boolean value located at byte 0, bit 0
    current_status = get_bool(data, 0, 0)
    print(f'Current valve status: {current_status}')
    
    # Write a new boolean value to the same address
    set_bool(data, 0, 0, True)
    client.db_write(db_number, start_address, data)
    print('New command sent successfully!')
    
    client.disconnect()
else:
    print('Failed to connect to PLC.')

Error handling and best practices in industrial environments

The factory floor is a harsh environment for software. Electromagnetic interference, damaged cables, or sudden reboots of the electrical panel can drop the network connection at any moment. If your SCADA application freezes due to a network drop, the operator loses process visibility, which is unacceptable. Therefore, never blindly trust the persistence of the Snap7 connection.

Implementing try-except blocks and automatic reconnection routines is mandatory. Whenever a read fails, the code should log the error, wait a few seconds, and attempt to re-establish the TCP channel without disrupting the supervisory main loop. In plants requiring high availability and power redundancy, it is worth checking electrical infrastructure best practices and how to size industrial UPS for critical plants to ensure neither the SCADA computer nor the PLC shuts down unexpectedly.

Final considerations

Integrating Siemens S7 PLCs with open SCADA systems through Snap7 opens up a massive range of economic and architectural possibilities for modern engineering. By eliminating exclusive dependence on expensive proprietary drivers, engineers and integrators gain total freedom to build custom web interfaces, integrate industrial data with artificial intelligence, and construct modern dashboards in open-source tools. Although it requires careful attention to network security, disabling optimized blocks, and robust connection failure handling, the effort pays off the first time you see a custom supervisory system running with total fluidity and zero license cost.