PCS 7 V8.2 Third-Party Software Integration via OPC and S7

1. PCS 7 V8.2 System Architecture and Integration Boundaries

SIMATIC PCS 7 V8.2 is a distributed control system (DCS) released in 2014 that combines the AS 410 automation station family (CPU 410-5H, CPU 410 SMART), the WinCC V7.2 operator system (OS Server, OS Client, OS Web / WebNavigator), the SIMATIC Manager / PCS 7 engineering toolchain, and SIMATIC NET V8.2 SP1 for plant-bus networking. The system organizes data flow across three logical layers:

• AS-OS layer — S7-400 backplane bus, S7 PUT/GET communication, alarm and time-stamp routing to the OS.
• OS-OS layer — WinCC redundancy, WebNavigator, archive database, OPC servers.
• OS-3rdParty layer — DCOM-based OPC DA, OPC A&E, OPC HDA, OPC UA, Industrial Data Bridge, and the S7 channel on the terminal bus.

Every third-party software integration in PCS 7 V8.2 terminates at one of three physical or logical boundaries:

1. OPC server on the OS Server — process values, alarms, and archive tags exposed to external clients.
2. S7 communication partner — a third-party PLC, SCADA, or gateway connected to the plant bus via ISO-on-TCP (RFC 1006, TCP port 102).
3. Database interface — the WinCC archive database, Connectivity Pack, or an Industrial Data Bridge SQL sink.

Select the boundary before cabinet wiring because it determines the OS Server network adapter (Intel PRO/1000 for office traffic, CP 1623 for plant-bus redundancy), the plant-bus topology (redundant ring vs. star), the CP selection for the OS station, and the OS Server license package (WinCC RT, Connectivity Pack, OPC Power Pack).

2. Integration Path Decision Matrix

Choose the boundary that matches the third-party system type, network position, data volume, and update rate:

For a third-party PLC such as an S7-300, the path of least resistance is the WinCC S7 channel referenced in the Siemens Support entry “Integration of third-party Systems with SIMATIC PCS 7/OPEN OS” (ID 49740087). The example in that document uses the S7-300 as a third-party automation system integrated via the S7 channel of the PCS 7 operator system.

3. OPC DA / A&E / HDA Server Built into WinCC V7.2

Every WinCC V7.2 OS Server automatically hosts an OPC DA, OPC A&E, and OPC HDA server. The server runs as a DCOM in-process server inside the WinCC process and requires no additional license beyond the WinCC RT package.

3.1 Server Identifiers

• OPC DA 3.0 ProgID: OPCServer.WinCC
• OPC A&E 1.1 ProgID: OPCAlarmsEventSvr.WinCC.1
• OPC HDA 1.2 ProgID: OPCHDAQueries.WinCC.1
• Default port: 135 (DCOM endpoint mapper) plus dynamic RPC ports (49152-65535 by default in Windows Server 2008 R2 and later)

3.2 Configuration Steps

1. On the OS Server, open Start > All Programs > Siemens Automation > SIMATIC > WinCC > WinCC Explorer.
2. Right-click OPC > OPC DA and select Properties. Confirm the WinCC project is set as the runtime project.
3. On the third-party client PC, install the OPC DA 3.0 client runtime (e.g. Matrikon OPC Explorer, OPC Scout V10, KEPServerEX Quick Client).
4. Create a local Windows user with an identical name and password on both the OS Server and the OPC client. Membership in Distributed COM Users and WinCC Administrators is required.
5. Run dcomcnfg on both machines. Navigate to Component Services > Computers > My Computer > DCOM Config.
6. Right-click OPCServer.WinCC and configure:
     • Identity: The interactive user (single-server) or This user with the matching service account (recommended for unattended operation).
     • Security: Add the matching OPC client user to Launch & Activation, Access, and Configuration with allow permissions.
     • Endpoints: Use static endpoint, e.g. 5000, instead of dynamic RPC.
7. Configure Windows Firewall inbound rules: allow %SystemRoot%\System32\svchost.exe for DCOM, plus the static endpoint port from step 6.
8. On the OS Server, restart the WinCC runtime so the OPC server re-registers its ProgID.
9. On the client, browse the server with the OPC browser. All WinCC tags prefixed with the project name and the @ namespace are exposed (e.g. OSServer_Project::Motor_RPM).

4. OPC UA Server via SIMATIC NET V8.2 SP1

OPC UA is the right boundary when the third-party client is not Windows (Linux, macOS), runs in a different Active Directory forest, or must traverse a stateful inspection firewall. The SIMATIC NET V8.2 SP1 OPC UA server is an add-on component, not part of the default WinCC V7.2 install.

