1. Overview: The WinCC-to-External-SQL Challenge
Siemens SIMATIC WinCC V7.0 SP3 stores runtime, alarm, and tag-logging data inside a project-bound Microsoft SQL Server instance. The internal archive database is held in exclusive single-user mode while Runtime is active. When a higher-level application such as SAP, a custom MES, or a reporting tool needs to consume or write the same tag values that the HMI sees, the engineer must build an explicit bridge from WinCC to a user-managed SQL Server.
WinCC does not provide an "open this database" channel to user applications by default. Three production-proven paths exist:
- Industrial Data Bridge (IDB) - separately licensed option that runs as a Windows service, configured through a graphical designer.
- VBScript inside WinCC - scripts executed by the WinCC scheduler that read tag-logging archives via the WinCC OLE DB Provider and push rows into an external SQL Server using ADO/ODBC.
- Connectivity Pack / OPC UA Server - exposes WinCC tags via standardized interfaces; the external consumer writes directly through the OPC layer.
2. WinCC Database Architecture Recap
Understanding which WinCC subsystem owns which data prevents wasted engineering effort:
| Subsystem | Default Storage | External Access Mechanism |
|---|---|---|
| Process tags (current value) | Internal WinCC image memory, no SQL persistence | OPC DA/UA, WinCC OLE DB (live), VBS HMIRuntime.Tags
|
| Tag logging (history) | SQL Server database inside the WinCC project (compressed + raw segments) | WinCC OLE DB Provider for Archives, Industrial Data Bridge, Connectivity Pack |
| Alarm logging | SQL Server database inside the WinCC project | WinCC OLE DB Provider for Archives, Connectivity Pack |
| User archives | SQL Server database inside the WinCC project | WinCC OLE DB Provider for Archives, Connectivity Pack |
The tag-logging database uses a proprietary compression scheme on archived segments. Reading "raw" values requires the WinCC OLE DB Provider; standard T-SQL SELECT against the MDF file is not supported.
3. Method Comparison
| Criterion | Industrial Data Bridge | VBScript with WinCC OLE DB | Connectivity Pack / OPC UA |
|---|---|---|---|
| Engineering effort | Low - graphical designer | Medium - code in WinCC Scheduler | Low - server configuration |
| Programmatic control | Limited (XML export of the config) | Full (any ADO query) | Limited to OPC capabilities |
| Live value push | Yes, with high-frequency provider | Yes, cyclic or trigger-based | Yes (via OPC DA/UA write) |
| Bulk archive push | Yes, native (provider pair) | Yes, manual loop | No - live tags only |
| External DB target | Any ODBC/OLE DB source | Any ODBC/OLE DB target | External OPC client writes back |
| WinCC Runtime impact | Minimal (out-of-process service) | Higher (in-process script) | Minimal |
| License required | Industrial Data Bridge license | None beyond WinCC base | Connectivity Pack / OPC UA server license |
| Failure isolation | Strong (own service) | Weak (Runtime crash stops forwarding) | Strong |
Recommendation: Use Industrial Data Bridge for routine archive forwarding. Use VBScript when you need conditional logic, transformations, or trigger-based writes (e.g., event-driven push to SAP on alarm). Use Connectivity Pack / OPC UA when the consumer is already OPC-capable or needs bidirectional live tag access.
4. Industrial Data Bridge: Architecture and Provider Matrix
Industrial Data Bridge is configured through the WinCC IDB Designer. A configuration consists of one or more connections (each with a source and a destination provider) plus a transfer object that defines the field mapping and schedule.
Common providers shipped with IDB:
| Provider | Direction | Use Case |
|---|---|---|
| WinCC Archive Provider | Source | Read tag-logging, alarm-logging, user archives |
| Send/Receive Provider (BSEND/BRCV) | Source or Destination | Raw data block transfer directly to/from S7 PLC; bypasses WinCC archive |
| ODBC Provider | Source or Destination | Read or write any ODBC-compliant database (SQL Server, Oracle, MySQL) |
| OLE DB Provider | Source or Destination | Native OLE DB targets (SQL Server Native Client 11) |
| CSV File Provider | Source or Destination | Flat-file staging for batch loads |
BSEND/BRCV PUT/GET primitives for raw, uncompressed data blocks. This path bypasses WinCC tag logging entirely and is the right choice when you need high-frequency process data (≤ 100 ms cycle) that should not be archived in WinCC. See Siemens Support Entry 18516182 for the IDB Send/Receive provider documentation.5. Industrial Data Bridge: Step-by-Step Setup
5.1 Prerequisites
- WinCC V7.0 SP3 Upd1 or later with valid license key on the engineering station and on the Runtime station that will host IDB.
