WinCC MPI to Ethernet: Share PLC Tags to Remote WinCC Clients

1. Problem Statement and Scope

A WinCC Station (TIA Portal WinCC Professional/Advanced, or WinCC V7.x) is connected to a SIMATIC S7-300/400 CPU through an MPI interface (CP 5611, CP 5621, PC adapter USB, or onboard MPI). All external tags are acquired successfully on this station, and HMI screens are updating correctly. The engineer now needs to forward those same tags — without re-adding the MPI driver to the second machine — to a remote WinCC client reachable only over the plant LAN (TCP/IP Ethernet).

Because MPI is a point-to-point or limited multi-drop RS-485 protocol at typically 187.5 kbit/s or 1.5 Mbit/s, it does not route over Ethernet routers and cannot natively traverse an office/plant LAN. The WinCC station that owns the MPI channel must therefore act as the data broker. This reference documents the four supported methods, their licensing impact, and the diagnostic checks required to confirm tag propagation.

2. MPI Communication Background

MPI (Multi-Point Interface) is the Siemens proprietary protocol derived from PROFIBUS DP at the physical layer (EIA-485, 9.6 kbit/s to 12 Mbit/s; most field deployments use 187.5 kbit/s or 1.5 Mbit/s). It supports up to 32 nodes on a single segment, with the programming device typically occupying address 0 and CPUs at 2, 3, 4. Connection resources on an S7-300 CPU are limited (e.g. S7-314 with PG/OP/AS-i only has 4–6 PG/OP connections reserved for HMI and programming), so the WinCC station may not be the only consumer of the PG/OP resource.

For a single S7-300 station with one MPI-connected WinCC, the standard recipe is documented in the TIA Portal help under "Communication via MPI (Basic Panels, Panels, Comfort Panels, RT Advanced, RT Professional)" — see the TIA Portal V21 HMI MPI connection configuration page. The same access point configuration is used by WinCC Runtime; only the channel diagnosis differs.

Because MPI does not carry IP traffic, the data has to exit the WinCC Station through one of the following software surfaces:

• WinCC Server-Client – internal binary protocol over TCP port 0x4444 / dynamic.
• WinCC OPC DA Server – COM-based, DCOM on TCP 135 plus dynamic.
• WinCC OPC UA Server – introduced with WinCC V7.3 / TIA WinCC Professional V14+, port 4840.
• WinCC Web Navigator – HTTPS, default 443 (server) and 80 (client config).
• External gateway (e.g., Hilscher NetLink PRO, Pi S7-Lan, IBH Link S7) that physically bridges MPI/PROFIBUS to Ethernet and exposes a TCP listener for OPC/Modbus/S7-LAN.

3. Architecture Decision Matrix

Choose one of the following architectures before installing any license. The decision is driven by the role of the second station (WinCC client, third-party HMI, custom .NET, or web browser), by the licensing already in use, and by the cybersecurity policy of the plant.

4. Prerequisites

Confirm the following before changing any configuration:

1. Both PCs are on the same IP subnet and can ping each other by name. WinCC Server-Client and OPC DA/UA both use Windows hostnames for endpoint resolution.
2. Windows firewall rule "SIMATIC WinCC Server" / "SIMATIC WinCC OPC" is enabled. On Windows 10/11, run WF.msc and verify inbound rules for CCEServer.exe, OPCDA.exe, Simulation.exe, and WebNavigatorRT.exe.
3. Local user account on the Server is a member of group SIMATIC HMI (created by the WinCC setup). The Client user must exist on the Server with the same password or be reachable through a trusted domain.
4. The MPI channel is stable. Open WinCC Explorer → "Diagnostics" → "Channel Diagnosis" and verify "Status = OK" and the connection's "Quality Code = 0xC0" (good) for at least one external tag.
5. No additional PG/OP connection resources are exhausted on the CPU. In STEP 7, open the CPU hardware properties → "Communication" tab and check that at least one PG/OP connection is still free.
6. Licenses are available on the server for the chosen option (RT 128, Server, Connectivity Pack, or WebNavigator). Check in WinCC Explorer → "Licensing" or run Automation License Manager.

5. Method A — WinCC Server / Client (recommended for native WinCC clients)

This is the simplest path when the second station is a WinCC station. The original PC becomes the WinCC Server; the second PC becomes a WinCC Client. Both run identical project files; only the runtime mode differs.

