Connecting to WinCC OPC DA and OPC UA Servers from VB.NET

Overview

Siemens WinCC (both the legacy WinCC V7.x and the current TIA Portal WinCC RT Professional runtime) exposes process tag values through an embedded OPC server. Two generations of this interface are in active use:

• OPC DA (Data Access) 2.0/3.0 — COM/DCOM based, the original channel used in WinCC V6, V7, and older WinCC RT Professional projects. The classic ProgID is OPCServer.WinCC.1.
• OPC UA (Unified Architecture) — TCP based, introduced in WinCC V7.2 and is the recommended channel in TIA Portal WinCC RT Professional V17 onward.

Both channels let a VisualBasic 2008 / VB.NET data-collection application read and write WinCC internal tags, archive tags, and alarm variables. This reference covers the ProgID, DCOM, sample code, and the migration path to OPC UA documented in TIA Portal V20.

WinCC OPC Architecture

WinCC Runtime acts as an OPC DA Server and (since V7.2) an OPC UA Server. External applications act as OPC Clients. The same instance can be a server to a SCADA tag on the engineering station and a client to a lower-level PLC OPC channel.

OPC DA ProgID Reference

Every COM/OPC DA server registers a programmatic identifier (ProgID) under HKEY_CLASSES_ROOT. The WinCC runtime registers the following ProgIDs after a complete install:

If the ProgID is not visible in the registry, the WinCC OPC channel was not installed. Reinstall WinCC with the "OPC" option ticked, or run RegAsm /codebase against the server DLL located in %ProgramFiles%\Siemens\Automation\WinCC\bin\.

Prerequisites

1. WinCC Runtime (V7.x or TIA Portal V20 RT Professional) installed and licensed on the server PC.
2. The WinCC project activated so the "WinCC Runtime" service is running — the OPC server only starts with the runtime.
3. SIMATIC NET installed if you plan to use the S7 OPC channel examples shipped under C:\Program Files\Siemens\SIMATIC_NET\Samples\OPC\.
4. On the client PC: the "OPC Core Components 2.00 Redistributable" (x86 for VB6/VB2008, x64 for newer .NET) and the OPCDAAuto.dll (Siemens OPC DAAutomation 2.0 wrapper).
5. Administrator rights on both machines to edit DCOM, Windows Firewall, and COM security.

VB.NET Sample Using OPC DAAutomation 2.0

The interface contract implemented by OPCDAAuto.dll is documented in the OPC Data Access Automation 2.0 Specification. The wrapper exposes four coclasses:

Add a COM reference in Visual Studio: Project → Add Reference → COM → "Siemens OPC DAAutomation 2.0". The reference embeds the RCW OPCDAAuto.dll from the WinCC bin folder.

' VB.NET 2008/2010+ — WinCC OPC DA read example
Imports OPCDAAuto

Module WinCCClient
  Private WithEvents opcGrp As OPCGroup
  Dim WithEvents srv As OPCServer
  Dim grps As OPCGroups

  Sub Main()
    srv = New OPCServer()
    ' Connect to local WinCC
    srv.Connect("OPCServer.WinCC.1", "127.0.0.1")
    Console.WriteLine("ServerState: " & srv.ServerState.ToString())
    ' Expected: OPC_STATUS_RUNNING = 1

    grps = srv.OPCGroups
    opcGrp = grps.Add("VBGroup")
    opcGrp.UpdateRate = 250           ' ms
    opcGrp.IsActive = True
    opcGrp.IsSubscribed = True        ' enable DataChange callback

    ' WinCC internal tag syntax <prefix>:<name>
    Dim itm As OPCItem
    itm = opcGrp.OPCItems.AddItem("Process.Pressure", 1)
    Console.WriteLine("Initial value: " & itm.Value)

    Console.ReadLine()
    srv.Disconnect()
  End Sub

  Private Sub opcGrp_DataChange(ByVal TransactionID As Integer, _
                                ByVal NumItems As Integer, _
                                ByRef ClientHandles As Array, _
                                ByRef ItemValues As Array, _
                                ByRef Qualities As Array, _
                                ByRef TimeStamps As Array) _
                                Handles opcGrp.DataChange
    For i As Integer = 0 To NumItems - 1
      Console.WriteLine(Now.ToString("HH:mm:ss.fff") & _
        " Handle=" & ClientHandles(i) & _
        " V=" & ItemValues(i) & _
        " Q=" & Qualities(i))
    Next
  End Sub
End Module

DCOM Configuration (Remote Client → Remote Server)

When the VB application and the WinCC OPC DA server are on different machines, DCOM must be configured on both ends. Default Windows security blocks anonymous access since Windows XP SP2.

