Resolving Siemens S7-1200 SIMATIC NET OPC Server BAD_Communication and BAD_WaitingForInitialData in TIA Portal V13

This technical reference documents the most common cause of the BAD_WaitingForInitialData and BAD_CommunicationError OPC quality codes when a SIMATIC NET OPC server (configured inside TIA Portal V13 / V13 SP1 / V13 SP2) is used as a client to a SIMATIC S7-1200 or S7-1500 controller. The article is written for commissioning engineers, SCADA developers, and system integrators who can browse the OPC namespace and see all tags, but cannot read or write tag values. The root cause is a single CPU protection flag that blocks the PUT/GET communication primitives used by the S7 communication channel. The fix takes less than one minute once the flag is located, but the symptom is misleading because the OPC server reports Statepath = connected/running even when the channel cannot reach any CPU data.

1. Problem Details

The failure is observable across three independent paths:

1. OPC Scout V10/V12/V13 – tag tree under Siemens TCP/IP->S7 connection populates, but Monitor on any DB or I/O item returns BAD_CommunicationError (0x80050006) and the subscription state stays at WaitingForInitialData.
2. Third-party DA/UA clients – any OPC client that subscribes through the local SIMATIC NET DA server (CLSID {C8F8B55E-B21C-4ee7-9D4E-B7B7B4B3E6C0}) cannot read values, even though GetStatus returns Running.
3. Connected state indication – the OPC server's internal State and Statepath nodes report 1 = connected. The PLC connection in the S7 channel diagnostics also shows OK at transport level (TCP keep-alive answered).

This combination is the diagnostic signature of a controller-side access restriction. The S7 transport is open, the S7 connection has been established by the OPC server, but the user-data PDUs (PUT/GET read/write services, function groups 3 and 4) are rejected by the CPU with the 0x8104 error class – No access authorization – which the OPC DA 2.05/3.0 wrapper translates into a Bad quality.

2. Root Cause

Beginning with S7-1200 firmware V2.0 and the introduction of the integrated protection model in STEP 7 Basic / TIA Portal V11, Siemens enabled a per-CPU access list. By default, an S7-1200 CPU running V2.0 or later will not service PUT/GET requests from any communication partner that has not been explicitly granted permission on the partner list. From firmware V4.0 (released with the S7-1200 G2 generation), the default was tightened further: PUT/GET access is denied unless the engineer actively enables it.

SIMATIC NET OPC server and the underlying S7 Protocol Suite use the S7 communication service to read tags. The S7-1200 does not implement the older S7 softnet / SAPI-S7 protocol; it implements a subset of S7 communication that exposes PUT (function 0x04) and GET (function 0x03) only. If the CPU's Connection mechanisms dialog does not have Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC, ...) enabled, every PUT/GET request is rejected with S7 error W#16#8104 / W#16#0005 (no resource / no authorization).

The OPC server cannot distinguish this rejection from a transient network fault, so the OPC quality code escalates from WaitingForInitialData to CommunicationError after the configured reconnect timeout (default 10 s, configurable on the S7 channel property Connection establishment timeout).

3. Affected Products and Firmware Versions

4. OPC Quality Code Reference

5. Solution – Enable PUT/GET on the S7-1200 CPU

This is the canonical Siemens remedy and resolves the issue in the vast majority of TIA Portal V13 deployments where browse works but values do not.

5.1 Prerequisites

• STEP 7 / TIA Portal V13 or later installed on the engineering station.
• The S7-1200 project open with online access to the device.
• Permission to download hardware configuration to the CPU (write protection key switch in RUN or RUN-P position).
• The PC station that hosts the SIMATIC NET OPC server must be in the same TIA project, and the S7 connection must be present and downloaded to both the PLC and the PC station.

5.2 Step-by-step procedure

1. In the TIA project tree, expand Devices & Networks and select the S7-1200 CPU.
2. Open Properties → Protection in the inspector pane (right window in TIA Portal V13; the Protection entry is the last item under General).
3. Scroll to the section Connection mechanisms.
4. Tick the checkbox Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC, ...).
5. Click Compile and download the hardware configuration to the CPU. The CPU will go through a brief startup sequence (typically 1–3 s) when PUT/GET is first enabled.
6. Right-click the PC station in the project tree, choose Download to PC station (or use PC internal if the OPC server runs on the engineering station). This refreshes the local Configuration Console with the new S7 connection parameters.
7. Restart the SIMATIC NET OPC server: open the SIMATIC NET Configuration Console, stop the S7 Protocol Suite service, then start it. Alternatively reboot the PC station; the OPC server re-initializes its subscriptions on startup.