5.1 Server configuration

1. Open the WinCC project on the Server PC in the WinCC Explorer (V7.x) or TIA Portal (for WinCC Professional).
2. Project properties → "General" → check "This is a server".
3. For each HMI tag that must be visible on the client, set its "Server" attribute. WinCC uses a "preferred server" mechanism in TIA: tag properties → "Quality code of PLC connection" / "WinCC preferred server" is set to this PC's name.
4. Activate the project. The Server service CCEServer.exe listens on TCP 0x4444 (and higher dynamic ports for diagnostics). Verify with netstat -an | find "4444".

5.2 Client configuration

1. Copy the same project to the Client PC (WinCC Server-Client allows the project to be loaded from a network share if path is identical; for production install a local copy).
2. Project properties → "General" → check "This is a client".
3. Add the server name in the project tree under "Server-Client" → "Server List". The client will subscribe to external tags and internal tags on demand.
4. Insert at least one "Server prefix" so the client knows which remote server supplies each tag: tag property "Computer name" or "WinCC Server".
5. Activate. Open the screen "Diagnosis" → "Connections": every external tag should show "quality good (0xC0)" and a non-zero update rate.

5.3 Server-Client diagnostics

Open WinCC Explorer on the Server and on the Client:

• Tools → Server-Client Diagnosis lists each client, the time of last tag update, and the count of subscribed tags.
• The default WinCC channel tags @ServerConnectionCount and @ServerLostConnection can be referenced on a screen for operator visibility.

6. Method B — OPC DA / UA (best for third-party clients)

Use OPC when the remote consumer is not a WinCC Station — for example a SCADA, an Excel VBA dashboard, or a custom .NET service. OPC DA is the classic COM implementation; OPC UA is the modern cross-platform equivalent.

6.1 OPC DA on the Server (WinCC V7.x)

1. Install "Option Connectivity Pack" on the Server PC. This adds the OPC DA server OPCDA.exe and the OPC A&E server OPC_A&E.exe.
2. Activate the WinCC project. The OPC server registers itself as OPCServer.WinCC and exposes every external tag under hierarchical folders named after the channel/connection.
3. On the remote client, configure DCOM access: dcomcnfg → Component Services → Computers → My Computer → DCOM Config → "OPCServer.WinCC" → Properties → Security → add the client user with "Launch and Activation" and "Access" permissions.
4. Open the client OPC browser and add the server by selecting "OPCServer.WinCC" on the Server hostname. Add tags by browsing the namespace.

6.2 OPC UA on the Server (WinCC V7.3+ / TIA WinCC)

1. Activate the WinCC project, then start the WinCC OPC UA Server console: "C:\Program Files\Siemens\Automation\WinCC\bin\UAConfigurator.exe" (V7) or configure the UA server in TIA under "Runtime settings → OPC UA".
2. Define an endpoint URL: opc.tcp://<ServerHostname>:4840. Default port 4840; for firewalls map explicitly.
3. Configure the security policy (None, Basic128Rsa15, Basic256Sha256) and a user token (Anonymous for testing, Username/Password for production). Add the client certificate to the Trusted certificates store if "Sign & Encrypt" is selected.
4. On the OPC UA client, add the endpoint URL. Browse the namespace — every WinCC external tag is exposed under Objects/<Channel>/<Connection>/<TagName>.

6.3 OPC quick verification

Install "OPC Scout V10" (Siemens) or "UaExpert" (Unified Automation) on the client PC. Connect to the configured endpoint, drag a known MPI tag (e.g. a motor current with a slow oscillating value) into the watch window, and confirm the value updates at the configured acquisition cycle (typically 1 s by default).

7. Method C — WinCC Web Navigator (for browser-based clients)

Web Navigator publishes the live HMI screens, alarms, and trends to a web browser. Operators do not need WinCC installed on the second PC, which is useful for supervisory offices.

1. Install the WebNavigator Server option on the WinCC Server PC. This adds WebNavigatorRT.exe and the IIS work process w3wp.exe.
2. Configure Internet Information Services: enable HTTPS, install the Siemens certificate from SSCERTSRV or a CA-issued one, and bind port 443 to the WebNavigator web site.
3. In the WinCC project, mark every screen that must be accessible remotely as "Web-enabled".
4. On the second PC, point the browser to https://<ServerHostname>/WebNavigator/ and log in with a WinCC user that has WebNavigator access rights.
5. Data flow is: MPI → WinCC Server internal tag DB → IIS → browser. Latency is typically 500–2000 ms depending on the screen refresh interval and number of active users.

