Fixing WinCC V7 RSLinx OEM OPC DA Connection Failure

Problem Overview

When integrating Siemens WinCC V7 with Allen-Bradley ControlLogix, CompactLogix, GuardLogix, MicroLogix, or Micro800 controllers through RSLinx Classic OEM, the OPC DA connection appears to succeed during tag browsing but every imported tag returns to "offline" the moment WinCC Runtime is activated. The same WinCC project, the same RSLinx topic, and the same controller path work flawlessly when RSLinx Classic is running under its 7-day activation grace period or when the system is licensed as RSLinx Classic Gateway, which isolates the failure to the OEM license tier rather than to the WinCC configuration, the controller path, or the network.

This article documents the exact failure mode, the licensing root cause, and the field-proven remediation path for engineers commissioning mixed-vendor HMI and SCADA systems where a Siemens runtime must consume Allen-Bradley process data through the standard RSLinx Classic OPC DA 2.0 broker.

Symptoms and Diagnostic Indicators

The failure presents a stable set of indicators that can be observed in both WinCC and RSLinx without any project change. The diagnostic fingerprint is identical regardless of controller family or driver type.

1. Tag browse succeeds. In WinCC Tag Management, navigating OPC -> RSLinx OPC Server -> configured topic returns all items with the correct data type, address, and access rights. Item IDs render as [topic_name]address with the expected =N7:0, Program:MainProgram.Tag, or MyTag[0].3 syntax.
2. Tags go offline in Runtime. The moment WinCC Runtime is started, every imported item reports connection status Disconnected or Fault. The Tag Diagnosis window shows a uniform error code, not a per-tag fault, which rules out address or naming problems.
3. OPC Scout reads the same items without error. When an OPC DA 2.0 client such as Siemens OPC Scout V10 is pointed at the identical RSLinx server name and topic, it reads and writes values continuously. This proves the RSLinx topic, the driver, and the controller path are healthy.
4. RSLinx kernel log records a specific failure string. With OEM license activated, the RSLinx Classic kernel log contains the entry "Remote OPC Connection attempted on a none RSLinx Classic Gateway machine" immediately after the first WinCC Runtime subscription attempt.
5. Removing the OEM license restores connectivity. Returning RSLinx to the default grace period (uninstalling the OEM activation, no license installed) makes WinCC Runtime work again, confirming the failure is bound to the license token rather than to project data.

The combination of successful browse and failed runtime read is the diagnostic fingerprint. Browse is a synchronous local COM read; runtime is an OPC DA 2.0 advisory subscription that requires the broker to host remote client endpoints, which the OEM tier explicitly does not enable.

Root Cause: RSLinx License Architecture

RSLinx Classic is delivered in three distinct license tiers, each implemented as a separate product activation under the FactoryTalk Activation Manager. The license is not a feature unlock on a single product: it is the binary switch that determines which executable components and which COM and OPC endpoints RSLinx registers with the Windows Service Control Manager.

The RSLinx Classic OEM activation is engineered for embedded use: it ships as part of RSLogix 5000, Studio 5000 Logix Designer, and FactoryTalk View SE/ME OEMs, and is intended to expose Allen-Bradley controllers to other FactoryTalk applications on the same workstation through in-process OPC. It does not register the OPC DA 3.0 broker component that WinCC Runtime requires to maintain a stable, cross-process subscription. When WinCC Runtime (a separate Win32 process from RSLinx) attempts to attach to the OEM-tier OPC DA server, the broker rejects the remote connection request, the subscription is silently torn down, and every tag drops to offline. The browse call succeeds because WinCC Tag Management is a thin wrapper that performs a one-shot synchronous read using local COM, which the OEM tier does allow.

Rockwell Automation support has confirmed that RSLinx Classic OEM is not licensed or supported as an OPC DA server for WinCC V7. The supported combination is RSLinx Classic Gateway, which exposes the same RSLinx OPC Server CLSID plus the RSLinx OPC Remote broker and accepts WinCC Runtime subscriptions on the same machine as well as from remote SCADA nodes.

License Tier Comparison and Engineering Trade-offs

Choosing the correct RSLinx license is the single largest variable in mixed-vendor SCADA reliability. The table below summarizes the operational characteristics observed in production environments where WinCC V7 is the SCADA layer.

Field experience across automotive, water and wastewater, and metals plants shows that the same WinCC project behaves correctly in all three tiers during the 7-day grace period because the grace period runs the Gateway-class broker. The failure manifests only when the OEM or Lite activation is written to the FactoryTalk Activation database, which triggers the broker downgrade. Migrating the same hardware to a Gateway activation requires no project change and no WinCC restart beyond a normal runtime reload.

