Connecting Siemens S7-400 to Third-Party SCADA via OPC Server

The S7-400 family of Siemens controllers is a workhorse in cement, power, water, and metallurgical plants. Many of these plants run mixed-vendor SCADA layers: the bulk of the process is supervised by a DCS such as Supcon Advantrol-Pro (JX-300XP / WebField), Rockwell FactoryTalk, AVEVA, or iFIX, but brownfield expansions or skid-packaged equipment bring Siemens S7-400 PLCs into the picture. The question this article answers is: how do you expose S7-400 data to a non-Siemens SCADA without rewriting the SCADA?

The answer is OPC (OLE for Process Control). With OPC, the SCADA becomes an OPC Client and a piece of software on the engineering station becomes the OPC Server, talking natively to the S7-400 over Industrial Ethernet, PROFIBUS, or MPI. The Supcon JX-OPC server used with the ECS cement-kiln software does not have a native Siemens S7 driver, so a third-party or vendor-supplied OPC server is required to bridge between the S7-400 and the Advantrol-Pro client. The same pattern applies to any SCADA that speaks OPC DA or OPC UA.

OPC Architecture Overview for S7-400 Integration

OPC is a client/server model. The OPC Server is the only component that needs to know the native protocol of the PLC (S7COMM over ISO-on-TCP, S7COMM-PLUS, FETCH/WRITE on PROFIBUS, or MPI). The OPC Client only knows the standardized OPC interface (DA 2.05a/3.0, XML-DA, or UA 1.04+). This separation is exactly the design strength that allows Advantrol-Pro to subscribe to data from an S7-400, an ABB AC800M, and a Schneider M580 simultaneously without modification.

The S7-400 in the source configuration has an Industrial Ethernet CP (CP 443-1) already installed in the rack. The CPU exposes MPI and PROFIBUS DP on the front, but the Ethernet CP is the preferred connection path for OPC because it offers a non-routable, deterministic, and gigabit-scalable link. The MPI port is fine for engineering, but production OPC traffic belongs on Ethernet.

Why a Dedicated OPC Server Is Required

The plant is already running Supcon JX-OPC (the OPC server bundled with the Supcon JX-300XP DCS). That server is designed to talk to the Supcon proprietary I/O bus and does not implement the Siemens S7COMM PUT/GET protocol. The Advantrol-Pro client cannot use JX-OPC to reach a Siemens S7-400 because the server does not speak the Siemens wire format. Three options exist:

1. Use the SCADA's ability to connect to multiple OPC servers in parallel. Advantrol-Pro and most industrial SCADA clients allow several OPC Server ProgIDs to be added as data sources in the same project. Add the existing JX-OPC server for the DCS portion and add a Siemens-compatible OPC server for the S7-400 portion. The SCADA multiplexes tags from both.
2. Install SIMATIC NET IE LEAN OPC on a Windows station. This is the OEM Siemens product and ships with the SIMATIC NET DVD or download package. It is licensed per installation and includes an OPC DA 3.0 server that knows S7-400 directly.
3. Install a third-party Siemens OPC server such as MatrikonOPC for Siemens S7 PLCs, Softing S7 OPC Server, or Kepware Siemens TCP/IP Ethernet Driver. These are licensed per tag or per server and typically add features such as redundant S7 connections, simulation mode, and OPC UA exposure.

Option 2 is preferred when the SCADA vendor is Supcon and the user wants the lowest-risk path: a Siemens-certified server talking S7-400 to a Supcon OPC client. Option 3 is preferred when the user needs OPC UA exposure for downstream historians or IIoT gateways, or when the SCADA wants OPC UA rather than OPC DA.

Prerequisites

Hardware

• CPU: S7-400 with firmware V5.x or V6.x. CPUs 414-3, 416-3, 417-4 are common. The example uses CPU 416-3 PN/DP (6ES7416-3ES06-0AB0) with firmware V6.0.4 or later for S7COMM-PLUS support.
• Ethernet CP: CP 443-1 (6GK7443-1EX30-0XE0) for ISO-on-TCP, or CP 443-1 Advanced (6GK7443-1GX30-0XE0) for ISO-on-TCP plus OPC UA server function. Confirm the MLFB against the TIA Portal / STEP 7 hardware catalog.
• Switch: Managed Industrial Ethernet switch (SCALANCE XC-200, X-200, or X-300) with port priority and IGMP snooping if multicast is used.
• Engineering station: Windows 10 IoT LTSC 2019 or Windows Server 2016/2019, 8 GB RAM minimum, 100 GB free disk. The OPC Server runs here.