8. Method D — External MPI / Ethernet Gateway

If the original PC must be removed from the architecture (e.g., the WinCC station is being decommissioned) or if the second station cannot host WinCC at all, install a hardware gateway. These boxes have a PROFIBUS/MPI slave on one side and a TCP listener on the other side. The S7-LAN variants expose the CPU's tag space using the native S7 protocol on port 102, which can be read by WinCC via the "SIMATIC S7 Protocol Suite" channel on a TCP/IP connection — no MPI on the new client PC required.

For the new client PC, add a TCP/IP connection in WinCC using the "SIMATIC S7 Protocol Suite" channel and select "TCP/IP". Point the connection to the gateway's IP, slot 2, rack 0 for an S7-300 CPU. Tag addresses (e.g. DB100.DBW0) are now accessible over the LAN without involving the original PC at all.

9. Step-by-Step Example — WinCC Server-Client (most common)

The following procedure assumes WinCC V7.5 SP2 on Windows 10 IoT LTSC 2019, an S7-315-2 PN/DP connected over MPI, and a target client PC at 10.20.30.45 with the same project files copied locally.

1. On the Server, open the project, go to Project Properties → General, enable "This computer is a WinCC Server" and enter a server name (default: hostname).
2. In "Computer" properties, add the Client computer name. Set the Client's startup mode to "Wait for server start".
3. For each HMI tag, open Properties → "Settings" and check "Use server prefix". Add a prefix matching the Server name in the project's tag namespace. WinCC inserts the prefix in the form <ServerName>::TagName for client-side interpretation.
4. Verify the user account: Control Panel → User Accounts → Manage User Accounts and confirm both Server and Client users exist with identical passwords. WinCC does not accept empty passwords for cross-machine connections.
5. Open Windows Defender Firewall with Advanced Security and enable the predefined rules for "SIMATIC WinCC Server" (inbound + outbound) on both PCs. On the domain profile, set the rule to "Allow the connection".
6. Start the Server. Open the "Server-Client Diagnosis" tool from the WinCC Explorer menu. The status must read "Server: started, no clients connected".
7. On the Client, activate the project. In the same Diagnosis window (connected to the Server's UDP broadcast, port 137/138), confirm that the Client row shows "Connected" and a non-zero "Tag requests/s".
8. Insert a status display on the Client screen bound to an external tag. The status should match the Server within one acquisition cycle. A persistent quality code of 0x01 (bad / communication failure) usually points to a DNS or firewall problem; 0x05 (no communication to partner) usually means the Server is not yet started or the user authentication failed.

10. Verification Matrix

11. Troubleshooting Matrix

12. Field-Commissioning Checklist

• Document the MPI address, baud rate (typically 187 500 bit/s) and PG/OP connection resource number of the CPU in the project handover package.
• Save a copy of the WinCC project before any Server/Client change; a "client-only" project that has its Server flag flipped off can no longer acquire from MPI.
• Verify that the WinCC user logged in at runtime has the right to read every tag, otherwise WinCC returns quality 0x0F (Access denied) silently.
• On a virtualized Server, disable VM checkpoint before activation; a checkpoint during tag write-back can corrupt the alarm log.
• Open the WinCC "Performance in Process" tool and review the "Cycle time" of the MPI channel — if it exceeds 80 % of the configured cycle, raise the cycle or reduce the tag count to avoid back-pressure on the Client.

13. Choosing the Right Method (Summary)

If the second station is a WinCC station and tag values, alarms, and archives must be identical, use Server/Client. If the consumer is third-party software or a cross-platform .NET/.Java service, use OPC DA for legacy Windows clients or OPC UA for modern cross-platform clients. If the consumer is a browser, use Web Navigator. If the original PC must disappear, or you need a tiny embedded reader, install a hardware gateway and use the S7 Protocol Suite on a TCP/IP connection. All four are documented in the official TIA Portal help portal — see the Siemens TIA Portal HMI MPI configuration reference for the channel-side configuration of MPI on the Panel/RT side that anchors all of these forwarding methods.