Resolving WinCC OPC Quality Code 8 with Softing INAT OPC Server and Pilz Safety PLCs

When integrating a Softing (formerly INAT) OPC Server Ethernet with Siemens SIMATIC WinCC to read data from a Pilz Safety System (PSS), the SCADA runtime may continue to display stale or last-known values for a tag even though the underlying QualityCode has degraded to 0x08 (OPC_QUALITY_BAD_COMM_FAILURE). This article documents the root cause of the discrepancy between the OPC quality flag and WinCC's tag status evaluation, and provides engineering-validated solutions for surfacing the fault to operators in graphics, logging, and alarms.

1. Problem Description

A common field scenario reported on multiple Pilz-WinCC integration projects is the following sequence:

1. The WinCC server is configured to use the OPC channel and connects to the local Softing INAT OPC-Server Ethernet instance as a Data Access (DA) client.
2. The INAT OPC server is bound to a Pilz PSS PLC over Ethernet (e.g. PSS 4000 with Ethernet/IP, Modbus/TCP, or Profinet, depending on the Pilz gateway).
3. The operator pulls the network cable on the Pilz PLC side or the PLC is powered off.
4. The INAT OPC server detects the lost connection within its configured watchdog/timeout window (typically 1–5 seconds) and updates the QualityCode of every cached item to 0x08.
5. WinCC receives the new quality code on the next update cycle. Hovering over the tag in the Graphics Designer shows a tooltip with the value 8, but WinCC does not fire "Evaluate tag status" actions, output mappings, or connection-loss color animations on the object.
6. A direct VBS read of HMIRuntime.Tags("Tag_1").QualityCode returns 8, but HMIRuntime.Tags("Tag_1").State remains 0 (OK) because the WinCC channel driver (OPC) still reports an active session to the OPC server.
7. Result: the HMI displays a value that is potentially minutes or hours old, with no visual or audible indication of the loss of communication.

For comparison, when an integrated S7 channel driver is used directly between WinCC and a SIMATIC S7 PLC, WinCC injects a sentinel string "- No connection to the PLC" into the tag value tooltip as soon as the driver detects the CP/PLC link down. This is the behavior operators expect, and its absence under OPC is the principal complaint.

2. Root Cause Analysis

WinCC has two completely independent mechanisms for surfacing tag health to the HMI application layer:

The OPC channel driver in WinCC treats the OPC server process as the unit of failure, not the device behind the OPC server. As long as the OPC server process is running and accepting reads, WinCC assumes the link is healthy. The QualityCode returned per item is treated as a data attribute, not a connection attribute, and is not propagated to the higher-level state machine used by "Evaluate tag status".

This is by design in the classic WinCC V7 OPC channel and in TIA Portal's WinCC RT Professional OPC channel: the OPC specification defines quality codes as per-item, while WinCC's tag status evaluation is per-channel-connection. A mismatch is unavoidable unless bridged explicitly by user code.

3. OPC DA Quality Code Reference

The OPC-DA 2.05a / 3.00 specification defines the lower byte of the Quality word as a 4-bit Quality field and a 4-bit Substatus field. Code 0x08 decodes as follows:

Softing INAT OPC-Server Ethernet sets 0x08 on all items mapped to a controller whose primary connection handle (the one the server has registered with the Pilz PSS communication stack) has entered DISCONNECTED state. The server's internal diagnostics log records the transition with the device IP, slot, and timestamp; this is documented in the Softing OPC-Server Ethernet handbook (PDF).

4. Softing INAT OPC-Server Ethernet Architecture

The INAT OPC-Server (rebranded under Softing as the OPC-Server Ethernet, part number families 1101-1000 through 1101-9999 depending on driver bundle) acts as a protocol bridge between the Ethernet-attached PLC and any OPC DA client on the host. For Pilz systems, the relevant protocol modules are:

• Pilz PSS 3000/4000 (Modbus/TCP) — typically routed through the PSS gateway or a PNOZmulti m B1 with Ethernet module.
• Pilz PMC (Pilz Multi-Configurator) / SafetyBUS p — supported by Softing via the SafetyBUS p option.
• Pilz PSS 4000 with OPC UA server — modern PSS 4000 firmware exposes a native OPC UA server, which can be preferred over OPC DA when the WinCC client supports OPC UA.

