Resolving OPC UA Server Discovery Failures on SIMATIC Comfort Panels

SIMATIC Comfort Panels (TP700, TP900, TP1200, TP1500, TP1900, TP2200) ship with an integrated OPC UA server starting from firmware that pairs with WinCC Comfort/Advanced in TIA Portal V13 SP1 and later. The server is fully embedded in the panel runtime, listens on TCP port 4870, and exposes the panel's HMI tags through namespace ns=3 with a string-based NodeId format ns=3;s=<TagName>. Although the server is functional out of the box, engineers routinely hit two wall-clock problems: (1) clients report "The connection to the server is down" even when the panel is reachable, and (2) clients must enter opc.tcp://<HostName>:4870 manually because the Local Discovery Server (LDS) cannot resolve the endpoint. This article explains the root cause and the field-proven remediation, including the mandatory name resolution step that the panel runtime depends on but never advertises.

1. Comfort Panel OPC UA Server Capabilities and Limits

The Comfort Panel OPC UA server is a stripped-down subset of the SIMATIC NET OPC UA server. Knowing the supported feature set is critical when a client tool expects capabilities that the panel does not implement.

2. TIA Portal Project Configuration

Open the HMI device configuration in TIA Portal, navigate to Properties > OPC UA Server, and verify the following settings before compiling and downloading.

1. Enable the server: Tick "Operate as OPC-UA Server". The runtime licence is included in the Comfort Panel firmware; no separate authorisation is required.
2. Select the security policy: The fastest setup is "None" for initial bring-up. Production deployments must use Basic128Rsa15 or stronger, and a self-signed server certificate must be generated automatically or supplied via TIA Portal.
3. Activate tag exposure: Mark every HMI tag that should be browsable in Properties > OPC UA > Accessible via OPC UA. Internal tags (without connection) are exposed by default if their visibility flag is set.
4. Compile and download: "Software (full)" download, not "Software (partial)". A partial download does not re-instantiate the OPC UA stack on the panel.
5. Runtime settings: Under Runtime Settings > Services, confirm the OPC UA service is set to "Start automatically on runtime start".

3. Endpoint URL Format and Port Allocation

The Comfort Panel always binds the OPC UA server endpoint to TCP port 4870. The URL that clients must enter manually is:

The PanelHostName is the device name configured in Device configuration > Properties > General > Device name in TIA Portal (default: TP900-Comfort). The panel's OPC UA stack uses this name to build the ApplicationDescription returned in the FindServers and GetEndpoints responses. The name is also the value displayed in the client's discovery tree under Servers > [HostName].

The server returns a ServerState of Running (value 0) once the runtime has fully started. During HMI startup the endpoint may briefly reply with Shutdown (value 4) for 10 to 25 seconds; the client must retry. The default OperationTimeout on the panel side is 60 000 ms, so a client-side timeout of 30 000 ms is recommended to avoid premature failure.

4. Root Cause: Why "The Connection to the Server is Down" Appears

The two symptoms described in the source — Siemens OPC Scout reporting a down connection and the UA Sample Client only working with a manually entered endpoint — share a single root cause: name resolution is broken on the client PC.

The Comfort Panel OPC UA stack uses the panel's configured device name in three places:

1. Inside the ApplicationDescription.applicationUri (e.g. urn:<HostName>:Siemens.HMI.ComfortPanel).
2. Inside the EndpointDescription.url field.
3. Inside the ServerArray string of ServerCapabilities.

When a client issues CreateSession, the stack performs a reverse lookup of the hostname from the ApplicationDescription.applicationUri to bind the session to the same transport channel. If the client cannot resolve the hostname back to an IP address, the stack rejects the session request with Bad_ServerUriInvalid (0x801F4000) and the client reports the connection as down. The UA Sample Client from the OPC Foundation masks this error because it falls back to the manually-entered endpoint URL for transport, but it cannot browse namespaces because the namespace array is keyed by the applicationUri.

5. Solution A — Configure lmhosts for NetBIOS Name Resolution

The most field-proven fix is to map the panel hostname to its IPv4 address in the client PC's lmhosts file. This works without a DNS server, without WINS, and across routed subnets.

