Configuring SCALANCE W786/W746 for PC-to-PC Data Transfer

Application Overview

Industrial environments frequently require wireless data exchange between two PCs where a wired Ethernet drop is impractical. A canonical example is a moving crane whose on-board PC must continuously report status, load, and operational data to a stationary server PC in the control room. The SCALANCE W786 (access point) and SCALANCE W746 (client) provide the physical-layer bridge that makes this link possible.

Unlike consumer-grade Wi-Fi hardware, the SCALANCE W family is engineered for industrial deployment: metal housings, extended temperature range, IP65 protection, deterministic roaming behavior, and IT-security features aligned with IEC 62443. Once the radio link is established, the W786/W746 pair presents itself to the application as a transparent Ethernet segment, leaving the choice of application-layer protocol entirely to the developer.

Two application-layer approaches dominate this class of problem:

• TCP/UDP socket programming - direct, low-overhead, language-agnostic.
• OPC UA - structured data modeling, built-in security, vendor-neutral.

The remainder of this article covers hardware selection, IP-layer setup, configuration steps for both devices, and both application-layer options with working code samples.

SCALANCE W786 and W746 Hardware Specifications

Both devices belong to the SCALANCE W700 iWLAN family. The W786 operates as a standalone access point, while the W746 functions strictly as an iWLAN client. Operating instructions and the latest firmware for both devices are available on the Siemens Industry Online Support portal.

Network Architecture and IP Planning

Treat the radio link as one IP subnet. The W786 acts as the bridge root, and the W746 forwards Ethernet frames from the crane PC into the wired segment through the established association. Both PCs must be on the same subnet (Layer 2 adjacency) for the simplest deployment, or routed through the W786 with care to avoid asymmetric routing on roaming.

For deployments that route through the plant backbone, place the W786 wired interface on the plant VLAN and the wireless side on a dedicated iWLAN VLAN, then forward at the Layer-3 boundary. Avoid placing the moving PC on the same broadcast domain as IT-managed office devices, to limit broadcast storms and ARP overhead during roaming.

iWLAN Configuration Prerequisites

1. Inventory both devices. Confirm the W786 supports Access Point mode and the W746 is in Client mode. W786 can also be configured as a Client, which would invert the topology and is not what is wanted for this crane use case.
2. Document the SSID, security mode, and pre-shared key (or RADIUS credentials) for both radios.
3. Document antenna gain and cable loss. Mismatched EIRP between AP and client does not prevent association but reduces link margin.
4. Connect the W786 Ethernet port to the plant network (or directly to the server PC for bench test).
5. Connect the W746 Ethernet port to the crane PC.
6. Power both devices from a 24 V DC industrial supply or PoE+ source per the device label.

Configuration can be performed through the Web-Based Management (WBM) interface, the Command Line Interface (CLI) over SSH, or centrally through TIA Portal / SINEC NMS. The WBM path is the fastest for a two-device deployment.

W786 Access Point - WBM Configuration Steps

1. Default IP out of the box is 192.168.1.1 on VLAN 1. Connect a service laptop, set the laptop to 192.168.1.100/24, and open https://192.168.1.1.
2. Log in with the default credentials shipped on the device label, then change the password immediately.
3. Navigate to Layer 2 > WLAN > Basic and set:
   • Country: select the country of operation to enforce the regulatory channel set.
   • Operation mode: Access Point.
   • Radio: enable the band matching the W746 variant (2.4 GHz or 5 GHz).
   • Channel: static channel recommended for predictable latency (DFS channels require CAC delay after power-up).
   • Max Tx power: leave at default unless a site survey demands reduction.
4. Navigate to Layer 2 > WLAN > Security:
   • Set SSID (e.g., CRANE_LINK).
   • Security mode: WPA2-PSK (AES) or WPA2-Enterprise with RADIUS.
   • Pre-shared key: minimum 20 random characters for PSK mode.
5. Navigate to Layer 3 > IP Configuration and assign the static IP/subnet listed in the planning table.
6. Save and reboot. The W786 is now ready for association.

W746 Client - WBM Configuration Steps

1. Default IP is 192.168.1.2. Connect a service laptop, set the laptop to 192.168.1.100/24, and open https://192.168.1.2.
2. Navigate to Layer 2 > WLAN > Basic and set:
   • Operation mode: Client.
   • Radio band: must match the AP.
   • Channel selection: leave on Auto or pin to the AP's static channel.
3. Navigate to Layer 2 > WLAN > Security:
   • Enter the same SSID and PSK as the W786.
4. Navigate to Layer 3 > IP Configuration and assign the static IP/subnet.
5. Save and reboot. The W746 scans, finds the SSID, and associates.

TIA Portal Centralized Configuration

For fleets of SCALANCE W devices, configure from TIA Portal through the project tree. Add the W786 and W746 as devices, push a shared WLAN profile, and let SINEC NMS distribute updates. This is the practical method when site security mandates individual PSK rotation per device.

