News, Product | 26.06.2026

Siemens PLC to MQTT: Two Paths for Every Tag, No Re-Engineering

Connecting a Siemens PLC to MQTT is how factory data reaches the systems that act on it – historian, MES, analytics and the unified namespace that ties OT and IT together.

In a Siemens-powered plant, that data lives deep inside the PLC. The goal of a connected factory is simple: full Siemens PLC data access – every operationally relevant value the controller holds reaching the systems that act on it. While OPC UA is the standard starting point, the densest controllers often hold more than their built-in servers can expose. When you hit that ceiling, you need a second path: Siemens’ S7plus (S7+) protocol, native and high-performance, reaching past the built-in server’s limits.


Expert article by

Dr. Diwaker Jha
Industrial Connectivity Expert, Cybus


The Blind Spot: 16,000 Tags That Never Reach MQTT

For full Siemens PLC data access, every tag has to be reachable – yet the densest controllers hold more than the built-in server is sized to expose. Take a case we ran into in the field: a Siemens S7-1200 holding over 18,000 tags. The customer connected via OPC UA and the first couple of thousand tags flowed – then the count stopped just under 2,000. That is the server’s node cap, the number of tags it can expose. Live updates are a separate budget: about 1,000 monitored items at 1,000 ms sampling, dropping to roughly 100 when you need 100 to 500 ms. The remaining 16,000 tags were healthy and present, but they sat just past what the built-in server is sized to expose. For complex datatypes, it falls further still – to a few variables. Not enough for modern, data-rich production environments.

For a decision-maker, those locked tags aren’t just a technical hurdle; they are a blind spot. Your historian, MES and analytics dashboards can only optimize what they can see. In complex batch plants, the variables out of reach are often the ones that matter most: yield, energy efficiency and quality metrics. The breakthrough? The customer didn’t have to touch the controller. They simply opened the second path: native S7plus.

Getting Siemens data into MQTT isn’t a connector question, it’s an architecture decision: one path leaves tags behind, two paths leave nothing on the shopfloor.

— Dr. Diwaker Jha, Industrial Connectivity Expert, Cybus

OPC UA and S7plus: Two Paths from Siemens PLC to MQTT

Split the Controller, or Open a Second Path with S7plus

The traditional way past these limits is painful: “split” the controller. This involves adding new CPUs, spreading the logic across them and then performing a complete rewiring and revalidation. It is a capital-intensive project that demands significant downtime. 

A Factory Data Hub approach changes the math. By using S7plus – Siemens’ own native, high-speed protocol – you gain full visibility into the existing hardware. You keep the same CPU and the same program. You simply choose the right path for the volume of data required. Connectware speaks both, allowing you to lead with OPC UA and transition to S7plus as your data needs scale.

Bottom Line: Two Paths to Your Siemens Data, No Re-Engineering

Many platforms stop at the built-in server’s limit. Connectware speaks both OPC UA and native S7plus – two paths to your Siemens data.

The alternative to a second data path is re-engineering the controller: adding CPUs, rewiring and revalidating, with the line down throughout. Production stoppages are expensive – Siemens’ own True Cost of Downtime 2024 puts unplanned downtime at 11% of annual revenue for the world’s largest manufacturers. S7plus avoids that work entirely: same controller, same program, every tag.

As the single reliable source of truth between OT and IT, Connectware ensures your infrastructure never becomes your bottleneck. Whether you need the open standard of OPC UA or the full depth of S7plus, you have the road already paved. Don’t let a built-in server limit your factory’s intelligence.

Stop migrating data you can’t see

Every tag your built-in server hides is a blind spot in your historian, MES and analytics. Connectware gets all of them into MQTT – OPC UA first, native S7plus when you need every tag, no re-engineering.


How to Connect a Siemens PLC to MQTT: Quick Answers

  • How do you connect a Siemens S7-1200 to MQTT? Read the controller via OPC UA or the native S7plus protocol, then publish the normalized tags to an MQTT broker. Connectware handles both the southbound read and the northbound MQTT publish in one platform.
  • Why don’t all tags reach MQTT over OPC UA? The built-in OPC UA server on an S7-1200 caps at roughly 2,000 exposed nodes, regardless of how many tags the controller actually holds. Any tag beyond that ceiling never reaches your MQTT layer over OPC UA alone.
  • What is S7plus? S7plus (S7+) is Siemens’ native, high-performance protocol. Accessed via Connectware, it exposes every tag — over 18,000 in the field case above — with no node cap and read speeds around 40 ms (single) to 100 ms (complex), tested on the S7-1200.