Configuring WinCC as an OPC DA Server for Citect SCADA Client Communication

WinCC and Citect SCADA frequently co-exist on multi-vendor plant networks. The cleanest, vendor-supported mechanism for moving runtime tag data from a Siemens WinCC station to a Schneider Electric (now AVEVA) Citect SCADA station is OPC Data Access (OPC DA). This reference documents the complete configuration: WinCC runtime OPC server activation, Citect OPC client driver, Windows DCOM security, and step-by-step verification.

1. Architecture Overview

The integration is unidirectional data flow by default, but OPC DA supports both read and write. Two physical PCs on the same TCP/IP subnet (or routable network) participate:

• WinCC Station (Server) — Hosts the WinCC Runtime and exposes tags through the COM-based OPC DA server registered under the programmatic identifier OPCServer.WinCC.
• Citect SCADA Station (Client) — Runs the Citect OPC client driver, browses the network for OPCServer.WinCC, and subscribes to runtime tags.

Communication traverses TCP port 135 (RPC Endpoint Mapper) plus the dynamically assigned DCOM range (default 49152-65535 on modern Windows). The OPC DA 2.0/3.0 protocol rides on top of Microsoft COM/DCOM, not raw TCP, which is why DCOM configuration is mandatory on most Windows installations.

2. Prerequisites

2.1 Required User Account Model

For WinCC OPC access across machines, configure both PCs to use matching local accounts with identical passwords, or join both to an Active Directory domain. The OPC service must run under an account that the Citect client can authenticate. The simplest production pattern is to create a local user OPCUser on both machines with the same password and run the WinCC OPC server service under that identity.

3. WinCC OPC Server Configuration

No additional software installation is required on the WinCC station. The OPC server is registered automatically when WinCC Runtime is installed. The ProgID exposed to the network is OPCServer.WinCC and the CLSID is platform-specific.

3.1 Confirm the Server is Registered

1. On the WinCC PC, open Start → Run and enter dcomcnfg.
2. Navigate to Component Services → Computers → My Computer → DCOM Config.
3. Look for the entry OPCServer.WinCC. If present, the server is registered. If absent, restart the WinCC Runtime once; the registration runs on first RT start.

3.2 Start the WinCC Runtime

The OPC server only starts when WinCC Runtime is running. Activate the project via the WinCC Explorer (right-click project → Activate). The OPC server window icon appears in the Windows taskbar notification area. Right-click to confirm server state shows OPCServer-WinCC Vx.x - Service is running.

3.3 Configure WinCC Tags for OPC Access

By default, all internal tags and process tags inside the running WinCC project are accessible through OPCServer.WinCC. No additional tag-level configuration is required for read access. To restrict access, edit the OPCTags.csv file in the WinCC project directory and add a filter, or use WinCC User Administrator to assign tag-level read/write permissions.

4. Windows DCOM Configuration

DCOM security is the most common failure point in cross-machine OPC. Apply these settings on both the WinCC server PC and the Citect client PC.

4.1 Default DCOM Properties on the WinCC Server

1. Open dcomcnfg.
2. Right-click My Computer → Properties.
3. Tab Default Properties:
   • Enable Enable Distributed COM on this computer.
   • Default Authentication Level: Connect.
   • Default Impersonation Level: Identify.
4. Tab COM Security:
   • Access Permissions: Add Everyone (production: replace with OPCUser or domain group) → Allow Access.
   • Launch and Activation Permissions: Add Everyone or the service account → Allow Launch, Allow Activation.

4.2 OPCServer.WinCC-Specific Properties

1. In DCOM Config, right-click OPCServer.WinCC → Properties.
2. Tab General → set Authentication Level to Default.
3. Tab Location → enable Run application on the following computer and check Run application on this computer.
4. Tab Security → set all three (Launch, Access, Configuration) to Use Default or to a custom ACL containing the Citect client's service account.
5. Tab Identity → set to This user and enter the dedicated OPCUser account credentials. Avoid Launching User for cross-machine access.
6. Tab EndPoints → ensure Use default system endpoints is selected so DCOM dynamically negotiates the port range.

4.3 Windows Firewall Rules

On Windows 7 and later, allow the following inbound rules on both PCs:

• COM+ Network Access (DCOM-In)
• All Rules for the Application %SystemRoot%\System32\dllhost.exe (the DCOM surrogate)
• For static port management (recommended in plant networks), restrict DCOM to a fixed range, e.g. TCP 5000-5020, using netsh int ipv4 set dynamicport tcp start=5000 num=1021 and create explicit firewall rules.

For background on DCOM hardening, see the Siemens Application Note "Setting up DCOM for OPC Communication" and Microsoft KB Configure DCOM Application.

5. Citect SCADA OPC Client Configuration

Citect (AVEVA Plant SCADA) ships the OPC client driver as an optional component. The driver exposes OPC items as native Citect variables, so any PLC tag visible to WinCC can be brought into the Citect database.

