Siemens WinCC Modbus TCP/IP Slave to Remote PC Setup

1. Overview

Boiler HMI stations built on Siemens WinCC are commonly deployed as redundant Operator Station (OS) Servers that aggregate process tags from PLCs via S7/MPI/Profibus/Ethernet. The next integration layer is often a centralised control room PC — or a third-party supervisory package — that polls each boiler station using Modbus TCP/IP (port 502). The technical question is: can WinCC expose its internal tag database as Modbus holding/input registers so that a remote PC acting as a Modbus master can read boiler data without modifying the SCADA application on the OS servers?

This reference covers three production-grade paths:

1. WinCC acting natively as a Modbus TCP/IP slave (WinCC V7.5 SP1+ with the Modbus/TCP Slave option, or WinCC Unified with the standard Modbus TCP/IP driver).
2. WinCC publishing tags to a Modbus TCP gateway (e.g. SIMATIC Modbus/TCP PN Coupler, ET 200SP Modbus coupler, HMS Anybus, Phoenix Contact, Red Lion, Moxa) which then exposes the registers to the remote master.
3. WinCC publishing tags via OPC DA or OPC UA using the WinCC Connectivity Pack, with the remote PC consuming them through an OPC bridge that re-publishes as Modbus TCP.

The 150–200 tag payload referenced in the original requirement fits comfortably inside a single Modbus transaction block and is well within the bandwidth of Modbus TCP on a normal plant LAN or routed VPN/3G link.

2. Architecture and Data Flow

There are two distinct endpoint roles in this integration:

• Boiler OS server side (WinCC) — exposes data. It must speak Modbus TCP in server (slave) mode, listening on TCP/502 and responding to read function codes 03 (Read Holding Registers), 04 (Read Input Registers), 01 (Read Coils), 02 (Read Discrete Inputs), and write function codes 05, 06, 15, 16 if write-back is required.
• Remote control PC side (third-party SCADA / custom master) — initiates connections, reads holding/input registers, and optionally writes coils/registers for commands.

3. WinCC Modbus TCP Capability Matrix

4. Option A — WinCC as Modbus TCP/IP Slave

4.1 WinCC V7.x: enabling the Slave channel

1. Open WinCC Explorer on the OS server.
2. Right-click Tag Management → Add new driver → select "Modbus TCP/IP Slave". (If absent, the license is not installed.)
3. Right-click the new driver → New Connection.
4. Configure the connection:
   • IP address / host name of the remote PC (master) — restrict to known master IPs in firewall.
   • Port: default 502 for Modbus TCP. Change only if a NAT or tunnel requires it.
   • Station address (Unit ID): typical value 255 (Modbus TCP default) or a value matching the master device profile.
   • Byte order: WinCC V7 implements Modbus standard big-endian. Confirm against the master's expectation; mismatched word/byte order is the single most common cause of "garbage" values.
5. Define the tag mapping. Each WinCC tag is exposed as a Modbus address. Holding Register area starts at offset 0 unless your mapping profile specifies otherwise.
   • Word (16-bit) WinCC tags → 4x Holding Registers, e.g. 400001 = first tag.
   • 32-bit float values → occupy two consecutive registers, e.g. 400001–400002. Document register pairing explicitly in the master side.
   • Boolean tags → 0x Coils, e.g. 000001.
6. Save, compile the OS, restart the WinCC Runtime.

4.2 WinCC Unified (TIA Portal V16+)

The Unified runtime includes a Standard Modbus TCP/IP driver that can be configured as a server. In the TIA Portal project tree:

1. Open the Unified HMI device → Connections.
2. Create a new Modbus TCP/IP connection.
3. Set:
   • Mode: Server (this is the role that answers the master).
   • Port: 502 unless firewall/NAT requires otherwise.
   • Connection type: TCP/IP.
   • Activate connection: checked.
4. Map the HMI tags to Modbus addresses via the Modbus address mapping editor. The exact editor location and field labels are described in Siemens TIA Portal documentation — Configuring the protocol parameters (Standard Modbus TCP/IP).

4.3 Example tag map (boiler station, 192 tags)

This layout gives the remote master a deterministic 200-register map. Reserve 400000–400050 for status / handshake, 400050–401000 for measured values, 401000–402000 for commands / setpoints.

5. Option B — Modbus TCP Gateway (SIMATIC, ET 200SP, HMS, Red Lion)

If the WinCC OS server cannot be re-licensed for the Modbus/TCP Slave option, insert a Modbus TCP gateway in the path. The gateway polls (or is polled by) WinCC via S7 / OPC and exposes the data as Modbus TCP registers. This is the most common production pattern when WinCC is treated as authoritative and Modbus is an interface for a third-party system.

5.1 Siemens SIMATIC ET 200SP Modbus TCP coupler

• Order number 6ES7138-6DF01-0AB0 (Modbus TCP coupler for ET 200SP, head module).
• Function: server listens on TCP/502, returns process image to master.
• On the WinCC side, the S7 connection to the ET 200SP station provides the data; on the Modbus side the coupler exposes a fixed register image.