Software

• STEP 7 V5.6 SP2 (for classic S7-400) or TIA Portal V16 SP1 / V17 / V18 with the S7-400 HSPs installed.
• SIMATIC NET PC software V16 SP1 or later. The DVD or download contains the OPC Server, the S7COMM driver, and the Station Configuration Editor.
• SIMATIC NET IE LEAN OPC license. A LEAN license is part of the SIMATIC NET DVD; no separate hardware dongle is required for IE LEAN.
• Supcon Advantrol-Pro V3.7 or later with the OPC Client option enabled.

Network

• IP address on the CP 443-1: e.g. 192.168.10.20, subnet mask 255.255.255.0, no default gateway required if the OPC Server is on the same VLAN.
• IP address on the engineering station running SIMATIC NET: 192.168.10.50.
• TCP/102 (ISO-on-TCP / RFC 1006) open in the Windows firewall in both directions between the OPC server station and the CP 443-1.

Step 1: Configure the S7-400 CP 443-1 in STEP 7

1. Open STEP 7 V5.6 and load the S7-400 station, or open the project for the target S7-400.
2. In HW Config, double-click the CP 443-1. Open the Properties > Ethernet Interface dialog.
3. Assign IP address 192.168.10.20, subnet 255.255.255.0, and the MAC address printed on the front of the CP.
4. Switch to the Options tab. Enable "Active connection establishment" only if the OPC server is the active partner; for OPC, the station typically is the passive partner, so leave it unchecked.
5. In the Connections tab, add an S7 connection (S7COMM). Note the local connection ID; this becomes the connection name in the OPC configuration. The remote end-point is the OPC server station (MAC/IP). The remote TSAP defaults to 01.01 for an OPC server.
6. Save and download to the S7-400 CPU. The CP 443-1 will reboot. Wait for RUN on the CPU and link-up on the CP.

Step 2: Configure the OPC Station with SIMATIC NET Station Configuration Editor

The SIMATIC NET OPC server is bound to a PC Station. The PC Station is a virtual S7 station that the Station Configuration Editor manages.

1. Open Station Configuration Editor from Start > Siemens Automation > SIMATIC > SIMATIC NET > Configuration.
2. Add an OPC Server component and an IE General component. Assign the IE General the IP address of the engineering station: 192.168.10.50.
3. Right-click the OPC Server index 1 and select Properties. The component name is the OPC ProgID that the SCADA client uses: OPC.SimaticNET.
4. Save and close. The PC Station is stored in C:\ProgramData\Siemens\Automation\SimaticOpc\Config\ as an XML file.

Step 3: Configure the S7 Connection in the OPC Server

Use the SIMATIC NET Configuration tool (part of SIMATIC NET PC software) to declare the S7 connection between the OPC server and the CP 443-1.

1. Launch SIMATIC NET Configuration and open the PC Station you created.
2. Drag an S7 Connection from the catalog into the OPC Server slot. The connection wizard opens.
3. Set the partner IP to 192.168.10.20 (the CP 443-1). Set the partner TSAP to 01.01.
4. Set the connection name to a meaningful string such as S7400_OPC_LINK_1. This name maps to the connection resource in the OPC namespace.
5. Download the PC Station configuration to the runtime. The SIMATIC NET service S7oiehsx must be running. Restart it from services.msc if needed.

Step 4: Build the OPC Tag Database

Two options exist for the tag database:

• Manual: Open the OPC Scout V10 (bundled with SIMATIC NET). Browse to OPC.SimaticNET > S7 > S7400_OPC_LINK_1 > DB1 for example, drag items such as DB1,REAL0, DB1,INT4, DB1,BOOL10.0 into the tag list. Export the tag list to CSV.
• Symbolic: If the S7-400 project has DB symbols exported to a symbol table (.sdf), the OPC Scout can import the symbols and assign item IDs of the form S7:[S7400_OPC_LINK_1]DB1.PV_Temp. This is the recommended approach because renames in the PLC project propagate to the OPC tag list.

