Configuring WinCC Communication with IM 151-8 PN/DP CPU

System Overview and Architecture

The ET200S is a modular, distributed I/O station from the SIMATIC family. The IM 151-8 PN/DP is the variant that integrates an intelligent CPU (order number 6ES7151-8AB00-0AB0 or the later 6ES7151-8AB01-0AB0 / 6ES7151-8FB00-0AB0 fail-safe variant) into the ET200S head station, exposing both a PROFINET interface and a PROFIBUS-DP master/slave interface on a single module. When the IM 151-8 acts as the controller for its own backplane, it presents itself to supervisory software as a standalone S7 CPU on the network — not as a passive I/O device. WinCC (classic, pre-TIA Portal) and the WinCC Channel "SIMATIC S7 PROTOCOL SUITE" use the S7 communication layer (BSEND/BRECV or PUT/GET) over ISO-on-TCP (RFC1006, port 102) to exchange process data with the CPU.

Communication path:

Prerequisites

Before configuring the connection, confirm the following components and versions are installed on the engineering/runtime PC and that the PLC is reachable on the network.

STEP 7 Hardware Configuration of the IM 151-8

1. Open SIMATIC Manager and create a new STEP 7 V5.x project.
2. Insert a SIMATIC 300 station (the IM 151-8 is configured with the S7-300 hardware catalog > ET200S > IM 151-8 PN/DP CPU).
3. Open HW Config and place the IM 151-8 in slot 2 of rack 0. The power module (PM-E) occupies slot 0; the IM 151-8 must be at slot 2 — this is the rack/slot pair WinCC will reference.
4. Double-click the IM 151-8 and assign the PROFINET interface an IP address that matches the physical PLC. Subnet mask 255.255.255.0 is typical. If a router is used, fill the router field.
5. Save and compile (Station > Save and Compile). Download the hardware configuration to the PLC (PLC > Download to Target).
6. In the NetPro view, no S7 connection is strictly required for WinCC communication, but if you want a configured connection, add an S7 connection to the partner PC station.

WinCC Project — Configuring the S7 Channel

WinCC's "SIMATIC S7 PROTOCOL SUITE" is the driver for native S7 communication. Add it to the tag management before creating any tags.

1. Open the WinCC Explorer and expand Tag Management.
2. Right-click Tag Management > Add New Driver > select SIMATIC S7 PROTOCOL SUITE > Open.
3. The driver appears with its logical connections: MPI, PROFIBUS, TCP/IP, Industrial Ethernet (ISO), Named Connections. For the IM 151-8 PROFINET interface, use TCP/IP (do not pick TCP/IP (Auto) — see the next section).
4. Right-click TCP/IP > New Connection. A new connection named NewConnection_1 appears.
5. Right-click the new connection > Connection Parameters. Configure the dialog as shown below.

Simatic Net and PG/PC Interface

The WinCC S7 channel does not talk to the network adapter directly — it talks to a logical device name that is mapped to a physical interface through the Set PG/PC Interface tool (the SIMATIC Shell / Configuration Console in newer releases). Three configuration paths are commonly used.

• Softnet on the standard Intel NIC: Apply in installations where no Siemens CP is present. The PC's LAN card becomes the S7 endpoint.
• CP 1612 / CP 1623 / CP 1628: A Siemens PROFINET ASIC card with its own NDIS driver. Use this for deterministic / IRT applications.
• Softnet IE (RFC1006): The most common setup for IM 151-8 connections.

Configure the access point:

1. Open Windows Control Panel > Set PG/PC Interface (32-bit) or SIMATIC Configuration Console (64-bit).
2. Access Point of Application: select S7ONLINE.
3. Interface Parameter Assignment Used: choose the LAN card or CP that connects to the IM 151-8 PROFINET network.
4. Properties > confirm IP address of the PC is in the same subnet as the PLC.
5. Click OK and close. WinCC will use this assignment when the project starts.

Logical Device Name and System Parameters

Inside WinCC Explorer > TCP/IP > System Parameters > Unit tab, the Logical device name field must point to the same access point used by SIMATIC Manager (S7ONLINE). If this field is left blank or set to a non-existent name, the runtime connection establishes briefly then drops.

Typical configuration:

• Logical device name: TCPIP -> Network card name (displayed as the friendly name of the bound NIC)
• If a Siemens CP is used, the logical device name is the CP's instance (e.g. CP1612.S7ONLINE).

Adding Tags and Testing the Connection

1. Right-click the connection (NewConnection_1) > New Tag.
2. Name the tag, choose data type (Binary, Word, etc.), and enter the PLC address in the form DBx.DBBy, Ix.y, Qx.y, or MWz as used in the STEP 7 program.
3. Repeat for every SCADA point that the HMI must read or write.
4. Open Graphics Designer, drop an I/O Field onto a screen, and link it to the new tag.
5. Save the project. Activate WinCC Runtime. The connection icon in the bottom status bar should turn green.

Channel Diagnosis — Reading Error Codes

When communication fails, the first diagnostic tool to run is the Channel Diagnosis utility, shipped with WinCC. The tool surfaces both the first and last error code emitted by the S7 channel, which can be cross-referenced against Siemens knowledge base entries.

