Siemens S7-1500 OPC UA Server: Supported Specifications

Overview

The SIMATIC S7-1500 CPU family integrates an OPC UA Server directly into the controller firmware, exposing tag data and (with newer firmware) methods to OPC UA clients on the plant network. Historically, Siemens delivered only the Server role; the OPC UA Client role on the S7-1500 was introduced as a separately licensed option beginning with TIA Portal V15 and a follow-up firmware update. The Server is enabled per interface (PROFINET port) and is bound by firmware capability - not all 14 parts of the IEC 62541 (OPC UA) specification are implemented in every firmware release.

This reference consolidates the supported specification parts, the minimum firmware / TIA Portal combinations, the security model, and the gaps (Events/Alarms, Historical Access, Programs state machine, PubSub) that engineers must understand before designing an S7-1500-centric OPC UA architecture. All capabilities below are anchored to the official Siemens S7-1500 Communication Function Manual and the OPC UA specification (IEC 62541).

OPC UA Architectural Concepts on the S7-1500

OPC UA (IEC 62541) replaces the COM/DCOM-bound OPC Classic stack with a service-oriented architecture transported over binary TCP, WebSockets, or MQTT. The S7-1500 OPC UA Server implements the following core building blocks:

• Address Space Model – Hierarchical, node-based object tree. On the S7-1500, the OPC namespace is built from the PLC tag table, DBs marked as accessible, and (with TIA V15+) the new OPC UA Companion Specification view.
• Services – Read, Write, Browse, Subscribe, Call (Methods), RegisterServer/Discovery. Implemented subsets are listed in the section below.
• Information Model – The base DI (Device Integration), AutomationML, and selected Companion Specifications (Euromap 77, Euromap 83).
• Mappings – OPC UA Binary over TCP (port 4840) and (firmware-dependent) HTTPS/WebSecure. No WebSocket or MQTT broker is embedded in the S7-1500 firmware itself - MQTT PubSub is supported via the Siemens "New Functions" firmware middleware path, not natively on the CPU.

For a primer on the underlying standard, refer to the OPC Foundation OPC UA overview and the OPC UA Wikipedia entry.

OPC UA Specification Parts – Supported vs Not Supported

The OPC UA specification (IEC 62541) is published in 14 numbered parts. Siemens implements a strict subset on the S7-1500, as documented in the Siemens "Supported OPC UA Specifications" entry (ID 109763315) and the S7-1500 Communication Function Manual (entry ID 109763315 / 109771626).

Firmware and TIA Portal Compatibility Matrix

The OPC UA capability exposed by the CPU is gated by the firmware version and by the TIA Portal version used to configure the project. Mismatched TIA/firmware combinations will silently down-grade the Server to the lowest-common-denominator feature set.

Refer to the S7-1500 "New Functions" firmware PDF (entry ID 109771626) for the definitive per-firmware change log.

OPC UA Server Configuration in TIA Portal

Enable the Server role on the S7-1500 CPU by navigating to CPU Properties → Communication → OPC UA Server. The configuration table below shows the parameters that must be set for a production deployment.

Step-by-step configuration

1. Open the TIA Portal project, select the S7-1500 CPU, and open Properties.
2. Navigate to Communication → OPC UA → Server.
3. Tick Activate OPC UA Server and bind it to the PROFINET interface X1/X2.
4. Import a server certificate (self-signed for test, CA-signed for production) under Security → Certificates.
5. Whitelist the DBs / tag collections that should be visible: OPC UA → Symbol Configuration.
6. If Methods are needed, declare them under OPC UA → Methods and reference the corresponding PLC FB.
7. For Companion Specifications, load the namespace XML (Euromap 77/83) from disk and assign nodes to PLC variables.
8. Compile the project and download to the CPU. Activate "Run OPC UA Server" in Online → Diagnostics → OPC UA.

OPC UA Methods (Firmware ≥ 2.5, TIA ≥ V15)

Methods allow a client to invoke an FB on the CPU and receive a return value - conceptually a remote procedure call. They are exposed as Call service nodes in the address space.

Server-side declaration

1. Create a function block in the PLC program with the OPC UA Method attribute enabled in its properties.
2. Declare the input parameters (var_input) and output parameters (var_output / var_in_out) - each becomes an argument of the UA Call request.
3. Reference the FB instance DB in the OPC UA Symbol Configuration so the runtime can resolve the Call to the FB method body.

