Writing WinCC V7 Tag Values to External SQL Server Database

David Krause12 min read
SiemensTutorial / How-toWinCC
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Overview: The WinCC-to-External-SQL Challenge

Siemens SIMATIC WinCC V7.0 SP3 stores runtime, alarm, and tag-logging data inside a project-bound Microsoft SQL Server instance. The internal archive database is held in exclusive single-user mode while Runtime is active. When a higher-level application such as SAP, a custom MES, or a reporting tool needs to consume or write the same tag values that the HMI sees, the engineer must build an explicit bridge from WinCC to a user-managed SQL Server.

WinCC does not provide an "open this database" channel to user applications by default. Three production-proven paths exist:

  • Industrial Data Bridge (IDB) - separately licensed option that runs as a Windows service, configured through a graphical designer.
  • VBScript inside WinCC - scripts executed by the WinCC scheduler that read tag-logging archives via the WinCC OLE DB Provider and push rows into an external SQL Server using ADO/ODBC.
  • Connectivity Pack / OPC UA Server - exposes WinCC tags via standardized interfaces; the external consumer writes directly through the OPC layer.
Critical constraint: The WinCC runtime SQL database is opened in single-user exclusive mode during Runtime. Attempting to open the same MDF file from SQL Server Management Studio while WinCC Runtime is active returns "database is locked" or "exclusive access could not be obtained." Always forward data to a replicated/foreign database; never let an external tool open the live WinCC archive file directly.

2. WinCC Database Architecture Recap

Understanding which WinCC subsystem owns which data prevents wasted engineering effort:

Subsystem Default Storage External Access Mechanism
Process tags (current value) Internal WinCC image memory, no SQL persistence OPC DA/UA, WinCC OLE DB (live), VBS HMIRuntime.Tags
Tag logging (history) SQL Server database inside the WinCC project (compressed + raw segments) WinCC OLE DB Provider for Archives, Industrial Data Bridge, Connectivity Pack
Alarm logging SQL Server database inside the WinCC project WinCC OLE DB Provider for Archives, Connectivity Pack
User archives SQL Server database inside the WinCC project WinCC OLE DB Provider for Archives, Connectivity Pack

The tag-logging database uses a proprietary compression scheme on archived segments. Reading "raw" values requires the WinCC OLE DB Provider; standard T-SQL SELECT against the MDF file is not supported.

3. Method Comparison

Criterion Industrial Data Bridge VBScript with WinCC OLE DB Connectivity Pack / OPC UA
Engineering effort Low - graphical designer Medium - code in WinCC Scheduler Low - server configuration
Programmatic control Limited (XML export of the config) Full (any ADO query) Limited to OPC capabilities
Live value push Yes, with high-frequency provider Yes, cyclic or trigger-based Yes (via OPC DA/UA write)
Bulk archive push Yes, native (provider pair) Yes, manual loop No - live tags only
External DB target Any ODBC/OLE DB source Any ODBC/OLE DB target External OPC client writes back
WinCC Runtime impact Minimal (out-of-process service) Higher (in-process script) Minimal
License required Industrial Data Bridge license None beyond WinCC base Connectivity Pack / OPC UA server license
Failure isolation Strong (own service) Weak (Runtime crash stops forwarding) Strong

Recommendation: Use Industrial Data Bridge for routine archive forwarding. Use VBScript when you need conditional logic, transformations, or trigger-based writes (e.g., event-driven push to SAP on alarm). Use Connectivity Pack / OPC UA when the consumer is already OPC-capable or needs bidirectional live tag access.

4. Industrial Data Bridge: Architecture and Provider Matrix

Industrial Data Bridge is configured through the WinCC IDB Designer. A configuration consists of one or more connections (each with a source and a destination provider) plus a transfer object that defines the field mapping and schedule.

Common providers shipped with IDB:

Provider Direction Use Case
WinCC Archive Provider Source Read tag-logging, alarm-logging, user archives
Send/Receive Provider (BSEND/BRCV) Source or Destination Raw data block transfer directly to/from S7 PLC; bypasses WinCC archive
ODBC Provider Source or Destination Read or write any ODBC-compliant database (SQL Server, Oracle, MySQL)
OLE DB Provider Source or Destination Native OLE DB targets (SQL Server Native Client 11)
CSV File Provider Source or Destination Flat-file staging for batch loads
Send/Receive mode uses the S7 BSEND/BRCV PUT/GET primitives for raw, uncompressed data blocks. This path bypasses WinCC tag logging entirely and is the right choice when you need high-frequency process data (≤ 100 ms cycle) that should not be archived in WinCC. See Siemens Support Entry 18516182 for the IDB Send/Receive provider documentation.

