TP277 ADOCE SQL Connectivity: Limitations and Verified Workarounds

The Siemens SIMATIC TP277 6" panel is a frequently deployed HMI in the xP27x family. Engineers who come from a PC-based WinCC Flexible / TIA Portal background often attempt to install ADOCE (Microsoft ActiveX Data Objects for Windows CE) on the device so they can run ADO-style database queries directly from the panel's VBScript environment. In practice, the install hangs on Setting registry entries..., and a deeper investigation shows the limitation is not the CAB package but the locked-down image that Siemens ships on the panel. This reference explains why the install cannot complete, what is actually inside the TP277 firmware image, and which officially supported paths deliver equivalent data exchange with an external Microsoft SQL Server.

1. Platform Overview: TP277 6" Hardware and Firmware

The TP277 6" is part of the 270 series of SIMATIC Panels and ships with a tightly constrained image rather than a generic Windows CE distribution.

The crucial point is that the WinCE image on the TP277 is not a full Windows CE 3.0 distribution. Siemens licenses the CE 3.0 base, removes components that are not required by WinCC Flexible Runtime, and signs the image so that the standard WCELoad.exe CAB installer cannot write its registry hive in the way generic ADOCE requires.

2. What ADOCE Actually Needs from the OS

ADOCE is a Microsoft-supplied data access stack for Windows CE / Pocket PC devices. It is not a single DLL; it is a set of COM components that register themselves into the device registry at install time.

Installation with the standard Microsoft CAB triggers WCELoad.exe to call into the COM registration chain (DllRegisterServer on each DLL). That call sequence is what fails on the TP277.

3. Root Cause of the Setting Registry Entries... Hang

Three contributing problems appear in the same symptom. Diagnose them in this order before assuming a corrupted CAB.

3.1 WCELoad.exe defect on early CE 3.0 builds

Microsoft documented a WCELoad bug where the loader takes an exception inside corelc.dll while processing the [RegKeys] section of a .inf-style CAB manifest. The fix requires a patched WCELoad.exe and a parallel corelc.dll. The patch is published only for licensees of Windows CE Platform Builder 3.0, which is not available to end users running WinCC Flexible.

3.2 The shipped registry hive is read-only for CAB installers

Siemens partitions the registry on the xP27x devices so that the WinCC Flexible keys live in a writable section but the COM-related keys (HKEY_CLASSES_ROOT\CLSID, HKEY_CLASSES_ROOT\TypeLib, etc.) sit in a protected area. The CAB handler opens those keys with insufficient access and the install appears to hang rather than fail explicitly.

3.3 The componentized image is missing OLE/COM infrastructure

ADOCE depends on a minimum OLE Automation layer. The TP277 build provides only the OLE objects WinCC Flexible Runtime actually consumes. Calling CreateObject("ADODB.Connection") from VBScript produces error 429 (ActiveX component can't create object) at runtime, regardless of whether you managed to copy the DLLs.

4. Why the Manual Registration Workaround Will Not Save You

Engineers sometimes try to bypass WCELoad by copying the ADOCE DLLs and running regsvrce over a telnet or FTP session. Two obstacles apply on the TP277:

1. There is no shell-equivalent command line on the xP27x image. The only console is the WinCC Flexible diagnostic page, which exposes file operations but not arbitrary process execution.
2. Even if the DLLs are regsvrce-registered, the missing OLE Automation / DCOM support means the COM object is unreachable from the VBScript engine used by WinCC Flexible.

Siemens presales has confirmed in answer to similar requests that no standard panel variant can be made to accept ADOCE without a custom firmware image built with Platform Builder. The contact channel is documented in Siemens support entry 15247601 for customized CE images.

5. Architecturally Supported Alternatives

Three patterns deliver the same intent (read/write data on an external SQL Server) without breaking the signed image.

6. Pattern A: OPC DA on the TP277 with a Custom ADODB Server

The TP277 natively exposes a Siemens OPC DA server channel when the project is compiled with the OPC option. A small Windows service running on the engineering station can be written in C# to subscribe to those OPC items, then persist the values to SQL Server using System.Data.SqlClient. This is the most transparent path because it preserves the familiar Tag -> DB mental model of WinCC Flexible.

