Connecting Citect SCADA to PCS 7 CFC via SIMATIC NET OPC Server

1. Overview: PCS 7 + CFC + Third-Party HMI Architecture

Siemens PCS 7 is an integrated process control system in which WinCC Operator Station (OS) is not an optional add-on — it is the runtime environment for the standard PCS 7 faceplates, alarm line, and the OS server/client topology. Replacing WinCC with a third-party HMI such as Citect SCADA (now AVEVA Plant SCADA) breaks the PCS 7 concept but is technically possible when the customer mandates it.

The challenge is that PCS 7 programs built in CFC generate tag instances dynamically inside instance data blocks (DBs) tied to function block (FB) calls inside charts. There is no static tag list exported by default the way a WinCC OS compile produces one. Any third-party HMI must therefore expose those tags through one of four mechanisms covered in this article.

The reference architecture for the configurations described below is:

Citect IO Server  --OPC DA-->  SIMATIC NET OPC Server  --S7 (TCP/ISO)> AS 400 CPU
       (Citect SCADA)              (PC Station)                     (CFC program)

The driver alternative to OPC is PSDirect, a native Citect driver that talks to S7 PLCs over Industrial Ethernet or MPI/PROFIBUS. PSDirect bypasses OPC entirely and reduces one failure point, but it still requires a symbol table to map CFC tags to readable names.

2. Four Methods to Expose CFC Tags to a Third-Party HMI

2.1 Method 1 — Global DB Interface

Create one or more global data blocks (DBs not associated with an FB) that act as the HMI mirror. Inside the CFC, use READ/WRITE blocks or named I/O connections to copy process values from instance DBs into the global DB. The Citect tag database then references only the global DB.

Advantages: DB number is owned by the engineer and never re-numbered by STEP 7. Symbol table in STEP 7 maps cleanly to Citect variable names.

Disadvantages: All operator commands must be routed through this DB. PCS 7 operator commands inside faceplates are not linkable to a global DB by default; they are bound to the APL/standard faceplate I/O. You will need custom command blocks in CFC for every setpoint, mode selector, and start/stop.

2.2 Method 2 — Instance DB Symbolic

Every FB call in a CFC chart creates an instance DB. The instance DB number is assigned by STEP 7 during compile and can shift if the FB interface changes. Use CFC cross-reference (Options > Cross-References > Chart/Block) to resolve (Chart > Block > Instance DB number > Tag) relationships.

Export the cross-reference from the SIMATIC Manager and convert it to a STEP 7 symbol file (.sym) importable into the S7 program, or directly into Citect's variable tag database. The Citect OPC client then browses the symbolic namespace.

2.3 Method 3 — Instance DB Absolute

Hard-code DB number and offset (e.g. DB1050.DBX12.0) into Citect tags. The CFC cross-reference provides the lookup table. This is the fastest initial build but the most fragile: any change to an FB interface causes STEP 7 to re-issue the instance DB number for all instances of that FB type, and all absolute references become invalid.

2.4 Method 4 — PCS 7 OS OPC Server

Purchase a PCS 7 OS license (e.g. 1000 PO), add the OS as a PC Station in NetPro, compile the OS. The OS compile generates a tag list and exposes it through the built-in WinCC OPC DA Server with full symbolic names. You do not have to run the OS graphics; the runtime can be installed in Single-Station mode without WinCC Runtime licenses if you only need the OPC service. This is the highest-cost but lowest-risk option for ongoing maintenance.

3. SIMATIC NET OPC Server: Symbolic Data Inheritance

The SIMATIC NET OPC Server is bundled with the SIMATIC NET PC software and supports OPC DA 2.0 / 3.0 and OPC UA. The relevant configuration flag for this integration is "Symbolic Inheritance from S7 Programs".

3.1 HW Config of the PC Station

1. Open the PC Station in HW Config (SIMATIC Manager > right-click the PC Station > Open HW Config).
2. Insert an OPC Server application (catalog: SIMATIC PC Station > OPC Server).
3. Insert an Industrial Ethernet CP (e.g. CP 1613, CP 1623, or the softnet IE card) and assign a connection to the S7-400 CPU over TCP/RFC1006 or ISO-on-TCP.
4. Open the OPC Server object properties and check "Inherit all symbolic data of the S7 programs assigned to the connections" (or equivalent wording depending on SIMATIC NET version; in newer releases this is on the S7 connection properties).
5. Save and compile the HW Config.

3.2 NetPro Configuration

1. Open NetPro for the project containing the PC Station.
2. Add an S7 connection from the OPC Server to the AS 400 CPU.
3. Confirm the connection target is the CPU in the same STEP 7 project.
4. Save and compile NetPro. The configuration is downloaded to the OPC Server PC using Station Configuration Editor and the "Download Station" function.