Example – sum of two tags

FUNCTION_BLOCK "fb_OpcUaSum"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
VAR_INPUT
  iTag1 : Real;
  iTag2 : Real;
END_VAR
VAR_OUTPUT
  oResult : Real;
END_VAR
BEGIN
  oResult := iTag1 + iTag2;
END_FUNCTION_BLOCK

Once the symbol is published, any OPC UA client can issue:

CallRequest
  objectId = ns=4;s=|var|fb_OpcUaSum_DB
  methodId = ns=4;s=|method|fb_OpcUaSum
  inputArguments = [20.0, 22.0]
returns [42.0]

OPC UA Companion Specifications (Firmware ≥ 2.5)

Companion Specifications are vendor- or industry-specific information models defined as XML namespaces and node sets. By loading the namespace XML into the S7-1500 OPC UA configuration, the Server exposes standardized node paths that any client (MES, ERP, machine builder tool) can navigate without a custom interface.

Commonly supported on the S7-1500:

• Euromap 77 – plastics/rubber injection-molding machinery interface.
• Euromap 83 – interface for upstream/downstream equipment in plastics/rubber production.
• DI (Device Integration) – IEC 62541-100 base information model.

To load a Companion Spec, place the corresponding namespace XML under OPC UA → Companion Specifications in TIA Portal, map the standardized node paths to PLC variables, and recompile. Search the TIA Portal Help system for "companion" for the version-specific wizard.

Subscription vs PubSub – Clarification

Engineers frequently conflate Subscription (OPC UA Part 4) with PubSub (OPC UA Part 14). On the S7-1500:

• Subscription – a client-server model where the client opens a session, registers MonitoredItems, and receives Publish responses. Supported on the S7-1500 since FW 1.8.
• PubSub – a brokerless (UDP multicast) or brokered (MQTT) publish/subscribe model. Not implemented on the S7-1500 CPU itself. MQTT is the supported middleware path - messages are produced by an external gateway (e.g., SIMATIC IoT2050, Node-RED, or a WinCC Unified data source) that consumes the S7-1500's classic DA/DA-via-Subscription and republishes through an MQTT broker.

If your customer requires Part 14 PubSub, you must deploy an edge gateway, not rely on the CPU's native OPC UA stack.

Security Model

OPC UA Part 2 (Security) is fully implemented on the S7-1500. The Server supports:

• SecurityPolicies: None (debug only), Basic128Rsa15 (legacy), Basic256, Basic256Sha256, Aes128-Sha256-RsaOaep (FW 3.0+), Aes256-Sha256-RsaPss (FW 3.0+).
• MessageSecurityModes: None, Sign, SignAndEncrypt.
• Authentication: Anonymous (default - leave for lab only), Username/Password, X.509 Client Certificate.
• Transport: UA Binary over TCP/4840; WebSecureTransport (HTTPS, port 443) on FW 3.0+.

OPC UA Client (Firmware ≥ 2.6, TIA ≥ V15.1, Licensed)

The Client role enables the S7-1500 to act as an OPC UA consumer - reading values from a third-party OPC UA Server, calling methods on remote servers, and writing data back. The capability is unlocked by:

1. Installing the SIMATIC OPC UA Client runtime option on the CPU (license key, order number 6ES7822-1AA05-0YA5 or similar per current catalog).
2. Configuring the Client connection in TIA Portal under Communication → OPC UA → Client.
3. Declaring the OPC_UA_Client_DB and using the supplied FBs (OPC_UA_Client_Read, OPC_UA_Client_Write, OPC_UA_Client_Method_Call) in the PLC program.

Reference: Siemens OPC UA Client Function Manual (entry ID 109762770).

Diagnostics and Verification

After enabling the OPC UA Server, validate connectivity before commissioning:

1. TIA Online diagnostics – Online → Diagnostics → OPC UA shows current session count, subscription count, and rejected requests.
2. Siemens OPC UA Scout – the official browser, available in the TIA Portal toolset, validates the address space, security settings, and subscription rates.
3. Wireshark dissector – filter on tcp.port == 4840 to confirm UA Binary frames; right-click → Decode As → OpcUa for protocol dissection.
4. Linux open62541 test client – quick smoke test from a Linux host:r>
   ./client discover -e opc.tcp://192.168.0.1:4840

Common error codes returned by the S7-1500 UA Server:

Troubleshooting Matrix

FAQ