S7-1200 SIMATIC NET OPC Tag Read Failure Firmware Fix

Problem Statement

An S7-1200 controller communicates with a WinCC V7.x runtime over a Wi-Fi bridged PROFINET link. SIMATIC NET OPC on the engineering station is configured as the S7 client and polls data block tags from the controller. Under normal conditions, the OPC server reports good quality for every item. When the wireless link drops momentarily and re-establishes, the following symptom is observed:

• SIMATIC NET OPC continues to run on the PC; the OPC service is reachable.
• The S7 connection in the SIMATIC NET Station Configurator shows a transient error and recovers on its own.
• All subsequently read tags return OPC_QUALITY_BAD (quality code 0x00000000, sub-status OPC_QUALITY_BAD_COMMUNICATION_ERROR, limit OPC_LIMIT_NONE).
• Writing tags from WinCC or any OPC client also fails with the same bad quality code.
• Only a power cycle or warm restart of the S7-1200 restores the read/write path. The PC side does not need to be restarted.

This is not a SIMATIC NET bug and not a WinCC bug. The fault lies in the S7-1200 firmware: after a link interruption, the controller fails to re-enable the passive partner (S7 server) side of the S7 communication that SIMATIC NET uses, even though the PROFINET interface itself has recovered and the controller is reachable for online operations from TIA Portal.

Root Cause Analysis: S7-1200 Firmware Communication Stack Bug

SIMATIC NET OPC exchanges S7 messages with the S7-1200 using the S7 Communication protocol over ISO-on-TCP (RFC1006, port 102). The S7-1200 acts as the server and SIMATIC NET as the client. From the S7-1200 side, the connection is registered with the operating system, an internal resource is allocated, and a passive partner (TP / "Transport Partner") is bound to the PROFINET interface's IP address.

On affected firmware versions, when the physical link goes down — for example because the Wi-Fi bridge loses association, the access point reboots, or a roaming event occurs — the operating system tears down the TCP socket, frees the connection resource, and re-arms the listening endpoint. On link recovery, the controller binds a new IP link, the PROFINET interface comes back, and the S7 server listening port is re-opened. However, the passive partner table is not always rebuilt for connections that were active at the moment of the link drop, and the S7 server enters a state where it:

1. Accepts a new TCP connection from SIMATIC NET OPC.
2. Receives the S7 CONNECT_REQUEST PDU.
3. Does not re-attach the internal connection context to the new socket, so the request is dropped silently.
4. Subsequently sends no response PDUs to the client, leaving the OPC tags in a bad quality state until the controller is restarted.

The behavior was confirmed by Siemens Technical Support as an S7-1200 operating system defect, not as a configuration or SIMATIC NET defect. The fix is delivered exclusively in a CPU firmware update.

Affected Hardware and Firmware Versions

The defect is documented for the first-generation S7-1200 CPUs (CPU 1211C, 1212C, 1214C, 1215C, 1217C) on the original operating system release line. The earliest fixes are delivered in firmware V2.0.1 and V2.0.3 of the corresponding CPU hardware. CPUs on later operating system lines (V3.x, V4.x) include the correction by inheritance and do not exhibit this specific symptom after a link drop, although they are still subject to wireless link design rules.

Resolution Summary

1. Identify the CPU firmware version currently loaded on the affected S7-1200.
2. Order or download the matching firmware update file (file extension .upd) from Siemens Industry Online Support.
3. Update the CPU using TIA Portal or SIMATIC Automation Tool.
4. Confirm the new firmware version is active after the restart.
5. Force a Wi-Fi / link drop and verify that SIMATIC NET OPC tags recover automatically without restarting the PLC.

Prerequisites for the Firmware Update

• TIA Portal V11 SP2 Update 2 or later installed on the engineering station (the same project that contains the S7-1200 device).
• Firmware update file for the exact CPU MLFB and hardware version, e.g. 6ES7214-1AE30-0XB0_V203.upd for a CPU 1214C DC/DC/DC at V2.0.3.
• Ethernet access to the S7-1200 PROFINET port (or a routed path through the project gateway). Wi-Fi access is acceptable for the transfer, but for reliability connect directly via cable for the update.
• Know the CPU protection password if one is configured (online "Full access incl. fail-safe" or higher is required for firmware update).
• Sufficient card space: the firmware update writes the new image to internal flash and switches the active image; a power loss during the write bricks the CPU and forces return-to-factory via SIMATIC memory card recovery.
• Backup of the current project on the engineering station and a SIMATIC memory card image if a roll-back may be required.