4.1 Endpoint and Security

• Default URL: opc.tcp://<OS-Server-IP>:4840
• Discovery URL: opc.tcp://<OS-Server-IP>:4840/UA/Discovery
• Security policies: None, Basic128Rsa15, Basic256, Basic256Sha256 (the last two require the corresponding SIMATIC NET license feature)
• User token types: Anonymous, UserName (Windows account), Certificate (X.509)
• Default session timeout: 60 min; default subscription publishing interval: 500 ms

4.2 Configuration Steps

1. Install SIMATIC NET V8.2 SP1 on the OS Server. Verify the “OPC UA Server” feature is selected during installation.
2. Open SIMATIC NET Configuration Console and assign the OPC UA server to the plant-bus network adapter (Intel PRO/1000 or CP 1623).
3. Configure the OPC UA server in Start > SIMATIC NET > OPC UA > OPC UA Configurator:
     • Add the WinCC V7.2 runtime tags as data source.
     • Choose the security policy. None is acceptable only on isolated plant networks.
     • Generate or import the server certificate. The default path is C:\Program Files\Siemens\SIMATIC.NET\opc2\ua\PKI\CA\certs.
4. Open TCP port 4840 inbound on the OS Server firewall.
5. On the third-party UA client, import the server certificate into the trusted peer store (UA clients typically store them in %APPDATA%\<Client>\trusted\).
6. Test connectivity with the free OPC Foundation UA .NET Sample Client or the UaExpert client from Unified Automation. The UA Discovery service should return the server endpoint list.

5. S7 Channel for Third-Party PLC Integration (Worked Example: S7-300)

The S7 channel is a WinCC channel driver that reads / writes process tags over the Siemens S7 communication protocol (ISO-on-TCP, RFC 1006). It is the standard answer when a third-party PLC must look “native” to the PCS 7 OS without joining the PCS 7 AS. The official Siemens Support entry “Integration of third-party Systems with SIMATIC PCS 7/OPEN OS” (ID 49740087) documents the use case of a S7-300 integrated via the S7 channel of the PCS 7 operator system.

5.1 Hardware and Software Prerequisites

• OS Server with one of: CP 1613 A2, CP 1623, CP 1604, or a Softnet IE S7 Lean / Softnet IE PG license on the standard Intel NIC.
• Ethernet connection from the OS Server plant-bus NIC to the third-party S7-CPU Ethernet port (or a switch in the plant bus).
• Third-party PLC: S7-300 CPU with PROFINET or Ethernet CP (e.g. CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP).
  The same path also works for S7-400, ET 200S, S7-1200, S7-1500, and any third-party controller that supports the S7 communication protocol.
• SIMATIC NET V8.2 SP1 drivers installed on the OS Server (CP 1613/1623 require the SIMATIC NET device driver, not the standard Windows NIC driver).

5.2 S7-300 Step-by-Step Configuration

1. On the OS Server, open SIMATIC Manager > PC Station > WinCC Explorer. The PC Station must contain a WinCC Application of the type WinCC Server on the same index as the S7 connection.
2. Open Station Configuration Editor and add the CP 1613/1623 (index 1) or the Intel NIC (index 1) configured for Softnet IE.
3. In WinCC Explorer, right-click Tag Management > Add New Driver > SIMATIC S7 Protocol Suite.
4. Expand the new SIMATIC S7 Protocol Suite node. Right-click TCP/IP and select New Connection.
5. Configure the connection properties:
     • Name: e.g. S7_300_Cabin_1.
     • IP Address: IP of the S7-300 CPU Ethernet interface (e.g. 192.168.10.20).
     • Connection Type: Active partner (WinCC initiates) or Passive partner (S7-300 initiates). Use Active by default.
     • CPU Slot / Rack: rack 0, slot 2 for a CPU 315-2 PN/DP in the central rack.
     • Connection Resource: local TSAP 01.01, partner TSAP 03.02 by default for S7-300 (slot 2 is TSAP 03.02).
6. Click Apply. WinCC performs an S7 connect test. The status field should read Connection established. If it reads Connection failed, jump to Section 12 for diagnostics.
7. Open the S7-300 program in STEP 7 V5.5 and create DB100 with at least 20 bytes of data. Inside DB100, define tags such as Motor_Speed (REAL, DBD0), Motor_Start (BOOL, DBX4.0), Valve_Position (INT, DBW6), Recipe_Number (DINT, DBD8).
8. Back in WinCC Explorer, right-click the new connection and select New Tag. Create a tag for each DB100 item:
     • Mot1_Speed → Data Block, DB number 100, Offset 0, REAL.
     • Mot1_Start → Data Block, DB number 100, Offset 4, Bit 0, BOOL.
     • Valve1_Pos → Data Block, DB number 100, Offset 6, INT.
9. Set the update cycle in the connection properties. 500 ms is the conservative default for 30–50 tags per connection. Increase to 2000 ms if the S7-300 CPU has fewer than 4 free S7 connection resources.
10. Create faceplates or process screens in the WinCC Graphics Designer and bind the new tags to IO fields and bar graphs.
11. Save the WinCC project and activate the runtime. The OS Server will now poll the S7-300 every 500 ms and expose the values as native WinCC tags.