1. Run dcomcnfg as administrator.
2. Component Services → Computers → My Computer → DCOM Config. Locate "OPCServer.WinCC". If absent, register it with regsvr32 OPCDAServer.dll from the WinCC bin folder.
3. Right-click → Properties:
   • General → Authentication Level: Connect (or None for lab test only).
   • Location: tick "Run application on the following computer" and enter the WinCC server hostname.
   • Security: add the client user account to Launch & Activation and Access permissions, allowing Local + Remote.
   • Identity: use "This user" and supply a domain service account that exists on both PCs.
4. On the WinCC server, open Windows Firewall with Advanced Security and allow OPCEnum (TCP 135) plus the dynamic DCOM range 49152–65535 (or a fixed range set via HKLM\Software\Microsoft\Rpc\Internet keys Ports, PortsInternetAvailable, UseInternetPorts).
5. On the client, allow outbound 135 and the same dynamic range.
6. Reboot both machines. Validate with the OPCEnum browser: \<server>\OPCEnum should list OPCServer.WinCC.1.

Migrating to OPC UA on TIA Portal V20

TIA Portal V20 documentation Using OPC in WinCC (RT Professional) states that the WinCC runtime ships with an OPC channel that can act as a client to DA or UA servers and exposes itself as an OPC UA server. The default server endpoint in V20 is:

opc.tcp://<wincc-pc>:4840
Security policies: None, Basic128Rsa15, Basic256, Basic256Sha256
Application URI: urn:<hostname>:WinCC-OPC-UA-Server

Activating the WinCC OPC UA Server in TIA Portal V20

1. In the TIA Portal project tree, right-click the HMI device → Properties → OPC UA Server.
2. Tick "Activate OPC UA Server".
3. Set the port (default 4840) and select the security policy and message mode. For a quick lab test, None + Sign is sufficient; production should use Basic256Sha256 + SignAndEncrypt.
4. Under Security → User authentication, add a user account or use certificate-based trust.
5. Compile and download to the RT Professional target.
6. Activate the project. The UA server endpoint becomes reachable as soon as Runtime starts.

This procedure matches Siemens KB article "Configure WinCC OPC UA Server — Communication" (ID 109755215).

VB.NET OPC UA Client (Modern Replacement)

After migration, the OPC DAAutomation wrapper is no longer needed. Use the open-source OPCFoundation.NetStandard.Opc.Ua.Client NuGet package. The replacement pattern is structurally identical to the DA sample above.

// .NET 6+ console client — WinCC OPC UA
using Opc.Ua;
using Opc.Ua.Client;

var cfg = new ApplicationConfiguration() {
  ApplicationName = "VBtoUA",
  SecurityConfiguration = new SecurityConfiguration {
    ApplicationCertificate = new CertificateIdentifier(),
    TrustedPeerCertificates = new CertificateTrustList()
  },
  TransportQuotas = new TransportQuotas() { OperationTimeout = 15000 }
};
await cfg.Validate(Opc.Ua.ApplicationType.Client);
var app = new ApplicationInstance(cfg);
await app.CheckApplicationInstanceCertificate(false, 0);

var endpoint = CoreClientUtils.SelectEndpoint(
  "opc.tcp://<wincc-pc>:4840", useSecurity: false);
var session = await Session.Create(cfg, endpoint, false,
  "VBtoUA", 60000, null, null);

var node = new NodeId("Process.Pressure", 2);   // ns=2 = WinCC default
var val = await session.ReadValueAsync(node);
Console.WriteLine($"Pressure = {val.Value} @ {val.ServerTimestamp}");

await session.CloseAsync();

Parameter & Error-Code Reference

Troubleshooting Matrix

Verification Checklist

• WinCC Runtime "Started", project "Active" in WinCC Explorer or TIA Portal "Online → Start Runtime".
• Client successfully calls Connect() without throwing — check ServerState == 1 (OPC_STATUS_RUNNING).
• A read on a known tag returns a numeric value, not a Quality = 0 (BAD) variant.
• DataChange callback fires at the requested UpdateRate ±20 %.
• After Disconnect(), Task Manager → Details on the server shows no orphaned CCExplorer.exe instances.

Field-Proven Caveats

• VB6 / VB2008 must run as a 32-bit process when using the classic OPCDAAuto.dll; loading the 64-bit variant raises 0x80040154 on a 64-bit client. Build the VB project with "Platform Target = x86".
• Tag browse via IOPCBrowseServerAddressSpace is throttled by WinCC — never call Browse() inside the DataChange loop; cache the handle list once.
• Archive tag reads on the HDA server require the WinCC archive segment to be open; a closed segment returns OPC_E_INVALIDHANDLE.
• On multi-user WinCC systems, the OPC server runs only on the server project; on client projects (WinCC Client), the OPC channel must be enabled in "Server Modules" and the client PC must trust the OPCEnum service account.
• For new deployments, prefer OPC UA on TIA Portal V20 — DCOM hardening in Windows 11 24H2 has tightened default ACLs and breaks many legacy DA configurations.

FAQ