What is WinCC?
WinCC is the Siemens software for process visualisation and operation that runs as an HMI on machine panels and as a SCADA system on servers, letting operators control the process, handle alarms, view trends and record process data. First released in 1996, it has grown into a family: the classic WinCC V7/V8 for SCADA, the HMI editions in TIA Portal, the web-based WinCC Unified and the highly scalable WinCC Open Architecture (OA). WinCC is widely used in industrial automation and process automation, and it also forms the Operator Station of the PCS 7 DCS. Because it is the link between PLCs and higher-level systems such as MES and historians, WinCC is a core part of many OT architectures and therefore also an attractive target for attackers.
🧱 Which WinCC variants are there?
The WinCC name covers four product lines, each with its own technology. In practice this causes confusion, for example between “WinCC Professional” in TIA Portal and the standalone WinCC V7/V8.
| Variant | Technology and engineering | Typical application |
|---|---|---|
| WinCC V7 / V8 (classic) | Standalone engineering environment (Graphics Designer), VBScript and ANSI-C, logging in Microsoft SQL Server | Plant-wide and process-wide SCADA, basis of the PCS 7 Operator Station |
| WinCC in TIA Portal (Basic, Comfort, Advanced, Professional) | Engineering editions within TIA Portal, tags shared with the SIMATIC PLC | Basic for Basic Panels, Comfort for Comfort Panels, Advanced for PC runtime, Professional for SCADA runtime |
| WinCC Unified | Since TIA Portal V16 (2019); runtime built on HTML5, SVG and JavaScript | New generation of panels (Unified Comfort/Basic) and PC or server runtime with web clients |
| WinCC Open Architecture (OA) | Originally PVSS by ETM (Eisenstadt, Austria), a Siemens subsidiary since 2007, renamed in 2010 | Large distributed systems: energy, water, traffic, oil and gas, research |
The classic WinCC V8.0 was released in March 2023 and is, among other things, the basis of PCS 7 V10.0. Projects from V7.2 onwards can be moved straight to V8.1. Siemens focuses further innovation in visualisation mainly on WinCC Unified, while WinCC OA follows its own development line.
🔧 How does WinCC work technically?
A WinCC system consists of an engineering part, in which you configure screens, tags, alarms and archives, and a runtime that executes the project. The runtime reads and writes process variables in the controller through communication channels (drivers) and shows them in process screens.
The main building blocks are:
- Process screens - graphical representations of the plant with dynamic objects, in Unified as scalable SVG graphics
- Alarm logging - messages with priority, class, acknowledgement and history, set up according to alarm management principles such as ISA-18.2
- Tag logging - archiving of process values and setpoints for trending and analysis
- Scripting - VBScript and ANSI-C in classic WinCC, JavaScript in WinCC Unified
- User management - roles and permissions, in Unified also linked to central user administration
- Reporting - shift, batch and alarm reports, designed in classic WinCC with the Report Designer
Which options and licences does classic WinCC have?
Classic WinCC V7/V8 runtime is licensed by PowerTags: process variables that communicate with the controller. The packages step up from 128 to 512, 2,048, 8,192, 65,536 and 102,400 PowerTags and finally unlimited, and an undersized package is a familiar surprise when a plant is extended. Many functions come as separate options with their own licence:
| Option | Function |
|---|---|
| WinCC/Redundancy | Two coupled servers that take over from each other and synchronise archives |
| WinCC/User Archives | Tabular data such as recipes, order data and parameter sets |
| WinCC/WebNavigator and WebUX | Operation and monitoring through a web client or browser, with their own client licences |
| WinCC/ProDiag | Machine and process diagnostics: why a step or movement has stopped |
| WinCC/Audit | Audit trail of operator actions and changes, for example in regulated pharmaceutical production |
Which protocols does WinCC support?
| Protocol | Role in WinCC |
|---|---|
| S7 Comm / S7 Comm Plus | Standard connection to SIMATIC S7 controllers, with secured communication on the S7-1500 |
| ProfiNET | Industrial Ethernet that carries the S7 connection to the controller |
| OPC UA | Vendor-neutral link as client and server, for example to MES and historians |
| Modbus TCP | Connection to equipment from other vendors |
| MQTT | Through additional connectivity options or an edge gateway for IIoT and cloud |
| TCP / UDP | Transport layer beneath the protocols above |
🏭 Where is WinCC used?
WinCC is found in discrete manufacturing as well as continuous and batch processes. Typical environments are production lines in manufacturing, chemicals and pharmaceuticals, food and beverage (batch visualisation), wastewater and drinking water treatment (pumping stations and treatment stages), power generation and building automation. WinCC OA is also used for tunnel control, traffic management, high-voltage grids and large research facilities, where hundreds of thousands of data points are spread across several sites.
In the Purdue Model, WinCC sits at level 2 (supervision and operation). A WinCC panel is often mounted directly at the machine, while WinCC servers run in a separate supervisory zone and pass data via OPC UA or a database interface to MES, historians and ERP at level 3 and above. In this way WinCC supplies the real-time data on which Industry 4.0 applications such as Industrial AI and predictive maintenance build.
⚡ How does WinCC handle redundancy and availability?
For critical infrastructure, loss of the operating layer is not an option. Classic WinCC offers the WinCC/Redundancy option, in which two coupled servers take over from each other and synchronise their archives. Since TIA Portal V20 there is also a redundancy option for WinCC Unified PC runtimes; it requires historical data to be stored in Microsoft SQL Server rather than SQLite. WinCC OA was designed from the start around distributed, redundant servers across multiple sites.
| Measure | Purpose |
|---|---|
| Redundant server pair | Operation stays available if one server fails |
| Archive synchronisation | No gaps in alarm and trend history |
| Redundant network (ring) | Continuity during a cable or switch failure |
| Client failover | Operator stations switch over automatically |
| Virtualisation | Faster recovery and simpler server management |
See also Redundancy and High Availability for the general principles.
