Connecting a Siemens S7-1500 PLC to a SCADA, MES, or historian is one of the most common starting points for an industrial connectivity project — and one of the most common places engineers get stuck. The S7-1500 is a modern, secure controller with several features (optimized data blocks, protection levels, PUT/GET access control) that did not exist on the older S7-300 and S7-400 platforms, and the default settings will block KEPServerEX from reading anything until you change them.
This tutorial walks through the full procedure: configuring the S7-1500 in TIA Portal, installing and configuring KEPServerEX, adding the device with the correct rack and slot, validating the connection, and exposing tags to a SCADA or any OPC UA client. It is the procedure our engineers use every week on real customer sites across Singapore, Malaysia, and Vietnam. No screenshots — just the settings, the values, and the reasons.
If you are at the procurement stage and have not yet purchased KEPServerEX, see our KEPServerEX product page or read our broader guide to Kepware industrial connectivity first.
The S7-1500 will refuse external reads until three protection settings are changed. Open your PLC project in TIA Portal, double-click the CPU in the device view, and open the Properties tab.
In Protection & Security → Access level, select Full access (no protection) for the test phase, or Read access if you only need KEPServerEX to read tags. The Siemens TCP/IP Ethernet driver does not support a PLC-side password, so a higher protection level will block the connection. For production, the recommended path is to leave the PLC at “Read access” and rely on segmenting the OT network instead of a PLC password.
In the same Protection & Security section, scroll to Connection mechanisms and check “Permit access with PUT/GET communication from remote partner.” This is the single most common reason a first-time connection fails. It is unchecked by default on every new S7-1500 project.
For every Data Block (DB) you want KEPServerEX to read or write, right-click the DB, choose Properties → Attributes, and make sure “Accessible from HMI/OPC UA/Web API” is checked. If it is not, the DB exists in the PLC but is invisible to KEPServerEX.
This is the decision that drives which Kepware driver you use:
For greenfield S7-1500 projects, the Plus Suite is almost always the right answer — you keep optimized blocks (faster, more memory-efficient, the way TIA Portal wants you to work), and you avoid the temptation to disable optimization just for connectivity. The Siemens Suite (classic driver) is fine for brownfield plants where DBs were already laid out the old way.
Save the project and download to the PLC after making these changes. A “cold restart” is not required.
Install KEPServerEX on the Windows host using a domain or local administrator account. During the install:
After install, open the KEPServerEX Configuration tool. The tree on the left is your project: Channels → Devices → Tags.
Right-click Connectivity → Click to add a channel. Walk the wizard:
Siemens_PlantA. Avoid spaces.Right-click the new channel and choose Click to add a device. The driver-specific settings start here.
In the Model dropdown, select S7-1500 (not S7-300 or S7-400). The model selection affects how the driver formats S7 read/write requests; picking S7-300 against an S7-1500 will sometimes work but will silently truncate certain data types.
Use the PLC’s Ethernet interface IP address as configured in TIA Portal under PROFINET interface → Ethernet addresses. Validate with a ping from the KEPServerEX host first — if ping fails, the issue is the network, not Kepware.
This is the second most common configuration mistake. For an S7-1500:
01The S7-1500 is always Rack 0, Slot 1, regardless of whether you wire into port X1 or X2 of the same CPU. Older KEPServerEX builds had a quirk that did not accept “1” as a slot value — if you are on a very old V5.x build and see a validation error, use Slot 2 as a workaround and upgrade KEPServerEX. On any V6.0 or later install this is no longer required.
Defaults are correct for almost all S7-1500 deployments:
Right-click the new device and choose Diagnostics → Display Diagnostics (or open the Event Log at the bottom of the configuration window). You should see lines like:
Siemens TCP/IP Ethernet | Siemens_PlantA.PLC1 | 'PLC1' is now responding
If you see “Unable to read tag PLC1 — reference is invalid” or “Device ‘PLC1’ is not responding”, walk this checklist in order:
ping the PLC from the KEPServerEX host? If not, fix routing first.With the device responding, right-click it and choose New Tag for each PLC variable you want to expose. Examples for an S7-1500:
DB10,DBD0 for a 32-bit floating-point value at offset 0 of DB10 (classic driver), or DB10.MyVariable using symbolic addressing (Plus driver).M10.0 — bit 0 of memory byte 10.I0.0 — first digital input.Q0.0 — first digital output.T1. Counter: C1.For large projects, do not type tags manually. Use Automatic Tag Database Generation — right-click the device, choose Properties → Tag Generation → Create Tags on Device Startup, then either point KEPServerEX at the TIA Portal symbol export or let the Plus driver browse symbols directly. A 5,000-tag plant takes about three seconds.