OPC DA Browse vs Runtime Subscription Mechanics

Understanding the difference between a synchronous browse and a runtime subscription is essential to interpreting the symptom pattern. WinCC Tag Management performs three distinct operations when an OPC server is added to a channel.

1. Server enumeration (CoCreateInstanceEx): Uses the OPC ServerList on the local machine. The client enumerates HKCR\CLSID keys under the OPC DA category. Both OEM and Gateway tiers register the standard RSLinx CLSID, so this step succeeds in both.
2. Item browse (IBrowseServerAddressSpace): Walks the address space from the root branch down to leaves. The OEM tier permits this because it is implemented in-process and uses the same item-definition tables the driver uses for synchronous reads.
3. Group subscription (IOPCGroupStateMgt / IOPCAsyncIO2): Creates a server-side group, attaches a callback sink, and the server pushes data changes back to the client at the requested update rate. The OEM tier does not register the RSLinx OPC Remote COM local server that WinCC Runtime OPC DA 3.0 wrapper requires, so the group creation call succeeds but the callback registration is rejected at the broker layer. WinCC then marks every item in the group as offline and retries every 5 to 15 seconds, producing a continuous log of E_FAIL callbacks.

This explains the exact behavior: every item browses, every item goes offline, and OPC Scout (which does its own simple read loop rather than a managed subscription) continues to work. The same explanation applies to any third-party OPC DA client that uses only synchronous reads; the failure is specific to the OPC DA subscription model used by WinCC Runtime.

Resolution Path A: Activate RSLinx Classic Gateway License

The supported remediation is to convert the RSLinx Classic installation from an OEM activation to a Gateway activation. The conversion is non-destructive: the existing RSLinx configuration, DDE/OPC topics, driver assignments, and EDS entries are preserved. The change is limited to the FactoryTalk Activation Manager database.

Prerequisites

• A valid RSLinx Classic Gateway activation key. Catalog numbers: 9324-RLXGW for the single-station Gateway, 9324-RLXGWENE for the regional activation media, or the newer FTLX-RLXGW FactoryTalk-Licensed version. Activation media is delivered on USB or as a downloadable .bin file from the Rockwell Automation Product Compatibility Download Center.
• Local administrator rights on the WinCC host, because the FactoryTalk Activation service and the RSLinx kernel driver both run as SYSTEM during activation.
• RSLinx Classic 4.40 or later installed. Earlier 4.x versions (4.00, 4.10, 4.20) used a separate RSLinx License Manager executable that has been merged into FactoryTalk Activation Manager from 4.30 onwards.
• The RSLinx Classic kernel must be stopped before the activation change; the activation manager restarts the kernel automatically.

Procedure

1. Close WinCC Explorer, WinCC Runtime, RSLinx Classic Launch Control Panel, and any Studio 5000 or RSLogix 5000 application. Close OPC Scout. This guarantees that no client holds a handle to the OPC server during the swap.
2. Stop the RSLinx Classic kernel. From the Start menu run "C:\Program Files (x86)\Rockwell Software\RSLinx\RSLinx.exe" /K and choose Stop RSLinx Kernel. Verify in the kernel log window that the message RSLinx Kernel Stopped appears.
3. Open FactoryTalk Activation Manager from Start -> Rockwell Software -> FactoryTalk Activation -> FactoryTalk Activation Manager.
4. In the left tree expand the local machine node. The currently installed RSLinx activation is listed under the RSLinx entry. Select it and click Return to release the OEM key back to the activation server, or click Borrow if the activation is managed by a floating server. A floating server return can take up to 30 minutes; the local return is immediate.
5. After the return completes, select the activation slot and click Activate. Browse to the .bin file supplied with the Gateway media, enter the activation serial number printed on the certificate, and complete the wizard.
6. When the wizard finishes, the RSLinx entry in the activation tree now reads RSLinx Classic Gateway with the correct activation count and expiration date.
7. Start the RSLinx Classic kernel again. Open RSLinx Launch Control Panel and verify that the About dialog reports RSLinx Classic Gateway, not OEM. The OPC server list in the DDE/OPC topic configuration must show the standard RSLinx OPC Server plus the RSLinx OPC Remote broker entry.
8. Launch WinCC Explorer and start Runtime. In the WinCC Tag Diagnosis window, all imported RSLinx tags should transition to Connected within one update cycle (default 1 second).

