Resolving TP1200 OPC UA Server Tag Read Failures with WinCC RT

Problem Overview

A TP1200 Comfort Panel configured as an OPC UA Server is reachable on the network (ICMP ping responds, OPC Scout discovers the endpoint), but a Windows Server running WinCC RT V7.4 cannot subscribe to or read HMI tags. Symptoms typically include:

• Endpoint discovery succeeds in OPC Scout (e.g., opc.tcp://192.168.0.10:4840), but adding the node tree returns BadCommunicationError or BadCertificateInvalid.
• The WinCC OPC UA Channel driver in Tag Management finds the TP1200 but the "Add" button is greyed out, or browsing the address space returns no nodes.
• The HMI appears in the OPC Scout Rejected Certificates folder on the WinCC PC, or vice-versa.
• Browsing the server address space produces an inconsistent set of errors that change after retries (transport timeout vs. service fault vs. secure channel rejected).

Two distinct root causes drive these symptoms. First, the OPC UA endpoint URL must use the Comfort Panel device name, not the IP address, and that name must resolve through the WinCC host's name-resolution path. Second, both the TIA Portal project version that generated the HMI image and the Comfort Panel firmware/runtime version must be at least TIA Portal V14 (HMI image 14.0.x) for OPC UA server operation to be functional on a Comfort Panel. Projects built in TIA V13 SP1 / V13 SP1 Update 7 with an older runtime image may expose the endpoint but fail certificate/secure-channel negotiation, producing the exact intermittent fault pattern reported in field cases.

Affected Products and Firmware Versions

Root Cause Analysis

Cause 1 – IP Address vs. Device Name in Endpoint URL

The OPC UA specification (IEC 62541) requires the endpoint URL to match the URL in the server's certificate ApplicationUri. On a Comfort Panel, the ApplicationUri is built from the device (host) name configured in the panel's Device configuration → PROFINET interface → Ethernet addresses → Properties, not from the IP address. When the WinCC client connects with opc.tcp://192.168.0.10:4840, the URL does not match the certificate URI and the server rejects the session with BadCertificateUriMismatch.

Cause 2 – NetBIOS / DNS Name Resolution Failure

Even when the client is corrected to opc.tcp://<DeviceName>:4840, the WinCC host must resolve <DeviceName> to the panel's IP. By default Comfort Panels broadcast their NetBIOS name on the local subnet via the "Use router" discovery option. If this option is disabled, or if the WinCC host cannot resolve the name, the client socket layer fails before the OPC UA stack can negotiate.

Cause 3 – Untrusted Certificates in Rejected Folder

Both the WinCC client and the TP1200 server maintain their own trusted-certificate store. The first time a session is opened, each side presents its ApplicationInstanceCertificate. If the counterpart's certificate is not pre-trusted, it is placed in the Rejected certificates folder. Browsing then fails with BadCertificateUntrusted.

Cause 4 – TIA Portal V13 SP1 Image Bug

As confirmed in field cases, a TP1200 with a V13 SP1 HMI image may expose the OPC UA discovery endpoint but returns inconsistent faults when a node browse or read is attempted. The OPC UA server stack in the V13 image has known regressions; only V14 (or later) runtime images implement the spec-compliant session and secure-channel behavior expected by WinCC V7.4.

Prerequisites

• Administrator rights on the WinCC RT host (for editing lmhosts, managing the certificate store, and opening port 4840 in Windows Firewall).
• TIA Portal V14 (or newer) installed with the Comfort Panel HSP for TP1200.
• The TP1200 must have a configured device name (default: <Plant designation>-<Position>) and a static IP address on the PROFINET network.
• The OPC UA Server option must be enabled in the runtime settings, and at least one HMI tag must be created with the "Accessible from OPC UA" attribute enabled (TIA marks this attribute automatically for tags within the default HMI tag table).
• Network reachability: ICMP ping to both IP and device name must succeed from the WinCC host.
• The Comfort Panel firmware must be loaded from a TIA Portal V14 (or later) project; recompiling in V14 is mandatory if the panel was originally programmed in V13 SP1.

