Configuring WinCC as an OPC UA Client to Exchange Data with S7-1500 in SIMATIC PCS 7

In SIMATIC PCS 7 V8.1, integrating an S7-1500 controller via OPC UA is implemented at the WinCC OS layer using the native WinCC OPC UA Client channel rather than at the S7-400 AS level. WinCC Tag Management connects directly to the S7-1500 integrated OPC UA Server endpoint over Industrial Ethernet, allowing process tags to be browsed, read, and written securely using digital certificates without requiring third-party middleware or hardware gateways.

OPC UA Integration Architecture in PCS 7 Environments

Integrating modern S7-1500 controllers into an established SIMATIC PCS 7 V8.1 architecture involves distinct architectural considerations:
* AS-Level Limitations: S7-400 and S7-410 automation stations running standard PCS 7 libraries cannot act as native OPC UA clients within CFC charts. While AS-to-AS data exchange can be performed via S7 communication (BSEND/BRECV) or Modbus TCP, exchanging data with an S7-1500 via OPC UA is hosted at the WinCC Operator Station (OS) level.
* WinCC OPC Communication Channel: SIMATIC WinCC V7.3 (the underlying SCADA engine of PCS 7 V8.1) incorporates a native OPC Channel supporting both Classic OPC (DA, HDA, A&E) and OPC Unified Architecture (OPC UA).
* S7-1500 OPC UA Server: Starting with firmware V2.0, SIMATIC S7-1500 CPUs incorporate a built-in OPC UA Server compliant with IEC 62541, capable of exposing optimized and non-optimized data blocks directly over TCP port 4840.

+-------------------------------------------------------------+
| SIMATIC S7-1500 Controller (TIA Portal)                     |
| Integrated OPC UA Server (Endpoint: opc.tcp://192.168.1.50) |
+-------------------------------------------------------------+
                              |
                              v Industrial Ethernet (Port 4840)
+-------------------------------------------------------------+
| SIMATIC PCS 7 WinCC OS Server (WinCC V7.3)                  |
| WinCC Tag Management -> OPC Channel -> OPC UA WinCC Client  |
+-------------------------------------------------------------+
                              |
                              v
+-------------------------------------------------------------+
| WinCC Runtime Graphics, Faceplates, and Tag Logging Archive |
+-------------------------------------------------------------+

Step-by-Step Procedure to Configure WinCC OPC UA Client

Follow this procedure to establish an authenticated OPC UA client connection from PCS 7 WinCC V8.1 to an S7-1500 CPU.

Prerequisites

S7-1500 CPU configured in TIA Portal with OPC UA Server enabled, runtime license assigned, and DB tags set to "Accessible from HMI/OPC UA".
Network routing and firewall rules configured to allow bidirectional traffic on TCP port 4840.
Administrative privileges on the PCS 7 Engineering / OS Server station.

Step 1: Enable OPC UA Channel in WinCC Tag Management

Open the target OS project in WinCC Explorer.
Right-click Tag Management and select Add new driver.
In the driver selection dialog, select OPC.chn and click Open.
The OPC communication driver appears in the Tag Management tree with sub-nodes for OPC Classic and OPC UA WinCC Channel.

Step 2: Configure OPC UA Server Connection

Expand the OPC driver node, right-click OPC Groups (OPC UA WinCC Channel), and select System Parameter.
In the OPC UA Configuration dialog, navigate to the Server tab.
Click Add Server and enter the connection details:
* Server Name: Enter a descriptive tag (e.g., S7_1500_Packaging).
* Server URL: Enter the endpoint URL: opc.tcp://<S7-1500_IP_Address>:4840
Select the desired Security Policy:
* For testing: None
* For production: Basic256Sha256 with message security Sign & Encrypt.
Under Authentication, select Anonymous or enter user credentials configured in the S7-1500 security settings.

Step 3: Certificate Exchange and Trust Validation

If using encrypted security profiles, initiate a connection test. The S7-1500 will reject the initial connection because the WinCC client certificate is untrusted.
In TIA Portal, open the S7-1500 CPU properties under OPC UA -> Server -> Certificate Manager. Move the WinCC client certificate from Rejected Certificates to Trusted Certificates.
On the WinCC OS Server, open the OPC UA certificate store (located in C:\ProgramData\Siemens\OPC\PKI\rejected) and move the S7-1500 server certificate into the trusted folder.

Step 4: Browse and Map S7-1500 Tags

In WinCC Tag Management, right-click the configured connection and select Browse Server.
The OPC UA address space loads dynamically, displaying the S7-1500 PLC data blocks under Objects -> PLC -> DataBlocksGlobal.
Select the required process tags and click Add Tags. WinCC automatically creates the corresponding internal process tags with appropriate data types.

Verification

In WinCC Explorer, activate Runtime.
Open the WinCC Channel Diagnosis tool (WinCC Explorer -> Tools -> Channel Diagnosis).
Locate the OPC channel and expand the OPC UA connection. Verify that the channel status reports Ready with a green checkmark and that the read/write counter increments continuously.
Create a test graphic in Graphics Designer with an I/O field linked to an S7-1500 process tag; verify that live process values update dynamically.

Limitations and Operational Precautions

Tag Licensing: Tags mapped from the S7-1500 via the OPC UA channel consume WinCC OS Runtime process tag licenses. Ensure your WinCC license size covers the added tags.
Update Frequency: Do not set OPC UA subscription scan rates faster than necessary; querying hundreds of tags at sub-100ms intervals can saturate the S7-1500 CPU communication budget.
Certificate Expiration: Self-signed certificates generated in TIA Portal or WinCC have finite validity periods (typically 1 to 5 years). Document expiration dates to prevent sudden communication failure upon certificate expiration.

Engineer FAQ

Can S7-400 CFC blocks read S7-1500 tags via OPC UA directly?
No. S7-400 CPUs do not support native OPC UA client blocks in CFC. If AS-level logic requires S7-1500 data, configure S7 communication using BSEND/BRECV blocks or Modbus TCP.
Does WinCC V7.3 support OPC UA historical data access (HDA)?
WinCC V7.3 supports OPC UA Data Access (DA) as a client. OPC UA HDA client capabilities are limited; historical values are typically logged within WinCC Tag Logging using cyclic DA acquisition.
Why does the OPC UA connection fail with 'BadSecurityChecksFailed'?
This error indicates an unexchanged or untrusted certificate, or a severe clock synchronization discrepancy (greater than 5 minutes) between the OS Server and S7-1500 CPU.
Can redundant PCS 7 OS servers connect to the same S7-1500 OPC UA server?
Yes. Both Master and Standby OS servers must have their individual client certificates trusted in the S7-1500 CPU.
Is an additional license required on the S7-1500 for OPC UA?
Yes. Enabling the OPC UA Server on an S7-1500 requires a SIMATIC OPC UA S7-1500 Small, Medium, or Large runtime license depending on the CPU model.

Technical References

Siemens Industry Online Support Entry ID 109769234: Connecting S7-1500 to WinCC via OPC UA.
Siemens Manual: WinCC V7.3 Communication Manual - OPC Channel.
OPC Foundation Standard: IEC 62541 - OPC Unified Architecture Specification.

Configuring WinCC as an OPC UA Client to Exchange Data with S7-1500 in SIMATIC PCS 7