Layer 3 Verification Before Application Development

Before writing any application code, prove the link end-to-end at the IP layer. Skip this and you risk debugging an OPC stack when the actual problem is a stuck WPA2 handshake.

Step-by-Step Verification

1. From the server PC, ping the W786 wired IP: ping 192.168.1.1.
2. From the server PC, ping the W746 IP: ping 192.168.1.2. If this fails, the W746 is not yet associated or the W786 has not forwarded the client into the wired side.
3. From the server PC, ping the client PC behind the W746: ping 192.168.1.20.
4. From the client PC, ping the server PC: ping 192.168.1.10.
5. Run a sustained iperf3 TCP test for 5 minutes to validate throughput and surface any roaming events: iperf3 -c 192.168.1.10 -t 300 -i 5.

All five checks must pass before moving on. If a ping passes but iperf3 throughput drops below expectations, suspect antenna alignment or RF interference rather than the application.

Application Communication Options Compared

The choice between sockets and OPC UA is not primarily about which is easier. It is about how much structure the data needs.

TCP Socket Implementation

TCP is the right starting point when the data is small (a string status message), reliability is required, and the application has no need for browse-able data modeling. The .NET TcpListener / TcpClient classes are the most direct path on Windows PCs.

Server Side (Control Room PC) - C#

using System;
using System.IO;
using System.Net;
using System.Net.Sockets;
using System.Text;
using System.Threading.Tasks;

class TcpServer
{
    static async Task Main()
    {
        var listener = new TcpListener(IPAddress.Any, 5000);
        listener.Start();
        Console.WriteLine("Server listening on 0.0.0.0:5000");

        while (true)
        {
            TcpClient client = await listener.AcceptTcpClientAsync();
            _ = HandleClientAsync(client);
        }
    }

    static async Task HandleClientAsync(TcpClient client)
    {
        using (client)
        using (var ns = client.GetStream())
        using (var reader = new StreamReader(ns, Encoding.UTF8))
        using (var writer = new StreamWriter(ns, Encoding.UTF8) { AutoFlush = true })
        {
            string payload = await reader.ReadLineAsync();
            Console.WriteLine($"Received: {payload}");

            // Persist to database here ...

            await writer.WriteLineAsync("ACK:" + DateTime.UtcNow.ToString("o"));
        }
    }
}

Client Side (Crane PC) - C#

using System;
using System.Net.Sockets;
using System.Text;
using System.Threading.Tasks;

class TcpClientApp
{
    static async Task Main()
    {
        while (true)
        {
            try
            {
                using var client = new TcpClient();
                await client.ConnectAsync("192.168.1.10", 5000);
                using var ns = client.GetStream();
                using var reader = new StreamReader(ns, Encoding.UTF8);
                using var writer = new StreamWriter(ns, Encoding.UTF8) { AutoFlush = true };

                await writer.WriteLineAsync("CRANE_STATE:HOIST_AT_5M,LOAD_2T");
                string ack = await reader.ReadLineAsync();
                Console.WriteLine($"Server: {ack}");
            }
            catch (Exception ex)
            {
                Console.WriteLine($"Comm error: {ex.Message}");
            }
            await Task.Delay(TimeSpan.FromSeconds(1));
        }
    }
}

Python Equivalent (Server)

import socket
import threading

def handle(conn, addr):
    with conn:
        data = conn.recv(4096).decode('utf-8').strip()
        print(f"[{addr}] -> {data}")
        conn.sendall(b"ACK:" + str.encode(__import__('datetime').datetime.utcnow().isoformat()))

srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
srv.bind(("0.0.0.0", 5000))
srv.listen(8)
print("Server on 0.0.0.0:5000")
while True:
    c, a = srv.accept()
    threading.Thread(target=handle, args=(c, a), daemon=True).start()

UDP Socket Implementation

Use UDP only if the data is frequent, small, and stale data has no value (e.g., periodic position updates). Add a sequence number and application-level acknowledgement if you need any reliability, because UDP provides none. Typical SCALANCE W latency is 1-5 ms across a single hop, so UDP over iWLAN is reasonable for control loops up to 50 Hz.

import socket, struct, time

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.bind(("0.0.0.0", 5001))
seq = 0
while True:
    payload = struct.pack("!I", seq) + b"POS_X=12.4,POS_Y=3.1\n"
    sock.sendto(payload, ("192.168.1.20", 5001))
    seq += 1
    time.sleep(0.02)

OPC UA Server / Client Implementation

When the data set grows beyond a single string or when the server-side data must be browsed by SCADA, OPC UA is the correct answer. OPC UA is vendor-neutral, runs over TCP, and provides authentication, encryption, and structured information modeling. The reference .NET SDK is the OPC Foundation .NET Standard stack, available from the OPC Foundation.

