Overview: CP 443-1 OPC UA Obsolescence and CC716 Migration Context
The Siemens CP 443-1 OPC UA communications processor (order number 6GK7 443-1UX00-0XE0) provided native OPC UA server capability on S7-400 / S7-400H racks without requiring a separate Windows-based SIMATIC NET installation. Once the preferred drop-in gateway, this CP has been moved to the obsolete product phase, forcing new redundant S7-400H installations to evaluate replacement architectures.
Two replacement paths dominate engineering discussions:
- Retain the PC-based SIMATIC NET OPC UA server approach (data block publishing from a Windows station with SIMATIC NET PC software) — a mature route that integrates with the existing STEP 7 V5 / PCS 7 toolchain. See the Siemens application summary for SIMATIC NET OPC server access to S7-400 for the canonical configuration pattern.
- Deploy a SIMATIC CloudConnect 716 (CC716) head station as a dedicated OPC UA server, communicating with the S7-400H over Industrial Ethernet and exposing an OPC UA server endpoint to the higher-level MES/ERP system.
The CC716 path is particularly attractive in marine and offshore projects where PC-based server solutions face type-approval friction. This reference documents the CC716 path, the practical limits of the firmware, the redundancy model (which is application-level, not protocol-level), and the configuration traps that surface when migrating from the CP 443-1 OPC UA workflow to the SiOME/CC716 workflow.
CC716 Hardware and Firmware Specifications
The SIMATIC CloudConnect 716 (article number 6GK1 716-1AC00-3AB0 in its base configuration, plus antenna/extension variants) is a fanless industrial gateway designed for data exchange between field-level SIMATIC stations and cloud or higher-level IT systems. For OPC UA server use, the device terminates the S7-400H connection and exposes a standard OPC UA endpoint.
| Parameter | CC712 | CC716 | Source |
|---|---|---|---|
| Max process stations / connections | 3 | 7 | CC716 datasheet; project reports |
| Max data points per process station (Firmware < 1.5) | 500 | 500 | Forum-confirmed operational limit |
| Max data points per process station (Firmware 1.5+) | — | 3500 (multiple connections to same station supported) | Firmware 1.5 release announcement |
| Max variables per OPC UA server (CC712 baseline) | 500 | See note | Project report |
| Max arrays per OPC UA server (CC712 baseline) | 100 | — | Project report |
| Protocols | S7, OPC UA Server, MQTT | S7, OPC UA Server, MQTT, OPC UA Client | Application example 109772282 |
| Configuration tool | SiOME (Siemens OPC UA Model Editor) | SiOME | SiOME manual v3.2.0 |
Mounting is on a DIN rail or wall; the device is rated for industrial temperature ranges and is designed for cabinet installation near the S7-400H rack. Power is 24 V DC. Two RJ45 Ethernet ports are available for separating the field-side (S7-400H) network from the IT/OPC UA network, which is the preferred topology for security zoning.
OPC UA Server Sizing: Variables, Arrays, and Data Points
Three related but distinct counters govern the CC7 server model, and confusing them is the most common reason a configured server fails to publish all signals:
- Data points — the count of individual S7 addresses read from the S7 station (each BOOL, INT, REAL, etc. counts as one data point on the S7 side).
- Variables — the count of items exposed in the OPC UA address space (each scalar variable counts as one; each array of N elements exposes as one variable, not N).
- Arrays — the count of structured array variables in the OPC UA address space (capped at 100 on CC712 baseline).
For the redundant S7-400H migration in this reference, the project has approximately:
- 200 to 300 analog signals (REAL), and
- 500 to 700 digital signals (BOOL),
yielding roughly 700 to 1000 raw data points on the S7 side. Mapping every BOOL and REAL individually to a scalar variable would exceed the CC712 500-variable ceiling. The correct engineering response is to bundle signals into OPC UA arrays on the CC716 (or upgrade to a CC716 with firmware 1.5 and a multi-connection S7 layout).
