Can I read data blocks without knowing the structure?

You need the byte offset and type of each value, for example DB1.DBD0 as a Real. Add tags to the tag table with those addresses. The block manager lists the blocks in the PLC and can save a block to a file.

Part of: Field tools

Talk to Siemens S7 PLCs
from your Mac.
No Windows.

Read and write Siemens S7-300, S7-400, S7-1200 and S7-1500 data blocks and memory areas from a native Mac app. No VM, no Parallels. Enter the IP and connect.

Download for Mac (free) Buy Pro · $29.99 See what it does

Free

Pro $29.99

300 to 1500

S7-300, 400, 1200, 1500 CPUs

DB · M · I · Q · T · C

Memory areas

macOS

Apple Silicon and Intel

S7 Explorer screenshot: a list of S7 PLC addresses read live as Real, Word, DWord or Bool values. — A list of S7 PLC addresses read live as Real, Word, DWord or Bool values.

S7 Explorer screenshot: a live chart of three PLC tags beside the tag table. — A live chart of three PLC tags beside the tag table.

S7 Explorer screenshot: cPU module information and the diagnostic buffer with timestamped events. — CPU module information and the diagnostic buffer with timestamped events.

Demo video

Watch the demo

A tour of S7 Explorer for Mac: live tags, CPU diagnostics, a built-in S7 server, trends and program block management.

Chapters

The Problem

Siemens tooling is Windows-only.

TIA Portal, Step 7 and WinCC all run on Windows. On a Mac that means Parallels, a Windows license, USB passthrough on Apple Silicon and x86 emulation, just to read one data block.

The VM Tax

Parallels Desktop is a yearly subscription. Add a Windows license and the TIA Portal license itself, just to read one data block.

USB Passthrough Issues

USB-Ethernet adapters and PROFINET interfaces can be awkward to pass through to a Windows VM on Apple Silicon, and connections can drop mid-session.

ARM Translation

x86 Windows PLC software on an M-series Mac runs under emulation inside the VM. That can mean slow starts and compatibility warnings.

"Buy a Windows PC"

The usual advice for Mac users who ask about PLC tools is to get a Windows PC. That is not much help when you only need to read a value.

Features

S7 communication without the overhead.

Tag Table

Add tags by S7 address (DB1.DBD0, MW100, I0.0, T5, C10) with data types Bool, Byte, Word, DWord, Real and String. Values are polled into one table.

Read + Write

Read data blocks (DB), marker memory (M), inputs (I), outputs (Q), timers (T), and counters (C). Write values to the PLC. Timers appear in milliseconds and counters as 0 to 999, and both are read-only.

Live Monitoring

Watch tag values update with configurable poll intervals. Monitor process values, setpoints, and status flags without TIA Portal.

Block Manager

List the blocks in the PLC (OB, FB, FC, DB, SDB, SFC, SFB), save a block to a file, or delete one.

Several PLCs

Open more than one PLC connection and switch between them with tabs.

PLC Information

Read the CPU model, firmware version and serial number, check RUN/STOP state, read the diagnostic buffer and list program blocks, all without TIA Portal.

Screenshots

See it in action

S7 Explorer screenshot: a block manager listing organization, function and data blocks on the controller. — A block manager listing organization, function and data blocks on the controller.

S7 Explorer screenshot: a built-in S7 server loaded from a process control template. — A built-in S7 server loaded from a process control template.

Compare

How it compares to what you're using now

The two usual workarounds on a Mac, side by side.

Price

Free, Pro $29.99 one-time

VM + Windows + TIA license

Free

Native macOS

Yes: Apple Silicon

No: Windows VM

CLI only

Setup time

Enter IP, connect

Install VM + TIA Portal

Build from source

Read data blocks

Yes: with GUI

Yes

Yes: CLI

Write data blocks

Yes

Yes: CLI

Live monitoring

Yes: polled tag table

Yes

No: script it yourself

Tag list import

CSV, including TIA Portal tag table exports

Yes

Several PLCs

Yes: tabs

Yes

Write your own

Block list, save and delete

Yes

Partly: library calls

PLC diagnostics

Yes: CPU info, mode, diag buffer

Full diagnostics

Subscription

None: one-time

VM subscription

N/A

Part of: Field tools · Debug one device from your laptop: protocol apps, terminal database browsers, utilities.

How MacTools S7 Explorer differs from…

Voltrus SCADA
This app is for commissioning and debugging one device from your laptop. Voltrus SCADA watches many devices around the clock, with dashboards, alarms and history on your own hardware.
Voltrus Gateway
Voltrus Gateway has no screens to click through: it is a self-hosted service that exposes Modbus, OPC UA, EtherNet/IP, S7, DNP3, BACnet/IP and MQTT to your own software over one gRPC API.

Next step

Not sure? See which one you need →

FAQ

Common questions

Which Siemens PLCs are supported?+

S7-300, S7-400, S7-1200 and S7-1500 over ISO-on-TCP (port 102). Set the rack and slot for your CPU: usually rack 0, slot 1 on S7-300/400 and slot 0 on S7-1200/1500. On S7-1200 and S7-1500 you must enable PUT/GET access in the CPU's protection settings and turn off optimized block access for the data blocks you read.

Do I need TIA Portal to use this?+

Not to run S7 Explorer. It communicates directly with the PLC over Ethernet using the S7 protocol, with no Windows VM. On S7-1200 and S7-1500 the PLC itself must allow PUT/GET access, which is a CPU setting made once in TIA Portal by whoever maintains the project.

What memory areas can I access?+

Data blocks (DB), marker memory (M), inputs (I), outputs (Q), timers (T), and counters (C). With Pro, values can be written with Bool, Byte, Word, DWord, Real and String types. The free download reads up to 10 live tags. Timers (shown in milliseconds) and counters (0 to 999) are read-only.

Does it work over Wi-Fi?+

Yes, as long as your Mac is on the same network as the PLC. For production environments, a wired Ethernet connection is recommended for reliability.

Is this a subscription?+

No. The app is a free download. Pro is an optional one-time licence key for $29.99, bought through the Voltrus Console. There is no subscription.

Get it free

Talk to S7 PLCs without Windows.

S7 Explorer is a free download for Mac. The DMG is signed and notarized by Apple, so it opens normally. An optional Pro licence key, $29.99 one-time, unlocks the Pro features below. The source is on GitHub under GPL-3.0.

Download for Mac (free) Buy Pro · $29.99 Source on GitHub Contact support

Optional Pro, $29.99 one-time licence key

Unlimited live tags (free: 10) and several PLC connections at once
Write values to the PLC
Live trends
Tag list CSV import (TIA Portal tag table) and export, value logging to CSV
Block manager: list, save to file, delete
Built-in S7 simulator server

Pro is a one-time purchase on the Voltrus Console. Your key arrives by email and in your console account. No subscription.

From one device to the whole line

Monitoring this PLC 24/7?

S7 Explorer is built for commissioning and debugging. For round-the-clock monitoring use Voltrus OEE (hosted, live availability and downtime per machine) or Voltrus SCADA (dashboards, alarms and history on your own hardware).

Voltrus OEE → Voltrus SCADA →

Get new tools, releases and protocol guides by email. A few emails a month, unsubscribe anytime.

Also from MacTools