WinCC SQL Server Connectivity: Configuring Remote Database Access

WinCC SQL Server Connectivity: Configuring Remote Database Access

Siemens WinCC (V6.0 and later, including V7.x and TIA WinCC Professional) can be configured to read from and write to a Microsoft SQL Server instance that resides on a separate workstation or server — even when that machine has neither WinCC nor an OPC server installed. This reference covers the four supported integration paths: VBS with ODBC, ANSI-C with the WinCC database API (DBConnect / DBExecuteDirect_hdsn), WinCC Industrial Data Bridge, and the WinCC Connectivity Pack. Each method is documented with prerequisites, configuration steps, sample code, verification procedures, and a fault matrix.

1. Architecture and Communication Paths

There are four practical architectures for moving data between a remote SQL Server and a WinCC Runtime project. The choice depends on data volume, update rate, license availability, and whether the WinCC station is a PC-based Runtime or a WinCC Professional (TIA Portal) engineering station.

For most single-station or small-scale deployments where only a few tags need periodic synchronization, the VBS + ODBC route is the lowest-cost and most portable approach. For higher data volumes, the Industrial Data Bridge (IDB) or Connectivity Pack provide scheduler-driven, robust transfer with retry semantics. When the SQL Server is an external business system (ERP/MES) and WinCC must consume or produce records, all four methods can be used; method selection is driven by the IT/OT boundary policy.

2. Prerequisites

Before configuring any of the four paths, verify the following prerequisites on both the WinCC station and the SQL Server host.

2.1 WinCC Station Prerequisites

1. WinCC V6.0 or higher installed and licensed. The article applies to V6.x, V7.x, and WinCC Professional (TIA Portal V13+); older V5.x variants use a different scripting API.
2. An ODBC driver matching the target SQL Server version:
   • SQL Server (legacy, ships with Windows)
   • SQL Server Native Client 11.0 (SQL 2012–2016 era)
   • Microsoft ODBC Driver 17 for SQL Server (recommended for SQL 2017+)
   • Microsoft ODBC Driver 18 for SQL Server (TLS 1.2 default, SQL 2019/2022)
3. For ANSI-C path: the WinCC database API headers and libraries, included with the standard installation under \Siemens\Automation\WinCC\aplib.
4. WinCC Runtime must be running with full administrator rights for the ODBC user DSN creation (only at design time); Runtime itself can run under a service account with appropriate SQL Server permissions.

2.2 SQL Server Host Prerequisites

1. SQL Server (any edition 2008 R2 or later supported). SQL Server Express is acceptable for low-volume polling; SQL Server Standard or Enterprise is recommended for production.
2. TCP/IP protocol enabled on the SQL Server instance (SQL Server Configuration Manager → Protocols for MSSQLSERVER → TCP/IP → Enabled).
3. A SQL Server login (either Windows Authentication or SQL Authentication) with at least db_datareader for read-only or db_datawriter for read/write on the target database.
4. Windows Firewall inbound rule for TCP port 1433 (default instance) or the configured dynamic port. SQL Browser service (UDP 1434) only required for named instances.

2.3 Network Prerequisites

1. Bidirectional network reachability between WinCC station and SQL Server host on TCP 1433 (or dynamic port for named instances).
2. If traversing subnets, route tables and any firewalls (Windows Firewall, network firewalls, anti-virus host firewall) must permit the SQL traffic.
3. DNS resolution or static hosts entries for the SQL Server hostname.

3. Method 1 — VBScript with ODBC

The VBS + ODBC path is the most direct way for a WinCC Runtime to read a remote SQL table on demand or on a periodic trigger. The standard WinCC Runtime includes a VBS engine with full ODBC support, no additional license required.