Step-by-Step Resolution

Step 1 – Upgrade the HMI Image to TIA V14 or Newer

1. Open the TP1200 project in TIA Portal V14 (or the newest available in your environment).
2. Verify the panel type under Devices & Networks. The TP1200 must remain a V14-compatible device; do not change the catalog part number.
3. Re-compile the project (Project → Compile all → Software (rebuild all)).
4. Download the project to the TP1200 over PROFINET or Ethernet. Accept the "Overwrite PLC/HMI" prompt and wait for the panel to reboot into the new image (typically 60–120 s for TP1200).
5. After reboot, in the Control Panel of the TP1200, navigate to OP → Properties → System → Version and confirm that the image version is ≥ 14.0.0.0.

Step 2 – Enable the OPC UA Server and Configure the Endpoint

1. In the TP1200 device configuration, open Runtime settings → Services → OPC UA Server.
2. Set "Activate OPC UA Server" = enabled.
3. Set "Port" = 4840 (or any free TCP port ≥ 1024 if 4840 collides with another service).
4. Set "Security policy" = None for the first connection test. Production deployments should switch to Basic256Sha256 after certificates are exchanged.
5. Under Runtime settings → Services → OPC UA Server → Security, disable "Accept client certificates automatically" if you want strict trust management; otherwise leave enabled for development.
6. Confirm the device name under PROFINET interface → Ethernet addresses. The default follows the project designation, e.g. HMI-1200-001. Write this name down; it becomes part of the endpoint URL.

Step 3 – Enable "Use Router" on the Comfort Panel

The "Use router" option enables NetBIOS name broadcast across routers (or, more precisely, allows the panel to respond to NetBIOS name queries across the configured subnet). On the TP1200 Control Panel:

1. Control Panel → Network & Dial-up Connections → PN/IE_1.
2. Properties → IP address → Advanced → WINS.
3. Enable "Use NetBIOS over TCP/IP" and "Enable LMHOSTS lookup".

On the engineering station side (TIA Portal), ensure the panel's PROFINET interface has "Use router" = enabled in the device configuration. This is required so that the panel answers name-resolution queries beyond the local subnet.

Step 4 – Edit the lmhosts File on the WinCC Host

The lmhosts file maps NetBIOS names to IP addresses when DNS is unavailable or when the WinCC host and the panel are on a non-DNS-managed subnet.

1. On the WinCC host, open an elevated command prompt.
2. Locate the sample file: C:\Windows\System32\drivers\etc\lmhosts.sam.
3. Copy lmhosts.sam to C:\Windows\System32\drivers\etc\lmhosts (remove the .sam extension). If Show extensions for known file types is disabled, use dir /x to confirm there is no stray extension.
4. Edit lmhosts with Notepad and append a line in the format:

#PRE
192.168.0.10   HMI-1200-001    #PRE

The #PRE directive causes Windows to preload the entry into the NetBIOS name cache at boot. Replace 192.168.0.10 with the actual IP of the TP1200 and HMI-1200-001 with the configured device name (case-insensitive but must match exactly).

5. Save the file and force a reload with nbtstat -R (capital R preloads from lmhosts #PRE entries; lowercase -r only purges and re-queries).
6. Verify resolution: ping HMI-1200-001 must return the configured IP.

Step 5 – Configure the WinCC OPC UA Channel

1. In the WinCC Explorer on the WinCC RT host, right-click Tag Management → Add new driver → OPC UA WinCC Channel.
2. Right-click OPC UA Channel → New Connection → enter a name (e.g., TP1200_OPCUA).
3. In the connection properties, set "OPC UA Server URL":

opc.tcp://HMI-1200-001:4840

Use the device name (not IP), exactly as configured on the panel. Keep the default port 4840 unless changed in Step 2.

