S7-300 CPU 315-2DP OPC Server: Symbol Setup and C++ Client Guide

S7-300 CPU 315-2DP OPC Server: STEP 7 Symbol Configuration and C++ Client Integration

This technical reference covers the complete engineering path for exposing Siemens S7-300 CPU 315-2DP data to a supervisory application through the SIMATIC NET OPC DA server using a CP5611 PROFIBUS interface, and then consuming that data from a native C++ application. The guide resolves the most common dead-end encountered in the field: OPC Scout returning an empty symbol namespace even though the PLC and PC station are physically online.

1. System Architecture

The S7-300 OPC solution is a three-layer stack: the PLC as data source, the SIMATIC NET PC station as a protocol/DA bridge, and the C++ application as a COM-based DA consumer.

Three components must be coherent for OPC Scout to populate the namespace:

1. The STEP 7 project must contain a SIMATIC PC Station with an OPC server application configured to the S7 channel of the CP5611.
2. The PC Station's S7 connection target must reference the actual CPU 315-2DP and that connection must compile and download without diagnostics errors.
3. The symbol table (S7 program symbols) must be non-empty and compiled, with the OPC server's Use Symbols option set to All.

2. Hardware Prerequisites

3. Software Prerequisites

For OPC UA development, the C++ SDK landscape includes commercial toolkits from Softing Industrial and Unified Automation, both certified by the OPC Foundation. Microsoft's reference OPC PLC server sample demonstrates a generic UA server using the .NET stack and is useful for UA discovery behavior testing.

4. STEP 7 Project Integration

The OPC server cannot read symbols from an isolated PLC project. The STEP 7 project and the PC station must live in a single, integrated project tree. Failure to do so is the dominant root cause of an empty symbol namespace in OPC Scout.

4.1 Project Layout

1. Open SIMATIC Manager and create a new project (e.g. S7_315_OPC_Project).
2. Insert SIMATIC 300 Station; assign the CPU 315-2DP and any DI/DO/AI modules.
3. Insert SIMATIC PC Station on the same project level. The PC station hosts the OPC server.
4. Configure the PC station's hardware: drag OPC Server from the catalog to slot 1 and the CP5611 (or CP5611 A2) to an appropriate index (typically Index 1 for the first card).
5. Double-click the OPC server slot and add an S7-Protocol connection named (e.g.) S7_OPC_Connection. The partner is the CPU 315-2DP's MPI/DP interface; specify the PROFIBUS address (default 2).

4.2 NETPRO Configuration

Open NETPRO by double-clicking the PC station or selecting Configure Network. The connection S7_OPC_Connection must show:

Compile the network (Network → Save and Compile) and download the PC station to the local PC. The OPC server wizard will then write its configuration under Program Files\Siemens\Automation\SIMATIC_NET\opc2\bin\S7wnAccess.xml (or the equivalent path in the installed SIMATIC NET version).

5. Configuring SIMATIC NET OPC Server

5.1 Configuration Console Binding

1. Launch Configuration Console (Start → SIMATIC → SIMATIC NET → Configuration Console).
2. Navigate to SIMATIC NET → [your PC station] → OPC Server → S7-Protocol → [connection name].
3. Confirm the Operating Mode is set to Configured mode (not PG mode). PG mode is non-persistent and intended for programming tools only.
4. Right-click → Properties. The PROFIBUS address and baud rate must match the CPU. Default is 1.5 Mbps.

5.2 Use Symbols Option

Right-click the S7-Protocol node in Configuration Console and select Properties → Symbols:

• Use Symbols: All — exposes every S7 program symbol to OPC clients. Requires an integrated STEP 7 project.
• Use Symbols: Selected — exposes only the symbols explicitly assigned to the connection.
• Use Symbols: None — the OPC namespace is built only from raw data block addresses. OPC Scout will then only show DB1, DB2, ... branches with no leaf items.