3.1 Create the ODBC Data Source

1. On the WinCC station, open ODBC Data Source Administrator (32-bit) — note: WinCC V6/V7 on Windows is 32-bit, so the 32-bit odbcad32.exe from %windir%\SysWOW64 is required. The 64-bit ODBC Administrator cannot be used.
2. Select the System DSN tab, click Add.
3. Choose the driver (e.g., ODBC Driver 17 for SQL Server) and click Finish.
4. Configure the DSN:
   • Name: SQL_PRODUCTION (used in connection strings)
   • Description: e.g., Production database read-only
   • Server: SVR-SQL01\INSTANCE01 or SVR-SQL01,1433
   • Authentication: Windows Authentication or SQL Authentication with login
5. Test the data source using the Test Data Source… button before saving. A successful "TESTS COMPLETED SUCCESSFULLY!" dialog confirms DSN connectivity.

3.2 VBScript Sample — Reading a Single Value

The following VBS action can be placed in a WinCC picture or scheduled on a timer. It reads the most recent value from a custom table and writes it to an internal WinCC tag.

' WinCC VBS action — read latest shift counter from SQL Server
Option Explicit

Dim sConn, oConn, oRs, sSQL
Dim sValue

' Connection string — uses DSN with SQL authentication
sConn = "Provider=MSDASQL;" & _
        "DSN=SQL_PRODUCTION;" & _
        "Uid=wincc_reader;" & _
        "Pwd=YourSecurePwd;" & _
        "Database=Production;"

Set oConn = CreateObject("ADODB.Connection")
oConn.ConnectionString = sConn
oConn.ConnectionTimeout = 5
oConn.CommandTimeout    = 10

On Error Resume Next
oConn.Open
If Err.Number <> 0 Then
    HMIRuntime.Trace "SQL connect error: " & Err.Number & " " & Err.Description & vbNewLine
    Exit Sub
End If
On Error Goto 0

sSQL = "SELECT TOP 1 CounterValue, TimeStamp FROM dbo.ShiftCounter ORDER BY TimeStamp DESC"

Set oRs = CreateObject("ADODB.Recordset")
oRs.CursorLocation = 3   ' adUseClient
oRs.Open sSQL, oConn, 1, 3 ' adOpenKeyset, adLockOptimistic

If Not oRs.EOF Then
    sValue = CStr(oRs.Fields("CounterValue").Value)
    HMIRuntime.Tags("DB_CounterValue").Write sValue
    HMIRuntime.Trace "SQL read OK, CounterValue=" & sValue & vbNewLine
Else
    HMIRuntime.Trace "SQL read: empty result set" & vbNewLine
End If

oRs.Close
Set oRs = Nothing
oConn.Close
Set oConn = Nothing

For driver-specific connection strings (bypassing DSN), the ODBC Driver 17 for SQL Server driver uses the format:

sConn = "Driver={ODBC Driver 17 for SQL Server};" & _
        "Server=SVR-SQL01;" & _
        "Database=Production;" & _
        "UID=wincc_reader;" & _
        "PWD=YourSecurePwd;" & _
        "Encrypt=yes;" & _
        "TrustServerCertificate=no;"

3.3 VBScript Sample — Reading Multiple Rows into Tags

' Read all active orders into an array of internal tags
Dim sSQL, oRs, i

sSQL = "SELECT OrderID, ProductCode, TargetQty FROM dbo.WorkOrders WHERE Status='ACTIVE'"

Set oRs = CreateObject("ADODB.Recordset")
oRs.Open sSQL, oConn, 1, 3

i = 0
Do While Not oRs.EOF And i < 16
    HMIRuntime.Tags("Order_ID_"     & i).Write CStr(oRs.Fields("OrderID").Value)
    HMIRuntime.Tags("Order_Prod_"   & i).Write CStr(oRs.Fields("ProductCode").Value)
    HMIRuntime.Tags("Order_Qty_"    & i).Write CLng(oRs.Fields("TargetQty").Value)
    oRs.MoveNext
    i = i + 1
Loop

