Writing WinCC VBScript to Insert SQL Data Using Transfer Tag

Overview

Siemens WinCC exposes a full VBScript (VBS) runtime that can call out to any COM automation server, including the Microsoft ActiveX Data Objects (ADO) library. The classic transfer tag pattern uses a Boolean internal tag as a handshake signal: a button or external PLC sets the tag to TRUE, the VBS action detects the edge, performs a SQL write, and then writes FALSE back to the tag to arm the next cycle. This pattern decouples HMI graphics from database latency and gives you deterministic, single-row inserts without losing events under fast operator input.

This article covers the working VBS code, the correct way to wire it to a WinCC tag-change event, the ODBC / OLE DB provider choices for SQL Server, the required WinCC and SQL Server configuration, and the failure modes you will hit in the field. It targets WinCC 7.4 / 7.5 SCADA running on Windows, and notes the differences for TIA Portal WinCC Runtime Professional where the API surface is similar but the editor paths differ.

Prerequisites

Architecture: The Transfer Tag Handshake

The transfer tag is a Boolean internal tag (typically named DB_TransferTrigger) acting as a single-bit semaphore. The control flow is:

1. Operator presses a button on the WinCC screen. The button's Click event writes TRUE to DB_TransferTrigger.
2. A WinCC action is configured with the OnTagChange trigger on DB_TransferTrigger. The action is a VBScript procedure that runs in the WinCC background.
3. When the action fires and sees DB_TransferTrigger.Value = TRUE, it reads the value tags, opens an ADODB connection, executes an INSERT, closes the connection, then writes FALSE back to the trigger tag.
4. If the operator presses the button twice in quick succession, the second event is latched in the tag and the action will fire again as soon as the first insert returns and the tag is re-armed to FALSE then back to TRUE.

Step 1: Create the Transfer Tag and Value Tags

In the WinCC Explorer open Tag Management -> Internal Tags and create:

If the value tags are to be populated from the PLC, configure them as external tags on the appropriate PLC connection (S7-300/400/1200/1500) and have WinCC poll them with the default 1 s update cycle, or with the cyclic trigger the project uses for production tags.

Step 2: Prepare the SQL Server Target

Create the destination database and table on the SQL Server host. A minimal but realistic schema is shown below; adapt column names and types to your actual process values.

CREATE DATABASE WinCC_Logging;
GO
USE WinCC_Logging;
GO
CREATE TABLE dbo.ProductionLog (
    LogID        BIGINT IDENTITY(1,1) PRIMARY KEY,
    PartNumber   NVARCHAR(32)  NOT NULL,
    Quantity     INT           NOT NULL,
    Operator     NVARCHAR(16)  NULL,
    TransferTime DATETIME2(0)  NOT NULL CONSTRAINT DF_ProductionLog_TransferTime DEFAULT (SYSUTCDATETIME()),
    StationName  NVARCHAR(32)  NULL
);
CREATE INDEX IX_ProductionLog_TransferTime ON dbo.ProductionLog (TransferTime DESC);
GO
CREATE USER [WINCC\WinCCService] FOR LOGIN [WINCC\WinCCService];
GRANT INSERT ON dbo.ProductionLog TO [WINCC\WinCCService];
GRANT SELECT ON dbo.ProductionLog TO [WINCC\WinCCService];
GO

Use a dedicated SQL login with the minimum privilege set: db_datawriter on the target table is sufficient. Do not use sa; the connection string will be readable in WinCC diagnostics and the WinCC service account is a common pivot point in incident-response investigations.

Step 3: Configure the ODBC / OLE DB Provider

WinCC VBS opens SQL Server through OLE DB or through an ODBC DSN. The DSN-less connection string is preferred because it survives SQL client upgrades and avoids the 32-bit / 64-bit DSN mismatch on 64-bit WinCC hosts. The recommended provider is the Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL) installed alongside the Microsoft OLE DB Driver for SQL Server package.

' Connection string variants (pick one)

' Option A: OLE DB Driver 18 with TLS 1.2
"Provider=MSOLEDBSQL;Server=SQLHOST\SQLEXPRESS;Database=WinCC_Logging;Uid=wincc_app;Pwd=StrongPwd!2024;Encrypt=Yes;TrustServerCertificate=No;"

' Option B: Legacy SQLOLEDB (deprecated, avoid on SQL 2019+)
"Provider=SQLOLEDB.1;Data Source=SQLHOST;Initial Catalog=WinCC_Logging;User ID=wincc_app;Password=StrongPwd!2024;"

' Option C: ODBC DSN (only if a 32-bit DSN is installed on a 32-bit WinCC host)
"DSN=WinCC_SQL;Uid=wincc_app;Pwd=StrongPwd!2024;"

Step 4: Write the VBScript Action

Open the WinCC Graphics Designer and place a button on a screen. Right-click the button, choose Properties -> Events -> Click, and use the action button to create a new VBS action. Then in the Computer editor (or directly via the project tree) create a global action with the trigger OnTagChange -> DB_TransferTrigger. Paste the following code into the action body.