4. Set "Security Policy" to None for the first connection test. After verification, switch to Basic256Sha256 and import certificates per Step 7.
5. Set "Authentication Mode" = Anonymous initially. Switch to Username/Password only if user authentication has been configured on the TP1200 OPC UA server.
6. Click Test Connection. The status indicator should turn green and the dialog should report the endpoint description, server status Running, and current time.

Step 6 – Browse and Add Tags

1. Click Browse in the OPC UA connection properties. The address space of the TP1200 opens.
2. The default node tree is rooted at Objects → 3:DeviceSet → 3:TP1200 Comfort → 3:Tags. The folder 3:Tags contains a child folder per HMI tag table.
3. Select the desired tags and confirm with Add. If the Add button is greyed out, return to Step 5 and verify the URL uses the device name (not IP) and that Test Connection succeeds.
4. In the WinCC tag list, configure the update rate (recommended: 500 ms for slow process tags, 100 ms for fast status). For Comfort Panels, do not exceed 50 tags per second aggregate read rate to avoid load on the HMI's OPC UA server stack.

Step 7 – Exchange and Trust Certificates (Production)

Once the connection is verified under Security Policy = None, raise security for production:

1. Set the TP1200 OPC UA Server security policy to Basic256Sha256 (or Basic256 for legacy clients; Basic128Rsa15 is deprecated by the OPC Foundation).
2. On the WinCC host, the TP1200's self-signed certificate is initially placed in C:\ProgramData\Siemens\Automation\OpcUaConfig\RejectedCertificates. Move (do not copy) it to ..\TrustedCertificates.
3. Export the WinCC client certificate from C:\ProgramData\Siemens\Automation\OpcUaConfig\OwnCertificates and transfer it to the TP1200 via TIA Portal Runtime settings → OPC UA Server → Trusted client certificates. Alternatively, enable "Accept client certificates automatically" on the panel for development.
4. Reboot the TP1200 to flush the in-memory trust list, then re-test the WinCC connection.

Verification

1. From the WinCC host command prompt, run nbtstat -c and confirm the TP1200 device name appears with its IP address.
2. From Siemens OPC Scout V10 (or V13), connect using opc.tcp://HMI-1200-001:4840, browse to Objects → DeviceSet, and confirm the expected tag count matches the HMI tag table.
3. Drag a tag into the OPC Scout DA View; confirm the value updates at the configured sampling rate and that the Status column shows Good.
4. In WinCC Explorer Graphics Designer, link an I/O field to the imported tag and toggle the value on the TP1200. The WinCC tag must follow within one update cycle.
5. Open WinCC Channel Diagnosis (Start → Siemens Automation → WinCC → Channel Diagnosis) and verify no OPC UA connection lost events appear in the log over a 10-minute burn-in.

Siemens OPC UA Server Node Limits (Reference)

Per the Siemens S7-1200/1500 OPC UA Server Limitations documentation (which also applies to Comfort Panels operating in OPC UA server mode), the following limits apply to address-space consumption. Each HMI tag exposes one OPC UA node; variables, alarms, and methods add additional nodes.

For the TP1200, plan tag-browsing structure such that the total node count (tags + folders + server metadata) stays below 1,500 to leave headroom for diagnostic nodes.

Endpoint URL and Security Policy Reference

Troubleshooting Matrix

Alternative Approach – Symbolic Tag Names

For long-term maintainability, expose HMI tags with stable symbolic names. In TIA Portal, the OPC UA server creates nodes under ns=3;s=Tags::<TagTableName>::<TagName>. Document the namespace in your WinCC project notes so that re-imports after firmware upgrades do not silently break references.

Related Configuration – "Use Router" on PROFINET

When the WinCC host and the TP1200 are on different subnets routed by an L3 device, two settings must both be true:

1. TP1200 PROFINET interface: "Use router" = enabled in TIA device configuration.
2. WinCC host must resolve the device name. Add a #PRE entry in lmhosts for routed scenarios where DNS does not propagate NetBIOS names.

Without both, name resolution works only on the local /24 and connections from a routed WinCC server will time out.