5.3 Verification

1. Open OPC Scout V13 (Start → Siemens Automation → SIMATIC → OPC Scout V13).
2. Navigate to the DA server OPC.SimaticNET, the S7 connection, and the tag tree.
3. Drag any DB tag (for example DB1.DBD0) into the monitoring window.
4. Confirm the quality column shows Good (0xC0) within two subscription cycles (default 1 s).
5. Click the tag and press the Write button. Enter a new value and confirm. The PLC's online value should change in the TIA watch table.

6. Solution – Simatic NET PC Station Configuration

Even with PUT/GET enabled, three additional items must be in order on the PC station side. Misconfiguration at this layer produces the same symptom.

6.1 S7 connection in the TIA project

• The PC station must contain an OPC server module of type SW V13.0 SPx with at least one S7 connection pointing to the S7-1200.
• Set the Local ID to a fixed S7 connection ID (recommended 1) and the Partner IP address to the CPU's PROFINET interface address.
• Confirm the Active connection establishment checkbox is set; the OPC server is the active partner.

6.2 Configuration Console

1. Open the SIMATIC NET Configuration Console (Start → Siemens Automation → SIMATIC → Configuration Console).
2. Select the Mode tab of the local network adapter used for S7 communication. The mode must be Configured mode with a project file assigned.
3. On the Diagnostics tab, click Status on the S7 Protocol Suite. The status should report RUNNING; the S7 connection should report CONNECTED.

6.3 Windows firewall and PG/PC interface

• Allow inbound TCP port 102 (ISO-TSAP) on the Windows Firewall profile used for the S7 subnet.
• Set the PG/PC interface to the same network adapter through Control Panel → Set PG/PC Interface. A wrong interface causes the OPC server to bind to the wrong IP and never see the CPU.

7. Solution – S7-200 / CP243-1 Variant

The error also occurs when a SIMATIC S7-200 (with CP243-1) is the target. In that topology the S7-200 does not implement the PUT/GET services that SIMATIC NET expects; instead the CP243-1 is configured with a server connection that exposes a byte address range. The remedy is:

1. In STEP 7 Micro/WIN, configure the Ethernet Wizard for the CP243-1 and set up a Server Connection for the PC station's IP address.
2. Tick Always accept connection in the wizard's connection properties; otherwise the CP discards the S7 request.
3. In the TIA / NCM PC Manager project, set the S7 connection's Partner TSAP to match the CP243-1 connection's TSAP (hex, two bytes). SIMATIC NET ships 01.01 as the default for the OPC server; the S7-200 side must mirror the byte order.
4. Confirm the IP of the S7-200 in the wizard matches the partner IP of the S7 connection on the PC station.
5. Reboot the CP243-1 (power cycle) to flush its connection state.

The S7-200 case is the second-most common manifestation of the same OPC browse-but-no-read symptom and is documented in the Siemens application example Step by Step: Ethernet Communication between OPC Server and S7-200 incl. CP243-1.

8. Diagnostic Procedure and Decision Tree

1. Confirm the OPC server's State tag is 1 = Running and Statepath is Connected.
   • If false → transport-level fault (cable, IP, firewall). Use Configuration Console → Diagnostics and ping the CPU.
2. Confirm the CPU is in RUN, not STOP.
   • If in STOP → the CPU rejects S7 reads while in STOP only on a tag-by-tag basis; restart the CPU to RUN before further tests.
3. Open CPU Properties → Protection → Connection mechanisms on the PLC. Is Permit access with PUT/GET communication from remote partner enabled?
   • If no → enable, compile, download, restart OPC server. (90% of reported incidents.)
4. Verify the OPC client is reading from OPC.SimaticNET (the local DA server), not from the wrong ProgID.
   • If wrong ProgID → tags may still browse from a 3rd-party wrapper, but the data plane is wrong.
5. Capture the S7 trace with S7 Trace (part of the SIMATIC NET install, Start → Siemens → SIMATIC NET → Trace). Look for User-data PDU rejected: 0x8104.
   • If 0x8104 appears → confirmed access rejection, return to step 3.
6. If still failing, check the OPC server's log at C:\ProgramData\Siemens\Automation\SimaticNet\log\S7OPC.log for Partner rejected service.
   • If present → check the OPC server's PC station TSAP versus the CPU's Connection resources table.

