S7-1200 OPC UA Server: Exposing Tags to Kepware and Third-Party Clients

The SIMATIC S7-1200 CPU family is widely used as a compact controller for machine-level automation, and a recurring integration requirement is exposing its internal tags (inputs, outputs, memory bits, and DB data block contents) to a higher-level OPC UA Server such as Kepware (KepwareEX / KEPServerEX) or Ignition. Because the S7-1200 can only act as an OPC UA Server (not as a client) and ships with only a single integrated PROFINET interface, the wiring of machine network, engineering access, and OPC UA traffic must be planned up front. This reference walks through the architectural constraints, TIA Portal configuration, tag release, Kepware driver setup, and the verification steps required to deliver 50 to 100 tags to a third-party OPC UA server.

1. Hardware Architecture Constraints

The S7-1200 system has a fixed hardware topology that affects every OPC UA integration design.

The two RJ45 sockets on the bottom of every CPU 12xx are physically the same PROFINET interface. They are internally switched, so a star or daisy-chained topology is permitted, but logically both ports share one MAC, one IP address, and one PROFINET device name. This is critical because it means the machine PROFINET network and the OPC UA client network (engineering PC, Kepware server) must coexist on the same IP subnet, or be bridged by an external router/firewall.

1.1 MLFB Identification

The reported article MLFB is 6ES72141AG400XB0. Breaking down the Siemens order code:

• 6ES7 — SIMATIC product family
• 214 — CPU 1214C (DC/DC/DC variant; note: the original article title references 1215C but the MLFB identifies a 1214C)
• 1AG40 — Power supply 24 V DC, integrated I/O type, ordering design
• 0XB0 — Without conformal coating

The complete MLFB should be confirmed on the front-panel label (article number column, e.g. 6ES7214-1AG40-0XB0 for the standard 1214C DC/DC/DC). The OPC UA Server feature was first introduced on the S7-1200 in firmware V4.4 as an optional, chargeable runtime function. From firmware V4.5 (and consolidated in TIA Portal V17+), the OPC UA Server capability was moved to the standard delivery scope. Confirm the active firmware under Online & Diagnostics → Diagnostics → CPU Information before commissioning.

2. OPC UA Role: Server Only

Within the SIMATIC ecosystem, the S7-1200 and S7-1500 families use different OPC UA roles:

Because the S7-1200 cannot initiate an OPC UA client connection, it cannot "push" tag values into Kepware via OPC UA. The integrator must select one of three architectural patterns:

1. Native OPC UA pull — Configure the S7-1200 OPC UA Server, point Kepware's OPC UA Client Driver at the CPU endpoint, and pull subscriptions.
2. S7 native pull (most common) — Use Kepware's Siemens TCP/IP Ethernet Driver, which speaks the S7 communication protocol directly. No OPC UA on the PLC side is required, but it must be enabled if you want a standards-based path.
3. Broker / middleware — Use a third-party aggregator (Ignition, WinCC Unified PC, or Node-RED with the s7 node) that speaks S7 to the PLC and exposes OPC UA to clients.

3. Licensing and Firmware Prerequisites

Before enabling OPC UA, verify the following prerequisites:

• Firmware V4.4 or later (article number 6ES7214-1AG40-0XB0 ships with V4.2/V4.4 depending on production year — upgrade via TIA Portal if required).
• TIA Portal V15.1 or later with the OPC UA plug-in enabled in the project tree.
• OPC UA runtime license on the S7-1200 side, where required by firmware version. As of V4.5, OPC UA Server is part of the standard scope and no license transfer is needed.
• KepwareEX V6.x or later (recommended V6.13+) for full OPC UA client / Siemens TCP/IP driver support.
• Open TCP port 4840 on the PLC and any intermediate firewalls (OPC UA binary protocol default; HTTPS / WebSocket variants use 4843).

4. Configuring the OPC UA Server in TIA Portal

The configuration is performed offline in the TIA Portal project and then loaded to the CPU.

