Automating Hardware Configuration Data Extraction and Asset Reporting in SIMATIC PCS 7

In SIMATIC PCS 7, extracting hardware configuration data (including module descriptions, order numbers/MLFBs, serial numbers, firmware revisions, and fieldbus addresses) across multiple Automation Stations cannot be performed by querying the WinCC SQL database directly, because raw HW Config data resides in proprietary STEP 7 binary project files (*.s7p). To automate hardware data extraction without manually exporting HW Config station by station, engineers should deploy the SIMATIC Management Console (SMC), which automatically queries all online and offline stations to generate comprehensive Excel/CSV inventory reports. Alternatively, deploying the PCS 7 Maintenance Station (MS Basic) automatically compiles hardware assets into structured WinCC SQL tables during OS compilation, while custom batch automation can be achieved using the STEP 7 Command Interface.

Storage Architecture of Hardware Configuration Data in PCS 7

In large-scale SIMATIC PCS 7 installations comprising dozens of Automation Stations (AS), communications processors, and thousands of distributed I/O modules (ET 200M, ET 200SP HA), plant lifecycle managers and maintenance engineers require comprehensive hardware inventory schedules.

Engineers frequently ask whether hardware inventory data can be queried directly from Microsoft SQL Server.
Understanding where this data resides is critical:
- Offline HW Config: In SIMATIC Manager, hardware configurations are stored inside proprietary binary files and Sybase relational tables within the project directory (<Project>\hdb\, System Data Blocks SDB). Standard WinCC SQL databases do NOT store AS hardware configuration tables by default.
- Online Field Hardware: Serial numbers, production dates, and actual firmware versions reside in the non-volatile memory of physical modules, accessible over the bus via standard Identification & Maintenance (I&M 0 to I&M 4) data records.

Exporting hardware data manually station by station (Station > Export...) is tedious and error-prone. PCS 7 provides three automated architectures for batch hardware data extraction.

Method 1: Enterprise Hardware Inventory via SIMATIC Management Console

The primary and most powerful tool provided by Siemens for automated hardware inventory is the SIMATIC Management Console (SMC):

flowchart TD
    A["SIMATIC Management Console (SMC)"] --> B["Network Scan / Multiproject XML Analysis"]
    B --> C["Online I&M Hardware Query (I&M 0-4)"]
    B --> D["Offline HW Config Configuration Query"]
    C & D --> E["Automated Export: Microsoft Excel (.xlsx) / CSV"]
    E --> F["Complete Plant Schedule: MLFB, Serial No, Firmware, Lifecycle Status"]

Key Capabilities of SIMATIC Management Console:

Automated Multiproject Inventory: SMC directly parses the entire Multiproject in a single batch operation, reading all AS controllers, CP cards, and distributed I/O stations.
Online Discrepancy Analysis: SMC queries the physical modules over Industrial Ethernet and PROFIBUS/PROFINET, comparing the configured MLFB/firmware in HW Config against the physical hardware actually installed in the cabinets.
Automated Export: Generates standardized, formatted Microsoft Excel (.xlsx) and .csv inventory reports containing:
- Module Name and Rack/Slot position
- Siemens Order Number (MLFB)
- Hardware Release and Firmware Version
- Serial Number and Manufacturer Date
- Product Lifecycle State (Active, Discontinued, Phase-out)

Method 2: Maintenance Station Asset Management and SQL Extraction

If the facility does not have SIMATIC Management Console installed, the PCS 7 Maintenance Station (MS Basic / MS Standard) provides an alternative SQL-accessible repository:

Automated Asset Database Compilation: When the Maintenance Station OS project is compiled, the system automatically translates HW Config hardware definitions into WinCC Asset Objects.
Microsoft SQL Server Storage: The Maintenance Station creates dedicated tables inside the local WinCC SQL Server database:
- Tables named MS_AssetTable, MS_ComponentData, and MS_Diagnostics.
- These tables contain component designations, rack locations, MLFBs, and operational health states.
Data Extraction: Engineers can query these SQL tables directly using SQL Server Management Studio (SSMS), generate automated reports using SIMATIC Information Server, or export CSV logs via WinCC IndustrialDataBridge.

