Resolving WinCC Unified OPC UA Connection to S7-1500 Server

Overview

Connecting a SIMATIC WinCC Unified runtime to an S7-1500 OPC UA server is a common architecture for separating the HMI project from the PLC project, especially when the HMI is published on a Unified Comfort Panel (UCP), Unified PC runtime, or a multi-project engineering setup. The connection is conceptually simple—TIA Portal handles the discovery, the runtime consumes the published DB tags—but the failure modes produce identical symptoms: tags are visible in the engineering system (discovery succeeds, browse succeeds) yet the runtime value field stays empty and the tag quality displays an error code.

This article walks through the canonical case in which a WinCC Unified OPC UA client sees a S7-1513 server, can browse the address space, but cannot read or update tag values at runtime. It covers certificate management across projects, security policy selection, endpoint URL construction, server interface configuration, and runtime-side trust store configuration, and it ends with a verification procedure and a troubleshooting matrix.

Problem Symptoms

The reported failure pattern has three diagnostic features that are diagnostic by themselves:

1. OPC UA discovery on the engineering system succeeds. The OPC UA connection wizard in TIA Portal locates the server, browses the address space, and lets the engineer select individual tags.
2. Third-party OPC UA clients behave inconsistently. UaExpert (Unified Automation) reads the value correctly; OPC Scout (Siemens) returns an empty value. The difference is the trust-store behavior at first contact: UaExpert prompts the user to install the server certificate, while OPC Scout rejects unknown server certificates silently.
3. WinCC Unified runtime returns the tag with an empty value and a non-zero quality code (typically OPC_Quality_Bad or OPC_Quality_Bad_CommunicationError). The value is not held at the last good reading; the connection state shows the channel as up, but the item state shows bad.

The combination is a strong indicator of a trust-store or endpoint-resolution problem at the runtime, not a tag mapping or a server-side publishing problem. Discovery and browse happen over the Discovery service on port 4840 and require only an unauthenticated session; read services require an activated secure channel, a session, and a trusted server certificate, all of which must be present at runtime.

Root Cause Analysis

Three layered causes produce the reported symptoms. They must be resolved in order because each one masks the next.

Cause 1 — Server certificate not in the WinCC Unified runtime trust store. The S7-1500 OPC UA server ships with a self-signed certificate. The engineering system implicitly trusts it because TIA Portal is the same project (or a project that has been synchronized with the PLC's certificate via the global certificate manager). When the HMI runtime starts, it has its own certificate store. If the server certificate is not present in that store, the runtime either refuses the secure channel or accepts it but cannot verify the application description, and the read requests are dropped.

Cause 2 — Endpoint URL configured for engineering but not for runtime. The OPC UA connection object in TIA Portal accepts a discovery URL (opc.tcp://<IP>:4840). During engineering, the client follows the discovery URL to the endpoint description list and selects a working endpoint. The runtime re-resolves the same discovery URL. If the runtime PC or Unified Comfort Panel cannot reach the same IP address at runtime (DNS, routing, firewall on port 4840, or a DHCP-issued address that changed between engineering and deployment), the discovery request fails and the channel never opens.

Cause 3 — Server interface not published. The S7-1500 OPC UA server only exposes tags that the user has explicitly published. The server interfaces are configured per PLC under Properties → OPC UA Server → Server interfaces. A DB tag that is not added to a server interface is invisible to all OPC UA clients, including UaExpert if the user is browsing the wrong interface. Discovery succeeds, browse succeeds, the tag is visible—but the read returns a status code Bad_NodeIdUnknown at runtime.

Architectural Prerequisites

Before changing any setting, confirm the deployment matches the assumptions of the OPC UA client channel in WinCC Unified.

Configuring the S7-1500 OPC UA Server

The server-side configuration is the foundation. If the server is not publishing the tag, no client configuration will produce a value at runtime.

1. In the TIA Portal project that contains the S7-1500 CPU, open the device view of the CPU and navigate to Properties → OPC UA Server.
2. Enable the Activate OPC UA Server checkbox.
3. Confirm the port is 4840. If the network requires a different port, change it here and update the connection in the HMI project accordingly.
4. Under Server interfaces, add the data block(s) you want to expose. Each server interface has a name, an optional namespace URI, and a list of accessible nodes.
5. Select the DB tag(s) you want to publish and add them to the server interface. The PLC symbol table is the source for selection.
6. Under Security, set the security policy. For an initial test where you want to isolate other causes, set Security policy to None and User authentication to Allow anonymous (this is the "guest authentication" the user mentioned). This corresponds to OPC UA MessageSecurityMode=None and SecurityPolicy=None.
7. Compile the project, download it to the CPU, and perform a STOP → RUN transition to start the OPC UA server. The server only starts after a power-on or STOP→RUN transition following a configuration change.

