Building an OPC UA Server for S7-300 with SIMATIC IOT2040/IOT2050

1. Overview: S7-300 OPC UA Gateway Architecture

The SIMATIC S7-300 family does not include a native OPC UA server. Unlike the S7-1500 line, where the OPC UA server capability is integrated from firmware V2.0 and is fully configurable inside TIA Portal (see Enabling the OPC UA server (S7-1500) procedure), the S7-300 platform requires an external gateway that acts as both a client to the PLC and an OPC UA server to the SCADA/MES layer.

This article documents a field-proven architecture in which a SIMATIC IOT2040 or IOT2050 industrial gateway reads process data from a S7-300 CPU 315-2AH14-0AB0 (6ES7315-2AH14-0AB0) over the integrated PROFINET interface or the CP343-1 communications processor, then publishes the data on an OPC UA endpoint using Node-RED or the open-source Open62541 stack. The pattern is the same for any S7-300 / S7-400 / WinAC CPU that cannot host OPC UA natively.

Putting the OPC UA server on a Linux gateway shifts certificate management, security policies, encryption, and node-address mapping away from the PLC's cyclic scan. The PLC remains a deterministic process controller; the IOT device handles all IT-side concerns.

2. Prerequisites

Before commissioning, confirm the following components and software versions are available.

You will additionally need an Ethernet switch or direct patch cable between the CPU/CP PROFINET port and the IOT device. A static IP plan must be agreed before commissioning; dynamic addressing is unsafe on the plant network.

3. Hardware Comparison: IOT2040 vs IOT2050

The OPC UA server workload is dominated by JSON parsing, certificate handling, and TCP/TLS state. Choosing the wrong platform produces Node-RED crashes after a few hours of continuous operation, especially with high tag counts.

For OPC UA workloads above ~500 tags with subscriptions > 500 ms update rate, the IOT2040's single-core 400 MHz CPU becomes the bottleneck. The Node-RED OPC UA server nodes (node-red-contrib-opcua) have been observed to crash after a few hours on the IOT2040 due to memory pressure in the V8 heap. The IOT2050 Advanced with 4 GB RAM is the recommended target for production deployments.

4. Communication Protocol Selection: S7 vs PROFINET vs TCP

Three logical options exist for moving data from the S7-300 to the IOT gateway. Each has different commissioning effort and traffic characteristics.

Recommendation: Use S7 Communication (PUT/GET) for the bulk of data because it requires no PLC program changes when the data already lives in a process DB. The IOT gateway can poll arbitrary DB areas at any update rate without disturbing the OB1 scan. PROFINET IO is only worthwhile when the data must arrive within the PLC's PROFINET update time (1–4 ms).

Verify that the CP343-1 has PUT/GET enabled, which is the default on CP343-1 (6GK7343-1EX30-0XE0) but must be confirmed in the hardware configuration.

5. S7-300 Network Configuration with CP343-1

Configure the S7-300 station in STEP 7 V5.6 (or TIA Portal V17+ with S7-300 HSP) as follows. The exact menu paths are for STEP 7 Classic; TIA Portal equivalents are noted in parentheses.

1. Open the hardware configuration (HW Config) and place the CP343-1 in slot 4 next to the CPU.
2. Double-click the CP343-1 and assign an IP address, e.g. 192.168.0.10, subnet mask 255.255.255.0. Do not use DHCP.
3. Open Properties → Options and ensure Allow PUT/GET access from remote partner is checked. Without this flag, the CP rejects all S7 communication write/read requests, including those from the IOT gateway.
4. If you require protection, define a connection resource (S7 connection) under NetPro with a local ID and the IOT IP as the partner. Leave the connection type as S7 Connection.
5. Create the process DBs in the S7 program. The IOT will poll these directly:

   DB	Symbol	Offset / Length	Type	Description
   DB10	iProcImage	DBW0–DBW30 (16 words)	INT	Process inputs (analog values, scaled)
   DB11	qProcImage	DBW0–DBW30 (16 words)	INT	Process outputs (setpoints, commands)
   DB20	diagData	DBW0–DBW100 (51 words)	WORD/INT/DWORD	Diagnostics block (last alarm, op hours, etc.)

6. Compile and download the hardware configuration to the rack. The CP should reach RUN with no SF/BF errors.

Verify connectivity from any PC with a SIMATIC NET installation before touching the IOT device:

If the ping fails, check the CP's MAC in the diagnostic buffer (Module Information → Diagnostic Buffer) for PROFINET link-up events.

