Configuring WinCC to Monitor Multiple S7-1200 PLCs via SIMATIC NET

Engineers scaling a small machine network to nine or more S7-1200 CPUs frequently discover that WinCC (WinCC RT Professional, WinCC Flexible, or WinCC Unified) cannot service every PLC directly through native S7 connections. This article documents the standard Siemens architecture, the connection-capability boundary, the role of SIMATIC NET PC Software as an OPC server, and the certificate handling required for WinCC Unified V21 secure communication. Use this reference when consolidating a line of 4–16 S7-1200 stations behind a single HMI/SCADA PC.

1. System Overview and Connection Model

WinCC supports two principal paths for talking to S7-1200 CPUs:

• Native S7 channel (S7MAX, S7-MAX, or the SIMATIC S7-1200/S7-1500 channel in WinCC Unified) - direct TCP/ISO-on-TCP communication from the WinCC station to the PLC. Fastest path, but limited by the connection count supported by the WinCC runtime.
• OPC DA / OPC UA channel with SIMATIC NET OPC Server acting as the data broker. The OPC server holds the S7 connections and exposes a consolidated tag namespace to WinCC.

For four to eight S7-1200 stations, the native S7 channel is acceptable. For nine or more CPUs, or any deployment that mixes S7-1200, S7-1500, S7-300/400, and third-party devices, the SIMATIC NET OPC Server topology is the supported path.

2. Prerequisites

Before commissioning, verify the following:

1. Engineering software - TIA Portal V18 or later. WinCC Unified V21 documentation targets TIA Portal V21. Earlier TIA Portal versions (V16/V17) support WinCC RT Professional and WinCC Unified V17 with the same connection model.
2. Runtime software - WinCC RT Professional, WinCC RT Advanced, or WinCC Unified PC RT, installed on the HMI/SCADA PC. License key (RT) for the runtime must be active.
3. SIMATIC NET PC Software - V18 or V21, matching the TIA Portal version. Required for OPC server operation beyond eight S7 connections.
4. S7-1200 firmware - V4.4 or later for TIA Portal V18; V4.5+ recommended for V21. CPU types 1211C through 1215C have one PROFINET interface; 1217C and 1215FC have two PROFINET interfaces usable for HMI traffic separation.
5. Network - Managed industrial Ethernet switch (SCALANCE XC-200/XB-200/XR-500 family recommended). Each S7-1200 station gets a unique IP in the same subnet (commonly 192.168.0.0/24).
6. User rights - Local administrator on the WinCC PC for SIMATIC NET configuration and certificate installation.

3. Reference Network Topology

The standard Siemens-recommended topology for nine S7-1200 CPUs uses two cascaded switches:

The cascaded switch approach is a deliberate Siemens recommendation: it keeps the HMI/engineering traffic on a separate broadcast domain from field I/O networks and lets you trunk the inter-switch link with port priority for HMI traffic.

4. The 8-Connection Boundary in WinCC

WinCC Runtime Professional and WinCC Unified V17/V21, when used with the native SIMATIC S7-1200/S7-1500 channel (channel name SIMATIC S7-1200/S7-1500), allow a maximum of 8 S7 connections per HMI station in the default licensed configuration. The boundary is enforced by the channel DLL (S7CHN.dll) and is independent of PLC type.

When a ninth S7 connection is configured, the WinCC runtime returns error 0xE0FF4001 ("Maximum number of S7 connections exceeded") and refuses to bring the channel online. OPC channels do not carry this constraint because the OPC server, not WinCC, terminates the S7 protocol.

5. Configuring SIMATIC NET as the OPC Server

5.1 PC Station in TIA Portal

1. Open the TIA Portal project that contains the S7-1200 stations.
2. Insert a new device: PC station > SIMATIC PC Station. Use a name that matches the host PC (e.g. HMI_PC_LINE1).
3. Add an IE General module in slot 1 of the PC station. Assign the same PROFINET interface name as the OS adapter that will be used at runtime (commonly the Intel I219-V or I225-V on-board NIC).
4. Drag an OPC Server application onto the PC station. The OPC Server slot is automatically configured as index 2.
5. Switch to the Network view, connect the OPC Server's PROFINET interface to the same subnet as the S7-1200 CPUs.