Step 5: Configure the Advantrol-Pro OPC Client

1. Open Advantrol-Pro and load the project for the cement or process plant. Open the I/O Driver or Device configuration dialog (path varies by version; in V3.7 it is under System > I/O Drivers > OPC).
2. Add a new OPC DA Client channel. Set the server name to the host running SIMATIC NET and the ProgID to OPC.SimaticNET. The CLSID for OPC.SimaticNET on SIMATIC NET V16 is {F86D7D40-1B81-11D3-8B30-0060B0EBE0E1}.
3. Click Browse. The Advantrol-Pro browser enumerates the S7 connection S7400_OPC_LINK_1 and the DB items. Add the items you defined in Step 4.
4. For each tag, set the update rate. Plant-level monitoring tags can use 1000 ms; control loops require 100-250 ms. The OPC server aggregates requests in groups; do not set per-tag rates below 100 ms on a plant-wide SCADA.
5. Map the OPC items to the Advantrol-Pro point database (tags in Advantrol-Pro parlance). Set scan class to match the update rate.
6. Save and deploy to the Advantrol runtime. Restart the Advantrol IO service.

Step 6: Configure the Firewall and DCOM

OPC DA uses DCOM. When the SCADA client and OPC server run on different Windows machines, DCOM must be opened on both. The minimum required:

1. On the OPC server, add a Windows Firewall inbound rule for OPC.EXE and OpcEnum.exe (found in C:\Windows\SysWOW64 on 64-bit Windows). Use the official MatrikonOPC DCOM configuration guide as a reference.
2. In Component Services > Computers > My Computer > DCOM Config, right-click OPC.SimaticNET, open Properties > Identity, and set the launching user to The interactive user or to a dedicated service account that owns the SIMATIC NET configuration.
3. Set Authentication Level to Connect (lowest) for testing, then raise to Packet Privacy for production.
4. If the SCADA and OPC server are on the same machine, you can skip the firewall step but still need to set the Identity of the OPC server.

Step 7: Verify End-to-End

Verification is a sequence of progressively deeper checks. Each step must pass before moving on.

1. Layer 1 – Network: From the engineering station, ping 192.168.10.20. The CP 443-1 must reply. Then telnet 192.168.10.20 102 must connect (a blank screen is normal; S7COMM does not echo ASCII).
2. Layer 2 – S7 connection: In the SIMATIC NET Diagnostics tool, the connection S7400_OPC_LINK_1 must show Established. If it shows Not connected, check the partner TSAP and that the S7-400 firewall (CP 443-1) has the S7 connection in the access list.
3. Layer 3 – OPC DA: In OPC Scout, drag DB1,REAL0 onto a watch window. Force a value in STEP 7 (Variable Table > Monitor/Modify). The value must appear in the OPC Scout within 1 second.
4. Layer 4 – Advantrol-Pro: Open the Advantrol-Pro point database. The OPC items must show Good quality. Use the OPC Diagnostics panel to confirm subscription state. A Bad quality usually means the Advantrol-Pro IO service is running under an account that cannot launch the OPC server.
5. Layer 5 – Plant display: Open a process graphic in Advantrol runtime that uses the imported tags. The numbers must update in real time at the configured scan rate.

Troubleshooting Common Issues

"Cannot browse OPC.SimaticNET" from Advantrol-Pro

The Advantrol-Pro OPC client tries to launch the OPC server on the remote machine through DCOM. If OpcEnum is not registered or the firewall blocks TCP/135, the server browser returns an empty list. Register OpcEnum with regsvr32 opcenum.exe in an elevated command prompt, then open TCP/135 in the firewall.

"S7 protocol error 0x03 / 0x0A" in the OPC log

The SIMATIC NET OPC server logs hex protocol errors. 0x03 indicates "Object does not exist" (wrong DB number or uninitialized DB). 0x0A indicates "Object access error" (DB write-protected or wrong access level). The S7-400 access level in STEP 7 is set under CPU Properties > Protection; the OPC user account must have at least Read rights.

Values Update Once, Then Freeze

This is the classic "subscription timeout" symptom. The OPC client subscribes to the tag, the first value arrives, then the S7 connection is torn down. Check the CP 443-1 Keep Alive setting in STEP 7. The default 30 s is fine; a value of 1 s is too aggressive. Also check the S7-400 CPU's Communication Resources: each S7 connection consumes one PG/OP connection and one S7 connection resource. The CPU 416-3 ships with 16 PG/OP + 16 S7 connections, but in cement plants the resources are often exhausted by WinCC clients. If exhausted, raise to 32 with the CPU's object properties (varies by MLFB).