Each PLC connection in the Softing OPC explorer has the following relevant parameters (see the handbook section "Device Configuration » Ethernet settings"):

5. Why "Evaluate Tag Status" Does Not Fire

In WinCC V7 and WinCC RT Professional, the "Evaluate tag status" property on a graphic object is bound to the tag's State attribute, not its QualityCode. The mapping performed by the WinCC channel is:

WinCC channel driver sees:
  - OPC server process reachable?      -> YES
  - Last Read()/Write() returned ok?   -> YES (server still answers)
  - Item QualityCode returned by server -> 0x08 (per item)

Therefore:
  - Tag.State          = 0 (OK)
  - Tag.QualityCode    = 0x08 (BAD_COMM_FAILURE)
  - Evaluate tag status condition      = not triggered

The bridging only happens if the OPC channel itself returns an error, for example when the OPC server process is stopped (CoCreateInstance fails, or IOPCServer::GetStatus returns S_FALSE / disconnected). In that case WinCC sets State = 1 (connection error) and overrides QualityCode to 0x0C.

6. Solution A — System-Tag Polling with C-Script / VBS

The classic WinCC V7 method is to expose a single OPC item from the Softing server whose quality reflects the link state, and bind that item to an internal boolean "LinkUp" tag. The item is most often a "System Status" register that the server updates with a counter, or a read of any item from the device.

Step 1 — Add a heartbeat tag in Softing OPC Explorer

1. Open the Softing OPC-Server Ethernet configuration.
2. Add a new item under the Pilz device, e.g. Device1.Heartbeat_Word at a 16-bit register that is guaranteed to be present (e.g. a holding register that the PLC firmware cycles 0…65535).
3. Set the Softing item's update mode to "On demand" and configure the connection timeout to 1000 ms.
4. Export/import the OPC tag list into WinCC using the OPC Scout or the WinCC OPC channel import wizard.

Step 2 — Create a WinCC internal boolean

In the WinCC Tag Management, add an internal tag PSS_Link_OK of type BOOL with initial value 0.

Step 3 — Schedule a Global Script to refresh the boolean

In WinCC V7, use the C-ODK scheduler (or a VBS action in a 1-second cyclic trigger). Example VBS in a global action:

' Global action, 1 s cycle
Dim oTag, q
Set oTag = HMIRuntime.Tags("Device1.Heartbeat_Word")
oTag.Read
q = oTag.QualityCode
If (q And &H00C0) = &H0000 Then         ' lower 2 bits = 00 (Bad)
    HMIRuntime.Tags("PSS_Link_OK").Write 0
Else
    HMIRuntime.Tags("PSS_Link_OK").Write 1
End If

Bind the PSS_Link_OK tag to the "Evaluate tag status" condition on every relevant object, or use it as the trigger for an Analog alarm in the alarm logging.

7. Solution B — Bridge the QualityCode Through the OPC UA Channel

WinCC RT Professional (TIA Portal V16 and later) ships with a native OPC UA client channel. The Unified Automation OPC UA Extension for SIMATIC WinCC provides a fully spec-compliant UA client including subscription-based monitoring, with quality and StatusCode propagation that is consumed by WinCC's tag status evaluation.

When Softing INAT is replaced by the Softing OPC UA Server (a separate product line) or the native OPC UA server of the Pilz PSS 4000, the StatusCode Bad_CommunicationError (numeric 0x80050000) is automatically translated by the WinCC OPC UA channel into a tag error, and "Evaluate tag status" works out of the box.

Procedure:

1. Open the TIA Portal project, navigate to Devices & Networks » HMI » Connections and add an OPC UA Client connection to the Softing / Pilz UA endpoint, e.g. opc.tcp://192.168.10.20:4840.
2. In the security settings, select the appropriate certificate policy. For an isolated cell network, None is acceptable; for plant networks use Sign with a server-side certificate issued by the WinCC project CA.
3. Import the namespace, drag the required nodes into the HMI tag table. The imported tags carry their original UA StatusCode mapping.
4. Verify in the WinCC diagnostics window that disconnecting the Pilz PLC updates QualityCode to 0x1C (good local override) is NOT raised, but the StatusCode mapping to WinCC State = 1 is.