Verification

1. Open RSLinx Classic Launch Control Panel -> Help -> About and confirm the license string ends in ... Gateway.
2. In RSLinx Classic, run DDE/OPC -> Topic Configuration and confirm the topic that WinCC uses still exists, that the data source (driver) is still selected, and that the data table is the same.
3. From an elevated command prompt, run dcomcnfg and navigate to Component Services -> Computers -> My Computer -> DCOM Config. The RSLinx OPC Server and RSLinx OPC Remote CLSIDs must both be present. The OEM-only install only registers the first CLSID.
4. Use WinCC Tag Diagnosis to read any live tag from the controller. The value must update at the configured update rate and the connection status must remain green.
5. Stop and restart the RSLinx kernel while WinCC Runtime is running. WinCC should automatically re-establish the OPC DA subscription; tags should return to Connected within the configured reconnect interval (default 30 seconds).

Resolution Path B: Replace RSLinx with a Separate Gateway Installation

If OEM licensing is mandated by the project (for example, when the same workstation is used as a Studio 5000 engineering seat and a WinCC runtime seat), install a second, isolated RSLinx instance on a dedicated gateway host and point WinCC at the remote OPC DA server over DCOM. This is the architecture that large plant systems have used since RSLinx 2.x.

Architecture

Procedure

1. Install RSLinx Classic Gateway on a dedicated Windows Server 2019 or 2022 machine. Activate with the Gateway key. Configure the EtherNet/IP driver, add the controller (EIP node, for example 192.168.10.50, slot 0 for ControlLogix), and verify with RSWho that the controller is online and that a read of any tag succeeds.
2. Configure DCOM on the gateway host. From dcomcnfg, open My Computer -> DCOM Config, right-click the RSLinx OPC Remote entry, and grant the WinCC service account both Local Access and Remote Access launch and activation rights. On the SCADA server, add the same account to Distributed COM Users.
3. Open the Windows Firewall on the gateway with an inbound rule allowing TCP 135 (RPC endpoint mapper) and the dynamic RPC port range used by RSLinx (default 49152 to 65535, configurable through netsh int ipv4 set dynamicport tcp start=49152 num=16384).
4. On the WinCC host, open Tag Management -> OPC -> Add New OPC Server and select RSLinx OPC Remote. Browse the remote machine, select the topic, and import the items. Start Runtime. Tags should connect over DCOM with the same performance as a local install.

WinCC V7 OPC DA Channel Configuration

After the RSLinx license is corrected, configure the WinCC V7 channel to use the correct server, update rate, and item naming rules. The configuration must match the way RSLinx exposes the Logix tag address space.

Channel parameters

Item import procedure

1. In WinCC Explorer, expand the new OPC channel and double-click OPC Groups. Create a group named AB_Fast for 250 ms items and AB_Slow for 1 s items. Faster groups should be reserved for control-loop feedback (PID process variable, drive speed reference); slower groups for monitoring and trending.
2. Open the group and click Add Tags -> Selection. The OPC item browser opens. Navigate to the RSLinx OPC server, expand the topic, and select items. For Logix controllers, the browser shows Program:MainProgram.Tag1; click Add to import. For PLC-5 and SLC 500, the address is shown as N7:0 and is imported verbatim.
3. For each imported tag, set the Quality Code handling to Substitute a value with a default of 0 for analog, a dash for string, and Keep last value for control-loop PVs to avoid the HMI flapping if the OPC subscription briefly drops.
4. Compile the OS project with Rebuild All and start Runtime. Verify in the Tag Diagnosis window that every imported item shows status Connected and that the value updates at the configured rate.

HRESULT Error Code Reference

The OPC DA 2.0 specification defines a standard set of HRESULT values that the WinCC Runtime and the RSLinx broker use to signal failure conditions. The table below maps the codes most commonly observed during the license-tier failure and the related DCOM misconfiguration cases.

COM Security, DCOM, and EDS Hardening

Mixed-vendor OPC installations that previously ran on the default Windows DCOM permissions frequently fail after a Windows security update or after a domain policy refresh. Harden the DCOM configuration on both the RSLinx gateway and the WinCC host before commissioning the system.

1. Open dcomcnfg as administrator. Right-click My Computer and select Properties. On the Default Properties tab, enable Enable Distributed COM on this computer and set the Default Authentication Level to Connect. Set the Default Impersonation Level to Identify. These two settings are the most common source of 0x80070005 access-denied errors when WinCC Runtime tries to attach to RSLinx.
2. On the COM Security tab of the same dialog, click Edit Limits under Access Permissions. Add the WinCC service account (typically SYSTEM and the user running the WinCC Runtime service) and grant both Local Access and Remote Access. Repeat under Launch and Activation Permissions.
3. Right-click the RSLinx OPC Server and RSLinx OPC Remote CLSIDs and verify that the Security tab uses the same access and launch rights. If custom security is configured on the CLSID, it overrides the machine defaults.
4. On the Default Protocols tab of My Computer, confirm that Connection-oriented TCP/IP is enabled and listed first. Remove the legacy SPX/IPX and NetBEUI protocols from the default list; they cause excessive RPC retries on modern networks.
5. On Windows Server 2019 and later, set the RPC dynamic port range explicitly with netsh int ipv4 set dynamicport tcp start=49152 num=16384. Add a Windows Firewall rule allowing inbound TCP 49152 to 65535 from the WinCC host IP. The default Windows Firewall blocks dynamic RPC, which is the single most common reason remote OPC DA connections fail after a server restart.