Step-by-Step Firmware Update via TIA Portal

1. Open the TIA Portal project that contains the S7-1200 station. Compile the project (Project > Compile > All) so the device configuration is in a consistent state.
2. Open the project tree, right-click the S7-1200 device, and select Online & diagnostics.
3. Select Go online and choose the correct PG/PC interface (PROFINET over the Wi-Fi bridge or a direct cable). Confirm that the online view shows the device.
4. In the Online & diagnostics view, expand Functions and choose Firmware update.
5. Browse to the .upd file. TIA Portal verifies that the file matches the connected CPU's order number; a mismatch is rejected.
6. Click Run update. The CPU accepts the image into the inactive partition first; this takes 30 to 120 seconds depending on the file size (typically 3 to 8 MB).
7. When prompted, confirm that the CPU may restart to switch to the new image. The CPU goes to STOP, re-initializes, runs the new firmware, and (if configured for "Startup after firmware update") returns to RUN.
8. Re-read the module information. The Firmware line must show the new version, e.g. V 2.0.3.
9. Perform a project download to resynchronize the offline/online hardware configuration, as the CPU's identification data has changed.
10. Mark a clear change in the project Change history: firmware upgrade, reason, date, technician. This is required for GxP, ISO 9001, and similar regulated environments.

Alternative: SIMATIC Automation Tool

For sites with many S7-1200 stations, the SIMATIC Automation Tool can be used to perform a firmware update on a network of controllers without opening the project for each one. The tool accepts the same .upd file, requires the same access rights, and performs the same STOP / reprogram / RUN sequence. It is particularly useful for batch updating a fleet that was shipped with the original V2.0 firmware.

SIMATIC NET OPC Configuration Best Practices

Even with the firmware fix applied, the OPC communication path must be configured for resilience. The following items remove other common causes of bad-quality tags after a network event.

Connection S7 Configuration

• Open the SIMATIC NET Station Configurator and verify that the S7 connection to the S7-1200 uses One-way (S7 standard connection) with the S7-1200 as the partner and the SIMATIC NET OPC server as the local endpoint.
• Confirm that the partner IP address in the connection is the S7-1200's PROFINET IP, not the Wi-Fi bridge's DHCP-assigned management IP.
• Set the connection's "Active connection establishment" property to the SIMATIC NET side, and leave the S7-1200 side as passive. This is the default and matches the firmware's expected role.
• Disable any unused "S7 connection diagnostic" blocks in the S7-1200 program that compete for the same passive partner resource; on early firmware only a limited number of passive partners were available.

OPC Group and Subscription Settings

Watchdog and Quality Mapping in WinCC V7

When OPC tags are bound to WinCC internal tags, configure the tag properties as follows:

• Update: cyclic, 1 s.
• Substitute value usage: "On bad quality, last valid value". This prevents WinCC archives from recording 0 values during the brief connection loss.
• Substitute value: process-specific safe state. For motor speeds, 0; for current/voltage, 0; for binary status, 0.

Wi-Fi / Wireless Network Considerations

The Wi-Fi link is a contributor to the symptom, not the cause. The firmware fix removes the failure to recover; the Wi-Fi design must still ensure that link events are short and survivable. Address these factors in parallel with the firmware update.

Industrial Wireless Bridge Settings

• Use a managed industrial access point (e.g. Siemens SCALANCE W series) with RSTP enabled. RSTP reconvergence after a link loss is typically < 5 s; unmanaged bridges can take 30 s or more.
• Configure the Wi-Fi client to aggressive roaming only if the AP layout supports it; otherwise leave on default and rely on seamless handoff at the cell boundary.
• Set the S7-1200's PROFINET interface to a static IP, not DHCP. A DHCP renewal on the Wi-Fi bridge is interpreted by early firmware as a link flap.
• Enable the access point's link layer discovery to the S7-1200's PROFINET port to keep the ARP table warm across reassociations.

Network Topologies to Avoid

• Double NAT between the SCADA network and the S7-1200 PROFINET network. SIMATIC NET OPC requires a direct IP path; the S7 connection timeout is not configurable and will expire on asymmetric NAT.
• Layer-3 firewalls with default-deny rules that silently drop the S7 port 102 traffic on link re-establishment. Add an explicit allow rule for the S7-1200's IP for the full TCP session lifetime, not just the SYN.
• Bridge mode in the access point disabled while the client is associated. This causes the SIMATIC NET client to see an open socket that the S7-1200 has already closed.