🛡️ What role does WinCC play in safety?
WinCC displays safety states, emergency shutdown messages, safety alarms and PROFIsafe diagnostics, but it does not perform a safety function itself. The safety function belongs in a safety PLC or SIS designed according to IEC 61508, IEC 61511 (process industry) or ISO 13849 (machinery). An emergency stop or trip must therefore never depend on a WinCC screen or script.
🔐 What cybersecurity risks come with WinCC?
WinCC runs on Windows and an SQL database, so it combines IT vulnerabilities with direct access to the process. The best-known example is Stuxnet: in 2010 the worm exploited a hard-coded password for WinCC’s SQL Server database (CVE-2010-2772, CVSS 3.1 score 7.8) as part of its attack on S7 controllers. Meanwhile, operators saw normal values on their screens.
Typical risks are unauthorised access to operator and engineering stations, ransomware on Windows servers, abuse of remote access, manipulation of historical data and outdated, unpatched installations. The consequences range from production downtime to loss of view of the process, with possible safety risks.
| Measure | Purpose |
|---|---|
| Network Segmentation | WinCC servers in their own zone, only necessary connections allowed |
| MFA and roles | Strong authentication, especially for engineering and remote access |
| Application Whitelisting | Only approved software on operator and server stations |
| Logging | Audit trail of operator actions, changes and logins |
| Patch Management | Windows and WinCC updates after compatibility testing |
| Backup | Recoverable projects, archives and system images |
| Jump Server | Controlled remote access instead of direct connections |
Siemens publishes vulnerabilities through ProductCERT security advisories. Base your security on IEC 62443 and treat the engineering station as a crown jewel. For Dutch organisations that fall under the Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026), demonstrable management of such SCADA systems is part of the duty of care.
🧪 How do you approach a WinCC project or migration in practice?
Many installations still run WinCC V7.x or older TIA runtimes. A structured approach avoids surprises:
- Take inventory of versions, options, licences (WinCC V7/V8 is licensed by the number of PowerTags; check that the package covers the planned extension) and operating systems. Use the Siemens compatibility tool to check which combinations are supported.
- Choose the target platform - stay on the classic line (direct upgrade from V7.2 to V8.1) or migrate to WinCC Unified, which often means rebuilding screens and rewriting VBScript/C scripts in JavaScript.
- Watch the Windows limits - on Windows 10 and 11, WinCC V8 allows at most three client connections per server-client system; larger systems need Windows Server 2019 or 2022.
- Standardise with libraries, faceplates and naming conventions, and follow ISA-101 for effective, calm operator screens.
- Test in an OTAP (DTAP) pipeline or with virtual commissioning, followed by a FAT and SAT.
- Secure the lifecycle - plan updates, backups and replacement ahead as part of lifecycle management, so that no legacy system emerges.
⚖️ What are the pros and cons of WinCC?
| Advantages | Disadvantages |
|---|---|
| Deep integration with SIMATIC PLCs and TIA Portal | Strong tie to the Siemens ecosystem (vendor lock-in) |
| Scales from panel to distributed SCADA | Four product lines with different technology and licensing |
| Extensive alarm, archiving and diagnostic functions | Migrations between generations require significant re-engineering |
| Web-based operation with WinCC Unified | Windows and SQL foundation demands intensive patch and security management |
❓ Frequently asked questions
Is WinCC an HMI or a SCADA system?
WinCC is both. On machine panels WinCC acts as a local HMI, while WinCC V7/V8, WinCC Professional, the WinCC Unified PC runtime and WinCC OA work as SCADA systems that monitor and archive several installations centrally.
What is the difference between WinCC V8 and WinCC Unified?
WinCC V8 is the classic SCADA line with its own engineering environment, VBScript/ANSI-C scripting and Microsoft SQL Server archives. WinCC Unified is configured in TIA Portal, uses HTML5, SVG and JavaScript, and is intended as the new generation for both panels and PC systems.
What is WinCC OA?
WinCC Open Architecture is a separate SCADA platform that was originally called PVSS and was developed by the Austrian company ETM. Siemens fully acquired ETM in 2007 and renamed PVSS to WinCC OA in 2010; it is mainly used for very large, distributed systems in energy, water and traffic.
How was WinCC involved in Stuxnet?
In 2010 Stuxnet exploited a hard-coded database password in Siemens WinCC (CVE-2010-2772) as part of its attack on S7 controllers. The incident showed that SCADA software is itself an attack vector and that WinCC environments must be segmented and hardened.
Does WinCC replace a safety system?
No, WinCC only visualises safety states and alarms. The safety function itself belongs in a safety PLC or SIS that complies with IEC 61508, IEC 61511 or ISO 13849.
Which standards are relevant for securing WinCC?
The most important standard for securing WinCC environments is IEC 62443, with zones and conduits, security levels and requirements for suppliers and components. In addition, ISA-18.2 and ISA-101 give guidance on alarm management and operator screens.
📌 In summary
WinCC is Siemens’ visualisation and SCADA family, from machine panel to distributed control system, comprising the classic WinCC V7/V8, the TIA Portal editions, the web-based WinCC Unified and WinCC OA. It connects SIMATIC controllers to operators and higher-level IT systems, and therefore calls for a careful choice of variant, redundancy where needed and security based on IEC 62443.
WinCC is the operator’s window on the process: choose the right variant, make it redundant where needed and secure it as a critical OT system.