--- title: "Connect to controllers" --- # Connect to controllers Add TwinCAT targets reached over ADS and S7-1500 targets reached over their web API, connect read-only, upload TwinCAT symbols and pin an S7-1500 web server certificate. The PLC module reaches controllers with its own clients: ADS over TCP for TwinCAT runtimes, and the web API over HTTPS for S7-1500 CPUs. CODESYS controllers are reached through CODESYS itself (see [CODESYS online actions](https://neuralinverse.com/docs/modules/plc/codesys-online/)). **State:** kit shipped. The ADS client is tested over real loopback TCP against a model of a TwinCAT router, its request bytes compared with those of Beckhoff's MIT-licensed ADS library; the S7-1500 client is tested over real HTTPS against a model of the CPU's web server. Neither has run against a real controller. Bench controllers on an isolated network only. ## TwinCAT targets 1. Run **Connect to TwinCAT Target** and pick a stored target, or **Add TwinCAT Target...** in its list to add one: the host name or IP address, the AMS Net ID, the AMS port (851, the first TwinCAT 3 PLC runtime, is offered) and this machine's AMS Net ID. 2. The Editor connects read-only and reads the device name, version and ADS state. 3. The **TwinCAT Target** status bar entry shows connecting, connected with the ADS state (click to show the symbols), or "TwinCAT Not Connected" with the reason (click to connect again). 4. Run **Show TwinCAT Target Symbols** to upload the symbol table and data types and list every symbol with type, size and comment. **Disconnect from TwinCAT Target** closes the connection, after deleting every ADS notification still registered. Targets are kept per workspace and hold addresses only. ADS has no credentials: access is the route the target holds for this machine's AMS Net ID, as for XAE. Add the route on the PLC yourself and use ADS on TCP 48898. Uploading the symbols also reads the runtime's symbol version and watches it. When it changes (an online change or a download), watches and live values are marked stale, a running trace ends, and the symbols are uploaded again. A device that does not report its symbol version is logged as such, and the views say "change detection unavailable". Every connection, disconnection, failure and symbol upload is in the **PLC** log. ## S7-1500 targets 1. Run **Add S7-1500 Target** with the host, the HTTPS port (443 offered) and the language of diagnostic texts (`en-US` offered). The workspace keeps the address and language only. 2. Run **Set S7-1500 Web Server User**. The user and password are kept only in the Editor's secret storage, never in settings, workspace storage or logs. 3. Run **Connect to S7-1500 Target**. On the first connect the Editor completes a TLS handshake without sending anything and shows the certificate: SHA-256 fingerprint, subject, issuer, validity, alternative names and serial number. Compare it with the CPU's and pin it. 4. From then on every connection must present exactly that certificate, checked before one byte of HTTP is written. Another certificate fails the request, sends nothing, ends the connection and is shown with both fingerprints. Certificate verification is never turned off. 5. The Editor logs in and reads the request size limit the firmware reports. **Disconnect from S7-1500 Target**, disabling the PLC environment or closing the window logs the token out. **Forget S7-1500 Pinned Certificate** clears the pin; check why the certificate changed before you use it. **Remove S7-1500 Target** removes the target. The token is renewed by a new login when it has been idle for the timeout the CPU reported, and once when a request is answered "permission denied"; a second "permission denied" is reported as missing rights of the web server user. Nothing writes to an S7-1500. The Editor sends only `Api.Login`, `Api.Logout`, `Api.GetQuantityStructures`, `DiagnosticBuffer.Browse` and `PlcProgram.Read`. No S7comm and no OPC UA. ## Reaching a target The Editor speaks plain ADS on TCP 48898 through a route you add on the PLC, and the S7-1500 web API over HTTPS. A target that opens only secure ADS on TCP 8016, as a factory-default TwinCAT/BSD target does, cannot be reached. See [What's next](https://neuralinverse.com/docs/modules/plc/whats-next/). ## Not verified - Any TwinCAT runtime, router or controller; the data type upload against a real device; timing on a real network; Windows beside a TwinCAT router on the same machine. - Any S7-1500, which firmware versions offer each method, and the web server user rights each method needs.