C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Troubleshooting Unconnected OPC DA Tags ('???') Between Kepware and WinCC in PCS 7 V8.1

Troubleshooting Unconnected OPC DA Tags ('???') Between Kepware and WinCC in PCS 7 V8.1

In SIMATIC PCS 7 V8.1 SP1 (WinCC V7.3), Kepware OPC DA tags showing '???' followed by blank fields indicate DCOM authentication denial, Windows Firewall dynamic port blocks, or missing user account parity between host machines. Resolve this by standardizing matching Windows local user credentials, configuring DCOM security permissions via dcomcnfg, enabling application rules in Windows Firewall, or migrating to modern OPC UA.

Table of Contents

OPC DA Communication Failures and Diagnostic Indicators

When integrating third-party systems (such as PLCs, weigh scales, or laboratory instruments) into SIMATIC PCS 7 V8.1 SP1 (WinCC V7.3) using Kepware (KEPServerEX) as a centralized OPC server on a separate PC, commissioning engineers frequently encounter communication failures:
* Tags are browsable in WinCC Tag Management under the OPC Channel.
* When WinCC Runtime starts, dynamic graphic displays show ??? on tag fields, followed after several seconds by blank values ().
* In the WinCC Channel Diagnosis tool (WinCCChannelDiagnosis.exe), the OPC connection status shows Disconnected or Connecting... with quality code 16#00 (Bad).
* The identical configuration functions without error on an older PCS 7 V8.0 workstation.

The initial appearance of ??? followed by blank fields indicates that WinCC attempted an initial synchronous read, failed to obtain data, and timed out. This symptom occurs because while the OPC Server allows tag browsing via the OPC Enum service, subsequent data streaming and asynchronous callbacks are blocked at the DCOM security or transport layer.

DCOM Security Architecture and PCS 7 V8.1 Hardening

The root cause of cross-workstation OPC DA communication failure in PCS 7 V8.1 stems from enhanced operating system and Siemens security hardening:

  1. User Account and Security Identifier (SID) Mismatch:
    * OPC DA (Data Access) relies entirely on Microsoft DCOM (Distributed Component Object Model).
    * In a workgroup environment (non-domain), DCOM requires that the user logged into the WinCC client exists on the Kepware PC with the identical username and identical password.
    * If credentials do not match, DCOM rejects incoming connection tokens with Access Denied (HRESULT 0x80070005).

  2. DCOM Access, Launch, and Activation Limits:
    * In PCS 7 V8.1, the Siemens Security Controller applies strict DCOM baseline templates.
    * Remote activation of Kepware's COM object requires explicit permissions for ANONYMOUS LOGON, Everyone, and Interactive under Machine Access Restrictions and Machine Launch Restrictions in dcomcnfg.

  3. Dynamic RPC Port Dropping via Windows Firewall:
    * DCOM establishes an initial handshake over TCP Port 135 (RPC Endpoint Mapper).
    * The server then negotiates random high-numbered TCP ports (49152 to 65535) for data callbacks. If the Windows Firewall on either machine blocks dynamic ports or lacks application exceptions for server_runtime.exe (Kepware) and CCClient.exe (WinCC), callback frames are silently dropped.

  4. OPC DA Callback Deadlocks:
    * OPC DA 2.05a and 3.0 utilize bi-directional callbacks: the client calls the server, and the server initiates an independent TCP connection back to the client to push tag changes. If the client PC has a strict firewall, the callback cannot connect.

Step-by-Step DCOM and OPC Troubleshooting Workflow

1. Isolate the Fault Using a Third-Party OPC Client

  1. Download and run a standalone diagnostic client (such as Matrikon OPC Explorer or OPC Foundation Sample Client) directly on the WinCC workstation.
  2. Attempt to connect to the remote Kepware server.
  3. If the diagnostic client also displays connection failure, the issue resides entirely within Windows DCOM and network firewall configuration.

2. Harmonize Windows User Accounts

  1. Ensure both the Kepware machine and WinCC station have an identical local user account (e.g. SimaticOperator).
  2. Assign the identical password to both accounts.
  3. Add this user to the local Administrators and Distributed COM Users groups on both computers.

