Files

Joseph Doherty 969b0847a1 docs: update path references for module-folder reorganization

Rewrite src/ and tests/ project paths in docs, CLAUDE.md, README.md, and
test-fixture READMEs to the new module-folder layout (Core/Server/Drivers/
Client/Tooling). References to retired v1 projects (Galaxy.Host/Proxy/Shared,
the legacy monolithic test projects) are left untouched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-17 02:10:29 -04:00

2.7 KiB

Raw Blame History

`otopcua-s7-cli` — Siemens S7 test client

Ad-hoc probe / read / write / subscribe tool for Siemens S7-300 / S7-400 / S7-1200 / S7-1500 (and compatible soft-PLCs) over S7comm / ISO-on-TCP port 102. Uses the same S7Driver the OtOpcUa server does (S7.Net under the hood).

Fourth of four driver test-client CLIs.

Build + run

dotnet run --project src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli -- --help

Common flags

Flag	Default	Purpose
`-h` / `--host`	required	PLC IP or hostname
`-p` / `--port`	`102`	ISO-on-TCP port (rarely changes)
`-c` / `--cpu`	`S71500`	S7200 / S7200Smart / S7300 / S7400 / S71200 / S71500
`--rack`	`0`	Hardware rack (S7-400 distributed setups only)
`--slot`	`0`	CPU slot (S7-300 = 2, S7-400 = 2 or 3, S7-1200/1500 = 0)
`--timeout-ms`	`5000`	Per-operation timeout
`--verbose`	off	Serilog debug output

PUT/GET must be enabled

S7-1200 / S7-1500 ship with PUT/GET communication disabled by default. Enable it in TIA Portal: Device config → Protection & Security → Connection mechanisms → "Permit access with PUT/GET communication from remote partner". Without it the CLI's first read will surface BadNotSupported.

S7 address grammar cheat sheet

Form	Meaning
`DB1.DBW0`	DB number 1, word offset 0
`DB1.DBD4`	DB number 1, dword offset 4
`DB1.DBX2.3`	DB number 1, byte 2, bit 3
`DB10.STRING[0]`	DB 10 string starting at offset 0
`M0.0`	Merker bit 0.0
`MW0` / `MD4`	Merker word / dword
`IW4`	Input word 4
`QD8`	Output dword 8

Commands

`probe`

# S7-1500 — default probe MW0
otopcua-s7-cli probe -h 192.168.1.30

# S7-300 (slot 2)
otopcua-s7-cli probe -h 192.168.1.31 -c S7300 --slot 2 -a DB1.DBW0

`read`

# DB word
otopcua-s7-cli read -h 192.168.1.30 -a DB1.DBW0 -t Int16

# Float32 from DB dword
otopcua-s7-cli read -h 192.168.1.30 -a DB1.DBD4 -t Float32

# Merker bit
otopcua-s7-cli read -h 192.168.1.30 -a M0.0 -t Bool

# 80-char S7 string
otopcua-s7-cli read -h 192.168.1.30 -a DB10.STRING[0] -t String --string-length 80

`write`

otopcua-s7-cli write -h 192.168.1.30 -a DB1.DBW0 -t Int16 -v 42
otopcua-s7-cli write -h 192.168.1.30 -a DB1.DBD4 -t Float32 -v 3.14
otopcua-s7-cli write -h 192.168.1.30 -a M0.0 -t Bool -v true

Writes to M / Q are real — they drive the PLC program. Be careful what you flip on a running machine.

`subscribe`

otopcua-s7-cli subscribe -h 192.168.1.30 -a DB1.DBW0 -t Int16 -i 500

S7comm has no native push — the CLI polls through PollGroupEngine just like Modbus / AB.

2.7 KiB Raw Blame History

otopcua-s7-cli — Siemens S7 test client