Configuring WinCC Flexible ADS Driver for Beckhoff CX PLCs

Configuring WinCC Flexible ADS Driver for Beckhoff CX PLCs

The WinCC Flexible runtime is a Siemens HMI/SCADA visualization platform that ships with a fixed catalog of communication drivers. The Automation Device Specification (ADS) protocol used by every Beckhoff CX-series embedded controller (CX1010, CX1020, CX-8190, etc.) is not part of that out-of-the-box catalog. Originally, the ADS driver was delivered as a paid, customer-specific add-on referenced in older Beckhoff manuals as V1.3.0.0_0.01.0.1. This article documents the supported paths to integrate Beckhoff CX controllers with WinCC Flexible 2008 SP3 and later, including TwinCAT routing, AMS NetId parameters, port configuration, tag addressing, and verification. Because the legacy paid driver is no longer generally available, the engineer must use one of the documented alternatives covered below.

1. ADS Protocol Overview

ADS is Beckhoff's device-independent, router-based communication protocol. According to the Beckhoff Information System, the ADS protocol runs on top of TCP/IP or UDP/IP and uses the AMS NetId as a unique identifier for every TwinCAT runtime and every Windows endpoint participating in the routing table. The default ADS TCP port is 48898 (UDP/TCP), and the older broadcast port is 8016.

Key ADS Terms

2. Prerequisites

• WinCC Flexible 2008 SP3 or later (the 2008 SP3 release is the last build that has a documented ADS channel type; 2008 SP5 introduces additional fixes for AMS routing timeouts).
• TwinCAT 2.10 (Build >= 1540) or TwinCAT 3.1 (Build >= 4022) installed on the engineering PC for the route table editor.
• Beckhoff CX controller with a known AMS NetId (factory default is derived from the MAC address; the current value is read from C:\TwinCAT\3.1\Target\Plc\Port_851\Port_851.xml on the target after first boot, or via TcAdsServer API on the device).
• TCP/IP connectivity between the WinCC runtime PC and the Beckhoff CX. The CX-8190 supports ADS over TCP, ADS over UDP, ADS broadcast, and EAP (EtherCAT Automation Protocol) on its Ethernet ports.
• Administrator rights on the engineering PC to register the ADS router service and edit the route table.

3. Step-by-Step Configuration

3.1 Configure the Beckhoff CX PLC AMS NetId

1. On the CX controller, open TwinCAT System > Properties > AMS Router (TwinCAT 2) or TwinCAT > Router > Edit Routes (TwinCAT 3).
2. Confirm the AMS NetId. For a CX-8190 shipped with default settings, it is typically 5.1.27.4.1.1 where 5.1.27.4 reflects the controller's MAC OUI prefix 00-01-05-1B-04-xx style assignment. Adjust the last two octets to a static value if you operate multiple CX units on the same subnet.
3. Add a static route from the CX to the WinCC runtime PC. The route uses the PC's IP and the PC's AMS NetId.

3.2 Add the WinCC PC to the TwinCAT Route Table

The route table on the CX is the single source of truth for which AMS endpoints may talk to the controller.

1. From the engineering PC, run TcRouteSrv.exe (TwinCAT 2) or open the Route Table Editor (TwinCAT 3).
2. Click Add Route, select IP Address, and enter the runtime PC's IP (e.g. 192.168.1.50).
3. For Route Name / Address, enter the PC's AMS NetId (e.g. 5.1.27.1.1.1).
4. Click Add Route and authenticate using the CX user credentials.

3.3 Register the PC as an ADS Endpoint

1. On the WinCC PC, run TcRegSvr.exe "C:\TwinCAT\AdsApi\TcAdsDll.dll" from an elevated command prompt.
2. Confirm the AMS router service is running: sc query TcService should report RUNNING.
3. Open the TwinCAT System Service Configurator and verify the local AMS NetId matches the one added to the route table.

3.4 Configure the Connection in WinCC Flexible

1. In the WinCC Flexible project tree, expand Communications > Connections.
2. Right-click and select Add Connection.
3. From the driver dropdown, select Beckhoff ADS (visible only if the custom driver is installed; otherwise see Section 5 for alternatives).
4. Enter the parameters from the table below.