'================================================================
' WinCC VBS action: TransferTag_SQLInsert
' Trigger: OnTagChange on internal tag DB_TransferTrigger
' Writes one row to dbo.ProductionLog per rising edge
'================================================================
Option Explicit

' --- Local references to WinCC runtime API -----------------------
Dim oTrigger, oValueTag, oStatusTag

Set oTrigger    = HMIRuntime.Tags("DB_TransferTrigger")
Set oValueTag   = HMIRuntime.Tags("DB_PartNumber")
Set oStatusTag  = HMIRuntime.Tags("DB_TransferStatus")

' --- Read latest values from the tag system ----------------------
oTrigger.Read
oValueTag.Read
HMIRuntime.Tags("DB_Quantity").Read
HMIRuntime.Tags("DB_Operator").Read

' Only act on the rising edge (TRUE)
If oTrigger.Value <> True Then
    Exit Sub
End If

' Mark busy so the HMI can show a spinner / disable the button
oStatusTag.Write 1

' --- Build the parameter set ------------------------------------
Dim sPart, iQty, sOp, sStation
sPart    = CStr(HMIRuntime.Tags("DB_PartNumber").Value)
iQty     = CLng(HMIRuntime.Tags("DB_Quantity").Value)
sOp      = CStr(HMIRuntime.Tags("DB_Operator").Value)
sStation = "Line1"

' --- Sanitise: single quotes must be doubled for T-SQL ----------
Dim sPartEsc
sPartEsc = Replace(sPart, "'", "''")

' --- Open ADODB connection ---------------------------------------
Dim conn, cmd, strSQL
On Error Resume Next

Set conn = CreateObject("ADODB.Connection")
conn.ConnectionTimeout = 5
conn.CommandTimeout    = 10
conn.Open "Provider=MSOLEDBSQL;Server=SQLHOST\SQLEXPRESS;Database=WinCC_Logging;Uid=wincc_app;Pwd=StrongPwd!2024;Encrypt=Yes;TrustServerCertificate=No;"

If Err.Number <> 0 Then
    HMIRuntime.Trace "DB_TransferTrigger: connection open failed: " & Err.Number & " " & Err.Description & vbCrLf
    oStatusTag.Write -1
    Err.Clear
    On Error Goto 0
    Exit Sub
End If

' --- Parameterised INSERT (preferred) ---------------------------
strSQL = "INSERT INTO dbo.ProductionLog (PartNumber, Quantity, Operator, StationName) " & _
         "VALUES (?, ?, ?, ?)"

Set cmd = CreateObject("ADODB.Command")
Set cmd.ActiveConnection = conn
cmd.CommandText    = strSQL
cmd.CommandType    = 1          ' adCmdText
cmd.Parameters.Append cmd.CreateParameter("@p1", 202, 1, 32, sPart)  ' adVarWChar
cmd.Parameters.Append cmd.CreateParameter("@p2",  3, 1,  4, iQty)   ' adInteger
cmd.Parameters.Append cmd.CreateParameter("@p3", 202, 1, 16, sOp)
cmd.Parameters.Append cmd.CreateParameter("@p4", 202, 1, 32, sStation)

cmd.Execute , , 128            ' adExecuteNoRecords

If Err.Number <> 0 Then
    HMIRuntime.Trace "DB_TransferTrigger: INSERT failed: " & Err.Number & " " & Err.Description & vbCrLf
    oStatusTag.Write -1
Else
    oStatusTag.Write 0
End If

' --- Tear down --------------------------------------------------
Set cmd = Nothing
conn.Close
Set conn = Nothing

On Error Goto 0

' --- Re-arm the transfer tag ------------------------------------
HMIRuntime.Tags("DB_TransferTrigger").Write False

Two patterns are shown side-by-side above. The first uses a parameterised ADODB.Command object, which is the correct, SQL-injection-safe approach for production. If you want a shorter, less object-heavy variant, replace the cmd.Execute block with a string-concatenated statement and conn.Execute:

strSQL = "INSERT INTO dbo.ProductionLog (PartNumber, Quantity, Operator, StationName) " & _
         "VALUES ('" & sPartEsc & "', " & iQty & _
         ", '" & Replace(sOp, "'", "''") & "', '" & sStation & "')"
conn.Execute strSQL, , 128      ' adExecuteNoRecords

Step 5: Wire the Button Click to Set the Transfer Tag

The transfer tag is set from the operator button. On the same button's Mouse Click event in the Graphics Designer, enter:

That single line is the entire button logic. The action configured in Step 4 will fire within one WinCC scheduling tick (default 250 ms) and run the SQL insert asynchronously relative to the screen refresh, so the button click returns immediately to the operator.

