WinCC v7.2 OPC Client Configuration for TCSB Telecontrol Server

Overview

Siemens TCSB (Telecontrol Server Basic) is a Windows service that aggregates process values from remote automation systems over GPRS, UMTS, LTE-M, or TCP/IP and exposes them through an embedded OPC DA / OPC UA server. WinCC v7.2 can consume those values in two ways: (1) by acting as an OPC DA client against the TCSB OPC server, or (2) by using the native OPC UA channel introduced with V7.2. The configuration path differs from WinCC flexible / TIA Portal, which use the proprietary "TCSB" channel unit; in V7.2 the connection is built manually inside Tag Management using the OPC or OPC UA channel.

This reference documents the architecture, prerequisites, configuration steps, user-account matching, certificate handling, and diagnostics required to establish a working WinCC v7.2 ↔ TCSB link. It consolidates procedures from the TCSB Basic Operating Manual V7.6, the WinCC V7.2 OPC Communication Manual, the S7-1200 / WinCC V7.4 Telecontrol Application Note, and the TCSB Certificate Management with WinCC guide.

System Architecture

The minimum topology uses two PCs and one or more telecontrol stations:

1. TCSB Server PC (PC-1) – Windows Server 2008 R2 / 2012 R2 / 2016, TCSB V7.x service, embedded OPC DA server (typically OPC.SimaticNet.TCSB) and OPC UA server endpoint on opc.tcp://<PC-1>:4862.
2. WinCC v7.2 Client PC (PC-2) – WinCC V7.2 SP1 or higher, OPC channel or OPC UA channel license, identical Windows user account for DCOM security.
3. Remote station – S7-1200 / S7-1500 / S7-300 with CP 1242-7 / CP 1243-7 / CP 1542SP-1, or third-party controller polled by a TCSB Master.

Data flow: PLC → CP → GPRS/Internet → TCSB Master → TCSB internal OPC DA/UA server → WinCC V7.2 (OPC client) → HMI tag → picture / archive / alarm.

Communication Stack Reference

Prerequisites

• WinCC V7.2 SP1 Update 9 or later (older SPs lack stable OPC UA client). Confirm via Help → About.
• WinCC option "WinCC/Connectivity Pack" or "WinCC/OPC UA Client" license available; OPC DA channel is included in the base license.
• TCSB V7.3 or higher installed on PC-1, configured with at least one working telecontrol station and OPC interface enabled.
• Both PCs joined to the same Windows workgroup or domain. A local user with identical username and password on both machines is mandatory for DCOM authentication (see User Account Matching below).
• Network reachability: ping PC-1 from PC-2 and telnet PC-1 4862 (UA) or dcomcnfg test (DA) must succeed.
• Disable the Windows firewall temporarily during first commissioning, or pre-create inbound rules for %SystemRoot%\System32\opcenum.exe and %ProgramFiles%\Siemens\Automation\WinCC\bin\CCClientStd.exe.

Step-by-Step Configuration

Step 1 – Enable and Test the TCSB OPC Server

1. On PC-1, open TCSB Config and select Project → Options → OPC Server.
2. Confirm Activate OPC DA Server and Activate OPC UA Server are checked. Note the UA endpoint URL: opc.tcp://<PC-1>:4862/TCSB.
3. Click Test OPC Server. A successful test displays the list of published items from the configured stations.
4. Open Windows Services (services.msc) and verify Siemens Telecontrol Server Basic is Running and startup type is Automatic (Delayed Start).

Step 2 – Create a Matching Windows User

DCOM authenticates by Windows credentials. If the same user does not exist on PC-1 and PC-2 with the same password, the OPC DA browse returns E_ACCESSDENIED (HRESULT 0x80070005).

1. On PC-1, create a local user TCSBUser, password P@ssw0rd!23, member of groups Distributed COM Users and Performance Log Users.
2. Repeat on PC-2 with the identical username and password.
3. On PC-1, in dcomcnfg.exe → Component Services → Computers → My Computer → DCOM Config, locate OPC SimaticNet TCSB (or the TCSB class ID {B9234A42-7E3A-4B9A-9C2D-2A8B7B7C3D11} – verify locally with Properties).
4. Open Properties → Security, set Launch and Activation Permissions → Customize → Edit, add TCSBUser with Local Launch / Remote Launch / Local Activation / Remote Activation.
5. Repeat for Access Permissions and Configuration Permissions.

Step 3 – Add the OPC Channel in WinCC Explorer

1. Open the WinCC Explorer on PC-2 and expand Tag Management.
2. Right-click Tag Management → Add New Driver. Choose "OPC" for OPC DA or "OPC UA WinCC Channel" for OPC UA. Click Open.
3. A new channel OPC (or OPC UA) appears with one default connection group.

Step 4 – Configure the OPC DA Connection

1. Right-click OPC → OPC Groups → New Connection. Name it TCSB_Connection.
2. Open Connection Properties and select OPC Server from the dropdown. The list is populated by OPCEnum across the network.
3. If PC-1 does not appear, enter the ProgID manually: OPC.SimaticNet.TCSB. The WinCC OPC channel runs in a service context, so the ProgID may need to be added with a registry stub under HKLM\SOFTWARE\Wow6432Node\Siemens\WinCC\OPC\ServerList.
4. Set Computer Name = PC-1, Server Name = OPC.SimaticNet.TCSB, Use KeepAlive = checked, Update Rate = 1000 ms.
5. Click Test Connection. A green status and an item count confirm the link.