OPC UA Migration Path

The S7-1200 firmware line V4.x and later (and the second-generation S7-1200 G2 CPUs) supports OPC UA as a server directly on the controller. OPC UA can be selected instead of the legacy SIMATIC NET OPC / S7 protocol combination. The advantages relevant to this issue are:

• OPC UA sessions use a keep-alive interval that the server (S7-1200) actively manages; loss of the keep-alive is followed by a clean session timeout and re-handshake, without requiring a controller restart.
• OPC UA transport over TCP is independent of the legacy S7 passive partner resource, so the specific bug in V2.0 firmware does not apply.
• Encrypted OPC UA over the wireless link is available, removing the clear-text S7 protocol exposure that PROFINET over Wi-Fi typically creates.

Configuration steps to migrate an existing WinCC V7 station from SIMATIC NET OPC to OPC UA:

1. Activate the OPC UA server in the S7-1200 device configuration under Properties > OPC UA Server. Define a server endpoint, port (default 4840), and a security policy. Start with None for the initial commissioning, then move to Basic128Rsa15 or Basic256Sha256 for production.
2. Mark the data block tags you want to expose by enabling Accessible from OPC UA and configuring the access rights.
3. On the WinCC V7 station, install the SIMATIC NET OPC UA driver (or the WinCC V7 OPC UA channel). Add a new OPC UA channel and configure the discovery URL opc.tcp://<S7-1200 IP>:4840.
4. Import the tags from the S7-1200 OPC UA address space and bind them to the existing WinCC internal tags, keeping the substitute-value behavior from the previous configuration.
5. Remove the SIMATIC NET S7 connection and the SIMATIC NET OPC channel once the OPC UA channel has run for a full production shift with no quality events.

Verification and Testing Procedures

1. Confirm firmware is at V2.0.3 or later in TIA Portal Online & diagnostics > General.
2. Confirm SIMATIC NET OPC server is running and the S7 connection is in "connected" state in the Station Configurator.
3. In the OPC client (WinCC V7 graphics, OPC Scout, or any DA client), verify that all tags show good quality.
4. Force a Wi-Fi link drop. The simplest method is to power-cycle the access point while the S7-1200 is online.
5. Observe the OPC quality for at least 10 minutes. With the firmware fix applied, the OPC tags should briefly show OPC_QUALITY_UNCERTAIN during the link drop, and return to OPC_QUALITY_GOOD within 10 to 30 seconds of the link coming back, without restarting the PLC.
6. Repeat the test 5 times to confirm repeatable recovery. The firmware fix addresses the issue deterministically, but the wireless link design (RSTP, ARP caching, static IP) is what determines the actual recovery time.

Diagnostic and Troubleshooting Matrix

Safety and Operational Notes

• A firmware update is an operational change. Notify operations before starting, and follow site change management (MOC) procedure if applicable.
• After the firmware update, verify the user program, all data block initial values, and the retentive behavior. The first cold start after a firmware update initializes all non-retentive variables to their configured start values. Retentive variables are preserved by the controller, but always confirm with an instrumented test.
• The S7-1200 firmware update is non-reversible through TIA Portal. To roll back, the previous firmware file must be loaded as a service image onto a SIMATIC memory card and the controller must be power-cycled with the card inserted. Plan the upgrade to allow for a 15-minute roll-back window.
• When the wireless link is also used for PROFINET IO (e.g. ET 200SP over Wi-Fi), the firmware update does not change PROFINET IO behavior, but the IO controller / device recovery time after the link drop will dominate the overall recovery. Tune the PROFINET IO watchdog time in TIA Portal accordingly.

Related Documentation

Refer to the following official Siemens documents for the exact configuration of your installation:

• S7-1200 Programmable Controller System Manual (entry ID 109741593 in the Siemens Industry Online Support).
• S7-1200 CPU 1211C / 1212C / 1214C / 1215C / 1217C Operating Instructions, firmware update section.
• SIMATIC NET PC Software S7 OPC Server, configuration manual.
• SIMATIC NET Industrial Communication, installation manual.
• WinCC V7 Communication Manual, OPC channel section.
• Application example "Communication between S7-1200 and WinCC V7" in the Siemens Industry Online Support (entry ID 39960679 as referenced in the source project setup).

FAQ