5.2 S7 Connection Configuration

1. Right-click the OPC Server > Properties > S7 connections.
2. Click Add new S7 connection for each S7-1200 CPU. Set the partner IP to the CPU's PROFINET address (e.g. 192.168.0.101).
3. Leave the Connection type as S7 connection (ISO-on-TCP, port 102).
4. In the Connection resources tab, the partner's local connection resource is the S7-1200's PROFINET interface. The partner's TSAP defaults to 01.01 (slot 1, rack 0). For S7-1200, the default TSAP is 03.01 for an unspecified slot; verify against the CPU's Properties > PROFINET interface > Ethernet addresses.

5.3 Compile and Download the PC Station

1. Select the PC station > Compile > Hardware (complete recompile).
2. Right-click the OPC Server > Download to target device > PC station. The TIA Portal deploys the PC station configuration to C:\ProgramData\Siemens\Automation\PCStation\<stationname>.
3. On the WinCC PC, open SIMATIC NET Configuration Console (Start > Siemens Automation > SIMATIC NET). The newly compiled configuration should appear in the station editor.
4. Start the S7ONLINE service and the OPC Server service. Use net start s7oie_sx64 from an elevated command prompt as an alternative.

6. Tag Mapping with OPC Scout V10

OPC Scout V10 is shipped with SIMATIC NET and is the primary tool for creating DA items on the OPC server. The TIA Portal project only handles the connection; the tag items must be added in OPC Scout for the OPC client (WinCC) to read or write PLC memory.

1. Launch OPC Scout V10 (Start > Siemens Automation > OPC Scout V10).
2. Add a new OPC DA server: OPC.SimaticNET.1. This is the ProgID of the SIMATIC NET OPC DA 3.0 server.
3. Navigate to the S7 connection you created (e.g. S7:[HMI_PC_LINE1]PLC1) and right-click > Add Item.
4. Define the tag using the S7 address syntax. For a DB word at DB10.DBW0 on PLC1:

Where:

• S7:[...] - OPC server prefix and station/connection name
• DB10 - Data block number
• W0 - Word offset, even-aligned
• 1 - Length in words (1 = 16 bits, 2 = 32 bits, etc.)

7. WinCC Configuration (RT Professional)

7.1 Add the OPC DA Channel

1. Open the WinCC project in TIA Portal. Navigate to HMI tags > Show/Hide > OPC tags.
2. Insert a new OPC DA channel. The default channel name is OPC_DA_1.
3. Set the OPC server entry to OPC.SimaticNET.1.
4. Right-click the channel > New connection. Map each OPC Scout item to a WinCC HMI tag.

7.2 HMI Tag Mapping

For each PLC item:

1. Create a new HMI tag with the desired name (e.g. PLC1_DBW0).
2. Set Connection to the OPC DA connection.
3. Set Item name to the OPC Scout item path (e.g. S7:[HMI_PC_LINE1]PLC1,DB10,W0,1).
4. Select the data type (Word, Int, Real, Bool, etc.) matching the PLC address.

Repeat for all 9 (or more) PLCs. The OPC channel does not enforce the 8-connection cap; only the number of S7 connections the SIMATIC NET license authorizes is relevant.

7.3 WinCC Unified V21 (OPC UA)

WinCC Unified supports OPC UA natively. With SIMATIC NET V21, the OPC UA server endpoint is opc.tcp://<PC>:4840. In the Unified project, add an OPC UA connection and browse the server. Secure communication is mandatory in Unified V21 by default.

8. Certificate Management for WinCC Unified V21

When Secure communication is enabled in the S7-1200 CPU (default in TIA Portal V21 for new devices), the CPU presents a self-signed X.509 certificate to the OPC client. WinCC Unified must trust this certificate or the connection drops with error 0x800B010F (certificate chain untrusted).

Reference: Communication with S7-1500 and S7-1200 (WinCC Unified Runtime, TIA Portal V21)

8.1 Export the PLC Certificate

1. In TIA Portal, open the S7-1200 CPU > Properties > Security > Certificate manager.
2. Select the device certificate and click Export. Save as a .cer file (DER-encoded X.509).
3. Repeat for each S7-1200 CPU (each CPU has its own self-signed cert by default).