To validate the tags, launch the bundled OPC Quick Client from the toolbar. Tags show their values and quality (Good, Bad, Uncertain). Anything with quality “Bad” usually means a typed address that does not exist on the PLC or a data type mismatch — double-check the DB declaration in TIA Portal.
KEPServerEX exposes the tag set as an OPC UA endpoint by default at opc.tcp://<kepserverex-host>:49320. To consume the tags:
On the KEPServerEX side, secure the OPC UA endpoint properly before exposing it beyond the OT network:
The procedure above is for S7-1500. Quick notes on the rest of the family:
For a new Siemens S7-1500 connectivity project, the typical license bundle is the Siemens Plus Suite (covers S7-1200, S7-1500 with optimized blocks, plus the classic S7-300/400 driver and the LOGO! driver). For pure S7-300/400 brownfield, the Siemens Suite is sufficient.
Allied Solutions Global is an authorized Kepware (PTC) distributor across Southeast Asia. We support license sizing, deployment, and ongoing support from offices in:
If you want to keep TIA Portal’s default Optimized block access setting on your data blocks (recommended for new projects), you need the Siemens Plus Suite and the Siemens S7 Plus Ethernet driver. If you are willing to disable optimized blocks on every DB the OPC server reads, the standard Siemens Suite with the classic Siemens TCP/IP Ethernet driver is enough.
TCP port 102, the standard S7 communication port. Open it outbound from the KEPServerEX host to the PLC. The OPC UA endpoint that SCADA/historian/MES clients use is a separate listener — TCP 49320 by default on the KEPServerEX side.
Yes, provided the PLC protection level is set to Full access (no read-only restriction) and PUT/GET is permitted. Writes use the same S7 communication mechanism as reads. For safety-critical writes, route them through structured PLC interlocks rather than direct DB writes.
Yes. Add multiple devices under the same Siemens channel, each with its own IP and Rack/Slot. KEPServerEX serializes requests across devices on a channel, so for high-tag-count plants you can also split PLCs across multiple channels in parallel for throughput.
Install the KEPServerEX IoT Gateway plug-in. It adds MQTT and REST agents that publish any KEPServerEX tag to a broker (AWS IoT Core, Azure IoT Hub, HiveMQ, Mosquitto, or any Sparkplug B broker). Configure the agent with the broker URL, topic template, and the tags you want to publish.
Siemens HMI panels (KTP/TP/MP series) are themselves OPC clients — they don’t need KEPServerEX between themselves and the PLC. But if you want to historize HMI alarms in OSIsoft PI or Proficy Historian, KEPServerEX can pull data from the same PLC the HMI is talking to without affecting HMI performance.
The high-level pattern is the same — install KEPServerEX, add a channel, add a device, add tags, expose via OPC UA — but the specifics differ. We have a separate tutorial planned for connecting Allen-Bradley ControlLogix and CompactLogix PLCs to KEPServerEX. For now, see the KEPServerEX product page for the supported Allen-Bradley driver families.
Allied Solutions Global is an authorized Kepware (PTC) distributor across Southeast Asia. KEPServerEX, Kepware, and the Siemens Plus Suite are products of PTC Inc. SIMATIC, S7-1500, S7-1200, S7-300, S7-400, LOGO!, and TIA Portal are trademarks of Siemens AG.
Keep Reading
A practical, vendor-neutral comparison for plant engineers and OT architects. Why OPC UA replaced OPC DA, where DCOM still bites, how the security and information models differ, when to migrate, when to run both, and how KEPServerEX bridges the two.
GE Vernova sold its Proficy industrial software business to TPG in March 2026; the combined Proficy + Kepware + ThingWorx portfolio now operates as Velotic. We walk through what changed for Proficy HMI/SCADA (iFIX, CIMPLICITY), Historian, Plant Applications, Operations Hub, CSense and Scheduler โ and what stays the same for Singapore and Vietnam customers under Allied Solutions Global’s distributor support.
Overall Equipment Effectiveness (OEE) is the single most important productivity metric in manufacturing โ yet most plants in Singapore and Vietnam calculate it inconsistently or not at all. This guide gives you the exact formula, a worked example, the industry benchmarks Parsec publishes for TrakSYS deployments, and shows how a modern MES turns OEE from a monthly spreadsheet into a real-time decision tool.