S7 Plus Protocol Subscription Limits on S7-1500 and S7-1200 CPUs

1. Overview of the S7 Plus Communication Protocol

The S7 Plus protocol is Siemens' modern Ethernet-based communication protocol used between S7-1200/S7-1500 CPUs and clients such as WinCC Professional, WinCC Unified, TIA Portal, OpenController-based HMI panels, and various SCADA drivers. It is a successor/supplement to the legacy S7comm protocol carried over ISO-on-TCP (RFC 1006) on TCP port 102, and it is the protocol negotiated by WinCC when it is configured to talk to an S7-1500 in "S7 Plus" mode.

Unlike the classic S7comm "polling" model, S7 Plus uses a subscription (publish/subscribe) model. The client registers interest in a set of tags, the CPU monitors those tags internally, and the CPU pushes updates to the client either on a value change or at a configured publishing interval. This drastically reduces the number of request/response frames on the wire when compared to one-poll-per-tag polling, but it introduces a new resource: the subscription.

Every active subscription consumes one entry in a CPU-internal subscription table. The size of that table is firmware- and CPU-specific and is the principal limit that an engineer designing a 10,000+ tag HMI/SCADA architecture must respect.

2. Subscription Architecture and Resource Model

The S7 Plus subscription model works as follows:

1. The client opens a TCP connection to the CPU on port 102 and negotiates the S7 Plus session.
2. The client sends a subscription request that references a set of items (tags) and a publishing interval.
3. The CPU accepts (or rejects) the subscription, depending on available resources and the negotiated maximum.
4. The CPU publishes a data block whenever any subscribed item changes or the publishing interval elapses, whichever comes first.
5. The client may add, remove, or modify items without tearing down the subscription.

Key resource rules documented in TIA Portal help and in the Siemens support article 98699910:

• Each subscription has a single sampling interval and a single publishing interval.
• Subscriptions with identical sampling/publishing intervals are typically grouped into one combined subscription on the CPU side.
• The maximum number of concurrent subscriptions is a CPU-internal limit, not a connection limit.
• When the limit is reached, the CPU rejects additional subscriptions; WinCC then falls back to legacy polling for the overflow tags, which reduces performance.

3. Documented Subscription Limits by CPU Model

The following values are taken from the official Siemens support entry 98699910 and from the technical data of the listed CPUs. Always cross-check the value against the technical specifications of the firmware version you have actually installed, because limits have historically increased between firmware releases.

For the S7-1518 specifically (the CPU used in the original question), the subscription limit is the highest in the S7-1500 portfolio. The S7-1518T motion-control variant has the same class of limit. Refer to the CPU's technical specifications entry 98699910 for the exact number on the firmware you deploy.

4. Frame Size Constraints and Packet Optimization

The S7 Plus payload is carried inside a TCP segment whose practical maximum is around 1,400 bytes per packet. This is the standard Ethernet MTU (1,500) minus the TCP, IP, and S7 Plus transport overhead. Implications for tag design:

• A single subscription can carry multiple items, but the combined serialized size of those items must not exceed ~1,400 bytes per publishing cycle.
• Items smaller than 4 bytes are still rounded to the next 4-byte boundary on the wire; pad your UDTs accordingly.
• If a subscription grows past ~1,400 bytes, the CPU will fragment the data across multiple packets, which the client must reassemble. Avoid this by grouping tags into multiple subscriptions with the same publishing interval rather than one mega-subscription.

Practical rule of thumb for sizing:

For a mixed tag set averaging 8 bytes per item (typical for BOOL+INT+REAL+TIMESTAMP), this yields roughly 150–170 items per subscription. With the S7-1518's available subscription count, this allows well over 10,000 monitored items.

5. UDT Bundling Strategy

The single most effective technique for fitting 10,000+ items onto a single CPU is to define UDTs in TIA Portal and subscribe to the UDT instance, not to each member. A UDT instance is one subscription regardless of how many members it contains.

Example UDT in TIA Portal's "PLC data types" editor:

TYPE "UDT_Motor_Data"
VERSION : 1.0
  STRUCT
    Speed_rpm       : Real;     // 4 bytes
    Current_A       : Real;     // 4 bytes
    Voltage_V       : Real;     // 4 bytes
    Temperature_C   : Real;     // 4 bytes
    Status          : Word;     // 2 bytes (+ 2 padding)
    ErrorCode       : Word;     // 2 bytes (+ 2 padding)
    RunHours        : DInt;     // 4 bytes
    AlarmBits       : Byte;     // 1 byte (+ 3 padding)
  END_STRUCT;
END_TYPE

A DB of type UDT_Motor_Data transfers 32 bytes of payload but counts as one subscription. Subscribing to its eight individual members would consume eight subscriptions for the same data, an 8× overhead. For a 500-motor plant, this turns 4,000 subscriptions into 500.