6.1 Required components

• Siemens OPC DA server shipped with WinCC Flexible / TIA Portal on the PC
• TP277 project with OPC server enabled in the connections editor
• Custom .NET 4.8 (or .NET 6 if OPC UA bridge is acceptable) Windows service using OPCAutomation.dll or System.Data.SqlClient

6.2 Server-side C# sketch

using System.Data.SqlClient;
using OPCAutomation;

OPCServer opc = new OPCServer();
opc.Connect("OPC.SimaticNET.1", "TP277-PC");
OPCGroup grp = opc.OPCGroups.Add("DbGroup");
grp.DataChange += (tx, evs) => {
    foreach (var ev in evs) {
        using (var cn = new SqlConnection(
            "Server=SQLSRV;Database=Prod;Integrated Security=SSPI;")) {
            cn.Open();
            using (var cmd = new SqlCommand(
                "INSERT INTO dbo.TpValues (TagId, Val, T) " +
                "VALUES (@id, @v, SYSUTCDATETIME())", cn)) {
                cmd.Parameters.AddWithValue("@id", ev.ItemName);
                cmd.Parameters.AddWithValue("@v", ev.Value);
                cmd.ExecuteNonQuery();
            }
        }
    }
};

6.3 Verification

From the TP277 side, force a tag change in WinCC Flexible. Within the configured update rate, the row should appear in the dbo.TpValues table. If nothing arrives, capture an OPC trace on the PC service and confirm the OPC.SimaticNET.1 ProgID is registered. Refer to Siemens Industry Online Support for the OPC server installation guide matching your WinCC Flexible / TIA Portal version.

7. Pattern B: HTTP Scripting Bridge with a .NET Web Service

The TP277 supports the WinCC Flexible "HTTP" channel, which can trigger VBScript functions on tag-value change. The VBScript payload is not ADODB-capable, but it can POST a small XML/JSON body to a web service hosted on a Windows machine that does have full ADO.NET. This is the pattern most often used when the SQL Server is on a different subnet from the panel.

7.1 REST endpoint (ASP.NET Core minimal API)

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

app.MapPost("/api/tp277", async (TpReading r) => {
    using var cn = new SqlConnection(
        builder.Configuration.GetConnectionString("Prod"));
    await cn.OpenAsync();
    using var cmd = new SqlCommand(
        "INSERT INTO dbo.TpReadings (Tag,Value,T) " +
        "VALUES (@t,@v,SYSUTCDATETIME())", cn);
    cmd.Parameters.AddWithValue("@t", r.Tag);
    cmd.Parameters.AddWithValue("@v", r.Value);
    await cmd.ExecuteNonQueryAsync();
    return Results.Ok();
});

app.Run();
record TpReading(string Tag, double Value);

7.2 TP277 VBScript (WinCC Flexible)

' Called from a tag-trigger or scheduled action in WinCC Flexible
Sub WriteToSql(tagName, value)
    Dim url, body, xmlhttp
    url = "http://sqlbridge.internal/api/tp277"
    body = "{ ""Tag"":" & Chr(34) & tagName & Chr(34) & _
           ", ""Value"":" & CStr(value) & " }"
    Set xmlhttp = CreateObject("MSXML2.ServerXMLHTTP")
    xmlhttp.open "POST", url, False
    xmlhttp.setRequestHeader "Content-Type", "application/json"
    xmlhttp.send body
    If xmlhttp.status <> 200 Then
        SmartTags("Comms.LastError") = xmlxml.status ' log on a HMI tag
    End If
End Sub

7.3 Verification

Trigger the script from a button in runtime. Tail the IIS / Kestrel log on the bridge host; a 200 response and a new row in SQL confirm the round trip. If the panel returns automation error, check that the URL is reachable from the TP277's network and that Windows Firewall on the bridge host allows inbound 80/443.

8. Pattern C: fileCtl.dll and CSV Bulk Transfer

The simplest fully-supported path uses the fileCtl.dll that WinCC Flexible exposes to VBScript. The panel writes a CSV to its flash file system or a network share, and a Windows service or scheduled task on the PC side imports the file into SQL Server with BULK INSERT or SqlBulkCopy. This is the pattern to recommend when the panel only needs to publish a periodic snapshot (alarm history, shift totals, energy counters) and the SQL side can tolerate minute-scale latency.

