Reprogramming Siemens simatic s7-200 smart PLC controllers?

I realize it’s a long shot, and that there are probably better forums on which to post this question.

That said; I’m looking for resources (software) for accessing the Siemens s7-200 PLC controllers that seem to come standard with the Chinese centrifuges I’m dealing with.

I’ve had no luck poking at (several different) centrifuge OEM, nor Siemens, but I will continue to try those avenues.

I’ve talked to three folks who tell me they can’t do this without the correct software, one of whom has tried multiple torrented versions of the TIA portal software…and I’ve spent some time digging around myself…

will update as I dig. especially if I can actually get into these things and reprogram them.

The S7-200 smart is apparently sold ONLY to the Chinese market.
https://www.supplc.com/the-difference-between-s7-200-and-s7-200-smart/#google_vignette

5 Likes
3 Likes

I’m on a similar Siemens mission with a controller that needs some buttons renamed after moving motors / VFDs around.

Curious if the download @downtheterphole linked works out for you

1 Like

TIA portal is probably too new for the S7-200/300/400, the Siemens plcs that have 9 pin ports on them usually need an old laptop with a non-usb serial connector and an interface cable along with a version of non-tia step 7 like v5.5.

Also hope the OEM didn’t lock you out with a password they almost certainly won’t share with you

2 Likes

I am not sure about this being older hardware, but yes you’d need TIA portal or equivalent. I think our license was around $2k with wincc, safety, and simulator. TIA is pretty solidly backwards compatible and Siemens online support is excellent for this kind of thing. You will not likely be able to pirate it as Siemens has their licenses on lock hard

2 Likes

@SidViscous the architecture that the S7-200/300/400 is built around predates tia portal by years even if the PLC was manufactured recently. Step 7 is the core parts of Tia that interfaces with and programs the plcs. And yeah tia is definitely expensive Ive easily got $1500 in licenses and software even buying used and outdated nos software from eBay

1 Like

It certainly does outdate the 200 but I’m not 100% you can’t speak with that hardware. I plugged into a unit that was probably mid 90s with our license and was able to upload last week. Could be the case they’re not compatible, could be they are. Siemens support would probably tell us. @cyclopath care to post a model/serial number?

yeah, maybe…but I’ve been out sick.

automation guy reports success.

he can’t get at the HMI, but has access to the PLC (I’ll ask what he purchased). which should get the job I need done.

soon as I can figure out/document what that actually is :thinking:

1 Like

Probably an EPROM reader/writer…

Reviving this topic, I was on a site recently that had an S7-200 Smart on a Lneya chiller, this S7-200 had an ethernet port. Tried to connect using TIA both version 13.2 and 15.1 and no luck making a connection with either.

Had to screw with connection settings a bit but was finally able to connect, see IO status and pull a program using Step 7 Micro/win SMART V2.5 and an ethernet cable and switch. At least on the PLC side. No idea what I’d need to use to talk to the HMI which was not a Siemens product.

Here’s where I got V2.5 [Download] STEP7 MicroWIN SMART V2.5 for PLC S7-200 Siemens (GoogleDrive) - plc247.com

2 Likes

Thank you!!!

We are gonna use a different HMI. Or try to. I think my automation specialist has figured a way in. I’d like to try myself as well…

2 Likes

stumbled on this one when it just so happens I’m trying to figure out how to access a Siemens S7-1200 using the TIA Portal software (V17). It’s in the control box for a Permacool ethanol chilling system, I’d like to use it to hopefully work up a remote access to turn our chiller and pumps on from offsite. Anyone know if this is even possible? i’m coming from extreeeme layperson skills on this kind of thing

2 Likes

@nategeo How are your computer/networking skills?
The S7-1200 has an ethernet port. If its running directly to an HMI (screen/touchscreen) you will need 2 more ethernet cords and a switch to connect the 2 with your laptop.
50/50 chance whether the OEM password protected their program. If they did you probably can’t do squat.
If you don’t already have TIA portal you will need to buy/borrow/steal a copy and it isn’t super cheap by itself, but Siemens does sell PLC starter kits that will get you into a copy for a very reasonable cost. Or you can do what I do and get on eBay and buy the not-bleeding-edge licenses for much cheaper

2 Likes

computer/networking skills are slightly above average, but not by much. enough to smell what you’re cooking though, thank you so much for that rundown!
I have a TIA Portal trial version that hopefully will allow me to make attempts to confirm this is a possibility before I purchase the program in earnest. i’ll be taking some cracks at this throughout the next week i’m hoping, thank you for pointing me in the right direction, this is exactly the nudge i needed

2 Likes

If there is a comfort touch HMI you can usually get into the back end and set up remote access to the HMI program without messing with the source code. Those HMIs are basically just a windows PC, and there is a standard built-in mirroring feature. If there is no HMI, you are SOL because the mfg will have locked down the source code. Buying TIA will be pointless if you need to change the source programming unless you plan on building a new program completely or you can convince the mfg to give you access (0% chance IME)

2 Likes

Whoops, found the thing and realized that if the HMI program is locked down you will probably have an issue :

ComfortPanelSmartServerSetup.pdf (609.1 KB)

It’s so simple though there’s a small chance you could convince the mfg to remote in and set it up. It’s also not entirely uncommon for the PLC program to be locked but the HMI not.

Is there no external stop/start command? Is there a non-latching fault you can simulate to put the unit on hold? In the past I’ve used a wifi enabled thermostat as a remote to trigger a dry contact (like resetting a building chiller or closing a contractor for a cooling tower fan). Janky AF but it works

2 Likes

it’s worth paying for step 7. Every other major PLC has a very large yearly subscription fee. i can program every PLC made by siemens. other have said s7300 is too old, it’s not you are able to program all of it with the right software package level l.

this is probably true. for the centrifuge if you understand the what’s happening well enough you can probably rewrite… PID function block for the rpm’s, trace the I/O to the right places, use step 7 to properly address these

I think the unit he is trying to interface with is a chiller/pump skid which might be very simple or it might have a good bit of IO. I wouldn’t recommend completely rebuilding the program from scratch unless you want a learning experience, certainly there has to be an easier way.

1 Like

unfortunately if it’s password protected it’s a one trick pony unless you do a memory reset.

1 Like