S7-1500 OPC UA Server: Resolving ECONNREFUSED Errors

Problem Overview: OPC UA Connection Refused on S7-1500

An OPC UA client (in this case, Node-RED running on a SIMATIC IoT2020) attempts to open a session to an S7-1500 OPC UA server and receives:

The error string ECONNREFUSED is a standard POSIX/Winsock socket status returned by the underlying TCP transport when no application is listening on the target IP/port combination, or when a host firewall drops the SYN. In the OPC UA stack, the client maps this to Bad_CommunicationError or BadConnectionClosed before the secure channel is even established. Unlike certificate trust errors (which surface as BadCertificateUntrusted), ECONNREFUSED means the TCP three-way handshake never completed against a listening server endpoint.

For a SIMATIC S7-1500, this is almost always caused by one of the following conditions:

1. The OPC UA server is not enabled in the PLC's security configuration.
2. The required OPC UA runtime license is missing (firmware V2.6 and later require a separate runtime license on many CPU variants).
3. The IP address of the PLC or client is on a different subnet and no default gateway routes between them.
4. A Windows firewall or PLC-side security policy blocks inbound TCP/4840.
5. The PLC's project is not compiled and downloaded, or the device configuration is in a STOP / inconsistent state.

Affected Hardware, Firmware, and Software Versions

Always confirm against the specific CPU's product manual and the corresponding TIA Portal release notes, since the OPC UA feature set and license model have been revised multiple times.

Reference Architecture

The deployment described uses three logical layers:

• OPC UA Server: SIMATIC S7-1500 (192.168.178.100) running the built-in OPC UA server interface.
• OPC UA Client: Node-RED running on a SIMATIC IoT2020 (192.168.178.29) using node-red-contrib-opcua.
• Diagnostic Client: UaExpert running on an engineering station, used to verify server reachability independent of the IoT2020.

All three devices must share a routable L2/L3 path. The Node-RED flows for this application are intentionally minimal: a single opcua-Client node is configured with the endpoint URL opc.tcp://192.168.178.100:4840 and pointed at a data block using its NodeId, e.g. ns=3;s="DB_HMI"."HMI_Tag".

Root Cause Analysis: Why ECONNREFUSED Occurs

Working from the lowest layer up:

Layer 1 — Physical / Data Link

Verify link LEDs on the PLC PROFINET port and the IoT2020 Ethernet port. A green link LED on both devices eliminates a cabling or switchport issue. If the IoT2020 is connected through a managed switch, confirm the port is enabled and not in a disabled VLAN.

Layer 2/3 — IPv4 Routing

From the IoT2020 shell, run ping 192.168.178.100. A successful ICMP echo reply confirms ARP resolution and routing. A "Destination Host Unreachable" reply indicates either a local subnet mismatch or a missing default gateway. From Windows, run Test-NetConnection 192.168.178.100 -Port 4840 to verify the TCP port is open — this test isolates port reachability from full OPC UA session negotiation.

Layer 4 — TCP Listener

If ICMP succeeds but TCP/4840 returns ECONNREFUSED, the most likely causes are:

• OPC UA server not enabled in TIA Portal under Device configuration → Properties → OPC UA → Server.
• Missing OPC UA license on the CPU — older CPU variants include OPC UA in the basic firmware, but newer firmware versions (V2.6+) require the optional "OPC UA Server" runtime license activated in the PLC's Web server / License management page.
• PLC in STOP — the OPC UA server only accepts connections when the CPU is in RUN.

Layer 7 — OPC UA Security / Trust

If the server is reachable at the TCP level but the session terminates with a BadCertificateUntrusted error, the issue is a certificate trust problem — not an ECONNREFUSED error. Distinguishing the two is critical: a trust problem requires accepting the client certificate on the PLC, while a connection refusal requires server activation or a firewall fix.

Step-by-Step Resolution Procedure

Step 1 — Confirm Server Is Listening on Port 4840

From the engineering station, run a TCP probe to confirm the server is bound to the expected endpoint:

A TcpTestSucceeded : True response confirms the server is alive. A False response, or a Linux telnet 192.168.178.100 4840 returning Connection refused, confirms the server is not listening.