4.1 Enable the OPC UA Server

1. Open the device view of the S7-1200 CPU.
2. Select the CPU → Properties → OPC UA → Server.
3. Check "Activate OPC UA Server".
4. Select the desired runtime security policy. Common choices:
   • None (development only — not for production)
   • Basic128Rsa15 (deprecated but still common)
   • Basic256Sha256 (recommended for legacy clients)
   • Aes128Sha256RsaOaep and Aes256Sha256RsaPss (recommended for new deployments)
5. Set the server endpoint port (default 4840).
6. Optionally restrict access to specific client certificates by toggling "Server only accepts manually configured certificates".

4.2 Configure the Application Path and Address Space

The OPC UA address space is built automatically from the CPU's released symbols:

1. In the project tree, navigate to PLC tags or open the relevant Data Block (DB).
2. Right-click a tag or DB element → "Accessible from OPC UA". This flag must be set on every tag you want to publish. There is no bulk release; each tag is individually checked.
3. Confirm the namespace URI under OPC UA → Server → Interfaces. The default is urn:Siemens:S7-1200:<CPU name>.

4.3 Security and Certificate Exchange

For production environments with security policy enabled:

1. Generate or export the S7-1200 server certificate from OPC UA → Security → Server certificate (PEM/DER).
2. On the Kepware server, install its client certificate into the trusted certificates folder of the CPU (TIA Portal: OPC UA → Trusted clients).
3. Install the S7-1200 server certificate into the Windows certificate store of the Kepware host (or accept the trust prompt on first connect).
4. Configure user identity — anonymous, username/password, or certificate-based — under OPC UA → Authentication.

5. Releasing Tags for OPC UA Access

Tag release is the step most often overlooked, especially on first-time projects. In TIA Portal:

1. Open the project tree and select the PLC data types or PLC tags folder.
2. Double-click each tag you wish to expose.
3. In the inspector window (lower right), under Attributes, check "Accessible from OPC UA".
4. For DBs, expand the DB and set the flag on every member, or apply it on the entire DB header (which propagates to all members).
5. Compile the project and download to the CPU. The OPC UA server only rebuilds its address space on a project download or restart.

A bulk release for projects with 50–100 tags can be scripted through the TIA Portal Openness API using the following C# pseudo-code:

// TIA Portal Openness — bulk-enable OPC UA access on a DB
foreach (var tag in db.Tags.Cast<PlcTag>()) {
    var attr = tag.Attributes.Find("OPCUA_Accessible");
    if (attr != null) {
        attr.Value = true;
    }
}
project.Save();

6. Connecting Kepware via the Siemens TCP/IP Ethernet Driver

For projects where OPC UA on the PLC is not licensed or the customer has standardized on Kepware's native S7 driver, the Siemens TCP/IP Ethernet driver is the simplest path. This driver bypasses OPC UA entirely on the PLC side — only the S7 protocol is required.

6.1 Create the Channel

1. Open the Kepware Configuration tool.
2. Right-click Channels → New Channel → select Siemens TCP/IP Ethernet.
3. Name the channel (e.g. S7_1214C_Machine1).
4. Set the Network Adapter to the NIC connected to the S7-1200 subnet.
5. Set Communication Timeout to 1500 ms (default) and Write Optimization to 100 ms.

6.2 Add the Device

1. Right-click the channel → New Device.
2. Set Device ID to the last octet of the CPU's PROFINET IP address (e.g. CPU IP 192.168.0.10 → Device ID 10). For rack-mounted S7-300/S7-400, use the MPI/Profibus address. For S7-1200, the Device ID is the IP last octet.
3. Set Family to S7-1200.
4. Set Timeout to 3000 ms for plant networks.

6.3 Add Tags

The S7-1200 address-to-tag mapping uses the following conventions:

Importing 50–100 tags is faster via CSV: prepare a header row with name,address,datatype,scanrate,description, save as UTF-8, and use Import Tags in Kepware.

6.4 Recommended Scan Rates

7. OPC UA Client Driver in Kepware (Alternative)

If the requirement is purely standards-based OPC UA, Kepware can also use the OPC UA Client Driver. The configuration steps are:

1. Add a new channel of type OPC UA Client Driver.
2. Enter the discovery URL: opc.tcp://<CPU IP>:4840.
3. Configure the security policy to match the CPU (e.g. Basic256Sha256, SignAndEncrypt).
4. Set the authentication mode (Anonymous / Username / Certificate).
5. Browse the address space from the CPU and add tags through the Kepware tag database.
6. Enable subscriptions with a publishing interval of 200–1000 ms.