5.1 Steps on Windows 7 / 10 / 11

1. Open File Explorer as Administrator and navigate to C:\Windows\System32\drivers\etc\.
2. Copy the file lmhosts.sam to a new file named lmhosts (no extension).
3. Edit lmhosts with Notepad and append a line in the form:
   192.168.10.42 TP900-Comfort #PRE
   Use one space between the IP and the hostname. The #PRE flag pre-loads the entry into the NetBIOS name cache; without it, the entry is only used when WINS lookup fails.
4. Save the file. Windows will not pick up lmhosts until the name cache is flushed or the machine is rebooted.
5. Open an elevated command prompt and run:
   nbtstat -R (reload remote cache table)
   nbtstat -c (verify the entry is loaded — you should see the IP and name in the list)
6. From the same command prompt, run ping TP900-Comfort and confirm the IP address resolves. If ping fails, the OPC UA client will also fail.

5.2 Alternative — Hosts File

If the client PC is on a non-Windows platform or NetBIOS is unsuitable, edit C:\Windows\System32\drivers\etc\hosts (or /etc/hosts on Linux) and add the same line without the #PRE suffix. The OPC UA stack on the Comfort Panel accepts either DNS or hosts-file resolution — the panel does not care which mechanism the client uses, only that resolution succeeds.

6. Solution B — Configure Siemens OPC Scout V10

Siemens OPC Scout V10 (shipped with SIMATIC NET V14 SP1 or later, installable from the SIMATIC NET DVD or downloaded from the Siemens Industry Online Support portal) is the canonical client. Configure it as follows:

1. Launch OPC Scout V10 with administrator rights. The tool requires admin to load its private certificate store.
2. Right-click Server > Add Server and enter the full URL: opc.tcp://TP900-Comfort:4870.
3. Choose the security profile. If the panel is set to None, select None here too. Mismatched security policies cause Bad_SecurityPolicyRejected (0x80140000).
4. Click Connect. The server should appear in the tree with status Connected.
5. Drag tags from the Tags folder into the watch window. The NodeId for an HMI tag named Temperature is ns=3;s=Temperature.

If OPC Scout still reports "The connection to the server is down" after the lmhosts fix, the next most likely cause is a firewall rule. The Comfort Panel accepts inbound TCP/4870 unconditionally, but the Windows Defender Firewall on the PC blocks outbound connections to UDP/4840 (multicast discovery) and to non-standard TCP ports. Add an inbound rule allowing %SystemRoot%\System32\OPCScoutV10.exe and an outbound rule permitting TCP/4870 to the panel's subnet.

7. Solution C — Configure the UA Sample Client (OPC Foundation)

The reference client from the OPC Foundation is UA .NET Standard Sample Client, available at the OPC Foundation developer tools page. Its configuration differs from OPC Scout:

1. On the Discover tab, enter opc.tcp://TP900-Comfort:4870 in the Custom URL field. Click Discover. The client will perform GetEndpoints against the URL directly.
2. On the Connect tab, double-click the discovered endpoint. If no endpoints appear, the hostname resolution has failed — re-check lmhosts and ping.
3. Once connected, switch to the Browse tab. The root node is Objects (ns=0;i=85) with a child folder Siemens.HMI.ComfortPanel (ns=3). HMI tags appear as variables under this folder.
4. To read a value without browsing, switch to the Read tab, set the NodeId to ns=3;s=Temperature, and click Read.

The sample client requires a valid certificate in the UA Certificate Manager trust list. When the panel server certificate is self-signed (the default), accept it by clicking Trust on the certificate dialog that appears during the first connect. The certificate is stored at %LocalAppData%\OPC Foundation\CertificateStores\UA Application Certificates\trusted\.

8. Namespace Mapping Reference

The Comfort Panel exposes a fixed namespace array. The applicationUri is always urn:<DeviceName>:Siemens.HMI.ComfortPanel. The table below is the canonical reference:

Tag NodeIds in namespace 3 follow the pattern ns=3;s=<TagName>, where TagName is the fully qualified HMI tag name including any leading slashes from the tag structure (for example, ns=3;s=Database\Recipe\Setpoint). Multilingual characters are encoded using UTF-8 inside the string component.

9. Security Configuration Deep Dive

Production deployments must use a non-None security policy. The Comfort Panel supports the following security profiles, configured in TIA Portal under OPC UA Server > Security:

When a signed or signed-and-encrypted policy is selected, the panel generates a self-signed server certificate the first time the runtime starts with OPC UA enabled. The certificate is stored on the panel's internal flash at /home/siemens/.config/Siemens/Automation/OpcUa/pki/own/certs/. The certificate's common name (CN) is set to the panel's device name; the subject alternative name (SAN) contains the IP address. Both must match the URL used by the client, otherwise the client rejects the certificate with Bad_CertificateHostNameInvalid (0x801F0000). A custom certificate with a CA-issued chain can be imported via the panel's Service > Certificates web interface (TP900 with firmware V14.0.1.0+).