6. IOT2000 Software Image and Initial Setup

The SIMATIC IOT2000 ships with a Yocto Linux example image that includes Node-RED, an OPC UA client/server stack, and the SD card handling utilities. Siemens publishes the image and SDK at the official IOT2000 support portal.

1. Download the SIMATIC IOT2050 product manual and locate the Example Image release notes for your hardware variant.
2. Flash the example image to a USB stick or SD card using the Balena Etcher or dd tool: sudo dd if=iot2050-image-v1.3.1.wic of=/dev/sdX bs=4M status=progress conv=fsync
3. Insert the SD card into the IOT and power it up. Connect a serial console (115200 8N1) on the debug UART or attach a DisplayPort monitor and USB keyboard.
4. Default credentials are root / root. Change them immediately: passwd root
5. Configure a static IP on the LAN-facing Ethernet port (the one connected to the S7-300). Edit /etc/network/interfaces:

   auto eth0
   iface eth0 inet static
     address 192.168.0.20
     netmask 255.255.255.0
     gateway 192.168.0.1
     dns-nameservers 192.168.0.1

6. Restart networking: systemctl restart networking
7. Test reachability to the CP: ping 192.168.0.10

Update the firmware and packages while still online:

The example image's Node-RED should be listening on http://192.168.0.20:1880. The OPC UA server (when enabled) binds to opc.tcp://0.0.0.0:4840.

7. Installing Node-RED and OPC UA Server Nodes

Node-RED is bundled with the IOT2000 example image but the OPC UA nodes must be installed manually. Two packages are required:

• node-red-contrib-s7 — S7 communication client (ISO-on-TCP, port 102)
• node-red-contrib-opcua — OPC UA server and client (bundled with open62541 stack)

1. Open the Node-RED UI at http://192.168.0.20:1880.
2. Open the burger menu → Manage Palette → Install tab.
3. Install node-red-contrib-s7 then node-red-contrib-opcua.
4. Restart Node-RED to load the new nodes: systemctl restart node-red
5. Verify the nodes appear under the function palette category.

If you prefer the command-line route (faster for reproducible deployments):

8. S7 Communication Driver Configuration

Place an s7 in node on the canvas and double-click it. The configuration parameters map directly to S7 Communication primitives.

The Variable name field uses S7-style absolute addressing. Examples:

DB10,INT0,16   // reads 16 INT values from DB10 starting at offset 0
DB11,INT0,16
DB20,WORD0,10
DB20,DINT50,4   // 4 double words (32 bits each)
MW0,WORD,1      // Merker word
IW0,INT,4       // Input word area

Wiring the output of s7 in into a function node allows you to scale, debounce, or tag-strip the payload before publication.

9. OPC UA Server Configuration in Node-RED

Place an opcua-server node on the canvas. Its configuration panel exposes the OPC UA endpoint, security, and node structure.

1. Set Endpoint URL to opc.tcp://192.168.0.20:4840 (use the IOT's plant-facing IP, not 0.0.0.0, so clients can resolve it).
2. Set Server certificate path. The node will auto-generate a self-signed cert at first start; replace it with a CA-signed cert before production.
3. Choose a security policy. None is fine for testing; production should use Basic256Sha256 with SignAndEncrypt.
4. Under Actions, add an Add Node action that creates an object Objects/S7300_Station and appends variables for each tag published by the S7 node.
5. Connect the output of the function node (which receives S7 reads) to the input of the opcua-server node. Use msg.topic for the OPC UA node ID and msg.payload for the value:

// function node body
msg.topic = "ns=1;s=S7300_Station.Pressure";
msg.payload = parseFloat(msg.payload);
return msg;

The full address space for the example above would resemble:

Objects
  +-- S7300_Station
       +-- Pressure (Float, Read-only)
       +-- Temperature (Float, Read-only)
       +-- Speed (Int32, Read-only)
       +-- OpHours (UInt32, Read-only)
       +-- Command (Int16, Read-Write)  // writes back to DB11

For write-back (SCADA command to PLC), wire an opcua-client or opcua-listener node to an s7 out node. The s7 out node performs a PUT/GET write to the configured DBW.

