Configuring Web-Based WinCC Runtime Access for S7-300 PC HMI

Overview: PC-Based HMI Runtime with Web Browser Sharing

Running a SIMATIC WinCC Runtime on a PC station, then exposing that runtime over the corporate network as a browser view for a second operator, is a standard SCADA architecture. The PC connects to an S7-300 CPU over PROFINET (or PROFIBUS via a CP), holds the runtime project, and serves the live screens through a built-in web server. A second workstation, tablet, or engineering office PC reaches the project by typing the server's IP address (or a fully qualified DNS name) into any modern browser - no local WinCC installation, no remote desktop, no per-client licensing beyond the connection contract.

Siemens offers two distinct PC-based runtime families inside TIA Portal, and the web capability you get depends entirely on which one you install:

• SIMATIC WinCC Unified (PC) - the newer, HTML5-native runtime. Web access is built in, served by the same process that drives the local screen, and is enabled by default once the runtime is started.
• SIMATIC WinCC Professional / WinCC Advanced (PC) - the classic WinCC line. Native web access requires the optional WinCC WebNavigator server add-on (ActiveX-based, Internet Explorer / Microsoft Edge IE-mode clients) or the WinCC WebUX add-on (HTML5-based, browser-agnostic).

The S7-300 side is identical in both cases: the PC station is a PROFINET IO device on the same subnet, communicating with the CPU through a standard S7 connection. The only difference is which HMI tags and which HMI connections you configure, and which runtime add-on handles the HTTP request.

Architecture Options Compared

Prerequisites

1. Engineering station: TIA Portal installed, with the same WinCC option as the target runtime (Unified or Professional). Open the same project on this PC to download / compile the runtime.
2. Runtime PC (the "server"): Windows 10 IoT Enterprise LTSC 2021, Windows Server 2019, or Windows Server 2022. Siemens maintains the exact OS compatibility list in the TIA Portal Readme / SIMATIC WinCC Unified Release Notes; verify against the installed TIA version before commissioning.
3. S7-300 CPU: Any CPU 31x-2 PN/DP or 31x-3 PN/DP with PROFINET interface. A separate CP 343-1 is required only if the CPU is a 31x (no PN) variant.
4. Network: Both PCs and the S7-300 must share a routable subnet, or the runtime PC must be reachable from the second PC. Layer 2 broadcast domain is the simplest; routing across VLANs is fine provided TCP port 443 (Unified) or 8080 / 80 (WebUX / WebNavigator) is allowed.
5. User accounts: Define at least one WinCC user with monitoring rights before the first login attempt, or the browser will display "No authorization".
6. Licenses: WinCC Unified PC RT license plus the required count of "Web Clients" (16 / 100 / unlimited). For Professional, the WinCC WebUX Power Pack or WinCC WebNavigator server license plus the matching client count.

S7-300 PROFINET Connection in TIA Portal

The HMI connection is independent of the web technology. Configure it once in the project, and the same tag database serves the local runtime, the web client, and any further client sessions.

1. In the TIA project tree, expand the PC station and double-click Devices & Networks.
2. Add the S7-300 CPU to the network view. The PROFINET interface of the CPU appears automatically.
3. Add the PC station's PROFINET interface (or the CP 1616 / CP 1623 card if used) and connect it to the CPU's PROFINET subnet.
4. Right-click the PC station → Properties → PROFINET interface → Ethernet addresses. Assign a fixed IP (for example 192.168.0.10 / 255.255.255.0) and a PROFINET device name (for example hmi-pc-01).
5. Right-click the S7-300 CPU → Properties → PROFINET interface → Ethernet addresses. Assign a fixed IP (for example 192.168.0.1) and the same subnet mask. If PROFINET device names are required, configure the device name on the CPU (or through the topology editor).
6. In the project tree of the PC station, open HMI tags. Create an S7 connection: protocol = S7, partner = the S7-300 CPU, rack / slot = 0 / 2 (CPU 315-2 PN) or 0 / 3 (CPU 317 / 319), partner IP = 192.168.0.1.
7. Add tags that map to DB addresses of the S7 program. Example: DB1.DBD0 as a Real tag named ProcessTemperature; DB1.DBX4.0 as a Bool tag named PumpRunning.
8. Compile the PC station and download to the runtime PC.

Option A - WinCC Unified PC with Built-In Web Client

Engineering the runtime

1. Add a new device SIMATIC PC station → SIMATIC WinCC Unified PC to the project.
2. Open the WinCC Unified configuration. Under Runtime settings → General, confirm the runtime name (defaults to the device name) and the start screen.
3. Build the screens in the Screens editor. Add faceplates, alarm views, trend views, and process tags as usual.
4. Configure users: Security → Users → Add user. Add at least one user, for example boss, with the function right View_Only. Do not assign the Operator right, otherwise the boss will see write-enabled widgets and could click them.
5. Compile the HMI project. Look for warnings about missing licenses, unsupported screen objects, or unconnected tags - all of these surface here, not at runtime.