3.3 Symbol Inheritance Mechanics

When the OPC Server downloads the configuration to the local PC, it reads the S7 program symbol tables from the project file. The OPC address space namespace is built from:

• Symbolic names from S7-Program > Symbols
• Symbolic names from instance DBs (DB name + element name)
• Global DB names and structure element names

The OPC browser will show an item path similar to:

S7:[S7-Program_1]Chart_1/MOTOR_SPEED
S7:[S7-Program_1]DB1050/MOTOR_SPEED_PV

4. Citect OPC Item Name Syntax

Citect's OPC client parses item names using the SIMATIC NET OPC Server syntax. The full syntax is documented in the Siemens FAQ How do you address S7 variables with the OPC server of SIMATIC NET?

Full item name examples:

// Symbolic - recommended
OPC:[AS400_OPC]S7:[S7-Program_1]Chart_1/MOTOR_SPEED

// Absolute - only if symbolic not available
OPC:[AS400_OPC]DB1050,REAL12

// Bit access
OPC:[AS400_OPC]DB1050,X12.0

4.1 Configuring the OPC Client in Citect

1. In Citect SCADA, open the Computer Setup Editor for the IO Server.
2. Add an OPC board of type OPC DA.
3. Add a port referring to the OPC Server ProgID. For SIMATIC NET OPC DA this is OPC.SimaticNET.
4. Add a logical connection name matching the NetPro connection (e.g. AS400_OPC).
5. In the Citect Variable Tags database, set the I/O Device field to the OPC port and the Address field to the item name as in section 4.
6. Compile and run the Citect IO Server.

5. Alternative: PSDirect Driver (No OPC Layer)

PSDirect is a native Citect driver that communicates with S7-300/S7-400 PLCs directly over Industrial Ethernet (TCP) using the S7 communication protocol. It bypasses SIMATIC NET and OPC entirely, removing a layer of configuration and a potential failure point.

5.1 When to Choose PSDirect

• Single-CPU or small project where OPC inheritance is not required.
• Customer mandates Citect and disallows additional third-party software on the IO Server PC.
• Symbolic access is not required, or the engineer is willing to maintain a manual symbol map.

5.2 Configuration Steps

1. Install the Citect PSDirect driver on the IO Server PC (bundled with Citect SCADA).
2. Configure the CPU's IP address, rack, and slot in the Citect port setup.
3. Define variable tags using PSDirect syntax, e.g. DB1050,REAL12 or symbolic names if you import a STEP 7 symbol file (.sdf).
4. Run the Citect driver trace to verify read/write PDUs.

6. PC Station + NetPro Prerequisites Checklist

7. Verification Procedure

1. Open the SIMATIC NET OPC Scout (Start > SIMATIC > SIMATIC NET > OPC Scout).
2. Add an S7 group and browse the server namespace.
3. Confirm that S7:[S7-Program_1] nodes are visible and that instance DBs appear with their element names.
4. Add a tag, force a value, and verify the IO Server in Citect receives the update.
5. In Citect, use the Citect Kernel page (Ctrl+K) and the Variable Tag diagnostic window to read raw values.
6. Force a write from Citect and confirm in the OPC Scout that the value arrives at the S7 CPU using VAT or PLCSIM.

8. Risk of Instance DB Re-Numbering After FB Interface Change

When you edit the input, output, or static interface of an FB in STEP 7 and re-compile the CFC, STEP 7 re-issues the instance DB number for all instances of that FB type across all charts that use it. Only the instance DBs for the modified FB type are renumbered — not the entire project — but the effect on HMI tag databases can still be large.

Mitigations:

• Always use Method 1 (Global DB) or Method 4 (PCS 7 OS OPC) for new projects to eliminate this risk.
• If using Method 2/3, re-export the CFC cross-reference and re-import the symbol table into Citect after every FB interface change. A pre-commit CI script that diffs the symbol table is recommended.
• Document FB interfaces as frozen versions in source control; treat FB interface changes as breaking changes for the HMI.

9. Troubleshooting Matrix

10. Field-Proven Recommendations

• Engage Siemens Application Engineering before a customer commits to PCS 7 + Citect. The license delta rarely justifies the engineering cost.
• If the customer must use Citect, push for Method 1 (Global DB interface). It is the only method that survives FB interface edits without re-engineering the HMI.
• If the customer insists on Method 4 (PCS 7 OS OPC), run the OS as a dedicated server. The PCS 7 OS license includes the OPC server and the OS single-station runtime.
• Always document the Citect tag database versioning in source control. Rebuilding 5000 tags after a DB shift is a multi-day job if the symbol export is not reproducible.
• Set up an OPC Scout test page on the engineering station so commissioning engineers can verify tag quality without Citect running.

11. Citect Resources and Documentation

Citect SCADA is now distributed as AVEVA Plant SCADA. The current AVEVA product pages and the historical Schneider Electric / Citect knowledge base contain the PSDirect driver documentation, OPC client setup, and tag import guides referenced in this article.

• AVEVA Plant SCADA (formerly Citect SCADA) overview
• PSDirect driver documentation — bundled with Citect SCADA installation media; see the Citect Driver Help within the Citect Explorer.

12. FAQ