Skip to content
S7 PLC Buddy

OPC UA Setup

S7 PLC Buddy can connect over OPC UA instead of the S7 WebServer API. This is the option to use if your plant disables the WebServer for security reasons (a common requirement under IEC 62443 hardening guidance), since OPC UA is the interface Siemens designed for this kind of restricted environment.

Supported CPUs

Section titled “Supported CPUs”

Any S7-1500 (including ET 200SP CPUs and the Software Controller) with the built-in OPC UA server licensed and enabled. Check Device configuration → Properties → OPC UA in TIA Portal to confirm your CPU supports it and whether a separate OPC UA license is required for your CPU variant.

Enabling the OPC UA server

Section titled “Enabling the OPC UA server”

  1. Open your project in TIA Portal

    Double-click your CPU in the device tree to open its properties.

  2. Activate the OPC UA server

    Navigate to Properties → OPC UA → Server → General and tick Activate OPC UA server.

  3. Configure security

    Under Properties → OPC UA → Server → Security, choose a security policy. Basic256Sha256 with Sign & Encrypt is recommended. S7 PLC Buddy accepts the PLC’s server certificate automatically on first connect, so no manual certificate import is required on your PC.

  4. Set up authentication

    Under Properties → OPC UA → Server → Security → User management, add a user with at least read access, or enable Anonymous access if your security policy allows it. S7 PLC Buddy supports both.

  5. Compile and download

    Compile the hardware configuration and download it to the PLC.

Connecting in S7 PLC Buddy

Section titled “Connecting in S7 PLC Buddy”

  1. Open Settings → Connections.

  2. Select OPC UA in the connection method toggle.

  3. Enter the Endpoint URL — the default OPC UA port is 4840, so this is typically opc.tcp://<plc-ip>:4840.

  4. Enter a Username and Password if your PLC requires them, or leave both blank to connect anonymously.

  5. Click Connect.

The status indicator turns green once the session is established. The password is never saved to disk, same as the WebServer connection method.

What works over OPC UA

Section titled “What works over OPC UA”
Capability Status
Connect / disconnect ✅ Supported
CPU status and operating mode ✅ Supported
Tag browsing (full namespace, including data blocks and structs) ✅ Supported
Reading tag values (single and batched) ✅ Supported
AI Agent tools using the above ✅ Supported
Diagnostic buffer ❌ Not yet — use the WebServer connection method
Alarms (browse and acknowledge) ❌ Not yet — use the WebServer connection method
Runtime info (cycle time, CPU load) ❌ Not yet — use the WebServer connection method
Module states ❌ Not yet — use the WebServer connection method
Reading/setting the PLC clock ❌ Not yet — use the WebServer connection method

If you need the features in the “not yet” column, connect via WebServer Setup instead. You can switch connection methods at any time in Settings — nothing about your PLC configuration needs to change to switch back and forth.

Network requirements

Section titled “Network requirements”
  • Your PC must be able to reach the PLC on the OPC UA port configured in TIA Portal (TCP 4840 by default).
  • If your plant network uses a firewall, ask your network admin to open this port between your PC and the PLC.

Troubleshooting connection failures

Section titled “Troubleshooting connection failures”
Symptom Likely cause
Connection times out OPC UA server not activated in TIA Portal, or the port is blocked by a firewall
“Cannot find ANONYMOUS user token policy” Anonymous access is disabled on the PLC’s OPC UA server — enter a username and password instead
“Invalid credentials” Wrong username or password, or the user isn’t authorized for OPC UA access
Certificate-related error on first connect Unusual — S7 PLC Buddy accepts the PLC’s certificate automatically. If you see this, check the Troubleshooting page or contact support

See Troubleshooting for more details.