- Microsoft SQL Server 2008 R2 or newer (Express is sufficient for small archives; Standard/Enterprise for > 4 GB).
- ODBC Driver 11 for SQL Server (or native client) installed on the IDB Runtime station.
- User account with
db_datareader/db_datawriteron the target database, or a dedicated SQL login with a strong password. - TCP port 1433 (default) open between IDB host and SQL Server; if named instance, also UDP 1434.
- WinCC project activated at least once so tag-logging segments exist.
5.2 Create the Destination Table in SQL Server
CREATE DATABASE WinCC_Export;
GO
USE WinCC_Export;
GO
CREATE TABLE dbo.TagHistory (
Id BIGINT IDENTITY(1,1) NOT NULL PRIMARY KEY,
TagName NVARCHAR(128) NOT NULL,
TagValue SQL_VARIANT NULL,
Quality INT NOT NULL,
Timestamp DATETIME2(3) NOT NULL,
SourceTime DATETIME2(3) NULL
);
CREATE INDEX IX_TagHistory_TagName_Time
ON dbo.TagHistory(TagName, Timestamp DESC);
GO
CREATE USER [WINCCSVC] FOR LOGIN [WINCCSVC];
ALTER ROLE db_datareader ADD MEMBER [WINCCSVC];
ALTER ROLE db_datawriter ADD MEMBER [WINCCSVC];
GO
Using SQL_VARIANT for TagValue avoids schema rework when WinCC tag types change. The composite index supports the typical "last value per tag" query the downstream SAP consumer runs.
5.3 Configure the ODBC DSN on the IDB Host
- Open ODBC Data Sources (64-bit) from Control Panel → Administrative Tools.
- Add a System DSN named
DSN_WinCC_Exportpointing toWinCC_Exporton the SQL Server using SQL Server authentication. - Test the connection; if it fails with "Cannot open database requested by login", confirm the login's default database is set to
WinCC_Exportin SQL Server Management Studio.
5.4 Configure IDB Connection Pair
- Open the WinCC Explorer → Industrial Data Bridge on the IDB Runtime host.
- Right-click Connections → New Connection. Name it
WinCC_to_SQL. - Add a source provider: WinCC Archive Provider. Set the WinCC project path, choose the tag-logging archive, and pick the tag(s) to forward. Use
SELECT Tag, Value, Quality, Timestamp FROM <archive>syntax. - Add a destination provider: ODBC Provider. Select the
DSN_WinCC_ExportDSN, set the target table todbo.TagHistory. - Map the WinCC fields to the SQL columns. Type-cast
Value→TagValueasSQL_VARIANT.
5.5 Define the Transfer
- Right-click Transfers → New Transfer. Link it to the
WinCC_to_SQLconnection. - Set the trigger to On Change for live tags or Cyclic every 10 s for archived history. The minimum cycle in IDB V7 is 1 second.
- Enable Write buffer with size 500 rows to batch inserts; this reduces SQL Server transaction overhead by an order of magnitude.
- Save the configuration; IDB compiles it into an XML file under
<WinCC Project>\IDB\. - Start the IDB Runtime Service from Windows Services or via
net start "Siemens Industrial Data Bridge".
5.6 Verify
In SQL Server Management Studio, run:
SELECT TOP 20 TagName, TagValue, Quality, Timestamp
FROM dbo.TagHistory
ORDER BY Timestamp DESC;
Rows must appear within the configured cycle. If the table stays empty, check the IDB Runtime log at C:\ProgramData\Siemens\Automation\IDB\Logs\.
6. VBScript with WinCC OLE DB Provider
Use this method when you need conditional forwarding, transformations, or event-driven writes the IDB designer cannot express. The script runs inside WinCC Runtime, so it stops if Runtime stops.
6.1 Connection Strings
' WinCC archive read (local Runtime)
strArchive = "Provider=WinCCOLEDBProvider.1;" & _
"Catalog=CC_EngineeringR_140531_113122;" & _
"Data Source=.\WinCC"
' Replace the catalog name with the actual project archive.
' Find it in WinCC Explorer → Tag Logging → Properties → Archive name.
' External SQL Server write
strTarget = "Provider=SQLNCLI11;" & _
"Server=SQLSRV01\INSTANCE01;" & _
"Database=WinCC_Export;" & _
"Uid=winccsvc;" & _
"Pwd=StrongP@ssw0rd;"
For named instances, escape the backslash as \\ inside the connection string.
