dohertj2/lmxopcua
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

S7: Timer/Counter numbering and BCD decode need a real S7-300/400 CPU #616

New Issue
Open
opened 2026-10-08 02:31:14 -04:00 by dohertj2 · 3 comments
dohertj2 commented 2026-10-08 02:31:14 -04:00
Owner
Copy Link
Copy Source

python-snap7 resolves TM/CT as bit addresses, so TM/CT decode at a non-zero device number is unproven (test + S7_TIMER_NUMBER_ADDRESSING=1 ready). Classic C-area counters are BCD but S7.Net returns the raw word.
Sources: docs/drivers/S7.md:140-145; S7Driver.cs:1349-1351; docs/plans/2026-08-17-perf-followups-r3.md.

  • Run the TM/CT test on a real CPU
  • BCD reinterpretation for legacy C-area counters behind a per-family switch + live check

Filed 2026-10-08 by the pending/deferred-work sweep after the #562–#591 issue sweep.

python-snap7 resolves TM/CT as bit addresses, so TM/CT decode at a non-zero device number is unproven (test + `S7_TIMER_NUMBER_ADDRESSING=1` ready). Classic C-area counters are BCD but S7.Net returns the raw word. Sources: docs/drivers/S7.md:140-145; S7Driver.cs:1349-1351; docs/plans/2026-08-17-perf-followups-r3.md. - [ ] Run the TM/CT test on a real CPU - [ ] BCD reinterpretation for legacy C-area counters behind a per-family switch + live check _Filed 2026-10-08 by the pending/deferred-work sweep after the #562–#591 issue sweep._
dohertj2 added the driver/s7 label 2026-10-08 02:31:14 -04:00
dohertj2 commented 2026-10-08 18:52:11 -04:00
Author
Owner
Copy Link
Copy Source

From #632: driver-gaps item #303 (S7 PLC password / protection) is tracked here.

From #632: driver-gaps item #303 (S7 PLC password / protection) is tracked here.
dohertj2 commented 2026-10-11 15:29:49 -04:00
Author
Owner
Copy Link
Copy Source

Evaluated adalbertuschris/PLC_Sim as a substitute for a real CPU (2026-10-11) — not usable.

Reviewed its S7comm handler (Packets/S7PacketGenerator.cs):

  • No PUT/GET data access. The only Job functions it answers are setup-communication (0xF0), download (0x1A), PLC control (0x28) and PLC stop (0x29). There is no Read Var (0x04) / Write Var (0x05), so S7.Net (and our S7 driver) could connect but could not read anything — including the T/C areas.
  • No timers/counters. Its engine runs only basic ladder logic on digital I/O; most other responses are byte arrays replayed from a TIA Portal v13 session.
  • Unmaintained / unlicensed: Windows Forms app, 4 commits (last Jan 2019), no LICENSE — can't be patched or vendored as a fixture.

More fundamentally, any community emulator would only echo our own assumptions about T/C numbering and BCD — the same problem we already have with python-snap7 — so it cannot close this issue.

Viable paths:

  1. A real S7-300/400 CPU (the issue as written).
  2. Classic Siemens PLCSIM (ships with STEP 7 / TIA Portal; runs real S7-300/400 T/C semantics) + NetToPLCsim (free bridge exposing it on TCP 102). The existing TM/CT test (S7_TIMER_NUMBER_ADDRESSING=1) and a BCD counter check could run against it. Requires a Windows box with a STEP 7/TIA licence.
**Evaluated [adalbertuschris/PLC_Sim](https://github.com/adalbertuschris/PLC_Sim) as a substitute for a real CPU (2026-10-11) — not usable.** Reviewed its S7comm handler (`Packets/S7PacketGenerator.cs`): - **No PUT/GET data access.** The only Job functions it answers are setup-communication (0xF0), download (0x1A), PLC control (0x28) and PLC stop (0x29). There is no Read Var (0x04) / Write Var (0x05), so S7.Net (and our S7 driver) could connect but could not read anything — including the T/C areas. - **No timers/counters.** Its engine runs only basic ladder logic on digital I/O; most other responses are byte arrays replayed from a TIA Portal v13 session. - **Unmaintained / unlicensed:** Windows Forms app, 4 commits (last Jan 2019), no LICENSE — can't be patched or vendored as a fixture. More fundamentally, any community emulator would only echo our own assumptions about T/C numbering and BCD — the same problem we already have with python-snap7 — so it cannot close this issue. **Viable paths:** 1. A real S7-300/400 CPU (the issue as written). 2. Classic **Siemens PLCSIM** (ships with STEP 7 / TIA Portal; runs real S7-300/400 T/C semantics) + **NetToPLCsim** (free bridge exposing it on TCP 102). The existing TM/CT test (`S7_TIMER_NUMBER_ADDRESSING=1`) and a BCD counter check could run against it. Requires a Windows box with a STEP 7/TIA licence.
dohertj2 commented 2026-10-13 09:22:00 -04:00
Author
Owner
Copy Link
Copy Source

Read-only source review found a readiness problem in the real-CPU Timer/Counter gate: C7 expects raw 31337, unsuitable as a meaningful classic SIMATIC count (documented range 0..999). Siemens documents binary L/CV and distinct BCD LC/CV_BCD representations; that does not establish the S7comm C-area wire representation. Keep the current decoder and this issue open pending independent raw response plus PLC-side binary/BCD reference evidence. Do not select wire decoding solely from CPU family. Suggested next slice is fixture/documentation readiness using a valid count and explicit unresolved wire evidence, with no driver behavior change. No hardware probe or test change performed.

Primary references: https://docs.tia.siemens.cloud/r/en-us/v21/stl-s7-300-s7-400/stl-mnemonic-s7-300-s7-400/counter-operations-s7-300-s7-400/l-load-counter-s7-300-s7-400 and https://docs.tia.siemens.cloud/r/en-us/v21/lad-s7-300-s7-400/counter-operations-s7-300-s7-400/simatic-counters-s7-300-s7-400/s_cd-assign-parameters-and-count-down-s7-300-s7-400?contentId=reR_xapFX_Ike2opHIvfzg

Read-only source review found a readiness problem in the real-CPU Timer/Counter gate: C7 expects raw 31337, unsuitable as a meaningful classic SIMATIC count (documented range 0..999). Siemens documents binary L/CV and distinct BCD LC/CV_BCD representations; that does not establish the S7comm C-area wire representation. Keep the current decoder and this issue open pending independent raw response plus PLC-side binary/BCD reference evidence. Do not select wire decoding solely from CPU family. Suggested next slice is fixture/documentation readiness using a valid count and explicit unresolved wire evidence, with no driver behavior change. No hardware probe or test change performed. Primary references: https://docs.tia.siemens.cloud/r/en-us/v21/stl-s7-300-s7-400/stl-mnemonic-s7-300-s7-400/counter-operations-s7-300-s7-400/l-load-counter-s7-300-s7-400 and https://docs.tia.siemens.cloud/r/en-us/v21/lad-s7-300-s7-400/counter-operations-s7-300-s7-400/simatic-counters-s7-300-s7-400/s_cd-assign-parameters-and-count-down-s7-300-s7-400?contentId=reR_xapFX_Ike2opHIvfzg
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 cross-driver
queue management
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
No Label driver/s7
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#616
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?