Sign Up for Free

RunKit +

Try any Node.js package right in your browser

This is a playground to test code. It runs a full Node.js environment and already has all of npm’s 400,000 packages pre-installed, including node-red-contrib-s7 with all npm packages installed. Try it out:

node-red-contrib-s7 lists no main file and has no index.js, so it can't be directly required. If this is a mistake, please let us know. It may however contain internal files that you can require manually:

// require("node-red-contrib-s7/[??]")

This service is provided by RunKit and is not affiliated with npm, Inc or the package authors.

node-red-contrib-s7 v2.0.2

A Node-RED node to interact with Siemens S7 PLCs


A Node-RED node to interact with Siemens S7 PLCs. Based on the awesome work of plcpeople/nodes7.

This node was created by Smart-Tech as part of the ST-One project.


You can install this node directly from the "Manage Palette" menu in the Node-RED interface. An optional compilation step is only necessary for supporting MPI-USB adapter.

Alternatively, run the following command in your Node-RED user directory - typically ~/.node-red on Linux or %HOMEPATH%\.nodered on Windows

    npm install node-red-contrib-s7


Each connection to a PLC is represented by the S7 Endpoint configuration node. You can configure the PLC's Address, the variables available and their addresses, and the cycle time for reading the variables.

The S7 In node makes the variable's values available in a flow in three different modes:

  • Single variable: A single variable can be selected from the configured variables, and a message is sent every cycle, or only when it changes if diff is checked. msg.payload contains the variable's value and msg.topic has the variable's name.
  • All variables, one per message: Like the Single variable mode, but for all variables configured. If diff is checked, a message is sent everytime any variable changes. If diff is unchecked, one message is sent for every variable, in every cycle. Care must be taken about the number of messages per second in this mode.
  • All variables: In this mode, msg.payload contains an object with all configured variables and their values. If diff is checked, a message is sent if at least one of the variables changes its value.

Variable addressing

The variables and their addresses configured on the S7 Endpoint follow a slightly different scheme than used on Step 7 or TIA Portal. Here are some examples that may guide you on addressing your variables:

AddressStep7 equivalentJS Data typeDescription
DB5,X0.1DB5.DBX0.1BooleanBit 1 of byte 0 of DB 5
DB23,B1 or DB23,BYTE1DB23.DBB1NumberByte 1 (0-255) of DB 23
DB100,C2 or DB100,CHAR2DB100.DBB2StringByte 2 of DB 100 as a Char
DB42,I3 or DB42,INT3DB42.DBW3NumberSigned 16-bit number at byte 3 of DB 42
DB57,WORD4DB57.DBW4NumberUnsigned 16-bit number at byte 4 of DB 57
DB13,DI5 or DB13,DINT5DB13.DBD5NumberSigned 32-bit number at byte 5 of DB 13
DB19,DW6 or DB19,DWORD6DB19.DBD6NumberUnsigned 32-bit number at byte 6 of DB 19
DB21,DR7 or DB21,REAL7DB19.DBD6NumberFloating point 32-bit number at byte 7 of DB 21
DB2,S7.10*-StringString of length 10 starting at byte 7 of DB 2
I1.0 or E1.0I1.0 or E1.0BooleanBit 0 of byte 1 of input area
Q2.1 or A2.1Q2.1 or A2.1BooleanBit 1 of byte 2 of output area
M3.2QM3.2BooleanBit 2 of byte 3 of memory area
IB4 or EB4IB4 or EB4NumberByte 4 (0 -255) of input area
QB5 or AB5QB5 or AB5NumberByte 5 (0 -255) of output area
MB6MB6NumberByte 6 (0 -255) of memory area
IC7 or EC7IB7 or EB7StringByte 7 of input area as a Char
QC8 or AC8QB8 or AB8StringByte 8 of output area as a Char
MC9MB9StringByte 9 of memory area as a Char
II10 or EI10IW10 or EW10NumberSigned 16-bit number at byte 10 of input area
QI12 or AI12QW12 or AW12NumberSigned 16-bit number at byte 12 of output area
MI14MW14NumberSigned 16-bit number at byte 14 of memory area
IW16 or EW16IW16 or EW16NumberUnsigned 16-bit number at byte 16 of input area
QW18 or AW18QW18 or AW18NumberUnsigned 16-bit number at byte 18 of output area
MW20MW20NumberUnsigned 16-bit number at byte 20 of memory area
IDI22 or EDI22ID22 or ED22NumberSigned 32-bit number at byte 22 of input area
QDI24 or ADI24QD24 or AD24NumberSigned 32-bit number at byte 24 of output area
MDI26MD26NumberSigned 32-bit number at byte 26 of memory area
ID28 or ED28ID28 or ED28NumberUnsigned 32-bit number at byte 28 of input area
QD30 or AD30QD30 or AD30NumberUnsigned 32-bit number at byte 30 of output area
MD32MD32NumberUnsigned 32-bit number at byte 32 of memory area
IR34 or ER34IR34 or ER34NumberFloating point 32-bit number at byte 34 of input area
QR36 or AR36QR36 or AR36NumberFloating point 32-bit number at byte 36 of output area
MR38MR38NumberFloating point 32-bit number at byte 38 of memory area

*) Note that strings on the PLC uses 2 extra bytes at start for size/length of the string

Notes on S7-1200/1500

These newer PLCs offer an "extended" version of the S7 Protocol, while we have only a "basic" version of it.

Therefore, some additional configuration steps on the PLC are necessary:

  • "Optimized block access" must be disabled for the DBs we want to access (image)
  • In the "Protection" section of the CPU Properties, enable the "Permit access with PUT/GET" checkbox (image)


  • Perform data type validation on the variables list, preventing errors on the runtime

Bugs and enhancements

Please share your ideas and experiences on the Node-RED forum, or open an issue on the page of the project on GitHub


Copyright 2016-2019 Smart-Tech, Apache 2.0 license.


RunKit is a free, in-browser JavaScript dev environment for prototyping Node.js code, with every npm package installed. Sign up to share your code.
Sign Up for Free