Connecting WinCC to C# and SQL Server: OPC DA, DCOM, IDB Guide

1. Overview

Siemens WinCC (TIA Portal / V7) exposes runtime data through three well-supported channels: an internal OPC DA Server (built-in, no extra license), the Connectivity Pack / WinCC DataMonitor (OLE DB / SOAP / OPC XML / WinCC OLE DB provider), and the Industrial Data Bridge (IDB) add-on for declarative tag-to-database bridging. A C# application can read and write WinCC tags through any of these paths and, in the same process, persist values to Microsoft SQL Server using ADO.NET or the WinCC SQL Provider.

This reference covers all four integration paths, the DCOM configuration required to traverse a LAN, the error matrix that appears in field deployments, and the C# code skeleton for an OPC DA 3.0 client built against OPC Foundation .NET API or OpcNetApi.

2. Architecture Options

For a C# application on a remote workstation, the canonical path is OPC DA over DCOM. For historical reads from the WinCC archive database, use the WinCC OLE DB Provider through Connectivity Pack. For a managed, point-and-click bridge without writing any C# code, use IDB.

3. Prerequisites

1. WinCC Runtime V7.2 / V7.3 / V7.4 / V7.5 (or WinCC Professional in TIA Portal) installed and running in Runtime.
2. The WinCC OPC DA Server process OPCServer.WinCC registered as a local COM service. Verify with opcenum.exe on the WinCC station - the server should appear under OPC Servers > OPCServer.WinCC.
3. Windows user accounts with identical username and password on both the WinCC station and the C# client station. Mismatched credentials are the leading cause of Access is Denied (0x80070005) failures.
4. DCOM configured on both machines (see Section 9).
5. For SQL Server integration: SQL Server 2014 / 2016 / 2017 / 2019 (Express is sufficient for tag mirroring), TCP port 1433 reachable, SQL authentication or trusted Windows authentication.
6. C# development environment: Visual Studio 2010 or later, .NET Framework 4.x or .NET 6/7/8 with COM interop enabled.

4. Method 1 - OPC DA Client in C#

The OPC Foundation .NET API (or the older OpcNetApi.dll) allows any .NET application to enumerate the WinCC OPC server, browse tags, subscribe to data changes, and synchronously read/write values.

4.1 Add References

• OpcNetApi.dll (v2.x) - browse, sync I/O, subscription
• OpcNetApi.Com.dll - COM interop wrapper
• Add using Opc;, using Opc.Da;

4.2 Connect to WinCC OPC Server

using Opc;
using Opc.Da;

// Replace 192.168.2.252 with the WinCC Runtime station IP or hostname
string serverUrl = "opcda://192.168.2.252/OPCServer.WinCC";

Opc.Da.Server server = null;
try
{
    server = new Opc.Da.Server(new OpcCom.Factory(), null);
    server.Url = new Opc.URL(serverUrl);
    server.Connect();
    // server.IsConnected == true on success
}
catch (OpcConnectException ex)
{
    // 0x80070005 = Access Denied (DCOM)
    // 0x80040154 = Class not registered (OPC service not running)
    // 0x800706BA = RPC server unavailable (firewall / service down)
    Console.WriteLine($"OPC connect failed: 0x{ex.Result.Code:X8}");
}

4.3 Browse and Read Tags

// Browse the flat namespace (use BrowseFilters.Flat)
BrowsePosition position = null;
BrowseElement[] elements = server.Browse(
    new ItemIdentifier(""),
    new BrowseFilters { BrowseFilter = browseFilter.flat, ElementNameFilter = null },
    out position);

foreach (BrowseElement el in elements)
{
    Item item = new Item(new ItemIdentifier(el.ItemName), true, 0);
    ItemValueResult[] result = server.Read(new Item[] { item });
    Console.WriteLine($"{el.ItemName} = {result[0].Value}");
}

4.4 Subscribe to Data Changes

Subscription subscription = null;
SubscriptionState state = new SubscriptionState
{
    Name = "WinCC_Sub",
    Active = true,
    UpdateRate = 250,           // ms
    Deadband = 0.0f,
    KeepAlive = 1000            // ms
};
subscription = (Subscription)server.CreateSubscription(state);