Other bundling best practices:

• Define UDTs aligned to natural word boundaries to avoid padding waste.
• Group by update rate: drive status at 100 ms, energy counters at 1 s, statistics at 10 s. Each group becomes one subscription.
• Use array DBs of UDTs for repetitive assets so the client can subscribe to the entire array and slice on its side.
• Mark UDT members with {S7_m_c := 'true'} only if you actually need HMI visibility on the member; do not blanket-mark.

6. OPC UA Server Subscription Rules

When the S7-1200/S7-1500/S7-1500T OPC UA server is the data source, the rules documented in TIA Portal apply (see Rules for subscriptions (S7-1200, S7-1500, S7-1500T)):

1. Group subscriptions in the client by sampling interval and publishing interval; never mix intervals inside one subscription.
2. Match the sampling interval to the actual update rate of the underlying process. A 10 ms sampling interval on a tag that changes every 30 s wastes CPU cycles.
3. The publishing interval should be an integer multiple of the sampling interval.
4. Avoid creating parallel subscriptions on the same tag with different intervals. Use one subscription at the fastest required rate and let the client discard unneeded updates.
5. Keep monitored items in one subscription below the ~1,400 byte payload limit to avoid fragmentation.

OPC UA exposes the configured maxima through the server's ServerCapabilities node: ServerCapabilities.ServerProfileArray, MaxSessions, MaxSubscriptionsPerSession, and MaxMonitoredItemsPerSubscription. Read these at commissioning to confirm the actual values your client must respect.

7. Reading the Actual Limit at Runtime

Three reliable methods to determine the live subscription count and the negotiated limit:

7.1 WinCC Channel Diagnosis

In WinCC Professional, open the project, right-click the S7 Plus channel, choose Channel Diagnosis. The diagnosis dialog reports the number of currently active subscriptions versus the negotiated maximum. This is the same number WinCC negotiated with the CPU when the connection was established.

7.2 TIA Portal Online > Diagnostics > Connection Resources

Connect TIA Portal online to the CPU, expand Online & Diagnostics > Connections. The CPU's connection table shows active S7 Plus sessions and the subscription count per session.

7.3 Network Capture

Capture the S7 Plus handshake with Wireshark on port 102. The client sends a CreateSubscription-style request; the CPU's response contains the maximum subscription count it is willing to grant for that session. This value varies by firmware and by CPU model.

8. Engineering Recommendations for High Tag Counts

For a 10,000+ datapoint project on an S7-1518, the following design pattern has been proven in production:

1. Pick the largest S7 Plus subscription count you can afford. The S7-1518-4 PN/DP has the highest value; consult the latest firmware data sheet under support entry 98699910.
2. Consolidate tags into UDTs and array DBs. Aim for a subscription-to-item ratio of at least 1:20; ratios of 1:50 are realistic for motor and I/O data.
3. Group subscriptions by update rate (100 ms / 500 ms / 1 s / 10 s). Each group is one subscription; you do not need more than four or five subscriptions even for 10,000 items.
4. Stay under the ~1,400 byte payload per subscription. If you exceed it, split the UDT instance across multiple DBs and subscribe to each DB.
5. Disable unused S7 Plus features on the CPU side: if you do not need the S7 routing or the legacy S7comm interface, turn them off to free protocol-handler resources.
6. For very high tag counts, evaluate the OPC UA server. The OPC UA server on the S7-1518 has independent subscription limits that are often larger than the S7 Plus limit and supports data-change filters that further reduce traffic.
7. Distribute across multiple CPUs if a single S7-1518 still does not have headroom. Multiple S7-1517s can each carry ~10,000 items with comfortable margin.

9. Troubleshooting Matrix

10. Versioning and Firmware Notes

Subscription limits have evolved across firmware generations. Engineering teams should pin the minimum firmware version in their project and document the negotiated limit in their HMI/SCADA design document. The following rules apply:

• Each firmware version has a specific subscription table size. Newer firmware is generally equal or larger.
• The S7 Plus protocol itself is backward compatible; older WinCC versions can subscribe to a newer CPU but they will be limited to the smaller of (client limit, CPU limit).
• PLCSIM's limit (4,000 in V14) is independent of physical CPU limits and is intended for development only.

Refer to the Siemens support article 98699910 and the CPU's product manual for the authoritative value for the firmware version deployed in production.

11. FAQ