Routing OPC Client Data to S7-400 Data Blocks in SIMATIC PCS 7 WinCC

In SIMATIC PCS 7 WinCC, data received from an external OPC server cannot be written to an S7-400 PLC data block simply by typing a PLC address (e.g., DB7,DBD0) on the OPC tag, because WinCC tags belong strictly to a single communication channel. To transfer external OPC data to controller data blocks, create an OPC channel tag to receive the external value, create a SIMATIC S7 Protocol Suite tag addressed to DB7,DBD0, and execute cyclic data routing using a WinCC Global Script (C-Action or VBScript) or an automated PCS 7 gateway block.

Architecture of WinCC as OPC DA Client vs. S7 Channel Driver

In SIMATIC PCS 7 Operator Stations, WinCC serves as a multi-protocol communication hub. It frequently interfaces simultaneously with:
1. SIMATIC S7 Protocol Suite (Industrial Ethernet / Named Connections): Communicates natively with S7-400 / S7-410 controllers over the Plant Bus to exchange process data, alarms, and setpoints.
2. WinCC OPC Channel (OPC DA / OPC UA Client): Connects to external third-party systems (e.g., laboratory analyzers, weight scales, third-party PLCs) to read external metrics.

A common misunderstanding occurs when an engineer attempts to route incoming OPC data into an S7-400 controller. The engineer opens the tag properties of the incoming OPC tag and attempts to configure an S7 memory address:
DB7,DDD0

The tag management editor rejects the change or fails to write data to the controller.

In the WinCC architecture, tags are channel-exclusive:
* A tag created under the OPC Channel can only communicate with the external OPC server.
* A tag created under the SIMATIC S7 Protocol Suite can only communicate with the S7 CPU.
* Furthermore, DB7,DDD0 is invalid S7 address syntax (32-bit floating-point or double-word variables in S7 data blocks are addressed as DB7,DBD0 or DB7,DD0).

Communication Channel and Data Flow Matrix

Understand how data flow is separated between WinCC communication channels:

Layer / ComponentAssigned WinCC ChannelAddress FormatDirection of Data FlowExternal Laboratory AnalyzerOPC DA / UA ChannelItemID: Analyzer.Vessel1.pH_ValueExternal Device -> WinCC OPC TagIntermediate Routing EngineWinCC Global Script RuntimeScript Trigger: Upon Change of OPC TagWinCC OPC Tag -> WinCC S7 TagS7-400 Technological DBSIMATIC S7 Protocol Suite (Named Connections)S7 Address: DB7,DBD0 (REAL)WinCC S7 Tag -> S7-400 Data BlockCFC Technological BlockS7 Controller Execution (CFC)Interconnection to DB7.DBD0S7 DB -> Controller Control Logic

Data integrity warning: Cyclic cross-channel script routing requires communication status validation before writing to controllers.

Why Direct Addressing (DB7,DDD0) Fails on OPC Channel Tags

WinCC tag drivers are isolated dynamic link libraries:
* When a tag belongs to the OPC channel driver (OPC.chn), its address dialog only accepts OPC ItemIDs (e.g., Channel1.Device1.Tag1). Entering S7 syntax (DB7,DDD0) causes the OPC server to search for an item named DB7,DDD0, which does not exist, setting tag quality to Bad - Configuration Error.
* In S7 Protocol Suite (S7ProtocolSuite.chn), data types follow strict notation:
* Binary bit: DB7,DBX0.0
* Byte: DB7,DBB0
* 16-bit Integer: DB7,DBW0
* 32-bit Real / Double Word: DB7,DBD0 (using three D's like DDD0 is a syntax error).

Step-by-Step Implementation: Transferring OPC Data to PLC Data Blocks

Follow this verified procedure to bridge OPC data into the S7-400 PLC:

Create the Inbound OPC Tag:
* In WinCC Explorer, open Tag Management.
* Under OPC > OPC Groups, create tag OPC_In_Weight (Type: Floating-point 32-bit).
* Address it to the external OPC ItemID.
Create the Outbound S7 PLC Tag:
* Under SIMATIC S7 Protocol Suite > Named Connections > AS_Unit1, create tag PLC_Out_Weight (Type: Floating-point 32-bit).
* Address it to:
- Data area: DB
- DB Number: 7
- Address: DBD 0
Implement Cyclic Cross-Channel Transfer Script:
* In WinCC Explorer, open Global Script > C-Editor (or VBS-Editor).
* Create a new Project Action:
```c
#include "apdefap.h"
void Write_OPC_To_PLC()
{
float opcVal = 0.0;
DWORD quality = 0;
```
 // 1. Read value and quality code from OPC tag
 opcVal = GetTagFloatQC("OPC_In_Weight", &quality);

 // 2. Validate quality code (0x80 = Good) before writing to PLC
 if ((quality & 0xC0) == 0x80)
 {
     SetTagFloat("PLC_Out_Weight", opcVal);
 }
```
}
`` * Set the Action Trigger to: **Upon change of tagOPC_In_Weight`** with a 1-second cyclic check fallback.

Verification

Verify end-to-end data transfer:
1. In the external OPC server, write a test value (e.g., 88.5) to the OPC item.
2. In WinCC Explorer, open Channel Diagnosis: Confirm that both the OPC channel and S7 Protocol Suite channel report status OK with zero error counters.
3. In SIMATIC Manager, open variable table (VAT) or monitor DB7 online in STEP 7:
* Confirm that address DB7.DBD0 displays 88.5 (REAL) within 100 to 500 milliseconds of the OPC change.

Limitations and Operational Precautions

Using WinCC scripts as a real-time data bridge is suitable for supervisory setpoints and laboratory data, but prohibited for safety interlocks or millisecond-critical process trips. Communication latency over WinCC scripts varies from 100 ms to 2 seconds.
Always evaluate the quality code (quality == 0x80) before writing to the PLC; writing stale or invalid values during external OPC disconnects can cause controller mathematical exceptions.
If high-speed, deterministic controller-to-controller data transfer is required, bypass WinCC entirely and deploy a hardware communication gateway (e.g., SIMATIC NET CP 443-1 with Open User Communication or Modbus TCP).

Engineer FAQ

Can OpenPCS 7 write data directly from an OPC client to an S7 DB?

Yes. If using the OpenPCS 7 station, external OPC clients can read and write directly to S7-400 CFC blocks and DBs using standard OLE DB or OPC DA/UA interfaces without WinCC scripting.

What happens if the external OPC connection drops?

If the connection drops, GetTagFloatQC returns a bad quality code (< 0x80). The C-script logic skips the SetTagFloat call, holding the last valid value in DB7 or allowing a timeout watchdog to trip in CFC.

Is VBScript faster than C-Script for tag copying in WinCC?

In modern WinCC versions, both execution engines have near-identical performance (< 5 ms execution time per action). C-Script is generally preferred in PCS 7 for its direct integration with Basic Process Control header files.