6.2 Reading WinCC Archives
Dim connArc, rsArc, sql
Set connArc = CreateObject("ADODB.Connection")
connArc.CursorLocation = 3 ' adUseClient
connArc.Open strArchive
sql = "SELECT TOP 1 'Tank1.Level', RealValue, Quality, Timestamp " & _
"FROM dbo.Tank1_Level_Archive " & _
"WHERE Timestamp > '2024-01-01 00:00:00.000' " & _
"ORDER BY Timestamp DESC"
Set rsArc = CreateObject("ADODB.Recordset")
rsArc.Open sql, connArc
If Not rsArc.EOF Then
Dim sTag, vVal, iQual, dtTs
sTag = rsArc.Fields(0).Value
vVal = rsArc.Fields(1).Value
iQual = rsArc.Fields(2).Value
dtTs = rsArc.Fields(3).Value
' ... forward to external DB
End If
rsArc.Close
connArc.Close
<TagName>_Archive with periods replaced by underscores (for example, Tank1.Level → Tank1_Level_Archive). Real tags land in the RealValue column; switch to DWordValue, BoolValue, or StringValue for other types.6.3 Writing to External SQL Server
Dim connOut, cmd
Set connOut = CreateObject("ADODB.Connection")
connOut.Open strTarget
Set cmd = CreateObject("ADODB.Command")
cmd.ActiveConnection = connOut
cmd.CommandText = "INSERT INTO dbo.TagHistory " & _
"(TagName, TagValue, Quality, Timestamp) " & _
"VALUES (?, ?, ?, ?)"
cmd.Parameters.Append cmd.CreateParameter("TagName", 202, 1, 128, sTag) ' adVarWChar
cmd.Parameters.Append cmd.CreateParameter("TagValue", 12, 1, 0, vVal) ' adVariant
cmd.Parameters.Append cmd.CreateParameter("Quality", 3, 1, 0, iQual) ' adInteger
cmd.Parameters.Append cmd.CreateParameter("Timestamp", 7, 1, 0, dtTs) ' adDate
cmd.Execute
connOut.Close
6.4 Scheduling the Script
Open WinCC Explorer → Global Script → Actions. Create a new action named Forward_TagHistory, paste the code, and trigger it with a cyclic event (default 1 s, recommended 5-10 s for archive forwarding). The action runs in the WinCC scheduler and survives Runtime restarts as long as the project is reloaded.
TOP n with a high-water-mark stored in a WinCC internal tag, and parameterize the WHERE Timestamp > ? clause so the query uses the IX_TagHistory_TagName_Time index.7. Connectivity Pack and OPC UA Alternative
When the external consumer (SAP, custom MES) is already OPC-capable, expose WinCC via the WinCC OPC UA Server (part of the Connectivity Pack option). Configuration steps:
- Install the Connectivity Pack V7.0 SP3 on the WinCC Runtime station.
- Enable OPC UA Server in WinCC Explorer → Communication → OPC UA WinCC.
- Define a server endpoint at
opc.tcp://<Runtime>:48020and select a security policy (None for test, Basic128Rsa15 or higher for production). - Tag mapping: the OPC UA namespace mirrors WinCC internal tag names with dot-to-underscore translation (for example,
Tank1.Level→Tank1_Level). - On the SAP side, configure an OPC UA client (or an OPC-to-XML gateway) to subscribe to the tags. SAP Plant Connectivity (PCo) is the most common bridge.
This path requires the consumer to handle OPC UA authentication, certificate trust, and subscription keep-alive. Latency is typically 100-500 ms over LAN, acceptable for SCADA but too high for closed-loop control.
8. SAP Integration Patterns
SAP consumes process data via PCo (Plant Connectivity) using XML-based queries. The two supported topologies with WinCC V7 are:
| Topology | Data Flow | Latency | Recommended For |
|---|---|---|---|
| WinCC → IDB → SQL Server → SAP MII/PCo | WinCC archive → ODBC → SQL → SAP query | 1-10 s | Historical reporting, batch genealogy |
| WinCC → OPC UA → PCo → SAP | WinCC live tag → OPC UA subscription → SAP cache | 100-500 ms | Live dashboards, order tracking |
For bidirectional tag write-back (SAP writes a recipe parameter that WinCC must apply to the PLC), the OPC UA path is mandatory: WinCC tags marked as writable in the OPC UA configuration accept incoming writes, which WinCC then forwards to the PLC via the configured channel (MPI/Profibus/Profinet).