5. Industrial Data Bridge: Step-by-Step Setup

5.1 Prerequisites

  1. WinCC V7.0 SP3 Upd1 or later with valid license key on the engineering station and on the Runtime station that will host IDB.
  2. Microsoft SQL Server 2008 R2 or newer (Express is sufficient for small archives; Standard/Enterprise for > 4 GB).
  3. ODBC Driver 11 for SQL Server (or native client) installed on the IDB Runtime station.
  4. User account with db_datareader/db_datawriter on the target database, or a dedicated SQL login with a strong password.
  5. TCP port 1433 (default) open between IDB host and SQL Server; if named instance, also UDP 1434.
  6. WinCC project activated at least once so tag-logging segments exist.

5.2 Create the Destination Table in SQL Server

CREATE DATABASE WinCC_Export;
GO
USE WinCC_Export;
GO
CREATE TABLE dbo.TagHistory (
    Id          BIGINT IDENTITY(1,1) NOT NULL PRIMARY KEY,
    TagName     NVARCHAR(128) NOT NULL,
    TagValue    SQL_VARIANT NULL,
    Quality     INT NOT NULL,
    Timestamp   DATETIME2(3) NOT NULL,
    SourceTime  DATETIME2(3) NULL
);
CREATE INDEX IX_TagHistory_TagName_Time
    ON dbo.TagHistory(TagName, Timestamp DESC);
GO
CREATE USER [WINCCSVC] FOR LOGIN [WINCCSVC];
ALTER ROLE db_datareader  ADD MEMBER [WINCCSVC];
ALTER ROLE db_datawriter  ADD MEMBER [WINCCSVC];
GO

Using SQL_VARIANT for TagValue avoids schema rework when WinCC tag types change. The composite index supports the typical "last value per tag" query the downstream SAP consumer runs.

5.3 Configure the ODBC DSN on the IDB Host

  1. Open ODBC Data Sources (64-bit) from Control Panel → Administrative Tools.
  2. Add a System DSN named DSN_WinCC_Export pointing to WinCC_Export on the SQL Server using SQL Server authentication.
  3. Test the connection; if it fails with "Cannot open database requested by login", confirm the login's default database is set to WinCC_Export in SQL Server Management Studio.

5.4 Configure IDB Connection Pair

  1. Open the WinCC Explorer → Industrial Data Bridge on the IDB Runtime host.
  2. Right-click Connections → New Connection. Name it WinCC_to_SQL.
  3. Add a source provider: WinCC Archive Provider. Set the WinCC project path, choose the tag-logging archive, and pick the tag(s) to forward. Use SELECT Tag, Value, Quality, Timestamp FROM <archive> syntax.
  4. Add a destination provider: ODBC Provider. Select the DSN_WinCC_Export DSN, set the target table to dbo.TagHistory.
  5. Map the WinCC fields to the SQL columns. Type-cast Value → TagValue as SQL_VARIANT.

5.5 Define the Transfer

  1. Right-click Transfers → New Transfer. Link it to the WinCC_to_SQL connection.
  2. Set the trigger to On Change for live tags or Cyclic every 10 s for archived history. The minimum cycle in IDB V7 is 1 second.
  3. Enable Write buffer with size 500 rows to batch inserts; this reduces SQL Server transaction overhead by an order of magnitude.
  4. Save the configuration; IDB compiles it into an XML file under <WinCC Project>\IDB\.
  5. Start the IDB Runtime Service from Windows Services or via net start "Siemens Industrial Data Bridge".

5.6 Verify

In SQL Server Management Studio, run:

SELECT TOP 20 TagName, TagValue, Quality, Timestamp
FROM dbo.TagHistory
ORDER BY Timestamp DESC;

Rows must appear within the configured cycle. If the table stays empty, check the IDB Runtime log at C:\ProgramData\Siemens\Automation\IDB\Logs\.

6. VBScript with WinCC OLE DB Provider

Use this method when you need conditional forwarding, transformations, or event-driven writes the IDB designer cannot express. The script runs inside WinCC Runtime, so it stops if Runtime stops.

6.1 Connection Strings

' WinCC archive read (local Runtime)
strArchive = "Provider=WinCCOLEDBProvider.1;" & _
             "Catalog=CC_EngineeringR_140531_113122;" & _
             "Data Source=.\WinCC"
' Replace the catalog name with the actual project archive.
' Find it in WinCC Explorer → Tag Logging → Properties → Archive name.