8.2 Install the Certificate on the WinCC PC

1. Copy the .cer files to the WinCC PC.
2. Open the certificates MMC: certlm.msc (Local Machine) or import via the WinCC Unified Certificate Administration tool.
3. Import each certificate into Trusted People > Certificates. Use the Place all certificates in the following store option.
4. Restart the WinCC Unified Runtime service to reload the trust store.

8.3 Trust Levels in WinCC Unified

For a 9-PLC deployment where PLCs are at mixed firmware levels (e.g. some V4.4 legacy), leave Legacy communication allowed active during the cutover and tighten security after every CPU is upgraded to V4.6+.

9. Verification Procedure

Use the following sequence to verify the full stack end-to-end:

1. Layer 1 - Physical/PROFINET: From the WinCC PC, ping 192.168.0.101 through ping 192.168.0.109. All must respond with < 1 ms on a dedicated switch segment.
2. Layer 2 - S7 connection: In OPC Scout V10, right-click each S7 connection and read a known tag. If the read returns the expected value with quality Good (0xC0), the S7 connection is healthy.
3. Layer 3 - OPC DA: Use OPC Scout's Read and Write toolbar to exercise a tag. Confirm the value matches the PLC online value in TIA Portal.
4. Layer 4 - WinCC runtime: Activate the WinCC RT project. On a faceplate, force a tag (e.g. PLC1_DBW0 = 1234) and verify it appears in TIA Portal's Watch table on PLC1.
5. Layer 5 - Certificate trust (Unified): Open WinCC Unified's diagnostic log (C:\ProgramData\Siemens\Automation\WinCCUnified\Log). No entries with 0x800B010F should appear.
6. Layer 6 - Load test: In WinCC, force the tag update rate to 250 ms for all 9 PLCs. With 200 tags per CPU, expect OPC server CPU usage < 35% and tag quality Good for > 99.9% of samples over a 1-hour run.

10. Troubleshooting Matrix

11. Performance and Capacity Planning

Each S7-1200 CPU provides up to 16 PG/HMI connection resources (firmware V4.4+). When 9 PLCs each consume 1 connection from the SIMATIC NET OPC server, the per-CPU footprint is minimal, but TIA Portal online, HMI panels, and other engineering clients also count. For a 9-PLC deployment, keep TIA Portal online to one CPU at a time and avoid running parallel WinCC instances on the same OPC server.

12. Migration from Native S7 to OPC Topology

For existing WinCC RT installations already at the 8-connection limit, follow this migration path:

1. Install SIMATIC NET on the WinCC PC alongside the existing WinCC project. No need to uninstall.
2. Create the PC station in TIA Portal as described in section 5.
3. Add OPC items in OPC Scout for one PLC as a pilot.
4. Add a parallel OPC DA channel in WinCC, mapping the new items to new HMI tags. The original S7 channel tags remain for PLCs 1-8.
5. Incrementally move PLCs 1-8 to OPC items over multiple engineering windows.
6. Once all 9+ PLCs are on OPC, retire the native S7 channel and remove the original S7 connection entries from the WinCC project.
7. Re-import certificates on the WinCC PC if using Unified, then re-validate the full tag set with the verification procedure in section 9.

13. Best Practices and Field-Proven Caveats

• Use unique S7 connection names (e.g. PLC1_LineA, PLC2_LineA) so that WinCC tag item names are human-readable in OPC Scout.
• Set the OPC tag update rate to 500 ms - 1 s for monitoring tags. Sub-100 ms update rates saturate the S7-1200 OB1 priority class and starve user code.
• Group tags by DB on the PLC side. A single DB20 with 50 contiguous words consumes 1 OPC item group read instead of 50 individual reads.
• Disable web server on the S7-1200 if unused; it claims a connection resource and CPU cycles.
• Use SCALANCE switch port security to lock the 9 PLC MAC addresses to their ports; prevents rogue devices from spoofing PLC IP and confusing the OPC server.
• Document TSAP pairs in a network map. S7-1200 TSAP changes after firmware updates that reset to factory defaults.
• Schedule certificate renewal. S7-1200 self-signed certs are valid for 5 years; coordinate renewal with the plant's annual outage.