Multiple SCADA Clients Conflict

When Advantrol-Pro and an existing WinCC runtime both want the same S7 connection, the OPC server hands out a copy of the tag list. The S7-400 sees one PUT/GET session per client, so the connection count on the CP 443-1 rises. Use the OPC server's Redundancy feature to share the same S7 connection across multiple OPC clients: SIMATIC NET supports "shared S7 connection" for this case.

OPC UA as a Modern Alternative

For new deployments, OPC UA eliminates DCOM and firewall pain. The S7-1500 line has OPC UA server built in (firmware V2.0+). The S7-400 with a CP 443-1 Advanced (6GK7443-1GX30-0XE0) and firmware V8.2 or later on the CP can act as an OPC UA server. The configuration is similar: assign a port (default TCP/4840), generate certificates, and configure the security policy (None, Basic128Rsa15, Basic256, Basic256Sha256).

For S7-400 with classic CP 443-1 EX30, OPC UA is exposed via SIMATIC NET on the engineering station. The configuration in SIMATIC NET Configuration adds an OPC UA Server component that maps DA items to UA nodes. Reference: OPC Foundation article on OPC UA data logging from S7-1500.

Advantrol-Pro V3.7.2 and later include an OPC UA client driver. The server endpoint URL is opc.tcp://192.168.10.50:4840. After importing the certificate from the OPC UA server, the tag browse exposes the same DB items with the same semantics.

Choosing Between SIMATIC NET, MatrikonOPC, and Kepware

For the cement-plant use case described in the source — Supcon Advantrol-Pro as the SCADA, a CP 443-1 already in the S7-400, and an existing JX-OPC server for the DCS portion — SIMATIC NET IE LEAN is the recommended primary choice. It is bundled with the engineering station's SIMATIC NET DVD, supported directly by Siemens, and shares the same S7 connection resource model as WinCC. Reference: MatrikonOPC Siemens Suite product page as a comparison point.

Performance and Capacity Planning

Each S7 connection in the S7-400 supports up to 32 parallel PUT/GET requests in firmware V6, and 64 in V7. The SIMATIC NET OPC server can hold up to 8 simultaneous S7 connections per OPC server instance. With one CP 443-1 and one OPC server, the plant can read approximately 8 000 items at 1 s update rate without saturating the S7 connection. Beyond that, the typical bottlenecks are:

• CP 443-1 CPU load (visible in STEP 7 diagnostics > CP diagnostics > CPU load)
• Network utilization on the S7-400 subnet (SCALANCE Web UI > Information > Port Statistics)
• OPC server workstation CPU (Task Manager > opc.exe handle)

For larger tag counts (10 000+), use the S7_OPT driver (optimized packing), raise the SIMATIC NET service priority, and consider splitting tags across multiple S7 connections on different CP 443-1 cards.

Security Considerations

1. Network segmentation: Place the S7-400 and the OPC server in the same control VLAN. Do not expose OPC DA to the corporate network.
2. Account hardening: Run the SIMATIC NET service and Advantrol-Pro IO under named service accounts with no interactive logon rights. Deny the account the "Log on locally" right.
3. Firewall: Restrict TCP/102 to the IP of the OPC server. Block TCP/135 (DCOM) at the VLAN boundary.
4. OPC UA: Use Basic256Sha256 with signed and encrypted messages. Generate per-installation certificates; do not reuse the SIMATIC NET default.
5. S7-400 access level: Set the CPU password and remove the "No password (full access)" option under CPU Properties > Protection. Use Read-only password for the OPC server account.

Edge Cases and Field Notes

• Some S7-400 CPUs older than 6ES7416-3ES06 (firmware V5.1) cap the OPC connection resource at 8. Verify the MLFB before commissioning.
• Advantrol-Pro V3.5.x does not browse OPC items dynamically; the tag list must be exported from OPC Scout to CSV and imported into Advantrol. V3.7+ supports dynamic browse.
• If the Advantrol-Pro runtime runs on Linux (WebField OCS V4), the OPC client is built on OpenSCADA; the bridge software is the same — point the client at opc.tcp://<host>:4840 for OPC UA, or use a local DCOM bridge from a Windows relay host.
• When the OPC server and the SCADA are on the same Windows host, set the OPC server's Endpoint to localhost in SIMATIC NET Configuration to keep DCOM traffic off the wire.

Summary of Connection Topology

FAQ