Fixing OPC Scout V10 BAD Quality on SIMATIC NET S7 Connections

Problem Overview

OPC Scout V10 (bundled with SIMATIC NET PC software) is the canonical diagnostic client for verifying S7 connections against a SIMATIC NET OPC DA server. When item qualities in the OPC Scout browsing tree report QUALITY=BAD or QUALITY=BAD/INVALID, the client is acknowledging the subscription but the server cannot deliver a valid process value. The connection from the engineering station to the S7-400 is technically reachable (ICMP ping succeeds, STEP 7 online functions work, item symbols are visible in OPC Scout), but no usable data crosses the S7 transport connection.

This is a distinct failure mode from a hard socket failure, where the item is reported as QUALITY=BAD/COMMUNICATION_FAILURE. A BAD/INVALID or generic BAD state almost always points to a configuration mismatch between the PC station project in STEP 7 / NETPro and the running SIMATIC NET OPC server service, or to a missing PC Station download of the XDB/PCD file that the OPC server runtime loads at boot.

This reference covers the full diagnostic chain for SIMATIC NET V8.x through V16 with OPC Scout V10 against an S7-400 / CP443-1 (Industrial Ethernet) target. Specific topics: PC station configuration, S7 connection establishment in NETPro, XDB download, OPC server runtime startup, item group definition, and quality-code interpretation per the OPC DA 2.05a / 3.0 specification.

Architecture and Component Identification

A correct deployment for OPC Scout V10 against an S7-400 uses the following components. Each must be identified in your project before diagnostics begin, because SIMATIC NET binds connections by logical names, not by IP address, and a mismatch at any layer produces a generic BAD quality.

Confirm the version pairing on the engineering station before continuing. SIMATIC NET V12 and later cannot coexist on the same machine with SIMATIC NET V8.x; mismatched or partially upgraded installations are a leading cause of items that browse cleanly yet stay BAD.

Required PC Station Components in HW Config

The PC station in STEP 7 HW Config (or TIA Portal "Devices & Networks") must contain both of the following slots, in the order shown. The order is enforced by SIMATIC NET and is verified against the running configuration during OPC server start-up.

1. Slot 1: OPC Server (component type index 16) — provided by SIMATIC NET PC software. In TIA Portal, the catalog item is SIMATIC NET OPC Server under PC Station > User Application.
2. Slot 2: IE General / CP1613 / CP1623 / Softnet IE — the Ethernet interface used to reach the S7-400. For wireless or virtual adapters, use the IE General (Layer-2 capable) component and set the Mode to Ethernet or ISO-on-TCP. Never assign a S7 connection to a generic NDIS adapter in PC station slot 2 without first binding the IE General to that physical interface via Configuration Console (SIMATIC NET V8.x) or Commissioning > Set PC station (TIA Portal).

Root Cause Analysis: Why OPC Scout Reports BAD

Per the OPC quality code semantics preserved from the OPC DA 3.0 specification, a BAD quality is the server's statement that "no usable value is available for this item." The cause is not always a wire problem; it is most often a state inside the OPC server engine that prevents the requested item from being associated with a valid source. The following five root causes account for the overwhelming majority of OPC Scout V10 BAD-quality incidents against S7-400.

Root Cause 1: PC Station XDB Not Downloaded to the Local Runtime

The single most common cause. The PC station was edited in NETPro, but the configuration was never written to the live PC station database (the *.XDB / *.PCD file the OPC server reads at startup). OPC Scout will browse the items (because it queries the project), but every read returns BAD because the OPC server engine has no active S7 connection matching the symbol's owner connection.

Root Cause 2: S7 Connection Built but Not Downloaded to the S7-400

STEP 7 / TIA Portal may export the configuration from the PC side only. If the S7-400's CP443-1 has no matching S7 connection, the CP443-1 will reject the OPC server's connection-establishment request, and OPC Scout items will report BAD/CONFIGURATION_ERROR (sub-code 0x80040000 range). Download must be performed to both the PC station and the S7-400 in the same NETPro session.

