Reading Siemens S7-1200 Optimized DBs via OPC: Symbolic Access

1. Problem Overview: Optimized Data Blocks Are Invisible to Legacy OPC DA

You are integrating a Siemens SIMATIC S7-1200 PLC that was programmed by another party. You receive an address list of data blocks (DBs) you must integrate into a higher-level system through OPC, but the integrator-side documentation only lists symbolic names such as "DB_Motor".Motor1.SpeedActual. There are no absolute offsets like DB1.DBD4. Classic OPC DA servers such as Softing S7/S5 OPC, Matrikon Modbus/TCP OPC, Kepware Siemens TCP/IP Ethernet Driver, and similar products return "address not found" or quality OPC_QUALITY_BAD because the blocks were created with the Optimized block access option in TIA Portal.

This is the single most common dead-end in machine integration projects where the original machine builder never delivered a side-by-side standard DB and the integrator cannot legally or contractually modify the PLC program. The integrator is left with a SCADA system, an OPC tag table, and a hardware inventory that simply cannot see the PLC variables.

This technical reference walks through the four engineering paths that actually work when you cannot modify the PLC program, lists every prerequisite that is silently assumed, and ends with a verification procedure and a troubleshooting matrix you can use on the plant floor.

2. Root Cause: What "Optimized Block Access" Changes Inside the CPU

In TIA Portal, when a DB is created (or when the static section of a function block is generated), the developer can toggle Optimized block access in the DB or FB properties under Attributes. The setting fundamentally changes how the compiler lays out the data in load memory and work memory, and how the runtime publishes it to the outside world.

The Siemens S7 communication protocol — used by virtually every classic OPC DA server — exposes memory by absolute byte offset inside the DB. When the block is optimized, the firmware does not publish stable offsets because the symbolic names are resolved dynamically through an internal symbol table. The OPC DA client simply has nothing to put into its tag address field. The protocol is not "broken" — it is doing exactly what the protocol contract specifies, and that contract does not include a way to ask "give me DB1.MyVariable by name."

3. Why Classic OPC DA Returns Bad Quality

Classic OPC DA servers all use one of two Siemens transports: ISO-on-TCP (RFC 1006) carrying PUT/GET, or S7 Communication over the same transport. Both transports require one of the following on every read or write request:

• A known absolute address inside a known block: DB1.DBD0, DB1.DBX4.2, MW10, I0.0, Q0.1.
• A known data type length so the server can pack the correct byte count into the request frame.
• A known byte order — the S7 transport is little-endian (Intel byte order) for INT, DINT, REAL, and WORD.

Because optimized DBs do not expose these addresses to the S7 protocol layer, the OPC server cannot resolve the tag. The client receives quality OPC_QUALITY_BAD with sub-status OPC_E_INVALID, or the tag simply does not appear in the server's address space at all. Some servers display the tag with a stub value; others refuse to add it. None of these are bugs — they are the contract of the S7 protocol when faced with optimized blocks.

A second, equally important limitation: classic OPC DA has no concept of a "symbolic browse." The address space is flat and typed, not hierarchical and named. There is no DA service for "list all variables in DB1 by name." Even if the S7 protocol could expose the symbol table, DA clients would have no way to consume it. That is what OPC UA was designed to solve, and why the right long-term path is almost always OPC UA.

4. Critical Configuration: The "Accessible from HMI" Attribute

Before any of the solutions in this article can succeed, every variable you need to read or write must have the Accessible from HMI attribute enabled. Without it, the variable is hidden from every communication layer — S7 protocol, OPC DA, OPC UA, even SIMATIC HMI panels. The attribute is per-variable and defaults to off for safety.

1. Open the DB in TIA Portal.
2. Select one or more variable rows in the declaration table.
3. In the right-hand Properties > Attributes pane, tick the Accessible from HMI checkbox.
4. Repeat for every variable you need to expose.
5. Compile the project (Ctrl+B or the lightning-bolt icon) and download to the PLC.

For large DBs with hundreds of variables, use the multi-row selection and the right-click context menu to apply the attribute in bulk. Verify in the TIA Portal online view that the attribute was retained across the download — a partial download of just the DB changes the variable list but not always the attributes.

5. Solution 1: Request a Bridge (Mirror) Data Block with Absolute Access

This is the most reliable path when the integrator cannot re-engineer the OPC layer. The PLC programmer creates a single standard (non-optimized) DB that mirrors only the variables you need. You then point your classic OPC DA server at the absolute offsets in that mirror DB. The PLC code copies data into the bridge DB each scan, and copies writes back from the bridge to the source DB.