5.2 HMS Anybus X-gateway / Communicator

HMS Networks publishes explicit integration notes for Siemens WinCC as the SCADA endpoint of an Anybus gateway. Refer to HMS Networks — Communicating to a Siemens WINCC SCADA via Modbus TCP/IP for the canonical reference wiring diagram. The typical pattern is:

• Anybus serial/Profinet/Ethernet/IP scanner side reads from WinCC's data source (or from the underlying S7 PLC).
• Anybus Modbus TCP server side publishes holding/input registers on TCP/502.

5.3 Other commonly used gateways

6. Option C — OPC DA / OPC UA via WinCC Connectivity Pack

When the Modbus/TCP Slave option is not available and a gateway is undesirable, the WinCC Connectivity Pack exposes the tag database through OPC DA (legacy, DCOM) and OPC UA (modern, encrypted). The remote PC can then consume these tags through any OPC client; if the remote application is a Modbus-only SCADA, an OPC-to-Modbus bridge (e.g. KEPware, MatrikonOPC Modbus Server, Softing dataFEED) is added at the remote side to re-publish as Modbus.

• OPC DA: WinCC Connectivity Pack exposes the tag DB on port 135 (RPC) plus dynamic DCOM ports; legacy but well supported. See Siemens support entry Siemens Entry ID 22892718 — OPC communication with WinCC for the canonical setup notes.
• OPC UA: WinCC Unified exposes OPC UA server on default port 4840. Recommended for greenfield and any deployment crossing security boundaries.

This option is the most flexible in terms of tag volume and security, but it requires both an OPC client on the remote PC and (for Modbus-only masters) a bridging application on the remote side.

7. Network and Firewall Requirements

Modbus TCP is a plaintext, unauthenticated protocol designed for trusted plant networks. Treat it accordingly.

8. Redundancy Considerations

The boiler OS is described as a redundant server pair. Two viable redundancy patterns exist for the Modbus interface:

1. Active/active with two TCP listeners — each OS server runs the Modbus slave on TCP/502; the remote master is configured with two slave IP addresses and fails over if a session drops. This works only if the OS redundancy synchronises tag values between the pair (standard WinCC redundant option).
2. Active/passive via virtual IP (VIP) — the cluster's VIP (e.g. a Windows Failover Cluster role or a VRRP-capable router) holds TCP/502; the remote master connects to a single IP. Cleaner from the master's perspective.

State which model is in use before specifying the Modbus wiring. Polling two independent slave IPs without VIP fails the OPC/Modbus consistency requirement the moment the active server changes.

9. Verification and Diagnostics

9.1 Connectivity test (no WinCC tool required)

1. From the remote PC, open a command prompt and run telnet <WinCC_OS_IP> 502. A blank screen (the connection stays open) means TCP/502 is reachable. A "connection refused" means either the listener is not running or a firewall is blocking.
2. Run a Modbus poll test using an open-source tool (e.g. modbus-cli, libmodbus examples, QModMaster) against the slave IP, FC 03, address 0, quantity 10. Expected response: 20 bytes (10 registers × 2 bytes) preceded by MBAP header (transaction ID, protocol ID 0, length, unit ID).

9.2 WinCC-side diagnostics

• Open the WinCC Channel Diagnosis applet (WinCC V7) or Trace Viewer (Unified). Filter on the Modbus channel. Look for connection-state events and request/response byte counts.
• Watch the OS server's Windows Firewall with Advanced Security log for dropped packets to TCP/502.
• Use netstat -an | findstr 502 on the OS server to confirm a listening socket on 0.0.0.0:502 (or the specific NIC address).

9.3 Tag-level verification

1. Force a known value into a WinCC tag in the OS server (e.g. via WinCC internal variable or a test script).
2. Read the corresponding Modbus register from the remote master and confirm the value matches, including byte order.
3. Reverse the test: write a value from the remote master (FC 06 / 16) to a dedicated test register mapped to a WinCC internal tag, and confirm the WinCC tag reflects the write.

10. Troubleshooting Matrix

11. Decision Path: Which Option to Choose

• Pick Option A (native WinCC Modbus slave) if the WinCC version is V7.4 SP1+ or Unified, and the Modbus/TCP Slave option can be licensed. This is the cleanest path: no extra hardware, no extra software on the remote side, no double-mapping.
• Pick Option B (gateway) if WinCC is older, the slave option is not licensed, or there are multiple masters that need to read the same boiler data simultaneously without sharing a TCP session.
• Pick Option C (OPC + remote bridge) if the remote PC already runs an OPC-capable SCADA, or if cybersecurity policy prohibits opening TCP/502 across a WAN/3G link. OPC UA (port 4840, encrypted) is the preferred transport.

12. Security and Operational Notes

• Modbus TCP carries no authentication and no encryption. It is acceptable on a sealed ICS VLAN; it is not acceptable across a routed or public boundary without a VPN.
• Disable all unused Modbus function codes on the master if the SCADA supports it (e.g. allow only FC 03 / 04 from the field).
• Document the complete register map in a single engineering document; make it a controlled revision (e.g. Engineering_Boiler_Modbus_Map_RevN.xlsx) signed by both boiler integrator and central SCADA integrator.
• Add the boiler station to the central SCADA's asset inventory with IP, port, Unit ID, last-seen timestamp, and alarm on comms loss.
• Include a Modbus comm-loss alarm in the boiler HMI as well, so the boiler operator is notified if the central system is offline for more than, e.g., 60 s.