Verify the server is publishing by connecting UaExpert. The address is opc.tcp://<PLC_IP>:4840. After the first connection, UaExpert prompts the user to trust the server certificate. This single observation—UaExpert reading values while OPC Scout returns empty—is the strong signal that the server is healthy and the trust store is the problem.

Configuring the WinCC Unified OPC UA Client Connection

The connection object on the HMI side is configured in TIA Portal under HMI device → Connections → OPC UA. For the canonical S7-1500 server case, follow the procedure documented in the Siemens TIA Portal help portal for WinCC Unified OPC UA client configuration: Defining connection settings to the OPC UA server (RT Unified).

1. Add a new connection. The connection type is OPC UA.
2. Set the Connection URL to opc.tcp://<PLC_IP>:4840. Do not append a path. Do not use the hostname unless DNS resolves it on the runtime host.
3. Set the Security policy to None and the Message security mode to None to match the server configuration during the first commissioning pass.
4. Set the User token policy to Anonymous (this is the "guest authentication" mode).
5. Use the Browse button to verify that TIA Portal can browse the server address space. If browse succeeds, the engineering connection is working.
6. Add the tags you want to read. The wizard produces a list of HMI tags with OPC UA item names of the form ns=3;s="DB_Name"."Tag_Name" or ns=4;s="MyInterface"/"TagName" depending on the namespace configuration.

Certificate Management Across Projects

When the PLC and the HMI are in different TIA Portal projects, the global certificate manager is the default mechanism. It allows the engineering system to sync certificates between projects during download. The user has indicated they do not want to use the global certificate manager, so the certificate must be managed manually. There are two certificates to manage:

• The server certificate issued by the S7-1500 OPC UA server. The runtime must trust it.
• The client certificate issued by the WinCC Unified runtime. The server must trust it (or, with None security and anonymous authentication, the server does not check it).

Exporting the server certificate

1. Open the S7-1500 device view in TIA Portal.
2. Navigate to Properties → OPC UA Server → Security → Server certificate.
3. Use Export certificate to write the DER-encoded certificate (file extension .der or .cer) to a local file. The certificate is self-signed by the CPU and is regenerated on each full download if the OPC UA server is re-initialized.

Importing the server certificate into the WinCC Unified runtime trust store

The WinCC Unified runtime on a PC uses the local certificate store of the user account running the runtime service. The Simatic Runtime Manager exposes this store. On a Unified Comfort Panel, the store is on the panel itself.

1. Open Simatic Runtime Manager.
2. Select the runtime instance.
3. Open Settings → OPC UA → Trusted server certificates.
4. Import the DER file exported from the PLC.
5. Restart the WinCC Unified runtime to ensure the trust list is re-read.

Client certificate handling

With None security and Anonymous authentication, the client certificate is not checked by the server. As soon as the security policy is upgraded to Basic256Sha256, the server-side Trusted client certificates list must contain the runtime's client certificate. The runtime's client certificate is generated on first start of the runtime and stored in %ProgramData%/Siemens/Automation/WinCCUnified/runtime/<instance>/certstore on a PC, or in the corresponding location on a Unified Comfort Panel.

Resolving Empty Tag Values at Runtime

With the server publishing, the connection configured, and the certificate in the trust store, the next most common reason for empty values is the endpoint-selection behavior at runtime. WinCC Unified uses the OPC UA discovery URL to obtain the list of available endpoints and selects the first endpoint that matches the configured security policy. If the server returns multiple endpoints (for example, one on port 4840 with None security and one on port 4841 with Basic256Sha256), the runtime may select a different endpoint than the engineering system.

To force a deterministic endpoint selection:

1. Open the OPC UA connection in the HMI project.
2. Set the Endpoint URL explicitly to the URL of the desired endpoint. On the S7-1500 with default configuration, this is opc.tcp://<PLC_IP>:4840 for the None endpoint, or opc.tcp://<PLC_IP>:4841 for the Basic256Sha256 endpoint.
3. Recompile the HMI project and download to the runtime.

If the runtime still returns empty values, enable the OPC UA diagnostic logging on the runtime host. On a PC, this is %ProgramData%/Siemens/Automation/WinCCUnified/runtime/<instance>/Logs/OPCUA.log. The log records every channel open, endpoint selection, certificate validation result, and read request with its status code.