10. Discovery Service Limitations and Workarounds

Because the Comfort Panel does not run a Local Discovery Server, any client relying on multicast FindServersOnNetwork to the address 239.255.255.1:4840 will never see the panel. The three proven workarounds are:

1. Direct URL entry: Configure the client with the full endpoint URL. This is the most reliable method for both OPC Scout and the UA Sample Client.
2. Standalone LDS on a Windows host: Install the OPC Foundation LDS (a free download from the OPC Foundation GitHub repository) on a Windows PC that is reachable by both the panel and the clients. Register the panel's endpoint in the LDS using the LDS configuration tool. Clients then perform a standard LDS lookup and discover the panel transparently.
3. DNS SRV records: Publish _opcua-tcp._tcp.example.com SRV 10 10 4870 panel.example.com in the corporate DNS zone. DNS-aware clients such as the Kepware OPC UA Configurator and UA Expert can be configured to query this SRV record instead of relying on multicast.

11. Troubleshooting Matrix

12. Transition to Unified Comfort Panel (RT Unified)

If the limits of the legacy Comfort Panel become a constraint, the Unified Comfort Panel (MTP700 / MTP1000 / MTP1200 / MTP1500 / MTP1900 / MTP2200) running WinCC Unified in TIA Portal V17 or later exposes a substantially richer OPC UA server. The transition paths are documented in the Siemens Knowledge Base article Using the Unified Comfort Panel as OPC UA Server (RT Unified). The most important improvements are: integrated LDS for automatic discovery, up to 2000 monitored items per session, full Alarms & Conditions, and Historical Access. The legacy Operate as OPC UA Server flag in the Comfort Panel device properties is replaced by a more granular security configuration under Runtime settings > Services > OPC UA.

13. Verification Procedure

After applying the lmhosts fix and reconnecting, run the following verification sequence to confirm the server is fully operational:

1. Open an elevated command prompt on the client PC and execute ping -a <PanelHostName>. The response must show the panel's IP address and the hostname in the first reply line.
2. Connect with OPC Scout V10. The connection state must be green within 5 seconds.
3. Browse to Root > Objects > Siemens.HMI.ComfortPanel. At least one folder containing user HMI tags must be visible.
4. Drag a Boolean tag and a Float tag into the watch window. Toggle the Boolean from the panel runtime and verify the value updates within 500 ms (default sampling interval).
5. Read a string tag and confirm UTF-8 characters render correctly. If garbage characters appear, the TIA Portal project locale is mismatched with the panel's runtime locale — set both to English (United States) in Project > Languages > Project languages.
6. Close the client and observe the panel diagnostic page (Control Panel > OPC UA > Statistics). The session count should drop to zero within 10 seconds. If sessions persist, the client is leaking sessions; enable CleanSessionOnLogout on the client side.

14. Field-Proven Recommendations

• Always configure the panel's device name to a DNS-compliant, FQDN-style identifier (e.g. tp900-line3.plant.example.com) before commissioning. This avoids the need to change the lmhosts entry every time the panel IP changes due to DHCP.
• Reserve the panel's IP address statically in the DHCP server. DHCP lease changes break the lmhosts mapping silently and cause intermittent connection failures that are hard to diagnose.
• Document the panel's OPC UA port (4870) in the network firewall policy. Many plant firewalls are configured to block high TCP ports by default.
• For multi-vendor environments, deploy an OPC Foundation LDS on a dedicated server. This provides a single source of truth for endpoint discovery and avoids the manual URL entry problem on every client.
• When migrating from TIA Portal V12 or earlier, remove the obsolete OPC XML DA / OPC XML-DA configuration. The Comfort Panel runtime no longer supports it as of V13, and residual configuration can cause Project inconsistent errors during download.
• Use a Wireshark capture filtered on tcp.port == 4870 during initial commissioning. A successful OpenSecureChannel message is the definitive proof that authentication, encryption, and certificate trust are all correctly configured.

15. Additional Resources

The official Siemens application example SIMATIC HMI and OPC UA Part 4: Comfort Panel Server (entry ID 63481236) provides a step-by-step TIA Portal project that configures two Comfort Panels exchanging data via OPC UA, including the certificate exchange procedure. The example is available as a PDF at the Siemens Industry Online Support attachment and complements the troubleshooting steps described above.

For third-party integration, the Software Toolbox technical note on connecting TOP Server to a Comfort Panel via OPC UA documents the path from WinCC flexible through to the TOP Server built-in OPC UA client, which is useful when migrating legacy WinCC flexible projects to a modern SCADA stack.