' Tag showing count of active rows
HMIRuntime.Tags("Order_ActiveCount").Write CStr(i)

oRs.Close

3.4 Periodic Polling Best Practices

• Do not run SQL queries in screen-open events; use a global VBS action with a timer (e.g., 1 s, 5 s, 30 s) to avoid blocking the picture update thread.
• Configure the WinCC Global Script runtime to start the action on a 1-second or longer cycle and use a counter to reduce the effective rate (only call every Nth cycle).
• Cache the ADODB.Connection in a global VBS variable rather than recreating it every cycle; reconnect only on error.
• Use ConnectionTimeout (5–10 s) and CommandTimeout (10–30 s) explicitly — never rely on the 30 s default in production.
• Always include On Error Resume Next followed by Err.Number logging; write failure states to dedicated tags so the operator can see database health in HMI.

4. Method 2 — ANSI-C with DBConnect and DBExecuteDirect_hdsn

The ANSI-C path exposes the WinCC database API, which is a thin wrapper over the database manager (DBM) and provides higher performance than VBS for batch operations. The APIs referenced in the source — DBConnect and DBExecuteDirect_hdsn — are part of the WinCC runtime database API shipped under aplib\database.h.

4.1 Function Prototypes

/* WinCC database API prototypes (ANSI-C) */
DWORD DBConnect(LPCTSTR szServer,
                LPCTSTR szDatabase,
                LPCTSTR szUser,
                LPCTSTR szPassword,
                LPDWORD lpdwHandle);

DWORD DBExecuteDirect_hdsn(DWORD     hdsn,           /* connection handle   */
                            LPCTSTR   szStatement,    /* SQL statement       */
                            LPDWORD   lpdwRowsAffected,
                            LPVOID    pvReserved);

DWORD DBDisconnect(DWORD hdsn);

4.2 ANSI-C Sample — Inserting a Record into a Custom Table

/* Insert a shift-end summary into a user table on remote SQL Server */
#include "apdefap.h"
#include "database.h"

void OnShiftEnd(char* pszShiftName, long lGoodParts, long lScrapParts)
{
    DWORD   hdsn      = 0;
    DWORD   dwErr     = 0;
    DWORD   dwRows    = 0;
    char    szStmt[512];

    dwErr = DBConnect("SVR-SQL01", "Production",
                      "wincc_writer", "YourSecurePwd", &hdsn);
    if (dwErr != 0) {
        printf("DBConnect failed, dwErr=%lu\n", dwErr);
        return;
    }

    sprintf(szStmt,
        "INSERT INTO dbo.ShiftSummary "
        "(ShiftName, GoodParts, ScrapParts, TimeStamp) "
        "VALUES('%s', %ld, %ld, GETDATE())",
        pszShiftName, lGoodParts, lScrapParts);

    dwErr = DBExecuteDirect_hdsn(hdsn, szStmt, &dwRows, NULL);
    if (dwErr != 0) {
        printf("DBExecuteDirect_hdsn failed, dwErr=%lu\n", dwErr);
    } else {
        printf("Rows affected: %lu\n", dwRows);
    }

    DBDisconnect(hdsn);
    return;
}

4.3 Reading with SELECT into WinCC Tags

For reads, the WinCC database API exposes DBExecuteDirect_hdsn for non-result statements and a separate result-set API (DBPrepareStatement + DBBindColumn + DBFetch) for SELECTs that return rows. A practical pattern is to call DBExecuteDirect_hdsn with a SELECT that uses T-SQL to update a single-row helper table, then read that row via tag bindings, but in most installations engineers prefer the VBS/ADODB path for reads because the WinCC C API is result-set oriented.

5. Method 3 — WinCC Industrial Data Bridge

WinCC Industrial Data Bridge is an optional WinCC add-on that provides a graphical configuration of data sources (OPC, ODBC, CSV/Text files, clipboard) and targets (OPC, ODBC, CSV, clipboard, Telegram), with scheduler- and event-driven transfer, transformation, and filtering. IDB is the recommended approach when:

• The transfer is many-to-many (multiple tags to multiple tables or vice versa).
• Event-based transfer is required (e.g., on tag change, on schedule).
• The IT policy prohibits inline scripting that opens external connections.

