S7-300 to Rockwell ControlLogix: OPC Integration via SIMATIC NET

Problem Statement: Bridging S7-300 Data into the Rockwell Ecosystem

Plants that mix Siemens SIMATIC S7-300 / S7-200 controllers with Rockwell Automation ControlLogix and FactoryTalk HMI/SCADA frequently need to expose Siemens-side process data to the Rockwell side. Procurement constraints often forbid third-party middleware (Kepware, Matrikon, Ignition, etc.) and limit the integrator to OEM products only. The supported, license-clean path between the two ecosystems is the OPC Data Access (DA) bridge pattern:

• SIMATIC NET acts as the OPC DA Server on the Siemens side, exposing S7-300 / S7-200 tags to any COM/DCOM OPC client.
• RSLinx Classic / RSLinx Enterprise act as the OPC DA Server on the Rockwell side, exposing ControlLogix tags.
• An OPC DA client — hosted inside FactoryTalk, inside a ControlLogix program via CIP messaging, or in an in-house VB/C#/.NET script — reads tags from SIMATIC NET and writes them to RSLinx (and optionally to a Microsoft SQL Server database via ODBC/ADO).

This article documents the architecture, the catalog numbers, the version matrix, the configuration steps, and the verification procedure for the full bridge. It targets a typical installation of 30 S7-300 controllers plus a smaller number of S7-200 controllers feeding one ControlLogix L63 (1756-L63) chassis with FactoryTalk View SE HMI and SQL Server logging.

Architecture Options Without Third-Party Middleware

Three bridge topologies are available using only Siemens and Rockwell software. Choose based on data volume, latency budget, and the need for SQL archival.

Topology A — FactoryTalk as OPC Client (Recommended)

FactoryTalk View SE / FactoryTalk Live Data subscribes to SIMATIC NET OPC tags and re-publishes them as RSLinx Enterprise tags. The ControlLogix L63 polls those tags via CIP. The same FactoryTalk runtime can also write the values to SQL Server using the built-in Data Log model and ODBC.

Topology B — ControlLogix Explicit Message to OPC Tag

A ControlLogix L63 (with a 1756-EN2T or 1756-ENBT module) cannot natively speak S7Comm. Instead, the L63 uses a CIP Generic MSG instruction to read a value from RSLinx Enterprise, which in turn is being written by a small in-house VB/C# OPC client that subscribes to SIMATIC NET.

Topology C — Custom .NET OPC Client Service

A Windows service built on the OPC .NET API (System.Management or OPC Foundation .NET wrapper) polls SIMATIC NET every 100–1000 ms and writes values directly to RSLinx Classic OPC tags and to SQL Server using ADO.NET. This is the lowest-latency, highest-throughput option, but it requires custom code that the customer must own and maintain.

Hardware Prerequisites on the Siemens Side

Each S7-300 needs an Industrial Ethernet interface to expose its DBs to SIMATIC NET. Confirm catalog numbers against current Siemens Industry Online Support availability.

Software Prerequisites and Version Matrix

Match SIMATIC NET and RSLinx versions to the Windows host OS and to each other. The following combinations are field-validated; other combinations may work but have not been bench-tested for this article.

SIMATIC NET Installation and OPC Server Configuration

SIMATIC NET installs as a Windows service and exposes an OPC DA 2.05a / 3.0 server named OPC.SimaticNET. The configuration tool is SIMATIC NET Configuration Console (also called Station Configuration Editor).

Step 1 — Install SIMATIC NET and assign the PC station name

1. Insert the SIMATIC NET DVD or mount the ISO. Run Setup.exe as Administrator.
2. Select Install > SIMATIC NET PC Software > OPC Server > S7 Protocol Suite. Do not deselect Station Configuration Editor.
3. After installation, open Station Configuration Editor. Right-click Index 1 and set the PC station name to match the Windows hostname (this name is referenced by STEP 7 when downloading an XDB/PCD file from the engineering station).

Step 2 — Add the S7-300 / S7-200 connections

1. Right-click Index 1 > Add > S7 Connection. Repeat for each of the 30+ PLCs.
2. For each connection, set:
   • Partner IP address: the CP 343-1 or CP 243-1 address on the plant network
   • Partner rack / slot: 0 / 2 (default for an S7-300) or 0 / 0 (S7-200 with CP 243-1)
   • Connection resource: OP / PG connection (use OP; PG is reserved for engineering)
   • Active / passive: Active on the PC side; the S7-300 must permit PUT/GET (see Section 6)
3. For 30 S7-300s, this is 30 S7 connection objects inside the single PC station. SIMATIC NET will consume one license counter per active connection.

