1. Problem Overview
Engineers deploying SIMATIC NET OPC Server alongside WinCC flexible Runtime on the same PC Station frequently encounter a symptom where only one application can communicate with the S7-300 CPU at a time. Starting OPC Scout yields live tag read/write; starting WinCC flexible Runtime yields HMI tag updates. Starting both simultaneously fails: one of the two clients reports "no connection" or "partner not reachable", while the other operates normally.
This article documents the root cause identified on a CPU 315-2AG10 (Siemens part number 6ES7315-2AG10-0AB0) fronted by a CP 343-1 LEAN (6GK7343-1CX10-0XE0), upgraded for testing to a CP 343-1 EX11 (6GK7343-1EX11-0XE0). The fault was not in the CP, the PC network adapter, or the OPC certificate — it was in the S7 connection resource table of the CPU itself, configured inside SIMATIC Manager / NetPro.
2. Affected Hardware and Firmware Versions
| Component | Part Number | Relevant Capability |
|---|---|---|
| S7-300 CPU 315-2 DP | 6ES7315-2AG10-0AB0 | 16 total connection resources (S7 + S5 + PG/OP combined) |
| CP 343-1 LEAN | 6GK7343-1CX10-0XE0 | 2 S7 connections maximum, no PG/OP routing beyond the two |
| CP 343-1 (standard) | 6GK7343-1EX11-0XE0 | Up to 16 S7 connections, ISO/TCP, supports more parallel partners |
| SIMATIC NET OPC Server | 6GK1704-0LW01-3AA0 (license bundle) | Provides DA 3.0, DA 2.0, AE, XML-DA, and (with v8.x) OPC UA endpoints |
| SIMATIC NET PC software | v8.x / v14 (for TIA Portal V13 SP1+) | Hosts Station Configurator, OPC Scout, configuration console |
| WinCC flexible Runtime | 2008 SP5 or 2008 SP3 | Softbus-based S7 connection via configured PC Station |
The S7-300 connection budget on a 315-2 class CPU is fixed at firmware level and cannot be increased by hardware swaps. Replacing the CP 343-1 LEAN with the EX11 module does not change the CPU's resource ceiling — it only changes the per-module connection fan-out.
3. Root Cause: S7 Connection Resource Exhaustion
The S7-300 firmware allocates a fixed pool of connection resources for OS-level communication, PG/OP access, HMI, and routed S7 basic/S7 fault-tolerant connections. On the CPU 315-2AG10 the pool is 16 resources. Every S7 connection declared in NetPro, whether actively used or merely configured, consumes one resource once it is downloaded to the CPU.
In the field case described, the connection table showed:
| Connection Type | Configured | In Use | Status |
|---|---|---|---|
| S7 basic connections | 12 | 0 | Reserved but unused — blocking other partners |
| PG/OP connections | 1 | 1 | Active (STEP 7 online) |
| OP connections | 1 | 1 | WinCC flexible RT |
| S7 connection (OPC Scout) | 1 | 1 | OPC Scout via SIMATIC NET |
| Free pool | 1 | — | Insufficient for simultaneous OPC + HMI + online |
| Total | 16 | 3 | Pool exhausted |
The CP 343-1 LEAN supports a maximum of 2 S7 connections per partner side. Each connection defined in NetPro that targets this CP counts toward the CPU resource pool. When the pool is full, the CPU rejects new connection-establishment requests with SF LED + diagnostic buffer entry, and the requesting partner (OPC or HMI) silently fails.
4. Diagnostic Procedure
Follow this ordered procedure to confirm resource exhaustion before changing hardware.
- Open SIMATIC Manager and load the S7 project. Make sure the offline project matches the CPU firmware and order number.
- Open NetPro (Options → NetPro or via the toolbar). Select the S7-300 station and double-click the CPU icon to open hardware properties.
- Inspect the connection table: In the left pane, look at "S7 Connections" / "Configured Connections". Each row is a separately allocated resource.
- Open online connection diagnostics: Right-click the CPU → "Object Properties" → "Connection" tab. The "Connection Resources" field shows total / configured / available.
-
Read the CPU diagnostic buffer: PLC → "CPU Messages" / "Diagnostic Buffer". Look for entries containing
SF,connection aborted, orresource. Typical hex-coded entries include0x8304(connection establishment fault) and0x8301(no resources available). - Use the Station Configurator Diagnostics tab on the PC Station. Verify both OPC Scout and WinCC flexible Runtime applications are listed under the PC station's components.
5. Step-by-Step Resolution
5.1 Reduce S7 Basic Connection Count in NetPro
- In NetPro, right-click the S7-300 station → "Properties" or open the connection list.
- Identify all S7 basic connections marked as "reserved" or "not used". These are typically entries created by project templates that were never deleted.
- Right-click each unused connection → "Delete". Confirm deletion in the project tree.