5.3 S7 Connection Resources

Each S7-300 / S7-400 CPU has a fixed pool of S7 connection resources (sometimes called “PG/OP/S7 connections”). Exceeding this pool is the single most common cause of Connection failed errors during commissioning:

In STEP 7 > HW Config > CPU Properties > Communication, raise the S7 connection resource count to at least Reserved = 1 for OP and at least Reserved = 1 for PG, and confirm the “Maximum number of connection resources” covers all planned S7 clients (PCS 7 OS, WebNavigator, additional WinCC clients, Engineering Station, TIA Portal PG).

6. Industrial Data Bridge (IDB)

The Industrial Data Bridge is a SIMATIC NET add-on product (part of the “SIMATIC PCS 7 Industry Library”) that polls process values from OPC, S7, Modbus, or file sources and writes them to a SQL database, CSV file, or another OPC server. It is the right tool for bulk, slow-rate exchange with MES or ERP systems that do not need a 100 ms update rate.

6.1 Architecture

IDB runs as a Windows service. A configuration tool (started from Start > SIMATIC > Industrial Data Bridge) defines data sources, destinations, and tag mappings. Polling is event-driven (subscription) or time-driven (1 s – 60 s).

6.2 Typical Use Cases

• Mirror every 5 s a set of process tags to SQL Server for the plant historian.
• Push alarm acknowledgements to Oracle for the production reporting system.
• Forward energy meter readings (S7-1200 / S7-1500 over S7 protocol) to MySQL for a KPI dashboard.

6.3 Configuration Steps

1. On the OS Server, install the IDB option package. It is selected in the SIMATIC NET V8.2 SP1 setup and requires a separate license key.
2. Create the destination database in SQL Server (e.g. PCS7_Historian) with a dedicated SQL login and read/write permission on the target tables.
3. Open the Industrial Data Bridge Configurator and create a new Data Source of type OPC DA. Point it to the ProgID OPCServer.WinCC on the local OS Server.
4. Create a new Data Destination of type SQL Database. Enter the SQL Server hostname, the database name, and the credentials.
5. Build a Tag Mapping that links each WinCC tag to a column in the destination table (e.g. Motor_RPM REAL, Timestamp DATETIME).
6. Set the Trigger to Time-driven, 5 s. Time-driven is the only trigger that scales above a few hundred tags per second.
7. Click Activate to start the IDB service. Verify rows appear in the destination table within the first interval.

7. Third-Party OPC Servers (Kepware, Matrikon, Softing)

When the third-party software is not OPC-capable out of the box (many MES packages, cloud gateways, and energy dashboards), the typical approach is to insert a third-party OPC server between PCS 7 and the consumer. Kepware (now PTC Kepware) is the most common Siemens-compatible choice.

7.1 Kepware as a Bridge

1. Install KEPServerEX V6 on a dedicated PC on the plant bus (do not co-locate with the OS Server).
2. Add the Siemens TCP/IP Ethernet driver. This driver speaks the S7 protocol and can read directly from PCS 7 AS CPUs without going through WinCC.
3. Add the OPC DA Client driver if you want to subscribe to the WinCC OPC DA server instead of polling the AS directly.
4. Add the MQTT Client or REST API plug-in for the cloud / MES endpoint.
5. Configure the tag database and link the source tags to the destination channels.

Kepware also imports STEP 7 / TIA Portal symbol tables, which removes the need to re-enter every tag name. The Symbol Editor reads the .SDF or .XDB file generated by STEP 7 and exposes DB, I, Q, M, T, C areas as named tags.

7.2 When to Choose Kepware over the Built-in OPC Server

• The consumer is a non-OPC protocol (MQTT, AMQP, REST, BACnet, IEC 60870-5-104, DNP3).
• You need a redundant bridge to two independent MES servers.
• You need to throttle update rates per tag (e.g. fast tags to SCADA, slow tags to MES).
• You need cross-controller tag aggregation (read from PCS 7 AS and from a third-party PLC in the same tag namespace).

8. Direct SQL Access to the WinCC Archive

WinCC V7.2 stores process value archives in a Sybase SQL Anywhere database (default) or, with the SQL Server Connectivity Pack, in Microsoft SQL Server. The Connectivity Pack license moves the archive from \<OSServer>\WinCCProject\Archive\*.db to a SQL Server instance, which opens the archive to standard BI tools.

