fix: symbolic write/read uses wrong sub_area for I/Q/M areas

[gijzelaerr]

From #735 — Bug 1

_build_symbolic_write_payload and _build_symbolic_read_payload use Ids.CONTROLLER_AREA_VALUE_ACTUAL (2551) for non-DB areas (I/Q/M). The PLC rejects symbolic writes with error 0x4D0013.

Wireshark capture of EXOR HMI (AGLink) confirms the correct sub_area is 3736 (0xE98) for symbolic LID-based access to I/Q/M areas.

Fix

Change both _build_symbolic_read_payload and _build_symbolic_write_payload to use 3736 for access_sub_area when access_area < 0x8A0E0000.

Add CONTROLLER_AREA_SYMBOLIC_SUB_AREA = 3736 to Ids enum.

Hardware tested on

• S7-1200 CPU 1214C DC/DC/DC, FW V4.5
• DI8/DQ6 module

Related

• S7-1200 Q/I/M symbolic reads: findings from real hardware testing (FW V4.5) #735 (parent issue)
• S7-1200 Session Setup Incomplete #710 / PR SessionKey handshake for V1-initial S7-1200 PLCs #724 (V1-initial session setup)

[gijzelaerr]

Fix is up in PR #741.

Added CONTROLLER_AREA_SYMBOLIC_SUB_AREA = 3736 to the Ids enum and updated both _build_symbolic_read_payload and _build_symbolic_write_payload to use it for non-DB areas.

Could you test against your S7-1200 (FW V4.5)?

pip install git+https://github.com/gijzelaerr/python-snap7.git@fix-symbolic-iqm-sub-area

Thanks for the detailed report and EXOR capture data!