Accessing PCS 7 Hardware Component and Station Inventory: SIMATIC Management Console vs Direct SQL Querying

In SIMATIC PCS 7, hardware component configurations, I/O module serial numbers, firmware revisions, and station topologies (ES, OS Servers, OS Clients) cannot be queried directly from a single Microsoft SQL Server database table. The Step 7 engineering configuration is stored across proprietary Sybase/C-ISAM databases (.s7p) and binary System Data Blocks (SDBs) inside the project folder, while WinCC SQL Server instances exclusively store runtime visualization tags and alarms. To extract comprehensive plant-wide hardware and software inventory without manual HW Config exports, Siemens provides the SIMATIC Management Console (SMMC). SMMC automatically interrogates distributed stations over the network, aggregating complete hardware MLFBs, firmware revisions, installed software packages, and license keys into centralized exportable XML and Microsoft Excel reports.

Database Storage Architecture: Step 7 Engineering vs WinCC SQL Server

Engineers frequently assume that because SIMATIC PCS 7 utilizes Microsoft SQL Server for WinCC, all DCS data—including controller racks, I/O modules, and field devices—resides in relational SQL tables. This is an architectural misconception:

Step 7 Engineering Database: The hardware catalog, HW Config layouts, network addresses, and CFC charts are stored within proprietary structured files inside the Step 7 project container on the Engineering Station. Station configurations are compiled into binary System Data Blocks (SDBs) that controllers parse at startup.
WinCC Microsoft SQL Server: Only hosts runtime HMI data: Tag Management, Alarm Logging archives, User Archives, and Batch databases. The SQL tables contain no awareness of remote I/O module model numbers or CPU firmware levels.

Limitations of Direct SQL Access for PCS 7 Hardware Data

Attempting to query WinCC SQL Server instances (WINCC) using SQL Server Management Studio (SSMS) to find hardware inventory data is futile because:

Absence of Hardware Schema: WinCC databases (CC_..._R and CC_..._C) contain tables such as PDE#Archive, MS_MESSAGES, and MCP_TAG, but possess no tables for PLC racks, part numbers, or bus interfaces.
Security and Integrity Risks: Directly querying or attaching scripts to production WinCC SQL instances can trigger table locking, degrading operator screen response times or violating validated pharmaceutical/nuclear software baselines.
Decoupled Architecture: PCS 7 controllers operate independently of WinCC; an S7-400 controller executes its logic and manages I/O even if the WinCC SQL Server is completely powered down.

SIMATIC Management Console (SMMC) for Automated Plant Inventory

To satisfy enterprise asset management, auditing, and cybersecurity requirements, Siemens developed the SIMATIC Management Console (SMMC):

Network Agent Architecture: SMMC runs on a central administrative PC and communicates with lightweight SMMC Agent services installed on every ES, OS Server, and OS Client across the Terminal Bus.
Field Interrogation: SMMC interrogates active controllers (S7-400, CPU 410-5H) and distributed ET 200 stations via S7 communication, reading the Electronic Rating Plate (I&M data - Identification and Maintenance functions 0 to 4).
Collected Metrics: SMMC retrieves exact MLFB order numbers, hardware revision levels, serial numbers, installed firmware, installed PCS 7 software updates, and ALM license keys.

Exporting Hardware, Software, and License Data via SMMC

To generate a comprehensive plant inventory report using SIMATIC Management Console:

Open SIMATIC Management Console on the administrative station.
In the console tree, navigate to Management Network; right-click and select Determine Inventory Data.
Select the inventory scope: check Hardware, Software, and Licenses.
Choose target objects: select the entire PCS 7 Multiproject, specific PC stations, or online automation stations.
Execute the scan. SMMC polls the devices and populates the inventory tables.
Select Export > Export Inventory Data to Excel (CSV/XML) to generate a formatted asset report suitable for maintenance auditing and migration planning.

Comparison of Hardware Data Extraction Methods in PCS 7

The following table compares different approaches to retrieving hardware and station inventory from a PCS 7 installation:

Extraction MethodExtracted InformationAutomation LevelImpact on ProductionRecommended ApplicationSIMATIC Management Console (SMMC)Full MLFBs, serials, firmware, software, licenses100% Automated network scanZero (Low-priority query)Standard enterprise DCS asset auditingHW Config 'Export Station'Addresses, rack slots, basic module namesManual per stationZero (Offline file export)Offline engineering cross-checksStep 7 Version Cross-ManagerProject block and parameter differencesManual batch comparisonZero (Offline ES tool)Software version comparisonDirect WinCC SQL QueryNone (Hardware data not stored in WinCC SQL)Manual SQL scriptHigh (Risk of SQL locks)Not viable / Not supported

Commercial Accuracy Disclaimer: Software order numbers (MLFBs), package structures, and hardware capacity prerequisites vary across PCS 7 versions and hardware platforms. System integrators must confirm exact software entitlements and licensing requirements against the official Siemens Catalog CA 01 and obtain an authorized Siemens distributor quotation prior to purchasing.

Verification

Verify hardware inventory extraction via SIMATIC Management Console:
1. In SMMC, select an active Automation Station in the device tree; verify that the inventory view displays the CPU 410 / S7-400 with its exact MLFB, serial number, and firmware version.
2. Expand the rack hierarchy; confirm that distributed ET 200M / ET 200SP HA interface modules and connected I/O cards are enumerated with matching I&M data.
3. Select an OS Server PC; verify that SMMC lists all installed hotfixes, WinCC updates, and Automation License Manager license allocations.
4. Export the inventory to an Excel spreadsheet; confirm that all field instrument part numbers and station hostnames populate without missing records.

Limitations and Operational Precautions

SMMC requires the 'SIMATIC Management Agent' service to be installed and active on all target PC stations. Terminal bus firewalls must permit communication on the designated SMMC ports. While SMMC reads electronic rating plates via non-intrusive background queries, avoid scheduling plant-wide hardware scans during critical plant startup phases or high-throughput batch execution to ensure zero network jitter on the plant bus.

Engineer FAQ

Does SIMATIC Management Console require a separate license?

The basic inventory scanning of PC stations requires SMMC licensing based on the number of managed nodes (e.g., SMMC package for 10, 50, or 100 nodes). Contact your Siemens distributor for current MLFBs.

Can SMMC detect hardware that is configured offline but disconnected in the field?

SMMC supports two modes: 'Online Inventory' (polls live hardware for serial numbers and firmware) and 'Offline Project Inventory' (reads the configured modules directly from the Step 7 project database).

Why isn't Step 7 hardware configuration stored in Microsoft SQL Server?

Step 7 was architected as an engineering tool using optimized structured databases for fast compilation and safety-critical deterministic validation, whereas SQL Server was integrated specifically for WinCC SCADA runtime data handling.