5.1 Driver Architecture

The Citect OPC client is the multi-threaded Citect.exe host plus the in-process driver OPCClient.ctl. It uses OPC DA 2.0 (custom interfaces) by default. In current versions, the driver can be configured to also use OPC DA 3.0 (Automation interfaces) by toggling a registry key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citect\CurrentVersion\Drivers\OPCClient\UseDA3 = 1.

5.2 Add the OPC Server in Citect Project Editor

1. Open the Citect Explorer and load the target project.
2. Navigate to Communications → I/O Devices.
3. Right-click → Add I/O Device.
4. Name: WinCC_OPC. I/O Device Type: OPC. Address: leave blank for browsing.
5. In the Protocol field leave the default OPC driver.

5.3 Use the OPC Client Driver Configuration Tool

Open Start → Citect → Citect OPC Client Configuration (or CiOpC.exe on older installs). This launches a dialog that uses IOPCServerList to enumerate all OPC servers on a remote host.

1. Enter the WinCC server's UNC name or IP, e.g. \\PC-WINCC-01.
2. The tool enumerates OPCServer.WinCC. If it does not appear, the DCOM configuration is broken (see Section 7).
3. Select the server, then click Browse. The hierarchy opens, displaying all configured WinCC tag prefixes.
4. Add required tags to the Citect tag database — Citect automatically generates variable definitions of the form:
   WinCC_OPC_<TagName> with data type REAL, INT, STRING, etc., inherited from the WinCC tag type.

5.4 Citect Variable Definition Format

Refer to the AVEVA Plant SCADA / Citect documentation portal for current driver configuration: AVEVA Plant SCADA product page and the in-product Citect Help → Drivers → OPC Client.

6. Step-by-Step Commissioning Procedure

1. Verify network reachability from the Citect PC:
   ping PC-WINCC-01 must succeed.
2. Test DCOM plumbing on the Citect PC using PowerShell:
   Get-CimInstance -ComputerName PC-WINCC-01 -ClassName Win32_Process -Filter "Name='dllhost.exe'"
   If the call returns a process, DCOM is working. If it returns RPC unavailable, check firewall and DCOM defaults.
3. Activate WinCC Runtime on the server. Confirm the OPC server icon appears in the taskbar.
4. Launch the Citect OPC client configuration tool on the Citect PC and connect to \\PC-WINCC-01. Browse to OPCServer.WinCC.
5. Add at least three test tags with different data types (e.g. one BOOL, one REAL, one STRING).
6. Compile and start the Citect project. Open Cicode expression window and verify with:
   TagDebug(0, "WinCC_TIC_1001", 1) (logs the tag value once per second).
7. Force a tag change in WinCC (e.g. flip a bit in the WinCC Graphics Designer simulation) and confirm the change reflects in Citect within the poll group interval plus 200 ms.

7. Troubleshooting Matrix

8. Performance and Sizing Considerations

OPC DA 3.0 callbacks deliver updates asynchronously; OPC DA 2.0 typically uses polling. Citect's OPC client supports both via the UseDA3 registry flag.

• Default Citect poll group rates: Fast = 100 ms, Normal = 250 ms, Slow = 1000 ms.
• A single OPC client process can subscribe to ~5,000 items before COM marshaling becomes the bottleneck. For 10,000+ tags, deploy multiple Citect I/O servers each pointing at a different OPCServer.WinCC instance or partition tags by data rate.
• Average data throughput: ~50,000 value updates per second on a 1 Gbit/s LAN with modern Windows Server, using a 64-bit Citect host.

9. Common Configuration Pitfalls

10. Alternative Topologies

10.1 WinCC Professional (TIA Portal) to Citect

WinCC Professional ships the OPC UA Server as standard and exposes only OPC UA — there is no COM/DA server. Use the Citect OPC UA client driver (introduced in Citect 2016) and address the WinCC OPC UA endpoint at opc.tcp://<host>:4840. This is the recommended path for new deployments and removes DCOM configuration entirely.

10.2 WinCC V7.x to Citect via OPC UA Wrapper

For sites that want to keep WinCC V7 but eliminate DCOM, install a third-party OPC DA-to-UA bridge (e.g. the Siemens Application & Tools catalog for Softing opc-ua-gateway style products) on a third machine and point both servers at the gateway. Costs and license complexity must be weighed against the DCOM maintenance burden.

11. Documentation References

• Siemens WinCC V7.5 SP2 manual: WinCC V7.5 Communication Manual — OPC DA Server
• Siemens FAQ: "What steps are required to start up a WinCC station as OPC server?" — entry ID 21531482 in the Siemens Industry Online Support.
• Siemens FAQ: "Why are the DCOM settings of the WinCC OPC server reset after activating the OS Runtime?" — entry ID 26249862.
• Microsoft Learn: COM and DCOM reference.