- Keep only the connections actually required:
- 1 × OPC Server (DA/UA) → S7 connection
- 1 × WinCC flexible RT → S7 connection (or OP connection)
- 1 × PG online (auto-created when STEP 7 is online)
- Save and recompile (Station → "Save and Compile").
- Download the hardware configuration and the connection configuration to the CPU (PLC → "Download").
For the affected project, the fix that worked was reducing the S7 basic connection count from 12 to 8, restoring enough free resources for both OPC and WinCC flexible to run concurrently. The exact number required depends on which combinations of clients are active — the recommendation is to keep the total configured connections at n + 2 where n is the number of simultaneously active S7 communication partners.
5.2 Verify CP 343-1 LEAN Connection Assignment
- In HW Config, double-click the CP 343-1 LEAN.
- Open the "Properties" dialog → "Connection" sub-tab.
- Confirm that the connection list for this CP shows at most 2 S7 connections. The LEAN module physically cannot terminate more than 2 S7 partner relationships.
- If the LEAN is fully utilized, route additional connections through a CP 343-1 EX11 or through the MPI/DP interface (which has its own connection count).
5.3 PC Station Configuration
- Open the Station Configurator on the engineering PC and verify the PC Station contains:
- One OPC Server slot (index 1 by convention)
- One WinCC flexible RT slot (index 2)
- One IE General / Network Card entry bound to the correct physical NIC
- In NetPro, on the PC Station side, the OPC Server component and the WinCC flexible RT component must each have an S7 connection defined pointing to the S7-300 station. Both connections are downloaded into the PC Station configuration via "Station → Save and Compile" followed by "PLC → Download" on the PC Station's local configuration database.
- Verify both connections appear under the Diagnostics tab of the Station Configurator with a green "OK" status after download.
6. CP 343-1 LEAN vs CP 343-1 EX11 Comparison
| Parameter | CP 343-1 LEAN (6GK7343-1CX10-0XE0) | CP 343-1 (6GK7343-1EX11-0XE0) |
|---|---|---|
| S7 connections (max) | 2 | 16 |
| PG/OP connections | 1 (shared) | Up to 16 |
| S7 routing | No | Yes |
| Send/receive (PUT/GET) | Yes, limited | Yes, full |
| Modbus TCP | No | No (separate variant: CP 343-1 BX/EX) |
| Typical use case | Small HMI + single PLC link | Multi-client SCADA + OPC + HMI |
| Firmware update path | Via SIMATIC Manager / TIA | Same |
Swapping the LEAN for the EX11 does not by itself resolve the resource exhaustion symptom if the CPU connection pool is already saturated. The EX11 simply raises the ceiling of the network module side; the CPU-side budget is unchanged. The fix must always be applied at the CPU/NetPro level.
7. SIMATIC NET OPC Server Configuration Reference
The SIMATIC NET OPC Server sits on top of the PC Station's S7 connection and exposes tag addresses via the OPC DA 3.0 / UA interfaces. Tag addressing for an S7-300 follows the SIMATIC notation:
DB1.DBD0 // double word at offset 0 in DB1
DB1.DBW10 // word at offset 10 in DB1
M0.0 // bit in merker byte 0
EW0 // input word 0 (process image)
For OPC UA access (SIMATIC NET v8.1 and higher), the endpoint URL follows the pattern:
opc.tcp://<PC>:55101
and the namespace URI is typically urn:Siemens:SIMATICNET:OpcUa:<StationName>. Refer to the official Siemens KB article on data exchange with the SIMATIC NET OPC server for full addressing details and tag import from STEP 7 symbols:
8. Certificate Considerations for OPC UA
If OPC UA access is used (rather than OPC DA), the SIMATIC NET OPC UA Server requires server and client certificates to be exchanged. The Configuration Console (Start → SIMATIC → SIMATIC NET → Configuration Console) lists installed certificates under "OPC UA → Certificates". Typical field errors include:
| Symptom | Likely Cause | Action |
|---|---|---|
| OPC UA client returns BadCertificateUntrusted | Server cert not in client's trusted store | Export from Configuration Console, copy to client trust list |
| OPC UA client returns BadCertificateHostNameInvalid | Cert issued for different host or domain (test rig vs. production) | Regenerate cert on the production PC via Configuration Console → Certificates → Create Self-Signed |
| OPC DA works, OPC UA does not | OPC UA Server plugin not licensed | Verify license via Automation License Manager for "SIMATIC NET OPC UA" |
| Variables not visible in OPC Scout | No tag imported or wrong namespace | Use "OPC Scout → Server → Connect → DA → Add Tag" with SIMATIC tag syntax |
A corrupted or wrong-domain certificate causes OPC UA read/write to fail but does not prevent OPC DA communication. If OPC DA is healthy and OPC UA is not, the cert chain is the first place to inspect — not the S7 connection count.
9. Commissioning Verification Procedure
- After NetPro changes, cycle power to the CPU if firmware allows, or perform an MRES only if the project is the sole configuration source.