EDS file registration

The RSLinx Classic EDS library must be healthy for the OPC server to enumerate devices and topics correctly. The Rockwell Automation compatibility release notes for RSLinx Classic EDS handling document the case where stale or unregistered EDS files cause the OPC server to publish items but the runtime subscription fails to map them to the underlying driver, producing exactly the browse-works, runtime-fails pattern.

1. Open RSLinx Launch Control Panel -> EDS Hardware Installation Tool. Choose Register an EDS file and re-register the EDS files for the controllers in the project. If a release note specific to the EDS version is available, follow its manual upload instruction by clicking Add in the EDS wizard and pointing to the EDS directory.
2. Stop the RSLinx kernel and restart it. The EDS upload is not re-read on a hot reload; the kernel must be restarted for new EDS registrations to take effect.
3. In RSLinx RSWho, expand the configured driver. Each controller must show the correct vendor, device type, and revision. A controller that appears as a generic device (vendor 0, device type 0) indicates the EDS did not register correctly. The OPC browse will still return tag items, but the driver will fail to map them to the controller at runtime.
4. If a controller still shows a generic device entry, manually copy the matching EDS file into C:\Program Files (x86)\Rockwell Software\RSLinx\EDS and run the EDS Hardware Installation Tool with the Register a directory of EDS files option. The release note path documents the exact error code and the manual upload sequence.

Verification, Logging, and Performance Tuning

Run the following sequence after any license change, OPC channel change, or Windows update. Each step produces a verifiable pass/fail result that can be logged in the project commissioning report.

1. RSLinx license string: Open RSLinx Launch Control Panel -> Help -> About. The license text must end in Gateway. Capture a screenshot for the FAT/SAT report.
2. OPC DA server registration: From an elevated command prompt, run reg query "HKCR\CLSID" /f "RSLinx OPC" /s. The output must include the RSLinx OPC Server and RSLinx OPC Remote ProgIDs and their CLSIDs. OEM-only installs return only the first.
3. DCOM permissions: Run dcomcnfg and confirm the access and launch permissions match the hardening list above. Use the Test button on the CLSID properties page to validate the configuration against the running RSLinx kernel.
4. WinCC Tag Diagnosis: All imported tags must report status Connected. Run for 60 seconds and confirm the value of at least one trending tag changes as expected when the controller program toggles the bit or changes the analog value.
5. Stress test: Force a controller-to-OPC disconnect by unplugging the EtherNet/IP cable at the controller switch port. WinCC should mark all items as Bad within 5 seconds. Reconnect the cable; WinCC should restore the items within 30 seconds. The reconnect interval is configured in the OPC channel properties under Behavior when the connection is lost.
6. Kernel restart test: With WinCC Runtime running, stop and restart the RSLinx kernel. WinCC should reattach the OPC groups automatically. The reattach interval and retry count are channel parameters; set them to 3 retries at 10-second intervals for a 30-second overall recovery.

Log paths and analysis

The most decisive log line in the RSLinx kernel log is the Remote OPC Connection attempted on a none RSLinx Classic Gateway machine string. The presence of this line combined with an OEM license in the FactoryTalk Activation Manager confirms the diagnosis in this article without further testing.

Performance tuning

• Update rate: Keep fast groups at 250 ms only for control-loop PVs (typically 8 to 16 items per loop). All monitoring and trending should run at 1000 ms or 2000 ms to minimize broker load.
• Dead band: Apply a 1 to 5 % dead band on all analog trending tags. The dead band is enforced on the server side by RSLinx and reduces callback traffic by an order of magnitude on noisy signals.
• Group sizing: Cap each OPC group at 500 items. Larger groups increase the time the RSLinx kernel needs to scan the topic and serialize callbacks. Split large projects into multiple groups per channel.
• Topic consolidation: Use a single RSLinx topic per controller when the controller exposes fewer than 2,000 tags. Larger tag counts should be split into one topic per program to simplify diagnostics and reduce the impact of a single bad item.
• CPU affinity: Pin the RSLinx kernel and the WinCC Runtime service to separate cores on multi-core hosts using start /affinity or the Processor Affinity dialog in Task Manager. This prevents the RSLinx OPC scan loop from contending with the WinCC picture update loop.

Troubleshooting Matrix