Step 3 — Validate the OPC server is reachable

Run the OPC Scout V10 (Start > SIMATIC NET > OPC Scout). Add a new group, browse to OPC.SimaticNET > S7 > [Connection name] > DB1 > DBW0, and verify the value updates. If the value shows OPC_QUALITY_BAD, the S7 connection is not established — typically because the CP on the S7-300 side is in stopped state or the S7-300 has not enabled PUT/GET access.

S7-300 and S7-200 PLC Configuration for OPC Access

SIMATIC NET reads S7-300 data using S7Comm (ISO-on-TCP, port 102). Two conditions must be true on the PLC side:

S7-300 with STEP 7 V5.x (SIMATIC Manager)

1. In HW Config, open the CP 343-1 properties > Options. Ensure Enable OP/PG communication is checked.
2. In NetPro, right-click the CP > Insert New Connection > S7 Connection > partner = unspecified. Activate the connection on the CP. This reserves one S7 connection resource on the CP for the OPC client.
3. In the CPU properties > Protection: set Access Level to Full (no password) or define a password and enter it into the SIMATIC NET S7 connection object on the PC side.
4. Important: Permit access with PUT/GET communication from remote partner must be checked under CPU properties > Protection (this is on by default in older firmware but is off by default in firmware V3.x and later for some CPU variants). Without this flag, OPC Scout will return 0x80B1 "Object access not permitted".

S7-300 with TIA Portal (CPU 31x-2 PN/DP)

1. Project tree > CPU > Properties > Protection & Security > Connection mechanisms > enable Permit access with PUT/GET from remote partner.
2. Device configuration > PROFINET interface > Web server access can stay disabled; OPC does not need it.
3. Compile and download the hardware configuration.

S7-200 with STEP 7 Micro/WIN

1. Open the Ethernet Wizard. Configure a S7 connection with the SIMATIC NET PC station as the partner, TSAP 01.01.
2. Place a NET_EXE subroutine in the OB1 scan to keep the connection alive. The S7-200 will not auto-handshake S7 connections without periodic execution.
3. Confirm the CP243 error word in V-memory does not return 0x0001 (no partner) or 0x0002 (TSAP mismatch).

Configuring the OPC DA Bridge to RSLinx / FactoryTalk

Bridge using FactoryTalk (Topology A)

1. Open FactoryTalk Administration Console. Create a new area, e.g. PlantA_S7.
2. Add a Communication shortcut. Select OPC DA Server. Set the Server ProgID to OPC.SimaticNET, Computer to the SIMATIC NET host, and browse to the desired DB tag.
3. In the FactoryTalk HMI tag database, create a Pass-through tag that points to the OPC tag imported in step 2. Mark it Read/Write.
4. From the FactoryTalk View SE HMI, drag the tag onto a graphic display to confirm updates. The minimum recommended update rate is 250 ms; faster than 100 ms wastes CPU on the SIMATIC NET host with 30+ connections.

Bridge using a small .NET service (Topology C — lowest latency)

For installations where the customer forbids FactoryTalk and wants a self-contained service, a small .NET console or Windows Service can be deployed on the RSLinx host. The skeleton below uses the OPC Foundation .NET Standard library and System.Data.SqlClient:

// S7ToRockwellBridge.cs — top-of-loop example, not production code
using Opc.Ua;
using Opc.Ua.Client;
using System.Data.SqlClient;

var siemensEndpoint = "opc.tcp://simatic-host:48010";  // SIMATIC NET OPC UA wrapper
var session = await Session.Create(..., siemensEndpoint, ...);

while (true)
{
    foreach (var tag in new[] { "DB1.DBW0", "DB1.DBW2", "DB10.DBD4" })
    {
        var value = (float)session.ReadValue("ns=2;s=" + tag).Value;

        // 1) Write into RSLinx Classic OPC tag
        rsLinxOpc.Write(tag, value);

        // 2) Append to SQL Server
        using var cn = new SqlConnection("Server=sqlhost;Database=plantA;Integrated Security=SSPI;");
        cn.Open();
        using var cmd = new SqlCommand("INSERT INTO S7_TagLog (Tag, Value, TS) VALUES (@t,@v,GETUTCDATE())", cn);
        cmd.Parameters.AddWithValue("@t", tag);
        cmd.Parameters.AddWithValue("@v", value);
        cmd.ExecuteNonQuery();
    }
    await Task.Delay(500);
}

Pushing Data into ControlLogix L63 via OPC

The ControlLogix L63 (1756-L63) does not speak S7. To read S7 values into the L63, you must write them into the RSLinx Enterprise tag database first, then have the L63 read them with a CIP message. Two methods are supported.