Step 5 – Configure the OPC UA Connection (Recommended)

1. Right-click the new OPC UA channel → New Connection.
2. Open Connection Parameters. Enter Endpoint URL: opc.tcp://PC-1:4862/TCSB.
3. Select Security Policy: None (lab/test) or Basic128Rsa15 / Basic256Sha256 (production).
4. For certificate-based authentication, click Manage Certificates and import the PC-2 client certificate into the TCSB trust list. The TCSB certificate must be imported into the WinCC trust store at %ProgramData%\Siemens\Automation\WinCC\UA\pki\trusted\certs. See the TCSB Certificate Management with WinCC PDF for the full wizard.
5. Choose Authentication Mode: Anonymous (only if TCSB permits it), Username/Password, or Certificate.
6. Set Session Timeout = 60000 ms and Publishing Interval = 1000 ms.
7. Click Test. A successful test logs UA session established in the WinCC diagnostic file WinCC_Sys_xx.log.

Step 6 – Browse the TCSB Namespace and Add Tags

1. Right-click the connection → Browse Server. The TCSB address space appears as TCSB / <StationName> / <DataPoint> / <Value or Status>.
2. Drag the desired items into the tag list, or use Add Tag with the fully-qualified ItemID, e.g. TCSB.Station1.Pump.Flow.Value.
3. Configure tag properties:
   • Data Type: Float, Boolean, Word, String
   • Length (for strings): 1–255
   • Adapt: Internal Adaptation for scaling, or Linear with Low / High pairs
   • Update: 1000 ms (matches TCSB default cycle)
4. Click Apply. The tag quality indicator turns green once Runtime starts polling.

Step 7 – Activate WinCC Runtime and Verify

1. Save the project and start WinCC Runtime.
2. Open WinCC Tag Simulator and force one TCSB value to confirm round-trip updates.
3. Open the Channel Diagnosis applet – OPC connection state must be OK, last error 0x00000000, item count non-zero.

User Account Matching – Detailed Rules

For OPC UA with user/password, the user is created inside TCSB Config → Security → User Administration. The password may contain up to 64 characters; the local Windows password policy is not enforced.

TCSB Certificate Management

Starting with TCSB V7.3, OPC UA endpoints require a server certificate auto-generated during installation at %ProgramData%\Siemens\Automation\TCSB\pki\own. The WinCC client creates a self-signed certificate at %ProgramData%\Siemens\Automation\WinCC\UA\pki\own. Both must be exchanged into the peer's trusted folder.

1. On PC-1, export TCSB.der from own and copy to PC-2\...\pki\trusted\certs.
2. On PC-2, export WinCCClient.der and copy to PC-1\...\TCSB\pki\trusted\certs.
3. Restart the Siemens Telecontrol Server Basic service and WinCC Runtime.
4. For production deployments, replace the self-signed certificates with ones issued by an enterprise CA. Subject field must contain CN=<PC-1 FQDN> matching the endpoint URL host.

Parameter Reference – OPC Channel Settings

Verification and Diagnostics

1. WinCC Channel Diagnosis – shows OPC connection state, last error, item count, last value change timestamp.
2. WinCC Syslog – C:\Program Files (x86)\Siemens\Automation\WinCC\Diagnose\WinCC_Sys_xx.log. Search for OPC or UA.
3. TCSB Trace – enable via TCSB Config → Options → Trace. Level 4 (Info) is sufficient; Level 6 (Debug) shows every polled value.
4. Wireshark / Port Query – confirm TCP 4862 is established and TLS handshake completes when encryption is enabled.
5. OPC Test Client – use the free OPC Foundation Sample Client or UaExpert to confirm the TCSB server is reachable independently of WinCC. This isolates whether a fault is WinCC-side or TCSB-side.

Troubleshooting Matrix

Differences to WinCC flexible / TIA Portal

WinCC flexible 2008 SP5 and TIA Portal (WinCC Comfort / Advanced / Professional) use a TCSB native channel unit that understands the TCSB namespace directly and ships ready-made faceplates. WinCC V7.2 has no such channel; only the generic OPC and OPC UA channels exist, which is why tag-management configuration looks unfamiliar to engineers migrating from Panel or Runtime Advanced projects. Functionally the data flow is identical, but every tag must be created manually because there is no automatic tag-import wizard for TCSB in V7.2.

For new installations, Siemens recommends upgrading to WinCC V7.5 SP2 or higher, where the OPC UA channel is more stable and supports bulk tag import from a CSV exported by TCSB Config.

Performance Sizing

A single WinCC V7.2 OPC UA client can subscribe to roughly 4,000 items at a 1 s update rate on a Core i5 with 8 GB RAM, before CPU saturation on the WinCC host. TCSB itself can serve ~30,000 items per OPC UA endpoint. Plan the system around these limits:

• Small site: < 500 tags, single station – one OPC UA group is sufficient.
• Medium site: 500 – 5,000 tags, 2–10 stations – split into logical groups per station to localize failures.
• Large site: > 5,000 tags – deploy the WinCC Connectivity Pack and use the OPC UA DataAccess subscription with monitored items per group of 500.

Security Hardening Checklist

1. Disable OPC DA entirely if the network supports OPC UA – blocks DCOM attack surface.
2. Replace self-signed certificates with enterprise-CA-issued X.509v3 certs.
3. Use Basic256Sha256 security policy with sign-and-encrypt message mode.
4. Restrict TCSB OPC UA endpoint to a dedicated Windows service account, not Administrator.
5. Enable Windows Firewall rule allowing only the WinCC client IP to TCP 4862.
6. Audit TCSB user logins in Windows Security Log via Advanced Audit Policy → Logon/Logoff → Audit Logon.