Item[] items = new Item[]
{
    new Item(new ItemIdentifier("S7_Program::DB1::Tag1"), true, 0),
    new Item(new ItemIdentifier("S7_Program::DB1::Tag2"), true, 0)
};
subscription.AddItems(items);
subscription.DataChanged += OnDataChanged;

// Handler signature
private static void OnDataChanged(object sender, DataChangedEventArgs e)
{
    foreach (ItemValueResult iv in e.Values)
        Console.WriteLine($"Change: {iv.ItemName} = {iv.Value} @ {iv.Timestamp}");
}

4.5 Write a Value

ItemValue itemValue = new ItemValue
{
    ItemName = "S7_Program::DB1::Tag1",
    Value = 1234
};
IdentifiedResult[] writeResult = server.Write(new ItemValue[] { itemValue });
// writeResult[0].ResultId.Succeeded == true on success

5. Method 2 - Connectivity Pack / DataMonitor (OLE DB)

The WinCC Connectivity Pack (license 6AV6371-1DR07-... or as part of DataMonitor) exposes the runtime archive, alarm log, and tag table through an OLE DB provider accessible to any ADO.NET consumer.

5.1 Connection String

Provider=WinCCOLEDBProvider.1;
Catalog=CC_Engineering_15_08_19_12_00_00;
Data Source=192.168.2.252\WinCC

The Catalog is the WinCC project name; Data Source is the SQL Server instance created during WinCC install (default \WinCC).

5.2 Read Archived Process Values

using (OleDbConnection conn = new OleDbConnection(connString))
{
    conn.Open();
    string sql = @"SELECT * FROM TAG:R,'S7_Program::DB1::Motor_Speed','0000-00-00 00:10:00.000','0000-00-00 00:11:00.000'";
    using (OleDbCommand cmd = new OleDbCommand(sql, conn))
    using (OleDbDataReader dr = cmd.ExecuteReader())
    {
        while (dr.Read())
            Console.WriteLine($"{dr["Timestamp"]} {dr["RealValue"]}");
    }
}

Read the official WinCC Connectivity Pack manual for the full SQL-like syntax: Siemens Entry ID 102628683 - WinCC Connectivity Pack documentation.

6. Method 3 - Industrial Data Bridge (IDB)

IDB is a Windows service shipped with WinCC that can mirror tags from any OPC DA / OPC UA source (including OPCServer.WinCC) into SQL Server, Oracle, MySQL, SAP RFC, or a text file - with no custom code. The agent is configured through the IDB Configurator GUI on the WinCC station.

Official Siemens entry for IDB: Entry ID 73968374 - WinCC Industrial Data Bridge. Licensing is per station via the Automation License Manager (ALM).

When to choose IDB over a C# client:

• No C# developer is available on the IT side.
• Tag list is stable and small (< 5000 tags).
• You need guaranteed-store-and-forward behaviour during network outages.

7. Method 4 - VBScript with ADODB (no external C# app)

If the integration target is just a SQL table and there is no need for an external C# application, a WinCC Global Script can perform the writes. In the WinCC Graphics Designer, add a Global Action running every N seconds:

Dim conn, rs, sql
Set conn = CreateObject("ADODB.Connection")
conn.Provider = "SQLOLEDB"
conn.Properties("Data Source").Value = "192.168.2.20\SQLEXPRESS"
conn.Properties("Initial Catalog").Value = "PlantHistorian"
conn.Properties("User ID").Value = "sa"
conn.Properties("Password").Value = "secret"
conn.Open
sql = "INSERT INTO TagLog(TagName, Value, TS) VALUES('Motor_Speed', " & _
      HMIRuntime.Tags("Motor_Speed").Read & ", GETDATE())"
conn.Execute(sql)
conn.Close
Set conn = Nothing

8. SQL Server Integration from the C# Host

Once the C# app is reading from WinCC, persist values to SQL Server with System.Data.SqlClient or Microsoft.Data.SqlClient.

