Simple sample - WinCC Unified PC Runtime - OPC Server

Hi,

As from TIA V17 it is possible to work with a WinCC Unified as OPC UA server for data and alarms (DA, A&C), both, in Runtime and HMI.

It is possible to use signed and encrypted communication and authentication of client.

Configuration steps:

General configuration:

1. TIA Portal, Project tree, HMI, Services: check the checkbox Operate as OPC Server.
2. TIA Portal, Project tree, Security settings, Users and role, create a user as usual but make sure that it has access to the runtime rights “OPC-UA- Read and write access” (as default the HMI Administrator has this rights). This user/password will be used by the client to access it (for example, UA Expert).

TIP:

• The OPC could be accessed by url opc.tcp://’PC name’: 4890
  • There are the follow options to access
  • Basic128Rsa15 Sign
  • Basic128Rsa15 SignAndEncrypt
  • Basic256 Sign
  • Basic256 SignAndEncrypt
  • Basic256Sha256 Sign
  • Basic256Sha256 SignAndEncrypt

(there is no option for “none” , that means, there is no open access)

(Sign means data packets are signed with the certificates but not encrypted; SignAndEncrypt means data packets are signed and encrypted with the certificates).

Certificate handling:

• On the server side, it is necessary to create certificates for the certificate authority, device and OPC server. This is done  WinCC Unified Certificate Manager (e.g., under C:\Program Files\Siemens\Autoation\WinCCUinfied\WebConfigurator\WinCC_CertManager.exe).
• The procedure is descripted in the FAQ “How do you create a certificate structure for the WinCC Unified V17 System so that other terminal devices can communicate encrypted with the Runtime?”https://support.industry.siemens.com/cs/br/en/view/109777591

Main steps:

1. Open WinCC Unified Certificate Manager (e.g., under C:\Program Files\Siemens\Autoation\WinCCUinfied\WebConfigurator\WinCC_CertManager.exe).
2. Click on “Create new certificate authority…”
3. Define the Certificate authority, including Livetime and Password.
4. Right mouse click on “Siemens Automation WinCC Unified Project CA”, Add new device
5. Fill name and IP address (The PC runtime name can be found in Control Panel, All Control Panel Items, System).
6. Right mouse click on the device certificate: “add OPC UA Server certificate…” fill the data and click in Create.
7. Right mouse click on the OPC UA server certificate, install.

For the first client’s access to the PC Runtime the steps are:

1. Start the OPC client and try to access the OPC Server: the connection will be refused, but it is expected at this point.
2. Open SIMATIC Runtime Manager and go to settings (gear icon), certificates tab.
3. Right mouse click on the client certificate and trust it.
4. The behavior of the client  is client dependent, but, e.g., it is necessary to retry reestablish the connection.

TIP:

• The client’s certificate is stored under C:\ProgramData\SCADAProjects\certstore

Sample program WinCC Unified as server and UAExpert as client project backup.