Redundancy Architecture for S7-400H with CC716
The CC716 is a single physical device. It does not implement S7-400H system-level redundancy (it does not synchronize with the H-CPU pair as a redundant partner). Redundancy must therefore be handled at the application level. The proven topologies are:
Topology A — Two CC716 in front of a single S7-400H rack
Each CC716 establishes its own S7 connection to the active H-CPU. The OPC UA clients subscribe to both servers, and the client (or a wrapper application) implements the failover logic by selecting the value with the better timestamp or the better status code. This is the topology most often proposed for S7-400H.
Topology B — Single CC716 with redundant S7 connections
Configure two S7 connections inside the CC716, one to CPU 0 and one to CPU 1 of the H-pair, and let the CC716 itself select the active one. This collapses the gateway count from two to one at the cost of a single point of failure at the gateway itself. The CC716 itself is non-redundant, so this is acceptable only when the OPC UA consumer is itself redundant or where the cost of the second CC716 is not justified.
Topology C — CP 443-1 OPC UA on each H-CPU + CC716 passthrough
Keep the existing CP 443-1 OPC UA on the rack for legacy consumers, and use a CC716 as a secondary bridge for clients that cannot consume the CP endpoint directly. The CC716 reads the same S7 data and publishes under a different OPC UA namespace.
Configuration Workflow: SiOME and Import Files
CC716 is configured offline in the SiOME (Siemens OPC UA Model Editor) and then pushed to the device. The official procedure for the OPC UA server layer is documented in the SiOME manual section "Connecting to the OPC UA Server".
- Open SiOME and create a new project for the CC716.
- In the Information model area, click Connect to OPC UA Server if you are connecting to a live device for verification, or skip this for first-time offline configuration.
- Define the S7 process station. Enter the S7-400H rack IP, rack/slot (rack 0, slot 3 for an S7-400 CPU, for example), and the connection type (ISO-on-TCP / S7).
- Import the S7 data block layout. The import accepts Siemens STEP 7 export files (for example the symbol table export or a DB source export).
- Map imported symbols to OPC UA variables. Each scalar becomes one variable; arrays of N elements become one array variable.
- Deploy the configuration to the CC716 over HTTPS and restart the OPC UA server.
- Connect a client UaExpert or equivalent OPC UA client to the CC716 endpoint (
opc.tcp://<cc716-ip>:4840) and verify browsing and subscription.
The detailed commissioning example for S7 stations + CC716 is in the Siemens application example with ID 109772282. A separate application covers MQTT for cloud relay: 109820894.
Data Mapping and Address Offsets: The Import Trap
The most common field-reported configuration failure on CC716 is the import offset trap. The SiOME importer only consumes Siemens-native export files, and the way addresses are resolved depends on file completeness:
- When the imported file contains every address of a DB (no holes), the offset is reconstructed correctly.
- When the imported file contains only the actually-used addresses (the typical engineering reality), the CC716 places the first symbol at offset 0, the next at the offset of the first free byte after the first symbol, and so on. The published OPC UA address no longer matches the real DB byte offset.
This is a critical constraint when migrating from a CP 443-1 OPC UA, where the OPC UA address space is built directly from the S7 symbol table inside the STEP 7 project. On CC716, the only robust mitigation is to either:
- Export the full DB layout (every byte from 0 to the end, including unused words/dwords) and import that, even if most entries are blank placeholders; or
- Configure the CC716 mapping manually (variable by variable) inside SiOME, explicitly entering the byte offset and data type for each OPC UA variable.
DB100.DBX0.0) against the actual STEP 7 DB offset. Mismatches of 1 to 4 bytes at the start of the array are the canonical symptom of a partial DB export.Network Topology and Interface Planning
The CC716 should sit on a dedicated subnet between the S7-400H plant network and the IT/MES network. The recommended port assignment is:
| Port | Function | Subnet | Notes |
|---|---|---|---|
| X1 (P1) | Field / S7 side | Plant network (Industrial Ethernet) | Connects to the S7-400H CP443-1 |
| X2 (P2) | IT / OPC UA side | Office / MES network | Exposes OPC UA Server (TCP 4840 default) |
Routing between subnets must be configured at a firewall or L3 switch. The OPC UA endpoint URL that the MES client configures points to the X2 IP, not X1. For the S7-400H pair, the CC716 connects to the IP of the active CPU (Topology A/B above) or to both CPU IPs and selects the active one via keep-alive.