Downloading and starting the runtime

1. Right-click the PC station → Download to device → Software (all). TIA Portal will transfer the compiled runtime, the HMI tags, and the alarms. The first download also installs the WinCC Unified Runtime services.
2. On the runtime PC, open the Unified Management Console (UMC). Confirm that the runtime is in the Running state.
3. The UMC exposes the runtime URL. By default the URL is https://<host>/. Open a browser on the runtime PC itself and test https://localhost/. The login screen of the runtime should appear.

Accessing the runtime from a second PC

1. On the second PC (the boss's workstation), open any current browser (Chrome, Edge, Firefox).
2. Type the URL of the runtime server: https://192.168.0.10/ (or the DNS name if registered in the corporate DNS). A certificate warning appears on the first connection because WinCC Unified generates a self-signed certificate.
3. Install the self-signed certificate into the Windows Trusted Root Certification Authorities store on the boss's PC, or import it through group policy. After that, the browser shows the lock icon and the login page is clean.
4. Log in with the configured user. The same screens the operator sees on the local monitor now render inside the browser, refreshed through a WebSocket connection.

User administration details

WinCC Unified stores users in the project database. By default, every user is a local user. For multi-site deployments, switch to a Windows domain authentication: Security → Settings → Authentication mode → Windows. After the switch, AD users log in with their domain credentials and the password is not stored in the runtime project.

Option B - WinCC Professional with WebUX

WebUX is the HTML5 successor of WebNavigator in the WinCC Professional line. It removes the ActiveX dependency, runs in any modern browser, and is the recommended web path for Professional projects that need to remain on the WinCC 7 / WinCC Professional feature set (e.g. the WinCC archive database, the WinCC UserArchive, or the WinCC option Process Historian).

Activating WebUX on the runtime PC

1. Install WinCC Professional Runtime on the PC station.
2. Install the SIMATIC WinCC WebUX add-on. The installer is on the TIA Portal installation media under Support → WebUX, or downloaded from the Siemens support portal. A separate license key is required (the "WebUX Power Pack").
3. Start WinCC WebUX Configurator. Enter the port (default 8080), enable HTTPS if a certificate is available, and select the WinCC project to publish.
4. In the WinCC project, open User Administrator. Add a user, assign the Web - monitoring only authorization level. Monitoring only removes the ability to write tags from the web client.
5. Compile and start the runtime. In the Windows notification area, the WebUX server icon must show a green "running" state.

Connecting from a browser

1. Open http://192.168.0.10:8080/ on the second PC.
2. The WebUX login page appears. The default URL parameter ?lang=en forces English. Other languages are available through the language pack installed with WebUX.
3. Log in. The web client opens the start screen defined in the WinCC project. If the start screen is empty, verify that the WebUX server is bound to the same project directory that the local WinCC Runtime is using.

Option C - WinCC Professional with WebNavigator (Legacy)

Use WebNavigator only if the boss's PC is locked to Internet Explorer, if you must reach a WinCC project that was originally written in WinCC V13 / V14, or if the corporate browser policy still mandates ActiveX. WebNavigator is fully supported by Siemens but is in maintenance mode; Siemens recommends WebUX for all new projects.

1. Install WinCC WebNavigator Server on the runtime PC.
2. Install WebNavigator Client on each user PC that needs full read/write access. For read-only monitoring, the WebNavigator Viewer (no local install) is sufficient.
3. Configure the WebNavigator server in the WinCC project. Web Navigator → Web Configurator. Define the publish port (default 80), the maximum number of simultaneous clients, and the timeout (default 30 s).
4. Distribute the WebNavigator client installer to user PCs through group policy or share, or point users to the IIS-hosted download page on the server (default http://<server>/WebNavigator/Client/).
5. The client PC must add the WebNavigator server URL to the Trusted sites zone of Internet Explorer / Edge IE mode, and ActiveX plug-ins must be enabled for that zone.

Network, Firewall, and Certificate Configuration

Firewall

On the runtime PC, open a PowerShell prompt as administrator and run, depending on the chosen web path:

# WinCC Unified (HTTPS default)
New-NetFirewallRule -DisplayName "WinCC Unified Web (443)" `
  -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow `
  -Profile Domain,Private

# WinCC WebUX
New-NetFirewallRule -DisplayName "WinCC WebUX (8080)" `
  -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow `
  -Profile Domain,Private

# WinCC WebNavigator
New-NetFirewallRule -DisplayName "WinCC WebNavigator (80)" `
  -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow `
  -Profile Domain,Private

Do not open the same ports on the S7-300 CPU - the CPU's integrated firewall is normally sufficient, and exposing port 102 (ISO-TSAP) to the corporate network is a known security incident vector.

