Configuring WinCC Flexible OPC Server and OPC Client with S7-300

Overview

OPC (OLE for Process Control) provides a standardized, vendor-neutral interface for exchanging process data between automation devices, HMIs, and higher-level applications. When you run WinCC Flexible on a PC connected to a SIMATIC S7-300 controller, the runtime can act simultaneously as an OPC DA Server (data source) and an OPC DA Client (data consumer). This article documents a field-proven configuration where a single PC station performs both roles and exchanges tags with the S7-300 CPU over PROFIBUS DP, eliminating the need for a second WinCC Flexible installation and avoiding the complexity of DCOM.

The configuration pattern is suited to retrofit projects where the same engineering workstation must both visualize the process and forward selected tags to a third-party application such as Microsoft Excel, a custom .NET HMI, or a SCADA bridge. The pattern is also valid for production-line cells where a maintenance laptop must occasionally read live process data without disturbing the active HMI runtime.

OPC Architecture Fundamentals

OPC is a series of specifications maintained by the OPC Foundation. The three specifications relevant to WinCC Flexible runtime are:

For WinCC Flexible runtime, the only practical specification is OPC DA 3.0. Any client that supports DA 2.0a or 3.0 can browse the WinCC Flexible server, read items, and write items back to the S7-300.

Logical Flow of an OPC DA Transaction

When OPC Is Required vs Native S7 Communication

The most common misapplication of OPC is using it to connect a PC to the S7-300 when a native driver would suffice. Apply the decision matrix below before adding OPC complexity to a project.

If the only data consumer is the WinCC flexible runtime itself, OPC adds no value: configure the S7 connection inside the WinCC flexible project under Communication > Connections using the SIMATIC S7 300/400 driver. OPC is justified when a non-Siemens or non-WinCC-flexible consumer must read/write tags.

Prerequisites: Hardware, Software, and Licensing

Hardware

• S7-300 station with a PROFIBUS DP interface, e.g., CPU 315-2 DP (6ES7315-2AH14-0AB0) or CPU 317-2 DP (6ES7317-2AK14-0AB0).
• PC interface: CP 5611 (6GK1561-1AA01) PCI card, CP 5612 (6GK1561-2AA00), CP 5621 (6GK1562-1AA00), or USB PC Adapter USB A2 (6ES7972-0CB20-0XA0) for MPI/Profibus.
• PROFIBUS cable (6XV1830-0EH10) and PROFIBUS connectors with terminating resistors enabled at the two end nodes.

Software

• Windows 7 SP1 / Windows 10 (32-bit) or Windows Server 2008 R2. WinCC flexible 2008 SP5 is the last version with broad OS support; SP5 supports Windows 10 with the SIMATIC WinCC flexible 2008 SP5 Readme.
• WinCC flexible 2008 SP5 ES (Engineering) for project creation. RT (Runtime) license for the deployed PC.
• STEP 7 V5.5 + SP4 (or compatible) if the S7-300 program is also being edited on the same PC.
• SIMATIC NET PC software v8.x (includes the PROFIBUS driver and CP 5611/CP 5621 configuration tool "Set PG/PC Interface").

Licensing

The OPC DA Server functionality in WinCC flexible Runtime is enabled by the runtime license. No separate OPC option is required. However, the runtime license count must include the OPC channel if OPC items count toward the external tag limit of the license class (128 / 256 / 512 / 2048 / 4096 power tags).

Single-PC vs Multi-PC Deployment Decision Matrix

PROFIBUS Connection Setup Between PC and S7-300

The PROFIBUS link is independent of the OPC configuration but must be operational before any OPC item is updated.

1. Insert the CP 5611 / CP 5621 in the PC and install SIMATIC NET v8.x. Verify the driver is present under Device Manager > SIMATIC NET > CP 5611/CP 5621.
2. Open Set PG/PC Interface (Start > SIMATIC > SIMATIC NET > Set PG/PC Interface). Set the access point S7ONLINE to the entry CP 5611/CP 5621.PROFIBUS.1.
3. Set the PROFIBUS node address of the PC (typical default is 0 for PG/PC); the S7-300 CPU occupies its slot address (default 2).
4. Configure the PROFIBUS network in STEP 7 (HW Config) with the same transmission rate on both ends (1.5 Mbps recommended for < 100 m cable length).
5. Run a connectivity test: in STEP 7, choose PLC > Diagnostics/Scan for Accessible Nodes. The CPU must appear as Direct, online.

WinCC Flexible OPC Server Configuration

Once the WinCC flexible project is compiled and tested as an HMI, exposing its tags as OPC items is mostly a property toggle.

