Resolving SIMATIC S7-1500 OPC UA ServerState Failed Error

Resolving SIMATIC S7-1500 OPC UA ServerState Failed Error

The SIMATIC S7-1500 OPC UA server can return a ServerState of Failed in its ServerStatus node, which causes compliant clients such as the Prosys OPC UA SDK for Java (versions 4.1.x and 4.2.0) to refuse to deliver subscription data, browse protected nodes, or establish functional sessions. The OPC UA specification marks this state as a vendor-specific fatal condition; under it, the client must assume the server is no longer functioning and most service requests will fail. Engineers encountering the message "ServerState changed from Unknown to Failed" in the SDK log must treat it as a controller-side condition, not a network or client configuration problem. This reference explains how to confirm the state, isolate the firmware-related root cause on the S7-1500, and apply a working remediation path with verifiable outcomes.

1. Problem Description

A typical failure case presents with the following diagnostic trail captured in a Prosys OPC UA SDK for Java log (v4.2.0-955, build date 02/11/2020):

02/11/2020 11:00:00.215 INFO  Prosys OPC UA SDK for Java v4.2.0-955
02/11/2020 11:00:00.215 INFO  (c) Prosys Ltd.
Connecting to opc.tcp://1.1.5.2:4840
Using SecurityPolicy http://opcfoundation.org/UA/SecurityPolicy#None
02/11/2020 11:00:06.205 INFO  Using an alternate endpoint URL 'opc.tcp://192.168.0.2:4840'
02/11/2020 11:00:08.424 INFO  Server sent a certificate, although SecurityPolicy NONE is used
02/11/2020 11:01:49.557 WARN  Encountered null or empty DataTypeDictionary NodeId: ns=3;i=6001, skipping
02/11/2020 11:01:56.892 INFO  TypeDictionary initialized successfully
ServerState changed from Unknown to Failed
ServerStatus: ServerStatusDataType [
  StartTime='02/11/20 08:54:08.8959614 GMT',
  CurrentTime='02/11/20 09:59:10.0240569 GMT',
  State='Failed',
  BuildInfo=BuildInfo [
    ProductUri='https://www.siemens.com/s7-1500',
    ManufacturerName='SIEMENS AG',
    ProductName='SIMATIC S7-1500 OPC UA',
    SoftwareVersion='V02.05.00',
    BuildNumber='00',
    BuildDate='01/01/01 00:00:00.0000000 GMT'
  ],
  SecondsTillShutdown='0',
  ShutdownReason=''
]

The session establishes, the application URI is recognized, and the client can browse the address space root, but the State field inside the standard Server_ServerStatus_State variable resolves to the literal value 1, which the OPC UA enumeration ServerState defines as Failed. Prosys SDK versions 4.1.2, 4.1.4, and 4.2.0 all enforce this state and will not push subscription data while it persists.

2. Affected Components and Versions

The following combinations have been observed in the field with the ServerState Failed symptom:

Siemens TIA Portal project versions that produce the affected firmware include V15.1 (firmware V2.5) and any project recompiled against the same firmware image. Newer firmware (V2.6 / TIA V16 and V2.9 / TIA V17) revised the ServerStatus reporting on certain CPU types; verify the exact firmware image installed on the CPU using Online & Diagnostics > Diagnostics > CPU information.

3. Root Cause: ServerState Enumeration Semantics

The OPC UA specification defines the ServerState data type as a 32-bit integer enumeration in Part 5, section 12.6, Table 136. The four valid values are:

The SIMATIC S7-1500 firmware V02.05.00 image referenced in the diagnostic capture reports State=Failed as a side effect of an internal initialization or licensing condition on the OPC UA server runtime. The value is published in the Server_ServerStatus_State node (numeric identifier 2256, also reachable at Root/Objects/Server/ServerStatus/State), and the runtime itself remains reachable on TCP port 4840. From the network's perspective, the service appears healthy: TCP three-way handshake completes, the Hello/Acknowledge exchange succeeds, the OpenSecureChannel call returns, and the CreateSession call returns a valid session ID. Only after the client attempts to use the session, or to publish against an active subscription, does the Failed state manifest as a functional blockage.

For the Prosys SDK, the operational impact is severe: the SDK's internal state machine inspects the latest ServerStatus.State returned by the server. When the value is anything other than Running (0), the SDK halts its PublishResponse dispatch and will not deliver monitored item samples to user code, even though the session remains technically open. Browsing continues to work, which is why operators typically see the address space populate successfully and yet the variables never update.

4. Diagnostic Procedure

Follow this sequence to confirm the ServerState Failed condition before applying any remediation. Each step adds a layer of evidence so the root cause is unambiguous.

