Bridging Desigo CC to Azure IoT Hub via Siemens IoT2040

Overview

Bridging a building management system that runs Siemens Desigo CC on PXC-100 series automation stations to Microsoft Azure requires an industrial edge gateway that can translate between two protocol worlds: OPC UA on the plant side and a cloud-friendly MQTT/AMQP transport on the Azure side. The Siemens SIMATIC IoT2040 (6ES7647-0AA00-0YA2) is an Intel Quark-based DIN-rail gateway shipped with a Yocto Linux image that already contains Node-RED, the Modbus TCP contrib nodes, and a working OPC UA stack. Combined with node-red-contrib-opcua on the field side and the official azure-iot-sdk-node device client on the cloud side, the IoT2040 becomes a self-contained Desigo CC → Azure IoT Hub forwarder that requires no Windows service, no custom C++ driver, and no permanent outbound firewall holes for SCADA workstations.

This article documents the full reference architecture, the bring-up of the IoT2040 firmware image, the Desigo CC OPC UA server configuration, the Node-RED flow that performs subscription-based polling, and the JSON telemetry payload that lands in Azure IoT Hub. It also explains why BACnet over the IoT2040 is not the recommended path (the node-bacnet package is known to fail on the IOT2000 class of devices due to UDP broadcast and timing issues on the Yocto userspace) and why OPC UA is the protocol of choice when Desigo CC exposes it.

Reference Architecture

The end-to-end data path has five discrete hops. Each hop is owned by a different component, and a failure at any hop is isolated by design so that a cloud outage does not stop on-site control.

1. PXC-100 automation station – reads physical I/O (analog inputs, binary inputs) and exposes them as BACnet/OPC objects.
2. Desigo CC server – the supervisory SCADA that aggregates PXC points, runs graphics, and hosts the OPC UA server endpoint on TCP port 4840 (or 4841 for encrypted).
3. IoT2040 gateway – runs Node-RED with the node-red-contrib-opcua client package. Reads subscribed OPC UA nodes at a configurable scan rate and forwards them as JSON.
4. Azure IoT Hub – the cloud ingress that accepts device-to-cloud telemetry over MQTT (port 8883), AMQP (port 5671), or HTTPS (port 443).
5. Downstream Azure services – Stream Analytics, Time Series Insights, Event Grid, or Data Lake – consume device-to-cloud messages from the built-in endpoint messages/events.

Prerequisites

Step 1 – Configure the Desigo CC OPC UA Server

Desigo CC ships with a built-in OPC UA server, but it is not enabled by default. Activate it once per management station.

1. Open the Desigo CC Management Console and log in with engineering credentials.
2. Navigate to System → Connectivity → OPC UA Server.
3. Tick Enable OPC UA Server and choose the listen port (default 4840). If you need encryption, switch to 4841 and bind the Desigo CC project certificate.
4. Add the security policies you want to expose. For an IoT2040 client on the same VLAN, None + Sign is acceptable. For multi-tenant or shared networks, select Basic256Sha256 and load the IoT2040 client certificate.
5. Click Apply. The service DesigoCC OPC UA Server restarts and binds to 0.0.0.0:4840.
6. Verify reachability from a Windows workstation using UaExpert – connect to opc.tcp://<desigo-cc-fqdn>:4840, accept the self-signed certificate, and browse the Objects → Desigo CC folder to confirm that the PXC-100 points are visible.

Step 2 – Bring Up the IoT2040

1. Download the latest Example Image V2.6.0 for the IoT2040 from Siemens Industry Online Support (article ID 109741799). The image is a 1.6 GB ZIP that contains a pre-baked SD card image.
2. Write the image to a ≥ 8 GB industrial-grade microSD card using balenaEtcher or Win32DiskImager.
3. Insert the card, power the IoT2040 with 24 V DC on the bottom terminal block, and wait ~90 s for the green PWR and RUN LEDs to go solid.
4. Connect a serial console (115 200 8N1) to the CON port and log in as root with the default password from the image release notes.
5. Assign a static IP on X1P1 (the plant-side NIC) and route X2P1 (the cloud-side NIC) through the corporate firewall:

ifconfig eth0 192.168.10.50 netmask 255.255.255.0 up
route add default gw 192.168.10.1

6. Confirm internet egress:

ping -c 3 mqtt.azure-devices.net

If the ping is blocked, add an explicit NAT or proxy exception for *.azure-devices.net on TCP 8883 and TCP 443.

Step 3 – Install the Node-RED Contrib Packages

Open the Node-RED UI on http://192.168.10.50:1880, then from the menu select Manage palette → Install and add the following two packages:

node-red-contrib-opcua
node-red-contrib-azure-iot-hub

For headless installs, drop to the IoT2040 shell and run:

cd /usr/lib/node_modules/node-red
npm install node-red-contrib-opcua
npm install node-red-contrib-azure-iot-hub
systemctl restart node-red

The node-red-contrib-opcua package provides the OpcUa-Browser, OpcUa-Client, and OpcUa-Item nodes used to discover, subscribe to, and read Desigo CC points. The node-red-contrib-azure-iot-hub package wraps the azure-iot-sdk-node device client and exposes a configurable Azure IoT Hub node that takes a connection string and a topic filter.

Step 4 – Create the OPC UA Subscription Flow

The recommended pattern is to subscribe to a MonitoredItem on the Desigo CC server with a 1000 ms publishing interval. Subscription-based reads are dramatically more efficient than polled reads because the server pushes only deltas.

