Connecting Siemens PLCs Without TIA Portal: A Practical Guide
Picture an integrator who buys a TIA Portal license to monitor 12 S7-1200 PLCs on a conveyor line. They do not need to program the PLCs, change the ladder logic, configure hardware, or touch a single function block. They need to read a temperature value from Data Block 1 every 5 seconds and display it on a dashboard. The license is spent on a tool designed for a job they are not doing.
This guide explains when you need TIA Portal, when you do not, and how to connect to Siemens S7-1200 and S7-1500 PLCs for monitoring and data collection without it.
What TIA Portal Actually Is
TIA Portal (Totally Integrated Automation Portal) is Siemens' engineering framework. It is an integrated development environment for programming Siemens PLCs, configuring HMI panels, setting up drives, and commissioning automation systems. It is a powerful tool, a Windows-only application, and a commercial product: price depends on the edition and licensing model you buy, so check Siemens' current pricing.
TIA Portal is designed for automation engineers who write PLC programs. It provides ladder logic and structured text editors, hardware configuration tools, network topology planners and firmware management; simulation of PLC code without physical hardware needs the separate PLCSIM option. For a controls engineer building a machine from scratch, TIA Portal is essential. For someone who only wants to monitor that machine's data, it is more than the job needs.
The Misconception: You Need TIA Portal to Talk to Siemens PLCs
This misconception persists for a reason. Siemens' marketing positions TIA Portal as the way to work with Siemens PLCs. Their documentation assumes you own it. Their forums answer questions in the context of TIA Portal workflows. The ecosystem reinforces the assumption that the programming tool and the monitoring tool are the same thing.
They are not. Reading data from a Siemens PLC requires the S7 communication protocol, not TIA Portal. The S7 protocol is proprietary to Siemens, but it has been documented through reverse engineering and is implemented by open-source libraries such as Snap7. It works over TCP/IP on port 102, and it provides direct read/write access to the memory areas of a Siemens PLC: data blocks, inputs, outputs, markers, timers, and counters.
The PLC does not know or care whether the client connecting on port 102 is TIA Portal, an HMI panel, or a third-party SCADA system. It responds to the same S7 protocol requests regardless.
How the S7 Protocol Works
The S7 protocol is a client-server protocol operating over TCP on port 102. A client (SCADA, HMI, monitoring tool) connects to the PLC, sends read or write requests, and receives responses. The protocol uses a compact binary format.
Memory Areas You Can Access
- Data Blocks (DB): user-defined data structures. The most common target for monitoring. DB1, DB10, DB100, etc. Each DB contains variables organized by offset.
- Inputs (I): physical input modules. Each byte represents 8 digital inputs. Updated by the PLC scan cycle.
- Outputs (Q): physical output modules. Written by the PLC program or (carefully) by external systems.
- Markers (M): internal memory flags. General-purpose bits and bytes used in ladder logic.
- Timers (T) and Counters (C): the classic S7 timer and counter areas. S7-1200/1500 programs typically use IEC timers and counters, whose values live in data blocks instead.
Steps to Connect from a SCADA System
- Enable PUT/GET communication on the PLC. In TIA Portal, under the CPU properties, in "Protection & Security" → "Connection mechanisms," check "Permit access with PUT/GET communication from remote partner." This is a one-time configuration step, and it lowers the CPU's protection: any client that can reach port 102 can then read, and depending on the protection level write, CPU data, so keep the PLC on an isolated network.
- Know the PLC's IP address. S7-1200 and S7-1500 PLCs have Ethernet ports with configurable IP addresses. Find this in the network configuration or ask the controls engineer.
- Know the rack and slot numbers. Rack 0, slot 1 for both S7-1200 and S7-1500 using the CPU's built-in port.
- Know the data block numbers and offsets. The controls engineer who programmed the PLC has a symbol table or tag export showing which variables live at which DB offsets. For offset-based reads, the DB must have "Optimized block access" turned off.
- Use an S7 client to connect. Voltrus, Snap7, libnodave, or any S7-compatible client library can establish the connection and read data.
TIA Portal vs a Monitoring Client: What You Pay For
When You DO Need TIA Portal
This is not an argument that TIA Portal is unnecessary. It is necessary for specific jobs:
- Writing or modifying PLC programs: ladder logic, structured text, function blocks
- Hardware configuration: adding I/O modules, configuring communication interfaces
- Firmware updates: updating the PLC operating system (also possible through the CPU web server or a memory card on some CPUs)
- Network topology configuration: PROFINET device naming and topology
- Safety program configuration: Siemens safety-integrated functions
- Initial commissioning: first-time setup of a new PLC
If your job involves any of these tasks, you need TIA Portal. Budget accordingly. But if your job involves reading data from an already-commissioned PLC and displaying it on a dashboard, you do not need TIA Portal. You need an S7 protocol client.
How Voltrus Connects to Siemens PLCs
Voltrus includes a built-in S7 protocol driver. No middleware. No OPC server. No protocol gateway. Configure the connection in three fields:
Connection Configuration
- IP Address: the PLC's Ethernet IP (e.g., 192.168.0.10)
- Rack: typically 0
- Slot: 1 for S7-1200 and S7-1500 (built-in port)
Data Block Mapping
Once connected, Voltrus reads the available data blocks and presents them in a visual browser. You see DB1, DB10, DB100, each with their variables, data types, and current values. Drag any variable onto a dashboard widget. The mapping is visual, not code-based.
For integrators who need to monitor multiple PLCs, Voltrus supports multiple simultaneous S7 connections. Monitor an S7-1200 on the packaging line and an S7-1500 on the main process line from the same dashboard.
Data Types Supported
BOOL, BYTE, WORD, DWORD, INT, DINT, REAL (float), STRING, CHAR, and arrays of each. Voltrus handles the byte-swapping and type conversion automatically, so you do not need to decode Siemens' big-endian byte order yourself.
Monitor Siemens PLCs Without TIA Portal
Voltrus includes a built-in S7 protocol driver for direct PLC connection. No middleware. No programming IDE. Just data: from the PLC to your dashboard.
Explore Voltrus