Certificates (Unified and WebUX)

WinCC Unified ships with a self-signed certificate per runtime installation. Browsers will warn on the first connection. To remove the warning, replace the self-signed certificate with one issued by the corporate CA:

1. Generate a CSR from the WinCC Unified certificate store (IIS Manager → Server Certificates → Create Certificate Request).
2. Submit the CSR to the corporate CA, retrieve the issued certificate in .pfx format.
3. Complete the certificate request in IIS Manager and bind it to port 443.
4. Restart the WinCC Unified Runtime service. New browser sessions will pick up the new certificate automatically.

DNS and routing

For a small office, type the IP address directly. For multi-site, register a DNS A record: hmi.yourdomain.local → 192.168.0.10. Avoid NetBIOS names - browser caching of NetBIOS name lookups is unreliable and is increasingly disabled on Windows 11.

User Administration and Read-Only Restriction

For the boss's PC, configure the user with the least possible rights. Concretely:

• WinCC Unified: create a user group Monitoring. Assign the function right View_Only to the group. Add the user boss to Monitoring only. Do not add the user to Administrators or Operators.
• WebUX / WebNavigator: assign the level Web - monitoring only. In a WinCC Professional project this level is found under User Administrator → Authorizations → Web.

To enforce a hard read-only state, add the user group to the screen's Operator right events and leave them empty. Buttons that the user is not authorized for are then grayed out on the web client.

Performance and Sizing Notes

Web clients consume bandwidth roughly proportional to the screen refresh rate, the number of trend curves, and the number of alarms visible. A read-only monitoring screen at 1 Hz with 50 tags and 4 trend curves uses on the order of 200-400 kbit/s per client. With 10 clients, budget 2-4 Mbit/s of LAN capacity - trivial on a corporate network, but relevant on a VPN or a wireless link.

For deployments with more than 20 concurrent web clients, consider a dedicated redundant WinCC Unified server pair rather than a single PC, and verify the S7 connection's polling cycle (default 1 s). Polling at 100 ms multiplies the tag load by 10 and is rarely needed for monitoring.

Verification and Commissioning Checklist

1. Local runtime visible. Open the runtime on the server PC, confirm the start screen renders and the values update as expected.
2. S7 connection healthy. In the runtime diagnostics (WinCC Unified: UMC → Diagnostics; WinCC Professional: WinCC Explorer → Tools → Status of connections), confirm the S7 connection is Connected and the last update time is < 1 s.
3. Loopback web access. From the server PC, open a browser and navigate to https://localhost/ (or http://localhost:8080/ for WebUX). Log in. Confirm the start screen is identical to the local runtime.
4. Cross-PC web access. From the boss's PC, open the same URL with the server's IP or DNS name. Confirm the certificate is trusted (or the user has accepted the warning), the login succeeds, and the screens refresh in real time.
5. Read-only enforcement. Log in as the boss on the web client. Try to operate a button configured with a write tag. The button should be either grayed out or trigger a "no authorization" message. The local WinCC operator account must still be able to write.
6. Disconnect / reconnect. Disconnect the S7 cable from the CPU. The web client should show the last known values with a "connection lost" indicator within 5-10 s. Reconnect the cable; the connection should recover without restarting the runtime.
7. Bandwidth test. Run a 10-minute monitoring session. Watch the runtime PC's network adapter in Resource Monitor. Confirm that the average traffic to the boss's PC is within the 200-400 kbit/s budget.

Troubleshooting Matrix

Selecting the Right Path for Your Project

For a brand-new S7-300 monitoring project where the only requirement is "the boss sees the same screen I see, in a browser, with no controls", the cleanest architecture is:

• One PC station with SIMATIC WinCC Unified PC Runtime (TIA V18 or V19).
• One S7 connection over PROFINET to the S7-300 CPU.
• One WinCC Unified Web Client license (16 / 100 / unlimited).
• One browser on the boss's PC, pointing at https://<runtime-pc>/.

For existing WinCC Professional / WinCC Advanced projects, retrofit with WinCC WebUX rather than WebNavigator. WebUX uses the same screens, the same tag database, and the same alarms as the local WinCC Runtime; the only addition is the WebUX Power Pack and the matching client count. WebNavigator should be reserved for projects that must run inside Internet Explorer for policy reasons, or for very old projects that cannot be recompiled against a newer WebUX release.

For deployments that will eventually scale to many concurrent web clients, to a redundant server, or to a tablet-based operator view, plan the migration to WinCC Unified now: the engineering effort is one project rewrite, and the operational benefit (HTML5, responsive layouts, no plug-ins, no IE) is permanent.