Resolving S7-1200 DASSIDirect Server Memory Bit Access Issues

Problem Overview

The Wonderware DASSIDirect server (now distributed as AVEVA SIDirect) reports no value or a fixed status code (commonly 0x0008 = OPC quality BAD_NO_COMMUNICATION with sub-status indicating subscription failure) when InTouch WWClient attempts to read S7-1200 memory-bit addresses such as M2.1, M0.0, MB90, MW10, or MD20. Discrete inputs (Ix.y), discrete outputs (Qx.y), and data-block words (DBw) often return correct values, while the entire Merker/Flag area remains unreadable. The same symptom appears whether the topic is browsed through OPCLink, I/O Server, or the WWClient tag dictionary.

The root cause is not InTouch, not the S7-1200 hardware, and not the physical Ethernet cable. The S7-1200 CPU is shipped with its data-access surface locked down by default as part of the know-how protection and integrated-access-control model introduced by Siemens SIMATIC Firmware V2.0 and tightened in V4.x. The DASSIDirect / SIDirect Legacy driver must be granted explicit permission to read Merker areas, and the data must be made reachable through a CPU-side protocol that the driver supports.

Affected Hardware and Firmware

DASSIDirect versions distributed with InTouch 10.0 through InTouch 2020 R2 are affected. AVEVA SIDirect Driver Pack 1.5 and later is the supported migration path. The driver communicates with the S7-1200 using S7 Communication (ISO-on-TCP, port 102, TPKT over RFC 1006), with the CPU acting as a passive partner and the PC driver acting as the active client.

Root Cause Analysis

Three independent Siemens-side gates must be opened simultaneously before DASSIDirect can read a Merker byte. The default S7-1200 project leaves all three closed:

1. Permit access with PUT/GET communication flag in the CPU properties (TIA Portal). When this is disabled — and it is disabled by default — the CPU rejects any S7 read/write request whose source is not the HMI/engineering connection that owns the variable. The DASSIDirect server opens a separate S7 connection on port 102 that has no project-level binding, so it is rejected at the CPU's connection resource manager.
2. Connection resource availability. The S7-1200 supports a maximum of 8 active S7 communication connections (PG/OP/HMI combined on the integrated PROFINET interface). The CPU must have at least one free OPC S7 connection slot for the DASSIDirect handle.
3. Optimized block access on data blocks (S7-1500/1200 V4.x). When a DB uses optimized access, the symbolic names compile to a non-contiguous internal memory layout. The DASSIDirect driver uses absolute addressing (M2.1, DB1.DBD0) and cannot resolve symbolic handles on optimized blocks. Memory bits, however, live in the system Merker area — the problem there is not optimized access but the PUT/GET gate.

The 0x0008 status code reported in WWClient is the OPC DA quality bitmask. 0x0008 = OPC_QUALITY_BAD (0x00) with sub-status 0x08 = BAD_COMMUNICATION, indicating the subscription is open in the OPC server's tag table but the underlying S7 read PDU is being NAK'd by the CPU.

Solution 1: Enable PUT/GET Access in TIA Portal

This is the primary fix. It must be performed on the engineering station that owns the S7-1200 project, then downloaded to the CPU. DASSIDirect is a read-only client of this flag — it cannot be changed from the SCADA side.

1. Open the S7-1200 project in TIA Portal V13 SP1 or later (V15.1, V16, V17, or V18 all carry the same dialog).
2. Select the S7-1200 CPU in the device tree.
3. Open Properties → General → Protection & Security → Connection mechanisms.
4. Tick the box labeled Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC, …).
5. Compile the hardware configuration and download to the CPU. The CPU goes into STOP-RUN during download; verify the operating-mode switch is on RUN or RUN-P.
6. Cycle power on the CPU if the new protection level does not take effect within 30 seconds. Some S7-1200 firmware revisions (V4.2, V4.4) require a power cycle to re-evaluate the protection settings.

Solution 2: Verify Connection Resource and IP Route

1. Open the DASSIDirect server configuration tool (DASSIDirect Console or ArchestrA IDE → DASSIDirect object → Device Group).
2. Confirm the PLC's IP address matches the S7-1200 PROFINET interface. The S7-1200's default address is 192.168.0.1; the subnet mask is 255.255.255.0.
3. From the SCADA station command prompt, run ping <PLC_IP> and verify < 5 ms round-trip time on a dedicated VLAN. ICMP echo is permitted by the S7-1200 even with PUT/GET disabled — a successful ping only proves Layer 3 reachability, not S7 access.
4. Run telnet <PLC_IP> 102 from an elevated command prompt. A blank terminal window indicates the TCP handshake to the S7 Communication port succeeded. Press Ctrl+] then quit to close.
5. In TIA Portal, navigate to Properties → General → System and clock memory → Connection resources. Confirm the number of configured HMI/OPC connections plus existing PG/OP connections is < 8. If all 8 are consumed, the DASSIDirect connection is silently rejected.