3. Configure DCOM Security Settings (dcomcnfg)

  1. On both the Kepware PC and WinCC PC, press Win + R, type dcomcnfg, and press Enter.
  2. Navigate to Component Services > Computers > My Computer.
  3. Right-click My Computer and select Properties.
  4. In the Default Properties tab:
    * Verify Enable Distributed COM on this computer is checked.
    * Set Default Authentication Level to Connect.
    * Set Default Impersonation Level to Identify.
  5. In the COM Security tab:
    * Under Access Permissions, click Edit Limits...: Grant Remote Access to ANONYMOUS LOGON, Everyone, and Interactive.
    * Under Launch and Activation Permissions, click Edit Limits...: Grant Remote Launch and Remote Activation to Everyone and Interactive.

4. Configure Kepware DCOM Identity

  1. In dcomcnfg, expand DCOM Config.
  2. Locate KEPServerEX (or your specific Kepware version).
  3. Right-click, select Properties > Identity tab.
  4. Set Identity to The Interactive User (if running as a desktop app) or specify the dedicated shared service account.

5. Recommended Alternative: Migrate to OPC Unified Architecture (OPC UA)

To permanently eliminate DCOM complexity:
1. Enable the OPC UA Server interface inside Kepware (default port TCP 49320).
2. In WinCC Tag Management, add the OPC UA Channel (or use the OPC Channel configured for UA).
3. Connect using pure TCP/IP: opc.tcp://<Kepware-IP>:49320.
4. Exchange and trust digital certificates between WinCC and Kepware.

OPC DA vs OPC UA Architectural Comparison

Feature / CharacteristicOPC Data Access (OPC DA Classic)OPC Unified Architecture (OPC UA)Underlying ProtocolMicrosoft DCOM / RPCPure TCP/IP (opc.tcp://) or HTTPSPort ManagementTCP 135 + Dynamic High Ports (49152–65535)Single configurable static port (e.g. 4840 / 49320)Firewall FriendlinessHighly problematic; requires dynamic RPC exceptionsHighly firewall friendly; single port forwardingOperating System DependencyStrictly Microsoft Windows onlyCross-platform (Linux, Windows, Embedded)Security & EncryptionWindows DCOM Access ListsX.509 Digital Certificates, AES-128/256 EncryptionDiagnostic ReliabilityHigh failure rate due to OS security updatesExtremely robust; native auto-reconnect

Verification

  1. In WinCC Explorer, launch WinCC Channel Diagnosis (Channel Diagnosis Control).
  2. Open the OPC Channel tab; confirm the connection state displays Connected with green checkmarks.
  3. In WinCC Graphics Designer, launch Runtime.
  4. Verify that process variables from Kepware immediately display valid numerical values instead of ??? or blank spaces.
  5. Invert a test digital bit in Kepware; confirm the change updates on the WinCC screen in under 500 ms.

Limitations and Operational Precautions

  • DCOM Hardening Vulnerability: Microsoft Windows cumulative security updates enforce DCOM hardening (KB5004442). Overly permissive DCOM settings (such as granting full access to Everyone) violate industrial cybersecurity standards (IEC 62443).
  • Workgroup Security Fragility: Workgroup account synchronization breaks if password change policies are enforced on one machine and not the other. Domain environments are strongly recommended for multi-station architectures.
  • Licensing Requirements: Ensure appropriate Kepware driver licenses and WinCC communication channel licenses are verified with authorized distributors.

Engineer FAQ

Why did the configuration work on PCS 7 V8.0 but fail on PCS 7 V8.1?

PCS 7 V8.1 introduces stricter Windows Firewall rules and Security Controller DCOM access restrictions that block remote unauthenticated callbacks by default.

What does quality code 16#00 mean in WinCC Tag Management?

16#00 represents 'Bad, Non-Specific'. It indicates the channel cannot establish communication with the OPC server or the server cannot poll the underlying device.

Can WinCC V7.3 act as an OPC UA client natively?

Yes, WinCC V7.3 / PCS 7 V8.1 includes native support for OPC UA Client connections in the WinCC communication channel suite.

Technical References

Related Articles

Related Tags

  • OPC DA
  • Kepware
  • DCOM
  • WinCC V7.3
  • PCS 7 V8.1
  • OPC UA
6 respuestas