OPC UA Server Skeleton (Control Room PC) - C#

// Requires OPCFoundation.NetStandard.Opc.Ua NuGet package
using Opc.Ua;
using Opc.Ua.Server;

public class CraneServer : StandardServer
{
    protected override void StartApplication()
    {
        base.StartApplication();
        // Add custom node manager for crane data points here.
    }
}

// Startup in Program.cs
var config = new ApplicationConfiguration
{
    ApplicationName = "CraneServer",
    ApplicationUri  = "urn:siemens:crane:server",
    ApplicationType = ApplicationType.Server,
    ServerConfiguration = new ServerConfiguration
    {
        BaseAddresses = { "opc.tcp://192.168.1.10:4840" }
    },
    SecurityConfiguration = new SecurityConfiguration
    {
        AutoAcceptUntrustedCertificates = true  // development only
    }
};
await config.Validate(Opc.Ua.ApplicationType.Server);
await new CraneServer().StartAsync(config);
Console.WriteLine("OPC UA server running. Press any key to exit.");
Console.ReadKey();

OPC UA Client Skeleton (Crane PC) - C#

var endpoint = new Uri("opc.tcp://192.168.1.10:4840");
var discovery = new DiscoveryClient(endpoint);
var endpoints = discovery.GetEndpoints();
var selected = SelectEndpoint(endpoints, 192.168.1.10);
var session = await Session.Create(selected, false, "CraneClient", 60000);
try
{
    string value;
    do
    {
        DataValue dv = await session.ReadValueAsync("ns=2;s=CraneState");
        value = dv.Value.ToString();
        Console.WriteLine($"Server value: {value}");
        await Task.Delay(1000);
    } while (value != "STOP");
}
finally
{
    session.Close();
}

Industrial Alternative Protocols

If the server PC runs Siemens software such as WinCC, or if the data feeds a SIMATIC S7 PLC, additional options open up:

• S7 Communication - native to SIMATIC. The server PC uses libnodave or the Snap7 open-source library to read/write DBs on a PLC that fronts the crane data.
• Modbus TCP - register-oriented, simple, available on most SCADA packages. Use port 502.
• MQTT - lightweight pub/sub. A broker (Mosquitto, HiveMQ) can sit on the server PC; the crane publishes to topics.
• OPC UA Pub/Sub over UDP - the brokerless variant of OPC UA, ideal for fan-out from a moving device.

Security Hardening for Production Deployment

A lab bench configuration will not survive an audit. Apply these controls before going live.

1. Replace WPA2-PSK with WPA2-Enterprise (802.1X) backed by a RADIUS server. Use EAP-TLS with client certificates if the crane PC supports certificate storage.
2. Disable the W786 management interfaces on the wireless side. Move WBM, SSH, and SNMP to the wired interface only.
3. Enable MAC ACL on the W786 as a second factor.
4. For OPC UA, replace the development-only AutoAcceptUntrustedCertificates = true with a real certificate trust list and use SecurityPolicy Basic256Sha256 or stronger.
5. Firewall the server PC: only the chosen application port should be reachable from the iWLAN VLAN.
6. Rotate PSKs/certificates on a defined schedule. SCALANCE W supports central key rollout through SINEC NMS.

Troubleshooting Matrix

Field Commissioning Checklist

1. W786 firmware matches W746 firmware major version - verify on Siemens Industry Online Support release notes.
2. Both devices share the same NTP source for consistent log timestamps.
3. SNMP traps enabled on both devices toward the network management station.
4. Spare antennas and PoE injectors stocked on site.
5. Documented recovery procedure: how to force a W746 re-association (power cycle, or CLI restart).
6. Latency baseline recorded at four crane positions: home, mid-bay, far end, full traverse.
7. Throughput baseline (iperf3 TCP) recorded at the same four positions.
8. RF site survey repeated annually - antenna masts shift, new metal structures change the multipath profile.

Edge Cases and Field-Proven Caveats

Three recurring issues are worth calling out specifically because they are not obvious from the manuals:

1. W746 client isolation after a power blip. If the crane loses 24 V briefly while the W786 stays up, the W746 may fail to re-associate without a manual restart. Enable the W746's automatic reconnection interval (CLI: wlan auto-reconnect) and watchdog timeouts so a brownout does not require an operator visit.
2. DFS channels in 5 GHz. If a DFS channel is selected and a radar pulse is detected, the AP must vacate the channel for 30 minutes (CAC delay). For predictable latency on a moving crane, pin the AP to a non-DFS channel.
3. MTU mismatches on long cable runs. Jumbo frames enabled on the W786 with a default-MTU server PC will produce silent fragmentation and TCP throughput loss. Either match MTU end-to-end or leave both at 1500.

FAQ