1. Open the WinCC flexible project in the ES.
2. Select the connection used to talk to the S7-300 (e.g., S7_300_PROFIBUS) and confirm the parameters match the CPU:

   Parameter	Setting
   Driver	SIMATIC S7 300/400
   PROFIBUS address (HMI station)	1 (example)
   PROFIBUS address (PLC)	2
   Slot / Rack	0 / 0 (CPU 315-2 DP)
   Cycle time	1 s (typical)

3. Open Project > Properties > OPC Server (or Options > OPC Settings on older builds). Enable the OPC DA Server check box.
4. Optionally restrict visibility: hide tags whose names start with an underscore or that reside in a designated internal area; the default exposes all external tags.
5. Compile the project with Project > Compiler > All. Verify there are zero errors and zero warnings of severity "Error".
6. Transfer the project to the target PC running WinCC flexible Runtime, or perform a Start Runtime > Locally from the ES for commissioning.

When the runtime starts, it registers the OPC server with the Windows registry under the programmatic identifier (ProgID) OPC.SimaticHMI.HmiRTm. The CLSID is documented in the WinCC flexible OPC server configuration manual. Clients connect to that ProgID.

WinCC Flexible OPC Client Configuration

WinCC flexible Runtime can simultaneously consume OPC tags from another server (for example, a SIMATIC NET OPC server, an external controller OPC, or a WinCC V7 station). This converts the local runtime into an OPC client.

1. Create a new Connection in WinCC flexible of type OPC.
2. Select the OPC server to subscribe to. Local single-PC deployments should browse to OPC.SimaticHMI.HmiRTm (the same WinCC flexible instance) or to a third-party server such as OPC.SimaticNet.S7OP when sourcing directly from the PLC.
3. Define the connection name (e.g., OPC_to_Excel_Bridge) and assign a refresh cycle (1 s default).
4. Add OPC tags via Tags > Add New Tag > OPC. Browse the remote server's namespace, select the source item, and map it to a local WinCC flexible tag.
5. Wire the local tag to the desired I/O field, trend, or alarm in a screen.

Because both the server and the client are inside the same WinCC flexible Runtime process, the data path is in-process COM and adds no measurable latency.

COM vs DCOM: When Each Applies

Common DCOM Pitfalls

• Different user accounts. If the OPC server runs as a service under SYSTEM and the OPC client runs interactively under DOMAIN\user, the DCOM negotiation fails with 0x80070005 - E_ACCESSDENIED. Set both to the same domain account, or use the Launch and Activation Permissions dialog in dcomcnfg to grant the interactive user explicit rights.
• Windows Firewall blocking RPC. Add an inbound rule for %SystemRoot%\System32\svchost.exe with the RPCSS service group, or open TCP 135 plus a static port range and constrain the DCOM application to that range via Default Protocols > Connection-oriented TCP/IP with a fixed port assignment.
• Anonymous Logon disabled. The Network access: Let Everyone permissions apply to anonymous users policy must be enabled, or you must explicitly add ANONYMOUS LOGON to the DCOM access list.

Verification and Testing with OPC Scout

OPC Scout (bundled with SIMATIC NET) is the canonical tool to validate the server before any custom client is deployed.

1. Launch Start > SIMATIC > SIMATIC NET > OPC Scout (V8.x) or the newer OPC Scout V10.
2. From the Server dropdown, select OPC.SimaticHMI.HmiRTm and click Connect.
3. In the item browser, navigate the WinCC flexible server namespace. Tags appear with their data type (VT_I2, VT_R4, VT_BSTR for strings, etc.).
4. Add an item to the watch window. Confirm a value appears within one cycle (default 1 s). Force a write to verify round-trip integrity.
5. For the PROFIBUS link, monitor the diagnostic buffer in STEP 7 (PLC > Diagnostic Buffer) and confirm no bus errors, station failures, or diagnostic interrupts are recorded.

Troubleshooting Matrix

Field-Proven Tips and Limits

• Item count ceiling. Practical OPC DA performance in WinCC flexible is acceptable up to roughly 2000 active items at a 1 s cycle. Beyond that, the runtime becomes the bottleneck before the bus is.
• String tags. VT_BSTR (string) items have higher per-item overhead. Group them on a slower 5 s cycle to keep the bus deterministic.
• Security hardening. WinCC flexible Runtime does not implement OPC security ticks (OPC DA 3.0 optional). Do not expose the OPC server endpoint to a public network; keep it on a plant LAN segment.
• Backup runtime behavior. The OPC server terminates when the WinCC flexible Runtime exits. If you need the OPC channel to survive a screen change, set the runtime to start in service mode (under Project > Properties > Runtime) so it remains a non-interactive session.
• Future migration. For new projects, prefer TIA Portal WinCC with OPC UA server. OPC UA removes the DCOM complexity, supports encryption, and is forward-compatible with Industry 4.0 architectures.

FAQ