Method 3: Batch Scripting via the STEP 7 Command Interface

For software developers seeking fully automated batch exports directly from SIMATIC Manager without additional licenses:
- Siemens provides the STEP 7 Command Interface (COM/OLE Automation API via s7comm.dll).
- An engineer can author a Visual Basic (.vbs) or C# script that:
1. Opens the target Multiproject programmatically.
2. Iterates through all AS stations in the project collection.
3. Executes the internal export command (ExportStationConfiguration) for each station sequentially.
4. Parses the generated CFG/XML text files and aggregates the data into a single consolidated master spreadsheet.

Hardware Data Extraction Methodology Comparison Matrix

The following matrix compares the three automated hardware extraction methodologies:

Extraction MethodTool RequiredLicensing RequirementData CapturedOutput FormatsSIMATIC Management ConsoleDedicated SMC ServerSMC Base License + Agent LicensesMLFB, Serial No, Firmware, Lifecycle statusFormatted Excel (.xlsx), CSVPCS 7 Maintenance StationWinCC Maintenance OSMS Basic (Free with OS) / MS StandardAsset names, MLFBs, diagnostic status, locationsWinCC SQL Tables, Info Server PDF/ExcelSTEP 7 Command InterfaceVisual Basic / C# ScriptStandard Engineering LicenseStation parameters, slot assignments, addressesText (.cfg), XML, custom CSVManual Station ExportHW Config GUINoneStation-specific configuration textSingle .cfg file per AS

Verification

To confirm that automated hardware data extraction is functioning:
1. In SIMATIC Management Console, execute an Inventory scan of the target Multiproject.
2. Verify that all AS stations, CPs, and distributed ET 200 nodes appear in the inventory tree.
3. Click Export Inventory Data: Select Microsoft Excel format.
4. Open the generated spreadsheet: Confirm that all columns (Station, Rack, Slot, Module Type, Order Number MLFB, Firmware Version) are completely populated.
5. Cross-reference a random module's serial number in the spreadsheet against the physical hardware in the cabinet: Confirm exact alphanumeric correspondence.

Limitations and Operational Precautions

Observe the following engineering precautions:
- I&M Data Record Support: Physical serial numbers and manufacturing dates can only be read online if field modules support Identification & Maintenance data (I&M 0 to I&M 4). Legacy S7-300 modules may only report MLFB and firmware revision.
- SQL Server Read-Only Safety: When querying Maintenance Station SQL tables directly via SSMS, strictly enforce SELECT read-only queries. Never execute UPDATE, INSERT, or DELETE statements, as this will corrupt the WinCC runtime database schema.
- Network Bandwidth During SMC Scans: Online inventory scanning of tens of thousands of field devices queries devices over fieldbus networks. Avoid executing full online scans during critical plant startup phases.

Engineer FAQ

Can I view AS hardware configuration directly in standard WinCC SQL tables?

No. Standard WinCC OS servers only store process tags, alarms, and trend archives. Hardware configuration data is compiled into SQL tables only if the station is configured as a PCS 7 Maintenance Station (MS).

What is the difference between SIMATIC Management Console (SMC) and Maintenance Station (MS)?

Maintenance Station is an operator-facing runtime diagnostic tool that visualizes hardware health and maintenance requests on HMI screens. SIMATIC Management Console is an administrative lifecycle tool used for software updating, license management, and automated plant-wide hardware inventory reporting.

Does SIMATIC Management Console require software agents on every PC?

Yes, for online PC station inventory, SMC communicates with lightweight 'SIMATIC Management Agents' installed on each computer node. For AS controllers, SMC communicates directly over Industrial Ethernet without requiring agents.