Access path in WinCC Explorer:

1. Right-click TCP/IP > Channel Diagnosis.
2. Click Test for the connection in question.
3. Record both the first error code and the last error code.

Cross-reference these codes against the official Siemens Industry Online Support portal:

• Siemens Industry Online Support — search entry IDs 6749787 (WinCC channel error codes) and 8854589 (S7-300/ET200S connection troubleshooting).
• WinCC — Error codes of the S7 channel

The "Send/Receive Raw Data" Pitfall

A common intermittent symptom reported by integrators: the project appears to start cleanly, no error is shown in Runtime, and the tag icons turn green — yet no values update. The PLC is reachable (a ping succeeds), and the simulator test in WinCC fails with a clean "no connection can be established between CPU and PC" error. Once the actual PLC is targeted, WinCC no longer reports a connection error and silently shows stale data.

The culprit is almost always the Send/Receive Raw Data checkbox on the connection's properties dialog. When this is left enabled, the S7 channel attempts to use raw data block services (BSEND/BRECV) rather than the standard PUT/GET path. The IM 151-8 firmware tolerates the request but does not service it reliably without an explicit S7 connection configured in NetPro, leaving the channel waiting indefinitely.

Resolution:

1. Open Connection Parameters on the affected TCP/IP connection.
2. Uncheck Send/Receive Raw Data.
3. Save the project and restart WinCC Runtime.

Tags should now update within one configured acquisition cycle (default 1 s).

Pushbutton Colour Issue with VBS Tag Assignments

After connectivity is restored, a residual symptom sometimes appears: a screen button that should display the standard light-grey Windows-style background renders in a solid blue colour and never repaints. This is a WinCC Graphics Designer configuration issue, not a communication fault. Two causes are typical.

Cause 1 — VBS script writing to the button's BackColor property on every cycle: if a script bound to the button or to a screen-wide event assigns a color to HmiRuntime.Screens("Main").Items("Btn_1").BackColor, the value will be re-applied continuously and override the configured style. Wrap the assignment in a condition that only fires on state change.

Cause 2 — Global color scheme (design) override: if a VBS action modifies Screen Items properties at load time using RGB() with a blue-dominant triple (e.g. RGB(0, 0, 255)), the button keeps the applied tint for the rest of the session. Replace with vbWhite, vbButtonFace, or a project-design color constant.

Reference snippet for color reset (paste into the button's Property > BackColor > Dynamic > Direct dialog):

Verification Procedure

After applying the configuration above, perform the following checks in order. Each step is fast and confirms a specific layer of the stack.

1. Layer-3 reachability: from a command prompt on the SCADA PC, run ping 192.168.0.10 (substitute the IM 151-8 IP). Expect 0% packet loss, < 1 ms latency on a copper link.
2. TCP 102 reachability: use telnet 192.168.0.10 102 or PowerShell Test-NetConnection -Port 102. A blank screen or TcpTestSucceeded : True confirms the port is open and the S7 server on the CPU is listening.
3. STEP 7 online access: in SIMATIC Manager > PLC > Accessible Nodes, the IM 151-8 must appear with its MAC and IP. If not, the network path is broken before the S7 driver is even involved.
4. WinCC Channel Diagnosis: start the tool, click Test. The status should read Connection OK with error codes 0x0000.
5. Runtime tag update: insert a tag with a known counter (e.g. MW10) in a STEP 7 OB1 increment block, display it in an I/O Field. Trigger the increment and watch the value change in WinCC.

Troubleshooting Matrix

Hardware Catalogue Reference (6ES7151-8…)

Confirm the exact order number in your hardware configuration; the rack/slot convention (rack 0, slot 2) is identical across all variants, but the maximum number of S7 communication connections scales with the firmware version — V3.x supports up to 16, while V2.x firmware supports 8.

Migration Note to TIA Portal / WinCC Unified

Projects built on the classic WinCC V7.x S7 channel can be migrated to WinCC Unified in the TIA Portal using a step-by-step conversion. During migration, the S7 channel is replaced by the integrated S7 driver in the HMI device, and the connection parameters are re-imported from the TIA Portal project. The rack/slot convention for the IM 151-8 remains the same in the new environment, but PROFINET device names must be unique within the IO controller — a constraint that did not exist in the old SIMATIC Manager world. When planning a migration, export the STEP 7 V5.x project as a TIA Portal V16+ migration file first, then re-assign the PROFINET device name to the migrated IM 151-8 node.

Field-Commissioning Checklist

1. PLC IP set, pingable from the SCADA PC.
2. SIMATIC Manager project downloaded, CPU in RUN with no SF/BF LEDs lit.
3. WinCC V7.x installed, SIMATIC S7 PROTOCOL SUITE driver added.
4. SIMATIC NET present, S7ONLINE bound to the correct NIC.
5. Connection parameters: IP, rack 0, slot 2, Send/Receive Raw Data unchecked.
6. Channel Diagnosis reports OK.
7. Sample I/O Field shows a live value.
8. Any VBS color scripts audited to avoid solid blue button artefacts.