Step 6: Configure the Action Trigger Properly

Open the WinCC Explorer, right-click Global Actions and create a new VBS action named TransferTag_SQLInsert. In the trigger dialog:

1. Click Add -> Tag -> OnTagChange.
2. Select the internal tag DB_TransferTrigger.
3. Set the action's update cycle to Upon change; do not tie it to a 250 ms timer, or the action will also fire on the falling edge (TRUE -> FALSE) when the script resets the tag, doubling the insert.
4. Confirm the action is enabled in the startup list of the WinCC runtime computer.

Step 7: Handle the Status and Error Path

Use the DB_TransferStatus tag to drive visible feedback on the screen. Recommended mapping:

You can also raise a WinCC alarm from the failure branch. Inside the On Error block use HMIRuntime.Alarm methods or write a Boolean tag that is wired to an alarm in the Alarm Logging editor. The simplest path is to set a Boolean tag DB_TransferError to TRUE; the alarm system handles the rest.

Step 8: Multi-Row Batch Insertion

If the operator can press the transfer button faster than the SQL round-trip (for example, on a manual rework station with 0.5 s button presses), you should batch. A common pattern is to have the script append values to a CSV file in a local path, and a separate 5-second scheduled action bulk-inserts the file. Inside the per-event action, instead of conn.Execute, write to a queue:

' --- Queue the row to a local staging file ---
Dim fso, ts
Set fso = CreateObject("Scripting.FileSystemObject")
Set ts  = fso.OpenTextFile("D:\WinCC\Staging\queue.csv", 8, True)   ' 8 = ForAppending
ts.WriteLine sPartEsc & "," & iQty & "," & sOp & "," & sStation
ts.Close
Set ts = Nothing
Set fso = Nothing

' --- Re-arm immediately ---
HMIRuntime.Tags("DB_TransferTrigger").Write False

Then a second scheduled action runs every 5 s and bulk-inserts queued rows with a single BULK INSERT or a TVP (table-valued parameter) call. This collapses N round-trips into one and lets the operator press the button as fast as they want.

Verification

1. Open WinCC -> Tools -> Computer -> Properties -> Startup and confirm Global Script Runtime is enabled.
2. Activate the project. Open the APDiag window (Start -> Programs -> Siemens Automation -> WinCC -> Tools -> APDiag). APDiag exposes a live view of internal tag values.
3. Press the transfer button. Watch DB_TransferTrigger go TRUE for one scan, then back to FALSE. DB_TransferStatus should briefly read 1 and then 0.
4. Open SQL Server Management Studio on the SQL host and run SELECT TOP 10 * FROM dbo.ProductionLog ORDER BY LogID DESC;. A new row should appear with the values you just wrote.
5. Force a failure path: stop the SQL Server service, press the button, and confirm DB_TransferStatus reads -1, an alarm is raised, and the GSC Diagnostics log contains the WinCC trace line with the ADODB error number.

WinCC 7.x vs TIA Portal WinCC RT Professional

The transfer tag pattern is identical, but the editor paths differ:

One practical difference: in TIA Portal, the VBScript editor lives under the HMI device -> Screens -> [Screen] -> [Object] -> Events -> [Event name] -> "Edit VBScript". Global actions are configured under "HMI Tags" -> "Connections" -> "Schedules" -> "Add new task" with the VBScript attached.

Troubleshooting Matrix

Performance and Sizing Notes

A single parameterised INSERT against a local SQL Server over a 1 Gb LAN takes 5-15 ms wall-clock. The ADODB connection open is the dominant cost at 30-80 ms because of the TLS handshake when Encrypt=Yes. If you insert more than 5-10 rows per second sustained, switch to a persistent connection held in an application-level global, or move to the bulk-queue pattern in Step 8. Avoid opening a new ADODB.Connection inside the action body on every trigger: it works, but it will not scale beyond a few events per second and it amplifies the impact of any network blip on SQL Server.

For very high-rate logging (hundreds of rows per second), prefer the WinCC IndustrialDataBridge or WinCC PerformanceIntegrator add-ons, which use the native SQL Server bulk-copy protocol and decouple WinCC from the database entirely. The VBS/ADO path documented here is appropriate for operator-driven, low-frequency, transactional writes, exactly the case the transfer-tag pattern is designed for.

Security and Hardening Checklist

1. Use parameterised queries (ADODB.Command with Parameters.Append) for every column that contains operator-entered text.
2. Encrypt the connection string. Do not store Pwd=... in plain text inside the project. WinCC supports an internal password dialog that masks the field in the editor.
3. Use a dedicated SQL login with db_datawriter only. Do not use sa and do not grant db_owner.
4. Force TLS on the SQL connection with Encrypt=Yes;TrustServerCertificate=No; and a valid CA-issued server certificate on the SQL host.
5. Audit the SQL Server login for failed login events; a misconfigured WinCC host will produce 4625 events in the Windows Security log on the SQL host.
6. Restrict the WinCC service account to the minimum set of Windows privileges: log on as service, write to the project directory, read the ODBC registry keys.

FAQ