Patch Release Notes 3.21

Web Server

• The built-in web server can now be extended with custom endpoints at runtime without requiring a restart. This enables customers to add or modify REST APIs on a running system, reducing downtime for web-based integrations.

Driver

• DNP3: The DNP3 driver now supports automatic polling of data classes without manual scripting, which creates more reliable data acquisition with less configuration effort in utility/SCADA environments.

Video OA

• Camera network interface priorities can now be configured via mass configuration. Customers managing large camera installations can efficiently set failover preferences across hundreds of devices in one operation.

NGA

• NGA database upgrade scripts have been adapted to ensure a smooth backend project upgrade process, helping users upgrading from earlier versions to minimize manual database intervention during migration.

Node.js

• The dpRename() function is now available in the Node.js API.
• A new npm package scaffolds TypeScript manager projects with proper structure and configuration.

CTRL

• WinCC OA now supports secure file transfers via SFTP, eliminating the need for less secure FTP or external tooling.

System Dashboard

• The System Dashboard now displays the security status of the pathTraversalRestricted config, allowing customers immediate visibility into whether their system is protected against directory traversal attacks.

General

• System names can now be referenced via a placeholder variable. Customers benefit from easier project templating and configuration reuse across multiple installations without manual renaming.
• The API client, WCD, and Angular Dashboard have been updated to newer versions.

WebUI Runtime – Bridging OT and IT with a Centralized Runtime

Today's industrial systems must reconcile two fundamentally different paradigms:

• Operational Technology (OT) prioritizes stability, reliability, and long lifecycles
• Information Technology (IT) focuses on agility, security, and continuous evolution

Traditionally, solutions have attempted to connect both worlds at the interface level. However, true integration requires more than combining features — it demands a shared foundation designed to support both approaches simultaneously.

With the latest WinCC OA release, the WebUI Runtime introduces exactly that: a convergence layer that enables OT and IT to operate together without compromise.

Built as a server-side runtime with a thin browser client, it provides:

• Centralized execution with zero-install deployment
• Web-native communication mechanisms for real-time interaction
• Integrated support for industrial protocols and modern identity management
• A consistent runtime from edge to cloud environments

By combining web technologies with industrial system requirements, the WebUI Runtime establishes a scalable and secure foundation for modern industrial applications.

See WebUI Runtime for details.

Alarm Shelving and Suppression (IEC 62682)

WinCC OA now provides alarm shelving and suppression capabilities based on IEC 62682 / ISA 18.2 standards. The new AlertService enables three complementary alarm management mechanisms:

• Alarm Shelving: Operators can temporarily hide individual alert instances from the active alert list. A configurable timer automatically restores shelved alerts after the shelving period expires.
• Suppression by Design: Engineers can suppress alert handler configurations at the datapoint level to prevent alert generation during commissioning or planned maintenance.
• Out-of-Service Mode: Datapoint elements can be placed into maintenance mode by swapping alert classes to dedicated maintenance counterparts (alarm-maint, warning-maint, info-maint). Alerts continue to be generated but are visually distinguished and excluded from operational KPIs.

All actions are logged as Security Events and provide a complete audit trail. Dedicated overview panels for shelved alerts, suppressed handlers, and out-of-service objects are accessible from the Alert Event Screen.

See Alarm shelving and suppression overview for details.

CTRL

• New AlertService functions: AlertServiceClient::shelveAlerts(), AlertServiceClient::suppressAlerts(), AlertServiceClient::setOutOfService() and their corresponding reverse operations.

Disaster Recovery System

• DRS project file synchronization now uses a network share instead of shared project folders, improving security. The synchronization reuses the export path configured in the DRS wizard (Step 4) and automatically creates the subdirectories FileSync and SubFileSync on the network share. This eliminates the need for individual projects to access other project folder structures. See Configuration - Step 5 - Project File Synchronization.