4. Tag Addressing

ADS uses a flat IndexGroup/IndexOffset address model. WinCC Flexible translates symbolic PLC tag names into the ADS handle once TwinCAT symbol initialization is enabled on the target (TwinCAT 2 menu: Project > Properties > Symbol Initialization; TwinCAT 3: System > Routes > Symbol Server). When symbol init is active, the HMI tag dialog shows PLC variables by name. If symbol init is disabled, use the raw handle syntax:

IndexGroup = 0x4040 (Input) | 0x4041 (Output) | 0x4020 (Memory)
IndexOffset = byte offset within the area
Length      = bit/byte/word/dword

Example: an INT input at PLC variable iCounter at byte offset 16 becomes 0x4040 / 0x10 / WORD in the tag dialog.

5. Recommended Alternatives to the Legacy ADS Driver

Because the historical ADS driver is no longer generally available, use one of the following supported paths:

5.1 OPC Classic via the Beckhoff OPC Server

1. Install TwinCAT OPC Server on the HMI PC (bundled with TwinCAT 3).
2. Add the OPC server as a WinCC Flexible channel of type OPC DA (DA = Data Access 2.0/3.0).
3. Browse the OPC namespace for the CX PLC symbols.
4. This path is supported up to WinCC Flexible 2008 SP5 and is the only Siemens-documented channel for ADS data on that release line.

5.2 OPC UA via the Beckhoff TF6100 OPC UA Server

Modern TwinCAT 3 builds ship with the TF6100 OPC UA server on the target. On WinCC Flexible 2008 SP5 and on WinCC Comfort/Advanced (TIA Portal) the OPC UA channel is supported. The CX-8190 is natively OPC UA-capable. Use this path for new deployments.

5.3 S7/S7+ Protocol with a TwinCAT Gateway

For sites already standardized on Siemens S7 communication, add a TwinCAT PLC HMI gateway that exposes the CX tag space as S7-compatible PUT/GET. The gateway runs on the HMI PC and uses ADS internally, so no ADS driver is required inside WinCC Flexible.

5.4 Beckhoff-native HMI Replacement

For new projects on a CX-8190, consider Beckhoff's own visualization tools (TwinCAT HMI, PLC HMI Web). The ADS protocol is then used end-to-end on Beckhoff-only hardware and software, eliminating the Siemens side of the integration.

6. Verification

1. On the engineering PC, run TcAdsTest.exe (TwinCAT 2) or the AdsBrowser (TwinCAT 3).
2. Enter the target AMS NetId (5.1.27.4.1.1) and port (801).
3. Read IndexGroup 0x4020, IndexOffset 0, Length 4. A successful return indicates the route and TCP port are functional.
4. Start WinCC Flexible Runtime. In the diagnostics view, confirm the channel reports Connected rather than Not connected / orange.
5. Force a known value in a PLC tag and confirm the WinCC tag updates within one update cycle.

7. Troubleshooting Matrix

8. Performance and Sizing

ADS over TCP/48898 has a typical round-trip latency of 1–3 ms on a 100 Mbit/s LAN. For an HMI scan class of 250 ms with 200 tags, expected bandwidth is roughly:

For 2,000 tags at the same scan time, bandwidth grows linearly to ~510 kbit/s, well within ADS and a 100 Mbit/s Ethernet. The bottleneck on large tag counts is the WinCC scan engine (limited to ~1,000 tags/second in the 2008 SP5 build), not ADS. Move high-frequency data acquisition to a dedicated TwinCAT task and only expose decimated values to the HMI.

9. Security and Network Hardening

• Restrict the TwinCAT route table to the specific HMI PC NetId; do not enable Add default route on the CX.
• Place HMI PCs and CX controllers on a private VLAN.
• Block TCP 48898 at the enterprise firewall; allow it only on the OT segment.
• Disable ADS broadcast (UDP 8016) when not used — it is the default discovery mechanism and a common scanning target.
• Use Windows authentication on the CX for route additions (TwinCAT 3.1 build 4024+).

10. Field-Commissioning Checklist

1. Document AMS NetId of every CX and every HMI PC on a sticker and in the project file.
2. Verify TwinCAT router service starts automatically after a reboot.
3. Export the CX route table to a backup file after every change.
4. Run TcAdsTest.exe for each connection at commissioning and again before handover.
5. Test WinCC Runtime for at least 30 minutes of continuous operation to catch intermittent route or symbol init issues.
6. Record PLC scan time under HMI load to confirm headroom for control tasks.

FAQ