using (var sql = new SqlConnection("Server=192.168.2.20\\SQLEXPRESS;Database=PlantHistorian;Integrated Security=SSPI;"))
{
    sql.Open();
    using (var cmd = new SqlCommand("INSERT INTO dbo.TagLog (TagName, Value, TS) VALUES (@n, @v, @t)", sql))
    {
        cmd.Parameters.AddWithValue("@n", iv.ItemName);
        cmd.Parameters.AddWithValue("@v", iv.Value);
        cmd.Parameters.AddWithValue("@t", iv.Timestamp);
        cmd.ExecuteNonQuery();
    }
}

For high-throughput applications, batch the inserts and use SqlBulkCopy:

DataTable dt = new DataTable();
dt.Columns.Add("TagName", typeof(string));
dt.Columns.Add("Value", typeof(object));
dt.Columns.Add("TS", typeof(DateTime));
// fill dt...
using (var bulk = new SqlBulkCopy(sql))
{
    bulk.DestinationTableName = "dbo.TagLog";
    bulk.WriteToServer(dt);
}

9. DCOM Configuration (Required for Network OPC)

The single most common cause of Access Denied when a C# app calls opcda://<remote>/OPCServer.WinCC is incomplete DCOM configuration. Apply the following on both the WinCC station and the C# client station.

1. Create a Windows user (e.g. opcuser) on both machines with identical password. Add it to the local Distributed COM Users group and to Administrators on the WinCC station.
2. Run WinCC Runtime as that user: Start > WinCC > Autostart > Configure, or in services.msc change the logon of CCEServer, SIMATIC WinCC OPC Server, and SQL Server (WINCC) to opcuser.
3. Open dcomcnfg → Component Services > Computers > My Computer > DCOM Config.
4. Right-click OPCServer.WinCC → Properties:
   • General tab → Authentication Level: None (test lab) or Connect (production).
   • Location tab → enable Run application on the following computer only.
   • Security tab → customize all three sections and grant opcuser full access.
   • Identity tab → set This user and enter opcuser and the password.
5. In My Computer properties (top of the DCOM tree):
   • Default Authentication Level: Connect.
   • Default Impersonation Level: Identify.
6. Open Windows Firewall with Advanced Security and create inbound rules for C:\Windows\System32\dllhost.exe (DCOM launcher) and OPCServer.WinCC.exe on ports 135 (TCP) plus the dynamic RPC range.
7. Add the WinCC host's IP and the C# host's IP to Trusted Hosts in the registry only when using classic-impersonation (rare).

10. Configuration Reference Table

11. Troubleshooting Matrix

12. Verification Procedure

1. On the WinCC station, launch Start > Programs > Siemens Automation > SIMATIC > WinCC > OPC and start the OPC Scout. Add the local OPCServer.WinCC, browse to a known tag, drag it into the view, and confirm the value updates.
2. From the C# client station, run OpcEnum (or OPC Foundation's SampleClient) and add the remote opcda://<WinCC>/OPCServer.WinCC. A successful add confirms DCOM works.
3. Start the C# application, verify it logs Connect: ok for every tag and that DataChanged fires at the expected UpdateRate.
4. Confirm rows appear in the target SQL table: SELECT TOP 10 * FROM dbo.TagLog ORDER BY TS DESC;
5. Pull the network cable between the WinCC station and the C# host. After the configured KeepAlive timeout, the client should log Server not connected. Reconnect the cable; subscription should auto-recover without restarting the C# app.

13. Security and Production Hardening

• Never leave Authentication Level = None on a production network - it disables RPC packet signing and allows trivial MITM attacks.
• Use a dedicated opcuser account with no interactive login rights.
• Restrict the SQL login to the db_datawriter role on the historian database only.
• Encrypt traffic: OPC UA is supported in WinCC V7.3+ via the OPC UA Server option. Migrate from DA to UA when the C# stack supports it - no DCOM configuration is required.
• Audit firewall rules annually; Windows updates sometimes reset DCOM defaults.

14. Frequently Asked Questions