Configuration is performed in the WinCC Explorer under "Industrial Data Bridge". The link Siemens Support entry 22578952 covers the WinCC Connectivity Pack and adjacent data-bridge topics, including licensing. To configure an ODBC destination:

1. Open IDB Configurator in WinCC Explorer.
2. Create a new Destination, type Database (ODBC). Enter the DSN, user credentials, target table, and column mapping.
3. Create a new Source, type OPC (point to the local WinCC OPC server) or Database (ODBC) for the reverse direction.
4. Create a Link connecting Source and Destination; configure transformation expressions for any value conversion.
5. Create a Trigger: choose Scheduled (e.g., every 5 s) or On Event (tag change, file change).
6. Activate the configuration. The IDB runtime service starts the transfers.

6. Method 4 — WinCC Connectivity Pack

The WinCC Connectivity Pack provides standardized interfaces (OLE-DB, OPC UA Historical Access, OPC XML-DA, WinCC OLE-DB Provider) for accessing WinCC archive and tag data from external applications. While its primary purpose is exposing WinCC data outward, it can be combined with an OPC tunneler or a custom OLE-DB consumer on the SQL Server side to integrate the two systems. The Connectivity Pack requires a separate license and is described in detail in the Siemens entry referenced above.

7. Configuration Walkthrough — End-to-End Example

The following is a complete walkthrough of the most common case: a WinCC Runtime on WINCC-PC01 needs to read the latest three active work orders from SVR-SQL01 every 5 seconds and display them in a WinCC picture.

7.1 On SVR-SQL01 — Prepare the Database

-- 1. Create a dedicated login (SQL authentication example)
CREATE LOGIN wincc_reader WITH PASSWORD = 'YourSecurePwd';

-- 2. Create user in the target database
USE Production;
CREATE USER wincc_reader FOR LOGIN wincc_reader;
ALTER ROLE db_datareader ADD MEMBER wincc_reader;

-- 3. Create the table that WinCC will read from
CREATE TABLE dbo.WorkOrders (
    OrderID      INT           IDENTITY(1,1) PRIMARY KEY,
    ProductCode  VARCHAR(32)   NOT NULL,
    TargetQty    INT           NOT NULL,
    Status       VARCHAR(16)   NOT NULL DEFAULT 'ACTIVE',
    TimeStamp    DATETIME      NOT NULL DEFAULT GETDATE()
);

-- 4. Enable TCP/IP and confirm port 1433 is open
-- (SQL Server Configuration Manager → Protocols for MSSQLSERVER → TCP/IP → Properties → IP Addresses)

7.2 On WINCC-PC01 — Create ODBC DSN

1. Run C:\Windows\SysWOW64\odbcad32.exe.
2. Add a System DSN named DSN_Production using ODBC Driver 17 for SQL Server.
3. Server: SVR-SQL01; Auth: SQL Server Auth; Login: wincc_reader.
4. Change default database to Production.
5. Click Test Data Source; expect "TESTS COMPLETED SUCCESSFULLY!".

7.3 In WinCC Explorer — Create Internal Tags

Create 9 internal tags for the three orders plus three "DB status" tags:

7.4 Create a Global VBS Action with 5-Second Trigger

In WinCC Explorer → Global Scripts → VBS Actions, create a new action with a 1-second trigger. Inside the action, use a counter to fire only every 5th call:

' Global action, trigger: 1 s
Dim g_iDbCycle : g_iDbCycle = 0
Const CYCLE_SECONDS = 5

Sub OnTimer()
    g_iDbCycle = g_iDbCycle + 1
    If g_iDbCycle < CYCLE_SECONDS Then Exit Sub
    g_iDbCycle = 0
    Call ReadActiveOrders()
End Sub