Solution 3: DASSIDirect Topic and Item Definition

The DASSIDirect topic must point at the S7-1200 with the correct addressing dialect. DASSIDirect historically uses two address syntaxes; S7-1200 Merker must be expressed in the SIMATIC-style syntax below.

In the DASSIDirect Device Group definition, set:

• Protocol: S7MPI/TCP (S7-1200 supports S7-TCP, not MPI — choose the TCP variant)
• CPU Rack/Slot: 0 / 1 (S7-1200 always reports as rack 0, slot 1)
• TSAP Local: 01.01 (the S7-1200 PROFINET interface)
• TSAP Remote: 01.00 (your DASSIDirect station's default)
• Poll interval: 250 ms minimum for Merker areas; DASSIDirect throttles faster polls to prevent S7-1200 connection-resource exhaustion

Solution 4: SIDirect Legacy Pre-Configuration (S7-1500 and S7-1200 V4.x)

Per the AVEVA driver documentation, the SIDirect Legacy object requires pre-configuration through the Siemens TIA Portal to allow access to data inside the S7-1500 PLC, and the same requirement applies to S7-1200 CPUs running V4.x firmware with security-level 3 or higher. See the official AVEVA documentation: SIDirect Legacy — S7-1500 / S7-1200 pre-configuration.

1. In TIA Portal, open the S7-1200 device properties.
2. Under Protection & Security, set the protection level to Full access (no protection) or Read/write access with password. The default "Complete protection" level blocks all OPC reads outside the engineering project.
3. If using a password-protected level, record the password in the DASSIDirect Device Group under Connection → S7 Access Password.
4. Confirm that data blocks containing the data you want to read have Optimized block access unchecked. In TIA Portal, right-click the DB → Properties → Attributes. Uncheck "Optimized block access" for any DB the SIDirect Legacy driver will reach by absolute address.

Solution 5: Alternative Path — TopServer

If DASSIDirect performance remains poor after the steps above, the AVEVA TopServer driver (or the legacy Software Toolbox TopServer) is a tested alternative that natively supports the S7-1200 Merker area without the TIA-side configuration quirks. TopServer exposes the S7-1200 as an OPC DA 2.05 / 3.0 server, and InTouch can use it directly as the "Access Name" application without an intermediate OPCLink topic.

TopServer can be evaluated with a full-featured trial. The trial inserts a 2-hour runtime limit; the user must restart the TopServer service when the time expires. This is the same behavior reported by users on legacy S7-1200 integration projects and is by design, not a defect.

Verification

1. Open the DASSIDirect console and force a Refresh All on the device group. The status column should report OK rather than Fault.
2. Use the DASSIDirect Quick Client (right-click the topic → Quick Client) to browse the tag namespace. Locate MB90 and verify the value matches the actual S7-1200 memory content. Use TIA Portal's Monitor / Modify view to cross-check the Merker byte in the PLC.
3. In InTouch WindowMaker, open WWClient, navigate to the Access Name bound to the DASSIDirect topic, and confirm the tag MB90 shows a numeric value (0–255) with a quality of Good. The quality column will read Good:NoError (OPC quality 0xC0) on success.
4. Toggle a memory bit from the S7-1200 ladder or from TIA Portal's Monitor/Modify (set M0.0 = TRUE) and confirm the change is reflected in WWClient within one poll interval.
5. Run a 24-hour soak test with the PLC disconnected mid-test. WWClient should report Comm Loss (quality 0x0008) within two poll intervals, and resume reading when the PLC is restored.

Troubleshooting Matrix

Operational Notes

When the S7-1200 is replaced (e.g., a CPU 1214C is swapped for a 1215C), TIA Portal's Device replacement wizard does not carry forward the Protection & Security settings. After every device replacement, the PUT/GET flag and the connection-mechanism configuration must be re-applied to the new CPU and re-downloaded. This is the single most common reason a previously working DASSIDirect connection suddenly reports 0x0008 after a hardware swap.

Firmware V4.4 of the S7-1200 introduced an additional security layer — the Security Event Log — that records each rejected PUT/GET access attempt with the source IP. Engineers diagnosing intermittent failures should retrieve this log via TIA Portal → Online → Diagnostics → Security Event Log to confirm the SCADA station is being explicitly denied.

For S7-1500 systems, Siemens has documented a known interaction between optimized block access and the SIDirect Legacy driver. The official recommendation is to either (a) disable optimized access on the affected DBs, or (b) use the symbolic addressing path of the SIDirect Driver Pack 1.5+ to access the data symbolically. See the AVEVA documentation page referenced in Solution 4 for the exact procedure.