8. Solution C — Direct QualityCode Polling in Graphics

For a small number of critical objects where the cost of Solution A (extra tag + script) is not justified, the QualityCode can be polled directly in the graphic object's property "Appearance / Flashing / Enable" with the following C-action:

// Returns 1 if tag quality is GOOD (0xC0..0xFF), else 0
{
    DWORD q;
    q = GetTagQualityCode(lpszPictureName, "Tag_1");
    return ((q & 0xC0) == 0xC0) ? 1 : 0;
}

This C-action is invoked every time WinCC refreshes the picture (default 250 ms). The return value drives the "Appearance" background color of the value field, so a degraded link produces a red flashing box. Performance impact is negligible for under 50 such evaluated objects per picture.

9. Verification Procedure

After applying Solution A, B, or C, perform the following acceptance test on the integrated Pilz–Softing–WinCC stack:

1. With the Pilz PLC online and healthy, verify in WinCC that all tags show QualityCode = 0xC0 and State = 0. Hover tooltip shows numeric value only.
2. Pull the network cable from the Pilz PLC. Wait one full connection-timeout interval (1000–5000 ms depending on configuration).
3. Verify with VBS that HMIRuntime.Tags("Device1.Heartbeat_Word").QualityCode = 0x08 (or equivalent per Solution B).
4. Verify that PSS_Link_OK transitions to 0 within one scheduler cycle (1 s).
5. Verify that the "Evaluate tag status" condition on the target object evaluates to "Bad" and the configured appearance / alarm fires.
6. Reconnect the cable. Verify that the Softing server transitions items back to 0xC0 within one poll interval and that PSS_Link_OK returns to 1 with no manual intervention.
7. Check the WinCC diagnostics file WinCC_Sys_.log for "OPC: Quality of tag … changed to BAD_COMMUNICATION" entries — these confirm the channel received the degraded quality.

10. Troubleshooting Matrix

11. Best Practices for Pilz–WinCC OPC Integration

• Prefer OPC UA for greenfield. For new Pilz PSS 4000 installations, expose the native UA server and connect WinCC RT Professional via OPC UA. StatusCode propagation is spec-compliant and removes the need for the bridging logic described above.
• Keep a heartbeat tag. Even on UA integrations, retain at least one cyclical read used solely for the purpose of monitoring the link state from the WinCC side. This is invaluable during commissioning and FAT.
• Configure explicit timeouts. Never leave the Softing server at its 3 000 ms default for safety systems. Set the connection timeout to 1 000 ms and the polling interval to 200 ms so that the propagation to 0x08 happens within the operator's attention envelope.
• Log quality transitions. Add a C-action in the scheduler that writes QualityCode changes to the WinCC user archive with timestamp. This gives you a permanent record for post-incident analysis without depending on the OPC server's local log.
• Document the bridging layer. If you use Solution A, document the heartbeat item, the script, and the internal PSS_Link_OK tag in the WinCC project notes. Future maintainers who only see the bridging boolean have no clue where it comes from.
• Test the fail-state in FAT. Pull the network cable on the bench, not in the live plant. Operators will not tolerate learning that the HMI silently freezes values on a real fault.

12. Alternative Architectures

For sites that already run a modern SCADA suite (Ignition, FactoryTalk View SE, WinCC Unified), the OPC DA layer can be replaced with a direct OPC UA connection to the Pilz PSS 4000 OPC UA server. The Siemens TIA Portal documentation on using OPC in WinCC RT Professional describes the supported UA client profiles and the security policies. When the UA channel is configured with a 1 000 ms publishing interval and a 5 000 ms keep-alive, the WinCC tag state machine propagates Bad_CommunicationError within the keep-alive window, eliminating the manual bridging step.

For Pilz systems that must remain on OPC DA (e.g. PSS 3000 with no UA server, or where the SCADA vendor is locked to OPC DA), the Softing OPC-Server Ethernet remains the most widely deployed bridge. The QualityCode bridging solutions above are the standard mitigation in those environments.