Enabling OPC UA Server in SIMATIC PCS 7: OpenPCS 7 vs Process Historian OPC UA Server Architecture and Licensing

In SIMATIC PCS 7 V8.1 and V8.2, native OPC Unified Architecture (OPC UA) server connectivity cannot be enabled directly inside the standard WinCC OS Server runtime. To expose real-time process values, historical data, and alarms to third-party ERP, MES, or external SCADA applications via OPC UA, engineers must deploy either an OpenPCS 7 station or utilize the native OPC UA server interface integrated into the SIMATIC Process Historian. OpenPCS 7 acts as an out-of-band communication gateway hosting OPC UA DA (Data Access), HDA (Historical Data Access), and A&E (Alarms & Events) services, licensed via the OpenPCS 7 software package, whereas Process Historian provides long-term historical tag and alarm access over OPC UA.

OPC UA Architectural Requirements in SIMATIC PCS 7

Modern industrial architectures frequently require plant-floor data exchange with external Manufacturing Execution Systems (MES), enterprise analytics platforms, and cloud IoT gateways using the platform-independent OPC Unified Architecture (IEC 62541). While classic SIMATIC PCS 7 installations historically relied on DCOM-based OPC DA and OPC HDA, DCOM suffers from severe cybersecurity vulnerabilities, complex firewall traversal rules, and operating system deprecation.

In PCS 7 V8.1 and V8.2, exposing OPC UA requires selecting the correct architectural middleware. Siemens does not recommend connecting third-party OPC UA clients directly to mission-critical redundant OS Servers, as heavy external query loads could starve WinCC operator display refresh cycles. Instead, Siemens provides two distinct OPC UA interfaces: OpenPCS 7 for real-time and near-term data, and Process Historian for long-term historical archives.

Deploying OpenPCS 7 as a Dedicated OPC UA Gateway

OpenPCS 7 is an official SIMATIC PCS 7 software station designed specifically to bridge the industrial control system to IT and enterprise layers:

Station Configuration: OpenPCS 7 is configured in SIMATIC Manager as a standard PC Station running the 'OpenPCS 7' application. It resides on the Terminal Bus, accessing real-time tags and messages from the WinCC OS Servers via server packages.
Supported Profiles: OpenPCS 7 provides OPC UA Data Access (DA) for live tag reads/writes, OPC UA Historical Data Access (HDA) for short-term Trend archives, and OPC UA Alarms & Conditions (AC) for real-time sequence-of-events.
Licensing: Requires an OpenPCS 7 station license (e.g., 6ES7658-0HX28-2YB0 for V8.2) installed on the gateway machine via Automation License Manager (ALM).

Process Historian Native OPC UA Server Integration

If the third-party application only requires access to archived historical tags and historical process alarm logs, the SIMATIC Process Historian (PH) is the preferred data provider:

Integrated Server: Starting in Process Historian 2014, an integrated OPC UA Server is embedded directly into the Historian operating core, running as a dedicated Windows service (CCStartHistorianUAServer.exe).
Direct SQL Database Access: Third-party OPC UA clients query historical data without placing any network load on the active WinCC OS runtime servers.
Security Profiles: Supports standard OPC UA encryption profiles (Basic256Sha256, Aes128_Sha256_RsaOaep) with X.509 security certificates.

Network Topology, Port Assignment, and Security Certificates

To establish secure OPC UA communications across corporate firewalls without compromising DCS perimeter defense:

Network Placement: The OpenPCS 7 PC or Process Historian must be placed in a Demilitarized Zone (DMZ) or connected across dual network interfaces (one facing the PCS 7 Terminal Bus, one facing the corporate MES network). It must NEVER bridge directly to the Plant Bus.
Firewall Ports: The standard OPC UA TCP endpoint port is 4840 (or 4852 for custom OpenPCS 7 installations). Open this inbound TCP port on the intermediate firewall.
Certificate Exchange: In the OpenPCS 7 / Process Historian OPC UA configurator, generate a trusted server certificate. Export the server certificate and import it into the third-party client trust store, and import the client certificate into the server's rejected/trusted certificate store.

Comparison of OpenPCS 7 vs Process Historian OPC UA Servers

The following table highlights the key operational differences, capabilities, and licensing prerequisites between OpenPCS 7 and Process Historian OPC UA servers:

Operational AttributeOpenPCS 7 OPC UA ServerProcess Historian OPC UA ServerPrimary Use CaseLive real-time control, setpoint writes, active alarmsHistorical analytics, compliance reporting, batch logsData Access ProfilesOPC UA DA (Real-Time), HDA (Short-term), AC (Events)OPC UA HDA (Historical Tags), AC (Alarm Archive)Read / Write CapabilityBidirectional (Read / Write to AS controller)Read-only historical data extractionData SourceReal-time WinCC OS Runtime Server packagesMicrosoft SQL Server / PH Archive DatabaseImpact on OS Server LoadLow (gateway buffers requests via OLE-DB)Zero impact on active OS Runtime ServersEngineering LicensingRequires dedicated OpenPCS 7 LicenseIncluded with Process Historian Server package

Commercial Accuracy Disclaimer: Software order numbers (MLFBs), package structures, and hardware capacity prerequisites vary across PCS 7 versions and hardware platforms. System integrators must confirm exact software entitlements and licensing requirements against the official Siemens Catalog CA 01 and obtain an authorized Siemens distributor quotation prior to purchasing.

Verification

Verify OPC UA server functionality with the following validation steps:
1. On a remote engineering laptop connected to the MES subnet, launch a diagnostic OPC UA client (such as UAExpert or Siemens OPC Scout).
2. Connect to the endpoint URL (e.g., opc.tcp://192.168.10.50:4840); verify that the server certificate appears and trust it.
3. Select security policy Basic256Sha256 with 'Sign and Encrypt'; verify successful cryptographic handshake and session establishment.
4. Browse the Address Space tree under Objects > Server > PCS7; drag analog process tags (e.g., FIC_101.PV_Out#Value) into the Data View and verify real-time value updates and quality code 0x80 (Good).

Limitations and Operational Precautions

Never install OpenPCS 7 software directly on a redundant WinCC OS Server in high-throughput plants; always deploy OpenPCS 7 on a dedicated hardware or virtual machine station. When configuring OPC UA write access through OpenPCS 7, implement strict user authentication and authorization using SIMATIC Logon or Windows Active Directory accounts to prevent unauthorized remote parameter modifications. Ensure that the system clocks of the OPC UA server and all client stations are synchronized via NTP to avoid certificate validation rejection.

Engineer FAQ

Can I upgrade PCS 7 V8.1 to get native OPC UA on the OS Server without OpenPCS 7?

No. WinCC 7.3 (underlying PCS 7 V8.1) does not support hosting an autonomous OPC UA server without the OpenPCS 7 / WinCC Connectivity Pack option. Even in newer versions like PCS 7 V9.0, OpenPCS 7 remains the mandated architecture for decoupling external clients from the DCS runtime.

Can OpenPCS 7 write setpoints back to the AS controller?

Yes. OpenPCS 7 supports OPC UA Data Access write operations. When an authorized client writes a value to an input tag, OpenPCS 7 forwards the write request across the terminal bus to the WinCC OS Server, which executes an S7 write to the target AS block.

What happens to OPC UA communication if the primary OS Server fails?

OpenPCS 7 is redundancy-aware. When configured with redundant OS Server packages, OpenPCS 7 automatically switches its internal data provider connection to the standby OS Server bumplessly, maintaining active OPC UA client sessions.