TIP - WinCC Unified PC Runtime - OPC Client

Hi,

As from TIA V17 it is possible to work with a WinCC Unified as OPC UA client for data acquisition (DA), both, in Runtime and HMI.

Now, it is also possible to use signed and encrypted communication and authentication (user and password) of client HMI.

Configuration steps:

To set the connections:

1. Project tree, HMI, Connections: <add new>,
2. Set “Communication driver” as OPC UA
3. In “Parameters” tab:
4. Either gives the URL in “OPC UA Server” (e.g., opc.tcp://’PC name’:’port’) or browse it in “Select OPC Server”
5. If you will use user and password, uncheck he “Anonymous” checkbox and give the “User name” and “Password”
6. Set “Security Policy” and ‘Message security’ mode  as desired.

TIP:

There are the follow options to access (Sign means data packets are signed with the certificates but not encrypted; SignAndEncrypt means data packets are signed and encrypted with the certificates):

• Security Policy” = None, ‘Message security’ = none
• Security Policy” = Basic128Rsa15, ‘Message security’ = Sign
• Security Policy” = Basic128Rsa15, ‘Message security’ = SignAndEncrypt
• Security Policy” = Basic256, ‘Message security’ = Sign
• Security Policy” = Basic256, ‘Message security’ = SignAndEncryp
• Security Policy” = Basic256Sha256, ‘Message security’ = Sign
• Security Policy” = Basic256Sha256, ‘Message security’ = SignAndEncrypt

To tag configuration:

1. Project tree, HMI, HMI Tags, open the tag table, <add new Tag>
2. In Address, either type manually the tag address or click on the combobox button and browse the variable on the server

For Certificate handling:

 If you set something different as none for “Security Policy” and ‘Message security’, it would be necessary to work with certificates.

TIP:

• If you intend to work with certificates, this also applies to engineering.
• You can create the client’s certificates in WinCC Unified Certificate Manager (e.g., under C:\Program Files\Siemens\Autoation\WinCCUinfied\WebConfigurator\WinCC_CertManager.exe).
• Procedure details could be found in the FAQ “How do you create a certificate structure for the WinCC Unified V17 System so that other terminal devices can communicate encrypted with the Runtime?”https://support.industry.siemens.com/cs/br/en/view/109777591

Main steps:

1. Open WinCC Unified Certificate Manager (e.g., under C:\Program Files\Siemens\Autoation\WinCCUinfied\WebConfigurator\WinCC_CertManager.exe).
2. Click on “Create new certificate authority…”
3. Define the Certificate authority, including Livetime and Password.
4. Right mouse click on “Siemens Automation WinCC Unified Project CA”, Add new device
5. Fill name and IP address (The PC runtime name can be found in Control Panel, All Control Panel Items, System).
6. Right mouse click on the device certificate: “add OPC UA Client certificate…” fill the data and click in Create.
7. Right mouse click on the OPC UA server certificate, install.

For the first engineering station /client’s access to the PC Runtime the steps are:

1. Start theengineering station /OPC client and try to access the OPC Server: the connection will be refused, but it is expected at this point.
2. Open SIMATIC Runtime Manager and go to settings (gear icon), certificates tab.
3. Right mouse click on the client certificate and trust it.
4. Try to connect again.

TIP:

• The server’s certificate is stored under C:\ProgramData\SCADAProjects\certstore
• How the server will import and accept the WinCC Unified’s certificate depends on the server. Consult the server supplier’s support regarding this.