6. STEP 7 Symbol Table Setup

Symbols are the human-readable names that the OPC server maps to absolute addresses. A typical tag like Motor_Speed in the symbol table resolves to DB1.DBD2 internally, and OPC Scout displays it as \S7:\SYM\Motor_Speed.

After every edit, choose Symbol → Save and then Symbol → Compile. A compiled symbol table writes the offsets to the S7 program. If the table is unsaved or contains duplicate symbols, the compile fails and OPC Scout will not see the new tags even though the S7 program is in RUN.

7. OPC Scout Item Creation

OPC Scout V10 is the supplied DA test client. The namespace browser presents a tree under \<LocalServerName>. For the bundled SIMATIC NET server the root is \S7 (or \<LocalSERVER> in older SIMATIC NET releases). Branches include:

• \S7\<LocalServerName>\objects\DB\DB1 — raw DB access by absolute byte address.
• \S7\<LocalServerName>\SYM — symbol-based access; populated only if the OPC server has the symbol option set and a compiled STEP 7 symbol table is present.
• \S7\<LocalServerName>\M — bit memory (Merker).
• \S7\<LocalServerName>\PE / PA — process image inputs / outputs.
• \S7\<LocalServerName>\T / Z — timers / counters.

7.1 Manual Item Definition (Address-based)

When the symbol branch is empty, items must be created manually. From OPC Scout:

1. Select Server → Connect; pick the local SIMATIC NET S7 server.
2. Navigate to \S7\<LocalServerName>\objects\DB\DB1.
3. Right-click DB1 → Define New Item → Leaf.
4. Enter the absolute address, datatype, and access rights:

The address syntax is DB<n>,<Datatype><ByteAddress>.<BitAddress>. For example, a REAL located at byte 2 of DB1 (the Motor_Speed tag above) is entered as DB1,REAL2.0. The trailing .0 indicates bit 0 of the starting byte; the server internally reads four consecutive bytes (REAL = 32 bits).

7.2 Quality and Value Verification

After defining items, OPC Scout's main grid shows:

• Value — current raw value from the PLC.
• Quality — OPC DA quality code (192 = Good, 0 = Bad).
• Timestamp — server-side time of the read.
• Error — HRESULT if the read fails (e.g. 0x80000000 for unknown item, 0xC0040007 for address out of range).

Confirm Quality = Good for at least one read cycle before writing any C++ code. Persistent Bad quality almost always indicates a Configuration Console mismatch (PG mode, wrong PROFIBUS address, or S7 connection not downloaded).

8. C++ OPC DA Client Development

The native OPC DA client is a COM automation client. The C++ side must implement the IDispatch pattern or use a wrapper that does.

8.1 Recommended Toolkit Choices

8.2 Minimal DA Client (MFC/ATL Pattern)

The pseudocode below uses the OPC DA Automation 2.0 wrapper generated from opcdaauto.dll:

// opcda_min_client.cpp -- S7-300 OPC DA client skeleton (ATL style)
#import "progid:OpcRcw.Da.Server.2" \
        rename_namespace("OpcDa") rename("Value", "ItemValue")

#include <atlcom.h>

int main()
{
    CoInitializeEx(NULL, COINIT_MULTITHREADED);
    try {
        OpcDa::IOPCServerPtr pSrv("OPC.SimaticNet.S7");   // ProgID from OPC Scout
        if (pSrv == nullptr) { printf("Server not registered\n"); return 1; }

        // Add the S7 connection (the one defined in Configuration Console)
        OpcDa::IOPCGroupsPtr pGroups = pSrv->OPCGroups;
        pGroups->DefaultGroupIsActive = VARIANT_TRUE;
        OpcDa::IOPCGroupPtr pGrp = pGroups->Add(VARIANT("S7ReadGroup"));
        pGrp->IsActive   = VARIANT_TRUE;
        pGrp->UpdateRate  = 250;            // ms
        pGrp->DeadBand    = 0.0;            // disable deadband for monitoring