Step 2 — Activate the OPC UA Server in TIA Portal

1. Open the TIA Portal project containing the S7-1500 station.
2. Select the CPU in the project tree and open Properties.
3. Navigate to OPC UA → Server.
4. Check Activate OPC UA server.
5. Set the desired port (default 4840).
6. Configure security policies. For commissioning, select None and Sign & Encrypt / Sign as needed, or start with None to isolate the problem.
7. Compile (hardware rebuild) and download to the PLC.
8. Cycle the CPU to RUN if it was in STOP.

Refer to the Siemens SIMATIC S7-1500 OPC UA Server Function Manual for CPU-specific details, and to the TIA Portal help under "Configuring the OPC UA server" for the full property set.

Step 3 — Verify the OPC UA License

On firmware V2.6 and later, confirm the license is present:

1. Open the PLC's Web server (http://192.168.178.100) and log in as administrator.
2. Navigate to License management.
3. Verify that the OPC UA Server license entry is present and active.

If the license is missing, the CPU may still bring up the server socket in some firmware versions, but it will refuse client sessions immediately. Older CPU variants (e.g., CPU 1511/1513 with firmware V1.x) included the OPC UA server without a separate license — verify against the specific CPU's manual.

Step 4 — Validate with UaExpert

Before changing the Node-RED flow, validate the server with the official OPC Foundation test client:

1. Install UaExpert from the OPC Foundation download page.
2. Add a new server connection: opc.tcp://192.168.178.100:4840.
3. Select the endpoint matching the security policy you configured in TIA Portal.
4. Click Connect.

If UaExpert connects and browses the address space, the server is healthy. If it fails with a trust error, accept the certificate in UaExpert's Certificate Manager and reconnect. This isolates whether the problem is server-side or client-side.

Step 5 — Configure Node-RED OPC UA Client

The IoT2020 (Debian) uses node-red-contrib-opcua. Configure the client endpoint:

For a minimal commissioning flow that exercises a single DB tag:

[
  {
    "id": "opcuaClient1",
    "type": "opcua-Client",
    "z": "flow1",
    "endpoint": "opc.tcp://192.168.178.100:4840",
    "securityPolicy": "None",
    "securityMode": "None",
    "name": "",
    "x": 320,
    "y": 180,
    "wires": [[]]
  }
]

Use the Action set to Subscribe or Read with the NodeId ns=3;s="DB_HMI"."HMI_Tag" for the initial test. The namespace 3 is the standard for S7-1500 data blocks. Always confirm by browsing the address space in UaExpert first.

Step 6 — Manage Client Certificates

Once a non-None security policy is enabled, the PLC will reject the Node-RED client until its certificate is trusted. There are two paths:

• Trust the client in TIA Portal: Under Device configuration → Properties → OPC UA → Security → Trusted clients, add the IoT2020 client certificate, then download the project to the PLC.
• Use "Automatically accept client certificates" for testing only. Disable in production.

The PLC's OPC UA server → Security → Certificate store page in the Web server allows you to inspect and remove untrusted client certificates.

Verification Checklist

Fault Code and Error Reference

Troubleshooting Matrix

Common Pitfalls and Field-Validated Caveats

Alternate Platforms and Controllers

The same diagnostic logic applies to other Siemens controllers that ship an OPC UA server. Differences in the configuration tree are minor:

• S7-1200 (firmware V4.4 and later): OPC UA server is opt-in under Device configuration → OPC UA. License handling is identical.
• ET 200SP CPU: Same as S7-1500; the OPC UA server is in Properties → OPC UA → Server.
• SIMATIC S7-1500 Software Controller (WinAC RTX / S7-1507S): Requires the OPC UA server feature to be activated in the same TIA Portal project tree path.

For non-Siemens controllers, consult the vendor's OPC UA server documentation for the specific activation steps; the underlying TCP/4840 reachability checks remain identical.

FAQ