Commissioning and Verification Checklist
- Confirm CC716 firmware version on the device's web UI (System > Device Info). Document the build against the release notes for the variables / data points ceiling.
- From a service laptop on the S7-side subnet, ping the S7-400H CPU 0 and CPU 1 IPs. Confirm that only one responds to the S7 connection request at a time (the active CPU).
- In SiOME, import the full DB layout. Build a list of all data points with byte offset and data type and save it as a CSV for FAT/SAT.
- Deploy the configuration. Watch the CC716 diagnostic page for S7 connection state and OPC UA server state. Both must be green before the FAT.
- Connect UaExpert to
opc.tcp://<cc716-ip>:4840. Browse the address space, subscribe to 10 to 20 representative variables (mix of BOOL, INT, REAL, array element), and confirm monotonic timestamps and values that match the S7 side via STEP 7 variable monitoring. - Force a CPU failover (disconnect the active CPU's PROFINET or use the S7-400H panel switch-over). Confirm that the CC716 reconnects within the keep-alive timeout and the OPC UA server resumes publishing with a clear status flag (Bad_CommunicationError during the gap, Good after reconnect).
- If using Topology A, run the same failover with the second CC716 and confirm that the OPC UA client receives data from the surviving server with no gap longer than the configured failover threshold.
Troubleshooting Matrix
| Symptom | Likely root cause | Diagnostic step | Corrective action |
|---|---|---|---|
| OPC UA namespace shows wrong byte offsets (off by N bytes) | Partial DB import — symbols packed without padding | Export full DB from STEP 7, diff with CC716 mapping | Re-import the full DB; or hand-edit each variable offset in SiOME |
| Variables above 500 do not appear in OPC UA namespace | CC712 variable ceiling reached | Check device variant in CC716 web UI | Upgrade to CC716; on CC716 firmware 1.5+ use multiple S7 connections per station |
| S7 connection drops on CPU failover, OPC UA values freeze | CC716 holds one S7 connection only; active CPU changed | Watch S7 connection state on CC716 diagnostics during switch-over | Configure second S7 connection to standby CPU; or add second CC716 (Topology A) |
| OPC UA client cannot browse variables, gets Bad_NotFound | SiOME namespace not deployed or server not restarted | Check CC716 OPC UA server status | Redeploy configuration, restart OPC UA server, reconnect client |
| Timestamps on values are old (seconds) | Polling interval set high in SiOME | Inspect publishing interval in SiOME | Reduce S7 polling and OPC UA publishing intervals to the lowest acceptable value |
| Cannot edit/check configuration off-site | SiOME project files are device-coupled; no offline simulator for the CC716 | Try connecting without device — should fail | Keep a spare CC716 in the office for support; document the exact firmware version |
| Data points above 500 per station not publishing | Firmware pre-1.5 ceiling on data points per process station | Check firmware version on CC716 | Update to firmware 1.5+ and configure multiple S7 connections to the same station |
| Marine-type-approval friction on PC-based solution | SIMATIC NET server on a Windows PC | — | Switch to CC716 head station (no PC in the loop); per project report, this is the deciding factor for marine acceptance |
Sizing Calculations for the Reference Project
Working through the project's reported 200-300 analog + 500-700 digital signals against the CC7 sizing limits.
Case 1: All-scalar mapping on CC712
- Number of scalar variables required: 1000 (700 + 300, taking the upper bound).
- CC712 OPC UA variable ceiling: 500.
- Result: 500 variables short; configuration will not deploy the full signal set.