1. Drag an OpcUa-Client node into the flow and configure it:
   • Endpoint: opc.tcp://192.168.10.20:4840
   • Security Mode: None (or Sign if you enabled signing)
   • Security Policy: None
   • Authentication: Anonymous for the default Desigo CC install, or User/Password for an OPC UA account.
2. Add an OpcUa-Item node for each Desigo CC point you want to forward. Use the OpcUa-Browser to navigate to Objects → Desigo CC → <System> → ... and pick a node by double-click. Common candidates are room temperature, damper position, and AHU enable command.
3. Wire the OpcUa-Item to an OpcUa-Subscription node with these settings:
   • Interval: 1000 ms
   • QueueSize: 10
   • DiscardOldest: true

The subscription node emits a msg.payload object with the structure:

{
  "topic": "ns=4;s=Plant1.AHU01.RoomTemp",
  "payload": 22.4,
  "dataType": "Float",
  "value": { "value": 22.4, "dataType": "Float" },
  "statusCode": { "value": 0 }
}

Step 5 – Connect to Azure IoT Hub

1. In the Azure portal, create an IoT Hub (S1 tier is fine for BMS data rates below 50 messages/s). Note the hostname (e.g. bms-hub.azure-devices.net).
2. Under Devices → Add Device, create a device with ID iot2040-gw-01 and copy the primary connection string – it has the form:

HostName=bms-hub.azure-devices.net;DeviceId=iot2040-gw-01;SharedAccessKey=xxxxxxxxxxxxxx=

3. Drop an Azure IoT Hub node in the Node-RED flow and paste the connection string. Set the Method to device-to-cloud and the topic to devices/iot2040-gw-01/messages/events/.
4. Add a function node between the OpcUa-Subscription and the Azure node to build a clean JSON envelope:

msg.payload = {
  deviceId: "iot2040-gw-01",
  ts: new Date().toISOString(),
  point: msg.topic,
  value: msg.payload.value,
  dataType: msg.payload.dataType,
  quality: (msg.statusCode && msg.statusCode.value === 0) ? "Good" : "Bad"
};
msg.payload = JSON.stringify(msg.payload);
return msg;

5. Wire the function output to the Azure IoT Hub node and click Deploy. The bottom-right status bar should read Connected within five seconds.

Step 6 – Verify the End-to-End Path

1. From any workstation with the Azure IoT Explorer tool installed, connect to the hub and select device iot2040-gw-01.
2. Click Telemetry and observe live messages arriving. Each message corresponds to one subscribed OPC UA point.
3. From the IoT2040 shell, run journalctl -u node-red -f and confirm that no BAD_COMMUNICATION_ERROR or SERVICE_BAD lines appear in the last hour.
4. Force a value change in Desigo CC (e.g. override an analog output). The new value should land in IoT Explorer within one scan interval (≤ 1 s).

Message Format and Schema

Every device-to-cloud message is a UTF-8 JSON document with the schema below. Schema-enforcement at the IoT Hub route simplifies downstream Stream Analytics queries.

Performance and Sizing

The IoT2040 has a single-core 400 MHz Intel Quark CPU and 1 GB of RAM. The practical ceiling for an OPC UA subscription running through Node-RED is approximately 500 monitored items at a 1 s interval. Above that, the node-opcua client begins to drop KeepAlive packets and the Azure node queues up.

For a typical BMS of one Desigo CC server with 200 physical points, the load is well within the budget. If you need to forward 1 000+ points, the recommended path is to deploy a SIMATIC IOT2050 (6ES7647-0BA00-0YA2) with the dual-core ARM Cortex-A53 and 2 GB of RAM, and run the same flow.

Security Hardening

1. Change the default root password on the IoT2040 image before commissioning. Siemens ships the example image with a publicly documented password.
2. Enable OPC UA Sign-and-Encrypt on Desigo CC and load the IoT2040 client certificate. Generate the cert with openssl on the IoT2040:

openssl req -x509 -newkey rsa:2048 -keyout iot2040.key -out iot2040.pem \
  -days 3650 -nodes -subj "/CN=iot2040-gw-01"

3. Switch the Azure node to MQTT over TLS (port 8883). The default contrib node does this automatically when the connection string contains the SAS key.
4. Add an IoT Hub IP filter that whitelists only the IoT2040's public IP. This prevents rogue devices from injecting telemetry.
5. Enable IoT Hub diagnostic logs to Azure Monitor and alert on Throttling or Unauthorized events.

Alternative: Azure IoT Hub Integration Patterns

The Node-RED + IoT2040 path is the lowest-cost, on-premises-only option. If your facility cannot host the IoT2040 or you want a managed connector, third-party services such as CloudRail provide a drop-in OPC UA → Azure IoT Hub bridge that can read Desigo CC points in minutes without any on-site Linux box. The trade-off is per-message licensing and a hard dependency on the vendor's cloud relay.

For a hybrid architecture where Desigo CC stays on-prem and only aggregated alarms are pushed to Azure, the recommended Azure-side services are Azure IoT Hub (ingress), Stream Analytics (windowing), and Time Series Insights (historical visualization). For an SAP DMC integration, see the reference pattern documented on Microsoft Learn for routing IoT Hub events to SAP Digital Manufacturing via Event Grid.

Troubleshooting Matrix

FAQ