8. Network and IP Configuration

Because the S7-1200 has only one logical interface, both the machine PROFINET and the OPC UA client traffic share the same subnet. The recommended layouts are:

8.1 Shared Subnet (Typical)

CPU 1214C — IP 192.168.0.10/24
IM/HMI — IP 192.168.0.20/24
ET200S — IP 192.168.0.30/24
Kepware PC — IP 192.168.0.100/24
Engineering PC — IP 192.168.0.200/24

All devices are in the same broadcast domain. PROFINET RT and TCP/UDP traffic coexist; switch ports must be configured for auto-negotiation at 100 Mbit/s full duplex.

8.2 Segmented Subnet (with Router)

Machine network 192.168.0.0/24 — CPU, PROFINET devices
IT/OPC network 192.168.1.0/24 — Kepware, OPC UA clients
Router/firewall between 192.168.0.1 and 192.168.1.1

The router must allow TCP/4840 (OPC UA) and TCP/102 (S7 ISO-on-TCP) from the IT side to the CPU.

8.3 Second Interface Option: CP 1243-1

A CP 1243-1 module can be installed in the left slot of the S7-1200 to provide a second Ethernet interface dedicated to IT/telecontrol communication. However, this CP:

• Does not act as a PROFINET IO controller for a separate IO line.
• Provides an additional IP address on its own Ethernet segment.
• Supports S7 communication, OUC, MQTT, HTTPS, and OPC UA pass-through (only if the OPC UA Server is bound to the integrated interface — see TIA Portal OPC UA → Server → Interfaces).
• Cannot be configured as a second PROFINET interface for parallel machine networks.

9. Verification and Diagnostics

After commissioning, perform the following checks:

1. CPU side: TIA Portal → Online & Diagnostics → Diagnostics → OPC UA. Verify the server status is "Running" and the number of sessions / subscriptions matches expected.
2. Firewall test: From the Kepware PC, run Test-NetConnection -ComputerName <CPU IP> -Port 4840 (PowerShell) or telnet <CPU IP> 4840. The port must respond.
3. Kepware quick client: Add a few test tags with a 100 ms scan rate and verify quality is "Good" after 5 seconds.
4. OPC UA browser: Use UA Expert or Prosys OPC UA Browser to navigate the address space of the CPU directly. Confirm released tags appear.
5. Subscription load: Monitor the CPU's OPC UA → Diagnostics → MonitoredItems counter. If the value approaches the configured maximum, increase the subscription interval or split into multiple clients.
6. Latency check: Toggle a tag in the CPU and measure the round-trip time in Kepware's tag diagnostics. Values above 1 s on a 100 ms scan rate indicate bus load or switch misconfiguration.

10. Troubleshooting Matrix

11. Decision Path: OPC UA Server vs Siemens TCP/IP Driver

12. Field-Proven Caveats

• Firmware downgrade risk: Once a V4.5+ CPU has OPC UA Server in the standard scope, downgrading below V4.4 disables the feature entirely.
• Optimized vs absolute DB access: Tags in optimized-access DBs cannot be addressed by absolute offset (DBWx, DBx.y) from the S7 TCP/IP driver. Either declare the DB as "non-optimized" (standard access) or expose symbolic names and use symbolic addressing in Kepware.
• STRING and ARRAY limits: The OPC UA Server has a maximum element length for strings (default 254 bytes). Configure the length in TIA Portal before download.
• PlcSysSim vs real CPU: PLCSIM does not fully simulate the OPC UA Server behavior — always validate against a real CPU before sign-off.
• Certificate expiry: The default OPC UA server certificate on the S7-1200 is valid for 5 years. Plan renewal before production turnover.
• CPU load: OPC UA Server increases CPU cycle time. On a 1214C with > 50 released tags and 1 kHz PROFINET cycle, expect an additional 2–5 ms scan time overhead.