Troubleshooting SINUMERIK 840D SL CP840D OPC UA Connection

1. Problem Statement

A SINUMERIK 840D SL controller using its integrated CP 840D communication processor refuses to complete a TCP/IP session with an external OPC server (or OPC UA client). The diagnostic buffer, HMI trace, or connection status register reads "Passive connection establishment in progress" and never transitions to Established. Cabling, the intermediate router, and ICMP echo (ping) are all functional; the host is reachable. Forty-nine identical cells on the same network topology communicate without intervention. This document isolates the failure path, ranks the most common causes, and provides a deterministic diagnostic and remediation procedure.

2. SINUMERIK 840D SL Communication Architecture

The 840D SL is built around an NCU (Numerical Control Unit) that integrates:

• An NCK (NC kernel) for motion and interpolation.
• A PLC (S7-300/ET200-class) for discrete logic.
• An integrated CP 840D communication processor with onboard Ethernet.
• A HMI runtime (Operate / SinuTrain) running on the NCU or a separate PCU/IPC.

The CP 840D shares the NCU's X130 Ethernet port with other TCP services (HMI web, VNC, SFTP). Configuring the OPC UA endpoint requires that the NCK have a valid IP, subnet, and router entry on X130.

3. CP 840D Hardware and the X130 Interface

The CP 840D is not a plug-in card on the 840D SL — it is hardwired into the NCU module. The relevant physical interface is X130, the customer-side Ethernet socket on the NCU. The CP 840D supports:

• PROFINET IO controller / device
• S7 communication (PUT/GET, BSEND/BRCV)
• ISO-on-TCP (RFC 1006) connections
• TCP/IP native sockets
• OPC UA server (NC-side, license-gated)

Configuration of the CP 840D's connection database is performed in the STEP 7 (or TIA Portal) project that owns the integrated PLC — not in HMI Operate. The HMI Operate interface exposes diagnostics but not full connection configuration.

4. OPC UA Server Placement on 840D SL

Unlike S7-1200/1500 controllers where the OPC UA server runs inside the PLC firmware, the 840D SL places its OPC UA server on the NC side (NCK). Consequences:

• The OPC UA server endpoint binds to the NCK's network stack, reachable on the NCU's X130 IP.
• Activation requires a runtime license on the NC, not the PLC.
• Tag data is read from PLC via internal NCK-PLC interfaces and exposed through the OPC UA address space.
• NC software version determines whether the server comes up automatically or requires manual file staging.

Because the server lives on the NC side, an OPC client that can ping the NCU but cannot OpenSecureChannel on TCP 4840 has either a port/ACL problem, an NC-side license missing, or an NC software version too old to host the server natively.

5. Active vs Passive Connection Establishment

The CP 840D maintains a TCP connection state machine identical to SIMATIC S7 CPs. There are two roles:

• Active connection establishment: CP 840D issues the CONNECT() call to the remote IP:port.
• Passive connection establishment: CP 840D binds to a local IP:port and waits for the remote side to connect.

When the connection sits in "passive connection establishment in progress" indefinitely, the CP has executed a LISTEN() and is waiting for a remote SYN that never arrives. Diagnostic branches:

1. The remote OPC client never sends SYN — fault on the client side (wrong target IP, wrong target port, firewall blocking outbound, wrong active/passive role in client config).
2. The remote OPC client sends SYN but a network device drops it — ACL, NAT, or routing asymmetry.
3. The CP 840D is configured passive but the field engineer expected active — configuration error; the checkbox "Active connection establishment" is not set.

6. Root Cause Matrix

7. Diagnostic Procedure (Step-by-Step)

Prerequisites

• STEP 7 / TIA Portal project archive for the 840D SL with the integrated PLC.
• HMI Operate access (or service menu on the NCU).
• Read access to the NCU's /user/system/etc/system bases.ini and tcpcfg.ini.
• A laptop with Wireshark and portqry / nmap available.
• Out-of-band console (e.g., SSH on X130 if enabled) or direct connection at X130.

Step 1 — Verify Physical and Layer 3

1. Confirm link LEDs on NCU X130 and adjacent switch port.
2. From OPC client, ping <NCU IP>. Confirm reachable.
3. From OPC client, tracert <NCU IP> (Windows) or traceroute. Confirm route.