10. Verification and Commissioning Steps

1. From a Windows PC, install the UaExpert OPC UA Client (or any other OPC UA client). Use this only as a verification tool.
2. Open UaExpert and select Add Server. Enter the endpoint URL opc.tcp://192.168.0.20:4840.
3. Accept the self-signed certificate (move it from Rejected to Trusted) and connect.
4. Expand the address space to Objects → S7300_Station. The variables listed in section 9 must appear.
5. Drag a tag to the Data Access View and confirm the value updates at the configured poll rate.
6. Force a value change in the S7-300 (e.g., move the value in DB10.DBW0 via the watch table in STEP 7) and observe the OPC UA value updates within one cycle (default 500 ms).
7. For write-back, double-click a Read-Write tag, change its value, and confirm the corresponding DBW updates in the PLC.
8. Pull a Wireshark capture on the PLC network segment to confirm traffic: you should see TPKT/COTP packets on port 102 (S7 communication) and opc.tcp packets on port 4840 (OPC UA).

Add the following acceptance criteria to the Site Acceptance Test (SAT):

11. Troubleshooting Common Issues

12. Alternative Stack: Open62541

For deployments where Node-RED is too heavy or too slow, Open62541 is a high-performance open-source OPC UA stack written in C with Python and Java bindings. The library is licensed under MPL-2.0 and is suitable for embedded use on both IOT2040 (x86) and IOT2050 Basic (ARM).

A minimal server in C exposes two variables sourced from an ISO-on-TCP read of DB10:

#include "open62541/server.h"
#include <unistd.h>

static UA_StatusCode readPressure(UA_Server *s,
        const UA_NodeId *n, UA_DataValue *dv) {
    UA_Float v = 12.34f;        // replace with S7 read
    UA_Variant_setScalar(&dv->value, &v, &UA_TYPES[UA_TYPES_FLOAT]);
    return UA_STATUSCODE_GOOD;
}

int main(void) {
    UA_Server *s = UA_Server_new();
    UA_ServerConfig_setMinimal(UA_Server_getConfig(s), 4840, NULL);
    UA_VariableAttributes attr = UA_VariableAttributes_default;
    attr.dataType = UA_TYPES[UA_TYPES_FLOAT].typeId;
    attr.accessLevel = UA_ACCESSLEVELMASK_READ;
    UA_Float init = 0.0f;
    UA_Variant_setScalar(&attr.value, &init, &UA_TYPES[UA_TYPES_FLOAT]);
    UA_NodeId id = UA_NODEID_STRING(1, "pressure");
    UA_Server_addVariableNode(s, id,
        UA_NODEID_NUMERIC(0, UA_NS0ID_OBJECTSFOLDER),
        UA_NODEID_NUMERIC(0, UA_NS0ID_ORGANIZES),
        UA_QUALIFIEDNAME(1, "Pressure"),
        UA_NODEID_NULL, attr, NULL);
    UA_ValueCallback cb;
    cb.read = readPressure;
    cb.write = NULL;
    UA_Server_setVariableNode_valueCallback(s, id, cb);
    UA_Server_run(s, &running);
    UA_Server_delete(s);
    return 0;
}

Compile and link:

The library ships with CMake helpers; the official Open62541 documentation covers TLS, certificates, subscriptions, and historical access. Open62541 typically uses 60–90 MB less RAM than the Node-RED OPC UA stack and is the preferred path when tag count exceeds 1000 or update rates fall below 200 ms.

13. Security Hardening Checklist

An OPC UA server crossing the OT/IT boundary is a security-sensitive component. Before handover, validate the following:

• Port filtering. Block all inbound TCP except 4840 on eth1. Block all inbound except 102 (S7) on eth0. Confirm with iptables -S.
• TLS. Switch the OPC UA server to Basic256Sha256 with a CA-signed certificate. Reject None and Basic128Rsa15.
• Authentication. Configure anonymous = false and require username/password or X.509 client certificates for each SCADA client.
• PLC access control. Use the CP343-1 connection resource list to restrict which partners can open S7 connections. Combine with PLC password protection in STEP 7.
• Firmware updates. Track the IOT2050 firmware release notes and apply security patches within the agreed patching SLA.
• Logging. Forward Node-RED and Open62541 logs to a central syslog/SIEM via rsyslog or syslog-ng.
• Backup. Persist the Node-RED flow file and OPC UA certificates to a remote location so an IOT swap does not require re-commissioning.