' External SQL Server write
strTarget  = "Provider=SQLNCLI11;" & _
             "Server=SQLSRV01\INSTANCE01;" & _
             "Database=WinCC_Export;" & _
             "Uid=winccsvc;" & _
             "Pwd=StrongP@ssw0rd;"

For named instances, escape the backslash as \\ inside the connection string.

6.2 Reading WinCC Archives

Dim connArc, rsArc, sql
Set connArc = CreateObject("ADODB.Connection")
connArc.CursorLocation = 3   ' adUseClient
connArc.Open strArchive

sql = "SELECT TOP 1 'Tank1.Level', RealValue, Quality, Timestamp " & _
      "FROM dbo.Tank1_Level_Archive " & _
      "WHERE Timestamp > '2024-01-01 00:00:00.000' " & _
      "ORDER BY Timestamp DESC"

Set rsArc = CreateObject("ADODB.Recordset")
rsArc.Open sql, connArc

If Not rsArc.EOF Then
    Dim sTag, vVal, iQual, dtTs
    sTag  = rsArc.Fields(0).Value
    vVal  = rsArc.Fields(1).Value
    iQual = rsArc.Fields(2).Value
    dtTs  = rsArc.Fields(3).Value
    ' ... forward to external DB
End If

rsArc.Close
connArc.Close
WinCC archive table names use the pattern <TagName>_Archive with periods replaced by underscores (for example, Tank1.Level → Tank1_Level_Archive). Real tags land in the RealValue column; switch to DWordValue, BoolValue, or StringValue for other types.

6.3 Writing to External SQL Server

Dim connOut, cmd
Set connOut = CreateObject("ADODB.Connection")
connOut.Open strTarget

Set cmd = CreateObject("ADODB.Command")
cmd.ActiveConnection = connOut
cmd.CommandText = "INSERT INTO dbo.TagHistory " & _
                  "(TagName, TagValue, Quality, Timestamp) " & _
                  "VALUES (?, ?, ?, ?)"
cmd.Parameters.Append cmd.CreateParameter("TagName",  202, 1, 128, sTag)   ' adVarWChar
cmd.Parameters.Append cmd.CreateParameter("TagValue",  12,  1,   0, vVal)   ' adVariant
cmd.Parameters.Append cmd.CreateParameter("Quality",   3,   1,   0, iQual)  ' adInteger
cmd.Parameters.Append cmd.CreateParameter("Timestamp", 7,   1,   0, dtTs)   ' adDate
cmd.Execute

connOut.Close

6.4 Scheduling the Script

Open WinCC Explorer → Global Script → Actions. Create a new action named Forward_TagHistory, paste the code, and trigger it with a cyclic event (default 1 s, recommended 5-10 s for archive forwarding). The action runs in the WinCC scheduler and survives Runtime restarts as long as the project is reloaded.

Performance note: WinCC VBS runs single-threaded inside the Runtime scheduler. A 1 s cycle with an archive query that returns > 1000 rows will saturate the scheduler. Always use TOP n with a high-water-mark stored in a WinCC internal tag, and parameterize the WHERE Timestamp > ? clause so the query uses the IX_TagHistory_TagName_Time index.

7. Connectivity Pack and OPC UA Alternative

When the external consumer (SAP, custom MES) is already OPC-capable, expose WinCC via the WinCC OPC UA Server (part of the Connectivity Pack option). Configuration steps:

  1. Install the Connectivity Pack V7.0 SP3 on the WinCC Runtime station.
  2. Enable OPC UA Server in WinCC Explorer → Communication → OPC UA WinCC.
  3. Define a server endpoint at opc.tcp://<Runtime>:48020 and select a security policy (None for test, Basic128Rsa15 or higher for production).
  4. Tag mapping: the OPC UA namespace mirrors WinCC internal tag names with dot-to-underscore translation (for example, Tank1.Level → Tank1_Level).
  5. On the SAP side, configure an OPC UA client (or an OPC-to-XML gateway) to subscribe to the tags. SAP Plant Connectivity (PCo) is the most common bridge.

This path requires the consumer to handle OPC UA authentication, certificate trust, and subscription keep-alive. Latency is typically 100-500 ms over LAN, acceptable for SCADA but too high for closed-loop control.

8. SAP Integration Patterns

SAP consumes process data via PCo (Plant Connectivity) using XML-based queries. The two supported topologies with WinCC V7 are:

Topology Data Flow Latency Recommended For
WinCC → IDB → SQL Server → SAP MII/PCo WinCC archive → ODBC → SQL → SAP query 1-10 s Historical reporting, batch genealogy
WinCC → OPC UA → PCo → SAP WinCC live tag → OPC UA subscription → SAP cache 100-500 ms Live dashboards, order tracking

For bidirectional tag write-back (SAP writes a recipe parameter that WinCC must apply to the PLC), the OPC UA path is mandatory: WinCC tags marked as writable in the OPC UA configuration accept incoming writes, which WinCC then forwards to the PLC via the configured channel (MPI/Profibus/Profinet).

