Accessing Sinumerik 840D sl NC Variables from IOT2050 over S7

Problem Definition: Reading Sinumerik 840D sl Variables from an IOT2050 on Legacy Firmware

Many retrofit projects require bringing a SIMATIC IOT2050 edge gateway into an existing Sinumerik 840D sl installation to expose machine data to higher-level MES, SCADA, or cloud systems. When the controller is running a pre-4.5 firmware such as 2.6 SP1 HF5 or 2.7 SP3 HF4, the integrated OPC UA server is not present, and the common drop-in OPC UA pattern used for newer controllers does not apply. The IOT2050 must instead reach the data through the embedded S7-300 PLC that ships inside every Sinumerik Solution Line and act as an S7 client plus OPC UA broker.

This article documents the engineering path for that scenario. It covers the OPC UA availability matrix for legacy 840D sl firmware, the network topology, the S7-300 / NC Varselector / PLC function block chain, the node-red flows pre-installed on the IOT2050, and the third-party gateways (Softing uaGate 840D, IBH Link UA) used when the PLC route is not available. The objective is to deliver deterministic access to NC variables, tool data, drive parameters, and HMI tags from the IOT2050 over both S7 and OPC UA.

Sinumerik 840D sl Firmware and OPC UA Availability Matrix

The integrated OPC UA server availability is tied to the Sinumerik Solution Line firmware train. The matrix below summarizes the supported paths for the firmware versions that typically appear in retrofit projects.

Service Packs (SP) and Hotfixes (HF) do not change OPC UA availability; they patch and stabilize the existing train. The 2.6.x and 2.7.x trains therefore remain OPC UA-less even after applying HF5 or HF4 respectively.

SIMATIC IOT2050 Edge Gateway Capabilities

The SIMATIC IOT2050 is a 35 mm DIN-rail edge device based on the TI AM6548 SoC. It runs the SIMATIC Industrial OS, a Yocto-based Linux that ships with a curated set of node-red flows, drivers, and protocols.

From the perspective of a legacy Sinumerik 840D sl installation, the relevant on-board capabilities are:

The reference deployment for a Sinumerik 840D sl retrofit uses two physical networks on the IOT2050: one port (X1 P1) attached to the machine network containing the Sinumerik X120 (operator panel) and the X130 (NC/PLC) interfaces, and the second port (X1 P2) on the plant LAN that carries OPC UA, MQTT, or HTTPS traffic to the SCADA / cloud broker. This dual-homed pattern is documented in the SIMATIC IOT2050 Industrial Edge Device commissioning manual.

System Architecture: From NC Kernel to IOT2050

The architecture is unidirectional for read traffic and bidirectional for write traffic. The IOT2050 acts as the S7 client (passive role 3) talking to the integrated S7-300 (server role 1) inside the Sinumerik 840D sl, which in turn executes the Siemens NC variable function blocks to read or write data on the NC kernel.

For the firmware versions in scope, the data path is:

1. IOT2050 sends an S7 read request over ISO-on-TCP (port 102) to the integrated S7-300.
2. The S7-300 executes a Siemens NC variable function block (FB7 for read, FB9 for write; FB2 / FB3 for PI services on older Solution Line basic programs).
3. The function block reads from / writes to the NC kernel at the address generated by the NC Varselector.
4. The S7-300 returns the data to the IOT2050.
5. The IOT2050 publishes the data to OPC UA, MQTT, or HTTPS endpoints in the plant network.

The IOT2050 never talks to the NC kernel directly. All NC variable traffic is mediated by the integrated S7-300. The NC Varselector is the offline tool that defines which NC variables are exposed and at which S7 data-block addresses the runtime values are mirrored.

Option A — S7 Communication to the Integrated S7-300

On every Sinumerik 840D sl (Solution Line and Power Line), the S7-300 inside the NCU is reachable on the X130 / X120 interfaces. The integrated PLC acts as an S7 server on TCP port 102 (ISO-on-TCP / TPKT). The IOT2050, running node-red-contrib-s7comm, can connect as an S7 client and read data blocks, inputs, outputs, and merkers.