4.1 Capture the BuildInfo

Read the standard node Root/Objects/Server/ServerStatus/BuildInfo. Confirm the following fields and record them in your service ticket:

ProductUri          = https://www.siemens.com/s7-1500
ManufacturerName    = SIEMENS AG
ProductName         = SIMATIC S7-1500 OPC UA
SoftwareVersion     = V02.05.00
BuildNumber         = 00

If the ProductUri does not begin with https://www.siemens.com/ the server is not a SIMATIC S7-1500 and the remediation steps below do not apply. Proceed to vendor-specific Siemens support instead.

4.2 Read ServerState Directly

Using any OPC UA client (UaExpert, the Prosys Simulation Server test tool, or a custom script), read the standard variable:

NodeId: ns=0;i=2256   (Root/Objects/Server/ServerStatus/State)
Expected type: Int32 (enumeration ServerState)

If the returned value is 1, the server is reporting the Failed condition described in the OPC UA specification. The ServerStatus_DataType structure itself is a structured value with the following fields; the State field is the only one that blocks client operation in the Prosys SDK:

ServerStatusDataType:
  StartTime             (DateTime)
  CurrentTime           (DateTime)
  State                 (Int32, ServerState enum)
  BuildInfo             (Structure)
  SecondsTillShutdown   (Int32)
  ShutdownReason        (LocalizedText)

4.3 Cross-Check With an Independent Client

Connect with UaExpert (Unified Automation) or the Prosys OPC UA Browser to the same endpoint. If both clients see State=Failed the condition is server-side and unrelated to the Prosys SDK version. If only the Prosys SDK reports Failed while UaExpert reports Running, the issue is client-side SDK caching, in which case clearing the trusted-certificate store in the SDK's PKI directory and re-initializing the application instance certificate resolves the false positive.

4.4 Inspect the Alternate Endpoint URL

The diagnostic capture shows:

INFO  Using an alternate endpoint URL 'opc.tcp://192.168.0.2:4840'
     instead of the requested 'opc.tcp://1.1.5.2:4840'

This is normal client behavior: the S7-1500 OPC UA server returns one or more EndpointDescription entries in response to GetEndpoints, and the host portion of the endpoint URL may differ from the discovery URL the client used. The Prosys SDK transparently re-issues CreateSession against the alternate URL. Confirm the alternate URL is routable from the client host with:

ping 192.168.0.2
Test-NetConnection -ComputerName 192.168.0.2 -Port 4840

If the alternate URL is on a different subnet, the client must have a route to that subnet or it will appear to hang for the full 90-second OpenSecureChannel timeout before reporting a connection error.

4.5 Confirm the DataTypeDictionary Warning

The log entry

WARN  Encountered null or empty DataTypeDictionary NodeId: ns=3;i=6001, skipping

is benign. The S7-1500 publishes a data-type dictionary node in namespace 3 that is empty when no user-defined complex types are exposed. The Prosys SDK skips it and continues initialization, as confirmed by the subsequent TypeDictionary initialized successfully line. Do not chase this warning as a root cause; it does not affect subscription delivery.

5. Resolution Path A: Server-Side Fix (S7-1500 Firmware Update)

The recommended permanent remediation is to update the S7-1500 CPU firmware to a release that no longer reports State=Failed under normal operating conditions. Siemens publishes firmware updates for the S7-1500 CPU family on the Siemens Industry Online Support portal.

5.1 Identify the Exact CPU Order Number

From the S7-1500 hardware catalog, common OPC UA-capable order numbers include:

5.2 Update Firmware via TIA Portal

1. Open the project in TIA Portal V15.1 or later that matches the target firmware.
2. Connect online to the CPU. From the project tree, right-click the CPU and select Online & Diagnostics.
3. Navigate to Diagnostics > CPU information and note the current firmware version (compare to SoftwareVersion in the BuildInfo).
4. From the Siemens Industry Online Support portal, search the order number and download the latest firmware update package (file type .upd).
5. In TIA Portal, select Online > Firmware update, choose the downloaded .upd file, and confirm the update. The CPU restarts automatically.
6. After restart, re-read Server_ServerStatus_State from any OPC UA client and confirm the value is 0 (Running).

5.3 Update via SIMATIC Automation Tool

For multi-CPU rollouts, use the SIMATIC Automation Tool to push the firmware to several CPUs without opening each TIA Portal project. The tool also verifies the post-update ServerStatus.State read.

6. Resolution Path B: Client-Side Workaround (Prosys SDK)

If a firmware update is not possible in the short term (for example, the affected CPU is part of a qualified production line that cannot be re-validated quickly), the Prosys OPC UA SDK exposes a known compatibility switch that allows the application to continue receiving data while the server reports State=Failed. This is a workaround, not a fix, and should be paired with a planned firmware update.

6.1 Downgrade to SDK 4.1.4

Prosys OPC UA SDK for Java version 4.1.4 is the last release in the 4.1.x line before the strict ServerState enforcement was tightened in 4.2.0. Downgrading is the simplest path:

# Maven dependency override
<dependency>
  <groupId>com.prosysopc.ua</groupId>
  <artifactId>prosys-opc-ua-sdk</artifactId>
  <version>4.1.4</version>
</dependency>

# Or, in Gradle
implementation 'com.prosysopc.ua:prosys-opc-ua-sdk:4.1.4'

After the change, rebuild the application, redeploy, and re-test the connection. The ServerState Failed log message may still appear because the value is reported by the server, but the SDK will not gate PublishResponses on the value.