8.1 TP277 side: append a CSV row

' Run from a scheduled task or value-change trigger
Sub AppendReading(ts, tag, val)
    Dim f, path, line
    path = "\Storage Card\export\readings.csv"
    line = ts & "," & tag & "," & CStr(val)
    Set f = CreateObject("FileCtl.File")
    f.Open path, 8          ' 8 = modeAppend
    f.LinePrint line
    f.Close
End Sub

8.2 PC side: import the file every minute

using System.Data.SqlClient;
using System.Data;
using System.IO;

string src = @"\\TP277\Storage Card\export\readings.csv";
using var cn = new SqlConnection("Server=SQLSRV;Database=Prod;Integrated Security=SSPI;");
cn.Open();
using var bulk = new SqlBulkCopy(cn) { DestinationTableName = "dbo.TpReadings" };
bulk.ColumnMappings.Add("T", "T");
bulk.ColumnMappings.Add("Tag", "Tag");
bulk.ColumnMappings.Add("Value", "Value");
using var reader = new StreamReader(src);
var dt = new DataTable();
dt.Columns.Add("T", typeof(DateTime));
dt.Columns.Add("Tag", typeof(string));
dt.Columns.Add("Value", typeof(double));
string line;
int moved = 0;
while ((line = reader.ReadLine()) != null) {
    var p = line.Split(',');
    dt.Rows.Add(DateTime.Parse(p[0]), p[1], double.Parse(p[2]));
    if (dt.Rows.Count >= 1000) { bulk.WriteToServer(dt); dt.Clear(); moved += 1000; }
}
if (dt.Rows.Count > 0) { bulk.WriteToServer(dt); moved += dt.Rows.Count; }
File.Move(src, src + ".done-" + DateTime.UtcNow.Ticks);

8.3 Verification

Confirm the SMB share is visible from the panel using the WinCC Flexible file browser. The TP277 must have the share mounted as a network drive; the standard VBScript FileCtl.FileSystem object will then accept the UNC path. The CSV should rotate (rename to .done-<ticks>) on the PC side so the panel does not append to an already-imported file.

9. Comparison Matrix: Which Pattern Fits Which Requirement

10. Migration Path: WinCC Flexible on a PC Runtime

If your application genuinely needs CreateObject("ADODB.Connection") from inside the HMI script, the most pragmatic answer is to move the runtime to a PC. WinCC Flexible Runtime and TIA Portal WinCC RT both expose the full ADODB object model when running on Windows, because the host OS has the COM/OLE Automation layer that ADOCE relies on. The script then becomes exactly the same as the one the user originally tried on the panel:

' WinCC Flexible Runtime on Windows, VBScript
Sub SyncToSql(equipId, status)
    Dim conn, cmd
    Set conn = CreateObject("ADODB.Connection")
    conn.Open "Provider=sqloledb;Data Source=SQLSRV;" & _
              "Initial Catalog=Prod;Integrated Security=SSPI;"
    Set cmd = CreateObject("ADODB.Command")
    cmd.ActiveConnection = conn
    cmd.CommandText = "INSERT INTO dbo.Equipment (Id,Status,T) " & _
                     "VALUES (?,?,SYSUTCDATETIME())"
    cmd.Parameters.Append cmd.CreateParameter("@id", 200, 1, 32, equipId)
    cmd.Parameters.Append cmd.CreateParameter("@st", 200, 1, 16, status)
    cmd.Execute
    conn.Close
End Sub

For environments standardized on TIA Portal, the equivalent path is to use the WinCC RT Professional's built-in IndustrialDataBridge or to expose tags via OPC UA to a SCADA layer that performs the SQL persistence.

11. Field Commissioning Checklist

1. Confirm the panel model: only the xP27x family (TP277, OP277, MP277, TP270, OP270) share this image; the MP377 / Comfort Panel lines use a different image with similar constraints but newer runtime.
2. Disable any attempt to push ADOCE CABs via ProSave; they will not succeed and will pollute the registry hive.
3. Decide between OPC DA, HTTP, and CSV based on the latency table above.
4. For OPC: install the SimaticNet OPC server on the bridge PC, allow the TP277 through the Windows firewall on port 135 plus the dynamic DCOM range.
5. For HTTP: pin the bridge service URL in the TP277 project (do not rely on DNS) and use MSXML2.ServerXMLHTTP, not MSXML2.XMLHTTP, to avoid the local-proxy pitfalls documented for CE 3.0.
6. For CSV: pre-create the destination folder on the network share, set share permissions so the panel service account has write access, and size the share so it can absorb a shift's worth of readings even if the import job is down.
7. Capture a baseline: a 30-minute soak test with the chosen pattern, then compare the row count in SQL with the panel's own archive log.

12. Frequently Asked Questions