- Download the PC Station configuration from NetPro (Station → "Save and Compile" with "PC Station" selected as the download target).
- Start WinCC flexible Runtime first. Confirm all configured HMI tags update in the diagnostics view.
- While WinCC flexible RT is running, start OPC Scout v10. Connect to "OPC.SimaticNET.1" and add a test tag.
- Verify in OPC Scout that the "Server State" remains "Running" and the tag quality is "Good (192)".
- In the Station Configurator Diagnostics tab, confirm both the OPC Server and WinCC flexible RT connections show "Established" or "OK".
- Read the CPU connection resource count online (PG → Accessible Nodes → CPU → Properties → Connection). Confirm free resources ≥ 2.
10. Troubleshooting Matrix
| Symptom | Diagnostic Check | Resolution |
|---|---|---|
| OPC works, HMI does not | CPU diagnostic buffer — connection abort codes | Reduce S7 connection count in NetPro; check CP 343-1 connection list |
| HMI works, OPC does not | Station Configurator → Diagnostics; Configuration Console cert list | Reinstall/regenerate OPC server cert; verify OPC Server slot in PC Station |
| Neither works after PC reboot | PC Station "XDB" file loaded? Service "SIMATIC NET Configuration" running? | Restart "SIMATIC NET" service; reload station configuration |
| Intermittent failures under load | Connection timeout settings on PC side | Match keepalive and connection timeout across OPC and HMI; increase OPC browse interval |
| "BadCommunicationError" on all tags | Physical link — link LED on CP, NIC | Check Ethernet cable, switch port, IP/subnet match |
| CPU SF LED on after NetPro download | Diagnostic buffer 0x8304/0x8301 | Connection resource pool exhausted — reduce configured connections |
| OPC UA client gets BadCertificateUntrusted | Configuration Console → OPC UA → Certificates | Export server cert, install into client trust list |
| OPC UA endpoint not reachable | Firewall on port 55101 (default) | Open TCP port 55101 inbound on PC firewall |
11. Preventive Design Guidelines
- Connection budget planning: For each CPU, document the static maximum (firmware-defined) and reserve at least 2 connections for diagnostics and online changes.
- Avoid stale NetPro entries: Every template-generated S7 connection that is not deleted still occupies a slot after download.
- Choose CP class to match the application: A CP 343-1 LEAN is sufficient only for single HMI plus single SCADA/OPC pair. For triple-client setups (e.g. OPC + HMI + WinCC), use CP 343-1 (EX11) or higher.
- Keep PG/OP channels separate: Reserve one connection type for STEP 7 online so it cannot be displaced by HMI/OPC traffic.
- Document the PC Station XDB file: The configuration is stored in an XDB file referenced by the SIMATIC NET service — back it up before any PC change.
- Test OPC UA certificates before deployment: Generate production certificates on the production host with the correct hostname; test rigs almost always produce certs that will fail in production.
12. Frequently Asked Questions
How many S7 connections does a CPU 315-2AG10 support?
The CPU 315-2AG10 (6ES7315-2AG10-0AB0) supports 16 total S7 connection resources at firmware level. These are shared among PG/OP, OP, S7 basic, and S7 fault-tolerant connections, and the number cannot be increased by changing the CP module.
Can CP 343-1 LEAN run both WinCC flexible Runtime and SIMATIC NET OPC Server at the same time?
Yes, but only if the S7 connection count on the CPU side is below the ceiling and the LEAN module's 2-connection limit is not exceeded. In the documented field case, the failure was caused by 12 reserved S7 basic connections exhausting the CPU pool, not by the LEAN itself.
Does the SIMATIC NET OPC UA Server require a paid license?
Yes. The SIMATIC NET OPC UA Server is licensed separately and is not freeware. The OPC DA Server is included with the base SIMATIC NET PC software license. The Automation License Manager must show a valid entry for "SIMATIC NET OPC UA Server" before OPC UA endpoints become active.
Why does OPC DA work but OPC UA fail with a certificate error?
OPC DA uses Windows COM/DCOM authentication and does not depend on X.509 certificates. OPC UA requires both server and client certificates to be trusted. A certificate issued on a test rig will have the wrong hostname and trigger BadCertificateHostNameInvalid. Regenerate the cert via the Configuration Console on the production PC and re-import to the client trust store.
What is the default OPC UA endpoint port for SIMATIC NET?
The default endpoint is opc.tcp://<hostname>:55101. The port must be allowed through any local firewall or Windows Defender rule, and the SIMATIC NET Configuration service must be running before the endpoint becomes reachable.
How do I check free connection resources on the CPU online?
In SIMATIC Manager, go online to the CPU, open "PLC → CPU Messages" or "PLC → Accessible Nodes", right-click the CPU and select "Object Properties → Connection". The Connection Resources field displays Total / Configured / Available counts in real time. Alternatively, the diagnostic buffer will record entry 0x8301 "no resources available" when the pool is exhausted.