Case 2: Bundled arrays on CC712
Group the 700 digital signals into 7 arrays of 100 BOOL each (100 variables). Group the 300 analog signals into 30 arrays of 10 REAL each (30 variables). Total variables: 130, well below the 500 ceiling. Total arrays: 37, below the 100 array ceiling. This is the practical solution on CC712.
Case 3: CC716 firmware 1.5 with multiple S7 connections
- Data points per S7-400H station ceiling: 3500 (firmware 1.5+).
- Number of S7 connections to the S7-400H: 1 (single station), so all 1000 data points fit on the S7 side.
- OPC UA variable ceiling on CC716 should be re-checked against the specific firmware release notes deployed.
Comparison: CP 443-1 OPC UA vs CC716 Gateway
| Aspect | CP 443-1 OPC UA (6GK7 443-1UX00-0XE0) | CC716 Gateway |
|---|---|---|
| Form factor | CP module inside S7-400H rack | External DIN-rail gateway |
| Status | Obsolete (Siemens) | Active product |
| Configuration | STEP 7 / HW Config, integrated with project | SiOME, separate toolchain |
| Redundancy | Inside the H-pair, follows CPU switch-over | Application-level: 1 or 2 CC716 + client logic |
| Marine / offshore acceptance | High (lives in the rack) | High (no PC in the loop) |
| Address mapping | Direct from STEP 7 symbol table | SiOME import — partial DB exports misalign offsets |
| Data point ceiling | Set by CP firmware release | 500 per station (<FW 1.5), 3500 per station (FW 1.5+) |
| Maintenance off-site | Project file is in STEP 7 | Project is device-coupled; a spare unit is the practical approach |
FAQ
Can the CloudConnect 716 replace the obsolete CP 443-1 OPC UA in a redundant S7-400H system?
Yes. The CC716 acts as an external OPC UA server gateway connected over Industrial Ethernet to the S7-400H pair. It does not live inside the rack like the CP 443-1 OPC UA did, so redundancy moves from the rack-internal H-system layer to an application-level pattern: one or two CC716 units plus failover logic in the OPC UA client. See the Siemens application example 109772282 for the canonical S7-to-OPC UA commissioning flow.
How many OPC UA variables can a CC712 expose and how do I exceed 500 variables?
The CC712 baseline is 500 OPC UA variables and 100 arrays. To expose more than 500 raw signals, bundle related signals into OPC UA arrays so each array counts as one variable. A 700-BOOL + 300-REAL signal set can fit as 7 BOOL arrays (100 each) plus 30 REAL arrays (10 each) for a total of 37 array variables. On a CC716 with firmware 1.5 or later, the per-station S7 data point ceiling rises to 3500 via multiple S7 connections, which removes the data point bottleneck on the field side.
How is redundancy handled between the CC716 and the S7-400H pair?
The CC716 itself is a single device and is not a redundant partner of the H-CPU pair. The standard approach is to deploy two CC716 units (Topology A), each opening its own S7 connection to the H-pair, and to let the OPC UA client select the surviving server by timestamp or status code. A single-CC716 approach (Topology B) is acceptable only when the consumer is tolerant to a single gateway failure.
Why do my OPC UA addresses come out with the wrong byte offset after import?
SiOME consumes Siemens-native STEP 7 export files. If the exported file contains only the symbols that have actual content, the importer packs them sequentially starting at offset 0, which no longer matches the real DB byte offsets. The mitigation is to export the full DB layout (every byte, including empty placeholders) or to hand-edit each variable's offset in SiOME. Always verify offsets with UaExpert after import.
Is the CC716 a better fit than SIMATIC NET OPC Server for marine / offshore projects?
Per the source project's experience, yes. SIMATIC NET OPC Server runs on a Windows PC station, and PC-based solutions are typically harder to get approved under marine type-approval regimes than head-station industrial gateways. The CC716 is a fanless industrial device with no PC operating system in the data path, which simplifies the approval package. The trade-off is that the CC716 configuration workflow is device-coupled — keep a spare unit in the office for off-site support.