Method 1 — RSLinx Enterprise as the OPC bridge to ControlLogix

1. In RSLinx Enterprise, configure an OPC topic that points to OPC.SimaticNET. Subscribe at 250 ms.
2. Create matching controller-scoped tags in Studio 5000: S7_TankLevel_REAL, S7_Pump1Running_BOOL, etc.
3. Map each FactoryTalk / RSLinx Enterprise tag to a controller tag through the Logic Designer > Tag Mapping function. The mapping uses CIP to push values into the L63 input image.

Method 2 — CIP Generic MSG from ladder / structured text

For lower-latency access, use a MSG instruction with service code 0x00CA (CIP Read Tag) addressed to the RSLinx OPC topic alias:

// Structured Text — read a single REAL tag from RSLinx
// 1756-L63 in slot 3, 1756-EN2T in slot 1, path = 1,3
MSG_ReadS7(  
    MessageType := Message_Type.CIP_Generic,
    CIP_Service_Code := 16#00CA,           // CIP Read Tag
    Request_Assembly_Length := 0,
    Source_Element := ???,                 // not used on read
    Destination_Element := S7_TankLevel_REAL,
    Path := 'EN2T,3,2',                    // 1756-EN2T backplane slot 3, then RSLinx slot 2
    Communication_Timeout := 2.0
);

Poll the MSG every 250 ms using a periodic task. CIP read latency from a 1756-EN2T to a local RSLinx OPC topic is typically 20–40 ms, so the end-to-end S7-to-ControlLogix latency lands near 350 ms — well within SCADA refresh requirements.

SQL Database Storage with FactoryTalk and ODBC

Two SQL paths are available without third-party software.

Path 1 — FactoryTalk View SE Data Log

1. Create a 32-bit or 64-bit ODBC System DSN pointing to the SQL Server instance. Use the ODBC Data Source Administrator launched from Administrative Tools.
2. On the FactoryTalk View SE Server, open Data Log Models. Create a model that points to the DSN, with a table named FT_VW_S7_Log and columns TagName NVARCHAR(128), Value REAL, Timestamp DATETIME2.
3. Add the desired S7 tags to the data log model with a 1 s trigger and on-change storage. The on-change dead-band prevents the database from filling with duplicate values.

Path 2 — FactoryTalk Historian

FactoryTalk Historian (formerly RSSql) stores data in a highly compressed, time-series-optimized format on top of SQL Server. Configure a Module in FactoryTalk Administrator that subscribes to the OPC.SimaticNET DA server, with a 100 ms poll and a 0.5% dead-band on analog tags. Historian exposes a SQL view that can be queried from SSRS, Power BI, or a custom dashboard.

Verification, Diagnostics, and Performance Tuning

Commission the bridge in the following order, validating each tier before moving to the next.

1. Layer 1 — S7 connectivity. From the SIMATIC NET host, ping every CP 343-1 address. Open OPC Scout V10 and confirm every S7 connection shows Quality = Good on DB1.DBW0.
2. Layer 2 — SIMATIC NET OPC service. Run OPC Scout V10 as a remote client from a second PC. Confirm COM/DCOM security allows the read. This isolates COM security issues from OPC tag configuration issues.
3. Layer 3 — OPC client bridge. In FactoryTalk Administration Console, force a refresh on the OPC.SimaticNET shortcut. Confirm every tag is Good.
4. Layer 4 — RSLinx / ControlLogix. In Studio 5000, open Tag Mapping. Observe the Last Update timestamp on the S7 tags. Use a trend chart in FactoryTalk View to display the S7_TankLevel_REAL tag and watch the curve move when you change the value in the S7-300 with STEP 7 variable monitor.
5. Layer 5 — SQL. Run SELECT TOP 100 * FROM dbo.FT_VW_S7_Log ORDER BY Timestamp DESC in SSMS. Confirm rows are being appended with the expected sample rate.

Performance baseline

Troubleshooting Matrix

Field-Commissioning Checklist

• All 30+ S7-300 CPs are reachable via ping -t for at least 5 minutes with zero loss.
• PUT/GET is enabled on every S7-300 CPU (verify with a per-PLC test in OPC Scout).
• SOFTNET-S7 license counter is greater than the number of active S7 connections (open Station Configuration Editor and inspect the watermark).
• RSLinx Classic is started as a Windows service, not a user application, on a Server-class host.
• DCOM is configured identically on the SIMATIC NET and RSLinx hosts (use the SIMATIC NET DCOM Configuration tool plus the RSLinx DCOM Configuration utility).
• FactoryTalk View SE Server is the OPC client, not the FactoryTalk View SE Client. The client cannot host the bridge.
• SQL Server is configured with a dedicated FT_Historian database in the Simple recovery model, with a 7-day full backup job and a daily log-shipping target.
• A network tap or Wireshark capture is performed once per shift for the first week, to confirm the S7-200 / S7-300 / SIMATIC NET / RSLinx / ControlLogix packet flows are correct.