Sub ReadActiveOrders()
    Dim oConn, oRs, sSQL, i

    On Error Resume Next
    Set oConn = CreateObject("ADODB.Connection")
    oConn.ConnectionTimeout = 5
    oConn.CommandTimeout    = 10
    oConn.Open "DSN=DSN_Production;UID=wincc_reader;PWD=YourSecurePwd;Database=Production;"

    If Err.Number <> 0 Then
        HMIRuntime.Tags("DB_Status").Write 1
        HMIRuntime.Tags("DB_LastError").Write "Conn err: " & Err.Description
        HMIRuntime.Trace "SQL connect error: " & Err.Description & vbNewLine
        Exit Sub
    End If
    On Error Goto 0

    sSQL = "SELECT TOP 3 OrderID, ProductCode, TargetQty " & _
           "FROM dbo.WorkOrders WHERE Status='ACTIVE' " & _
           "ORDER BY TimeStamp DESC"

    Set oRs = CreateObject("ADODB.Recordset")
    oRs.CursorLocation = 3
    oRs.Open sSQL, oConn, 1, 3

    For i = 0 To 2
        If oRs.EOF Then
            HMIRuntime.Tags("Order_ID_"   & i).Write ""
            HMIRuntime.Tags("Order_Prod_" & i).Write ""
            HMIRuntime.Tags("Order_Qty_"  & i).Write 0
        Else
            HMIRuntime.Tags("Order_ID_"   & i).Write CStr(oRs.Fields("OrderID").Value)
            HMIRuntime.Tags("Order_Prod_" & i).Write CStr(oRs.Fields("ProductCode").Value)
            HMIRuntime.Tags("Order_Qty_"  & i).Write CLng(oRs.Fields("TargetQty").Value)
        End If
        If Not oRs.EOF Then oRs.MoveNext
    Next

    HMIRuntime.Tags("DB_Status").Write 0
    HMIRuntime.Tags("DB_LastError").Write ""
    HMIRuntime.Tags("DB_LastUpdate").Write Now

    oRs.Close : Set oRs = Nothing
    oConn.Close : Set oConn = Nothing
End Sub

7.5 Verification

1. Activate WinCC Runtime.
2. Open the APDIAG log (WinCC Explorer → Tools → APDiag) or HmiRtTrace and look for "SQL read OK" lines every 5 seconds.
3. Bind the Order_Prod_0 tag to a text field in a WinCC picture and confirm display.
4. Insert a row into dbo.WorkOrders from SQL Management Studio and confirm it appears in WinCC within 5 seconds.
5. Stop the SQL Server service; confirm DB_Status becomes 1 and DB_LastError shows the connection error within 5 seconds.
6. Restart SQL Server; confirm tags resume updating without restarting WinCC Runtime.

8. Troubleshooting Matrix

9. Security and Operational Considerations

• Least-privilege login: never use sa. Create a dedicated login (e.g., wincc_reader) and grant only db_datareader or specific table-level SELECT rights.
• Credential storage: in VBS scripts, avoid hard-coding passwords; use WinCC's password-protected tag or an encrypted configuration file with DPAPI.
• Connection pooling: the ODBC driver manager pools connections per DSN; if you see many short-lived connections, switch from per-call Open/Close to a cached, reused ADODB.Connection with explicit error-driven reconnect.
• OT/IT boundary: if the SQL Server is in the corporate DMZ, coordinate with IT on firewall rules; consider a unidirectional OPC-DA bridge or IDB for one-way replication if the policy prohibits bidirectional SQL traffic.
• Time synchronization: ensure the WinCC station and SQL Server are time-synced (NTP). Drift in TimeStamp columns causes incorrect "latest" ordering.
• Localized collations: confirm the SQL Server collation (e.g., SQL_Latin1_General_CP1_CI_AS) matches WinCC's expected text encoding; otherwise VARCHAR comparisons will silently mismatch.

10. Method Selection Guide

11. Frequently Asked Questions