Connect OPC UA to Siemens TIA Portal OPC UA config

Before you start

• A TIA Portal version that matches the target CPU firmware, and a project that can be compiled and downloaded. OPC UA settings live in the hardware configuration, so you need download rights on the CPU, not just online access.
• Clarity on the licence position for the server option before you configure it, so you do not spend a day debugging a server that was never entitled to run.
• SiOME if you intend to map a companion specification onto the server interface. It is a separate Siemens modelling tool that consumes NodeSet2 files.
• A decision, made before configuration, about which hostnames and IP addresses clients will use, because they must go into the server certificate's Subject Alternative Name.

Setting it up

1. Open the CPU's OPC UA server settingsThe settings sit in the CPU properties in the device configuration, not in the program. Enable the server, confirm the reported endpoint, and set the application name once and permanently: it becomes the ApplicationUri that certificates and trust lists are keyed on.
2. Set the runtime behaviour limits explicitlyThe server settings expose the minimum sampling and publishing intervals the CPU will accept and the session and subscription ceilings it will enforce. Set them to what you intend to allow, then tell the client team the numbers. Leaving defaults and discovering the ceiling in production is the common failure.
3. Publish tags through the accessibility attributesIn the PLC tag table and the data-block editor, the per-symbol attributes decide whether a symbol is visible to HMI and OPC UA and whether it is writable. This is your access-control surface at the data level; use it, and record the decisions somewhere a reviewer can read.
4. Create a server interface as the published contractAdd a server interface and drag the tags you want into it, giving them interface names that are independent of internal symbol names. Clients bind to the interface, so you can refactor the program without renegotiating the integration.
5. Import a companion model with SiOME and map tags onto itLoad the companion NodeSet2 file into SiOME, map PLC symbols onto the model's variables and methods, and export the result as a server interface you import back into the TIA project. This is the difference between a client that reads a data-block tree and a client that reads standard machinery types.
6. Issue the server certificate through the project's global security settingsEnable the project's protected security settings, log in as a project user, and generate or import the CPU's server certificate there. Include every DNS name and IP a client will dial as SAN entries and the ApplicationUri as a URI entry. This is also where client certificates are placed into the CPU's trusted list before download.
7. Configure identity tokens and usersDecide whether anonymous access is permitted at all and configure the username tokens the server will accept. Anonymous plus no encryption is a defensible bench configuration and an indefensible plant one.
8. Compile, download, and re-verify the namespace mapCompile the hardware configuration and download it. Then reconnect a client, re-read the NamespaceArray and confirm your URI to index map. If any client stored a raw ns= number, this is the moment it breaks.
9. Export the interface for the client teamExport the server interface as a nodeset or document the node list, and hand it over as the integration contract. A client team working from an exported model rather than from screenshots of a browse tree is the cheapest quality improvement available on a Siemens project.

What the address space looks like

TIA produces one of two very different address spaces. Left at defaults you get the standard server nodes plus a Siemens-shaped tree of data blocks, inputs, outputs and memory, with string identifiers mirroring symbol names. With server interfaces you get exactly the nodes and hierarchy you defined, in a namespace whose URI you control, and the internal symbol names disappear from the contract. With a SiOME-mapped companion model on top, the published nodes are instances of standard types under the companion namespace URIs, and a client written against those types is portable to other vendors' machines. Which of the three you have is the most important single fact about a Siemens integration, and it is visible in thirty seconds by checking HasTypeDefinition on a published node.

The traps

• Every OPC UA change is a hardware-configuration download. That means a CPU stop on many project setups, so OPC UA changes have to be scheduled into production windows like any other download, and namespace indexes may be reassigned when the server restarts.
• Certificate management is inside the project's protected global security settings. If nobody knows the project security password, you cannot issue or replace the server certificate, and an expired certificate then becomes a project archaeology exercise rather than a maintenance task.
• The application name set at configuration time propagates into the ApplicationUri. Renaming it later invalidates every peer's trust decision at once across the fleet.
• Server interfaces are versioned artefacts. Editing one in place without telling the client team produces a client that silently reads a node that no longer means what it did.
• The minimum sampling interval and session ceilings configured here are enforced silently: the server revises the client's request rather than rejecting it, so a client that never reads back the revised values believes it is sampling faster than it is.
• SiOME mapping does not validate that your PLC logic actually maintains the model's semantics. A state machine node that never leaves one state is a valid mapping and a useless one.

Getting OEE data out of it

TIA Portal is where an OEE integration is either made portable or made brittle. Mapping a companion model onto a server interface, so that availability comes from a standard state machine and counts from a standard counter, moves the mapping work from the analytics platform to the machine and makes it reusable on the next machine. Doing nothing and letting the client scrape data blocks works, and is the common case, but it produces a per-machine mapping that has to be redone for every line. What TIA cannot give you at any configuration effort is planned production time, shift calendars, order context or standard cycle times: those are MES and ERP data, and the intended bridge is an ISA-95 style job interface rather than a PLC tag.

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.