Root Cause 3: IP / Subnet Mismatch Between OPC Server's IE General and CP443-1

The OPC server sends the S7 connection request from the IP of the bound IE General adapter. If the CP443-1's IP is in a different subnet (or behind a NAT router that does not preserve the source port for ISO-on-TCP port 102), the S7 connection cannot establish. ICMP ping working through a consumer-grade router is not sufficient evidence; many routers block the TCP/102 path while permitting echo. Verify with telnet 192.168.0.1 102 from the engineering station command line — it must open.

Root Cause 4: PG/PC Interface Not Set to the IE General Bound Adapter

For SIMATIC NET V8.x, the Configuration Console binds the IE General component to a specific NDIS adapter. If the PG/PC Interface (in the Control Panel applet, or via Set PG/PC Interface) is left on PC-Internal (local), STEP 7 online functions still work, but the SIMATIC NET OPC server cannot resolve the IE General to a physical interface and starts without an active S7 transport.

Root Cause 5: Symbol Resolution Mismatch in OPC Scout V10

OPC Scout V10's "S7" access path uses the syntax S7:[<connectionname>]<symbolpath>. The <connectionname> is the logical S7 connection name as defined in NETPro, not the IP address. A typo, a renamed connection, or a connection that exists in NETPro but is disabled produces a browsable item that returns BAD/INVALID on every read.

Pre-Diagnostic Checklist

Run the following checks before editing any project. Each check costs less than 30 seconds and rules out 80% of bad-quality reports without project modification.

1. Ping CP443-1: ping 192.168.0.1 from the engineering station. A reply proves L3 reachability only.
2. Test S7 port: telnet 192.168.0.1 102 from a Windows command prompt. The cursor should land on a blank black screen. If it fails, the OPC server will not be able to connect either.
3. Verify STEP 7 online: In STEP 7 V5.5, choose PLC > Display Accessible Nodes with the PG/PC interface set to the IE General adapter. The S7-400 must appear. Online capability proves the S7 transport DLLs are functional and the IE General is correctly bound.
4. Check SIMATIC NET services: Open services.msc. The SIMATIC NET OPC Server and S7DOS services must be Started and Automatic.
5. Configuration Console state: Open SIMATIC NET Configuration Console and confirm the IE General mode is Ethernet (not PG mode), the assigned physical adapter is the correct NDIS instance, and the configured IP matches the engineering station's wired or wireless adapter IP.

Step-by-Step Resolution Procedure

The following procedure is the canonical fix for OPC Scout V10 reporting BAD on items after the S7 station was reconfigured. It assumes STEP 7 V5.5 + SIMATIC NET V8.x; equivalent TIA Portal / V16 steps are noted in brackets where they differ.

Step 1 — Validate the PC Station Project

In STEP 7 V5.5 HW Config, double-click the PC station and verify:

• Slot 1: OPC Server (firmware version matches the installed SIMATIC NET CD, e.g. V8.2).
• Slot 2: IE General with IP 192.168.0.241 (or your engineering station IP) and subnet mask matching the CP443-1 (typically 255.255.255.0).
• The PC station's Name matches the Windows hostname exactly. Use hostname in cmd to confirm.

Step 2 — Create the S7 Connection in NETPro

Right-click the OPC Server slot → Insert New Connection. In the connection dialog:

Save and close NETPro. The connection object becomes visible as a yellow "ladder" line between the PC station and the S7-400 station.

Step 3 — Download the Configuration to the PC Station (XDB)

This is the step that is most often skipped, producing the exact "symbols visible, quality BAD" symptom.

1. In NETPro, right-click the PC station and choose Download > Selected Stations.
2. Confirm the target is the local PC station (it must show the local PC station name and IP).
3. STEP 7 will prompt whether to stop the SIMATIC NET OPC server. Click Yes. The service stops, the XDB is written to %ProgramFiles%\Siemens\Automation\SIMATIC_NET\<version>\S7opc\Data\<stationname>.XDB, and the service restarts.