UI

• VarTrend: Configurable downsampling is now available for NGA projects, improving data visualization performance.
• Automatic _MemoryCheck threshold calculation now adapts dynamically to the target system hardware.

Drivers

• Modbus: The driver now supports the Output Single direction, allowing a single bit to be written to a register while all other bits are set to 0.

Northbound Manager

• Sparkplug B: The protocol now supports a configurable MQTT keep-alive timeout through the mqttkeepalive parameter in <nbm_instance>.Config.Protocol (default: 60 seconds).

Security & Authentication

• OIDC Authentication: Mobile and Desktop UIs now send only minimal information to the HTTP server during authentication, reducing exposure.
• Private Key Storage: CNG-based certificates are now supported in the web server on Windows.

Drivers

• SNMP: The config entry enableTraps can now restrict trap handling through numeric values. The legacy string values Yes and No remain supported to ensure backward compatibility.
• DNP3: The DNP3 driver now automatically performs a general query for unsolicited requests after a redundancy switchover.
• S7: The S7 driver now supports transforming S5Time to UINT, featuring the new transformation type S5TimeAsMilliseconds.
• The new SECS/GEM Gateway manager is available in WinCC OA 3.21 now

Northbound Manager

• The Northbound Manager now supports Distributed Systems. Data from remote WinCC OA systems can be published through the Northbound Interface using Plantmodel data sources. The option Incl. system name in metric name allows you to prefix metric names with the source system name, which helps to distinguish datapoints from different systems.
• The Northbound Manager now also supports the publishing of Quality data.

Manager Service API

• RPC messaging now supports encrypted payloads for the Manager Service API.

NGA

• When using NGA with a PostgreSQL® backend, DPE descriptions and units can now be stored for each value change.
• NGA command elements no longer store last values by default, reducing unnecessary storage overhead.
• The database-specific entries "backend.storeCommentsPerValue" and "backend.storeUnitsPerValue" now support dynamic data types. You can now also query for comments containing NULL or empty strings (e.g. WHERE _COMMENT=NULL).

CTRL

• Refactored the sendMail() function with improved error messages and additional parameters.

UI

• The License Management panel has been improved with new capabilities.
• Various DP Groups Check panel functions have been enhanced.
• A search button for filtering and double click navigation was added in the Console's Manager Properties panel.

Platform & Infrastructure

• The Qt version has been upgraded to 6.8.6
• The included Node-RED version has been updated to 4.1.5.
• The included PM2 version has been updated to 6.0.14.
• The vimacc version has been updated to 2.2.14.12.
• The API for the WinCC OA JavaScript Manager for Node.js was updated to version 2.3.10.

Northbound Manager: Distributed System Support

The Northbound Manager now supports Distributed systems for the Plantmodel (CNS) data source. Data from remote WinCC OA systems can be published through the Northbound Interface using the Plantmodel data source. The option Incl. system name in metric name allows you to prefix metric names with the source system name to distinguish datapoints from different systems.

SNMP

The config entry [snmpdrv] enableTraps now supports numeric values to control which trap versions are accepted. The legacy string values "Yes" and "No" remain supported for backward compatibility.

Northbound Manager: Quality Mapping

The Northbound Manager now supports quality mapping for Sparkplug B data publishing. The WinCC OA _invalid attribute is mapped to the Sparkplug B quality property, propagating data validity information to Sparkplug B consumers. Quality mapping can be enabled per data source using the "usequalitymapping" configuration option. See Quality Mapping.

UI

The function fillSvgElement() can now also be used for push buttons in the Qt UI.

GEDI

The Search Window now provides a new option to limit the search to open files only. Additionally, a "Case Sensitive" option has been added.

OPC UA

The OPC UA Server now supports Views as well as Dynamic Alarm Texts.

Drivers

• Support for the new OCPP driver has been added.
• DNP3 Driver: File Transfer is now supported.

SQL Queries

When querying data points, specifying only a data point name (without a root data point element) will now automatically include all sub-elements.