6.2 Use the ServerState Override in 4.2.x Point Releases

Beginning with the Prosys OPC UA SDK for Java 4.2.0 point releases, a configuration option allows the application to declare which non-Running ServerState values are still acceptable for production use. In the application code, set the following before the first connect() call:

// Java code (Prosys OPC UA SDK 4.2.x with workaround)
import com.prosysopc.ua.client.UaClient;

UaClient client = new UaClient("opc.tcp://1.1.5.2:4840");
client.getConfig().setServerStateAcceptance(
    java.util.EnumSet.of(
        com.prosysopc.ua.types.opcua.server.ServerState.Running,
        com.prosysopc.ua.types.opcua.server.ServerState.Failed));
client.connect();

Confirm the exact API path against the SDK's release notes for your installed 4.2.x point release; method names and package locations have changed across minor versions.

6.3 Switch to a Different Client Library

If neither downgrade nor the override is acceptable, switch to an alternative Java client library that does not enforce the ServerState rule, for example the Eclipse Milo open-source client or the node-opcua client for Node.js. These libraries still record the state but do not gate subscription delivery on it. For C# applications, the OPC Foundation's .NET Standard library and the Siemens SIMATIC .NET OPC UA Client samples provide reference implementations.

7. Resolution Path C: Security and Endpoint Configuration

Two ancillary conditions in the captured log are worth addressing even though they are not the root cause: the SecurityPolicy None setting and the server certificate exchange.

7.1 SecurityPolicy None vs. Signed/Encrypted

The client is configured with SecurityPolicy#None:

Using SecurityPolicy http://opcfoundation.org/UA/SecurityPolicy#None

This is acceptable for a lab test, but in a production environment Siemens recommends at minimum Basic128Rsa15 or Basic256Sha256. To enable security in the Prosys SDK:

1. Open the S7-1500 OPC UA server configuration in TIA Portal under Properties > OPC UA > Server.
2. Add the client application URI to the Trusted clients list and assign the Sign or Sign and Encrypt security policy.
3. In the Prosys SDK application, set the security policy before connecting:

   client.getConfig().setSecurityPolicyUri(
       SecurityPolicy.BASIC256SHA256.getUri());
   client.getConfig().setApplicationCertificate(
       applicationCertificate);
   client.getConfig().setApplicationKeyPair(
       applicationKeyPair);

4. Export the S7-1500 OPC UA server certificate from the TIA Portal configuration and import it into the SDK's PKI/CA/certs trusted folder.

7.2 Server Certificate Acceptance

The log entry

INFO  Server sent a certificate, although SecurityPolicy NONE is used

is informational. The S7-1500 OPC UA server sends its application instance certificate in the endpoint descriptions regardless of the security policy. When SecurityPolicy None is in use, the certificate is not used for cryptographic operations, but the client still records the URL it points to. Accept the certificate into the trusted store the first time; subsequent connections will not re-prompt.

8. Verification Steps

After applying the fix, perform the following verification sequence:

1. Re-read ServerStatus.State. Confirm the value is 0 (Running). Use UaExpert and the Prosys client side by side.
2. Create a subscription with at least one monitored item. The monitored item should be a known-good S7-1500 tag, e.g. a DB1.DBD0 floating-point variable exposed as ns=3;s="DB1"."DBD0" on the server.
3. Force a value change. From TIA Portal in monitor mode, modify the tag value, or from a second client write to it. The first client must receive a Publish response with the new value within the publishing interval (default 1000 ms).
4. Inspect the SDK log. Confirm that no ServerState changed from Unknown to Failed line is emitted, and that SubscriptionPublishCallback entries appear at the configured interval.
5. Browse the address space. The Root/Objects/Server/ServerStatus node must show State with a current value attribute of 0.
6. Capture the BuildInfo again. The SoftwareVersion field must match the firmware version you installed (e.g. V02.09.07 if you updated to TIA V17 firmware V2.9).

9. Preventive Measures and Best Practices

10. Troubleshooting Matrix

11. Reference Standards and Official Documentation

Always verify the OPC UA server behavior against the current versions of the standards listed below.

• OPC UA Specification Part 5: Information Model, section 12.6 ServerState (Table 136). Available from the OPC Foundation specifications page.
• OPC UA Specification Part 4: Services, section 5.6.2 CreateSession and section 5.13.5 Publish. Available from the OPC Foundation specifications page.
• SIMATIC S7-1500 OPC UA Server Function Manual. Available on the Siemens Industry Online Support portal.
• SIMATIC S7-1500 CPU firmware updates. Search the order number on the Siemens Industry Online Support portal.
• Prosys OPC UA SDK for Java release notes. Available on the Prosys OPC product page.