Step 4 — Download the Configuration to the S7-400 (CP443-1)

With the S7-400 selected as the target, choose PLC > Download in NETPro (or Online > Download to device in TIA Portal). This pushes the matching S7 connection into the CP443-1's connection table. The CP443-1 must be in Run with configuration (not Run without configuration) for the connection to become active; verify with the CP443-1's MODE switch position.

Step 5 — Restart SIMATIC NET OPC Server Service

Even if step 3 reported success, manually restart the service to force a clean read of the new XDB:

sc stop "SIMATIC NET OPC Server"
sc start "SIMATIC NET OPC Server"

Or via services.msc → right-click SIMATIC NET OPC Server → Restart. Wait 10–15 seconds for the S7 transports to establish; the service logs to %ProgramFiles%\Siemens\Automation\SIMATIC_NET\<ver>\S7opc\Trace\s7opc.log.

Step 6 — Add Items in OPC Scout V10

Open S7OPCSCOUT.exe from %ProgramFiles%\Siemens\Automation\SIMATIC_NET\<ver>\OPC\Bin (or the Start menu Siemens Automation > SIMATIC NET > OPC Scout).

1. Double-click OPC.SimaticNET under Local Server(s). The DA 2.05/3.0 server progID for SIMATIC NET is OPC.SimaticNET (DA 2.05a) or OPC.SimaticNET.DA (DA 3.0, V14+).
2. Navigate the tree to S7 → <connectionname> → CPU_4xx → Symbols. The connection name from step 2 appears here.
3. Drag a symbol (e.g. DB1.DBD0 or a named tag) into the right-hand item pane.
4. The quality cell should transition from BAD to GOOD within 1–2 seconds. If it does not, the diagnostic tree in the next section applies.

Verification

Once OPC Scout reports GOOD for at least one item, run the following verification suite before closing the commissioning session.

A passing disconnect/reconnect test is the strongest evidence that the S7 connection is properly bound on both ends; it also confirms the OPC server's auto-reconnect timeout (default 30 s) is functioning.

Troubleshooting Matrix

Use this matrix when the steps above do not produce a GOOD result. Each row maps a symptom to the most likely cause and the corrective action.

Quality-Code Reference for OPC DA 2.05a / 3.0

The OPC DA specification defines the quality word as a 16-bit field: 2 bits for Quality, 6 bits for Sub-status, 8 bits for Limit. The values most commonly observed in OPC Scout V10 are listed below for quick reference.

The OPC Foundation documents the full list in the OPC DA 3.0 specification, also referenced in OPC UA Standard forum note on BAD quality semantics.

Log and Trace Locations

When the matrix above does not pinpoint the cause, harvest the following logs and attach them to a Siemens Industry Online Support request.

For V12 and later, the trace directory is reorganised under %ProgramFiles%\Siemens\Automation\SIMATIC_NET\v<ver>\Trace; the S7OPCSCOUT log remains the primary correlation point.

Preventive Best Practices

Build these into commissioning procedure documents to prevent recurrence.

• Version lock: Document the exact SIMATIC NET build, STEP 7 / TIA Portal build, and S7-400 firmware version in a commissioning report. Cross-version mismatches are the most common latent cause of intermittent BAD qualities after Windows updates.
• Single source of truth: Always edit S7 connections in NETPro / Devices & Networks, never directly in the Configuration Console. The Configuration Console only binds the IE General to a physical adapter; the S7 connection lives in NETPro.
• Industrial network: For production cells, replace consumer wireless routers (Belkin N150 etc.) with SCALANCE W access points configured as a transparent bridge; the CP443-1 and the engineering station must be in the same L2 broadcast domain without NAT for ISO-on-TCP / S7 transport reliability.
• XDB backup: After every NETPro change, archive the resulting <stationname>.XDB alongside the STEP 7 project. This is the only file the OPC server reads; restoring a known-good XDB is often faster than re-editing the project.
• Service account: Run OPC server and OPC Scout under a dedicated Windows user, not SYSTEM. This keeps DCOM security simple when third-party clients (Ignition, Kepware, WinCC) are added later.

FAQ