        // Define items -- addresses match section 7.1
        OpcDa::IOPCItemsPtr pItems = pGrp->OPCItems;
        OpcDa::OPCITEMDEF items[2];
        items[0].szItemID   = L"DB1,REAL2.0";       // Motor_Speed
        items[0].bActive    = VARIANT_TRUE;
        items[0].hClient    = 1;
        items[1].szItemID   = L"DB1,INT10.0";       // Alarm_Code
        items[1].bActive    = VARIANT_TRUE;
        items[1].hClient    = 2;
        pItems->AddItems(2, items, nullptr);

        // Poll loop
        for (int i = 0; i < 20; ++i) {
            HRESULT hr = pGrp->SyncRead(OPC_DS_DEVICE, 2, NULL, &v);
            // inspect vtData array: [0].fltVal = Motor_Speed, [1].iVal = Alarm_Code
            Sleep(250);
        }
        pGrp->Release();
    } catch (_com_error& e) {
        printf("COM error: %s\n", (LPCSTR)e.Description());
    }
    CoUninitialize();
    return 0;
}

8.3 Switching to OPC UA

If a S7-300 UA gateway (e.g. SIMATIC IE/PB Link PN IO with UA server enabled, or a third-party broker) sits between the PLC and the application, the C++ side becomes a UA client. The implementation pattern then uses UA_Client from the OPC Foundation / Unified Automation UA stack or the Softing UA C++ SDK, and reads ns=4;s=|var|S7-300/CP5611/DB1,REAL2.0 style NodeIds. The DA ItemID conventions above do not carry over to UA without translation.

9. Verification Procedure

1. Run Configuration Console; confirm the OPC server mode is Configured and the S7 connection status is Established.
2. Launch OPC Scout V10; connect to the local S7 server.
3. Expand \S7\<LocalServerName>\SYM. Verify all symbols from section 6 are visible.
4. Manually create a single DB1,REAL2.0 item; confirm Quality = Good.
5. Force a value change in STEP 7 (e.g. L 1234.5; T DB1.DBD 2 in OB1) and confirm the new value appears in OPC Scout within one UpdateRate.
6. Run the C++ client; confirm it logs the same values and updates at the configured poll rate.
7. From the C++ client, write a value to a test tag (e.g. DB1,REAL6.0). Verify the S7 program sees the new value via a VAT or a watch table.

10. Troubleshooting Matrix

11. OPC DA vs OPC UA on the S7-300 Path

For greenfield installations, prefer the OPC UA path with an IE/PB Link PN IO configured as a UA server. For brownfield, the SIMATIC NET DA path covered here remains the most reliable and best-documented approach through STEP 7 V5.x.

12. Field-Proven Best Practices

• Keep an integrated project. The single most common OPC Scout failure is a PC station built standalone. Always drop the SIMATIC PC Station into the same STEP 7 project as the S7-300.
• One S7 connection per CPU. Multiple OPC groups can share one S7 connection; do not create a second connection for a polling rate difference — set the group UpdateRate instead.
• Use symbolic ItemIDs in production C++ clients. They survive DB renumbering and are easier to map in source code.
• Mind the DCOM firewall. For remote OPC clients, the SIMATIC NET PC must allow the OPCEnum and DA Server through Windows Firewall with proper DCOM launch and access permissions.
• Watch the UpdateRate. Setting it to 0 (on demand) reduces CPU load but may surface latency in statistical monitoring; 100–500 ms is the typical range for HMI/SCADA consumers.
• Validate with OPC Scout before any custom code. The Scout tool is the fastest way to isolate PLC/protocol issues from application issues.
• Match CP5611 driver to SIMATIC NET version. A CP5611 with V13 firmware and V15 SIMATIC NET will not enumerate until the firmware is updated through the Set PC Station wizard.