Network Topology and Port Allocation

S7 Connection Parameters

Configuring ISO-on-TCP on the IOT2050

In node-red, install node-red-contrib-s7comm if not already present (the SIMATIC Industrial OS image ships it pre-installed). Drag an s7 in node onto the canvas, open its configuration, and enter the values from the table above. The node uses the libnodave / Snap7 library to drive ISO-on-TCP and S7 communication.

For a single read of a 32-bit real value at DB1000.DBD200 (an arbitrary example), the node configuration looks like:

Mode:       Single Variable
Address:    DB1000.DBD0
Data type:  REAL
Cycle:      1000 ms

For batch reads (recommended for high tag counts), use the Read mode with a list of addresses; this minimizes connection setup overhead and reduces ISO-on-TCP keep-alive traffic on the machine network.

Option B — NC Variable Access via NC Varselector and PLC Function Blocks

NC variables (axis positions, spindle speed, tool data, G-code state, drive parameters) are not directly visible in the S7 data blocks. The Sinumerik NC Varselector tool generates an address file that maps each NC variable to an S7 memory location. The integrated S7-300 then continuously mirrors the values using Siemens function blocks (FBs).

Generating the Address File with NC Varselector

1. Open NC Varselector on the engineering station (part of the Sinumerik Operate commissioning toolkit).
2. Select the target NCK version matching the controller (e.g., 2.6 SP1 or 2.7 SP3).
3. Add the NC variables of interest (e.g., /Channel/State/actBlockNo, /Axis/actPos, /Tool/Compensation/cuttingEdge[1].dWear).
4. Export the address list. The output is typically a text file containing lines of the form DB9910.DBX0.0 BYTE 1 /Channel/State/actBlockNo.
5. Import the generated address list into the S7-300 project (Step 7 V5.5 + SINUMERIK add-on for 840D sl FW 2.6 / 2.7) and compile.

Loading the Address File into the S7-300 Project

The generated list maps each NC variable to a location inside one of the pre-defined NCVAR data blocks (commonly DB9910, DB9911, DB9912 for the axis / channel data, and DB9913 / DB9914 for the tool / magazine data). The PLC programmer instantiates the corresponding Siemens function block to read or write the data at those addresses.

Standard Function Blocks for NC Variable Read/Write

Once the address file is loaded and the FBs are instantiated in the S7-300 project, the IOT2050 sees the NC variable values as ordinary data-block content and reads them with the S7 node in node-red. The cycle time of the FB (typically 100–500 ms) becomes the effective publish rate of the NC variables.

Node-RED Flows on the IOT2050

The SIMATIC IOT2050 image bundles a curated node-red palette that covers the three protocols a Sinumerik retrofit typically needs: S7, OPC UA, and Modbus. The flows live in /home/admin/node-red and survive reboots.

Pre-installed Node Catalog (Industrial OS default image)

Example Flow 1: Periodic S7 Read with OPC UA Server Exposure

This flow reads a batch of four NC variables from the integrated S7-300 and exposes them through an OPC UA server that plant SCADA can browse.

[{"id":"s7in","type":"s7 in","endpoint":"192.168.214.1:102","mode":"all",
      "split":"60s","name":"NCVAR batch read",
      "addresses":[
        {"db":9900,"byte":0,"type":"REAL","name":"actBlockNo"},
        {"db":9900,"byte":4,"type":"REAL","name":"actFeedrate"},
        {"db":9910,"byte":0,"type":"REAL","name":"spindleActSpeed"},
        {"db":9913,"byte":0,"type":"DINT","name":"tNumber"}]},
 {"id":"func","type":"function","name":"Tag remap",
      "func":"msg.payload = msg.payload.map(v => ({tag:v.address, value:v.value, ts:Date.now()})); return msg;"},
 {"id":"opcsrv","type":"OpcUa-Server","port":4840,
      "endpoint":"opc.tcp://0.0.0.0:4840",
      "name":"Sinumerik840D_S7_Shadow"},
 {"id":"dbg","type":"debug","name":"raw","active":true}]