9. SQL Server Sizing and Tuning

For a plant producing 5,000 process tags with 1 s archive cycle, plan for:

Metric Value Notes
Raw insert rate ~5,000 rows/s Compressed before insert by WinCC; IDB delivers de-compressed rows
Daily row count ~430 million SQL Server can ingest this with batched inserts (500/batch)
Storage per day ~25 GB (SQL_VARIANT overhead) Normalize to typed columns to halve this
Recommended edition SQL Server 2019 Standard Enterprise only needed for > 128 GB RAM or partitioning
Recovery model Simple for archive DB Full recovery if SAP requires point-in-time restore

Apply partitioning by day or week once the table exceeds 100 million rows. A partitioned clustered index on Timestamp lets SAP drop old partitions in seconds.

10. Verification and Commissioning Checklist

  1. Confirm WinCC Runtime is active and tag-logging segments are written (check WinCC Explorer → Tag Logging → Archive).
  2. Confirm SQL Server target database WinCC_Export exists with the schema above.
  3. Confirm the IDB or VBS service account can authenticate to SQL Server.
  4. Trigger a known tag change at the PLC and observe the row appear in dbo.TagHistory within the configured cycle.
  5. Force-stop the IDB service and restart; rows buffered before the stop must appear after the restart (transactional guarantee).
  6. From the SAP PCo side, execute a test query and confirm rows return with the expected TagName and Timestamp.
  7. Run a 24-hour burn-in and check the SQL Server transaction log growth, CPU, and disk queue length against baseline.

11. Troubleshooting Matrix

Symptom Likely Root Cause Fix
"Database is locked" when opening MDF in SSMS WinCC Runtime holds exclusive lock Stop Runtime first; use a replicated database for analysis
IDB log: "ODBC connection failed" DSN not 64-bit, or SQL Server firewall Recreate DSN in 64-bit ODBC administrator; open TCP 1433
VBS error: "WinCC archive not found" Wrong catalog name in connection string Copy catalog name from WinCC Explorer → Tag Logging → Properties
Rows arrive but TagValue is NULL Type mismatch in ODBC mapping Cast WinCC RealValue to FLOAT or use SQL_VARIANT
Latency > 30 s Single-row inserts, no buffer Enable IDB write buffer (500 rows) or batch VBS inserts
SAP cannot subscribe OPC UA endpoint not exposed or certificate rejected Open port 48020; trust PCo certificate in WinCC OPC UA trust list
VBS script stops after Runtime restart Script lost its trigger Re-assign the cyclic trigger in Global Script → Actions

FAQ

Can I open the WinCC archive database directly from SQL Server Management Studio?

No, not while WinCC Runtime is active. WinCC takes an exclusive lock on the archive MDF. Stop Runtime, detach the database, or - preferably - use Industrial Data Bridge or the WinCC OLE DB Provider to forward data into a separate, user-managed SQL Server database.

Which method has the lowest impact on WinCC Runtime performance?

Industrial Data Bridge. It runs as an out-of-process Windows service and uses a separate ODBC/OLE DB connection, so a slow external SQL Server does not stall the WinCC scheduler. VBScript runs in-process and can degrade Runtime if the cycle is too short or the query returns too many rows.

What is the difference between Industrial Data Bridge Send/Receive and tag logging?

Send/Receive uses the S7 BSEND/BRCV primitives to move raw, uncompressed data blocks directly between the PLC and IDB, bypassing WinCC archive entirely. Use it for high-frequency (≤ 100 ms) live values you do not want to store in WinCC. Tag logging goes through WinCC's compressed archive and is the right choice when you also need the data inside WinCC for trends.

How do I write tags from SAP back into WinCC?

Use the OPC UA path with the Connectivity Pack option. Enable WinCC's OPC UA Server, mark the target tags as writable in the OPC UA configuration, and have SAP PCo write to them via OPC UA. WinCC then forwards the write to the PLC through the configured channel.

Can the WinCC OLE DB Provider write to an external SQL Server?

No. The WinCC OLE DB Provider is read-only with respect to the WinCC archive. To write to an external database, use ADO with a standard SQL Server OLE DB or ODBC driver inside a VBScript, or use Industrial Data Bridge with an ODBC/OLE DB destination provider.

Back to blog