Troubleshooting SIMATIC PCS 7 as an OPC DA and OPC UA Client

In SIMATIC PCS 7 OS (WinCC), when operating as an OPC Client, being able to browse an external OPC Server's tag hierarchy but failing to read active values or receiving 'Bad Quality' (16#00) stems from Microsoft DCOM security restrictions, Windows Firewall port blocking, or tag data type mismatches. For OPC DA Classic, configure DCOM permissions (dcomcnfg) for OPCEnum and the target OPC Server, open TCP port 135 and dynamic RPC ports, or migrate the connection to the modern SIMATIC WinCC OPC UA Client channel (OPC UA.chn).

SIMATIC PCS 7 and WinCC OPC Client Architecture

In industrial plants, SIMATIC PCS 7 frequently needs to exchange real-time data with external supervisory systems, laboratory information management systems (LIMS), third-party packaging machines, or legacy PLCs. The open communication standard OPC (Open Platform Communications) provides the primary mechanism for this data exchange.

SIMATIC WinCC acts as a versatile OPC Client:
* OPC DA (Data Access Classic): Based on Microsoft COM/DCOM technology. Communicates via the OPC.chn driver in WinCC Tag Management.
* OPC UA (Unified Architecture): Modern cross-platform standard based on binary TCP/IP sockets and X.509 security certificates. Communicates via the OPC UA.chn channel.

A classic troubleshooting scenario occurs with OPC DA Classic:
An engineer adds the OPC.chn driver, clicks Browse Server, successfully connects to the external OPC Server, and browses the complete hierarchical tree of tags. However, once the tags are imported into WinCC Tag Management and runtime is activated, every tag displays bad quality (16#00), and dynamic fields display ???.

Root Causes for Tag Browsing Success but Value Read Failure

The reason browsing works while reading fails lies in the asymmetric architecture of Microsoft DCOM:
1. Asymmetric DCOM Callback Architecture:
- Browsing uses synchronous remote procedure calls initiated by WinCC Client -> OPC Server.
- Data updates in OPC DA rely on Asynchronous Callbacks (IConnectionPointContainer / IOPCDataCallback): The OPC Server initiates an independent DCOM connection back to the WinCC Client machine to deliver changed tag values.
- If the WinCC client's firewall or DCOM access permissions reject incoming connections from the server machine, browsing succeeds, but all asynchronous data updates are blocked.
2. Tag Data Type Incompatibility:
If a tag is defined as a 64-bit double-precision float (VT_R8) on the OPC server but imported as a 32-bit single-precision float (VT_R4) in WinCC without automatic scaling, WinCC rejects the incoming data packet as invalid type.
3. OPC Server User Context (Identity Mismatch):
If the OPC Server runs under the identity of a local Windows user that does not exist or has a different password on the WinCC machine, DCOM authentication fails silently.

DCOM Security and Windows Firewall Requirements for OPC DA Classic

To allow OPC DA Classic communication across two Windows machines (e.g. Windows Server 2008 R2 / 2012 R2 or Windows 7):
* Matching User Accounts: The exact same Windows user account and password must exist on both the OPC Server and WinCC Client machines (or both machines must reside in the same Active Directory Domain).
* DCOM Configuration (dcomcnfg.exe):
- Open Component Services (dcomcnfg).
- Navigate to Component Services -> Computers -> My Computer -> Properties -> COM Security.
- In both Access Permissions and Launch and Activation Permissions, add the user account and enable Remote Access and Remote Activation.
- In the properties of OPCEnum and the specific OPC Server application, set Identity to The Interactive User or This User.
* Windows Firewall Rules:
- Open inbound TCP Port 135 (DCOM RPC Endpoint Mapper).
- Open the dynamic RPC port range (TCP 49152 to 65535 on modern Windows) or configure a fixed DCOM port range in Component Services.

OPC DA Classic vs. OPC UA Client Comparison Matrix

The following matrix compares classic DCOM-based OPC with modern OPC UA in SIMATIC PCS 7:

Evaluation MetricOPC DA Classic (OPC.chn)OPC UA Client (OPC UA.chn)Underlying TechnologyMicrosoft COM / DCOMCross-Platform Binary TCP/IPFirewall FriendlinessExtremely Poor (Port 135 + Dynamic ports)Excellent (Single fixed TCP port, e.g. 4840)Security & EncryptionWindows NTLM / Kerberos (Complex)X.509 Certificates + AES EncryptionCallback RobustnessProne to silent DCOM callback blockingNative bidirectional socket communicationBrowsing vs. Read FailureCommon failure mode due to DCOMImmune (Single channel handles both)Recommended by Siemens?Legacy support onlyStandard for all modern integrations

Step-by-Step Procedure to Configure WinCC as an OPC Client

To configure and verify WinCC OPC communication:
1. Configure DCOM and User Security (for OPC DA Classic):
- Ensure the operating user belongs to the local Windows groups Administrators and SIMATIC HMI on both PCs.
- Run dcomcnfg.exe. Enable Remote Access in COM Security for both computers.
2. Add the OPC Channel in WinCC Explorer:
- In WinCC Explorer, right-click Tag Management and select Add New Driver.
- Select OPC.chn (for DA Classic) or OPC UA WinCC Channel (for modern UA).
3. Establish Connection and Import Tags:
- Expand the OPC driver folder in Tag Management.
- Right-click and select System Parameter -> OPC Server Selection.
- Browse local or remote computers and select the registered OPC Server.
- In the tag browser dialog, select the required items and click Add Tags.
4. Verify Tag Data Types in WinCC:
- Inspect the imported tags in WinCC Tag Management.
- Ensure the WinCC tag data type (e.g. Floating-point number 32-bit IEEE 754) matches the native OPC item data type.
5. Activate Runtime and Monitor Channel Health:
- Activate WinCC Runtime.
- Open WinCC Channel Diagnosis: Under the OPC channel tab, confirm connection status displays Ready / OK with an active update cycle.

Verification

Verify end-to-end OPC communication:
1. Open WinCC Channel Diagnosis: Under OPC.chn, verify connection status displays a green checkmark and zero error codes.
2. Create an I/O field on a test graphic connected to an imported OPC tag.
3. Open WinCC Runtime:
- Verify the value displays valid numbers instead of ???.
- Verify that modifying the value on the external OPC server immediately updates the display in WinCC.
4. If writing is required: Modify the setpoint from WinCC and confirm the external system accepts the write command.

Limitations and Operational Precautions

Operating classic OPC DA across corporate firewalls or wide-area networks (WAN) is strongly discouraged due to DCOM timeout vulnerabilities; use OPC UA or an OPC tunneling utility instead.
High tag polling rates (< 100 ms) across thousands of OPC tags can cause severe CPU saturation on third-party OPC servers.
Ensure third-party OPC server software is officially certified by the OPC Foundation.

Engineer FAQ

Can WinCC act as both an OPC Server and an OPC Client simultaneously?

Yes. WinCC natively runs an OPC DA and OPC UA Server (allowing external systems to read WinCC tags) while simultaneously executing the OPC Client channels to acquire external data.

What does Quality Code 16#00 mean on an OPC tag?

Quality code 16#00 represents 'Bad: Non-specific'. It indicates that the OPC client cannot establish communication with the OPC server or the server cannot access the physical data point.

Does WinCC OPC UA Client require an additional software license?

In standard PCS 7 V8.x OS packages, the WinCC OPC UA Client channel is included within standard OS Runtime PO licensing. External third-party OPC servers may require vendor-specific licenses.