Example Flow 2: S7 Read to MQTT for Cloud Pipeline

[{"id":"s7in2","type":"s7 in","endpoint":"192.168.214.1:102","mode":"single",
      "variable":"DB9910.DBD0","name":"Axis X actual position"},
 {"id":"deadb","type":"function","name":"0.001 mm deadband",
      "func":"const last=context.get('last')||0;\\nif (Math.abs(msg.payload-last) < 0.001) return null;\\ncontext.set('last',msg.payload); return msg;"},
 {"id":"mqtt","type":"mqtt out","broker":"plant-broker",
      "topic":"sin840d/axis/x/actPos","qos":1}]

The deadband function prevents the IOT2050 from publishing identical values to MQTT on every cycle and reduces cloud ingress costs. The OPC UA server flow on the same box is the more deterministic choice when the consumer is a plant SCADA such as WinCC Unified or a third-party MES.

Option C — Third-Party OPC UA Gateways

When the customer cannot modify the integrated S7-300 program (no access to Step 7 V5.5, no downtime for PLC reload), the IOT2050 S7 path is not available and an external OPC UA gateway is required. Two products dominate this space.

Both Softing and IBH gateways connect to the integrated S7-300 over S7 communication, run the same NC Varselector → FB7 / FB9 chain internally, and re-publish the values as OPC UA nodes. They can be chained with the IOT2050: the gateway becomes the OPC UA server, the IOT2050 becomes an OPC UA client, and the IOT2050 forwards the data via MQTT or to a higher-level cloud broker.

Commissioning Procedure (Step-by-Step)

Use this procedure for first-time integration of an IOT2050 with a 840D sl on firmware 2.6 SP1 HF5 or 2.7 SP3 HF4.

1. Inventory and validate. Confirm controller part number, Sinumerik Operate version, integrated S7-300 firmware, and the basic program version (e.g., 06.05.04.00 for 2.7 SP3 HF4). Capture the controller's serial number for vendor support.
2. Network segment. Connect IOT2050 X1 P1 to the machine network. Verify reachability of 192.168.214.1 on port 102 with nc -vz 192.168.214.1 102 from the IOT2050 shell.
3. Enable S7 communication. On the Sinumerik, set the X130 IP and confirm that S7 communication is enabled in the controller's network settings. The default state allows S7 on X130; verify, do not assume.
4. Build the NC variable list. Run NC Varselector on the engineering PC, generate the address list for the chosen variables, and load it into the S7-300 project.
5. PLC adaptation. Add the appropriate read / write FBs (FB7 / FB9 for read / write, FB2 / FB3 for PI service) to the S7-300 program with NC variable addresses pointing at the generated DB offsets. Compile and load to the controller with Step 7 V5.5 as appropriate.
6. Test S7 connectivity from IOT2050. Open node-red, drop an s7 in node pointed at DB9910.DBD0, deploy, and confirm values change in the debug pane when the controller transitions through reset, JOG, and AUTO with a running part program.
7. Publish OPC UA. Add an OpcUa-Server node, bind the S7 read output to OPC UA variables, and connect with UA Expert on the engineering PC to verify NodeID resolution.
8. Bridge to plant / cloud. Add MQTT or HTTPS nodes if the plant stack requires them. Add a deadband function to throttle NC variable traffic when the controller is idle.
9. Document. Record the S7 addresses, OPC UA NodeIDs, MQTT topics, the IOT2050 firmware version, the basic program version, and the NC Varselector export file. This is the information the customer will need to support the system later.

Verification and Diagnostics

After commissioning, the IOT2050 should be exercised with deterministic traffic and observed both locally and remotely. The checks below cover the most common regressions.

Troubleshooting Matrix

Frequently Asked Questions