9. SQL Server Sizing and Tuning
For a plant producing 5,000 process tags with 1 s archive cycle, plan for:
| Metric | Value | Notes |
|---|---|---|
| Raw insert rate | ~5,000 rows/s | Compressed before insert by WinCC; IDB delivers de-compressed rows |
| Daily row count | ~430 million | SQL Server can ingest this with batched inserts (500/batch) |
| Storage per day | ~25 GB (SQL_VARIANT overhead) | Normalize to typed columns to halve this |
| Recommended edition | SQL Server 2019 Standard | Enterprise only needed for > 128 GB RAM or partitioning |
| Recovery model | Simple for archive DB | Full recovery if SAP requires point-in-time restore |
Apply partitioning by day or week once the table exceeds 100 million rows. A partitioned clustered index on Timestamp lets SAP drop old partitions in seconds.
10. Verification and Commissioning Checklist
- Confirm WinCC Runtime is active and tag-logging segments are written (check WinCC Explorer → Tag Logging → Archive).
- Confirm SQL Server target database
WinCC_Exportexists with the schema above. - Confirm the IDB or VBS service account can authenticate to SQL Server.
- Trigger a known tag change at the PLC and observe the row appear in
dbo.TagHistorywithin the configured cycle. - Force-stop the IDB service and restart; rows buffered before the stop must appear after the restart (transactional guarantee).
- From the SAP PCo side, execute a test query and confirm rows return with the expected
TagNameandTimestamp. - Run a 24-hour burn-in and check the SQL Server transaction log growth, CPU, and disk queue length against baseline.
11. Troubleshooting Matrix
| Symptom | Likely Root Cause | Fix |
|---|---|---|
| "Database is locked" when opening MDF in SSMS | WinCC Runtime holds exclusive lock | Stop Runtime first; use a replicated database for analysis |
| IDB log: "ODBC connection failed" | DSN not 64-bit, or SQL Server firewall | Recreate DSN in 64-bit ODBC administrator; open TCP 1433 |
| VBS error: "WinCC archive not found" | Wrong catalog name in connection string | Copy catalog name from WinCC Explorer → Tag Logging → Properties |
Rows arrive but TagValue is NULL |
Type mismatch in ODBC mapping | Cast WinCC RealValue to FLOAT or use SQL_VARIANT
|
| Latency > 30 s | Single-row inserts, no buffer | Enable IDB write buffer (500 rows) or batch VBS inserts |
| SAP cannot subscribe | OPC UA endpoint not exposed or certificate rejected | Open port 48020; trust PCo certificate in WinCC OPC UA trust list |
| VBS script stops after Runtime restart | Script lost its trigger | Re-assign the cyclic trigger in Global Script → Actions |
FAQ
Can I open the WinCC archive database directly from SQL Server Management Studio?
No, not while WinCC Runtime is active. WinCC takes an exclusive lock on the archive MDF. Stop Runtime, detach the database, or - preferably - use Industrial Data Bridge or the WinCC OLE DB Provider to forward data into a separate, user-managed SQL Server database.
Which method has the lowest impact on WinCC Runtime performance?
Industrial Data Bridge. It runs as an out-of-process Windows service and uses a separate ODBC/OLE DB connection, so a slow external SQL Server does not stall the WinCC scheduler. VBScript runs in-process and can degrade Runtime if the cycle is too short or the query returns too many rows.
What is the difference between Industrial Data Bridge Send/Receive and tag logging?
Send/Receive uses the S7 BSEND/BRCV primitives to move raw, uncompressed data blocks directly between the PLC and IDB, bypassing WinCC archive entirely. Use it for high-frequency (≤ 100 ms) live values you do not want to store in WinCC. Tag logging goes through WinCC's compressed archive and is the right choice when you also need the data inside WinCC for trends.
How do I write tags from SAP back into WinCC?
Use the OPC UA path with the Connectivity Pack option. Enable WinCC's OPC UA Server, mark the target tags as writable in the OPC UA configuration, and have SAP PCo write to them via OPC UA. WinCC then forwards the write to the PLC through the configured channel.
Can the WinCC OLE DB Provider write to an external SQL Server?
No. The WinCC OLE DB Provider is read-only with respect to the WinCC archive. To write to an external database, use ADO with a standard SQL Server OLE DB or ODBC driver inside a VBScript, or use Industrial Data Bridge with an ODBC/OLE DB destination provider.