Interpreting WinCC Unified OPC UA Error Codes

The cryptic error code reported by the user is a WinCC Unified quality code. The most common codes seen in this scenario, with their OPC UA StatusCode equivalents, are:

The exact inner status code is written to the OPC UA log on the runtime host. Reading the log is faster than guessing from the HMI quality code alone.

Verification

After applying the changes, verify the connection end-to-end with the following procedure.

1. On the S7-1500, confirm the OPC UA server is running. In the CPU's online diagnostics, navigate to Diagnostics → OPC UA. The server should report Running with the configured endpoint URL.
2. On the runtime host, open UaExpert and connect to the same URL. If UaExpert reads the value, the network path, port, server, and server-side publishing are all correct. The remaining cause is the WinCC Unified trust store.
3. In Simatic Runtime Manager, confirm the server certificate is in the trusted list. Restart the runtime.
4. Start the WinCC Unified runtime. Open the HMI tag in the online tag diagnostics. The value should be displayed, and the quality code should be OPC_Quality_Good (hex 0x00000000).
5. Force a value change in the PLC (set the tag to a known value in the watch table). Confirm the HMI reflects the new value within the configured acquisition cycle (default 1 s for cyclic polling, 250 ms for change-of-state).

Troubleshooting Matrix

Hardening for Production

The None / Anonymous configuration is acceptable for the initial commissioning pass and for isolated lab networks. It must not be left in place for production. The recommended production configuration is:

• Security policy: Basic256Sha256 on the S7-1500 (firmware V2.9 or later) and on the WinCC Unified client. This policy uses SHA-256 and 256-bit AES, and is the only policy currently considered secure by the OPC Foundation. Basic128Rsa15 and Basic256 are deprecated.
• Message security mode: SignAndEncrypt. This ensures both message integrity and confidentiality.
• User authentication: Username/Password with a dedicated OPC UA user, or Certificate with mutual TLS. Anonymous is not appropriate for production.
• Certificate management: a CA-issued certificate for both the server and the runtime, with the CA root in the trust store of the other side. Self-signed certificates are acceptable but must be rotated annually.
• Firewall: restrict port 4840/TCP to the runtime host IP only. The S7-1500 firewall (CPU PROFINET interface) should also restrict the port to the runtime host's MAC or IP.

When upgrading from None to Basic256Sha256, perform the change in a controlled sequence. First, add Basic256Sha256 as an additional policy on the server while keeping None available. Confirm the runtime connects with the new policy. Then remove None. This sequence avoids a configuration error locking out the only client.

Notes on Alternative Client Channels

The OPC UA client channel documented in the Siemens TIA Portal help is the official channel for connecting WinCC Unified to an S7-1500 OPC UA server. Third-party OPC UA channels exist (the OPC UA Extension for SIMATIC WinCC developed by Allmendinger and distributed by Unified Automation is one example) and offer features such as redundant server handling and historical access. These channels are configured separately and are not part of the TIA Portal connection wizard. The OPC UA Extension for SIMATIC WinCC case study documents the deployment topology for these third-party channels and is useful for advanced scenarios such as connecting to a non-Siemens OPC UA server.

For a S7-1500 server, the native WinCC Unified OPC UA client channel is the supported path. It uses the same discovery and browse experience as the engineering connection, and it is maintained by Siemens as part of the TIA Portal release.

Field-Proven Caveats

A few caveats seen in field deployments are worth recording explicitly.

• The S7-1500 OPC UA server uses the PROFINET interface's IP address. If the CPU has multiple PROFINET interfaces, the OPC UA server listens on the IP of the interface configured under OPC UA Server → IP address. A common error is pointing the runtime at the PROFINET X2 IP when the server is listening on X1.
• The server certificate is regenerated when the CPU is reset to factory defaults. The runtime trust list must be re-imported after a factory reset, even if the project was downloaded unchanged.
• WinCC Unified on a Unified Comfort Panel uses the panel's IP, not the engineering PC's IP, to reach the server. The connection URL must be reachable from the panel's network interface, not the engineering subnet.
• If the runtime is started before the PLC is online, the connection enters a retry state. Confirm in the runtime diagnostics that the connection state is Connected and not Establishing or Disconnected before evaluating tag quality.
• The default acquisition cycle for an OPC UA tag in WinCC Unified is 1 second. A 100 ms update rate requires explicit configuration on the tag and on the server interface sampling interval.