8.1 Enabling SQL Server Storage

1. On the OS Server, install the WinCC Connectivity Pack option. The license is keyed against the OS Server serial number.
2. Open WinCC Explorer > Computer > Properties > Archive. Switch the Database Type from Sybase to SQL Server.
3. Enter the SQL Server hostname, the database name (default: CC_<ProjectName>_<RR>), and the service account.
4. WinCC creates the schema and begins inserting rows. Table names follow the pattern dbo.PDArchiv_<ArchiveTag> or dbo.UAArchiv_<ArchiveTag>.

8.2 Read-Only Access Pattern

External BI tools should always connect through a read-only SQL login. The default WinCC user owns the schema and should not be used by external consumers. The Connectivity Pack exposes a set of stored procedures that handle time-stamp conversion and tag name resolution, e.g. MSP_TagToTagID and MSP_GetHistoryData. Direct SELECT against the archive tables is supported but ties the external tool to the table layout, which can change between PCS 7 releases.

9. DCOM and Firewall Hardening

OPC DA, A&E, and HDA use Microsoft DCOM, which is a frequent source of “it works on the bench, fails on the plant” problems. The following checklist is required on every OS Server and every OPC client that participates in the integration.

1. Match local user accounts: the same username and password must exist on both machines. If you cannot create local accounts (domain-only environment), use a domain user and add it to WinCC Administrators and Distributed COM Users on the OS Server.
2. Disable the Windows firewall during initial bench test, then re-enable it rule-by-rule.
3. Open dcomcnfg. On My Computer > Properties > Default Properties:
     • Enable Distributed COM on this computer = on
     • Default Authentication Level = Connect (or Packet Integrity)
     • Default Impersonation Level = Identify
4. On My Computer > Properties > COM Security, edit the default access and launch permissions to include the matching OPC client user.
5. For every OPC server ProgID in DCOM Config (OPCServer.WinCC, OPCAlarmsEventSvr.WinCC.1, OPCHDAQueries.WinCC.1):
     • Set Identity to This user with the WinCC service account.
     • Set Endpoints to Use static endpoint, e.g. 5001 (DA), 5002 (A&E), 5003 (HDA).
     • Re-add the matching OPC client user to Security > Launch & Activation and Access.
6. Add Windows Firewall inbound rules: svchost.exe for DCOM (port 135), plus each static endpoint from step 5.
7. Restart the OPCEnum service and the WinCC runtime.

10. Security Considerations

• Network segmentation: place the OS Server, the third-party S7 CPU, and the OPC UA server on a dedicated plant bus VLAN. The Connectivity Pack SQL Server should be on a separate “historian” VLAN with one-way firewall rules to the BI segment.
• User authentication: prefer OPC UA with UserName token + certificate, or Windows integrated authentication over DCOM. Avoid SecurityPolicy=None.
• Encryption: for OPC UA, use Basic256Sha256. For OPC DA, no native encryption is available — rely on IPsec or MACsec on the plant bus.
• Read-only accounts: BI and MES consumers should get a read-only SQL login. OPC clients should be configured with read-only on the OPC server.
• Audit log: enable the WinCC audit option if FDA 21 CFR Part 11 traceability is required for the integration path.

11. Verification and Diagnostics

Walk through this checklist after every commissioning or change to the integration boundary.

1. S7 connection test: in WinCC Explorer > SIMATIC S7 Protocol Suite > Connection > Properties > Connection, click Test. The status should read OK. The round-trip time should be < 10 ms on a local plant bus.
2. OPC DA browse: from the OPC client, use the OPC Scout V10 tool (ships with SIMATIC NET) to browse OPCServer.WinCC. Verify the project namespace and the @ alias for archive tags.
3. OPC DA read/write: read a known tag, verify the value matches the WinCC tag. Write a value, verify the S7-300 or AS responds (use a STEP 7 VAT table to confirm).
4. OPC UA connection: from a UA client (UaExpert, OPC Foundation .NET sample client), connect to opc.tcp://<OSServer>:4840. Verify the endpoint URL, security policy, and authentication token are accepted.
5. Industrial Data Bridge: on the destination SQL Server, run SELECT TOP 10 * FROM dbo.<TargetTable> ORDER BY Timestamp DESC. Verify rows are written at the configured interval.
6. Connectivity Pack: from a SQL client, execute EXEC MSP_GetHistoryData 'TagName', '2024-01-01 00:00:00', '2024-01-02 00:00:00', 1000. Verify the row count and the values.
7. DCOM diagnostics: on the OPC client, run Event Viewer > Applications and Services Logs > Microsoft > Windows > DistributedCOM. Look for event ID 10016 — it points to a permission mismatch on a specific ProgID.
8. Wireshark on plant bus: capture TCP 102 (S7) and TCP 4840 (OPC UA). Verify the connection is being re-established at the expected keep-alive interval (60-120 s for S7, 60 min for OPC UA by default).

12. Troubleshooting Matrix

13. Frequently Asked Questions