9. S7 Error Codes Used in This Failure Mode

10. S7-1500 and S7-1200 G2 Additional Considerations

On the S7-1500 family the same Connection mechanisms → Permit access with PUT/GET communication from remote partner flag is the only required setting. The S7-1500 OPC UA server (firmware V1.0+ ships an integrated OPC UA server) does not use PUT/GET; it uses UA binary protocol on TCP 4840, but the same checkbox controls access for non-UA S7 clients. If a hybrid deployment is in use (both DA OPC UA and the SIMATIC NET DA OPC server), the OPC UA server runs unconditionally; the SIMATIC NET server is what requires PUT/GET.

For S7-1200 G2 (firmware V4.0+, introduced 2023), Siemens has added an additional Secure PG/PC communication mode. When Secure PG/PC communication is enabled, PUT/GET is forced off and the OPC server must use the secure variant. This produces a different error – connection refused at TLS handshake – and is outside the scope of the original report, but the fix is identical: disable Secure PG/PC communication if non-secure PUT/GET clients are present, or migrate the OPC client to a UA-capable client.

11. Third-Party OPC Client Notes

Two common third-party scenarios present the same symptom because they ride the SIMATIC NET DA server:

• Ignition by Inductive Automation (OPC-UA gateway to SIMATIC NET DA) – the Ignition OPC-UA server appears to connect to Siemens.SimaticNET and the tag browser shows the S7-1200 tree. Browse works, reads return Bad_WaitingForInitialData. Same root cause: PUT/GET is disabled on the CPU. The fix is to enable PUT/GET in TIA; no change to Ignition is required.
• node-opcua (Node.js OPC UA stack) – connecting with EndpointUrl = opc.tcp://<pc-station>:49320 (the SIMATIC NET OPC UA wrapper) shows Bad_CommunicationError for every node under Objects/Server/Data. The endpoint is reachable, the security handshake completes, but the underlying S7 PDUs are rejected. Apply the same CPU-side fix.

12. Common Pitfalls

1. Only the PLC was downloaded. The PC station's XDB file must be re-imported into the local Configuration Console. After a hardware download to the CPU, the OPC server still has the stale S7 connection definition and will continue to use the old TSAPs.
2. Project mismatch. The PC station that hosts the OPC server is a different TIA project from the one used to program the PLC. The S7 connection in each project points to a different local ID; PUT/GET works on either, but the OPC server reads from the local XDB, not the remote project.
3. Firewall on the PC station. Windows Defender Firewall blocks TCP 102 in the Domain profile even when the network is private. Add an inbound rule for C:\Program Files\Siemens\Automation\SimaticNet\opc\bin\S7OpcSrv.exe.
4. Multiple network adapters. With Wi-Fi enabled on the engineering station, the PG/PC interface auto-selects the wireless adapter. Disable Wi-Fi during commissioning or pin the PG/PC interface to the wired adapter.
5. CPU in STOP after a missing PUT/GET error. Some S7-1200 firmware revisions enter a one-time diagnostic interrupt on the first PUT/GET rejection. This is informational; the CPU remains in RUN, but the diagnostic buffer entry can be misleading.
6. Secured CP243-1 password. The CP243-1 stores the connection password separately from the PLC password. If the password is set in the wizard but not on the S7 connection in the PC station, the OPC server will establish the transport but receive an S7 error on PUT/GET.

13. Pre-Commissioning Checklist

14. Standards and References

The OPC DA 2.05 / 3.0 specification defines the quality codes used throughout this article. The S7 communication services PUT and GET are documented in the Siemens standard SIMATIC Communication – Programming and Operating Manual, and the S7-1200 protection model is described in the S7-1200 Programmable Controller – System Manual. The exact path of the Permit access with PUT/GET checkbox is illustrated in the TIA Portal online help under Configuring devices and networks → Configuring the CPU → Protection.

15. Frequently Asked Questions