5.1 What to send to the PLC programmer

Provide an Excel sheet with this column structure to remove ambiguity and prevent back-and-forth emails:

5.2 Sample SCL code for the bridge

The PLC programmer drops the following into OB1 (or a faster cyclic OB if scan time allows):

// Mirror optimized source DBs into a single standard-access bridge DB
// Place in OB1 so it runs every scan

// Reads: source -> bridge
"DB_Interface".SpeedActual_R   := "DB_Motor".Motor1.SpeedActual;
"DB_Interface".LineState_I     := "DB_LineCtrl".Line.State;
"DB_Interface".RecipeID_DI     := "DB_Recipe".Recipe.ID;

// Writes: bridge -> source (one-direction per OB1 pass)
"DB_Recipe".Recipe.ID          := "DB_Interface".RecipeIDCmd_DI;

// Edge-triggered write commands
IF "DB_Interface".LoadCmd_B AND NOT "DB_Interface".LoadCmdPrev_B THEN
    "DB_Recipe".Recipe.LoadCmd := TRUE;
END_IF;
"DB_Interface".LoadCmdPrev_B  := "DB_Interface".LoadCmd_B;

5.3 Configure the bridge DB

1. In the TIA Portal project tree, right-click Program blocks → Add new block → Data block.
2. In block properties, uncheck Optimized block access. The block must be standard for the OPC DA server to address it by offset.
3. Add one variable per signal from the integrator sheet, in the order you want the offsets to fall. Group by data type to keep byte alignment clean.
4. Tick Accessible from HMI for every variable.
5. Compile and download to the PLC. Now DB_Interface.DBD0, DB_Interface.DBW4, DB_Interface.DBD6, DB_Interface.DBX12.0 are stable offsets your OPC server can target.

5.4 OPC DA configuration (example for Softing, Kepware, Matrikon)

Channel name:        Siemens TCP/IP Ethernet
Device driver:       Siemens S7-1200/1500 (or compatible S7-300/400 fallback)
PLC IP address:      192.168.0.10
Rack / Slot:         0 / 1  (S7-1200 always slot 1)

Tag address examples:
  MotorSpeed_r       DB100.DBD0      REAL   4 bytes   100 ms
  LineState_i        DB100.DBW4      INT    2 bytes   100 ms
  RecipeID_di        DB100.DBD6      DINT   4 bytes   on change
  LoadCmd_b          DB100.DBX12.0   BOOL   1 bit     on change

Byte order:          Little-endian (Intel)
Scan mode:           Polled, 100 ms default

Performance cost is minimal — a single assignment per signal in OB1 runs well under 1 ms even with 200 mirrored tags on a CPU 1214C. The CPU load impact is negligible compared to the savings in OPC debugging time. The downside is that the bridge DB itself becomes a maintenance artifact: every new signal requires a code change in the PLC, a re-download, and an OPC tag database update.

6. Solution 2: Activate the Built-in OPC UA Server on S7-1200

Starting with firmware V4.4 (released 2018), every S7-1200 CPU can act as an OPC UA server directly, with no additional hardware and — on most current models — no extra license. Every variable that has Accessible from HMI set becomes browseable by symbolic name over the OPC UA binary protocol on TCP port 4840 (default). This is the cleanest, most sustainable solution and should be your first choice whenever the PLC programmer is willing to spend ten minutes enabling it.

6.1 Check prerequisites

6.2 Activate the server in TIA Portal

1. Open the PLC device configuration in the project tree.
2. Navigate to Properties → OPC UA → Server.
3. Check Activate OPC UA Server.
4. Choose the port (default 4840) and at least one endpoint security policy: None for lab testing, Basic128Rsa15 or Basic256Sha256 for production.
5. Define the server certificate under Security → Server certificate. Export the certificate and install it in the OPC UA client's trusted store.
6. Under Runtime licenses, confirm the OPC UA option is licensed. If not, transfer the license from the license key file.
7. Download the hardware configuration to the PLC (not just the program blocks).

6.3 Verify with UA Expert (free OPC Foundation client)

1. Install UA Expert from the OPC Foundation downloads page.
2. Add a new server: opc.tcp://192.168.0.10:4840.
3. Trust the server certificate when prompted.
4. Browse to Objects → Server interface → DB_Motor. Variables with Accessible from HMI appear as child nodes.
5. Drag a variable onto a DataView panel; the value, data type, source timestamp, and server timestamp should populate.

Once UA Expert confirms the address space, your SCADA or HMI client can connect using the same endpoint URL and certificate. No bridge code, no extra PLC scan time, and no fragile offsets — the symbol table published by the firmware is the source of truth.