Step 2 — Inspect CP 840D Connection Configuration (PLC Side)

1. Open the PLC project in STEP 7 / TIA Portal.
2. Navigate to CP 840D > Connections.
3. Identify the connection to the OPC server. Confirm:

Step 3 — Verify NC-Side OPC UA State

1. On HMI Operate, open Commissioning > Licenses. Confirm the OPC UA option is licensed on the NCK.
2. Check the NC SW version: only newer NC releases host the OPC UA server natively without manual file staging.
3. If older NC SW is in use, the OPC UA server files must be manually deployed to the NCU and tcpcfg.ini configured.

Step 4 — Firewall and bases.ini Audit

1. On the NCU, open system bases.ini:

# Example excerpt — adapt to site policy
[LinuxBase]
firewall=1
firewall_in_tcp=4840
firewall_out_tcp=4840
firewall_in_udp=0
firewall_out_udp=0

2. Ensure the OPC UA TCP port (default 4840) is allowed inbound. Restart of the relevant service may be required after editing.
3. Check tcpcfg.ini for the OPC UA server's bind address and port.

Step 5 — Capture a Network Trace

1. Start a packet capture at the OPC client (Wireshark on the client NIC) with display filter tcp.port == 4840 || ip.addr == <NCU IP>.
2. Reproduce the failure by triggering a connect from the client.
3. Confirm whether the client ever emits SYN:

• If no SYN: client-side configuration error (target IP/port, outbound firewall, OPC UA endpoint URL string).
• If SYN sent, no SYN-ACK: intermediate device filtering, or NC-side listener absent (license, NC version, service crashed).
• If SYN sent, RST received: NC-side active reject (port bound but not accepting, or wrong protocol).

Microsoft's general TCP/IP troubleshooting guidance (Troubleshoot TCP/IP communication — Microsoft Learn) is the canonical checklist for this trace-then-isolate discipline.

Step 6 — OPC Client-Side Verification

1. Open the OPC client's configuration (e.g., OPC UA expert tool, Kepware, Ignition, Siemens OPC Scout).
2. Verify the Endpoint URL:

opc.tcp://<NCU IP>:4840

3. Verify the client's destination IP is the NCU's X130 address — not the management port of an intermediate device. Single-character typos here are the most frequent field finding.

8. Field-Proven Resolution Path

The original incident resolved when a typo in the OPC client's target IP was corrected. After the IP fix, the connection transitioned from passive-listen to established in seconds. Apply this priority order when reproducing:

1. Validate IP on both sides. Most failures are configuration errors, not hardware.
2. Confirm active vs passive role in the CP 840D connection.
3. Confirm NC-side OPC UA license and NC SW version.
4. Audit system bases.ini and tcpcfg.ini.
5. Capture packets at both ends to localize the dropped frame.
6. If all configuration is correct and trace confirms SYN-reach but no SYN-ACK, escalate to Siemens for NC firmware update.
7. If firmware update does not resolve, replace the NCU. Field reports indicate this resolves cases where the integrated CP 840D hardware is defective.

9. Firmware Update and Hardware Escalation

When configuration and trace are clean but the failure persists on a single machine among identical peers, Siemens' recommendation is:

1. Update the NCK firmware on the suspect NCU to the latest released version compatible with the PLC project.
2. Re-test the OPC UA connection post-update.
3. If the issue remains, replace the NCU module. Document the NCU order number (e.g., 6FC5371-..., varies by performance class) and warranty status.

10. Verification Checklist

After applying a remediation, verify the following before returning the machine to production:

• OPC UA client receives OpenSecureChannel and CreateSession responses.
• Subscription and monitored items return expected values for at least 5 minutes.
• Connection state in HMI Operate reads Established (not "passive in progress").
• No new entries in NCK diagnostic buffer related to CP 840D or OPC UA.
• Packet capture shows periodic keep-alive / publish traffic consistent with subscription intervals.
• NCU X130 link utilization remains within nominal envelope (<5% sustained).

11. Related Connection Types on CP 840D

When diagnosing, ensure you are testing the correct transport:

Confirm the OPC client is actually targeting the OPC UA endpoint (port 4840). A misconfigured S7 connection endpoint will produce a similar "passive establishment" symptom but on port 102.

FAQ