7. Solution 3: Symbolic Access During Runtime (S7-1500 Path)

For S7-1500 systems, and for S7-1200 from firmware V4.5 with the S7-1200 symbolic access feature, SCL supports symbolic variable access by string name at runtime. The PLC code registers a DB and looks up a symbol inside it, returning a VARIANT pointer that can be dereferenced. This is documented at the official Siemens TIA Portal help page Symbolic access during runtime (S7-1500).

7.1 When this path makes sense

• You have an S7-1500 (or compatible S7-1200 firmware) and can add code.
• The OPC client can only consume absolute addresses but you need to expose many tags without enumerating each one in source.
• You want to drive a generic tag table from configuration data rather than hand-coded assignments.
• The integrator needs the PLC to compute the absolute address of a symbol whose name is supplied by the SCADA.

7.2 SCL sketch

// Cyclic OB1
// Symbol lookup at runtime — register the DB, then resolve a name string
"dbSymLookup"(req        := TRUE,
              lookUp     := 'MyDB.MyTag',
              dataBlock  := "DB_Registry",
              found      => #bFound,
              symAddress => #pSymbolAddr);

IF #bFound THEN
    // Dereference the VARIANT pointer into the bridge DB
    IF IS_REAL(#pSymbolAddr) THEN
        "DB_Interface".MirrorReal := #pSymbolAddr^;
    ELSIF IS_BOOL(#pSymbolAddr) THEN
        "DB_Interface".MirrorBool := #pSymbolAddr^;
    END_IF;
END_IF;

8. Solution 4: Third-Party OPC Servers with Symbolic Capability

A small number of OPC vendors implement a Siemens-specific parser that walks the TIA Portal project (offline via exported XML, or online via the OPC UA interface) and rebuilds a symbolic tag namespace that legacy DA clients can consume through a wrapper or DA-to-UA bridge. Products in this category include Softing edgeConnector Siemens, the Siemens SIMATIC NET OPC Server with the S7-1200/1500 symbolic driver, and Prosys OPC UA Gateway. These map the symbolic browser onto legacy DA clients.

8.1 Decision factors

When evaluating these, confirm that the vendor specifically supports the S7-1200 OPC UA interface (firmware V4.4+) or the SIMATIC S7-1200/1500 symbolic driver. Generic S7-300/400 drivers will still fail because they bind to absolute addresses only.

9. Verification: Confirming the OPC Path Works End-to-End

9.1 Bridge DB path

1. In TIA Portal online view, watch DB_Interface.DBD0 in a VAT — confirm the value updates when you change the source DB_Motor.Motor1.SpeedActual in a separate VAT.
2. From the OPC client, read the same tag and confirm a non-stale timestamp (within your scan rate).
3. Force a write from the OPC client; verify the source variable updates in the PLC VAT within one scan.
4. Cycle power on the PLC; confirm the bridge DB re-populates from retained source data on the next scan.
5. Verify byte order by writing a known pattern (e.g., REAL 1234.5 = 0x449A5000) and reading it back as four bytes.

9.2 OPC UA path

1. Browse the server from UA Expert; the address space under your DB must list every variable flagged Accessible from HMI.
2. Subscribe to a tag with a 100 ms publishing interval; confirm monitored item notifications arrive without Bad_CommunicationError.
3. Check ServerStatus_State — should report Running.
4. Disconnect and reconnect; verify the session re-establishes without re-importing the certificate.
5. Inspect ServerStatus_StartTime, ServerStatus_CurrentTime, and ServerStatus_BuildInfo to confirm the server is the S7-1200 and not a stale cached session.

9.3 Symbolic runtime path

1. Force the lookup string to an invalid name; the found output should go FALSE within one scan.
2. Force a write to the symbol; confirm the OPC client receives the new value.
3. Stop and restart the PLC; confirm the registry DB re-populates and the lookups succeed again.
4. Monitor the cycle time impact — runtime symbolic lookup is heavier than a direct assignment; budget accordingly.

10. Decision Flowchart

11. Troubleshooting Matrix

12. Standards and Reference Material

The S7-1200 OPC UA server implements the OPC UA Binary protocol as defined in IEC 62541. The S7 transport used by legacy OPC DA servers is the Siemens-proprietary ISO-on-TCP (RFC 1006) carrying the S7 Communication or PUT/GET application layer. Security policies available on the S7-1200 OPC UA endpoint are None, Basic128Rsa15, and Basic256Sha256; the legacy Basic128Rsa15 policy is considered deprecated by the OPC Foundation and should be phased out in favor of Basic256Sha256 for any new integration.

For the runtime symbolic access feature on S7-1500, refer to the official Siemens TIA Portal help topic Symbolic access during runtime (S7-1500). Always confirm the feature set against the specific TIA Portal version and CPU firmware you have installed; some features are gated to specific firmware versions and CPU SKUs.

FAQ